Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
22/08/2023, 17:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6eb4baeef96ef4247b041ebae7eadf4a_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
6eb4baeef96ef4247b041ebae7eadf4a_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
6eb4baeef96ef4247b041ebae7eadf4a_mafia_JC.exe
-
Size
520KB
-
MD5
6eb4baeef96ef4247b041ebae7eadf4a
-
SHA1
317ec73d3775845ac098a0e99a5f71361975b0bf
-
SHA256
c25e77881533bec1dd0daa1ddea017b836d87b2b77621bf27240fa640ee021ce
-
SHA512
6c80a63d4133552527374f743b54f8668ec66ef40b4d4c39b691b7e32aa732ffc46e2e51eb22d3708d911a6b05dc01e7460802ec3dbac8ecae26abfe28799d51
-
SSDEEP
12288:0q5XOi3U+BUvLvSESPepyA2k+mvoJPoXJJKPpE1wcYcRNZ:0qYi3BK2ZnJPxPpE1woN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1232 B19D.tmp 3632 B297.tmp 5072 B391.tmp 3680 B49A.tmp 3000 B594.tmp 3088 B65F.tmp 1932 B70B.tmp 4848 B7B7.tmp 3408 B882.tmp 4256 B90F.tmp 3180 BA09.tmp 1828 BB41.tmp 4336 BC3B.tmp 4796 BCD8.tmp 1840 BD74.tmp 3236 BE20.tmp 1148 BF29.tmp 4888 C052.tmp 2988 C0EE.tmp 4740 C1AA.tmp 3812 C265.tmp 2148 C2F2.tmp 3344 C39E.tmp 1908 C459.tmp 3376 C4E6.tmp 4444 C573.tmp 5104 C62E.tmp 376 C6AB.tmp 3188 C747.tmp 624 C7F3.tmp 4668 C8DE.tmp 1016 C98A.tmp 3496 CA84.tmp 3576 CAE1.tmp 4784 CB6E.tmp 3800 CBEB.tmp 2336 CC87.tmp 1724 CD14.tmp 4660 CDC0.tmp 2576 CE4C.tmp 4044 CEE9.tmp 1480 CF94.tmp 4616 D031.tmp 1816 D0BD.tmp 3768 D14A.tmp 4700 D1C7.tmp 3752 D244.tmp 2468 D2C1.tmp 3664 D36D.tmp 4628 D409.tmp 1300 D4A5.tmp 3108 D522.tmp 4744 D61C.tmp 5056 D6B9.tmp 3592 D745.tmp 2380 D7D2.tmp 4764 D88D.tmp 5036 D92A.tmp 3632 D9B6.tmp 3016 DA43.tmp 220 DADF.tmp 3000 DB7B.tmp 4836 DBE9.tmp 2212 DC46.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2380 wrote to memory of 1232 2380 6eb4baeef96ef4247b041ebae7eadf4a_mafia_JC.exe 83 PID 2380 wrote to memory of 1232 2380 6eb4baeef96ef4247b041ebae7eadf4a_mafia_JC.exe 83 PID 2380 wrote to memory of 1232 2380 6eb4baeef96ef4247b041ebae7eadf4a_mafia_JC.exe 83 PID 1232 wrote to memory of 3632 1232 B19D.tmp 84 PID 1232 wrote to memory of 3632 1232 B19D.tmp 84 PID 1232 wrote to memory of 3632 1232 B19D.tmp 84 PID 3632 wrote to memory of 5072 3632 B297.tmp 85 PID 3632 wrote to memory of 5072 3632 B297.tmp 85 PID 3632 wrote to memory of 5072 3632 B297.tmp 85 PID 5072 wrote to memory of 3680 5072 B391.tmp 86 PID 5072 wrote to memory of 3680 5072 B391.tmp 86 PID 5072 wrote to memory of 3680 5072 B391.tmp 86 PID 3680 wrote to memory of 3000 3680 B49A.tmp 87 PID 3680 wrote to memory of 3000 3680 B49A.tmp 87 PID 3680 wrote to memory of 3000 3680 B49A.tmp 87 PID 3000 wrote to memory of 3088 3000 B594.tmp 88 PID 3000 wrote to memory of 3088 3000 B594.tmp 88 PID 3000 wrote to memory of 3088 3000 B594.tmp 88 PID 3088 wrote to memory of 1932 3088 B65F.tmp 89 PID 3088 wrote to memory of 1932 3088 B65F.tmp 89 PID 3088 wrote to memory of 1932 3088 B65F.tmp 89 PID 1932 wrote to memory of 4848 1932 B70B.tmp 90 PID 1932 wrote to memory of 4848 1932 B70B.tmp 90 PID 1932 wrote to memory of 4848 1932 B70B.tmp 90 PID 4848 wrote to memory of 3408 4848 B7B7.tmp 91 PID 4848 wrote to memory of 3408 4848 B7B7.tmp 91 PID 4848 wrote to memory of 3408 4848 B7B7.tmp 91 PID 3408 wrote to memory of 4256 3408 B882.tmp 92 PID 3408 wrote to memory of 4256 3408 B882.tmp 92 PID 3408 wrote to memory of 4256 3408 B882.tmp 92 PID 4256 wrote to memory of 3180 4256 B90F.tmp 93 PID 4256 wrote to memory of 3180 4256 B90F.tmp 93 PID 4256 wrote to memory of 3180 4256 B90F.tmp 93 PID 3180 wrote to memory of 1828 3180 BA09.tmp 94 PID 3180 wrote to memory of 1828 3180 BA09.tmp 94 PID 3180 wrote to memory of 1828 3180 BA09.tmp 94 PID 1828 wrote to memory of 4336 1828 BB41.tmp 95 PID 1828 wrote to memory of 4336 1828 BB41.tmp 95 PID 1828 wrote to memory of 4336 1828 BB41.tmp 95 PID 4336 wrote to memory of 4796 4336 BC3B.tmp 96 PID 4336 wrote to memory of 4796 4336 BC3B.tmp 96 PID 4336 wrote to memory of 4796 4336 BC3B.tmp 96 PID 4796 wrote to memory of 1840 4796 BCD8.tmp 97 PID 4796 wrote to memory of 1840 4796 BCD8.tmp 97 PID 4796 wrote to memory of 1840 4796 BCD8.tmp 97 PID 