Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2023, 17:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
61b0acada09cb24d08cb20450dcbf6b4_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
61b0acada09cb24d08cb20450dcbf6b4_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
61b0acada09cb24d08cb20450dcbf6b4_mafia_JC.exe
-
Size
527KB
-
MD5
61b0acada09cb24d08cb20450dcbf6b4
-
SHA1
b093d503ca6f0d8bfa944a0a2da43a21435648cb
-
SHA256
374173b2371395fa3f1195d8975f5a1575d6be93153faa07f7b6d5526bff8269
-
SHA512
c655f685d08dba5c3cf61e25fb9b2ea19f6fe11ac91e61c8eebe325cc859f58970fb036a4239beee39c166ecfecc89d5e6503a0adf1809d968a538b9ee9ee9eb
-
SSDEEP
12288:fU5rCOTeid3HUAiLRNd1LepmtgNurk8erMODZu:fUQOJdkAi/eyKug8eQODo
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2532 9A8A.tmp 2264 9B55.tmp 1984 9C21.tmp 552 9D1B.tmp 4204 9DC6.tmp 4428 9E72.tmp 1496 9F5D.tmp 4196 A047.tmp 1220 A112.tmp 3988 A1DD.tmp 4976 A2D7.tmp 984 A364.tmp 1136 A42F.tmp 3148 A4DB.tmp 3220 A587.tmp 2164 A633.tmp 2008 A72D.tmp 4600 A8F2.tmp 3884 A99E.tmp 4904 AA69.tmp 2552 AB24.tmp 1956 AC0F.tmp 4468 AC8C.tmp 5004 AD47.tmp 4888 ADC4.tmp 1656 AE70.tmp 4640 AF4B.tmp 3512 AFF7.tmp 2996 B093.tmp 2492 B15E.tmp 2568 B248.tmp 3108 B314.tmp 640 B3CF.tmp 228 B43C.tmp 948 B4B9.tmp 4840 B556.tmp 4040 B5F2.tmp 4504 B69E.tmp 4184 B74A.tmp 572 B7E6.tmp 3448 B882.tmp 4284 B90F.tmp 968 B98C.tmp 2100 BA95.tmp 5032 BB80.tmp 2212 BC5B.tmp 1236 BCF7.tmp 4948 BDB2.tmp 3612 BE2F.tmp 224 BEDB.tmp 4012 BF49.tmp 900 BFD5.tmp 4884 C071.tmp 4000 C0DF.tmp 3744 C15C.tmp 404 C1F8.tmp 4788 C294.tmp 2120 C311.tmp 3252 C38E.tmp 1348 C4B7.tmp 2264 C534.tmp 1984 C5D0.tmp 4536 C68C.tmp 3976 C719.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2464 wrote to memory of 2532 2464 61b0acada09cb24d08cb20450dcbf6b4_mafia_JC.exe 81 PID 2464 wrote to memory of 2532 2464 61b0acada09cb24d08cb20450dcbf6b4_mafia_JC.exe 81 PID 2464 wrote to memory of 2532 2464 61b0acada09cb24d08cb20450dcbf6b4_mafia_JC.exe 81 PID 2532 wrote to memory of 2264 2532 9A8A.tmp 82 PID 2532 wrote to memory of 2264 2532 9A8A.tmp 82 PID 2532 wrote to memory of 2264 2532 9A8A.tmp 82 PID 2264 wrote to memory of 1984 2264 9B55.tmp 83 PID 2264 wrote to memory of 1984 2264 9B55.tmp 83 PID 2264 wrote to memory of 1984 2264 9B55.tmp 83 PID 1984 wrote to memory of 552 1984 9C21.tmp 84 PID 1984 wrote to memory of 552 1984 9C21.tmp 84 PID 1984 wrote to memory of 552 1984 9C21.tmp 84 PID 552 wrote to memory of 4204 552 9D1B.tmp 85 PID 552 wrote to memory of 4204 552 9D1B.tmp 85 PID 552 wrote to memory of 4204 552 9D1B.tmp 85 PID 4204 wrote to memory of 4428 4204 9DC6.tmp 86 PID 4204 wrote to memory of 4428 4204 9DC6.tmp 86 PID 4204 wrote to memory of 4428 4204 9DC6.tmp 86 PID 4428 wrote to memory of 1496 4428 9E72.tmp 87 PID 4428 wrote to memory of 1496 4428 9E72.tmp 87 PID 4428 wrote to memory of 1496 4428 9E72.tmp 87 PID 1496 wrote to memory of 4196 1496 9F5D.tmp 88 PID 1496 wrote to memory of 4196 1496 9F5D.tmp 88 PID 1496 wrote to memory of 4196 1496 9F5D.tmp 88 PID 4196 wrote to memory of 1220 4196 A047.tmp 89 PID 4196 wrote to memory of 1220 4196 A047.tmp 89 PID 4196 wrote to memory of 1220 4196 A047.tmp 89 PID 1220 wrote to memory of 3988 1220 A112.tmp 90 PID 1220 wrote to memory of 3988 1220 A112.tmp 90 PID 1220 wrote to memory of 3988 1220 A112.tmp 90 PID 3988 wrote to memory of 4976 3988 A1DD.tmp 92 PID 3988 wrote to memory of 4976 3988 A1DD.tmp 92 PID 3988 wrote to memory of 4976 3988 A1DD.tmp 92 PID 4976 wrote to memory of 984 4976 A2D7.tmp 93 PID 4976 wrote to memory of 984 4976 A2D7.tmp 93 PID 4976 wrote to memory of 984 4976 A2D7.tmp 93 PID 984 wrote to memory of 1136 984 A364.tmp 94 PID 984 wrote to memory of 1136 984 A364.tmp 94 PID 984 wrote to memory of 1136 984 A364.tmp 94 PID 1136 wrote to memory of 3148 1136 A42F.tmp 95 PID 1136 wrote to memory