Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
27/08/2023, 13:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a7fdb93ba74956d05d2cdcd34a0779e3_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
a7fdb93ba74956d05d2cdcd34a0779e3_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
a7fdb93ba74956d05d2cdcd34a0779e3_mafia_JC.exe
-
Size
520KB
-
MD5
a7fdb93ba74956d05d2cdcd34a0779e3
-
SHA1
6c58c900701e674f12d63e1f0e002031626914a0
-
SHA256
e294ca5430100a554aa1d6a9ed91c5cb029b4891a767266ab60d18f13a516858
-
SHA512
95fd9f61773db01d5adda7014babc5104807ba5c9be2e5dfcee35d9ca05d6cb7e781f46393268193c9e748513c8e7a3150436bb3738b8912e7fb8a20183d6d4e
-
SSDEEP
12288:roRXOQjmOy6DhFjhoxmcQLvxZUyK1MNZ:rogQ9yG1akLvO1MN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4400 9D78.tmp 4824 9E34.tmp 3828 9F0F.tmp 4380 A009.tmp 4168 A0C4.tmp 640 A170.tmp 2240 A25A.tmp 3928 A3B2.tmp 2064 A48D.tmp 4488 A519.tmp 3248 A5C5.tmp 4948 A6A0.tmp 2176 A70D.tmp 3408 A817.tmp 2024 A8B3.tmp 4508 A97E.tmp 4760 AA0B.tmp 2900 AA78.tmp 548 AAE6.tmp 4776 AB72.tmp 3904 ABFF.tmp 2580 AD66.tmp 116 AE51.tmp 5108 AEDD.tmp 3384 AF7A.tmp 2160 B006.tmp 2248 B093.tmp 3336 B14E.tmp 2392 B1DB.tmp 4340 B268.tmp 2444 B304.tmp 3460 B3B0.tmp 3560 B48B.tmp 4232 B4F8.tmp 4348 B575.tmp 1344 B5E2.tmp 3472 B66F.tmp 3240 B6DC.tmp 1556 B759.tmp 2436 B7F6.tmp 1232 B892.tmp 1964 B90F.tmp 848 B98C.tmp 4528 BA09.tmp 2920 BA95.tmp 2120 BB22.tmp 4812 BB80.tmp 3872 BC0C.tmp 2560 BC89.tmp 2220 BD06.tmp 4332 BDA3.tmp 856 BE20.tmp 4344 BEAC.tmp 1952 BF49.tmp 2004 BFC6.tmp 4992 C052.tmp 5104 C0FE.tmp 4584 C18B.tmp 3708 C208.tmp 4400 C294.tmp 4824 C321.tmp 2256 C3AE.tmp 4752 C41B.tmp 4380 C4A8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4808 wrote to memory of 4400 4808 a7fdb93ba74956d05d2cdcd34a0779e3_mafia_JC.exe 83 PID 4808 wrote to memory of 4400 4808 a7fdb93ba74956d05d2cdcd34a0779e3_mafia_JC.exe 83 PID 4808 wrote to memory of 4400 4808 a7fdb93ba74956d05d2cdcd34a0779e3_mafia_JC.exe 83 PID 4400 wrote to memory of 4824 4400 9D78.tmp 84 PID 4400 wrote to memory of 4824 4400 9D78.tmp 84 PID 4400 wrote to memory of 4824 4400 9D78.tmp 84 PID 4824 wrote to memory of 3828 4824 9E34.tmp 85 PID 4824 wrote to memory of 3828 4824 9E34.tmp 85 PID 4824 wrote to memory of 3828 4824 9E34.tmp 85 PID 3828 wrote to memory of 4380 3828 9F0F.tmp 86 PID 3828 wrote to memory of 4380 3828 9F0F.tmp 86 PID 3828 wrote to memory of 4380 3828 9F0F.tmp 86 PID 4380 wrote to memory of 4168 4380 A009.tmp 87 PID 4380 wrote to memory of 4168 4380 A009.tmp 87 PID 4380 wrote to memory of 4168 4380 A009.tmp 87 PID 4168 wrote to memory of 640 4168 A0C4.tmp 88 PID 4168 wrote to memory of 640 4168 A0C4.tmp 88 PID 4168 wrote to memory of 640 4168 A0C4.tmp 88 PID 640 wrote to memory of 2240 640 A170.tmp 89 PID 640 wrote to memory of 2240 640 A170.tmp 89 PID 640 wrote to memory of 2240 640 A170.tmp 89 PID 2240 wrote to memory of 3928 2240 A25A.tmp 90 PID 2240 wrote to memory of 3928 2240 A25A.tmp 90 PID 2240 wrote to memory of 3928 2240 A25A.tmp 90 PID 3928 wrote to memory of 2064 3928 A3B2.tmp 91 PID 3928 wrote to memory of 2064 3928 A3B2.tmp 91 PID 3928 wrote to memory of 2064 3928 A3B2.tmp 91 PID 2064 wrote to memory of 4488 2064 A48D.tmp 92 PID 2064 wrote to memory of 4488 2064 A48D.tmp 92 PID 2064 wrote to memory of 4488 2064 A48D.tmp 92 PID 4488 wrote to memory of 3248 4488 A519.tmp 93 PID 4488 wrote to memory of 3248 4488 A519.tmp 93 PID 4488 wrote to memory of 3248 4488 A519.tmp 93 PID 3248 wrote to memory of 4948 3248 A5C5.tmp 94 PID 3248 wrote to memory of 4948 3248 A5C5.tmp 94 PID 3248 wrote to memory of 4948 3248 A5C5.tmp 94 PID 4948 wrote to memory of 2176 4948 A6A0.tmp 95 PID 4948 wrote to memory of 2176 4948 A6A0.tmp 95 PID 4948 wrote to memory of 2176 4948 A6A0.tmp 95 PID 2176 wrote to memory of 3408 2176 A70D.tmp 