Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
27/08/2023, 17:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b77dad892b227deb0bffd4bbf1960cdb_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
b77dad892b227deb0bffd4bbf1960cdb_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
b77dad892b227deb0bffd4bbf1960cdb_mafia_JC.exe
-
Size
487KB
-
MD5
b77dad892b227deb0bffd4bbf1960cdb
-
SHA1
efcc8a674c85559dfd190e4ff0900cacae86966c
-
SHA256
daaf13ecd9bb39e94dc65ae226ef41639cbb124214a5974ee99093ee8231edc8
-
SHA512
227a714d0b166473f705454c604c25de1e2337a4ff41a988c6455840784d2932ca61cc8520dcffb05c7574b1a54c17efe2b96031906a1e199fdc4472eda7791b
-
SSDEEP
12288:yU5rCOTeiNLxsFpUyR7wI4wt1i/+BYbZ:yUQOJNLWFpUyR78wt1i/IYb
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4612 9FE9.tmp 4284 A0C4.tmp 3780 A18F.tmp 4752 A24B.tmp 4336 A316.tmp 2704 A3B2.tmp 4860 A48D.tmp 3116 A529.tmp 5048 A5B6.tmp 2836 A662.tmp 2032 A78A.tmp 1028 A846.tmp 3696 A95F.tmp 912 AA1B.tmp 2400 AAC7.tmp 1608 AB82.tmp 436 AC4D.tmp 2208 AD18.tmp 2828 AE03.tmp 3832 AEBE.tmp 1576 AF99.tmp 2012 B074.tmp 1060 B100.tmp 1148 B18D.tmp 3688 B239.tmp 3736 B2D5.tmp 3704 B3A0.tmp 3516 B47B.tmp 1808 B5A4.tmp 4500 B640.tmp 4180 B6EC.tmp 2648 B7C7.tmp 3712 B882.tmp 1144 B8FF.tmp 3748 B99B.tmp 1184 BA28.tmp 1524 BAC4.tmp 1248 BB41.tmp 4048 BBBE.tmp 3628 BC4B.tmp 1412 BCF7.tmp 4128 BD93.tmp 736 BE20.tmp 3804 BEFA.tmp 4044 BFA6.tmp 2424 C033.tmp 3880 C0DF.tmp 624 C18B.tmp 4668 C237.tmp 1820 C2C3.tmp 5044 C36F.tmp 5056 C3FC.tmp 2576 C4A8.tmp 2004 C525.tmp 4992 C5A2.tmp 1828 C63E.tmp 4216 C6F9.tmp 5080 C796.tmp 3780 C813.tmp 1624 C870.tmp 2704 C8ED.tmp 4980 C96A.tmp 4568 C9F7.tmp 2864 CA84.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4024 wrote to memory of 4612 4024 b77dad892b227deb0bffd4bbf1960cdb_mafia_JC.exe 83 PID 4024 wrote to memory of 4612 4024 b77dad892b227deb0bffd4bbf1960cdb_mafia_JC.exe 83 PID 4024 wrote to memory of 4612 4024 b77dad892b227deb0bffd4bbf1960cdb_mafia_JC.exe 83 PID 4612 wrote to memory of 4284 4612 9FE9.tmp 84 PID 4612 wrote to memory of 4284 4612 9FE9.tmp 84 PID 4612 wrote to memory of 4284 4612 9FE9.tmp 84 PID 4284 wrote to memory of 3780 4284 A0C4.tmp 85 PID 4284 wrote to memory of 3780 4284 A0C4.tmp 85 PID 4284 wrote to memory of 3780 4284 A0C4.tmp 85 PID 3780 wrote to memory of 4752 3780 A18F.tmp 86 PID 3780 wrote to memory of 4752 3780 A18F.tmp 86 PID 3780 wrote to memory of 4752 3780 A18F.tmp 86 PID 4752 wrote to memory of 4336 4752 A24B.tmp 87 PID 4752 wrote to memory of 4336 4752 A24B.tmp 87 PID 4752 wrote to memory of 4336 4752 A24B.tmp 87 PID 4336 wrote to memory of 2704 4336 A316.tmp 88 PID 4336 wrote to memory of 2704 4336 A316.tmp 88 PID 4336 wrote to memory of 2704 4336 A316.tmp 88 PID 2704 wrote to memory of 4860 2704 A3B2.tmp 89 PID 2704 wrote to memory of 4860 2704 A3B2.tmp 89 PID 2704 wrote to memory of 4860 2704 A3B2.tmp 89 PID 4860 wrote to memory of 3116 4860 A48D.tmp 90 PID 4860 wrote to memory of 3116 4860 A48D.tmp 90 PID 4860 wrote to memory of 3116 4860 A48D.tmp 90 PID 3116 wrote to memory of 5048 3116 A529.tmp 91 PID 3116 wrote to memory of 5048 3116 A529.tmp 91 PID 3116 wrote to memory of 5048 3116 A529.tmp 91 PID 5048 wrote to memory of 2836 5048 A5B6.tmp 92 PID 5048 wrote to memory of 2836 5048 A5B6.tmp 92 PID 5048 wrote to memory of 2836 5048 A5B6.tmp 92 PID 2836 wrote to memory of 2032 2836 A662.tmp 93 PID 2836 wrote to memory of 2032 2836 A662.tmp 93 PID 2836 wrote to memory of 2032 2836 A662.tmp 93 PID 2032 wrote to memory of 1028 2032 A78A.tmp 94 PID 2032 wrote to memory of 1028 2032 A78A.tmp 94 PID 2032 wrote to memory of 1028 2032 A78A.tmp 94 PID 1028 wrote to memory of 3696 1028 A846.tmp 95 PID 1028 wrote to memory of 3696 1028 A846.tmp 95 PID 1028 wrote to memory of 3696 1028 A846.tmp 95 PID 3696 wrote to memory of 912 3696 A95F.tmp 96 PID 3696 wrote to memory of 912 3696 A95F.tmp 96 PID 3696 wrote to memory of 