Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
24/08/2023, 15:25
Static task
static1
Behavioral task
behavioral1
Sample
8132af12e62fdc2efeb8d98745b0a47b_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
8132af12e62fdc2efeb8d98745b0a47b_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
8132af12e62fdc2efeb8d98745b0a47b_mafia_JC.exe
-
Size
527KB
-
MD5
8132af12e62fdc2efeb8d98745b0a47b
-
SHA1
f08f775cdb400ef6751ee5849c40fbb6def90146
-
SHA256
153d84ca54cdaa52060251e7c31670940b2c6c7d2f9c68a5519617d9b4fbd027
-
SHA512
41653619df8c0890d3636e90da25055ab20fe24e336b1538c6b9e33270c3548da1dcbd567d51a1949c0db49a5131c317bb43e18a8d57dd07b31062489d1c2074
-
SSDEEP
6144:yorf3lPvovsgZnqG2C7mOTeiLRDYhVnPW0SbSWhI52dClR83xU1cWkf1u178IrDa:fU5rCOTeid0q+WqEdO4xHf1uJrRDZu
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2120 99DE.tmp 4512 9A9A.tmp 4192 9B75.tmp 1488 9C4F.tmp 5024 9D2A.tmp 4372 9DD6.tmp 4664 9EE0.tmp 4164 9FAB.tmp 3016 A066.tmp 4524 A112.tmp 1360 A1BE.tmp 1516 A23B.tmp 1228 A2F7.tmp 4880 A3F1.tmp 4444 A50A.tmp 3624 A5F4.tmp 4608 A6DF.tmp 4844 A827.tmp 2408 A930.tmp 4992 A9EC.tmp 780 AAA7.tmp 2852 AB53.tmp 1956 AC0F.tmp 4352 ACAB.tmp 4464 AD47.tmp 3264 AE03.tmp 2824 AE8F.tmp 412 AF4B.tmp 3288 B035.tmp 2996 B110.tmp 4064 B1DB.tmp 1576 B287.tmp 3464 B314.tmp 4772 B381.tmp 3980 B3FE.tmp 4896 B48B.tmp 1744 B508.tmp 4528 B575.tmp 4184 B5E2.tmp 572 B65F.tmp 3448 B6EC.tmp 4284 B788.tmp 968 B805.tmp 2100 B892.tmp 5032 B95D.tmp 2816 BA18.tmp 4748 BAB5.tmp 4792 BB80.tmp 1236 BC0C.tmp 3008 BCB8.tmp 2624 BD45.tmp 4280 BDC2.tmp 3780 BE3F.tmp 2188 BEDB.tmp 3496 BF68.tmp 1888 BFF4.tmp 4788 C091.tmp 892 C10E.tmp 3252 C18B.tmp 3724 C237.tmp 4124 C2B4.tmp 4120 C340.tmp 4912 C3EC.tmp 1392 C488.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 892 wrote to memory of 2120 892 8132af12e62fdc2efeb8d98745b0a47b_mafia_JC.exe 82 PID 892 wrote to memory of 2120 892 8132af12e62fdc2efeb8d98745b0a47b_mafia_JC.exe 82 PID 892 wrote to memory of 2120 892 8132af12e62fdc2efeb8d98745b0a47b_mafia_JC.exe 82 PID 2120 wrote to memory of 4512 2120 99DE.tmp 83 PID 2120 wrote to memory of 4512 2120 99DE.tmp 83 PID 2120 wrote to memory of 4512 2120 99DE.tmp 83 PID 4512 wrote to memory of 4192 4512 9A9A.tmp 84 PID 4512 wrote to memory of 4192 4512 9A9A.tmp 84 PID 4512 wrote to memory of 4192 4512 9A9A.tmp 84 PID 4192 wrote to memory of 1488 4192 9B75.tmp 85 PID 4192 wrote to memory of 1488 4192 9B75.tmp 85 PID 4192 wrote to memory of 1488 4192 9B75.tmp 85 PID 1488 wrote to memory of 5024 1488 9C4F.tmp 86 PID 1488 wrote to memory of 5024 1488 9C4F.tmp 86 PID 1488 wrote to memory of 5024 1488 9C4F.tmp 86 PID 5024 wrote to memory of 4372 5024 9D2A.tmp 87 PID 5024 wrote to memory of 4372 5024 9D2A.tmp 87 PID 5024 wrote to memory of 4372 5024 9D2A.tmp 87 PID 4372 wrote to memory of 4664 4372 9DD6.tmp 88 PID 4372 wrote to memory of 4664 4372 9DD6.tmp 88 PID 4372 wrote to memory of 4664 4372 9DD6.tmp 88 PID 4664 wrote to memory of 4164 4664 9EE0.tmp 89 PID 4664 wrote to memory of 4164 4664 9EE0.tmp 89 PID 4664 wrote to memory of 4164 4664 9EE0.tmp 89 PID 4164 wrote to memory of 3016 4164 9FAB.tmp 90 PID 4164 wrote to memory of 3016 4164 9FAB.tmp 90 PID 4164 wrote to memory of 3016 4164 9FAB.tmp 90 PID 3016 wrote to memory of 4524 3016 A066.tmp 92 PID 3016 wrote to memory of 4524 3016 A066.tmp 92 PID 3016 wrote to memory of 4524 3016 A066.tmp 92 PID 4524 wrote to memory of 1360 4524 A112.tmp 93 PID 4524 wrote to memory of 1360 4524 A112.tmp 93 PID 4524 wrote to memory of 1360 4524 A112.tmp 93 PID 1360 wrote to memory of 1516 1360 A1BE.tmp 94 PID 1360 wrote to memory of 1516 1360 A1BE.tmp 94 PID 1360 wrote to memory of 1516 1360 A1BE.tmp 94 PID 1516 wrote to memory of 1228 1516 A23B.tmp 95 PID 1516 wrote to memory of 1228 1516 A23B.tmp 95 PID 1516 wrote to memory of 1228 1516 A23B.tmp 95 PID 1228 wrote