1840 wrote to memory of 3236 1840 BD74.tmp 98 PID 1840 wrote to memory of 3236 1840 BD74.tmp 98 PID 1840 wrote to memory of 3236 1840 BD74.tmp 98 PID 3236 wrote to memory of 1148 3236 BE20.tmp 101 PID 3236 wrote to memory of 1148 3236 BE20.tmp 101 PID 3236 wrote to memory of 1148 3236 BE20.tmp 101 PID 1148 wrote to memory of 4888 1148 BF29.tmp 102 PID 1148 wrote to memory of 4888 1148 BF29.tmp 102 PID 1148 wrote to memory of 4888 1148 BF29.tmp 102 PID 4888 wrote to memory of 2988 4888 C052.tmp 103 PID 4888 wrote to memory of 2988 4888 C052.tmp 103 PID 4888 wrote to memory of 2988 4888 C052.tmp 103 PID 2988 wrote to memory of 4740 2988 C0EE.tmp 104 PID 2988 wrote to memory of 4740 2988 C0EE.tmp 104 PID 2988 wrote to memory of 4740 2988 C0EE.tmp 104 PID 4740 wrote to memory of 3812 4740 C1AA.tmp 105 PID 4740 wrote to memory of 3812 4740 C1AA.tmp 105 PID 4740 wrote to memory of 3812 4740 C1AA.tmp 105 PID 3812 wrote to memory of 2148 3812 C265.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\6eb4baeef96ef4247b041ebae7eadf4a_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\6eb4baeef96ef4247b041ebae7eadf4a_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\B19D.tmp"C:\Users\Admin\AppData\Local\Temp\B19D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\B391.tmp"C:\Users\Admin\AppData\Local\Temp\B391.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\B49A.tmp"C:\Users\Admin\AppData\Local\Temp\B49A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\B594.tmp"C:\Users\Admin\AppData\Local\Temp\B594.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\B70B.tmp"C:\Users\Admin\AppData\Local\Temp\B70B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\B882.tmp"C:\Users\Admin\AppData\Local\Temp\B882.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\B90F.tmp"C:\Users\Admin\AppData\Local\Temp\B90F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\BA09.tmp"C:\Users\Admin\AppData\Local\Temp\BA09.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\BB41.tmp"C:\Users\Admin\AppData\Local\Temp\BB41.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\BD74.tmp"C:\Users\Admin\AppData\Local\Temp\BD74.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\BE20.tmp"C:\Users\Admin\AppData\Local\Temp\BE20.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\BF29.tmp"C:\Users\Admin\AppData\Local\Temp\BF29.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\C052.tmp"C:\Users\Admin\AppData\Local\Temp\C052.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"23⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\C39E.tmp"C:\Users\Admin\AppData\Local\Temp\C39E.tmp"24⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\C459.tmp"C:\Users\Admin\AppData\Local\Temp\C459.tmp"25⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"26⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\C573.tmp"C:\Users\Admin\AppData\Local\Temp\C573.tmp"27⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\C62E.tmp"C:\Users\Admin\AppData\Local\Temp\C62E.tmp"28⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"29⤵
- Executes dropped EXE
PID:376 -
C:\Users\Admin\AppData\Local\Temp\C747.tmp"C:\Users\Admin\AppData\Local\Temp\C747.tmp"30⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"31⤵
- Executes dropped EXE
PID:624 -
C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"32⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\C98A.tmp"C:\Users\Admin\AppData\Local\Temp\C98A.tmp"33⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\CA84.tmp"C:\Users\Admin\AppData\Local\Temp\CA84.tmp"34⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"35⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"36⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"37⤵
- Executes dropped EXE
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\CC87.tmp"C:\Users\Admin\AppData\Local\Temp\CC87.tmp"38⤵
- Executes dropped EXE
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\CD14.tmp"C:\Users\Admin\AppData\Local\Temp\CD14.tmp"39⤵
