Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2023, 19:42
Static task
static1
Behavioral task
behavioral1
Sample
cab80e2f8fc96c39fb0eef82ae37a597_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
cab80e2f8fc96c39fb0eef82ae37a597_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
cab80e2f8fc96c39fb0eef82ae37a597_mafia_JC.exe
-
Size
486KB
-
MD5
cab80e2f8fc96c39fb0eef82ae37a597
-
SHA1
ef8801eefb49bf189ffd857448d9c14c45015e81
-
SHA256
90c69fa959825d9987d621090d8bf1bffd81e8da9e108caf6a5ed61d7becade0
-
SHA512
16f18d14f084fa3973456837fe98cd8f775648e74736ae4ebd9734b82048069489aedf0a6903d4e1d345af40b25dc281c7a4dde7ff1b65887582c6aed6ca2a6f
-
SSDEEP
6144:Borf3lPvovsgZnqG2C7mOTeiLfD7Ea9v8AP/uz1eCEjj1l3fxz6NcnyjJtTn1R5b:oU5rCOTeiD38P101lVRna1fPNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2240 7AFC.tmp 1504 7BA8.tmp 3628 7C64.tmp 4964 7D5E.tmp 3964 7E58.tmp 2160 7F42.tmp 1132 801D.tmp 4592 80B9.tmp 3328 8155.tmp 1508 8201.tmp 4712 828E.tmp 2708 8359.tmp 1996 83E5.tmp 4004 854D.tmp 2860 85D9.tmp 388 86B4.tmp 2784 877F.tmp 2912 87FC.tmp 3992 8889.tmp 2656 8973.tmp 4744 8A1F.tmp 1612 8AFA.tmp 4020 8BE4.tmp 4216 8CCF.tmp 4228 8D8A.tmp 4992 8E17.tmp 4288 8ED2.tmp 4832 8F7E.tmp 4120 900B.tmp 2624 9088.tmp 1936 90F5.tmp 4728 91C0.tmp 4836 926C.tmp 3388 9318.tmp 2788 93B4.tmp 688 9422.tmp 5112 94AE.tmp 2144 952B.tmp 2324 95B8.tmp 2968 9654.tmp 2008 96F0.tmp 2536 977D.tmp 3652 9829.tmp 3284 98C5.tmp 2096 9971.tmp 3472 9A5B.tmp 556 9AC9.tmp 4244 9B65.tmp 1268 9C11.tmp 4300 9C9E.tmp 3924 9D49.tmp 1832 9DD6.tmp 3588 9E43.tmp 5096 9EC0.tmp 2444 9F3D.tmp 4388 9FBA.tmp 3840 A037.tmp 3784 A0C4.tmp 4184 A131.tmp 408 A1CE.tmp 2180 A25A.tmp 2132 A306.tmp 4888 A393.tmp 4772 A43F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4300 wrote to memory of 2240 4300 cab80e2f8fc96c39fb0eef82ae37a597_mafia_JC.exe 81 PID 4300 wrote to memory of 2240 4300 cab80e2f8fc96c39fb0eef82ae37a597_mafia_JC.exe 81 PID 4300 wrote to memory of 2240 4300 cab80e2f8fc96c39fb0eef82ae37a597_mafia_JC.exe 81 PID 2240 wrote to memory of 1504 2240 7AFC.tmp 82 PID 2240 wrote to memory of 1504 2240 7AFC.tmp 82 PID 2240 wrote to memory of 1504 2240 7AFC.tmp 82 PID 1504 wrote to memory of 3628 1504 7BA8.tmp 83 PID 1504 wrote to memory of 3628 1504 7BA8.tmp 83 PID 1504 wrote to memory of 3628 1504 7BA8.tmp 83 PID 3628 wrote to memory of 4964 3628 7C64.tmp 84 PID 3628 wrote to memory of 4964 3628 7C64.tmp 84 PID 3628 wrote to memory of 4964 3628 7C64.tmp 84 PID 4964 wrote to memory of 3964 4964 7D5E.tmp 85 PID 4964 wrote to memory of 3964 4964 7D5E.tmp 85 PID 4964 wrote to memory of 3964 4964 7D5E.tmp 85 PID 3964 wrote to memory of 2160 3964 7E58.tmp 86 PID 3964 wrote to memory of 2160 3964 7E58.tmp 86 PID 3964 wrote to memory of 2160 3964 7E58.tmp 86 PID 2160 wrote to memory of 1132 2160 7F42.tmp 87 PID 2160 wrote to memory of 1132 2160 7F42.tmp 87 PID 2160 wrote to memory of 1132 2160 7F42.tmp 87 PID 1132 wrote to memory of 4592 1132 801D.tmp 88 PID 1132 wrote to memory of 4592 1132 801D.tmp 88 PID 1132 wrote to memory of 4592 1132 801D.tmp 88 PID 4592 wrote to memory of 3328 4592 80B9.tmp 89 PID 4592 wrote to memory of 3328 4592 80B9.tmp 89 PID 4592 wrote to memory of 3328 4592 80B9.tmp 89 PID 3328 wrote to memory of 1508 3328 8155.tmp 90 PID 3328 wrote to memory of 1508 3328 8155.tmp 90 PID 3328 wrote to memory of 1508 3328 8155.tmp 90 PID 1508 wrote to memory of 4712 1508 8201.tmp 91 PID 1508 wrote to memory of 4712 1508 8201.tmp 91 PID 1508 wrote to memory of 4712 1508 8201.tmp 91 PID 4712 wrote to memory of 2708 4712 828E.tmp 93 PID 4712 wrote to memory of 2708 4712 828E.tmp 93 PID 4712 wrote to memory of 2708 4712 828E.tmp 93 PID 2708 wrote to memory of 1996 2708 8359.tmp 94 PID 2708 wrote to memory of 1996 2708 8359.tmp 94 PID 2708 wrote to memory of 1996 2708 8359.tmp 94 PID 1996 wrote to memory of 4004 1996 83E5.tmp 95 PID 1996 wrote to memory of 4004 1996 83E5.tmp 95 PID 1996 wrote to memory of 4004 1996 83E5.tmp 95 PID 4004 wrote to memory of 2860 4004 854D.tmp 96 PID 4004 wrote to memory of 2860 4004 854D.tmp 96 PID 4004 wrote to memory of 2860 4004 854D.tmp 96 PID 2860 wrote to memory of 388 2860 85D9.tmp 97 PID 2860 wrote to memory of 388 2860 85D9.tmp 97 PID 2860 wrote to memory of 388 2860 85D9.tmp 97 PID 388 wrote to memory of 2784 388 86B4.tmp 98 PID 388 wrote to memory of 2784 388 86B4.tmp 98 PID 388 wrote to memory of 2784 388 86B4.tmp 98 PID 2784 wrote to memory of 2912 2784 877F.tmp 99 PID 2784 wrote to memory of 2912 2784 877F.tmp 99 PID 2784 wrote to memory of 2912 2784 877F.tmp 99 PID 2912 wrote to memory of 3992 2912 87FC.tmp 100 PID 2912 wrote to memory of 3992 2912 87FC.tmp 100 PID 2912 wrote to memory of 3992 2912 87FC.tmp 100 PID 3992 wrote to memory of 2656 3992 8889.tmp 101 PID 3992 wrote to memory of 2656 3992 8889.tmp 101 PID 3992 wrote to memory of 2656 3992 8889.tmp 101 PID 2656 wrote to memory of 4744 2656 8973.tmp 104 PID 2656 wrote to memory of 4744 2656 8973.tmp 104 PID 2656 wrote to memory of 4744 2656 8973.tmp 104 PID 4744 wrote to memory of 1612 4744 8A1F.