Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
20/08/2023, 09:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4d2e339d70e043915e32f45a9b5312dc_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
4d2e339d70e043915e32f45a9b5312dc_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
4d2e339d70e043915e32f45a9b5312dc_mafia_JC.exe
-
Size
488KB
-
MD5
4d2e339d70e043915e32f45a9b5312dc
-
SHA1
c75163ca665bfc98005240101437a1d994ab3ebe
-
SHA256
4c7af3a561a8de6f1f17cfe26695e16bdb1be6ad70b2af400d396c6616b557cd
-
SHA512
0a08bbc153e8e8156099b82eb55e1ba13268e9d4a8244de79af44aa0470ec838eb0c27bb6575ecc902621d4c4f64fb28e7a450f8a3538ce0c59ea66502df1771
-
SSDEEP
12288:/U5rCOTeiDY7BVzdb8g7ZX/N/aSqofB+NZ:/UQOJDY7bZYMX/96xN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4828 B5F2.tmp 3456 B6AD.tmp 4884 B74A.tmp 3424 B7F6.tmp 416 B8C1.tmp 5084 B96D.tmp 4300 BA47.tmp 456 BB03.tmp 4164 BBCE.tmp 4740 BC7A.tmp 340 BD16.tmp 1080 BDC2.tmp 4404 BEBC.tmp 2848 BF68.tmp 1124 C014.tmp 1568 C0CF.tmp 1956 C17B.tmp 3044 C35F.tmp 4232 C40B.tmp 3244 C4F6.tmp 5008 C5B1.tmp 4056 C65D.tmp 4048 C719.tmp 2936 C7F3.tmp 3880 C89F.tmp 5060 C999.tmp 3352 CA45.tmp 2612 CAE1.tmp 2780 CB7E.tmp 4980 CC29.tmp 4316 CD14.tmp 3224 CDCF.tmp 4880 CEE9.tmp 4152 CF75.tmp 2340 D031.tmp 1788 D0CD.tmp 5108 D169.tmp 4408 D205.tmp 2336 D2A2.tmp 5024 D30F.tmp 1664 D39C.tmp 2660 D448.tmp 1988 D590.tmp 2880 D65B.tmp 568 D716.tmp 2456 D7C2.tmp 4392 D85E.tmp 680 D8FB.tmp 1508 D987.tmp 2712 DA72.tmp 3388 DB1E.tmp 4068 DBE9.tmp 1348 DC75.tmp 3172 DCF2.tmp 668 DDAE.tmp 4788 DE2B.tmp 3656 DED7.tmp 4508 DF63.tmp 3384 DFF0.tmp 1388 E0AB.tmp 3448 E119.tmp 636 E196.tmp 4300 E232.tmp 456 E290.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1420 wrote to memory of 4828 1420 4d2e339d70e043915e32f45a9b5312dc_mafia_JC.exe 80 PID 1420 wrote to memory of 4828 1420 4d2e339d70e043915e32f45a9b5312dc_mafia_JC.exe 80 PID 1420 wrote to memory of 4828 1420 4d2e339d70e043915e32f45a9b5312dc_mafia_JC.exe 80 PID 4828 wrote to memory of 3456 4828 B5F2.tmp 81 PID 4828 wrote to memory of 3456 4828 B5F2.tmp 81 PID 4828 wrote to memory of 3456 4828 B5F2.tmp 81 PID 3456 wrote to memory of 4884 3456 B6AD.tmp 82 PID 3456 wrote to memory of 4884 3456 B6AD.tmp 82 PID 3456 wrote to memory of 4884 3456 B6AD.tmp 82 PID 4884 wrote to memory of 3424 4884 B74A.tmp 83 PID 4884 wrote to memory of 3424 4884 B74A.tmp 83 PID 4884 wrote to memory of 3424 4884 B74A.tmp 83 PID 3424 wrote to memory of 416 3424 B7F6.tmp 84 PID 3424 wrote to memory of 416 3424 B7F6.tmp 84 PID 3424 wrote to memory of 416 3424 B7F6.tmp 84 PID 416 wrote to memory of 5084 416 B8C1.tmp 85 PID 416 wrote to memory of 5084 416 B8C1.tmp 85 PID 416 wrote to memory of 5084 416 B8C1.tmp 85 PID 5084 wrote to memory of 4300 5084 B96D.tmp 86 PID 5084 wrote to memory of 4300 5084 B96D.tmp 86 PID 5084 wrote to memory of 4300 5084 B96D.tmp 86 PID 4300 wrote to memory of 456 4300 BA47.tmp 87 PID 4300 wrote to memory of 456 4300 BA47.tmp 87 PID 4300 wrote to memory of 456 4300 BA47.tmp 87 PID 456 wrote to memory of 4164 456 BB03.tmp 88 PID 456 wrote to memory of 4164 456 BB03.tmp 88 PID 456 wrote to memory of 4164 456 BB03.tmp 88 PID 4164 wrote to memory of 4740 4164 BBCE.tmp 90 PID 4164 wrote to memory of 4740 4164 BBCE.tmp 90 PID 4164 wrote to memory of 4740 4164 BBCE.tmp 90 PID 4740 wrote to memory of 340 4740 BC7A.tmp 91 PID 4740 wrote to memory of 340 4740 BC7A.tmp 91 PID 4740 wrote to memory of 340 4740 BC7A.tmp 91 PID 340 wrote to memory of 1080 340 BD16.tmp 92 PID 340 wrote to memory of 1080 340 BD16.tmp 92 PID 340 wrote to memory of 1080 340 BD16.tmp 92 PID 1080 wrote to memory of 4404 1080 BDC2.tmp 93 PID 1080 wrote to memory of 4404 1080 BDC2.tmp 93 PID 1080 wrote to memory of 4404 1080 BDC2.tmp 93 PID 4404 wrote to memory of 2848 4404 BEBC.tmp 94 PID 4404 wrote to memory of 2848 4404 BEBC.tmp 94 PID 4404 wrote to memory of 2848 4404 BEBC.tmp 94 PID 2848 wrote to memory of 1124 2848 BF68.tmp 95 PID 2848 wrote to memory of 1124 2848 BF68.tmp 95 PID 2848 wrote to memory of 1124 2848 BF68.tmp 95 PID 1124 wrote to memory