Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2023, 19:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cacb666fb4145a5519e4698ec56c5881_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
cacb666fb4145a5519e4698ec56c5881_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
cacb666fb4145a5519e4698ec56c5881_mafia_JC.exe
-
Size
488KB
-
MD5
cacb666fb4145a5519e4698ec56c5881
-
SHA1
cdf6016efeb6a388009e8a5bee30d3cb8cf845c1
-
SHA256
1443e4deec0ddcfa728a4d9e7bdc94ed848d1bf6da71497c92d8ea7211ee0fd3
-
SHA512
a5161b8dae729ca91760c9913441799dce14e66a850708a5aca054744b30606af7cd24d7c59a20d55490c6796310b333938eb3f7b12cc3477ace0cb3877b98ca
-
SSDEEP
12288:/U5rCOTeiDpECkXh2wjr7SbR7jhClhndLH/NZ:/UQOJDpECu2KStH0lhn9fN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4756 DEA8.tmp 4568 DF44.tmp 1952 E03E.tmp 2944 E128.tmp 2740 E203.tmp 1400 E2BF.tmp 2552 E38A.tmp 4436 E4C2.tmp 1636 E55F.tmp 4608 E61A.tmp 948 E697.tmp 4892 E733.tmp 4672 E7EF.tmp 4604 E89B.tmp 1708 E9D3.tmp 4624 EA8F.tmp 4796 EB3B.tmp 1484 EBC7.tmp 4636 EC92.tmp 4276 ED5D.tmp 2284 EE77.tmp 1396 EF32.tmp 3452 EFDE.tmp 3052 F0E8.tmp 5048 F174.tmp 1160 F201.tmp 2344 F2AD.tmp 3888 F339.tmp 4880 F414.tmp 4684 F4DF.tmp 2572 F57C.tmp 4840 F685.tmp 2492 F750.tmp 400 F7DD.tmp 2796 F879.tmp 4304 F925.tmp 1472 F9D1.tmp 3080 FA5E.tmp 4612 FADB.tmp 4368 FB96.tmp 5108 FC42.tmp 1464 FCCF.tmp 4876 FD6B.tmp 3244 FDE8.tmp 1772 FE55.tmp 1520 FEF1.tmp 4992 FF9D.tmp 4172 59.tmp 2904 D6.tmp 3204 172.tmp 796 1FF.tmp 4744 29B.tmp 3192 337.tmp 4968 3D3.tmp 3232 470.tmp 4524 4FC.tmp 4800 589.tmp 2528 625.tmp 2044 6A2.tmp 4060 71F.tmp 3732 7BB.tmp 4568 858.tmp 3740 8E4.tmp 1452 961.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2952 wrote to memory of 4756 2952 cacb666fb4145a5519e4698ec56c5881_mafia_JC.exe 80 PID 2952 wrote to memory of 4756 2952 cacb666fb4145a5519e4698ec56c5881_mafia_JC.exe 80 PID 2952 wrote to memory of 4756 2952 cacb666fb4145a5519e4698ec56c5881_mafia_JC.exe 80 PID 4756 wrote to memory of 4568 4756 DEA8.tmp 81 PID 4756 wrote to memory of 4568 4756 DEA8.tmp 81 PID 4756 wrote to memory of 4568 4756 DEA8.tmp 81 PID 4568 wrote to memory of 1952 4568 DF44.tmp 82 PID 4568 wrote to memory of 1952 4568 DF44.tmp 82 PID 4568 wrote to memory of 1952 4568 DF44.tmp 82 PID 1952 wrote to memory of 2944 1952 E03E.tmp 83 PID 1952 wrote to memory of 2944 1952 E03E.tmp 83 PID 1952 wrote to memory of 2944 1952 E03E.tmp 83 PID 2944 wrote to memory of 2740 2944 E128.tmp 84 PID 2944 wrote to memory of 2740 2944 E128.tmp 84 PID 2944 wrote to memory of 2740 2944 E128.tmp 84 PID 2740 wrote to memory of 1400 2740 E203.tmp 85 PID 2740 wrote to memory of 1400 2740 E203.tmp 85 PID 2740 wrote to memory of 1400 2740 E203.tmp 85 PID 1400 wrote to memory of 2552 1400 E2BF.tmp 86 PID 1400 wrote to memory of 2552 1400 E2BF.tmp 86 PID 1400 wrote to memory of 2552 1400 E2BF.tmp 86 PID 2552 wrote to memory of 4436 2552 E38A.tmp 87 PID 2552 wrote to memory of 4436 2552 E38A.tmp 87 PID 2552 wrote to memory of 4436 2552 E38A.tmp 87 PID 4436 wrote to memory of 1636 4436 E4C2.tmp 88 PID 4436 wrote to memory of 1636 4436 E4C2.tmp 88 PID 4436 wrote to memory of 1636 4436 E4C2.tmp 88 PID 1636 wrote to memory of 4608 1636 E55F.tmp 90 PID 1636 wrote to memory of 4608 1636 E55F.tmp 90 PID 1636 wrote to memory of 4608 1636 E55F.tmp 90 PID 4608 wrote to memory of 948 4608 E61A.tmp 91 PID 4608 wrote to memory of 948 4608 E61A.tmp 91 PID 4608 wrote to memory of 948 4608 E61A.tmp 91 PID 948 wrote to memory of 4892 948 E697.tmp 92 PID 948 wrote to memory of 4892 948 E697.tmp 92 PID 948 wrote to memory of 4892 948 E697.tmp 92 PID 4892 wrote to memory of 4672 4892 E733.tmp 93 PID 4892 wrote to memory of 4672 4892 E733.tmp 93 PID 4892 wrote to memory of 4672 4892 E733.tmp 93 PID 4672 wrote to memory of 4604 4672 E7EF.tmp 94 PID 4672 wrote to memory of 4604 4672 E7EF.tmp 94 PID 4672 wrote to memory of 4604 4672 E7EF.tmp 94 PID 4604 wrote to memory of 1708 4604 E89B.tmp 95 PID 4604 wrote to memory of 1708 4604 E89B.tmp 95 PID 4604 wrote to memory of 1708 4604 E89B.tmp 95 PID 1708 wrote to memory of 4624 1708 E9D3.tmp 96 PID 1708 wrote to memory of 4624 1708 E9D3.tmp 96 PID 1708 wrote to memory of 4624 1708 E9D3.tmp 96 PID 4624 wrote to memory of 4796 4624 EA8F.tmp 97 PID 4624 wrote to memory of 4796 4624 EA8F.tmp 97 PID 4624 wrote to memory of 4796 4624 EA8F.tmp 97 PID 4796 wrote to memory of 1484 4796 EB3B.tmp 98 PID 4796 wrote to memory of 1484 4796 EB3B.tmp 98 PID 4796 wrote to memory of 1484 4796 EB3B.tmp 98 PID 1484 wrote to memory of 4636 1484 EBC7.tmp 99 PID 1484 wrote to memory of 4636 1484 EBC7.tmp 99 PID 1484 wrote to memory of 4636 1484 EBC7.tmp 99 PID 4636 wrote to memory of 4276 4636 EC92.tmp 102 PID 4636 wrote to memory of 4276 4636 EC92.tmp 102 PID 4636 wrote to memory of 4276 4636 EC92.tmp 102 PID 4276 wrote to memory of 2284 4276 ED5D.tmp 103 PID 4276 wrote to memory of 2284 4276 ED5D.tmp 103 PID 4276 wrote to memory of 2284 4276 ED5D.tmp 103 PID 2284 wrote to memory of 1396 2284 EE77.