Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2023, 19:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ca59f97e8017350bce9b5fa1eb7dbcdf_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
ca59f97e8017350bce9b5fa1eb7dbcdf_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
ca59f97e8017350bce9b5fa1eb7dbcdf_mafia_JC.exe
-
Size
486KB
-
MD5
ca59f97e8017350bce9b5fa1eb7dbcdf
-
SHA1
db491cafd15435ff491117290061ca415e4c9111
-
SHA256
3d3a7e712a2aca10516275e34f46d04634bc6d997a96b68d6c0e76e02580d82e
-
SHA512
59118cf2a3dcb84d5d638bf4767232b72febc57d5262fceebb02d056d4f81c0eabfa61c614a4b252142d6ba6675b7a82561da52f8f691201b8a8451b993e6247
-
SSDEEP
12288:oU5rCOTeiDZ4bD7stOLda/99eJa1MHN0WktN6RNZ:oUQOJD6bD7TcemMHN0tN6RN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2620 B074.tmp 3052 B15E.tmp 4920 B229.tmp 1272 B304.tmp 2180 B391.tmp 5044 B45C.tmp 4572 B508.tmp 752 B5A4.tmp 4548 B70B.tmp 2560 B7E6.tmp 3212 B8A1.tmp 4064 B91E.tmp 1820 B9F9.tmp 2052 BA86.tmp 4388 BB9F.tmp 2664 BC7A.tmp 4364 BD64.tmp 4976 BE6E.tmp 3392 BF49.tmp 2192 C081.tmp 932 C10E.tmp 2688 C1AA.tmp 3296 C246.tmp 3068 C2D3.tmp 2196 C36F.tmp 4268 C40B.tmp 4872 C4C7.tmp 4632 C592.tmp 3992 C6BB.tmp 2740 C757.tmp 1388 C851.tmp 768 C91C.tmp 1248 C9E7.tmp 4148 CA84.tmp 3568 CB01.tmp 952 CBAC.tmp 4900 CC39.tmp 4640 CCB6.tmp 2520 CD52.tmp 1452 CDEF.tmp 3312 CEBA.tmp 4856 CF56.tmp 1376 CFE3.tmp 4280 D09E.tmp 1832 D14A.tmp 4608 D1D7.tmp 2852 D263.tmp 4992 D2FF.tmp 1104 D38C.tmp 892 D409.tmp 460 D486.tmp 3860 D503.tmp 4428 D590.tmp 5016 D62C.tmp 2620 D6C8.tmp 5072 D774.tmp 1624 D801.tmp 5068 D88D.tmp 4196 D90A.tmp 1924 D9C6.tmp 1740 DA62.tmp 1824 DACF.tmp 3096 DB6C.tmp 1972 DC18.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3808 wrote to memory of 2620 3808 ca59f97e8017350bce9b5fa1eb7dbcdf_mafia_JC.exe 80 PID 3808 wrote to memory of 2620 3808 ca59f97e8017350bce9b5fa1eb7dbcdf_mafia_JC.exe 80 PID 3808 wrote to memory of 2620 3808 ca59f97e8017350bce9b5fa1eb7dbcdf_mafia_JC.exe 80 PID 2620 wrote to memory of 3052 2620 B074.tmp 81 PID 2620 wrote to memory of 3052 2620 B074.tmp 81 PID 2620 wrote to memory of 3052 2620 B074.tmp 81 PID 3052 wrote to memory of 4920 3052 B15E.tmp 82 PID 3052 wrote to memory of 4920 3052 B15E.tmp 82 PID 3052 wrote to memory of 4920 3052 B15E.tmp 82 PID 4920 wrote to memory of 1272 4920 B229.tmp 83 PID 4920 wrote to memory of 1272 4920 B229.tmp 83 PID 4920 wrote to memory of 1272 4920 B229.tmp 83 PID 1272 wrote to memory of 2180 1272 B304.tmp 84 PID 1272 wrote to memory of 2180 1272 B304.tmp 84 PID 1272 wrote to memory of 2180 1272 B304.tmp 84 PID 2180 wrote to memory of 5044 2180 B391.tmp 85 PID 2180 wrote to memory of 5044 2180 B391.tmp 85 PID 2180 wrote to memory of 5044 2180 B391.tmp 85 PID 5044 wrote to memory of 4572 5044 B45C.tmp 87 PID 5044 wrote to memory of 4572 5044 B45C.tmp 87 PID 5044 wrote to memory of 4572 5044 B45C.tmp 87 PID 4572 wrote to memory of 752 4572 B508.tmp 88 PID 4572 wrote to memory of 752 4572 B508.tmp 88 PID 4572 wrote to memory of 752 4572 B508.tmp 88 PID 752 wrote to memory of 4548 752 B5A4.tmp 89 PID 752 wrote to memory of 4548 752 B5A4.tmp 89 PID 752 wrote to memory of 4548 752 B5A4.tmp 89 PID 4548 wrote to memory of 2560 4548 B70B.tmp 90 PID 4548 wrote to memory of 2560 4548 B70B.tmp 90 PID 4548 wrote to memory of 2560 4548 B70B.tmp 90 PID 2560 wrote to memory of 3212 2560 B7E6.tmp 91 PID 2560 wrote to memory of 3212 2560 B7E6.tmp 91 PID 2560 wrote to memory of 3212 2560 B7E6.tmp 91 PID 3212 wrote to memory of 4064 3212 B8A1.tmp 92 PID 3212 wrote to memory of 4064 3212 B8A1.tmp 92 PID 3212 wrote to memory of 4064 3212 B8A1.tmp 92 PID 4064 wrote to memory of 1820 4064 B91E.tmp 93 PID 4064 wrote to memory of 1820 4064 B91E.tmp 93 PID 4064 wrote to memory of 1820 4064 B91E.tmp 93 PID 1820 wrote to memory of 2052 1820 B9F9.tmp 94 PID 1820 wrote to memory of 2052 1820 B9F9.tmp 94 PID 1820 wrote to memory of 2052 1820 B9F9.tmp 94 PID 2052 wrote to memory of 4388 2052 BA86.tmp 95 PID 2052 wrote to memory of 4388 2052 BA86.tmp 95 PID 2052 wrote to memory of 4388 2052 BA86.tmp 95 PID 4388 wrote to memory of 2664 4388 BB9F.tmp 98 PID 4388 wrote to memory of 2664 4388 BB9F.tmp 98 PID 4388 wrote to memory of 2664 4388 BB9F.tmp 98 PID 2664 wrote to memory