Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230824-en -
resource tags
arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2023, 15:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9bac1a547830c9f609e7c957288a0729_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
9bac1a547830c9f609e7c957288a0729_mafia_JC.exe
Resource
win10v2004-20230824-en
3 signatures
150 seconds
General
-
Target
9bac1a547830c9f609e7c957288a0729_mafia_JC.exe
-
Size
486KB
-
MD5
9bac1a547830c9f609e7c957288a0729
-
SHA1
7f21a12e1c07fa1e7d26fb2675c4689090a698d3
-
SHA256
c74b72a26c5f1be91e19a0c9b717b2636284eceb847abc64f861ea5dde40db83
-
SHA512
94773029942b576094df9987f64dc43e691d327aebc2c898b85a897563472bf4063b6972adc8fc616609e317988bad401a26a110c0600a8e85b98b147df1c34a
-
SSDEEP
12288:UU5rCOTeiD2kj0sLXBc8jJ1T3DX97hbC6qLsF8VGBNZ:UUQOJD2kjTLXdX97QwF1N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4832 C841.tmp 4476 C93B.tmp 1820 C9E7.tmp 5096 CA93.tmp 2256 CB5E.tmp 2828 CC0A.tmp 3052 CD04.tmp 4828 CDB0.tmp 4564 CE3D.tmp 4600 CF17.tmp 3104 CFA4.tmp 3896 D06F.tmp 4616 D10B.tmp 2304 D188.tmp 1032 D215.tmp 4108 D2F0.tmp 1456 D35D.tmp 3944 D428.tmp 4956 D503.tmp 1344 D5AF.tmp 1692 D61C.tmp 4224 D6C8.tmp 2616 D7A3.tmp 4704 D89D.tmp 2972 D939.tmp 3596 D9B6.tmp 2716 DA33.tmp 3228 DAEF.tmp 2720 DB7B.tmp 1648 DC37.tmp 4092 DCC3.tmp 2964 DD50.tmp 2112 DDFC.tmp 2064 DE98.tmp 3752 DF25.tmp 2124 DFB1.tmp 4800 E05D.tmp 3384 E109.tmp 4176 E1C5.tmp 3592 E290.tmp 1868 E30D.tmp 4592 E3C8.tmp 4200 E465.tmp 4292 E4E2.tmp 368 E57E.tmp 440 E668.tmp 316 E753.tmp 2100 E8BA.tmp 4844 E956.tmp 228 EC15.tmp 4240 ECC1.tmp 1768 ED5D.tmp 4260 EF32.tmp 4680 EFBF.tmp 1944 F07A.tmp 1820 F107.tmp 2136 F194.tmp 5096 F230.tmp 2332 F2DC.tmp 1700 F378.tmp 2004 F414.tmp 1728 F4A1.tmp 4828 F54D.tmp 3324 F5D9.tmp -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{F25C8E81-C75D-4A35-9120-57804D471990}.catalogItem svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3780 wrote to memory of 4832 3780 9bac1a547830c9f609e7c957288a0729_mafia_JC.exe 84 PID 3780 wrote to memory of 4832 3780 9bac1a547830c9f609e7c957288a0729_mafia_JC.exe 84 PID 3780 wrote to memory of 4832 3780 9bac1a547830c9f609e7c957288a0729_mafia_JC.exe 84 PID 4832 wrote to memory of 4476 4832 C841.tmp 85 PID 4832 wrote to memory of 4476 4832 C841.tmp 85 PID 4832 wrote to memory of 4476 4832 C841.tmp 85 PID 4476 wrote to memory of 1820 4476 C93B.tmp 86 PID 4476 wrote to memory of 1820 4476 C93B.tmp 86 PID 4476 wrote to memory of 1820 4476 C93B.tmp 86 PID 1820 wrote to memory of 5096 1820 C9E7.tmp 87 PID 1820 wrote to memory of 5096 1820 C9E7.tmp 87 PID 1820 wrote to memory of 5096 1820 C9E7.tmp 87 PID 5096 wrote to memory of 2256 5096 CA93.tmp 88 PID 5096 wrote to memory of 2256 5096 CA93.tmp 88 PID 5096 wrote to memory of 2256 5096 CA93.tmp 88 PID 2256 wrote to memory of 2828 2256 CB5E.tmp 89 PID 2256 wrote to memory of 2828 2256 CB5E.tmp 89 PID 2256 wrote to memory of 2828 2256 CB5E.tmp 89 PID 2828 wrote to memory of 3052 2828 CC0A.tmp 91 PID 2828 wrote to memory of 3052 2828 CC0A.tmp 91 PID 2828 wrote to memory of 3052 2828 CC0A.tmp 91 PID 3052 wrote to memory of 4828 3052 CD04.tmp 92 PID 3052 wrote to memory of 4828 3052 CD04.tmp 92 PID 3052 wrote to memory of 4828 3052 CD04.tmp 92 PID 4828 wrote to memory of 4564 4828 CDB0.tmp 93 PID 4828 wrote to memory of 4564 4828 CDB0.tmp 93 PID 4828 wrote to memory of 4564 4828 CDB0.tmp 93 PID 4564 wrote to memory of 4600 4564 CE3D.tmp 94 PID 4564 wrote to memory of 4600 4564 CE3D.tmp 94 PID 4564 wrote to memory of 4600 4564 CE3D.tmp 94 PID 4600 wrote to memory of 3104 4600 CF17.tmp 96 PID 4600 wrote to memory of 3104 4600 CF17.tmp 96 PID 4600 wrote to memory of 3104 4600 CF17.tmp 96 PID 3104 wrote to memory of 3896 3104 CFA4.tmp 97 PID 3104 wrote to memory of 3896 3104 CFA4.tmp 97 PID 3104 wrote to memory of 3896 3104 CFA4.tmp 97 PID 3896 wrote to memory of 4616 3896 D06F.tmp 98 PID 3896 wrote to memory of 4616 3896 D06F.tmp 98 PID 3896 wrote to memory of 4616 3896 D06F.tmp 98 PID 4616 wrote to memory of 2304 4616 D10B.tmp 99 PID 4616 wrote to memory of 2304 4616 D10B.tmp 99 PID 4616 wrote to memory of 2304 4616 D10B.tmp 99 PID 2304 wrote to memory of 1032 2304 D188.tmp 100 PID 2304 wrote to memory of 1032 2304 D188.tmp 100 PID 2304 wrote to memory of 1032 2304 D188.tmp 100 PID 1032 wrote to