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\cacb666fb4145a5519e4698ec56c5881_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\cacb666fb4145a5519e4698ec56c5881_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\DF44.tmp"C:\Users\Admin\AppData\Local\Temp\DF44.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\E03E.tmp"C:\Users\Admin\AppData\Local\Temp\E03E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\E128.tmp"C:\Users\Admin\AppData\Local\Temp\E128.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\E203.tmp"C:\Users\Admin\AppData\Local\Temp\E203.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\E38A.tmp"C:\Users\Admin\AppData\Local\Temp\E38A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\E4C2.tmp"C:\Users\Admin\AppData\Local\Temp\E4C2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\E55F.tmp"C:\Users\Admin\AppData\Local\Temp\E55F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\E61A.tmp"C:\Users\Admin\AppData\Local\Temp\E61A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\E697.tmp"C:\Users\Admin\AppData\Local\Temp\E697.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\E733.tmp"C:\Users\Admin\AppData\Local\Temp\E733.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\E89B.tmp"C:\Users\Admin\AppData\Local\Temp\E89B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\EA8F.tmp"C:\Users\Admin\AppData\Local\Temp\EA8F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\EB3B.tmp"C:\Users\Admin\AppData\Local\Temp\EB3B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\EBC7.tmp"C:\Users\Admin\AppData\Local\Temp\EBC7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\EC92.tmp"C:\Users\Admin\AppData\Local\Temp\EC92.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\EE77.tmp"C:\Users\Admin\AppData\Local\Temp\EE77.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\EF32.tmp"C:\Users\Admin\AppData\Local\Temp\EF32.tmp"23⤵
- Executes dropped EXE
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\EFDE.tmp"C:\Users\Admin\AppData\Local\Temp\EFDE.tmp"24⤵
- Executes dropped EXE
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\F0E8.tmp"C:\Users\Admin\AppData\Local\Temp\F0E8.tmp"25⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\F174.tmp"C:\Users\Admin\AppData\Local\Temp\F174.tmp"26⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\F201.tmp"C:\Users\Admin\AppData\Local\Temp\F201.tmp"27⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\F2AD.tmp"C:\Users\Admin\AppData\Local\Temp\F2AD.tmp"28⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\F339.tmp"C:\Users\Admin\AppData\Local\Temp\F339.tmp"29⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\F414.tmp"C:\Users\Admin\AppData\Local\Temp\F414.tmp"30⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\F4DF.tmp"C:\Users\Admin\AppData\Local\Temp\F4DF.tmp"31⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\F57C.tmp"C:\Users\Admin\AppData\Local\Temp\F57C.tmp"32⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\F685.tmp"C:\Users\Admin\AppData\Local\Temp\F685.tmp"33⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\F750.tmp"C:\Users\Admin\AppData\Local\Temp\F750.tmp"34⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"35⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\F879.tmp"C:\Users\Admin\AppData\Local\Temp\F879.tmp"36⤵
- Executes dropped EXE