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\CDC0.tmp"C:\Users\Admin\AppData\Local\Temp\CDC0.tmp"40⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"41⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\CEE9.tmp"C:\Users\Admin\AppData\Local\Temp\CEE9.tmp"42⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\CF94.tmp"C:\Users\Admin\AppData\Local\Temp\CF94.tmp"43⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\D031.tmp"C:\Users\Admin\AppData\Local\Temp\D031.tmp"44⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"45⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\D14A.tmp"C:\Users\Admin\AppData\Local\Temp\D14A.tmp"46⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"47⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\D244.tmp"C:\Users\Admin\AppData\Local\Temp\D244.tmp"48⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\D2C1.tmp"C:\Users\Admin\AppData\Local\Temp\D2C1.tmp"49⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\D36D.tmp"C:\Users\Admin\AppData\Local\Temp\D36D.tmp"50⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\D409.tmp"C:\Users\Admin\AppData\Local\Temp\D409.tmp"51⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"52⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\D522.tmp"C:\Users\Admin\AppData\Local\Temp\D522.tmp"53⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\D59F.tmp"C:\Users\Admin\AppData\Local\Temp\D59F.tmp"54⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\D61C.tmp"C:\Users\Admin\AppData\Local\Temp\D61C.tmp"55⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\D6B9.tmp"C:\Users\Admin\AppData\Local\Temp\D6B9.tmp"56⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\D745.tmp"C:\Users\Admin\AppData\Local\Temp\D745.tmp"57⤵
- Executes dropped EXE
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"58⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\D88D.tmp"C:\Users\Admin\AppData\Local\Temp\D88D.tmp"59⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\D92A.tmp"C:\Users\Admin\AppData\Local\Temp\D92A.tmp"60⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"61⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\DA43.tmp"C:\Users\Admin\AppData\Local\Temp\DA43.tmp"62⤵
- Executes dropped EXE
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\DADF.tmp"C:\Users\Admin\AppData\Local\Temp\DADF.tmp"63⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\DB7B.tmp"C:\Users\Admin\AppData\Local\Temp\DB7B.tmp"64⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\DBE9.tmp"C:\Users\Admin\AppData\Local\Temp\DBE9.tmp"65⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\DC46.tmp"C:\Users\Admin\AppData\Local\Temp\DC46.tmp"66⤵
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"67⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\DD12.tmp"C:\Users\Admin\AppData\Local\Temp\DD12.tmp"68⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\DD9E.tmp"C:\Users\Admin\AppData\Local\Temp\DD9E.tmp"69⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"70⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\DE79.tmp"C:\Users\Admin\AppData\Local\Temp\DE79.tmp"71⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\DEF6.tmp"C:\Users\Admin\AppData\Local\Temp\DEF6.tmp"72⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\DF73.tmp"C:\Users\Admin\AppData\Local\Temp\DF73.tmp"73⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"74⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\E06D.tmp"C:\Users\Admin\AppData\Local\Temp\E06D.tmp"75⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"76⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\E148.tmp"C:\Users\Admin\AppData\Local\Temp\E148.tmp"77⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\E1B5.tmp"C:\Users\Admin\AppData\Local\Temp\E1B5.tmp"78⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\E213.tmp"C:\Users\Admin\AppData\Local\Temp\E213.tmp"79⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\E290.tmp"C:\Users\Admin\AppData\Local\Temp\E290.tmp"80⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\E30D.tmp"C:\Users\Admin\AppData\Local\Temp\E30D.tmp"81⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\E399.tmp"C:\Users\Admin\AppData\Local