memory of 4108 1032 D215.tmp 101 PID 1032 wrote to memory of 4108 1032 D215.tmp 101 PID 1032 wrote to memory of 4108 1032 D215.tmp 101 PID 4108 wrote to memory of 1456 4108 D2F0.tmp 102 PID 4108 wrote to memory of 1456 4108 D2F0.tmp 102 PID 4108 wrote to memory of 1456 4108 D2F0.tmp 102 PID 1456 wrote to memory of 3944 1456 D35D.tmp 103 PID 1456 wrote to memory of 3944 1456 D35D.tmp 103 PID 1456 wrote to memory of 3944 1456 D35D.tmp 103 PID 3944 wrote to memory of 4956 3944 D428.tmp 104 PID 3944 wrote to memory of 4956 3944 D428.tmp 104 PID 3944 wrote to memory of 4956 3944 D428.tmp 104 PID 4956 wrote to memory of 1344 4956 D503.tmp 105 PID 4956 wrote to memory of 1344 4956 D503.tmp 105 PID 4956 wrote to memory of 1344 4956 D503.tmp 105 PID 1344 wrote to memory of 1692 1344 D5AF.tmp 106 PID 1344 wrote to memory of 1692 1344 D5AF.tmp 106 PID 1344 wrote to memory of 1692 1344 D5AF.tmp 106 PID 1692 wrote to memory of 4224 1692 D61C.tmp 107
Processes
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
PID:4896
-
C:\Users\Admin\AppData\Local\Temp\9bac1a547830c9f609e7c957288a0729_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\9bac1a547830c9f609e7c957288a0729_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\C841.tmp"C:\Users\Admin\AppData\Local\Temp\C841.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\C93B.tmp"C:\Users\Admin\AppData\Local\Temp\C93B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\CA93.tmp"C:\Users\Admin\AppData\Local\Temp\CA93.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\CC0A.tmp"C:\Users\Admin\AppData\Local\Temp\CC0A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\CD04.tmp"C:\Users\Admin\AppData\Local\Temp\CD04.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\CE3D.tmp"C:\Users\Admin\AppData\Local\Temp\CE3D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\CF17.tmp"C:\Users\Admin\AppData\Local\Temp\CF17.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\D06F.tmp"C:\Users\Admin\AppData\Local\Temp\D06F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\D10B.tmp"C:\Users\Admin\AppData\Local\Temp\D10B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\D188.tmp"C:\Users\Admin\AppData\Local\Temp\D188.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\D215.tmp"C:\Users\Admin\AppData\Local\Temp\D215.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\D35D.tmp"C:\Users\Admin\AppData\Local\Temp\D35D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\D428.tmp"C:\Users\Admin\AppData\Local\Temp\D428.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\D503.tmp"C:\Users\Admin\AppData\Local\Temp\D503.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\D61C.tmp"C:\Users\Admin\AppData\Local\Temp\D61C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"23⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\D7A3.tmp"C:\Users\Admin\AppData\Local\Temp\D7A3.tmp"24⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\D89D.tmp"C:\Users\Admin\AppData\Local\Temp\D89D.tmp"25⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\D939.tmp"C:\Users\Admin\AppData\Local\Temp\D939.tmp"26⤵
- Executes dropped EXE
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"27⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\DA33.tmp"C:\Users\Admin\AppData\Local\Temp\DA33.tmp"28⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\DAEF.tmp"C:\Users\Admin\AppData\Local\Temp\DAEF.tmp"29⤵
- Executes dropped EXE
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\DB7B.tmp"C:\Users\Admin\AppData\Local\Temp\DB7B.tmp"30⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\DC37.tmp"C:\Users\Admin\AppData\Local\Temp\DC37.tmp"31⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\DCC3.tmp"C:\Users\Admin\AppData\Local\Temp\DCC3.tmp"32⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\DD50.tmp"C:\Users\Admin\AppData\Local\Temp\DD50.tmp"33⤵
- Executes dropped EXE
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"34⤵
- Executes dropped EXE
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\DE98.tmp"C:\Users\Admin\AppData\Local\Temp\DE98.tmp"35⤵
- Executes dropped EXE
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\DF25.tmp"C:\Users\Admin\AppData\Local\Temp\DF25.tmp"36⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"37⤵
- Executes dropped EXE