to memory of 4880 1228 A2F7.tmp 96 PID 1228 wrote to memory of 4880 1228 A2F7.tmp 96 PID 1228 wrote to memory of 4880 1228 A2F7.tmp 96 PID 4880 wrote to memory of 4444 4880 A3F1.tmp 97 PID 4880 wrote to memory of 4444 4880 A3F1.tmp 97 PID 4880 wrote to memory of 4444 4880 A3F1.tmp 97 PID 4444 wrote to memory of 3624 4444 A50A.tmp 98 PID 4444 wrote to memory of 3624 4444 A50A.tmp 98 PID 4444 wrote to memory of 3624 4444 A50A.tmp 98 PID 3624 wrote to memory of 4608 3624 A5F4.tmp 99 PID 3624 wrote to memory of 4608 3624 A5F4.tmp 99 PID 3624 wrote to memory of 4608 3624 A5F4.tmp 99 PID 4608 wrote to memory of 4844 4608 A6DF.tmp 100 PID 4608 wrote to memory of 4844 4608 A6DF.tmp 100 PID 4608 wrote to memory of 4844 4608 A6DF.tmp 100 PID 4844 wrote to memory of 2408 4844 A827.tmp 101 PID 4844 wrote to memory of 2408 4844 A827.tmp 101 PID 4844 wrote to memory of 2408 4844 A827.tmp 101 PID 2408 wrote to memory of 4992 2408 A930.tmp 102 PID 2408 wrote to memory of 4992 2408 A930.tmp 102 PID 2408 wrote to memory of 4992 2408 A930.tmp 102 PID 4992 wrote to memory of 780 4992 A9EC.tmp 103 PID 4992 wrote to memory of 780 4992 A9EC.tmp 103 PID 4992 wrote to memory of 780 4992 A9EC.tmp 103 PID 780 wrote to memory of 2852 780 AAA7.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\8132af12e62fdc2efeb8d98745b0a47b_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\8132af12e62fdc2efeb8d98745b0a47b_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\A066.tmp"C:\Users\Admin\AppData\Local\Temp\A066.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\A112.tmp"C:\Users\Admin\AppData\Local\Temp\A112.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\A23B.tmp"C:\Users\Admin\AppData\Local\Temp\A23B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\A50A.tmp"C:\Users\Admin\AppData\Local\Temp\A50A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\A827.tmp"C:\Users\Admin\AppData\Local\Temp\A827.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Users\Admin\AppData\Local\Temp\AB53.tmp"C:\Users\Admin\AppData\Local\Temp\AB53.tmp"23⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"24⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"25⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"26⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"27⤵
- Executes dropped EXE
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"28⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"29⤵
- Executes dropped EXE
PID:412 -
C:\Users\Admin\AppData\Local\Temp\B035.tmp"C:\Users\Admin\AppData\Local\Temp\B035.tmp"30⤵
- Executes dropped EXE
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\B110.tmp"C:\Users\Admin\AppData\Local\Temp\B110.tmp"31⤵
- Executes dropped EXE
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"32⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\B287.tmp"C:\Users\Admin\AppData\Local\Temp\B287.tmp"33⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\B314.tmp"C:\Users\Admin\AppData\Local\Temp\B314.tmp"34⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\B381.tmp"C:\Users\Admin\AppData\Local\Temp\B381.tmp"35⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"36⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\B48B.tmp"C:\Users\Admin\AppData\Local\Temp\B48B.tmp"37⤵
- Executes dropped EXE
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\B508.tmp"C:\Users\Admin\AppData\Local\Temp\B508.tmp"38⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\B575.tmp"C:\Users\Admin\AppData\Local\Temp\B575.tmp"39⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"40⤵
- Executes dropped EXE
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"41⤵
- Executes dropped EXE
PID:572 -
C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"42⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\B788.tmp"C:\Users\Admin\AppData\Local\Temp\B788.tmp"43⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\B805.tmp"C:\Users\Admin\AppData\Local\Temp\B805.tmp"44⤵
