Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2023, 16:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d179304d9429c014de38175530584b8f_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
d179304d9429c014de38175530584b8f_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
d179304d9429c014de38175530584b8f_mafia_JC.exe
-
Size
486KB
-
MD5
d179304d9429c014de38175530584b8f
-
SHA1
a1ecfa86fd89c9dd7d54f4b96343af2728e20bd1
-
SHA256
a662068d1c959c539e247f2cdbf5edcafd0bf08dfaca4328a92034ca58381a78
-
SHA512
f17b5537a4ad7ff9389adbe09d17c3e90fd669b4c89932902e19699b10c0620243834289584c6c575e99ded1e49470c8b3d5af4173e84b2c9c24512c167318b2
-
SSDEEP
12288:UU5rCOTeiDcpuIap8TYqG56i3nhq7bFmp6wrkNZ:UUQOJDLIaGstfhKA6wAN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5112 7772.tmp 1784 780E.tmp 1188 78BA.tmp 3352 7976.tmp 672 7A21.tmp 3996 7B4A.tmp 3476 807A.tmp 2000 8126.tmp 4732 8201.tmp 2152 829D.tmp 4792 8397.tmp 4672 8434.tmp 3124 84B1.tmp 1372 858B.tmp 4700 8676.tmp 3848 8750.tmp 4916 87ED.tmp 1032 8879.tmp 1448 8916.tmp 3700 89A2.tmp 2664 8A4E.tmp 1184 8AEA.tmp 1412 8B77.tmp 4208 8C23.tmp 2140 8D0D.tmp 2628 8E07.tmp 4560 8EA3.tmp 4484 8F4F.tmp 4352 8FFB.tmp 2060 90A7.tmp 1148 9172.tmp 2792 924D.tmp 3656 92F9.tmp 3332 9395.tmp 3504 9431.tmp 4676 94BE.tmp 4344 952B.tmp 3052 95A8.tmp 3056 9616.tmp 4976 96A2.tmp 4088 974E.tmp 1984 97EA.tmp 2660 9887.tmp 4868 9A5B.tmp 4304 9AC9.tmp 3488 9B46.tmp 3980 9BB3.tmp 744 9C4F.tmp 4924 9CDC.tmp 4320 9D78.tmp 4204 9DF5.tmp 1292 9E72.tmp 1268 9EEF.tmp 4668 9F6C.tmp 3352 A009.tmp 1436 A076.tmp 676 A0F3.tmp 4248 A160.tmp 4732 A1BE.tmp 2072 A22B.tmp 972 A289.tmp 4480 A2F7.tmp 4948 A4DB.tmp 1780 A558.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1476 wrote to memory of 5112 1476 d179304d9429c014de38175530584b8f_mafia_JC.exe 81 PID 1476 wrote to memory of 5112 1476 d179304d9429c014de38175530584b8f_mafia_JC.exe 81 PID 1476 wrote to memory of 5112 1476 d179304d9429c014de38175530584b8f_mafia_JC.exe 81 PID 5112 wrote to memory of 1784 5112 7772.tmp 82 PID 5112 wrote to memory of 1784 5112 7772.tmp 82 PID 5112 wrote to memory of 1784 5112 7772.tmp 82 PID 1784 wrote to memory of 1188 1784 780E.tmp 83 PID 1784 wrote to memory of 1188 1784 780E.tmp 83 PID 1784 wrote to memory of 1188 1784 780E.tmp 83 PID 1188 wrote to memory of 3352 1188 78BA.tmp 84 PID 1188 wrote to memory of 3352 1188 78BA.tmp 84 PID 1188 wrote to memory of 3352 1188 78BA.tmp 84 PID 3352 wrote to memory of 672 3352 7976.tmp 85 PID 3352 wrote to memory of 672 3352 7976.tmp 85 PID 3352 wrote to memory of 672 3352 7976.tmp 85 PID 672 wrote to memory of 3996 672 7A21.tmp 86 PID 672 wrote to memory of 3996 672 7A21.tmp 86 PID 672 wrote to memory of 3996 672 7A21.tmp 86 PID 3996 wrote to memory of 3476 3996 7B4A.tmp 87 PID 3996 wrote to memory of 3476 3996 7B4A.tmp 87 PID 3996 wrote to memory of 3476 3996 7B4A.tmp 87 PID 3476 wrote to memory of 2000 3476 807A.tmp 88 PID 3476 wrote to memory of 2000 3476 807A.tmp 88 PID 3476 wrote to memory of 2000 3476 807A.tmp 88 PID 2000 wrote to memory of 4732 2000 8126.tmp 89 PID 2000 wrote to memory of 4732 2000 8126.tmp 89 PID 2000 wrote to memory of 4732 2000 8126.tmp 89 PID 4732 wrote to memory of 2152 4732 8201.tmp 90 PID 4732 wrote to memory of 2152 4732 8201.tmp 90 PID 4732 wrote to memory of 2152 4732 8201.tmp 90 PID 2152 wrote to memory of 4792 2152 829D.tmp 91 PID 2152 wrote to memory of 4792 2152 829D.tmp 91 PID 2152 wrote to memory of 4792 2152 829D.tmp 91 PID 4792 wrote to memory of 4672 4792 8397.tmp 92 PID 4792 wrote to memory of 4672 4792 8397.tmp 92 PID 4792 wrote to memory of 4672 4792 8397.tmp 92 PID 4672 wrote to memory of 3124 4672 8434.tmp 95 PID 4672 wrote to memory of 3124 4672 8434.tmp 95 PID 4672 wrote to memory of 3124 4672 8434.tmp 95 PID 3124 wrote to memory of 1372 3124 84B1.tmp 96 PID 3124 wrote to memory of 1372 3124 84B1.tmp 96 PID 3124 wrote to memory of 1372 3124 84B1.tmp 96 PID 1372 wrote to memory of 4700 1372 858B.tmp 97 PID 1372 wrote to memory of 4700 1372 858B.tmp 97 PID 1372 wrote to memory of 4700 1372 858B.tmp 97 PID 4700 wrote to memory of 3848 4700 8676.tmp 98 PID 4700 wrote to memory of 3848 4700 8676.tmp 98 PID 4700 wrote to memory of 3848 4700 8676.tmp 98 PID 3848 wrote to memory of 4916 3848 8750.tmp 99 PID 3848 wrote to memory of 4916 3848 8750.tmp 99 PID 3848 wrote to memory of 4916 3848 8750.tmp 99 PID 4916 wrote to memory of 1032 4916 87ED.tmp 100 PID 4916 wrote to memory of 1032 4916 87ED.tmp 100 PID 4916 wrote to memory of 1032 4916 87ED.tmp 100 PID 1032 wrote to memory of 1448 1032 8879.tmp 102 PID 1032 wrote to memory of 1448 1032 8879.tmp 102 PID 1032 wrote to memory of 1448 1032 8879.tmp 102 PID 1448 wrote to memory of 3700 1448 8916.tmp 103 PID 1448 wrote to memory of 3700 1448 8916.tmp 103 PID 1448 wrote to memory of 3700 1448 8916.tmp 103 PID 3700 wrote to memory of 2664 3700 89A2.tmp 105 PID 3700 wrote to memory of 2664 3700 89A2.tmp 105 PID 3700 wrote to memory of 2664 3700 89A2.tmp 105 PID 2664 wrote to memory of 1184 2664 8A4E.