Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2023, 14:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
974e4158677feb5b8ae6360e1ede435f_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
974e4158677feb5b8ae6360e1ede435f_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
974e4158677feb5b8ae6360e1ede435f_mafia_JC.exe
-
Size
487KB
-
MD5
974e4158677feb5b8ae6360e1ede435f
-
SHA1
a3ebd9414d97838a36c48687ccb7f2e228060904
-
SHA256
9b033d00c2dfad10bd7c7a4da0cf36a712c52fe11574615d876775be8ac51176
-
SHA512
1d371dbc2b6b61da2b9bce0b1f0d140a6cc114d71696405d382488facb0ea3adccf9eedaf0729351eb1ec76124fdd544c4b2bac7e9acaa233823a41e6ec0af53
-
SSDEEP
12288:HU5rCOTeiJR6WFmVKQhX3g1G9F/81n/Dxj5NZ:HUQOJJVEX3EG9i195N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2376 87BE.tmp 2244 8889.tmp 3556 8944.tmp 948 8A10.tmp 3304 8B96.tmp 3464 8C90.tmp 2632 8D7B.tmp 2428 8E07.tmp 1028 8EE2.tmp 3528 8FAD.tmp 4128 9059.tmp 2728 90F5.tmp 4252 91E0.tmp 2140 928B.tmp 4196 9347.tmp 4540 9431.tmp 212 94FC.tmp 2456 9693.tmp 2032 971F.tmp 4528 97DB.tmp 1620 9877.tmp 5092 9961.tmp 116 9A1D.tmp 5096 9AD8.tmp 3076 9B84.tmp 2872 9C11.tmp 2748 9CDC.tmp 2112 9D78.tmp 3644 9E24.tmp 4444 9ED0.tmp 3848 9F6C.tmp 1872 A009.tmp 1664 A122.tmp 2600 A19F.tmp 4496 A22B.tmp 3740 A2D7.tmp 4904 A354.tmp 2592 A3E1.tmp 3948 A45E.tmp 3312 A4FA.tmp 4980 A596.tmp 2724 A652.tmp 1804 A6CF.tmp 404 A76B.tmp 1996 A7E8.tmp 3268 A865.tmp 4424 A901.tmp 416 A99E.tmp 1272 AA1B.tmp 928 AAB7.tmp 3556 AB34.tmp 4260 ABD0.tmp 4408 AC6C.tmp 3776 ACF9.tmp 1488 ADA5.tmp 3944 AE22.tmp 1204 AEAF.tmp 1320 AF5A.tmp 1296 AFE7.tmp 4492 B064.tmp 1444 B100.tmp 2396 B17D.tmp 2428 B21A.tmp 3396 B2C5.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2376 2416 974e4158677feb5b8ae6360e1ede435f_mafia_JC.exe 82 PID 2416 wrote to memory of 2376 2416 974e4158677feb5b8ae6360e1ede435f_mafia_JC.exe 82 PID 2416 wrote to memory of 2376 2416 974e4158677feb5b8ae6360e1ede435f_mafia_JC.exe 82 PID 2376 wrote to memory of 2244 2376 87BE.tmp 83 PID 2376 wrote to memory of 2244 2376 87BE.tmp 83 PID 2376 wrote to memory of 2244 2376 87BE.tmp 83 PID 2244 wrote to memory of 3556 2244 8889.tmp 84 PID 2244 wrote to memory of 3556 2244 8889.tmp 84 PID 2244 wrote to memory of 3556 2244 8889.tmp 84 PID 3556 wrote to memory of 948 3556 8944.tmp 85 PID 3556 wrote to memory of 948 3556 8944.tmp 85 PID 3556 wrote to memory of 948 3556 8944.tmp 85 PID 948 wrote to memory of 3304 948 8A10.tmp 86 PID 948 wrote to memory of 3304 948 8A10.tmp 86 PID 948 wrote to memory of 3304 948 8A10.tmp 86 PID 3304 wrote to memory of 3464 3304 8B96.tmp 87 PID 3304 wrote to memory of 3464 3304 8B96.tmp 87 PID 3304 wrote to memory of 3464 3304 8B96.tmp 87 PID 3464 wrote to memory of 2632 3464 8C90.tmp 88 PID 3464 wrote to memory of 2632 3464 8C90.tmp 88 PID 3464 wrote to memory of 2632 3464 8C90.tmp 88 PID 2632 wrote to memory of 2428 2632 8D7B.tmp 89 PID 2632 wrote to memory of 2428 2632 8D7B.tmp 89 PID 2632 wrote to memory of 2428 2632 8D7B.tmp 89 PID 2428 wrote to memory of 1028 2428 8E07.tmp 90 PID 2428 wrote to memory of 1028 2428 8E07.tmp 90 PID 2428 wrote to memory of 1028 2428 8E07.tmp 90 PID 1028 wrote to memory of 3528 1028 8EE2.tmp 92 PID 1028 wrote to memory of 3528 1028 8EE2.tmp 92 PID 1028 wrote to memory of 3528 1028 8EE2.tmp 92 PID 3528 wrote to memory of 4128 3528 8FAD.tmp 93 PID 3528 wrote to memory of 4128 3528 8FAD.tmp 93 PID 3528 wrote to memory of 4128 3528 8FAD.tmp 93 PID 4128 wrote to memory of 2728 4128 9059.tmp 94 PID 4128 wrote to memory of 2728 4128 9059.tmp 94 PID 4128 wrote to memory of 2728 4128 9059.tmp 94 PID 2728 wrote to memory of 4252 2728 90F5.tmp 95 PID 2728 wrote to memory of 4252 2728 90F5.tmp 95 PID 2728 wrote to memory of 4252 2728 90F5.tmp 95 PID 4252 wrote to memory of 2140 4252 91E0.tmp 96 PID 4252 wrote to memory of 2140 4252 91E0.tmp 96 PID 4252 wrote to memory of 2140 4252 91E0.tmp 96 PID 2140 wrote to memory of 4196 2140 928B.tmp 97 PID 2140 wrote to memory of 4196 2140 928B.tmp 97 PID 2140 wrote to memory of 4196 2140 928B.tmp 97 PID 4196 wrote to memory of 4540 4196 9347.tmp 98 PID 4196 wrote to memory of 4540 4196 9347.tmp 98 PID 4196 wrote to memory of 4540 4196 9347.tmp 98 PID 4540 wrote to memory of 212 4540 9431.tmp 99 PID 4540 wrote to memory of 212 4540 9431.tmp 99 PID 4540 wrote to memory of 212 4540 9431.tmp 99 PID 212 wrote to memory of 2456 212 94FC.tmp 100 PID 212 wrote to memory of 2456 212 94FC.tmp 100 PID 212 wrote to memory of 2456 212 94FC.tmp 100 PID 2456 wrote to memory of 2032 2456 9693.tmp 101 PID 2456 wrote to memory of 2032 2456 9693.tmp 101 PID 2456 wrote to memory of 2032 2456 9693.tmp 101 PID 2032 wrote to memory of 4528 2032 971F.tmp 104 PID 2032 wrote to memory of 4528 2032 971F.tmp 104 PID 2032 wrote to memory of 4528 2032 971F.tmp 104 PID 4528 wrote to memory of 1620 4528 97DB.tmp 105 PID 4528 wrote to memory of 1620 4528 97DB.tmp 105 PID 4528 wrote to memory of 1620 4528 97DB.tmp 105 PID 1620 wrote to memory of 5092 1620 9877.