Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
22/08/2023, 15:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
675e2482c2578de01a64426002ab359f_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
675e2482c2578de01a64426002ab359f_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
675e2482c2578de01a64426002ab359f_mafia_JC.exe
-
Size
520KB
-
MD5
675e2482c2578de01a64426002ab359f
-
SHA1
8d785ae061ed20d9467c1f5dbfe5d989e9103663
-
SHA256
f5312b53b2f9385f8ea2e3e9fe2e1f4c203a8e175a4adb13aa324eac5062fc70
-
SHA512
d40e471560ce285e190518a2979edcae61f7f59b3a584db914511e978b3226728895b180083193d1dffb6ca8e384c8f15d70dd5781b7e6b0a6055892616817a0
-
SSDEEP
12288:YcRnG07aWi8m50U6oSuBFkwH4vef2k6NZ:YcI0Bi8m50QdFkwYI6N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1744 CFC3.tmp 924 D07F.tmp 396 D13A.tmp 4976 D244.tmp 4384 D2F0.tmp 2008 D36D.tmp 1644 D438.tmp 4188 D4C5.tmp 2236 D5CE.tmp 4736 D66A.tmp 836 D707.tmp 1868 D7B3.tmp 3612 D83F.tmp 2820 D8CC.tmp 544 DA14.tmp 4884 DADF.tmp 4984 DBAA.tmp 4544 DC56.tmp 1760 DD12.tmp 1876 DE0C.tmp 1404 DE89.tmp 3420 DF34.tmp 524 DFC1.tmp 2400 E08C.tmp 936 E109.tmp 4416 E1A5.tmp 1524 E232.tmp 2052 E2BF.tmp 1232 E35B.tmp 5100 E455.tmp 208 E501.tmp 1956 E57E.tmp 2244 E62A.tmp 4988 E6E5.tmp 1260 E781.tmp 3720 E7DF.tmp 4488 E85C.tmp 4148 E8D9.tmp 8 E956.tmp 4596 E9F2.tmp 3148 EA7F.tmp 3260 EB0C.tmp 1372 EBD7.tmp 2296 EC63.tmp 2424 ED00.tmp 2888 ED8C.tmp 876 EE09.tmp 1732 EE86.tmp 3876 EF23.tmp 4412 EFAF.tmp 4908 F02C.tmp 3092 F0C8.tmp 4608 F155.tmp 1028 F24F.tmp 1780 F2CC.tmp 1032 F359.tmp 2704 F3F5.tmp 4164 F482.tmp 5056 F52D.tmp 4440 F5CA.tmp 4384 F656.tmp 1808 F6D3.tmp 1836 F750.tmp 5048 F7BE.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1780 wrote to memory of 1744 1780 675e2482c2578de01a64426002ab359f_mafia_JC.exe 82 PID 1780 wrote to memory of 1744 1780 675e2482c2578de01a64426002ab359f_mafia_JC.exe 82 PID 1780 wrote to memory of 1744 1780 675e2482c2578de01a64426002ab359f_mafia_JC.exe 82 PID 1744 wrote to memory of 924 1744 CFC3.tmp 83 PID 1744 wrote to memory of 924 1744 CFC3.tmp 83 PID 1744 wrote to memory of 924 1744 CFC3.tmp 83 PID 924 wrote to memory of 396 924 D07F.tmp 84 PID 924 wrote to memory of 396 924 D07F.tmp 84 PID 924 wrote to memory of 396 924 D07F.tmp 84 PID 396 wrote to memory of 4976 396 D13A.tmp 85 PID 396 wrote to memory of 4976 396 D13A.tmp 85 PID 396 wrote to memory of 4976 396 D13A.tmp 85 PID 4976 wrote to memory of 4384 4976 D244.tmp 86 PID 4976 wrote to memory of 4384 4976 D244.tmp 86 PID 4976 wrote to memory of 4384 4976 D244.tmp 86 PID 4384 wrote to memory of 2008 4384 D2F0.tmp 87 PID 4384 wrote to memory of 2008 4384 D2F0.tmp 87 PID 4384 wrote to memory of 2008 4384 D2F0.tmp 87 PID 2008 wrote to memory of 1644 2008 D36D.tmp 88 PID 2008 wrote to memory of 1644 2008 D36D.tmp 88 PID 2008 wrote to memory of 1644 2008 D36D.tmp 88 PID 1644 wrote to memory of 4188 1644 D438.tmp 89 PID 1644 wrote to memory of 4188 1644 D438.tmp 89 PID 1644 wrote to memory of 4188 1644 D438.tmp 89 PID 4188 wrote to memory of 2236 4188 D4C5.tmp 90 PID 4188 wrote to memory of 2236 4188 D4C5.tmp 90 PID 4188 wrote to memory of 2236 4188 D4C5.tmp 90 PID 2236 wrote to memory of 4736 2236 D5CE.tmp 91 PID 2236 wrote to memory of 4736 2236 D5CE.tmp 91 PID 2236 wrote to memory of 4736 2236 D5CE.tmp 91 PID 4736 wrote to memory of 836 4736 D66A.tmp 92 PID 4736 wrote to memory of 836 4736 D66A.tmp 92 PID 4736 wrote to memory of 836 4736 D66A.tmp 92 PID 836 wrote to memory of 1868 836 D707.tmp 93 PID 836 wrote to memory of 1868 836 D707.tmp 93 PID 836 wrote to memory of 1868 836 D707.tmp 93 PID 1868 wrote to memory of 3612 1868 D7B3.tmp 94 PID 1868 wrote to memory of 3612 1868 D7B3.tmp 94 PID 1868 wrote to memory of 3612 1868 D7B3.tmp 94 PID 3612 wrote to memory of 2820 3612 D83F.tmp 95 PID 3612 wrote to memory of 2820 3612 D83F.tmp 95 PID 3612 wrote to memory of 2820 3612 D83F.tmp 95 PID 2820 wrote to memory of 544 2820 D8CC.tmp 98 PID 2820 wrote to memory of 544 2820 D8CC.tmp 98 PID 2820 wrote to memory of 544 2820 D8CC.tmp 98 PID 544 wrote to memory of 4884 544 DA14.tmp 99 PID 544 wrote to memory of 4884 544 DA14.tmp 99 PID 544 wrote to memory of 4884 544 DA14.tmp 99 PID 4884 wrote to memory of 4984 4884 DADF.tmp 100 PID 4884 wrote to memory of 4984 4884 DADF.tmp 100 PID 4884 wrote to