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\cab80e2f8fc96c39fb0eef82ae37a597_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\cab80e2f8fc96c39fb0eef82ae37a597_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\7C64.tmp"C:\Users\Admin\AppData\Local\Temp\7C64.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\7F42.tmp"C:\Users\Admin\AppData\Local\Temp\7F42.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\801D.tmp"C:\Users\Admin\AppData\Local\Temp\801D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\80B9.tmp"C:\Users\Admin\AppData\Local\Temp\80B9.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\8155.tmp"C:\Users\Admin\AppData\Local\Temp\8155.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\8201.tmp"C:\Users\Admin\AppData\Local\Temp\8201.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\828E.tmp"C:\Users\Admin\AppData\Local\Temp\828E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\8359.tmp"C:\Users\Admin\AppData\Local\Temp\8359.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\83E5.tmp"C:\Users\Admin\AppData\Local\Temp\83E5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\854D.tmp"C:\Users\Admin\AppData\Local\Temp\854D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\85D9.tmp"C:\Users\Admin\AppData\Local\Temp\85D9.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Users\Admin\AppData\Local\Temp\877F.tmp"C:\Users\Admin\AppData\Local\Temp\877F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\87FC.tmp"C:\Users\Admin\AppData\Local\Temp\87FC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\8889.tmp"C:\Users\Admin\AppData\Local\Temp\8889.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\8973.tmp"C:\Users\Admin\AppData\Local\Temp\8973.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"23⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"24⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"25⤵
- Executes dropped EXE
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"26⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\8E17.tmp"C:\Users\Admin\AppData\Local\Temp\8E17.tmp"27⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"28⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"29⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\900B.tmp"C:\Users\Admin\AppData\Local\Temp\900B.tmp"30⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"31⤵
- Executes dropped EXE
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"32⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\91C0.tmp"C:\Users\Admin\AppData\Local\Temp\91C0.tmp"33⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\926C.tmp"C:\Users\Admin\AppData\Local\Temp\926C.tmp"34⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"35⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\93B4.tmp"C:\Users\Admin\AppData\Local\Temp\93B4.tmp"36⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\9422.tmp"C:\Users\Admin\AppData\Local\Temp\9422.tmp"37⤵
- Executes dropped EXE
PID:688 -
C:\Users\Admin\AppData\Local\Temp\94AE.tmp"C:\Users\Admin\AppData\Local\Temp\94AE.tmp"38⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"39⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\95B8.tmp"C:\Users\Admin\AppData\Local\Temp\95B8.tmp"40⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\9654.tmp"C:\Users\Admin\AppData\Local\Temp\9654.tmp"41⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\96F0.tmp"C:\Users\Admin\AppData\Local\Temp\96F0.tmp"42⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\977D.tmp"C:\Users\Admin\AppData\Local\Temp\977D.tmp"43⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"44⤵
- Executes dropped EXE
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\98C5.tmp"C:\Users\Admin\AppData\Local\Temp\98C5.tmp"45⤵
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"46⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"47⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"48⤵
- Executes dropped EXE
PID:556 -
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"49⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"50⤵
- Executes dropped EXE
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"51⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"52⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"53⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"54⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"55⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"56⤵
- Executes dropped EXE
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"57⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"58⤵
- Executes dropped EXE
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"59⤵
- Executes dropped EXE
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"60⤵
- Executes dropped EXE
