Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2023, 17:26
Static task
static1
Behavioral task
behavioral1
Sample
c2197997e59d013708abccc05bfbaf0c_mafia_JC.exe
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
c2197997e59d013708abccc05bfbaf0c_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
c2197997e59d013708abccc05bfbaf0c_mafia_JC.exe
-
Size
486KB
-
MD5
c2197997e59d013708abccc05bfbaf0c
-
SHA1
60e3a00a46757d79c0a16726d9acdf0bf2333691
-
SHA256
7a60df9b0e84d9396352fea953e26b865caf4d6dc6e0c1c0b3aaebb4ddd4945d
-
SHA512
1825aecd98d746f75156a7d5eadb72b463a5f880ee37acb583e4431d27e4944bca2c9f437093d9a26ba40ea4b769b4dfe46830106eab55d30a70e02ddb284161
-
SSDEEP
6144:Forf3lPvovsgZnqG2C7mOTeiLfD7E0T8DJidZmT7n/E9RDGe4h0eYpNzn1pNmgGM:UU5rCOTeiDEY8078/UDQhYzAbgye/NZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2728 9163.tmp 4072 91FF.tmp 2764 928B.tmp 2336 9347.tmp 216 93F3.tmp 4056 949F.tmp 3624 955A.tmp 4296 95F6.tmp 548 96A2.tmp 3664 975E.tmp 1060 97DB.tmp 4264 9867.tmp 3368 99DE.tmp 4664 9A6B.tmp 3336 9B36.tmp 1984 9BC3.tmp 3588 9C4F.tmp 4500 9CBD.tmp 4792 9D2A.tmp 3320 9DC6.tmp 3868 9E92.tmp 316 9F8C.tmp 3892 A066.tmp 1876 A141.tmp 3756 A1CE.tmp 4132 A24B.tmp 4768 A2F7.tmp 4680 A393.tmp 1944 A42F.tmp 4972 A4DB.tmp 3696 A558.tmp 4312 A633.tmp 5104 A6BF.tmp 4248 A75C.tmp 888 A7C9.tmp 1252 A846.tmp 856 A8B3.tmp 4436 A940.tmp 3444 A9EC.tmp 1520 AA69.tmp 1472 AAE6.tmp 3440 AB82.tmp 2596 AC0F.tmp 4376 ACAB.tmp 4484 AD47.tmp 2012 ADD4.tmp 4176 AE70.tmp 1300 AF0C.tmp 4852 AFA9.tmp 4864 B035.tmp 3184 B0E1.tmp 1776 B15E.tmp 2448 B1EB.tmp 4024 B287.tmp 3020 B342.tmp 2024 B3B0.tmp 4608 B43C.tmp 860 B4B9.tmp 2468 B546.tmp 4556 B5D3.tmp 3128 B65F.tmp 1044 B70B.tmp 4056 B779.tmp 4424 B805.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3820 wrote to memory of 2728 3820 c2197997e59d013708abccc05bfbaf0c_mafia_JC.exe 81 PID 3820 wrote to memory of 2728 3820 c2197997e59d013708abccc05bfbaf0c_mafia_JC.exe 81 PID 3820 wrote to memory of 2728 3820 c2197997e59d013708abccc05bfbaf0c_mafia_JC.exe 81 PID 2728 wrote to memory of 4072 2728 9163.tmp 82 PID 2728 wrote to memory of 4072 2728 9163.tmp 82 PID 2728 wrote to memory of 4072 2728 9163.tmp 82 PID 4072 wrote to memory of 2764 4072 91FF.tmp 83 PID 4072 wrote to memory of 2764 4072 91FF.tmp 83 PID 4072 wrote to memory of 2764 4072 91FF.tmp 83 PID 2764 wrote to memory of 2336 2764 928B.tmp 84 PID 2764 wrote to memory of 2336 2764 928B.tmp 84 PID 2764 wrote to memory of 2336 2764 928B.tmp 84 PID 2336 wrote to memory of 216 2336 9347.tmp 85 PID 2336 wrote to memory of 216 2336 9347.tmp 85 PID 2336 wrote to memory of 216 2336 9347.tmp 85 PID 216 wrote to memory of 4056 216 93F3.tmp 86 PID 216 wrote to memory of 4056 216 93F3.tmp 86 PID 216 wrote to memory of 4056 216 93F3.tmp 86 PID 4056 wrote to memory of 3624 4056 949F.tmp 87 PID 4056 wrote to memory of 3624 4056 949F.tmp 87 PID 4056 wrote to memory of 3624 4056 949F.tmp 87 PID 3624 wrote to memory of 4296 3624 955A.tmp 88 PID 3624 wrote to memory of 4296 3624 955A.tmp 88 PID 3624 wrote to memory of 4296 3624 955A.tmp 88 PID 4296 wrote to memory of 548 4296 95F6.tmp 89 PID 4296 wrote to memory of 548 4296 95F6.tmp 89 PID 4296 wrote to memory of 548 4296 95F6.tmp 89 PID 548 wrote to memory of 3664 548 96A2.tmp 91 PID 548 wrote to memory of 3664 548 96A2.tmp 91 PID 548 wrote to memory of 3664 548 96A2.tmp 91 PID 3664 wrote to memory of 1060 3664 975E.tmp 92 PID 3664 wrote to memory of 1060 3664 975E.tmp 92 PID 3664 wrote to memory of 1060 3664 975E.tmp 92 PID 1060 wrote to memory of 4264 1060 97DB.tmp 93 PID 1060 wrote to memory of 4264 1060 97DB.tmp 93 PID 1060 wrote to memory of 4264 1060 97DB.tmp 93 PID 4264 wrote to memory of 3368 4264 9867.tmp 94 PID 4264 wrote to memory of 3368 4264 9867.tmp 94 PID 4264 wrote to memory of 3368 4264 9867.tmp 94 PID 3368 wrote to memory of 4664 3368 99DE.tmp 95 PID 3368 wrote to memory of 4664 3368 99DE.tmp 95 PID 3368 wrote to memory of 4664 3368 99DE.tmp 95 PID 4664 wrote to memory of 3336 4664 9A6B.tmp 96 PID 4664 wrote to memory of 3336 4664 9A6B.tmp 96 PID 4664 wrote to memory of 3336 4664 9A6B.tmp 96 PID 3336 wrote to memory of 1984 3336 9B36.tmp 97 PID 3336 wrote to memory of 1984 3336 9B36.tmp 97 PID 3336 wrote to memory of 1984 3336 9B36.tmp 97 PID 1984 wrote to memory of 3588 1984 9BC3.tmp 98 PID 1984 wrote to memory of 3588 1984 9BC3.tmp 98 PID 1984 wrote to memory of 3588 1984 9BC3.tmp 98 PID 3588 wrote to memory of 4500 3588 9C4F.tmp 99 PID 3588 wrote to memory of 4500 3588 9C4F.tmp 99 PID 3588 wrote to memory of 4500 3588 9C4F.tmp 99 PID 4500 wrote to memory of 4792 4500 9CBD.tmp 100 PID 4500 wrote to memory of 4792 4500 9CBD.tmp 100 PID 4500 wrote to memory of 4792 4500 9CBD.tmp 100 PID 4792 wrote to memory of 3320 4792 9D2A.tmp 103 PID 4792 wrote to memory of 3320 4792 9D2A.tmp 103 PID 4792 wrote to memory of 3320 4792 9D2A.tmp 103 PID 3320 wrote to memory of 3868 3320 9DC6.tmp 104 PID 3320 wrote to memory of 3868 3320 9DC6.tmp 104 PID 3320 wrote to memory of 3868 3320 9DC6.tmp 104 PID 3868 wrote to memory of 316 3868 9E92.