memory of 4984 4884 DADF.tmp 100 PID 4984 wrote to memory of 4544 4984 DBAA.tmp 101 PID 4984 wrote to memory of 4544 4984 DBAA.tmp 101 PID 4984 wrote to memory of 4544 4984 DBAA.tmp 101 PID 4544 wrote to memory of 1760 4544 DC56.tmp 102 PID 4544 wrote to memory of 1760 4544 DC56.tmp 102 PID 4544 wrote to memory of 1760 4544 DC56.tmp 102 PID 1760 wrote to memory of 1876 1760 DD12.tmp 103 PID 1760 wrote to memory of 1876 1760 DD12.tmp 103 PID 1760 wrote to memory of 1876 1760 DD12.tmp 103 PID 1876 wrote to memory of 1404 1876 DE0C.tmp 105 PID 1876 wrote to memory of 1404 1876 DE0C.tmp 105 PID 1876 wrote to memory of 1404 1876 DE0C.tmp 105 PID 1404 wrote to memory of 3420 1404 DE89.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\675e2482c2578de01a64426002ab359f_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\675e2482c2578de01a64426002ab359f_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\D07F.tmp"C:\Users\Admin\AppData\Local\Temp\D07F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\D13A.tmp"C:\Users\Admin\AppData\Local\Temp\D13A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\D244.tmp"C:\Users\Admin\AppData\Local\Temp\D244.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\D36D.tmp"C:\Users\Admin\AppData\Local\Temp\D36D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\D438.tmp"C:\Users\Admin\AppData\Local\Temp\D438.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\D4C5.tmp"C:\Users\Admin\AppData\Local\Temp\D4C5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\D5CE.tmp"C:\Users\Admin\AppData\Local\Temp\D5CE.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\D66A.tmp"C:\Users\Admin\AppData\Local\Temp\D66A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\D707.tmp"C:\Users\Admin\AppData\Local\Temp\D707.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\D83F.tmp"C:\Users\Admin\AppData\Local\Temp\D83F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\D8CC.tmp"C:\Users\Admin\AppData\Local\Temp\D8CC.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\DA14.tmp"C:\Users\Admin\AppData\Local\Temp\DA14.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Users\Admin\AppData\Local\Temp\DADF.tmp"C:\Users\Admin\AppData\Local\Temp\DADF.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\DBAA.tmp"C:\Users\Admin\AppData\Local\Temp\DBAA.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\DC56.tmp"C:\Users\Admin\AppData\Local\Temp\DC56.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\DD12.tmp"C:\Users\Admin\AppData\Local\Temp\DD12.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\DE0C.tmp"C:\Users\Admin\AppData\Local\Temp\DE0C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\DE89.tmp"C:\Users\Admin\AppData\Local\Temp\DE89.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\DF34.tmp"C:\Users\Admin\AppData\Local\Temp\DF34.tmp"23⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\DFC1.tmp"C:\Users\Admin\AppData\Local\Temp\DFC1.tmp"24⤵
- Executes dropped EXE
PID:524 -
C:\Users\Admin\AppData\Local\Temp\E08C.tmp"C:\Users\Admin\AppData\Local\Temp\E08C.tmp"25⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\E109.tmp"C:\Users\Admin\AppData\Local\Temp\E109.tmp"26⤵
- Executes dropped EXE
PID:936 -
C:\Users\Admin\AppData\Local\Temp\E1A5.tmp"C:\Users\Admin\AppData\Local\Temp\E1A5.tmp"27⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\E232.tmp"C:\Users\Admin\AppData\Local\Temp\E232.tmp"28⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"29⤵
- Executes dropped EXE
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\E35B.tmp"C:\Users\Admin\AppData\Local\Temp\E35B.tmp"30⤵
- Executes dropped EXE
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\E455.tmp"C:\Users\Admin\AppData\Local\Temp\E455.tmp"31⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\E501.tmp"C:\Users\Admin\AppData\Local\Temp\E501.tmp"32⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\E57E.tmp"C:\Users\Admin\AppData\Local\Temp\E57E.tmp"33⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\E62A.tmp"C:\Users\Admin\AppData\Local\Temp\E62A.tmp"34⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"35⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\E781.tmp"C:\Users\Admin\AppData\Local\Temp\E781.tmp"36⤵
- Executes dropped EXE