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"61⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"62⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\A306.tmp"C:\Users\Admin\AppData\Local\Temp\A306.tmp"63⤵
- Executes dropped EXE
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"64⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\A43F.tmp"C:\Users\Admin\AppData\Local\Temp\A43F.tmp"65⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"66⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"67⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"68⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"69⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"70⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\A76B.tmp"C:\Users\Admin\AppData\Local\Temp\A76B.tmp"71⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"72⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\A856.tmp"C:\Users\Admin\AppData\Local\Temp\A856.tmp"73⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"74⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\A921.tmp"C:\Users\Admin\AppData\Local\Temp\A921.tmp"75⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"76⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"77⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"78⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"79⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"80⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"81⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"82⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\AD95.tmp"C:\Users\Admin\AppData\Local\Temp\AD95.tmp"83⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"84⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"85⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"86⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"87⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\B045.tmp"C:\Users\Admin\AppData\Local\Temp\B045.tmp"88⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"89⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\B120.tmp"C:\Users\Admin\AppData\Local\Temp\B120.tmp"90⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\B17D.tmp"C:\Users\Admin\AppData\Local\Temp\B17D.tmp"91⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"92⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\B287.tmp"C:\Users\Admin\AppData\Local\Temp\B287.tmp"93⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\B304.tmp"C:\Users\Admin\AppData\Local\Temp\B304.tmp"94⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"95⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\B45C.tmp"C:\Users\Admin\AppData\Local\Temp\B45C.tmp"96⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"97⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\B546.tmp"C:\Users\Admin\AppData\Local\Temp\B546.tmp"98⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"99⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\B640.tmp"C:\Users\Admin\AppData\Local\Temp\B640.tmp"100⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"101⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\B759.tmp"C:\Users\Admin\AppData\Local\Temp\B759.tmp"102⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\B805.tmp"C:\Users\Admin\AppData\Local\Temp\B805.tmp"103⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\B882.tmp"C:\Users\Admin\AppData\Local\Temp\B882.tmp"104⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\B91E.tmp"C:\Users\Admin\AppData\Local\Temp\B91E.tmp"105⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"106⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\BA38.tmp"C:\Users\Admin\AppData\Local\Temp\BA38.tmp"107⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"108⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\BB22.tmp"C:\Users\Admin\AppData\Local\Temp\BB22.tmp"109⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"110⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"111⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"112⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\BD16.tmp"C:\Users\Admin\AppData\Local\Temp\BD16.tmp"113⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\BD93.tmp"C:\Users\Admin\AppData\Local\Temp\BD93.tmp"114⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\BE20.tmp"C:\Users\Admin\AppData\Local\Temp\BE20.tmp"115⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"116⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\BF29.tmp"C:\Users\Admin\AppData\Local\Temp\BF29.tmp"117⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"118⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\C043.tmp"C:\Users\Admin\AppData\Local\Temp\C043.tmp"119⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"120⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\C16B.tmp"C:\Users\Admin\AppData\Local\Temp\C16B.tmp"121⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"122⤵PID:3964
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-