912 3696 A95F.tmp 96 PID 912 wrote to memory of 2400 912 AA1B.tmp 97 PID 912 wrote to memory of 2400 912 AA1B.tmp 97 PID 912 wrote to memory of 2400 912 AA1B.tmp 97 PID 2400 wrote to memory of 1608 2400 AAC7.tmp 100 PID 2400 wrote to memory of 1608 2400 AAC7.tmp 100 PID 2400 wrote to memory of 1608 2400 AAC7.tmp 100 PID 1608 wrote to memory of 436 1608 AB82.tmp 101 PID 1608 wrote to memory of 436 1608 AB82.tmp 101 PID 1608 wrote to memory of 436 1608 AB82.tmp 101 PID 436 wrote to memory of 2208 436 AC4D.tmp 102 PID 436 wrote to memory of 2208 436 AC4D.tmp 102 PID 436 wrote to memory of 2208 436 AC4D.tmp 102 PID 2208 wrote to memory of 2828 2208 AD18.tmp 103 PID 2208 wrote to memory of 2828 2208 AD18.tmp 103 PID 2208 wrote to memory of 2828 2208 AD18.tmp 103 PID 2828 wrote to memory of 3832 2828 AE03.tmp 104 PID 2828 wrote to memory of 3832 2828 AE03.tmp 104 PID 2828 wrote to memory of 3832 2828 AE03.tmp 104 PID 3832 wrote to memory of 1576 3832 AEBE.tmp 105 PID 3832 wrote to memory of 1576 3832 AEBE.tmp 105 PID 3832 wrote to memory of 1576 3832 AEBE.tmp 105 PID 1576 wrote to memory of 2012 1576 AF99.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\b77dad892b227deb0bffd4bbf1960cdb_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\b77dad892b227deb0bffd4bbf1960cdb_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\A18F.tmp"C:\Users\Admin\AppData\Local\Temp\A18F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\A24B.tmp"C:\Users\Admin\AppData\Local\Temp\A24B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\A662.tmp"C:\Users\Admin\AppData\Local\Temp\A662.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\A78A.tmp"C:\Users\Admin\AppData\Local\Temp\A78A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\AB82.tmp"C:\Users\Admin\AppData\Local\Temp\AB82.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\AD18.tmp"C:\Users\Admin\AppData\Local\Temp\AD18.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\AF99.tmp"C:\Users\Admin\AppData\Local\Temp\AF99.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\B074.tmp"C:\Users\Admin\AppData\Local\Temp\B074.tmp"23⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\B100.tmp"C:\Users\Admin\AppData\Local\Temp\B100.tmp"24⤵
- Executes dropped EXE
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\B18D.tmp"C:\Users\Admin\AppData\Local\Temp\B18D.tmp"25⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\B239.tmp"C:\Users\Admin\AppData\Local\Temp\B239.tmp"26⤵
- Executes dropped EXE
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"27⤵
- Executes dropped EXE
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"28⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\B47B.tmp"C:\Users\Admin\AppData\Local\Temp\B47B.tmp"29⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"30⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\B640.tmp"C:\Users\Admin\AppData\Local\Temp\B640.tmp"31⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"32⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"33⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\B882.tmp"C:\Users\Admin\AppData\Local\Temp\B882.tmp"34⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"35⤵
- Executes dropped EXE
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\B99B.tmp"C:\Users\Admin\AppData\Local\Temp\B99B.tmp"36⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\BA28.tmp"C:\Users\Admin\AppData\Local\Temp\BA28.tmp"37⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"38⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\BB41.tmp"C:\Users\Admin\AppData\Local\Temp\BB41.tmp"39⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"40⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"41⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"42⤵
- Executes dropped EXE
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\BD93.tmp"C:\Users\Admin\AppData\Local\Temp\BD93.tmp"43⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\BE20.tmp"C:\Users\Admin\AppData\Local\Temp\BE20.tmp"44⤵
