Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
26/08/2023, 13:16
Static task
static1
Behavioral task
behavioral1
Sample
a17ab13f6728fbb8f3623a6cf3445210_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
a17ab13f6728fbb8f3623a6cf3445210_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
a17ab13f6728fbb8f3623a6cf3445210_mafia_JC.exe
-
Size
486KB
-
MD5
a17ab13f6728fbb8f3623a6cf3445210
-
SHA1
ed6b2c6788527f8a85819d92aa0b00bd85f81739
-
SHA256
47f61a24acac17b997b42a518b5e7e9b54c001ded6a0ff03548389b1c25175ca
-
SHA512
0dfac3c2710827fef4e5c9fdd64099e763b166dc2133e33b99f54d6b8b68e4b352d74cd3458ce463cf7966f470581ffe3a6c8615acc940b3dde4348f1d627beb
-
SSDEEP
12288:/U5rCOTeiDXE2hgbOIEDEF+oM7ruNgBDGTwF6LOqlRjQ6NZ:/UQOJDU3OCuruNqDGrLbR06N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1236 A19F.tmp 4872 A289.tmp 2528 A383.tmp 1876 A49C.tmp 4012 A587.tmp 2220 A652.tmp 4828 A6FE.tmp 3796 A7D9.tmp 1012 A894.tmp 1216 A98E.tmp 4384 AAD6.tmp 1500 AB63.tmp 1684 ABEF.tmp 3820 ACDA.tmp 4608 ADD4.tmp 3972 AEED.tmp 4592 AFF7.tmp 4668 B0B2.tmp 3936 B16E.tmp 2344 B248.tmp 4464 B2F4.tmp 2504 B3A0.tmp 2960 B44C.tmp 4576 B517.tmp 3280 B5C3.tmp 3168 B650.tmp 2900 B73A.tmp 2088 B7C7.tmp 4388 B873.tmp 3616 B90F.tmp 760 B9CA.tmp 4912 BA67.tmp 4000 BB12.tmp 4356 BBAF.tmp 3732 BC3B.tmp 3484 BCB8.tmp 5092 BD55.tmp 652 BDC2.tmp 4156 BE4F.tmp 2452 BEEB.tmp 8 BF87.tmp 4236 C023.tmp 2840 C0B0.tmp 3964 C12D.tmp 4560 C1C9.tmp 3004 C256.tmp 392 C2E2.tmp 2064 C37F.tmp 5048 C40B.tmp 4904 C498.tmp 4996 C544.tmp 4820 C5C1.tmp 3420 C66D.tmp 2988 C709.tmp 4244 C7A5.tmp 3904 C861.tmp 1084 C8DE.tmp 3956 C95B.tmp 5060 C9B8.tmp 1068 CA26.tmp 864 CAE1.tmp 3884 CB4F.tmp 4308 CBEB.tmp 4048 CC78.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4572 wrote to memory of 1236 4572 a17ab13f6728fbb8f3623a6cf3445210_mafia_JC.exe 81 PID 4572 wrote to memory of 1236 4572 a17ab13f6728fbb8f3623a6cf3445210_mafia_JC.exe 81 PID 4572 wrote to memory of 1236 4572 a17ab13f6728fbb8f3623a6cf3445210_mafia_JC.exe 81 PID 1236 wrote to memory of 4872 1236 A19F.tmp 82 PID 1236 wrote to memory of 4872 1236 A19F.tmp 82 PID 1236 wrote to memory of 4872 1236 A19F.tmp 82 PID 4872 wrote to memory of 2528 4872 A289.tmp 83 PID 4872 wrote to memory of 2528 4872 A289.tmp 83 PID 4872 wrote to memory of 2528 4872 A289.tmp 83 PID 2528 wrote to memory of 1876 2528 A383.tmp 84 PID 2528 wrote to memory of 1876 2528 A383.tmp 84 PID 2528 wrote to memory of 1876 2528 A383.tmp 84 PID 1876 wrote to memory of 4012 1876 A49C.tmp 85 PID 1876 wrote to memory of 4012 1876 A49C.tmp 85 PID 1876 wrote to memory of 4012 1876 A49C.tmp 85 PID 4012 wrote to memory of 2220 4012 A587.tmp 86 PID 4012 wrote to memory of 2220 4012 A587.tmp 86 PID 4012 wrote to memory of 2220 4012 A587.tmp 86 PID 2220 wrote to memory of 4828 2220 A652.tmp 87 PID 2220 wrote to memory of 4828 2220 A652.tmp 87 PID 2220 wrote to memory of 4828 2220 A652.tmp 87 PID 4828 wrote to memory of 3796 4828 A6FE.tmp 88 PID 4828 wrote to memory of 3796 4828 A6FE.tmp 88 PID 4828 wrote to memory of 3796 4828 A6FE.tmp 88 PID 3796 wrote to memory of 1012 3796 A7D9.tmp 89 PID 3796 wrote to memory of 1012 3796 A7D9.tmp 89 PID 3796 wrote to memory of 1012 3796 A7D9.tmp 89 PID 1012 wrote to memory of 1216 1012 A894.tmp 90 PID 1012 wrote to memory of 1216 1012 A894.tmp 90 PID 1012 wrote to memory of 1216 1012 A894.tmp 90 PID 1216 wrote to memory of 4384 1216 A98E.tmp 91 PID 1216 wrote to memory of 4384 1216 A98E.tmp 91 PID 1216 wrote to memory of 4384 1216 A98E.tmp 91 PID 4384 wrote to memory of 1500 4384 AAD6.tmp 92 PID 4384 wrote to memory of 1500 4384 AAD6.tmp 92 PID 4384 wrote to memory of 1500 4384 AAD6.tmp 92 PID 1500 wrote to memory of 1684 1500 AB63.tmp 95 PID 1500 wrote to memory of 1684 1500 AB63.tmp 95 PID 1500 wrote to memory of 1684 1500 AB63.tmp 95 PID 1684 wrote to memory