of 3148 1136 A42F.tmp 95 PID 1136 wrote to memory of 3148 1136 A42F.tmp 95 PID 3148 wrote to memory of 3220 3148 A4DB.tmp 96 PID 3148 wrote to memory of 3220 3148 A4DB.tmp 96 PID 3148 wrote to memory of 3220 3148 A4DB.tmp 96 PID 3220 wrote to memory of 2164 3220 A587.tmp 97 PID 3220 wrote to memory of 2164 3220 A587.tmp 97 PID 3220 wrote to memory of 2164 3220 A587.tmp 97 PID 2164 wrote to memory of 2008 2164 A633.tmp 98 PID 2164 wrote to memory of 2008 2164 A633.tmp 98 PID 2164 wrote to memory of 2008 2164 A633.tmp 98 PID 2008 wrote to memory of 4600 2008 A72D.tmp 99 PID 2008 wrote to memory of 4600 2008 A72D.tmp 99 PID 2008 wrote to memory of 4600 2008 A72D.tmp 99 PID 4600 wrote to memory of 3884 4600 A8F2.tmp 100 PID 4600 wrote to memory of 3884 4600 A8F2.tmp 100 PID 4600 wrote to memory of 3884 4600 A8F2.tmp 100 PID 3884 wrote to memory of 4904 3884 A99E.tmp 101 PID 3884 wrote to memory of 4904 3884 A99E.tmp 101 PID 3884 wrote to memory of 4904 3884 A99E.tmp 101 PID 4904 wrote to memory of 2552 4904 AA69.tmp 102 PID 4904 wrote to memory of 2552 4904 AA69.tmp 102 PID 4904 wrote to memory of 2552 4904 AA69.tmp 102 PID 2552 wrote to memory of 1956 2552 AB24.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\61b0acada09cb24d08cb20450dcbf6b4_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\61b0acada09cb24d08cb20450dcbf6b4_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\9C21.tmp"C:\Users\Admin\AppData\Local\Temp\9C21.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\9E72.tmp"C:\Users\Admin\AppData\Local\Temp\9E72.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\A047.tmp"C:\Users\Admin\AppData\Local\Temp\A047.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\A112.tmp"C:\Users\Admin\AppData\Local\Temp\A112.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\A364.tmp"C:\Users\Admin\AppData\Local\Temp\A364.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\A633.tmp"C:\Users\Admin\AppData\Local\Temp\A633.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\A99E.tmp"C:\Users\Admin\AppData\Local\Temp\A99E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\AA69.tmp"C:\Users\Admin\AppData\Local\Temp\AA69.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"23⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"24⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"25⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"26⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\AE70.tmp"C:\Users\Admin\AppData\Local\Temp\AE70.tmp"27⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"28⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"29⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\B093.tmp"C:\Users\Admin\AppData\Local\Temp\B093.tmp"30⤵
- Executes dropped EXE
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\B15E.tmp"C:\Users\Admin\AppData\Local\Temp\B15E.tmp"31⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"32⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\B314.tmp"C:\Users\Admin\AppData\Local\Temp\B314.tmp"33⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"34⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\B43C.tmp"C:\Users\Admin\AppData\Local\Temp\B43C.tmp"35⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"36⤵
- Executes dropped EXE
PID:948 -
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"37⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"38⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\B69E.tmp"C:\Users\Admin\AppData\Local\Temp\B69E.tmp"39⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\B74A.tmp"C:\Users\Admin\AppData\Local\Temp\B74A.tmp"40⤵
- Executes dropped EXE
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"41⤵
- Executes dropped EXE
PID:572 -