of 1568 1124 C014.tmp 96 PID 1124 wrote to memory of 1568 1124 C014.tmp 96 PID 1124 wrote to memory of 1568 1124 C014.tmp 96 PID 1568 wrote to memory of 1956 1568 C0CF.tmp 97 PID 1568 wrote to memory of 1956 1568 C0CF.tmp 97 PID 1568 wrote to memory of 1956 1568 C0CF.tmp 97 PID 1956 wrote to memory of 3044 1956 C17B.tmp 98 PID 1956 wrote to memory of 3044 1956 C17B.tmp 98 PID 1956 wrote to memory of 3044 1956 C17B.tmp 98 PID 3044 wrote to memory of 4232 3044 C35F.tmp 101 PID 3044 wrote to memory of 4232 3044 C35F.tmp 101 PID 3044 wrote to memory of 4232 3044 C35F.tmp 101 PID 4232 wrote to memory of 3244 4232 C40B.tmp 102 PID 4232 wrote to memory of 3244 4232 C40B.tmp 102 PID 4232 wrote to memory of 3244 4232 C40B.tmp 102 PID 3244 wrote to memory of 5008 3244 C4F6.tmp 103 PID 3244 wrote to memory of 5008 3244 C4F6.tmp 103 PID 3244 wrote to memory of 5008 3244 C4F6.tmp 103 PID 5008 wrote to memory of 4056 5008 C5B1.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d2e339d70e043915e32f45a9b5312dc_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\4d2e339d70e043915e32f45a9b5312dc_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\B74A.tmp"C:\Users\Admin\AppData\Local\Temp\B74A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Users\Admin\AppData\Local\Temp\B96D.tmp"C:\Users\Admin\AppData\Local\Temp\B96D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\BA47.tmp"C:\Users\Admin\AppData\Local\Temp\BA47.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\BB03.tmp"C:\Users\Admin\AppData\Local\Temp\BB03.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\BD16.tmp"C:\Users\Admin\AppData\Local\Temp\BD16.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:340 -
C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\BF68.tmp"C:\Users\Admin\AppData\Local\Temp\BF68.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\C014.tmp"C:\Users\Admin\AppData\Local\Temp\C014.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\C17B.tmp"C:\Users\Admin\AppData\Local\Temp\C17B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\C35F.tmp"C:\Users\Admin\AppData\Local\Temp\C35F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\C40B.tmp"C:\Users\Admin\AppData\Local\Temp\C40B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\C65D.tmp"C:\Users\Admin\AppData\Local\Temp\C65D.tmp"23⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\C719.tmp"C:\Users\Admin\AppData\Local\Temp\C719.tmp"24⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"25⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\C89F.tmp"C:\Users\Admin\AppData\Local\Temp\C89F.tmp"26⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\C999.tmp"C:\Users\Admin\AppData\Local\Temp\C999.tmp"27⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\CA45.tmp"C:\Users\Admin\AppData\Local\Temp\CA45.tmp"28⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"29⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"30⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\CC29.tmp"C:\Users\Admin\AppData\Local\Temp\CC29.tmp"31⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\CD14.tmp"C:\Users\Admin\AppData\Local\Temp\CD14.tmp"32⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"33⤵
- Executes dropped EXE
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\CEE9.tmp"C:\Users\Admin\AppData\Local\Temp\CEE9.tmp"34⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\CF75.tmp"C:\Users\Admin\AppData\Local\Temp\CF75.tmp"35⤵
- Executes dropped EXE
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\D031.tmp"C:\Users\Admin\AppData\Local\Temp\D031.tmp"36⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"37⤵
- Executes dropped EXE
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\D169.tmp"C:\Users\Admin\AppData\Local\Temp\D169.tmp"38⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\D205.tmp"C:\Users\Admin\AppData\Local\Temp\D205.tmp"39⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\D2A2.tmp"C:\Users\Admin\AppData\Local\Temp\D2A2.tmp"40⤵
- Executes dropped EXE
