Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
26/08/2023, 13:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a1d513121dccd43a843c18e0486421bf_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
a1d513121dccd43a843c18e0486421bf_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
a1d513121dccd43a843c18e0486421bf_mafia_JC.exe
-
Size
486KB
-
MD5
a1d513121dccd43a843c18e0486421bf
-
SHA1
b82778599398843a3dd925df7fdf747485d3c48b
-
SHA256
f14862d3fbdb8c5bdbf177dffafe4eebb6aa9d8271c05abb2838b371017a4db9
-
SHA512
6b97d8bffc3847f2f33facfd78de465bab359704b4e37459a9092e48115921440ff1f134b9895f1be2c1216b060919962fc1a22732d9df8a6a6143a3f2e20a56
-
SSDEEP
12288:oU5rCOTeiDoUYvp9ujT7Gd8g9czkYw4eNZ:oUQOJDavp9uTtgMnw4eN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1744 D0EC.tmp 924 D1A8.tmp 396 D292.tmp 4440 D37C.tmp 4940 D419.tmp 2008 D503.tmp 3852 D5CE.tmp 4188 D6A9.tmp 2236 D764.tmp 3272 D820.tmp 2184 D8FB.tmp 3544 DA04.tmp 3612 DAC0.tmp 4276 DB6C.tmp 3908 DC37.tmp 4884 DD02.tmp 4984 DDDD.tmp 4544 DED7.tmp 1760 DF83.tmp 1876 E03E.tmp 540 E0DA.tmp 2692 E196.tmp 3008 E261.tmp 4072 E2EE.tmp 1860 E38A.tmp 3248 E436.tmp 2784 E4D2.tmp 4648 E5AD.tmp 3916 E697.tmp 1536 E733.tmp 1976 E7DF.tmp 4748 E86C.tmp 4104 E927.tmp 4616 E9B4.tmp 868 EA31.tmp 840 EABE.tmp 5068 EB89.tmp 4272 EC25.tmp 4960 ECC1.tmp 4452 ED4E.tmp 4860 EDEA.tmp 3380 EE77.tmp 4716 EF03.tmp 1624 EFAF.tmp 4172 F03C.tmp 3756 F0D8.tmp 3168 F174.tmp 32 F1F1.tmp 764 F28E.tmp 3820 F31A.tmp 4892 F3A7.tmp 64 F433.tmp 3664 F4C0.tmp 1484 F54D.tmp 4060 F5E9.tmp 4932 F666.tmp 2740 F702.tmp 924 F79E.tmp 5052 F82B.tmp 5116 F898.tmp 4940 F906.tmp 960 F973.tmp 4152 F9E1.tmp 1676 FA4E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1780 wrote to memory of 1744 1780 a1d513121dccd43a843c18e0486421bf_mafia_JC.exe 82 PID 1780 wrote to memory of 1744 1780 a1d513121dccd43a843c18e0486421bf_mafia_JC.exe 82 PID 1780 wrote to memory of 1744 1780 a1d513121dccd43a843c18e0486421bf_mafia_JC.exe 82 PID 1744 wrote to memory of 924 1744 D0EC.tmp 83 PID 1744 wrote to memory of 924 1744 D0EC.tmp 83 PID 1744 wrote to memory of 924 1744 D0EC.tmp 83 PID 924 wrote to memory of 396 924 D1A8.tmp 84 PID 924 wrote to memory of 396 924 D1A8.tmp 84 PID 924 wrote to memory of 396 924 D1A8.tmp 84 PID 396 wrote to memory of 4440 396 D292.tmp 85 PID 396 wrote to memory of 4440 396 D292.tmp 85 PID 396 wrote to memory of 4440 396 D292.tmp 85 PID 4440 wrote to memory of 4940 4440 D37C.tmp 86 PID 4440 wrote to memory of 4940 4440 D37C.tmp 86 PID 4440 wrote to memory of 4940 4440 D37C.tmp 86 PID 4940 wrote to memory of 2008 4940 D419.tmp 87 PID 4940 wrote to memory of 2008 4940 D419.tmp 87 PID 4940 wrote to memory of 2008 4940 D419.tmp 87 PID 2008 wrote to memory of 3852 2008 D503.tmp 88 PID 2008 wrote to memory of 3852 2008 D503.tmp 88 PID 2008 wrote to memory of 3852 2008 D503.tmp 88 PID 3852 wrote to memory of 4188 3852 D5CE.tmp 89 PID 3852 wrote to memory of 4188 3852 D5CE.tmp 89 PID 3852 wrote to memory of 4188 3852 D5CE.tmp 89 PID 4188 wrote to memory of 2236 4188 D6A9.tmp 90 PID 4188 wrote to memory of 2236 4188 D6A9.tmp 90 PID 4188 wrote to memory of 2236 4188 D6A9.tmp 90 PID 2236 wrote to memory of 3272 2236 D764.tmp 91 PID 2236 wrote to memory of 3272 2236 D764.tmp 91 PID 2236 wrote to memory of 3272 2236 D764.tmp 91 PID 3272 wrote to memory of 2184 3272 D820.tmp 92 PID 3272 wrote to memory of 2184 3272 D820.tmp 92 PID 3272 wrote to memory of 2184 3272 D820.tmp 92 PID 2184 wrote to memory of 3544 2184 D8FB.tmp 93 PID 2184 wrote to memory of 3544 2184 D8FB.tmp 93 PID 2184 wrote to memory of 3544 2184 D8FB.tmp 93 PID 3544 wrote to memory of 3612 3544 DA04.tmp 94 PID 3544 wrote to memory of 3612 3544 DA04.tmp 94 PID 3544 wrote to memory of 3612 3544 DA04.tmp 94 PID 3612 wrote to memory of 4276 3612 DAC0.tmp 95 PID 3612 wrote to memory of 4276 3612 DAC0.tmp 95 PID 3612 wrote to memory of 4276 3612 DAC0.tmp 95 PID 4276 wrote to memory of 3908 4276 DB6C.tmp 98 PID 4276 wrote to memory of 3908 4276 DB6C.tmp 98 PID 4276 wrote to memory of 3908 4276 DB6C.tmp 98 PID 3908 wrote to memory of 4884 3908 DC37.tmp 99 PID 3908 wrote to memory of 4884 3908 DC37.tmp 99 PID 3908 wrote to memory of 4884 3908 DC37.tmp 99 PID 4884 wrote to memory of 4984 4884 DD02.tmp 100 PID 4884 wrote to memory of 4984 4884 DD02.tmp 100 PID 4884 wrote to memory of 4984 4884 DD02.tmp 100 PID 4984 wrote to memory of 4544 4984 DDDD.tmp 101 PID 4984 wrote to memory of 4544 4984 DDDD.tmp 101 PID 4984 wrote to memory of 4544 4984 DDDD.tmp 101 PID 4544 wrote to memory of 1760 4544 DED7.tmp 102 PID 4544 wrote to memory of 1760 4544 DED7.tmp 102 PID 4544 wrote to memory of 1760 4544 DED7.tmp 102 PID 1760 wrote to memory of 1876 1760 DF83.tmp 103 PID 1760 wrote to memory of 1876 1760 DF83.tmp 103 PID 1760 wrote to memory of 1876 1760 DF83.tmp 103 PID 1876 wrote to memory of 540 1876 E03E.tmp 105 PID 1876 wrote to memory of 540 1876 E03E.tmp 105 PID 1876 wrote to memory of 540 1876 E03E.tmp 105 PID 540 wrote to memory of 2692 540 E0DA.