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\F925.tmp"C:\Users\Admin\AppData\Local\Temp\F925.tmp"37⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"38⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"39⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\FADB.tmp"C:\Users\Admin\AppData\Local\Temp\FADB.tmp"40⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\FB96.tmp"C:\Users\Admin\AppData\Local\Temp\FB96.tmp"41⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\FC42.tmp"C:\Users\Admin\AppData\Local\Temp\FC42.tmp"42⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"43⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\FD6B.tmp"C:\Users\Admin\AppData\Local\Temp\FD6B.tmp"44⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"45⤵
- Executes dropped EXE
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\FE55.tmp"C:\Users\Admin\AppData\Local\Temp\FE55.tmp"46⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"47⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\FF9D.tmp"C:\Users\Admin\AppData\Local\Temp\FF9D.tmp"48⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\59.tmp"C:\Users\Admin\AppData\Local\Temp\59.tmp"49⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\D6.tmp"C:\Users\Admin\AppData\Local\Temp\D6.tmp"50⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\172.tmp"C:\Users\Admin\AppData\Local\Temp\172.tmp"51⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\1FF.tmp"C:\Users\Admin\AppData\Local\Temp\1FF.tmp"52⤵
- Executes dropped EXE
PID:796 -
C:\Users\Admin\AppData\Local\Temp\29B.tmp"C:\Users\Admin\AppData\Local\Temp\29B.tmp"53⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\337.tmp"C:\Users\Admin\AppData\Local\Temp\337.tmp"54⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\3D3.tmp"C:\Users\Admin\AppData\Local\Temp\3D3.tmp"55⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\470.tmp"C:\Users\Admin\AppData\Local\Temp\470.tmp"56⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\4FC.tmp"C:\Users\Admin\AppData\Local\Temp\4FC.tmp"57⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\589.tmp"C:\Users\Admin\AppData\Local\Temp\589.tmp"58⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\625.tmp"C:\Users\Admin\AppData\Local\Temp\625.tmp"59⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\6A2.tmp"C:\Users\Admin\AppData\Local\Temp\6A2.tmp"60⤵
- Executes dropped EXE
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\71F.tmp"C:\Users\Admin\AppData\Local\Temp\71F.tmp"61⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\7BB.tmp"C:\Users\Admin\AppData\Local\Temp\7BB.tmp"62⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\858.tmp"C:\Users\Admin\AppData\Local\Temp\858.tmp"63⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\8E4.tmp"C:\Users\Admin\AppData\Local\Temp\8E4.tmp"64⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\961.tmp"C:\Users\Admin\AppData\Local\Temp\961.tmp"65⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\9DE.tmp"C:\Users\Admin\AppData\Local\Temp\9DE.tmp"66⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\A6B.tmp"C:\Users\Admin\AppData\Local\Temp\A6B.tmp"67⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\AD8.tmp"C:\Users\Admin\AppData\Local\Temp\AD8.tmp"68⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\B46.tmp"C:\Users\Admin\AppData\Local\Temp\B46.tmp"69⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\BE2.tmp"C:\Users\Admin\AppData\Local\Temp\BE2.tmp"70⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\C4F.tmp"C:\Users\Admin\AppData\Local\Temp\C4F.tmp"71⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\CCC.tmp"C:\Users\Admin\AppData\Local\Temp\CCC.tmp"72⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\D49.tmp"C:\Users\Admin\AppData\Local\Temp\D49.tmp"73⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\DB7.tmp"C:\Users\Admin\AppData\Local\Temp\DB7.tmp"74⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\E53.tmp"C:\Users\Admin\AppData\Local\Temp\E53.tmp"75⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\EC0.tmp"C:\Users\Admin\AppData\Local\Temp\EC0.tmp"76⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\F5D.tmp"C:\Users\Admin\AppData\Local\Temp\F5D.tmp"77⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\FDA.tmp"C:\Users\Admin\AppData\Local\Temp\FDA.tmp"78⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\1057.tmp"C:\Users\Admin\AppData\Local\Temp\1057.tmp"79⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\10E3.tmp"C:\Users\Admin\AppData\Local\Temp\10E3.tmp"80⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\1160.tmp"C:\Users\Admin\AppData\Local\Temp\1160.tmp"81⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\