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\D30F.tmp"C:\Users\Admin\AppData\Local\Temp\D30F.tmp"41⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\D39C.tmp"C:\Users\Admin\AppData\Local\Temp\D39C.tmp"42⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\D448.tmp"C:\Users\Admin\AppData\Local\Temp\D448.tmp"43⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\D590.tmp"C:\Users\Admin\AppData\Local\Temp\D590.tmp"44⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\D65B.tmp"C:\Users\Admin\AppData\Local\Temp\D65B.tmp"45⤵
- Executes dropped EXE
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\D716.tmp"C:\Users\Admin\AppData\Local\Temp\D716.tmp"46⤵
- Executes dropped EXE
PID:568 -
C:\Users\Admin\AppData\Local\Temp\D7C2.tmp"C:\Users\Admin\AppData\Local\Temp\D7C2.tmp"47⤵
- Executes dropped EXE
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\D85E.tmp"C:\Users\Admin\AppData\Local\Temp\D85E.tmp"48⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\D8FB.tmp"C:\Users\Admin\AppData\Local\Temp\D8FB.tmp"49⤵
- Executes dropped EXE
PID:680 -
C:\Users\Admin\AppData\Local\Temp\D987.tmp"C:\Users\Admin\AppData\Local\Temp\D987.tmp"50⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\DA72.tmp"C:\Users\Admin\AppData\Local\Temp\DA72.tmp"51⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"52⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\DBE9.tmp"C:\Users\Admin\AppData\Local\Temp\DBE9.tmp"53⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\DC75.tmp"C:\Users\Admin\AppData\Local\Temp\DC75.tmp"54⤵
- Executes dropped EXE
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\DCF2.tmp"C:\Users\Admin\AppData\Local\Temp\DCF2.tmp"55⤵
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"56⤵
- Executes dropped EXE
PID:668 -
C:\Users\Admin\AppData\Local\Temp\DE2B.tmp"C:\Users\Admin\AppData\Local\Temp\DE2B.tmp"57⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\DED7.tmp"C:\Users\Admin\AppData\Local\Temp\DED7.tmp"58⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\DF63.tmp"C:\Users\Admin\AppData\Local\Temp\DF63.tmp"59⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"60⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\E0AB.tmp"C:\Users\Admin\AppData\Local\Temp\E0AB.tmp"61⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\E119.tmp"C:\Users\Admin\AppData\Local\Temp\E119.tmp"62⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\E196.tmp"C:\Users\Admin\AppData\Local\Temp\E196.tmp"63⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\E232.tmp"C:\Users\Admin\AppData\Local\Temp\E232.tmp"64⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\E290.tmp"C:\Users\Admin\AppData\Local\Temp\E290.tmp"65⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\E2EE.tmp"C:\Users\Admin\AppData\Local\Temp\E2EE.tmp"66⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\E37A.tmp"C:\Users\Admin\AppData\Local\Temp\E37A.tmp"67⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\E3E8.tmp"C:\Users\Admin\AppData\Local\Temp\E3E8.tmp"68⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\E493.tmp"C:\Users\Admin\AppData\Local\Temp\E493.tmp"69⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\E54F.tmp"C:\Users\Admin\AppData\Local\Temp\E54F.tmp"70⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"71⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\E659.tmp"C:\Users\Admin\AppData\Local\Temp\E659.tmp"72⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"73⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\E753.tmp"C:\Users\Admin\AppData\Local\Temp\E753.tmp"74⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"75⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\E87B.tmp"C:\Users\Admin\AppData\Local\Temp\E87B.tmp"76⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\E908.tmp"C:\Users\Admin\AppData\Local\Temp\E908.tmp"77⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"78⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\EA21.tmp"C:\Users\Admin\AppData\Local\Temp\EA21.tmp"79⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\EABE.tmp"C:\Users\Admin\AppData\Local\Temp\EABE.tmp"80⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