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1d513121dccd43a843c18e0486421bf_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\a1d513121dccd43a843c18e0486421bf_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\D1A8.tmp"C:\Users\Admin\AppData\Local\Temp\D1A8.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\D292.tmp"C:\Users\Admin\AppData\Local\Temp\D292.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\D37C.tmp"C:\Users\Admin\AppData\Local\Temp\D37C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\D419.tmp"C:\Users\Admin\AppData\Local\Temp\D419.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\D503.tmp"C:\Users\Admin\AppData\Local\Temp\D503.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\D5CE.tmp"C:\Users\Admin\AppData\Local\Temp\D5CE.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\D6A9.tmp"C:\Users\Admin\AppData\Local\Temp\D6A9.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\D764.tmp"C:\Users\Admin\AppData\Local\Temp\D764.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\D820.tmp"C:\Users\Admin\AppData\Local\Temp\D820.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\D8FB.tmp"C:\Users\Admin\AppData\Local\Temp\D8FB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\DA04.tmp"C:\Users\Admin\AppData\Local\Temp\DA04.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\DB6C.tmp"C:\Users\Admin\AppData\Local\Temp\DB6C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\DC37.tmp"C:\Users\Admin\AppData\Local\Temp\DC37.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\DD02.tmp"C:\Users\Admin\AppData\Local\Temp\DD02.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\DDDD.tmp"C:\Users\Admin\AppData\Local\Temp\DDDD.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\DED7.tmp"C:\Users\Admin\AppData\Local\Temp\DED7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\DF83.tmp"C:\Users\Admin\AppData\Local\Temp\DF83.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\E03E.tmp"C:\Users\Admin\AppData\Local\Temp\E03E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\E196.tmp"C:\Users\Admin\AppData\Local\Temp\E196.tmp"23⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\E261.tmp"C:\Users\Admin\AppData\Local\Temp\E261.tmp"24⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\E2EE.tmp"C:\Users\Admin\AppData\Local\Temp\E2EE.tmp"25⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\E38A.tmp"C:\Users\Admin\AppData\Local\Temp\E38A.tmp"26⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\E436.tmp"C:\Users\Admin\AppData\Local\Temp\E436.tmp"27⤵
- Executes dropped EXE
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\E4D2.tmp"C:\Users\Admin\AppData\Local\Temp\E4D2.tmp"28⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"29⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\E697.tmp"C:\Users\Admin\AppData\Local\Temp\E697.tmp"30⤵
- Executes dropped EXE
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\E733.tmp"C:\Users\Admin\AppData\Local\Temp\E733.tmp"31⤵
- Executes dropped EXE
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"32⤵
- Executes dropped EXE
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\E86C.tmp"C:\Users\Admin\AppData\Local\Temp\E86C.tmp"33⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\E927.tmp"C:\Users\Admin\AppData\Local\Temp\E927.tmp"34⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"35⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\EA31.tmp"C:\Users\Admin\AppData\Local\Temp\EA31.tmp"36⤵
- Executes dropped EXE
PID:868 -
C:\Users\Admin\AppData\Local\Temp\EABE.tmp"C:\Users\Admin\AppData\Local\Temp\EABE.tmp"37⤵
- Executes dropped EXE
PID:840 -