\Temp\E399.tmp"82⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\E426.tmp"C:\Users\Admin\AppData\Local\Temp\E426.tmp"83⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\E4B3.tmp"C:\Users\Admin\AppData\Local\Temp\E4B3.tmp"84⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\E53F.tmp"C:\Users\Admin\AppData\Local\Temp\E53F.tmp"85⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\E59D.tmp"C:\Users\Admin\AppData\Local\Temp\E59D.tmp"86⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\E649.tmp"C:\Users\Admin\AppData\Local\Temp\E649.tmp"87⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"88⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\E762.tmp"C:\Users\Admin\AppData\Local\Temp\E762.tmp"89⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"90⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\E84D.tmp"C:\Users\Admin\AppData\Local\Temp\E84D.tmp"91⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"92⤵PID:180
-
C:\Users\Admin\AppData\Local\Temp\E956.tmp"C:\Users\Admin\AppData\Local\Temp\E956.tmp"93⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\EA02.tmp"C:\Users\Admin\AppData\Local\Temp\EA02.tmp"94⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\EA9E.tmp"C:\Users\Admin\AppData\Local\Temp\EA9E.tmp"95⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\EB4A.tmp"C:\Users\Admin\AppData\Local\Temp\EB4A.tmp"96⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\EBE6.tmp"C:\Users\Admin\AppData\Local\Temp\EBE6.tmp"97⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\EC63.tmp"C:\Users\Admin\AppData\Local\Temp\EC63.tmp"98⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\ECE0.tmp"C:\Users\Admin\AppData\Local\Temp\ECE0.tmp"99⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\ED6D.tmp"C:\Users\Admin\AppData\Local\Temp\ED6D.tmp"100⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\EDEA.tmp"C:\Users\Admin\AppData\Local\Temp\EDEA.tmp"101⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\EEA6.tmp"C:\Users\Admin\AppData\Local\Temp\EEA6.tmp"102⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\EF42.tmp"C:\Users\Admin\AppData\Local\Temp\EF42.tmp"103⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\EFDE.tmp"C:\Users\Admin\AppData\Local\Temp\EFDE.tmp"104⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\F05B.tmp"C:\Users\Admin\AppData\Local\Temp\F05B.tmp"105⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\F0F7.tmp"C:\Users\Admin\AppData\Local\Temp\F0F7.tmp"106⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\F1A3.tmp"C:\Users\Admin\AppData\Local\Temp\F1A3.tmp"107⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\F230.tmp"C:\Users\Admin\AppData\Local\Temp\F230.tmp"108⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\F2CC.tmp"C:\Users\Admin\AppData\Local\Temp\F2CC.tmp"109⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\F378.tmp"C:\Users\Admin\AppData\Local\Temp\F378.tmp"110⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\F433.tmp"C:\Users\Admin\AppData\Local\Temp\F433.tmp"111⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"112⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\F56C.tmp"C:\Users\Admin\AppData\Local\Temp\F56C.tmp"113⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\F608.tmp"C:\Users\Admin\AppData\Local\Temp\F608.tmp"114⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"115⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\F712.tmp"C:\Users\Admin\AppData\Local\Temp\F712.tmp"116⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\F7BE.tmp"C:\Users\Admin\AppData\Local\Temp\F7BE.tmp"117⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\F86A.tmp"C:\Users\Admin\AppData\Local\Temp\F86A.tmp"118⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\F8F6.tmp"C:\Users\Admin\AppData\Local\Temp\F8F6.tmp"119⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\F9A2.tmp"C:\Users\Admin\AppData\Local\Temp\F9A2.tmp"120⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"121⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"122⤵PID:2344
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-