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\974e4158677feb5b8ae6360e1ede435f_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\974e4158677feb5b8ae6360e1ede435f_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\87BE.tmp"C:\Users\Admin\AppData\Local\Temp\87BE.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\8889.tmp"C:\Users\Admin\AppData\Local\Temp\8889.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\8A10.tmp"C:\Users\Admin\AppData\Local\Temp\8A10.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\8B96.tmp"C:\Users\Admin\AppData\Local\Temp\8B96.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\8E07.tmp"C:\Users\Admin\AppData\Local\Temp\8E07.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\91E0.tmp"C:\Users\Admin\AppData\Local\Temp\91E0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\94FC.tmp"C:\Users\Admin\AppData\Local\Temp\94FC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\9693.tmp"C:\Users\Admin\AppData\Local\Temp\9693.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\97DB.tmp"C:\Users\Admin\AppData\Local\Temp\97DB.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\9877.tmp"C:\Users\Admin\AppData\Local\Temp\9877.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"23⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"24⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"25⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"26⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"27⤵
- Executes dropped EXE
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"28⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\9D78.tmp"C:\Users\Admin\AppData\Local\Temp\9D78.tmp"29⤵
- Executes dropped EXE
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"30⤵
- Executes dropped EXE
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"31⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"32⤵
- Executes dropped EXE
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"33⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"34⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\A19F.tmp"C:\Users\Admin\AppData\Local\Temp\A19F.tmp"35⤵
- Executes dropped EXE
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"36⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"37⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\A354.tmp"C:\Users\Admin\AppData\Local\Temp\A354.tmp"38⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"39⤵
- Executes dropped EXE
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"40⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"41⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"42⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"43⤵
- Executes dropped EXE
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"44⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\A76B.tmp"C:\Users\Admin\AppData\Local\Temp\A76B.tmp"45⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"46⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"47⤵
- Executes dropped EXE
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"48⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\A99E.tmp"C:\Users\Admin\AppData\Local\Temp\A99E.tmp"49⤵
- Executes dropped EXE
PID:416 -
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"50⤵
- Executes dropped EXE
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"51⤵
- Executes dropped EXE
PID:928 -
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"52⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"53⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"54⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"55⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"56⤵
- Executes dropped EXE
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"57⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"58⤵
- Executes dropped EXE
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"59⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"60⤵
- Executes dropped EXE
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\B064.tmp"C:\Users\Admin\AppData\Local\Temp\B064.tmp"61⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\B100.tmp"C:\Users\Admin\AppData\Local\Temp\B100.tmp"62⤵
- Executes dropped EXE
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\B17D.tmp"C:\Users\Admin\AppData\Local\Temp\B17D.tmp"63⤵
- Executes dropped EXE