C:\Users\Admin\AppData\Local\Temp\EB89.tmp"C:\Users\Admin\AppData\Local\Temp\EB89.tmp"38⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\EC25.tmp"C:\Users\Admin\AppData\Local\Temp\EC25.tmp"39⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"40⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\ED4E.tmp"C:\Users\Admin\AppData\Local\Temp\ED4E.tmp"41⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\EDEA.tmp"C:\Users\Admin\AppData\Local\Temp\EDEA.tmp"42⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\EE77.tmp"C:\Users\Admin\AppData\Local\Temp\EE77.tmp"43⤵
- Executes dropped EXE
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\EF03.tmp"C:\Users\Admin\AppData\Local\Temp\EF03.tmp"44⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\EFAF.tmp"C:\Users\Admin\AppData\Local\Temp\EFAF.tmp"45⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\F03C.tmp"C:\Users\Admin\AppData\Local\Temp\F03C.tmp"46⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"47⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\F174.tmp"C:\Users\Admin\AppData\Local\Temp\F174.tmp"48⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\F1F1.tmp"C:\Users\Admin\AppData\Local\Temp\F1F1.tmp"49⤵
- Executes dropped EXE
PID:32 -
C:\Users\Admin\AppData\Local\Temp\F28E.tmp"C:\Users\Admin\AppData\Local\Temp\F28E.tmp"50⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\F31A.tmp"C:\Users\Admin\AppData\Local\Temp\F31A.tmp"51⤵
- Executes dropped EXE
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\F3A7.tmp"C:\Users\Admin\AppData\Local\Temp\F3A7.tmp"52⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\F433.tmp"C:\Users\Admin\AppData\Local\Temp\F433.tmp"53⤵
- Executes dropped EXE
PID:64 -
C:\Users\Admin\AppData\Local\Temp\F4C0.tmp"C:\Users\Admin\AppData\Local\Temp\F4C0.tmp"54⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\F54D.tmp"C:\Users\Admin\AppData\Local\Temp\F54D.tmp"55⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\F5E9.tmp"C:\Users\Admin\AppData\Local\Temp\F5E9.tmp"56⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\F666.tmp"C:\Users\Admin\AppData\Local\Temp\F666.tmp"57⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\F702.tmp"C:\Users\Admin\AppData\Local\Temp\F702.tmp"58⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\F79E.tmp"C:\Users\Admin\AppData\Local\Temp\F79E.tmp"59⤵
- Executes dropped EXE
PID:924 -
C:\Users\Admin\AppData\Local\Temp\F82B.tmp"C:\Users\Admin\AppData\Local\Temp\F82B.tmp"60⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\F898.tmp"C:\Users\Admin\AppData\Local\Temp\F898.tmp"61⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\F906.tmp"C:\Users\Admin\AppData\Local\Temp\F906.tmp"62⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\F973.tmp"C:\Users\Admin\AppData\Local\Temp\F973.tmp"63⤵
- Executes dropped EXE
PID:960 -
C:\Users\Admin\AppData\Local\Temp\F9E1.tmp"C:\Users\Admin\AppData\Local\Temp\F9E1.tmp"64⤵
- Executes dropped EXE
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"65⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\FACB.tmp"C:\Users\Admin\AppData\Local\Temp\FACB.tmp"66⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\FB67.tmp"C:\Users\Admin\AppData\Local\Temp\FB67.tmp"67⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"68⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\FC90.tmp"C:\Users\Admin\AppData\Local\Temp\FC90.tmp"69⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"70⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\FD9A.tmp"C:\Users\Admin\AppData\Local\Temp\FD9A.tmp"71⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\FE07.tmp"C:\Users\Admin\AppData\Local\Temp\FE07.tmp"72⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\FE65.tmp"C:\Users\Admin\AppData\Local\Temp\FE65.tmp"73⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\FED2.tmp"C:\Users\Admin\AppData\Local\Temp\FED2.tmp"74⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\FF5F.tmp"C:\Users\Admin\AppData\Local\Temp\FF5F.tmp"75⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"76⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\78.tmp"C:\Users\Admin\AppData\Local\Temp\78.tmp"77⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\105.tmp"C:\Users\Admin\AppData\Local\Temp\105.tmp"78⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\182.tmp"C:\Users\Admin\AppData\Local\Temp\182.tmp"79⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\1DF.tmp"C:\Users\Admin\AppData\Local\Temp\1DF.tmp"80⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\24D.tmp"C:\Users\Admin\AppData\Local\Temp\24D.tmp"81⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