96 PID 2176 wrote to memory of 3408 2176 A70D.tmp 96 PID 2176 wrote to memory of 3408 2176 A70D.tmp 96 PID 3408 wrote to memory of 2024 3408 A817.tmp 97 PID 3408 wrote to memory of 2024 3408 A817.tmp 97 PID 3408 wrote to memory of 2024 3408 A817.tmp 97 PID 2024 wrote to memory of 4508 2024 A8B3.tmp 98 PID 2024 wrote to memory of 4508 2024 A8B3.tmp 98 PID 2024 wrote to memory of 4508 2024 A8B3.tmp 98 PID 4508 wrote to memory of 4760 4508 A97E.tmp 99 PID 4508 wrote to memory of 4760 4508 A97E.tmp 99 PID 4508 wrote to memory of 4760 4508 A97E.tmp 99 PID 4760 wrote to memory of 2900 4760 AA0B.tmp 100 PID 4760 wrote to memory of 2900 4760 AA0B.tmp 100 PID 4760 wrote to memory of 2900 4760 AA0B.tmp 100 PID 2900 wrote to memory of 548 2900 AA78.tmp 101 PID 2900 wrote to memory of 548 2900 AA78.tmp 101 PID 2900 wrote to memory of 548 2900 AA78.tmp 101 PID 548 wrote to memory of 4776 548 AAE6.tmp 104 PID 548 wrote to memory of 4776 548 AAE6.tmp 104 PID 548 wrote to memory of 4776 548 AAE6.tmp 104 PID 4776 wrote to memory of 3904 4776 AB72.tmp 105 PID 4776 wrote to memory of 3904 4776 AB72.tmp 105 PID 4776 wrote to memory of 3904 4776 AB72.tmp 105 PID 3904 wrote to memory of 2580 3904 ABFF.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7fdb93ba74956d05d2cdcd34a0779e3_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\a7fdb93ba74956d05d2cdcd34a0779e3_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\9D78.tmp"C:\Users\Admin\AppData\Local\Temp\9D78.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\A519.tmp"C:\Users\Admin\AppData\Local\Temp\A519.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\A817.tmp"C:\Users\Admin\AppData\Local\Temp\A817.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\AB72.tmp"C:\Users\Admin\AppData\Local\Temp\AB72.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\AD66.tmp"C:\Users\Admin\AppData\Local\Temp\AD66.tmp"23⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\AE51.tmp"C:\Users\Admin\AppData\Local\Temp\AE51.tmp"24⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"25⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"26⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\B006.tmp"C:\Users\Admin\AppData\Local\Temp\B006.tmp"27⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\B093.tmp"C:\Users\Admin\AppData\Local\Temp\B093.tmp"28⤵
- Executes dropped EXE
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\B14E.tmp"C:\Users\Admin\AppData\Local\Temp\B14E.tmp"29⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"30⤵
- Executes dropped EXE
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\B268.tmp"C:\Users\Admin\AppData\Local\Temp\B268.tmp"31⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\B304.tmp"C:\Users\Admin\AppData\Local\Temp\B304.tmp"32⤵
- Executes dropped EXE
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"33⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\B48B.tmp"C:\Users\Admin\AppData\Local\Temp\B48B.tmp"34⤵
- Executes dropped EXE
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"35⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\B575.tmp"C:\Users\Admin\AppData\Local\Temp\B575.tmp"36⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"37⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\B66F.tmp"C:\Users\Admin\AppData\Local\Temp\B66F.tmp"38⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"39⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\B759.tmp"C:\Users\Admin\AppData\Local\Temp\B759.tmp"40⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"41⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\B892.tmp"C:\Users\Admin\AppData\Local\Temp\B892.tmp"42⤵
- Executes dropped EXE
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\B90F.tmp"C:\Users\Admin\AppData\Local\Temp\B90F.tmp"43⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\B98C.tmp"C:\Users\Admin\AppData\Local\Temp\B98C.tmp"44⤵