of 4364 2664 BC7A.tmp 99 PID 2664 wrote to memory of 4364 2664 BC7A.tmp 99 PID 2664 wrote to memory of 4364 2664 BC7A.tmp 99 PID 4364 wrote to memory of 4976 4364 BD64.tmp 100 PID 4364 wrote to memory of 4976 4364 BD64.tmp 100 PID 4364 wrote to memory of 4976 4364 BD64.tmp 100 PID 4976 wrote to memory of 3392 4976 BE6E.tmp 101 PID 4976 wrote to memory of 3392 4976 BE6E.tmp 101 PID 4976 wrote to memory of 3392 4976 BE6E.tmp 101 PID 3392 wrote to memory of 2192 3392 BF49.tmp 103 PID 3392 wrote to memory of 2192 3392 BF49.tmp 103 PID 3392 wrote to memory of 2192 3392 BF49.tmp 103 PID 2192 wrote to memory of 932 2192 C081.tmp 104 PID 2192 wrote to memory of 932 2192 C081.tmp 104 PID 2192 wrote to memory of 932 2192 C081.tmp 104 PID 932 wrote to memory of 2688 932 C10E.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca59f97e8017350bce9b5fa1eb7dbcdf_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\ca59f97e8017350bce9b5fa1eb7dbcdf_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\B074.tmp"C:\Users\Admin\AppData\Local\Temp\B074.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\B15E.tmp"C:\Users\Admin\AppData\Local\Temp\B15E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\B229.tmp"C:\Users\Admin\AppData\Local\Temp\B229.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\B304.tmp"C:\Users\Admin\AppData\Local\Temp\B304.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\B391.tmp"C:\Users\Admin\AppData\Local\Temp\B391.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\B45C.tmp"C:\Users\Admin\AppData\Local\Temp\B45C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\B508.tmp"C:\Users\Admin\AppData\Local\Temp\B508.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\B70B.tmp"C:\Users\Admin\AppData\Local\Temp\B70B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\B91E.tmp"C:\Users\Admin\AppData\Local\Temp\B91E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\BA86.tmp"C:\Users\Admin\AppData\Local\Temp\BA86.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\BD64.tmp"C:\Users\Admin\AppData\Local\Temp\BD64.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\BF49.tmp"C:\Users\Admin\AppData\Local\Temp\BF49.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\C10E.tmp"C:\Users\Admin\AppData\Local\Temp\C10E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"23⤵
- Executes dropped EXE
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\C246.tmp"C:\Users\Admin\AppData\Local\Temp\C246.tmp"24⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"25⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\C36F.tmp"C:\Users\Admin\AppData\Local\Temp\C36F.tmp"26⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\C40B.tmp"C:\Users\Admin\AppData\Local\Temp\C40B.tmp"27⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\C4C7.tmp"C:\Users\Admin\AppData\Local\Temp\C4C7.tmp"28⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\C592.tmp"C:\Users\Admin\AppData\Local\Temp\C592.tmp"29⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"30⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\C757.tmp"C:\Users\Admin\AppData\Local\Temp\C757.tmp"31⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\C851.tmp"C:\Users\Admin\AppData\Local\Temp\C851.tmp"32⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\C91C.tmp"C:\Users\Admin\AppData\Local\Temp\C91C.tmp"33⤵
- Executes dropped EXE
PID:768 -
C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"34⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\CA84.tmp"C:\Users\Admin\AppData\Local\Temp\CA84.tmp"35⤵
- Executes dropped EXE
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\CB01.tmp"C:\Users\Admin\AppData\Local\Temp\CB01.tmp"36⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\CBAC.tmp"C:\Users\Admin\AppData\Local\Temp\CBAC.tmp"37⤵
- Executes dropped EXE
PID:952 -