of 3820 1684 ABEF.tmp 96 PID 1684 wrote to memory of 3820 1684 ABEF.tmp 96 PID 1684 wrote to memory of 3820 1684 ABEF.tmp 96 PID 3820 wrote to memory of 4608 3820 ACDA.tmp 97 PID 3820 wrote to memory of 4608 3820 ACDA.tmp 97 PID 3820 wrote to memory of 4608 3820 ACDA.tmp 97 PID 4608 wrote to memory of 3972 4608 ADD4.tmp 98 PID 4608 wrote to memory of 3972 4608 ADD4.tmp 98 PID 4608 wrote to memory of 3972 4608 ADD4.tmp 98 PID 3972 wrote to memory of 4592 3972 AEED.tmp 99 PID 3972 wrote to memory of 4592 3972 AEED.tmp 99 PID 3972 wrote to memory of 4592 3972 AEED.tmp 99 PID 4592 wrote to memory of 4668 4592 AFF7.tmp 101 PID 4592 wrote to memory of 4668 4592 AFF7.tmp 101 PID 4592 wrote to memory of 4668 4592 AFF7.tmp 101 PID 4668 wrote to memory of 3936 4668 B0B2.tmp 102 PID 4668 wrote to memory of 3936 4668 B0B2.tmp 102 PID 4668 wrote to memory of 3936 4668 B0B2.tmp 102 PID 3936 wrote to memory of 2344 3936 B16E.tmp 104 PID 3936 wrote to memory of 2344 3936 B16E.tmp 104 PID 3936 wrote to memory of 2344 3936 B16E.tmp 104 PID 2344 wrote to memory of 4464 2344 B248.tmp 105 PID 2344 wrote to memory of 4464 2344 B248.tmp 105 PID 2344 wrote to memory of 4464 2344 B248.tmp 105 PID 4464 wrote to memory of 2504 4464 B2F4.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\a17ab13f6728fbb8f3623a6cf3445210_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\a17ab13f6728fbb8f3623a6cf3445210_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\A19F.tmp"C:\Users\Admin\AppData\Local\Temp\A19F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\A383.tmp"C:\Users\Admin\AppData\Local\Temp\A383.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\A894.tmp"C:\Users\Admin\AppData\Local\Temp\A894.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"23⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"24⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\B517.tmp"C:\Users\Admin\AppData\Local\Temp\B517.tmp"25⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"26⤵
- Executes dropped EXE
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\B650.tmp"C:\Users\Admin\AppData\Local\Temp\B650.tmp"27⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\B73A.tmp"C:\Users\Admin\AppData\Local\Temp\B73A.tmp"28⤵
- Executes dropped EXE
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"29⤵
- Executes dropped EXE
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\B873.tmp"C:\Users\Admin\AppData\Local\Temp\B873.tmp"30⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\B90F.tmp"C:\Users\Admin\AppData\Local\Temp\B90F.tmp"31⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"32⤵
- Executes dropped EXE
PID:760 -
C:\Users\Admin\AppData\Local\Temp\BA67.tmp"C:\Users\Admin\AppData\Local\Temp\BA67.tmp"33⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\BB12.tmp"C:\Users\Admin\AppData\Local\Temp\BB12.tmp"34⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"35⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"36⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"37⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\BD55.tmp"C:\Users\Admin\AppData\Local\Temp\BD55.tmp"38⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"39⤵
- Executes dropped EXE
PID:652 -
C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"40⤵
- Executes dropped EXE
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\BEEB.tmp"C:\Users\Admin\AppData\Local\Temp\BEEB.tmp"41⤵
- Executes dropped EXE
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\BF87.tmp"C:\Users\Admin\AppData\Local\Temp\BF87.tmp"42⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\C023.tmp"C:\Users\Admin\AppData\Local\Temp\C023.tmp"43⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"44⤵
- Executes dropped EXE