C:\Users\Admin\AppData\Local\Temp\B882.tmp"C:\Users\Admin\AppData\Local\Temp\B882.tmp"42⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\B90F.tmp"C:\Users\Admin\AppData\Local\Temp\B90F.tmp"43⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\B98C.tmp"C:\Users\Admin\AppData\Local\Temp\B98C.tmp"44⤵
- Executes dropped EXE
PID:968 -
C:\Users\Admin\AppData\Local\Temp\BA95.tmp"C:\Users\Admin\AppData\Local\Temp\BA95.tmp"45⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\BB80.tmp"C:\Users\Admin\AppData\Local\Temp\BB80.tmp"46⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"47⤵
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"48⤵
- Executes dropped EXE
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"49⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"50⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"51⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\BF49.tmp"C:\Users\Admin\AppData\Local\Temp\BF49.tmp"52⤵
- Executes dropped EXE
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"53⤵
- Executes dropped EXE
PID:900 -
C:\Users\Admin\AppData\Local\Temp\C071.tmp"C:\Users\Admin\AppData\Local\Temp\C071.tmp"54⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"55⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"56⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"57⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\C294.tmp"C:\Users\Admin\AppData\Local\Temp\C294.tmp"58⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\C311.tmp"C:\Users\Admin\AppData\Local\Temp\C311.tmp"59⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\C38E.tmp"C:\Users\Admin\AppData\Local\Temp\C38E.tmp"60⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"61⤵
- Executes dropped EXE
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\C534.tmp"C:\Users\Admin\AppData\Local\Temp\C534.tmp"62⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"63⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\C68C.tmp"C:\Users\Admin\AppData\Local\Temp\C68C.tmp"64⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\C719.tmp"C:\Users\Admin\AppData\Local\Temp\C719.tmp"65⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\C796.tmp"C:\Users\Admin\AppData\Local\Temp\C796.tmp"66⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\C822.tmp"C:\Users\Admin\AppData\Local\Temp\C822.tmp"67⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"68⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\C93B.tmp"C:\Users\Admin\AppData\Local\Temp\C93B.tmp"69⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\C9C8.tmp"C:\Users\Admin\AppData\Local\Temp\C9C8.tmp"70⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\CA45.tmp"C:\Users\Admin\AppData\Local\Temp\CA45.tmp"71⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"72⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"73⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\CBAC.tmp"C:\Users\Admin\AppData\Local\Temp\CBAC.tmp"74⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\CC49.tmp"C:\Users\Admin\AppData\Local\Temp\CC49.tmp"75⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"76⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\CD62.tmp"C:\Users\Admin\AppData\Local\Temp\CD62.tmp"77⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\CDEF.tmp"C:\Users\Admin\AppData\Local\Temp\CDEF.tmp"78⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"79⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\CF37.tmp"C:\Users\Admin\AppData\Local\Temp\CF37.tmp"80⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"81⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\D021.tmp"C:\Users\Admin\AppData\Local\Temp\D021.tmp"82⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"83⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\D12B.tmp"C:\Users\Admin\AppData\Local\Temp\D12B.tmp"84⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\D1B7.tmp"C:\Users\Admin\AppData\Local