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2197997e59d013708abccc05bfbaf0c_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\c2197997e59d013708abccc05bfbaf0c_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\9163.tmp"C:\Users\Admin\AppData\Local\Temp\9163.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\93F3.tmp"C:\Users\Admin\AppData\Local\Temp\93F3.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\95F6.tmp"C:\Users\Admin\AppData\Local\Temp\95F6.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\97DB.tmp"C:\Users\Admin\AppData\Local\Temp\97DB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\9867.tmp"C:\Users\Admin\AppData\Local\Temp\9867.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"23⤵
- Executes dropped EXE
PID:316 -
C:\Users\Admin\AppData\Local\Temp\A066.tmp"C:\Users\Admin\AppData\Local\Temp\A066.tmp"24⤵
- Executes dropped EXE
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\A141.tmp"C:\Users\Admin\AppData\Local\Temp\A141.tmp"25⤵
- Executes dropped EXE
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"26⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\A24B.tmp"C:\Users\Admin\AppData\Local\Temp\A24B.tmp"27⤵
- Executes dropped EXE
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"28⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"29⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"30⤵
- Executes dropped EXE
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"31⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"32⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\A633.tmp"C:\Users\Admin\AppData\Local\Temp\A633.tmp"33⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"34⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"35⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"36⤵
- Executes dropped EXE
PID:888 -
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"37⤵
- Executes dropped EXE
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"38⤵
- Executes dropped EXE
PID:856 -
C:\Users\Admin\AppData\Local\Temp\A940.tmp"C:\Users\Admin\AppData\Local\Temp\A940.tmp"39⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"40⤵
- Executes dropped EXE
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\AA69.tmp"C:\Users\Admin\AppData\Local\Temp\AA69.tmp"41⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"42⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\AB82.tmp"C:\Users\Admin\AppData\Local\Temp\AB82.tmp"43⤵
- Executes dropped EXE
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"44⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"45⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"46⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"47⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\AE70.tmp"C:\Users\Admin\AppData\Local\Temp\AE70.tmp"48⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"49⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"50⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\B035.tmp"C:\Users\Admin\AppData\Local\Temp\B035.tmp"51⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"52⤵
- Executes dropped EXE
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\B15E.tmp"C:\Users\Admin\AppData\Local\Temp\B15E.tmp"53⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"54⤵
- Executes dropped EXE
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\B287.tmp"C:\Users\Admin\AppData\Local\Temp\B287.tmp"55⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\B342.tmp"C:\Users\Admin\AppData\Local\Temp\B342.tmp"56⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"57⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\B43C.tmp"C:\Users\Admin\AppData\Local\Temp\B43C.tmp"58⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"59⤵
- Executes dropped EXE
PID:860 -
C:\Users\Admin\AppData\Local\Temp\B546.tmp"C:\Users\Admin\AppData\Local\Temp\B546.tmp"60⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"61⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"62⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\B70B.tmp"C:\Users\Admin\AppData\Local\Temp\B70B.tmp"63⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\B779.tmp"C:\Users\Admin\AppData\Local\Temp\B779.tmp"64⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\B805.tmp"C:\Users\Admin\AppData\Local\Temp\B805.tmp"65⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\B892.tmp"C:\Users\Admin\AppData\Local\Temp\B892.tmp"66⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"67⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\B96D.tmp"C:\Users\Admin\AppData\Local\Temp\B96D.tmp"68⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