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"45⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"46⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\C256.tmp"C:\Users\Admin\AppData\Local\Temp\C256.tmp"47⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"48⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\C37F.tmp"C:\Users\Admin\AppData\Local\Temp\C37F.tmp"49⤵
- Executes dropped EXE
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\C40B.tmp"C:\Users\Admin\AppData\Local\Temp\C40B.tmp"50⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\C498.tmp"C:\Users\Admin\AppData\Local\Temp\C498.tmp"51⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\C544.tmp"C:\Users\Admin\AppData\Local\Temp\C544.tmp"52⤵
- Executes dropped EXE
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"53⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\C66D.tmp"C:\Users\Admin\AppData\Local\Temp\C66D.tmp"54⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\C709.tmp"C:\Users\Admin\AppData\Local\Temp\C709.tmp"55⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"56⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\C861.tmp"C:\Users\Admin\AppData\Local\Temp\C861.tmp"57⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"58⤵
- Executes dropped EXE
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\C95B.tmp"C:\Users\Admin\AppData\Local\Temp\C95B.tmp"59⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"60⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\CA26.tmp"C:\Users\Admin\AppData\Local\Temp\CA26.tmp"61⤵
- Executes dropped EXE
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"62⤵
- Executes dropped EXE
PID:864 -
C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"63⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"64⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\CC78.tmp"C:\Users\Admin\AppData\Local\Temp\CC78.tmp"65⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\CCE5.tmp"C:\Users\Admin\AppData\Local\Temp\CCE5.tmp"66⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\CD81.tmp"C:\Users\Admin\AppData\Local\Temp\CD81.tmp"67⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"68⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"69⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\CEC9.tmp"C:\Users\Admin\AppData\Local\Temp\CEC9.tmp"70⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\CF66.tmp"C:\Users\Admin\AppData\Local\Temp\CF66.tmp"71⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\D09E.tmp"C:\Users\Admin\AppData\Local\Temp\D09E.tmp"72⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\D11B.tmp"C:\Users\Admin\AppData\Local\Temp\D11B.tmp"73⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\D188.tmp"C:\Users\Admin\AppData\Local\Temp\D188.tmp"74⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\D215.tmp"C:\Users\Admin\AppData\Local\Temp\D215.tmp"75⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\D2B1.tmp"C:\Users\Admin\AppData\Local\Temp\D2B1.tmp"76⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\D30F.tmp"C:\Users\Admin\AppData\Local\Temp\D30F.tmp"77⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"78⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\D428.tmp"C:\Users\Admin\AppData\Local\Temp\D428.tmp"79⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\D4B5.tmp"C:\Users\Admin\AppData\Local\Temp\D4B5.tmp"80⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\D522.tmp"C:\Users\Admin\AppData\Local\Temp\D522.tmp"81⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\D590.tmp"C:\Users\Admin\AppData\Local\Temp\D590.tmp"82⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\D5FD.tmp"C:\Users\Admin\AppData\Local\Temp\D5FD.tmp"83⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\D65B.tmp"C:\Users\Admin\AppData\Local\Temp\D65B.tmp"84⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\D6D8.tmp"C:\Users\Admin\AppData\Local\Temp