11ED.tmp"C:\Users\Admin\AppData\Local\Temp\11ED.tmp"82⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\126A.tmp"C:\Users\Admin\AppData\Local\Temp\126A.tmp"83⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\12F6.tmp"C:\Users\Admin\AppData\Local\Temp\12F6.tmp"84⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\1373.tmp"C:\Users\Admin\AppData\Local\Temp\1373.tmp"85⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\13D1.tmp"C:\Users\Admin\AppData\Local\Temp\13D1.tmp"86⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\148D.tmp"C:\Users\Admin\AppData\Local\Temp\148D.tmp"87⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\150A.tmp"C:\Users\Admin\AppData\Local\Temp\150A.tmp"88⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\1596.tmp"C:\Users\Admin\AppData\Local\Temp\1596.tmp"89⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\15F4.tmp"C:\Users\Admin\AppData\Local\Temp\15F4.tmp"90⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\1652.tmp"C:\Users\Admin\AppData\Local\Temp\1652.tmp"91⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\16DE.tmp"C:\Users\Admin\AppData\Local\Temp\16DE.tmp"92⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\175B.tmp"C:\Users\Admin\AppData\Local\Temp\175B.tmp"93⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\17C9.tmp"C:\Users\Admin\AppData\Local\Temp\17C9.tmp"94⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\1865.tmp"C:\Users\Admin\AppData\Local\Temp\1865.tmp"95⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\1901.tmp"C:\Users\Admin\AppData\Local\Temp\1901.tmp"96⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\198E.tmp"C:\Users\Admin\AppData\Local\Temp\198E.tmp"97⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"98⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\1AA7.tmp"C:\Users\Admin\AppData\Local\Temp\1AA7.tmp"99⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\1B43.tmp"C:\Users\Admin\AppData\Local\Temp\1B43.tmp"100⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\1BC0.tmp"C:\Users\Admin\AppData\Local\Temp\1BC0.tmp"101⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"102⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\1C7C.tmp"C:\Users\Admin\AppData\Local\Temp\1C7C.tmp"103⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"104⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\1D47.tmp"C:\Users\Admin\AppData\Local\Temp\1D47.tmp"105⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\1DE3.tmp"C:\Users\Admin\AppData\Local\Temp\1DE3.tmp"106⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\1E70.tmp"C:\Users\Admin\AppData\Local\Temp\1E70.tmp"107⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\1EED.tmp"C:\Users\Admin\AppData\Local\Temp\1EED.tmp"108⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\1F89.tmp"C:\Users\Admin\AppData\Local\Temp\1F89.tmp"109⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\2035.tmp"C:\Users\Admin\AppData\Local\Temp\2035.tmp"110⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\20A2.tmp"C:\Users\Admin\AppData\Local\Temp\20A2.tmp"111⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\2100.tmp"C:\Users\Admin\AppData\Local\Temp\2100.tmp"112⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\217D.tmp"C:\Users\Admin\AppData\Local\Temp\217D.tmp"113⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\21EB.tmp"C:\Users\Admin\AppData\Local\Temp\21EB.tmp"114⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\2277.tmp"C:\Users\Admin\AppData\Local\Temp\2277.tmp"115⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\2313.tmp"C:\Users\Admin\AppData\Local\Temp\2313.tmp"116⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\23B0.tmp"C:\Users\Admin\AppData\Local\Temp\23B0.tmp"117⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\241D.tmp"C:\Users\Admin\AppData\Local\Temp\241D.tmp"118⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\24AA.tmp"C:\Users\Admin\AppData\Local\Temp\24AA.tmp"119⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\2546.tmp"C:\Users\Admin\AppData\Local\Temp\2546.tmp"120⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\25C3.tmp"C:\Users\Admin\AppData\Local\Temp\25C3.tmp"121⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\2630.tmp"C:\Users\Admin\AppData\Local\Temp\2630.tmp"122⤵PID:3416
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-