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\d179304d9429c014de38175530584b8f_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\d179304d9429c014de38175530584b8f_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\7772.tmp"C:\Users\Admin\AppData\Local\Temp\7772.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\780E.tmp"C:\Users\Admin\AppData\Local\Temp\780E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\78BA.tmp"C:\Users\Admin\AppData\Local\Temp\78BA.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\7976.tmp"C:\Users\Admin\AppData\Local\Temp\7976.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\7A21.tmp"C:\Users\Admin\AppData\Local\Temp\7A21.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\807A.tmp"C:\Users\Admin\AppData\Local\Temp\807A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\8126.tmp"C:\Users\Admin\AppData\Local\Temp\8126.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\8201.tmp"C:\Users\Admin\AppData\Local\Temp\8201.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\829D.tmp"C:\Users\Admin\AppData\Local\Temp\829D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\8434.tmp"C:\Users\Admin\AppData\Local\Temp\8434.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\84B1.tmp"C:\Users\Admin\AppData\Local\Temp\84B1.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\858B.tmp"C:\Users\Admin\AppData\Local\Temp\858B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\8676.tmp"C:\Users\Admin\AppData\Local\Temp\8676.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\8750.tmp"C:\Users\Admin\AppData\Local\Temp\8750.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\8879.tmp"C:\Users\Admin\AppData\Local\Temp\8879.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\8916.tmp"C:\Users\Admin\AppData\Local\Temp\8916.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\89A2.tmp"C:\Users\Admin\AppData\Local\Temp\89A2.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"23⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\8B77.tmp"C:\Users\Admin\AppData\Local\Temp\8B77.tmp"24⤵
- Executes dropped EXE
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\8C23.tmp"C:\Users\Admin\AppData\Local\Temp\8C23.tmp"25⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"26⤵
- Executes dropped EXE
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\8E07.tmp"C:\Users\Admin\AppData\Local\Temp\8E07.tmp"27⤵
- Executes dropped EXE
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"28⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"29⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"30⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\90A7.tmp"C:\Users\Admin\AppData\Local\Temp\90A7.tmp"31⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp"32⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\924D.tmp"C:\Users\Admin\AppData\Local\Temp\924D.tmp"33⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\92F9.tmp"C:\Users\Admin\AppData\Local\Temp\92F9.tmp"34⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\9395.tmp"C:\Users\Admin\AppData\Local\Temp\9395.tmp"35⤵
- Executes dropped EXE
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"36⤵
- Executes dropped EXE
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\94BE.tmp"C:\Users\Admin\AppData\Local\Temp\94BE.tmp"37⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"38⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"39⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"40⤵
- Executes dropped EXE
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"41⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"42⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\97EA.tmp"C:\Users\Admin\AppData\Local\Temp\97EA.tmp"43⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"44⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"45⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"46⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"47⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"48⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"49⤵
- Executes dropped EXE
PID:744 -
C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"50⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\9D78.tmp"C:\Users\Admin\AppData\Local\Temp\9D78.tmp"51⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"52⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\9E72.tmp"C:\Users\Admin\AppData\Local\Temp\9E72.tmp"53⤵
- Executes dropped EXE
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"54⤵
- Executes dropped EXE
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"55⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"56⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\A076.tmp"C:\Users\Admin\AppData\Local\Temp\A076.tmp"57⤵
- Executes dropped EXE
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"58⤵
- Executes dropped EXE
PID:676 -