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\E05D.tmp"C:\Users\Admin\AppData\Local\Temp\E05D.tmp"38⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\E109.tmp"C:\Users\Admin\AppData\Local\Temp\E109.tmp"39⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"40⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\E290.tmp"C:\Users\Admin\AppData\Local\Temp\E290.tmp"41⤵
- Executes dropped EXE
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\E30D.tmp"C:\Users\Admin\AppData\Local\Temp\E30D.tmp"42⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"43⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\E465.tmp"C:\Users\Admin\AppData\Local\Temp\E465.tmp"44⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\E4E2.tmp"C:\Users\Admin\AppData\Local\Temp\E4E2.tmp"45⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\E57E.tmp"C:\Users\Admin\AppData\Local\Temp\E57E.tmp"46⤵
- Executes dropped EXE
PID:368 -
C:\Users\Admin\AppData\Local\Temp\E668.tmp"C:\Users\Admin\AppData\Local\Temp\E668.tmp"47⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\E753.tmp"C:\Users\Admin\AppData\Local\Temp\E753.tmp"48⤵
- Executes dropped EXE
PID:316 -
C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"49⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\E956.tmp"C:\Users\Admin\AppData\Local\Temp\E956.tmp"50⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\EA60.tmp"C:\Users\Admin\AppData\Local\Temp\EA60.tmp"51⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\EC15.tmp"C:\Users\Admin\AppData\Local\Temp\EC15.tmp"52⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"53⤵
- Executes dropped EXE
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"54⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\EF32.tmp"C:\Users\Admin\AppData\Local\Temp\EF32.tmp"55⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\EFBF.tmp"C:\Users\Admin\AppData\Local\Temp\EFBF.tmp"56⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\F07A.tmp"C:\Users\Admin\AppData\Local\Temp\F07A.tmp"57⤵
- Executes dropped EXE
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\F107.tmp"C:\Users\Admin\AppData\Local\Temp\F107.tmp"58⤵
- Executes dropped EXE
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\F194.tmp"C:\Users\Admin\AppData\Local\Temp\F194.tmp"59⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\F230.tmp"C:\Users\Admin\AppData\Local\Temp\F230.tmp"60⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\F2DC.tmp"C:\Users\Admin\AppData\Local\Temp\F2DC.tmp"61⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\F378.tmp"C:\Users\Admin\AppData\Local\Temp\F378.tmp"62⤵
- Executes dropped EXE
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\F414.tmp"C:\Users\Admin\AppData\Local\Temp\F414.tmp"63⤵
- Executes dropped EXE
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"64⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\F54D.tmp"C:\Users\Admin\AppData\Local\Temp\F54D.tmp"65⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"66⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\F6B4.tmp"C:\Users\Admin\AppData\Local\Temp\F6B4.tmp"67⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\F750.tmp"C:\Users\Admin\AppData\Local\Temp\F750.tmp"68⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\F7CD.tmp"C:\Users\Admin\AppData\Local\Temp\F7CD.tmp"69⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\F879.tmp"C:\Users\Admin\AppData\Local\Temp\F879.tmp"70⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"71⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\F964.tmp"C:\Users\Admin\AppData\Local\Temp\F964.tmp"72⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\FA00.tmp"C:\Users\Admin\AppData\Local\Temp\FA00.tmp"73⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\FABB.tmp"C:\Users\Admin\AppData\Local\Temp\FABB.tmp"74⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\FB38.tmp"C:\Users\Admin\AppData\Local\Temp\FB38.tmp"75⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"76⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\FC52.tmp"C:\Users\Admin\AppData\Local\Temp\FC52.tmp"77⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"78⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"79⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\FE46.tmp"C:\Users\Admin\AppData\Local\Temp\FE46.tmp"80⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\FEB3.tmp"C:\Users\Admin\AppData\Local\Temp\FEB3.tmp"81⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\FF30.tmp"C:\Users\Admin\AppData\Local\Temp\FF30.tmp"82⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\FF9D.tmp"C:\Users\Admin\AppData\Local\Temp\FF9D.tmp"83⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\1A.tmp"C:\Users\Admin\AppData\Local\Temp\1A.tmp"84⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\88.tmp"C:\Users\Admin\AppData\Local\Temp\88.tmp"85⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\124.tmp"C:\Users\Admin\AppData\Local\Temp\124.tmp"86⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\1B1.tmp"C:\Users\Admin\AppData\Local\Temp\1B1.tmp"87⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\22E.tmp"C:\Users\Admin\AppData\Local\Temp\22E.tmp"88⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\29B.tmp"C:\Users\Admin\AppData\Local\Temp\29B.tmp"89⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\328.tmp"C:\Users\Admin\AppData\Local\Temp\328.tmp"90⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\3A5.tmp"C:\Users\Admin\AppData\Local\Temp\3A5.tmp"91⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\431.tmp"C:\Users\Admin\AppData\Local\Temp\431.tmp"92⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\49F.tmp"C:\Users\Admin\AppData\Local\Temp\49F.tmp"93⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\54A.tmp"C:\Users\Admin\AppData\Local\Temp\54A.tmp"94⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\5E7.tmp"C:\Users\Admin\AppData\Local\Temp\5E7.tmp"95⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\673.tmp"C:\Users\Admin\AppData\Local\Temp\673.tmp"96⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\700.tmp"C:\Users\Admin\AppData\Local\Temp\700.tmp"97⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\78D.tmp"C:\Users\Admin\AppData\Local\Temp\78D.tmp"98⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\819.tmp"C:\Users\Admin\AppData\Local\Temp\819.tmp"99⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\887.tmp"C:\Users\Admin\AppData\Local\Temp\887.tmp"100⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\904.tmp"C:\Users\Admin\AppData\Local\Temp\904.tmp"101⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\990.tmp"C:\Users\Admin\AppData\Local\Temp\990.tmp"102⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\A1D.tmp"C:\Users\Admin\AppData\Local\Temp\A1D.tmp"103⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\AB9.tmp"C:\Users\Admin\AppData\Local\Temp\AB9.tmp"104⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\B46.tmp"C:\Users\Admin\AppData\Local\Temp\B46.tmp"105⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"106⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\C7E.tmp"C:\Users\Admin\AppData\Local\Temp\C7E.tmp"107⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\D0B.tmp"C:\Users\Admin\AppData\Local\Temp\D0B.tmp"108⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"109⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\E43.tmp"C:\Users\Admin\AppData\Local\Temp\E43.tmp"110⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"111⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\F3D.tmp"C:\Users\Admin\AppData\Local\Temp\F3D.tmp"112⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"113⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\1066.tmp"C:\Users\Admin\AppData\Local\Temp\1066.tmp"114⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\10F3.tmp"C:\Users\Admin\AppData\Local\Temp\10F3.tmp"115⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\118F.tmp"C:\Users\Admin\AppData\Local\Temp\118F.tmp"116⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\11FC.tmp"C:\Users\Admin\AppData\Local\Temp\11FC.tmp"117⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\12F6.tmp"C:\Users\Admin\AppData\Local\Temp\12F6.tmp"118⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\1383.tmp"C:\Users\Admin\AppData\Local\Temp\1383.tmp"119⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\141F.tmp"C:\Users\Admin\AppData\Local\Temp\141F.tmp"120⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\149C.tmp"C:\Users\Admin\AppData\Local\Temp\149C.tmp"121⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\1567.tmp"C:\Users\Admin\AppData\Local\Temp\1567.tmp"122⤵PID:4572
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-