\Temp\D1B7.tmp"85⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\D254.tmp"C:\Users\Admin\AppData\Local\Temp\D254.tmp"86⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"87⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\D35D.tmp"C:\Users\Admin\AppData\Local\Temp\D35D.tmp"88⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\D3CB.tmp"C:\Users\Admin\AppData\Local\Temp\D3CB.tmp"89⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\D467.tmp"C:\Users\Admin\AppData\Local\Temp\D467.tmp"90⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\D4D4.tmp"C:\Users\Admin\AppData\Local\Temp\D4D4.tmp"91⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\D542.tmp"C:\Users\Admin\AppData\Local\Temp\D542.tmp"92⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\D59F.tmp"C:\Users\Admin\AppData\Local\Temp\D59F.tmp"93⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\D62C.tmp"C:\Users\Admin\AppData\Local\Temp\D62C.tmp"94⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"95⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"96⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\D8CC.tmp"C:\Users\Admin\AppData\Local\Temp\D8CC.tmp"97⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\D987.tmp"C:\Users\Admin\AppData\Local\Temp\D987.tmp"98⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\DA33.tmp"C:\Users\Admin\AppData\Local\Temp\DA33.tmp"99⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\DACF.tmp"C:\Users\Admin\AppData\Local\Temp\DACF.tmp"100⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\DB4C.tmp"C:\Users\Admin\AppData\Local\Temp\DB4C.tmp"101⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\DBE9.tmp"C:\Users\Admin\AppData\Local\Temp\DBE9.tmp"102⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\DC85.tmp"C:\Users\Admin\AppData\Local\Temp\DC85.tmp"103⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\DD21.tmp"C:\Users\Admin\AppData\Local\Temp\DD21.tmp"104⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"105⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\DE4A.tmp"C:\Users\Admin\AppData\Local\Temp\DE4A.tmp"106⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\DED7.tmp"C:\Users\Admin\AppData\Local\Temp\DED7.tmp"107⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\DF54.tmp"C:\Users\Admin\AppData\Local\Temp\DF54.tmp"108⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\E01F.tmp"C:\Users\Admin\AppData\Local\Temp\E01F.tmp"109⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\E0CB.tmp"C:\Users\Admin\AppData\Local\Temp\E0CB.tmp"110⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\E148.tmp"C:\Users\Admin\AppData\Local\Temp\E148.tmp"111⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\E1D4.tmp"C:\Users\Admin\AppData\Local\Temp\E1D4.tmp"112⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\E271.tmp"C:\Users\Admin\AppData\Local\Temp\E271.tmp"113⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\E30D.tmp"C:\Users\Admin\AppData\Local\Temp\E30D.tmp"114⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\E38A.tmp"C:\Users\Admin\AppData\Local\Temp\E38A.tmp"115⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\E426.tmp"C:\Users\Admin\AppData\Local\Temp\E426.tmp"116⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\E4B3.tmp"C:\Users\Admin\AppData\Local\Temp\E4B3.tmp"117⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\E53F.tmp"C:\Users\Admin\AppData\Local\Temp\E53F.tmp"118⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"119⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\E649.tmp"C:\Users\Admin\AppData\Local\Temp\E649.tmp"120⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"121⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\E762.tmp"C:\Users\Admin\AppData\Local\Temp\E762.tmp"122⤵PID:2532
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-