\2D9.tmp"C:\Users\Admin\AppData\Local\Temp\2D9.tmp"82⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\376.tmp"C:\Users\Admin\AppData\Local\Temp\376.tmp"83⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\402.tmp"C:\Users\Admin\AppData\Local\Temp\402.tmp"84⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\47F.tmp"C:\Users\Admin\AppData\Local\Temp\47F.tmp"85⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\4FC.tmp"C:\Users\Admin\AppData\Local\Temp\4FC.tmp"86⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\55A.tmp"C:\Users\Admin\AppData\Local\Temp\55A.tmp"87⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\5D7.tmp"C:\Users\Admin\AppData\Local\Temp\5D7.tmp"88⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\644.tmp"C:\Users\Admin\AppData\Local\Temp\644.tmp"89⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\72F.tmp"C:\Users\Admin\AppData\Local\Temp\72F.tmp"90⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\7BB.tmp"C:\Users\Admin\AppData\Local\Temp\7BB.tmp"91⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\838.tmp"C:\Users\Admin\AppData\Local\Temp\838.tmp"92⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\8A6.tmp"C:\Users\Admin\AppData\Local\Temp\8A6.tmp"93⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\913.tmp"C:\Users\Admin\AppData\Local\Temp\913.tmp"94⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\990.tmp"C:\Users\Admin\AppData\Local\Temp\990.tmp"95⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\A1D.tmp"C:\Users\Admin\AppData\Local\Temp\A1D.tmp"96⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\AA9.tmp"C:\Users\Admin\AppData\Local\Temp\AA9.tmp"97⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\B46.tmp"C:\Users\Admin\AppData\Local\Temp\B46.tmp"98⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\BB3.tmp"C:\Users\Admin\AppData\Local\Temp\BB3.tmp"99⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\C40.tmp"C:\Users\Admin\AppData\Local\Temp\C40.tmp"100⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\CDC.tmp"C:\Users\Admin\AppData\Local\Temp\CDC.tmp"101⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\D78.tmp"C:\Users\Admin\AppData\Local\Temp\D78.tmp"102⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\E14.tmp"C:\Users\Admin\AppData\Local\Temp\E14.tmp"103⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\E91.tmp"C:\Users\Admin\AppData\Local\Temp\E91.tmp"104⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"105⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"106⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\1057.tmp"C:\Users\Admin\AppData\Local\Temp\1057.tmp"107⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\10D4.tmp"C:\Users\Admin\AppData\Local\Temp\10D4.tmp"108⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\1141.tmp"C:\Users\Admin\AppData\Local\Temp\1141.tmp"109⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\11ED.tmp"C:\Users\Admin\AppData\Local\Temp\11ED.tmp"110⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\1299.tmp"C:\Users\Admin\AppData\Local\Temp\1299.tmp"111⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\1335.tmp"C:\Users\Admin\AppData\Local\Temp\1335.tmp"112⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\13D1.tmp"C:\Users\Admin\AppData\Local\Temp\13D1.tmp"113⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\145E.tmp"C:\Users\Admin\AppData\Local\Temp\145E.tmp"114⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\14EA.tmp"C:\Users\Admin\AppData\Local\Temp\14EA.tmp"115⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\1596.tmp"C:\Users\Admin\AppData\Local\Temp\1596.tmp"116⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\1604.tmp"C:\Users\Admin\AppData\Local\Temp\1604.tmp"117⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\1681.tmp"C:\Users\Admin\AppData\Local\Temp\1681.tmp"118⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\16FE.tmp"C:\Users\Admin\AppData\Local\Temp\16FE.tmp"119⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\178A.tmp"C:\Users\Admin\AppData\Local\Temp\178A.tmp"120⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\1807.tmp"C:\Users\Admin\AppData\Local\Temp\1807.tmp"121⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\18A4.tmp"C:\Users\Admin\AppData\Local\Temp\18A4.tmp"122⤵PID:4736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-