\EB3B.tmp"C:\Users\Admin\AppData\Local\Temp\EB3B.tmp"81⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"82⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\EC44.tmp"C:\Users\Admin\AppData\Local\Temp\EC44.tmp"83⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\ECE0.tmp"C:\Users\Admin\AppData\Local\Temp\ECE0.tmp"84⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"85⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\EE09.tmp"C:\Users\Admin\AppData\Local\Temp\EE09.tmp"86⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\EE67.tmp"C:\Users\Admin\AppData\Local\Temp\EE67.tmp"87⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\EF03.tmp"C:\Users\Admin\AppData\Local\Temp\EF03.tmp"88⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\EFA0.tmp"C:\Users\Admin\AppData\Local\Temp\EFA0.tmp"89⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\F04B.tmp"C:\Users\Admin\AppData\Local\Temp\F04B.tmp"90⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"91⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\F155.tmp"C:\Users\Admin\AppData\Local\Temp\F155.tmp"92⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\F201.tmp"C:\Users\Admin\AppData\Local\Temp\F201.tmp"93⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\F28E.tmp"C:\Users\Admin\AppData\Local\Temp\F28E.tmp"94⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\F32A.tmp"C:\Users\Admin\AppData\Local\Temp\F32A.tmp"95⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\F3D6.tmp"C:\Users\Admin\AppData\Local\Temp\F3D6.tmp"96⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"97⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\F54D.tmp"C:\Users\Admin\AppData\Local\Temp\F54D.tmp"98⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"99⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\F666.tmp"C:\Users\Admin\AppData\Local\Temp\F666.tmp"100⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\F712.tmp"C:\Users\Admin\AppData\Local\Temp\F712.tmp"101⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\F79E.tmp"C:\Users\Admin\AppData\Local\Temp\F79E.tmp"102⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\F80C.tmp"C:\Users\Admin\AppData\Local\Temp\F80C.tmp"103⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\F889.tmp"C:\Users\Admin\AppData\Local\Temp\F889.tmp"104⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\F925.tmp"C:\Users\Admin\AppData\Local\Temp\F925.tmp"105⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\F9F0.tmp"C:\Users\Admin\AppData\Local\Temp\F9F0.tmp"106⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"107⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"108⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"109⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\FC42.tmp"C:\Users\Admin\AppData\Local\Temp\FC42.tmp"110⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"111⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\FDD8.tmp"C:\Users\Admin\AppData\Local\Temp\FDD8.tmp"112⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\FE74.tmp"C:\Users\Admin\AppData\Local\Temp\FE74.tmp"113⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\FF20.tmp"C:\Users\Admin\AppData\Local\Temp\FF20.tmp"114⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"115⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A.tmp"116⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\E5.tmp"C:\Users\Admin\AppData\Local\Temp\E5.tmp"117⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\191.tmp"C:\Users\Admin\AppData\Local\Temp\191.tmp"118⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\20E.tmp"C:\Users\Admin\AppData\Local\Temp\20E.tmp"119⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\2AB.tmp"C:\Users\Admin\AppData\Local\Temp\2AB.tmp"120⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\337.tmp"C:\Users\Admin\AppData\Local\Temp\337.tmp"121⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\3C4.tmp"C:\Users\Admin\AppData\Local\Temp\3C4.tmp"122⤵PID:3384
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-