- Executes dropped EXE
PID:736 -
C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"45⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"46⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"47⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"48⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\C18B.tmp"C:\Users\Admin\AppData\Local\Temp\C18B.tmp"49⤵
- Executes dropped EXE
PID:624 -
C:\Users\Admin\AppData\Local\Temp\C237.tmp"C:\Users\Admin\AppData\Local\Temp\C237.tmp"50⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"51⤵
- Executes dropped EXE
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\C36F.tmp"C:\Users\Admin\AppData\Local\Temp\C36F.tmp"52⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"53⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"54⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\C525.tmp"C:\Users\Admin\AppData\Local\Temp\C525.tmp"55⤵
- Executes dropped EXE
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"56⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\C63E.tmp"C:\Users\Admin\AppData\Local\Temp\C63E.tmp"57⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"58⤵
- Executes dropped EXE
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\C796.tmp"C:\Users\Admin\AppData\Local\Temp\C796.tmp"59⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\C813.tmp"C:\Users\Admin\AppData\Local\Temp\C813.tmp"60⤵
- Executes dropped EXE
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\C870.tmp"C:\Users\Admin\AppData\Local\Temp\C870.tmp"61⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\C8ED.tmp"C:\Users\Admin\AppData\Local\Temp\C8ED.tmp"62⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\C96A.tmp"C:\Users\Admin\AppData\Local\Temp\C96A.tmp"63⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"64⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\CA84.tmp"C:\Users\Admin\AppData\Local\Temp\CA84.tmp"65⤵
- Executes dropped EXE
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\CB01.tmp"C:\Users\Admin\AppData\Local\Temp\CB01.tmp"66⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"67⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\CC29.tmp"C:\Users\Admin\AppData\Local\Temp\CC29.tmp"68⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\CCC6.tmp"C:\Users\Admin\AppData\Local\Temp\CCC6.tmp"69⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\CD62.tmp"C:\Users\Admin\AppData\Local\Temp\CD62.tmp"70⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\CDEF.tmp"C:\Users\Admin\AppData\Local\Temp\CDEF.tmp"71⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"72⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\CF37.tmp"C:\Users\Admin\AppData\Local\Temp\CF37.tmp"73⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"74⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\D050.tmp"C:\Users\Admin\AppData\Local\Temp\D050.tmp"75⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"76⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\D169.tmp"C:\Users\Admin\AppData\Local\Temp\D169.tmp"77⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\D1F6.tmp"C:\Users\Admin\AppData\Local\Temp\D1F6.tmp"78⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\D273.tmp"C:\Users\Admin\AppData\Local\Temp\D273.tmp"79⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\D31F.tmp"C:\Users\Admin\AppData\Local\Temp\D31F.tmp"80⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\D39C.tmp"C:\Users\Admin\AppData\Local\Temp\D39C.tmp"81⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\D419.tmp"C:\Users\Admin\AppData\Local\Temp\D419.tmp"82⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"83⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\D542.tmp"C:\Users\Admin\AppData\Local\Temp\D542.tmp"84⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"85⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