- Executes dropped EXE
PID:968 -
C:\Users\Admin\AppData\Local\Temp\B892.tmp"C:\Users\Admin\AppData\Local\Temp\B892.tmp"45⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\B95D.tmp"C:\Users\Admin\AppData\Local\Temp\B95D.tmp"46⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\BA18.tmp"C:\Users\Admin\AppData\Local\Temp\BA18.tmp"47⤵
- Executes dropped EXE
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"48⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\BB80.tmp"C:\Users\Admin\AppData\Local\Temp\BB80.tmp"49⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"50⤵
- Executes dropped EXE
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"51⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\BD45.tmp"C:\Users\Admin\AppData\Local\Temp\BD45.tmp"52⤵
- Executes dropped EXE
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"53⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"54⤵
- Executes dropped EXE
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"55⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\BF68.tmp"C:\Users\Admin\AppData\Local\Temp\BF68.tmp"56⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"57⤵
- Executes dropped EXE
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\C091.tmp"C:\Users\Admin\AppData\Local\Temp\C091.tmp"58⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\C10E.tmp"C:\Users\Admin\AppData\Local\Temp\C10E.tmp"59⤵
- Executes dropped EXE
PID:892 -
C:\Users\Admin\AppData\Local\Temp\C18B.tmp"C:\Users\Admin\AppData\Local\Temp\C18B.tmp"60⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\C237.tmp"C:\Users\Admin\AppData\Local\Temp\C237.tmp"61⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"62⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\C340.tmp"C:\Users\Admin\AppData\Local\Temp\C340.tmp"63⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"64⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\C488.tmp"C:\Users\Admin\AppData\Local\Temp\C488.tmp"65⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\C505.tmp"C:\Users\Admin\AppData\Local\Temp\C505.tmp"66⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\C592.tmp"C:\Users\Admin\AppData\Local\Temp\C592.tmp"67⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\C61F.tmp"C:\Users\Admin\AppData\Local\Temp\C61F.tmp"68⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"69⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\C738.tmp"C:\Users\Admin\AppData\Local\Temp\C738.tmp"70⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"71⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\C851.tmp"C:\Users\Admin\AppData\Local\Temp\C851.tmp"72⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"73⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\C98A.tmp"C:\Users\Admin\AppData\Local\Temp\C98A.tmp"74⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\CA07.tmp"C:\Users\Admin\AppData\Local\Temp\CA07.tmp"75⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\CA55.tmp"C:\Users\Admin\AppData\Local\Temp\CA55.tmp"76⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\CAC2.tmp"C:\Users\Admin\AppData\Local\Temp\CAC2.tmp"77⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"78⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"79⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\CC49.tmp"C:\Users\Admin\AppData\Local\Temp\CC49.tmp"80⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\CCC6.tmp"C:\Users\Admin\AppData\Local\Temp\CCC6.tmp"81⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\CD72.tmp"C:\Users\Admin\AppData\Local\Temp\CD72.tmp"82⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"83⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"84⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