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"37⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\E85C.tmp"C:\Users\Admin\AppData\Local\Temp\E85C.tmp"38⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"39⤵
- Executes dropped EXE
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\E956.tmp"C:\Users\Admin\AppData\Local\Temp\E956.tmp"40⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"41⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"42⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"43⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"44⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\EC63.tmp"C:\Users\Admin\AppData\Local\Temp\EC63.tmp"45⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\ED00.tmp"C:\Users\Admin\AppData\Local\Temp\ED00.tmp"46⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"47⤵
- Executes dropped EXE
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\EE09.tmp"C:\Users\Admin\AppData\Local\Temp\EE09.tmp"48⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\EE86.tmp"C:\Users\Admin\AppData\Local\Temp\EE86.tmp"49⤵
- Executes dropped EXE
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\EF23.tmp"C:\Users\Admin\AppData\Local\Temp\EF23.tmp"50⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\EFAF.tmp"C:\Users\Admin\AppData\Local\Temp\EFAF.tmp"51⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\F02C.tmp"C:\Users\Admin\AppData\Local\Temp\F02C.tmp"52⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"53⤵
- Executes dropped EXE
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\F155.tmp"C:\Users\Admin\AppData\Local\Temp\F155.tmp"54⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\F1E2.tmp"C:\Users\Admin\AppData\Local\Temp\F1E2.tmp"55⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\F24F.tmp"C:\Users\Admin\AppData\Local\Temp\F24F.tmp"56⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\F2CC.tmp"C:\Users\Admin\AppData\Local\Temp\F2CC.tmp"57⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\F359.tmp"C:\Users\Admin\AppData\Local\Temp\F359.tmp"58⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\F3F5.tmp"C:\Users\Admin\AppData\Local\Temp\F3F5.tmp"59⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\F482.tmp"C:\Users\Admin\AppData\Local\Temp\F482.tmp"60⤵
- Executes dropped EXE
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\F52D.tmp"C:\Users\Admin\AppData\Local\Temp\F52D.tmp"61⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"62⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\F656.tmp"C:\Users\Admin\AppData\Local\Temp\F656.tmp"63⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"64⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\F750.tmp"C:\Users\Admin\AppData\Local\Temp\F750.tmp"65⤵
- Executes dropped EXE
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\F7BE.tmp"C:\Users\Admin\AppData\Local\Temp\F7BE.tmp"66⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\F82B.tmp"C:\Users\Admin\AppData\Local\Temp\F82B.tmp"67⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\F889.tmp"C:\Users\Admin\AppData\Local\Temp\F889.tmp"68⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\F915.tmp"C:\Users\Admin\AppData\Local\Temp\F915.tmp"69⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\F9A2.tmp"C:\Users\Admin\AppData\Local\Temp\F9A2.tmp"70⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\FA3E.tmp"C:\Users\Admin\AppData\Local\Temp\FA3E.tmp"71⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\FB19.tmp"C:\Users\Admin\AppData\Local\Temp\FB19.tmp"72⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"73⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\FC23.tmp"C:\Users\Admin\AppData\Local\Temp\FC23.tmp"74⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\FCBF.tmp"C:\Users\Admin\AppData\Local\Temp\FCBF.tmp"75⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"76⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"77⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\FE74.tmp"C:\Users\Admin\AppData\Local\Temp\FE74.tmp"78⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\FF01.tmp"C:\Users\Admin\AppData\Local\Temp\FF01.tmp"79⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"80⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"81⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\78.tmp"C:\Users\Admin\AppData\Local\