\D63C.tmp"C:\Users\Admin\AppData\Local\Temp\D63C.tmp"86⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\D6B9.tmp"C:\Users\Admin\AppData\Local\Temp\D6B9.tmp"87⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\D726.tmp"C:\Users\Admin\AppData\Local\Temp\D726.tmp"88⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\D784.tmp"C:\Users\Admin\AppData\Local\Temp\D784.tmp"89⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\D7F1.tmp"C:\Users\Admin\AppData\Local\Temp\D7F1.tmp"90⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\D86E.tmp"C:\Users\Admin\AppData\Local\Temp\D86E.tmp"91⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\D8CC.tmp"C:\Users\Admin\AppData\Local\Temp\D8CC.tmp"92⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\D939.tmp"C:\Users\Admin\AppData\Local\Temp\D939.tmp"93⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\D9A7.tmp"C:\Users\Admin\AppData\Local\Temp\D9A7.tmp"94⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\DA33.tmp"C:\Users\Admin\AppData\Local\Temp\DA33.tmp"95⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"96⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\DB7B.tmp"C:\Users\Admin\AppData\Local\Temp\DB7B.tmp"97⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\DC18.tmp"C:\Users\Admin\AppData\Local\Temp\DC18.tmp"98⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\DC75.tmp"C:\Users\Admin\AppData\Local\Temp\DC75.tmp"99⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\DCF2.tmp"C:\Users\Admin\AppData\Local\Temp\DCF2.tmp"100⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\DD6F.tmp"C:\Users\Admin\AppData\Local\Temp\DD6F.tmp"101⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\DE0C.tmp"C:\Users\Admin\AppData\Local\Temp\DE0C.tmp"102⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\DE98.tmp"C:\Users\Admin\AppData\Local\Temp\DE98.tmp"103⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\DF34.tmp"C:\Users\Admin\AppData\Local\Temp\DF34.tmp"104⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\DFA2.tmp"C:\Users\Admin\AppData\Local\Temp\DFA2.tmp"105⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\E03E.tmp"C:\Users\Admin\AppData\Local\Temp\E03E.tmp"106⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"107⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\E177.tmp"C:\Users\Admin\AppData\Local\Temp\E177.tmp"108⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\E1F4.tmp"C:\Users\Admin\AppData\Local\Temp\E1F4.tmp"109⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\E271.tmp"C:\Users\Admin\AppData\Local\Temp\E271.tmp"110⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\E30D.tmp"C:\Users\Admin\AppData\Local\Temp\E30D.tmp"111⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\E3A9.tmp"C:\Users\Admin\AppData\Local\Temp\E3A9.tmp"112⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\E436.tmp"C:\Users\Admin\AppData\Local\Temp\E436.tmp"113⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\E4D2.tmp"C:\Users\Admin\AppData\Local\Temp\E4D2.tmp"114⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\E54F.tmp"C:\Users\Admin\AppData\Local\Temp\E54F.tmp"115⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"116⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\E678.tmp"C:\Users\Admin\AppData\Local\Temp\E678.tmp"117⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\E724.tmp"C:\Users\Admin\AppData\Local\Temp\E724.tmp"118⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"119⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\E84D.tmp"C:\Users\Admin\AppData\Local\Temp\E84D.tmp"120⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\E8CA.tmp"C:\Users\Admin\AppData\Local\Temp\E8CA.tmp"121⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\E947.tmp"C:\Users\Admin\AppData\Local\Temp\E947.tmp"122⤵PID:64
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-