- Executes dropped EXE
PID:848 -
C:\Users\Admin\AppData\Local\Temp\BA09.tmp"C:\Users\Admin\AppData\Local\Temp\BA09.tmp"45⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\BA95.tmp"C:\Users\Admin\AppData\Local\Temp\BA95.tmp"46⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\BB22.tmp"C:\Users\Admin\AppData\Local\Temp\BB22.tmp"47⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\BB80.tmp"C:\Users\Admin\AppData\Local\Temp\BB80.tmp"48⤵
- Executes dropped EXE
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"49⤵
- Executes dropped EXE
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\BC89.tmp"C:\Users\Admin\AppData\Local\Temp\BC89.tmp"50⤵
- Executes dropped EXE
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\BD06.tmp"C:\Users\Admin\AppData\Local\Temp\BD06.tmp"51⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"52⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\BE20.tmp"C:\Users\Admin\AppData\Local\Temp\BE20.tmp"53⤵
- Executes dropped EXE
PID:856 -
C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"54⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\BF49.tmp"C:\Users\Admin\AppData\Local\Temp\BF49.tmp"55⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"56⤵
- Executes dropped EXE
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\C052.tmp"C:\Users\Admin\AppData\Local\Temp\C052.tmp"57⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"58⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\C18B.tmp"C:\Users\Admin\AppData\Local\Temp\C18B.tmp"59⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\C208.tmp"C:\Users\Admin\AppData\Local\Temp\C208.tmp"60⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\C294.tmp"C:\Users\Admin\AppData\Local\Temp\C294.tmp"61⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\C321.tmp"C:\Users\Admin\AppData\Local\Temp\C321.tmp"62⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"63⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\C41B.tmp"C:\Users\Admin\AppData\Local\Temp\C41B.tmp"64⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"65⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\C525.tmp"C:\Users\Admin\AppData\Local\Temp\C525.tmp"66⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"67⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\C62E.tmp"C:\Users\Admin\AppData\Local\Temp\C62E.tmp"68⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"69⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\C738.tmp"C:\Users\Admin\AppData\Local\Temp\C738.tmp"70⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\C796.tmp"C:\Users\Admin\AppData\Local\Temp\C796.tmp"71⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\C841.tmp"C:\Users\Admin\AppData\Local\Temp\C841.tmp"72⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"73⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\C91C.tmp"C:\Users\Admin\AppData\Local\Temp\C91C.tmp"74⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\C97A.tmp"C:\Users\Admin\AppData\Local\Temp\C97A.tmp"75⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"76⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\CA74.tmp"C:\Users\Admin\AppData\Local\Temp\CA74.tmp"77⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"78⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"79⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"80⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\CC68.tmp"C:\Users\Admin\AppData\Local\Temp\CC68.tmp"81⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\CCE5.tmp"C:\Users\Admin\AppData\Local\Temp\CCE5.tmp"82⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\CD72.tmp"C:\Users\Admin\AppData\Local\Temp\CD72.tmp"83⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"84⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