\CF08.tmp"C:\Users\Admin\AppData\Local\Temp\CF08.tmp"85⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\CF85.tmp"C:\Users\Admin\AppData\Local\Temp\CF85.tmp"86⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\CFE3.tmp"C:\Users\Admin\AppData\Local\Temp\CFE3.tmp"87⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\D060.tmp"C:\Users\Admin\AppData\Local\Temp\D060.tmp"88⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\D0DD.tmp"C:\Users\Admin\AppData\Local\Temp\D0DD.tmp"89⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\D169.tmp"C:\Users\Admin\AppData\Local\Temp\D169.tmp"90⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\D1D7.tmp"C:\Users\Admin\AppData\Local\Temp\D1D7.tmp"91⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\D254.tmp"C:\Users\Admin\AppData\Local\Temp\D254.tmp"92⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"93⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\D38C.tmp"C:\Users\Admin\AppData\Local\Temp\D38C.tmp"94⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\D3EA.tmp"C:\Users\Admin\AppData\Local\Temp\D3EA.tmp"95⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\D457.tmp"C:\Users\Admin\AppData\Local\Temp\D457.tmp"96⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\D4C5.tmp"C:\Users\Admin\AppData\Local\Temp\D4C5.tmp"97⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\D542.tmp"C:\Users\Admin\AppData\Local\Temp\D542.tmp"98⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"99⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\D60D.tmp"C:\Users\Admin\AppData\Local\Temp\D60D.tmp"100⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\D67A.tmp"C:\Users\Admin\AppData\Local\Temp\D67A.tmp"101⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\D6E7.tmp"C:\Users\Admin\AppData\Local\Temp\D6E7.tmp"102⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\D755.tmp"C:\Users\Admin\AppData\Local\Temp\D755.tmp"103⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"104⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\D86E.tmp"C:\Users\Admin\AppData\Local\Temp\D86E.tmp"105⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"106⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\D958.tmp"C:\Users\Admin\AppData\Local\Temp\D958.tmp"107⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\D9E5.tmp"C:\Users\Admin\AppData\Local\Temp\D9E5.tmp"108⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\DA91.tmp"C:\Users\Admin\AppData\Local\Temp\DA91.tmp"109⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\DB0E.tmp"C:\Users\Admin\AppData\Local\Temp\DB0E.tmp"110⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\DBAA.tmp"C:\Users\Admin\AppData\Local\Temp\DBAA.tmp"111⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\DC46.tmp"C:\Users\Admin\AppData\Local\Temp\DC46.tmp"112⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\DCD3.tmp"C:\Users\Admin\AppData\Local\Temp\DCD3.tmp"113⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\DD60.tmp"C:\Users\Admin\AppData\Local\Temp\DD60.tmp"114⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"115⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"116⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\DF54.tmp"C:\Users\Admin\AppData\Local\Temp\DF54.tmp"117⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"118⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\E06D.tmp"C:\Users\Admin\AppData\Local\Temp\E06D.tmp"119⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\E109.tmp"C:\Users\Admin\AppData\Local\Temp\E109.tmp"120⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\E1A5.tmp"C:\Users\Admin\AppData\Local\Temp\E1A5.tmp"121⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\E222.tmp"C:\Users\Admin\AppData\Local\Temp\E222.tmp"122⤵PID:3812
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-