C:\Users\Admin\AppData\Local\Temp\CC39.tmp"C:\Users\Admin\AppData\Local\Temp\CC39.tmp"38⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"39⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\CD52.tmp"C:\Users\Admin\AppData\Local\Temp\CD52.tmp"40⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\CDEF.tmp"C:\Users\Admin\AppData\Local\Temp\CDEF.tmp"41⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"42⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\CF56.tmp"C:\Users\Admin\AppData\Local\Temp\CF56.tmp"43⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\CFE3.tmp"C:\Users\Admin\AppData\Local\Temp\CFE3.tmp"44⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\D09E.tmp"C:\Users\Admin\AppData\Local\Temp\D09E.tmp"45⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\D14A.tmp"C:\Users\Admin\AppData\Local\Temp\D14A.tmp"46⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\D1D7.tmp"C:\Users\Admin\AppData\Local\Temp\D1D7.tmp"47⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\D263.tmp"C:\Users\Admin\AppData\Local\Temp\D263.tmp"48⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\D2FF.tmp"C:\Users\Admin\AppData\Local\Temp\D2FF.tmp"49⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\D38C.tmp"C:\Users\Admin\AppData\Local\Temp\D38C.tmp"50⤵
- Executes dropped EXE
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\D409.tmp"C:\Users\Admin\AppData\Local\Temp\D409.tmp"51⤵
- Executes dropped EXE
PID:892 -
C:\Users\Admin\AppData\Local\Temp\D486.tmp"C:\Users\Admin\AppData\Local\Temp\D486.tmp"52⤵
- Executes dropped EXE
PID:460 -
C:\Users\Admin\AppData\Local\Temp\D503.tmp"C:\Users\Admin\AppData\Local\Temp\D503.tmp"53⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\D590.tmp"C:\Users\Admin\AppData\Local\Temp\D590.tmp"54⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\D62C.tmp"C:\Users\Admin\AppData\Local\Temp\D62C.tmp"55⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"56⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\D774.tmp"C:\Users\Admin\AppData\Local\Temp\D774.tmp"57⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\D801.tmp"C:\Users\Admin\AppData\Local\Temp\D801.tmp"58⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\D88D.tmp"C:\Users\Admin\AppData\Local\Temp\D88D.tmp"59⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\D90A.tmp"C:\Users\Admin\AppData\Local\Temp\D90A.tmp"60⤵
- Executes dropped EXE
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\D9C6.tmp"C:\Users\Admin\AppData\Local\Temp\D9C6.tmp"61⤵
- Executes dropped EXE
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\DA62.tmp"C:\Users\Admin\AppData\Local\Temp\DA62.tmp"62⤵
- Executes dropped EXE
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\DACF.tmp"C:\Users\Admin\AppData\Local\Temp\DACF.tmp"63⤵
- Executes dropped EXE
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\DB6C.tmp"C:\Users\Admin\AppData\Local\Temp\DB6C.tmp"64⤵
- Executes dropped EXE
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\DC18.tmp"C:\Users\Admin\AppData\Local\Temp\DC18.tmp"65⤵
- Executes dropped EXE
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\DC95.tmp"C:\Users\Admin\AppData\Local\Temp\DC95.tmp"66⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\DD12.tmp"C:\Users\Admin\AppData\Local\Temp\DD12.tmp"67⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\DD9E.tmp"C:\Users\Admin\AppData\Local\Temp\DD9E.tmp"68⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"69⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\DE89.tmp"C:\Users\Admin\AppData\Local\Temp\DE89.tmp"70⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\DF63.tmp"C:\Users\Admin\AppData\Local\Temp\DF63.tmp"71⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"72⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\E06D.tmp"C:\Users\Admin\AppData\Local\Temp\E06D.tmp"73⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"74⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\E167.tmp"C:\Users\Admin\AppData\Local\Temp\E167.tmp"75⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\E1D4.tmp"C:\Users\Admin\AppData\Local\Temp\E1D4.tmp"76⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\E232.tmp"C:\Users\Admin\AppData\Local\Temp\E232.tmp"77⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"78⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\E34B.tmp"C:\Users\Admin\AppData\Local\Temp\E34B.tmp"79⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"80⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\E455.tmp"C:\Users\Admin\AppData\Local\Temp\E455.tmp"81⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\E4F1.tmp"C:\Users\Admin\AppData\Local\Temp\E4F1.tmp"82⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\E55F.tmp"C:\Users\Admin\AppData\Local\Temp\E55F.tmp"83⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\E5EB.tmp"C:\Users\Admin\AppData\Local\Temp\E5EB.tmp"84⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\E697.tmp"C:\Users\Admin\AppData\Local\Temp\E697.tmp"85⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\E714.tmp"C:\Users\Admin\AppData\Local\Temp\E714.tmp"86⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\E781.tmp"C:\Users\Admin\AppData\Local\Temp\E781.tmp"87⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\E81E.tmp"C:\Users\Admin\AppData\Local\Temp\E81E.tmp"88⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\E88B.tmp"C:\Users\Admin\AppData\Local\Temp\E88B.tmp"89⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\E918.tmp"C:\Users\Admin\AppData\Local\Temp\E918.tmp"90⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\E995.tmp"C:\Users\Admin\AppData\Local\Temp\E995.tmp"91⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\EA02.tmp"C:\Users\Admin\AppData\Local\Temp\EA02.tmp"92⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\EA60.tmp"C:\Users\Admin\AppData\Local\Temp\EA60.tmp"93⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"94⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\EB89.tmp"C:\Users\Admin\AppData\Local\Temp\EB89.tmp"95⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\EC15.tmp"C:\Users\Admin\AppData\Local\Temp\EC15.tmp"96⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\EC83.tmp"C:\Users\Admin\AppData\Local\Temp\EC83.tmp"97⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\ED00.tmp"C:\Users\Admin\AppData\Local\Temp\ED00.tmp"98⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\ED6D.tmp"C:\Users\Admin\AppData\Local\Temp\ED6D.tmp"99⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\EDFA.tmp"C:\Users\Admin\AppData\Local\Temp\EDFA.tmp"100⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\EE77.tmp"C:\Users\Admin\AppData\Local\Temp\EE77.tmp"101⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\EEF4.tmp"C:\Users\Admin\AppData\Local\Temp\EEF4.tmp"102⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\EF71.tmp"C:\Users\Admin\AppData\Local\Temp\EF71.tmp"103⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\F01D.tmp"C:\Users\Admin\AppData\Local\Temp\F01D.tmp"104⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"105⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\F145.tmp"C:\Users\Admin\AppData\Local\Temp\F145.tmp"106⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\F1D2.tmp"C:\Users\Admin\AppData\Local\Temp\F1D2.tmp"107⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\F25F.tmp"C:\Users\Admin\AppData\Local\Temp\F25F.tmp"108⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\F2EB.tmp"C:\Users\Admin\AppData\Local\Temp\F2EB.tmp"109⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\F378.tmp"C:\Users\Admin\AppData\Local\Temp\F378.tmp"110⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\F405.tmp"C:\Users\Admin\AppData\Local\Temp\F405.tmp"111⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\F482.tmp"C:\Users\Admin\AppData\Local\Temp\F482.tmp"112⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\F50E.tmp"C:\Users\Admin\AppData\Local\Temp\F50E.tmp"113⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\F58B.tmp"C:\Users\Admin\AppData\Local\Temp\F58B.tmp"114⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\F618.tmp"C:\Users\Admin\AppData\Local\Temp\F618.tmp"115⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"116⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\F721.tmp"C:\Users\Admin\AppData\Local\Temp\F721.tmp"117⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\F78F.tmp"C:\Users\Admin\AppData\Local\Temp\F78F.tmp"118⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\F7FC.tmp"C:\Users\Admin\AppData\Local\Temp\F7FC.tmp"119⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"120⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\F935.tmp"C:\Users\Admin\AppData\Local\Temp\F935.tmp"121⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\F9A2.tmp"C:\Users\Admin\AppData\Local\Temp\F9A2.tmp"122⤵PID:3784
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-