"85⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\CEE9.tmp"C:\Users\Admin\AppData\Local\Temp\CEE9.tmp"86⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\CF56.tmp"C:\Users\Admin\AppData\Local\Temp\CF56.tmp"87⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"88⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\D050.tmp"C:\Users\Admin\AppData\Local\Temp\D050.tmp"89⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"90⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\D11B.tmp"C:\Users\Admin\AppData\Local\Temp\D11B.tmp"91⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\D198.tmp"C:\Users\Admin\AppData\Local\Temp\D198.tmp"92⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\D225.tmp"C:\Users\Admin\AppData\Local\Temp\D225.tmp"93⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\D2C1.tmp"C:\Users\Admin\AppData\Local\Temp\D2C1.tmp"94⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\D31F.tmp"C:\Users\Admin\AppData\Local\Temp\D31F.tmp"95⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\D38C.tmp"C:\Users\Admin\AppData\Local\Temp\D38C.tmp"96⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\D438.tmp"C:\Users\Admin\AppData\Local\Temp\D438.tmp"97⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\D4B5.tmp"C:\Users\Admin\AppData\Local\Temp\D4B5.tmp"98⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\D532.tmp"C:\Users\Admin\AppData\Local\Temp\D532.tmp"99⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\D59F.tmp"C:\Users\Admin\AppData\Local\Temp\D59F.tmp"100⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\D62C.tmp"C:\Users\Admin\AppData\Local\Temp\D62C.tmp"101⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\D6B9.tmp"C:\Users\Admin\AppData\Local\Temp\D6B9.tmp"102⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\D736.tmp"C:\Users\Admin\AppData\Local\Temp\D736.tmp"103⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"104⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\D84F.tmp"C:\Users\Admin\AppData\Local\Temp\D84F.tmp"105⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"106⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\D949.tmp"C:\Users\Admin\AppData\Local\Temp\D949.tmp"107⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\D9F5.tmp"C:\Users\Admin\AppData\Local\Temp\D9F5.tmp"108⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\DA62.tmp"C:\Users\Admin\AppData\Local\Temp\DA62.tmp"109⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\DAEF.tmp"C:\Users\Admin\AppData\Local\Temp\DAEF.tmp"110⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"111⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\DBD9.tmp"C:\Users\Admin\AppData\Local\Temp\DBD9.tmp"112⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\DC66.tmp"C:\Users\Admin\AppData\Local\Temp\DC66.tmp"113⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\DD02.tmp"C:\Users\Admin\AppData\Local\Temp\DD02.tmp"114⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\DD6F.tmp"C:\Users\Admin\AppData\Local\Temp\DD6F.tmp"115⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\DDEC.tmp"C:\Users\Admin\AppData\Local\Temp\DDEC.tmp"116⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\DE69.tmp"C:\Users\Admin\AppData\Local\Temp\DE69.tmp"117⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"118⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\DF73.tmp"C:\Users\Admin\AppData\Local\Temp\DF73.tmp"119⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\DFE0.tmp"C:\Users\Admin\AppData\Local\Temp\DFE0.tmp"120⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\E06D.tmp"C:\Users\Admin\AppData\Local\Temp\E06D.tmp"121⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"122⤵PID:4808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-