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\B21A.tmp"C:\Users\Admin\AppData\Local\Temp\B21A.tmp"64⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"65⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\B371.tmp"C:\Users\Admin\AppData\Local\Temp\B371.tmp"66⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"67⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\B46B.tmp"C:\Users\Admin\AppData\Local\Temp\B46B.tmp"68⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"69⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"70⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"71⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\B640.tmp"C:\Users\Admin\AppData\Local\Temp\B640.tmp"72⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\B69E.tmp"C:\Users\Admin\AppData\Local\Temp\B69E.tmp"73⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\B70B.tmp"C:\Users\Admin\AppData\Local\Temp\B70B.tmp"74⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"75⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\B853.tmp"C:\Users\Admin\AppData\Local\Temp\B853.tmp"76⤵PID:32
-
C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"77⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"78⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"79⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\BA09.tmp"C:\Users\Admin\AppData\Local\Temp\BA09.tmp"80⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\BA86.tmp"C:\Users\Admin\AppData\Local\Temp\BA86.tmp"81⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\BB12.tmp"C:\Users\Admin\AppData\Local\Temp\BB12.tmp"82⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"83⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"84⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"85⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\BD55.tmp"C:\Users\Admin\AppData\Local\Temp\BD55.tmp"86⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"87⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\BE20.tmp"C:\Users\Admin\AppData\Local\Temp\BE20.tmp"88⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"89⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\BF29.tmp"C:\Users\Admin\AppData\Local\Temp\BF29.tmp"90⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"91⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\C062.tmp"C:\Users\Admin\AppData\Local\Temp\C062.tmp"92⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"93⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"94⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"95⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\C217.tmp"C:\Users\Admin\AppData\Local\Temp\C217.tmp"96⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\C285.tmp"C:\Users\Admin\AppData\Local\Temp\C285.tmp"97⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\C311.tmp"C:\Users\Admin\AppData\Local\Temp\C311.tmp"98⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\C3BD.tmp"C:\Users\Admin\AppData\Local\Temp\C3BD.tmp"99⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\C43A.tmp"C:\Users\Admin\AppData\Local\Temp\C43A.tmp"100⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\C4C7.tmp"C:\Users\Admin\AppData\Local\Temp\C4C7.tmp"101⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\C573.tmp"C:\Users\Admin\AppData\Local\Temp\C573.tmp"102⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"103⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"104⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\C747.tmp"C:\Users\Admin\AppData\Local\Temp\C747.tmp"105⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\C7E4.tmp"C:\Users\Admin\AppData\Local\Temp\C7E4.tmp"106⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\C870.tmp"C:\Users\Admin\AppData\Local\Temp\C870.tmp"107⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\C8ED.tmp"C:\Users\Admin\AppData\Local\Temp\C8ED.tmp"108⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\C98A.tmp"C:\Users\Admin\AppData\Local\Temp\C98A.tmp"109⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\CA26.tmp"C:\Users\Admin\AppData\Local\Temp\CA26.tmp"110⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\CAB2.tmp"C:\Users\Admin\AppData\Local\Temp\CAB2.tmp"111⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"112⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"113⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\CC97.tmp"C:\Users\Admin\AppData\Local\Temp\CC97.tmp"114⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\CD33.tmp"C:\Users\Admin\AppData\Local\Temp\CD33.tmp"115⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\CDDF.tmp"C:\Users\Admin\AppData\Local\Temp\CDDF.tmp"116⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"117⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\CEF8.tmp"C:\Users\Admin\AppData\Local\Temp\CEF8.tmp"118⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\CF85.tmp"C:\Users\Admin\AppData\Local\Temp\CF85.tmp"119⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\D011.tmp"C:\Users\Admin\AppData\Local\Temp\D011.tmp"120⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\D09E.tmp"C:\Users\Admin\AppData\Local\Temp\D09E.tmp"121⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\D13A.tmp"C:\Users\Admin\AppData\Local\Temp\D13A.tmp"122⤵PID:2900
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-