\D6D8.tmp"85⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\D764.tmp"C:\Users\Admin\AppData\Local\Temp\D764.tmp"86⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\D810.tmp"C:\Users\Admin\AppData\Local\Temp\D810.tmp"87⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\D88D.tmp"C:\Users\Admin\AppData\Local\Temp\D88D.tmp"88⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\D92A.tmp"C:\Users\Admin\AppData\Local\Temp\D92A.tmp"89⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\D9E5.tmp"C:\Users\Admin\AppData\Local\Temp\D9E5.tmp"90⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\DA91.tmp"C:\Users\Admin\AppData\Local\Temp\DA91.tmp"91⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\DB2D.tmp"C:\Users\Admin\AppData\Local\Temp\DB2D.tmp"92⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\DBBA.tmp"C:\Users\Admin\AppData\Local\Temp\DBBA.tmp"93⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\DC56.tmp"C:\Users\Admin\AppData\Local\Temp\DC56.tmp"94⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\DCE3.tmp"C:\Users\Admin\AppData\Local\Temp\DCE3.tmp"95⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\DD6F.tmp"C:\Users\Admin\AppData\Local\Temp\DD6F.tmp"96⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\DE0C.tmp"C:\Users\Admin\AppData\Local\Temp\DE0C.tmp"97⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\DE98.tmp"C:\Users\Admin\AppData\Local\Temp\DE98.tmp"98⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\DF25.tmp"C:\Users\Admin\AppData\Local\Temp\DF25.tmp"99⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"100⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\E05D.tmp"C:\Users\Admin\AppData\Local\Temp\E05D.tmp"101⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"102⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\E177.tmp"C:\Users\Admin\AppData\Local\Temp\E177.tmp"103⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\E222.tmp"C:\Users\Admin\AppData\Local\Temp\E222.tmp"104⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\E2AF.tmp"C:\Users\Admin\AppData\Local\Temp\E2AF.tmp"105⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\E34B.tmp"C:\Users\Admin\AppData\Local\Temp\E34B.tmp"106⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\E3D8.tmp"C:\Users\Admin\AppData\Local\Temp\E3D8.tmp"107⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\E465.tmp"C:\Users\Admin\AppData\Local\Temp\E465.tmp"108⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\E4E2.tmp"C:\Users\Admin\AppData\Local\Temp\E4E2.tmp"109⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\E58D.tmp"C:\Users\Admin\AppData\Local\Temp\E58D.tmp"110⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\E61A.tmp"C:\Users\Admin\AppData\Local\Temp\E61A.tmp"111⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"112⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\E753.tmp"C:\Users\Admin\AppData\Local\Temp\E753.tmp"113⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"114⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\E88B.tmp"C:\Users\Admin\AppData\Local\Temp\E88B.tmp"115⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\E927.tmp"C:\Users\Admin\AppData\Local\Temp\E927.tmp"116⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"117⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\EA41.tmp"C:\Users\Admin\AppData\Local\Temp\EA41.tmp"118⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\EADD.tmp"C:\Users\Admin\AppData\Local\Temp\EADD.tmp"119⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\EB69.tmp"C:\Users\Admin\AppData\Local\Temp\EB69.tmp"120⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"121⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\EC83.tmp"C:\Users\Admin\AppData\Local\Temp\EC83.tmp"122⤵PID:4244
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-