C:\Users\Admin\AppData\Local\Temp\A160.tmp"C:\Users\Admin\AppData\Local\Temp\A160.tmp"59⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"60⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"61⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"62⤵
- Executes dropped EXE
PID:972 -
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"63⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"64⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"65⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"66⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\A662.tmp"C:\Users\Admin\AppData\Local\Temp\A662.tmp"67⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"68⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\A73C.tmp"C:\Users\Admin\AppData\Local\Temp\A73C.tmp"69⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"70⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"71⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\A911.tmp"C:\Users\Admin\AppData\Local\Temp\A911.tmp"72⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\A99E.tmp"C:\Users\Admin\AppData\Local\Temp\A99E.tmp"73⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"74⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"75⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\AB53.tmp"C:\Users\Admin\AppData\Local\Temp\AB53.tmp"76⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"77⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"78⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\AD66.tmp"C:\Users\Admin\AppData\Local\Temp\AD66.tmp"79⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"80⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\AE12.tmp"C:\Users\Admin\AppData\Local\Temp\AE12.tmp"81⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"82⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"83⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"84⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\B045.tmp"C:\Users\Admin\AppData\Local\Temp\B045.tmp"85⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"86⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"87⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"88⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\B229.tmp"C:\Users\Admin\AppData\Local\Temp\B229.tmp"89⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"90⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\B342.tmp"C:\Users\Admin\AppData\Local\Temp\B342.tmp"91⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"92⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"93⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"94⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\B565.tmp"C:\Users\Admin\AppData\Local\Temp\B565.tmp"95⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"96⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\B650.tmp"C:\Users\Admin\AppData\Local\Temp\B650.tmp"97⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"98⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\B769.tmp"C:\Users\Admin\AppData\Local\Temp\B769.tmp"99⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"100⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\B892.tmp"C:\Users\Admin\AppData\Local\Temp\B892.tmp"101⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\B97C.tmp"C:\Users\Admin\AppData\Local\Temp\B97C.tmp"102⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\BA18.tmp"C:\Users\Admin\AppData\Local\Temp\BA18.tmp"103⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\BA95.tmp"C:\Users\Admin\AppData\Local\Temp\BA95.tmp"104⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\BB22.tmp"C:\Users\Admin\AppData\Local\Temp\BB22.tmp"105⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"106⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"107⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\BC99.tmp"C:\Users\Admin\AppData\Local\Temp\BC99.tmp"108⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\BD16.tmp"C:\Users\Admin\AppData\Local\Temp\BD16.tmp"109⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\BD93.tmp"C:\Users\Admin\AppData\Local\Temp\BD93.tmp"110⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"111⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"112⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\BF68.tmp"C:\Users\Admin\AppData\Local\Temp\BF68.tmp"113⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"114⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"115⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"116⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"117⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"118⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"119⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\C38E.tmp"C:\Users\Admin\AppData\Local\Temp\C38E.tmp"120⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\C41B.tmp"C:\Users\Admin\AppData\Local\Temp\C41B.tmp"121⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"122⤵PID:2072
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-