"69⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\BA67.tmp"C:\Users\Admin\AppData\Local\Temp\BA67.tmp"70⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"71⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\BB32.tmp"C:\Users\Admin\AppData\Local\Temp\BB32.tmp"72⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"73⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"74⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"75⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\BD26.tmp"C:\Users\Admin\AppData\Local\Temp\BD26.tmp"76⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"77⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"78⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"79⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"80⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"81⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"82⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"83⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"84⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\C208.tmp"C:\Users\Admin\AppData\Local\Temp\C208.tmp"85⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"86⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\C36F.tmp"C:\Users\Admin\AppData\Local\Temp\C36F.tmp"87⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\C3DC.tmp"C:\Users\Admin\AppData\Local\Temp\C3DC.tmp"88⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\C479.tmp"C:\Users\Admin\AppData\Local\Temp\C479.tmp"89⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"90⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\C553.tmp"C:\Users\Admin\AppData\Local\Temp\C553.tmp"91⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"92⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\C63E.tmp"C:\Users\Admin\AppData\Local\Temp\C63E.tmp"93⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\C69C.tmp"C:\Users\Admin\AppData\Local\Temp\C69C.tmp"94⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\C709.tmp"C:\Users\Admin\AppData\Local\Temp\C709.tmp"95⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\C776.tmp"C:\Users\Admin\AppData\Local\Temp\C776.tmp"96⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"97⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\C880.tmp"C:\Users\Admin\AppData\Local\Temp\C880.tmp"98⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"99⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\C97A.tmp"C:\Users\Admin\AppData\Local\Temp\C97A.tmp"100⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\CA07.tmp"C:\Users\Admin\AppData\Local\Temp\CA07.tmp"101⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\CA93.tmp"C:\Users\Admin\AppData\Local\Temp\CA93.tmp"102⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\CB01.tmp"C:\Users\Admin\AppData\Local\Temp\CB01.tmp"103⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"104⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\CC0A.tmp"C:\Users\Admin\AppData\Local\Temp\CC0A.tmp"105⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"106⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\CD43.tmp"C:\Users\Admin\AppData\Local\Temp\CD43.tmp"107⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\CDC0.tmp"C:\Users\Admin\AppData\Local\Temp\CDC0.tmp"108⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\CE3D.tmp"C:\Users\Admin\AppData\Local\Temp\CE3D.tmp"109⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\CEC9.tmp"C:\Users\Admin\AppData\Local\Temp\CEC9.tmp"110⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\CF56.tmp"C:\Users\Admin\AppData\Local\Temp\CF56.tmp"111⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\CFE3.tmp"C:\Users\Admin\AppData\Local\Temp\CFE3.tmp"112⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\D07F.tmp"C:\Users\Admin\AppData\Local\Temp\D07F.tmp"113⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\D11B.tmp"C:\Users\Admin\AppData\Local\Temp\D11B.tmp"114⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\D1A8.tmp"C:\Users\Admin\AppData\Local\Temp\D1A8.tmp"115⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\D215.tmp"C:\Users\Admin\AppData\Local\Temp\D215.tmp"116⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\D282.tmp"C:\Users\Admin\AppData\Local\Temp\D282.tmp"117⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"118⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\D38C.tmp"C:\Users\Admin\AppData\Local\Temp\D38C.tmp"119⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\D428.tmp"C:\Users\Admin\AppData\Local\Temp\D428.tmp"120⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\D4B5.tmp"C:\Users\Admin\AppData\Local\Temp\D4B5.tmp"121⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\D542.tmp"C:\Users\Admin\AppData\Local\Temp\D542.tmp"122⤵PID:1244
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-