Temp\78.tmp"82⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\D6.tmp"C:\Users\Admin\AppData\Local\Temp\D6.tmp"83⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\162.tmp"C:\Users\Admin\AppData\Local\Temp\162.tmp"84⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\1EF.tmp"C:\Users\Admin\AppData\Local\Temp\1EF.tmp"85⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\27C.tmp"C:\Users\Admin\AppData\Local\Temp\27C.tmp"86⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\2E9.tmp"C:\Users\Admin\AppData\Local\Temp\2E9.tmp"87⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\356.tmp"C:\Users\Admin\AppData\Local\Temp\356.tmp"88⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\3D3.tmp"C:\Users\Admin\AppData\Local\Temp\3D3.tmp"89⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\47F.tmp"C:\Users\Admin\AppData\Local\Temp\47F.tmp"90⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\4FC.tmp"C:\Users\Admin\AppData\Local\Temp\4FC.tmp"91⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\579.tmp"C:\Users\Admin\AppData\Local\Temp\579.tmp"92⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\5F6.tmp"C:\Users\Admin\AppData\Local\Temp\5F6.tmp"93⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\683.tmp"C:\Users\Admin\AppData\Local\Temp\683.tmp"94⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\71F.tmp"C:\Users\Admin\AppData\Local\Temp\71F.tmp"95⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\7AC.tmp"C:\Users\Admin\AppData\Local\Temp\7AC.tmp"96⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\838.tmp"C:\Users\Admin\AppData\Local\Temp\838.tmp"97⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\8C5.tmp"C:\Users\Admin\AppData\Local\Temp\8C5.tmp"98⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\952.tmp"C:\Users\Admin\AppData\Local\Temp\952.tmp"99⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\9DE.tmp"C:\Users\Admin\AppData\Local\Temp\9DE.tmp"100⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\A6B.tmp"C:\Users\Admin\AppData\Local\Temp\A6B.tmp"101⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\AE8.tmp"C:\Users\Admin\AppData\Local\Temp\AE8.tmp"102⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\B75.tmp"C:\Users\Admin\AppData\Local\Temp\B75.tmp"103⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"104⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\C7E.tmp"C:\Users\Admin\AppData\Local\Temp\C7E.tmp"105⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\D1A.tmp"C:\Users\Admin\AppData\Local\Temp\D1A.tmp"106⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\D78.tmp"C:\Users\Admin\AppData\Local\Temp\D78.tmp"107⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\DF5.tmp"C:\Users\Admin\AppData\Local\Temp\DF5.tmp"108⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\E53.tmp"C:\Users\Admin\AppData\Local\Temp\E53.tmp"109⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"110⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\F5D.tmp"C:\Users\Admin\AppData\Local\Temp\F5D.tmp"111⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\1018.tmp"C:\Users\Admin\AppData\Local\Temp\1018.tmp"112⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\10A5.tmp"C:\Users\Admin\AppData\Local\Temp\10A5.tmp"113⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\1122.tmp"C:\Users\Admin\AppData\Local\Temp\1122.tmp"114⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\11AE.tmp"C:\Users\Admin\AppData\Local\Temp\11AE.tmp"115⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\122B.tmp"C:\Users\Admin\AppData\Local\Temp\122B.tmp"116⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\1299.tmp"C:\Users\Admin\AppData\Local\Temp\1299.tmp"117⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\1316.tmp"C:\Users\Admin\AppData\Local\Temp\1316.tmp"118⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\13C2.tmp"C:\Users\Admin\AppData\Local\Temp\13C2.tmp"119⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\143F.tmp"C:\Users\Admin\AppData\Local\Temp\143F.tmp"120⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\14FA.tmp"C:\Users\Admin\AppData\Local\Temp\14FA.tmp"121⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\1577.tmp"C:\Users\Admin\AppData\Local\Temp\1577.tmp"122⤵PID:2360
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-