Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
30/08/2023, 16:31
Static task
static1
Behavioral task
behavioral1
Sample
e2b44c940be0f7a9eab2b2727a157d3b_mafia_JC.exe
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
e2b44c940be0f7a9eab2b2727a157d3b_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
e2b44c940be0f7a9eab2b2727a157d3b_mafia_JC.exe
-
Size
486KB
-
MD5
e2b44c940be0f7a9eab2b2727a157d3b
-
SHA1
90ff70922080b9feed5f7cf578d76bc60c7d3993
-
SHA256
de55eb55c7544d974d960710e3790eeee5596b8d0854183778bb98e94e7bed08
-
SHA512
f068eb01bf7ece55d70eb5ddb1f1fb6eaa84f6020ce32732a799e5ba3156285ae20dab2ed925da770bffadab7fb2d37c5c89295296c16954694d4e29659f2390
-
SSDEEP
6144:Forf3lPvovsgZnqG2C7mOTeiLfD75esZvV1Qmz7YvzXR4VNb5DMWK+hG0vRsH3dZ:UU5rCOTeiD4sZjrNqWt2NZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1452 8A9C.tmp 3220 8B38.tmp 2800 8BE4.tmp 3936 8CCF.tmp 3880 8D9A.tmp 4936 8E46.tmp 3600 8EE2.tmp 3848 8FEC.tmp 1912 9088.tmp 3956 9134.tmp 2940 91B1.tmp 4916 927C.tmp 3644 9308.tmp 1080 93A5.tmp 1284 94ED.tmp 4284 95B8.tmp 3872 9673.tmp 3128 971F.tmp 3576 97BC.tmp 3544 9858.tmp 4200 9A0D.tmp 3812 9AE8.tmp 3240 9BC3.tmp 1192 9CAD.tmp 1708 9D69.tmp 1064 9E24.tmp 2668 9EC0.tmp 4428 9F6C.tmp 3856 9FE9.tmp 2680 A076.tmp 2412 A112.tmp 2980 A21C.tmp 5052 A306.tmp 1680 A393.tmp 1428 A42F.tmp 4968 A4CB.tmp 1484 A548.tmp 4176 A5E5.tmp 3716 A681.tmp 4856 A71D.tmp 4124 A7B9.tmp 2132 A836.tmp 2696 A8C3.tmp 452 A940.tmp 3944 A9CD.tmp 4544 AA69.tmp 3028 AB05.tmp 1100 AB63.tmp 4044 ABEF.tmp 2632 AC9B.tmp 3296 AD47.tmp 2004 ADD4.tmp 3880 AE51.tmp 1340 AEFD.tmp 5088 AF89.tmp 5096 B026.tmp 4868 B0C2.tmp 4212 B13F.tmp 4908 B1CB.tmp 4500 B287.tmp 3164 B314.tmp 5108 B3A0.tmp 1160 B43C.tmp 3232 B4D9.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3640 wrote to memory of 1452 3640 e2b44c940be0f7a9eab2b2727a157d3b_mafia_JC.exe 82 PID 3640 wrote to memory of 1452 3640 e2b44c940be0f7a9eab2b2727a157d3b_mafia_JC.exe 82 PID 3640 wrote to memory of 1452 3640 e2b44c940be0f7a9eab2b2727a157d3b_mafia_JC.exe 82 PID 1452 wrote to memory of 3220 1452 8A9C.tmp 83 PID 1452 wrote to memory of 3220 1452 8A9C.tmp 83 PID 1452 wrote to memory of 3220 1452 8A9C.tmp 83 PID 3220 wrote to memory of 2800 3220 8B38.tmp 84 PID 3220 wrote to memory of 2800 3220 8B38.tmp 84 PID 3220 wrote to memory of 2800 3220 8B38.tmp 84 PID 2800 wrote to memory of 3936 2800 8BE4.tmp 85 PID 2800 wrote to memory of 3936 2800 8BE4.tmp 85 PID 2800 wrote to memory of 3936 2800 8BE4.tmp 85 PID 3936 wrote to memory of 3880 3936 8CCF.tmp 86 PID 3936 wrote to memory of 3880 3936 8CCF.tmp 86 PID 3936 wrote to memory of 3880 3936 8CCF.tmp 86 PID 3880 wrote to memory of 4936 3880 8D9A.tmp 87 PID 3880 wrote to memory of 4936 3880 8D9A.tmp 87 PID 3880 wrote to memory of 4936 3880 8D9A.tmp 87 PID 4936 wrote to memory of 3600 4936 8E46.tmp 88 PID 4936 wrote to memory of 3600 4936 8E46.tmp 88 PID 4936 wrote to memory of 3600 4936 8E46.tmp 88 PID 3600 wrote to memory of 3848 3600 8EE2.tmp 89 PID 3600 wrote to memory of 3848 3600 8EE2.tmp 89 PID 3600 wrote to memory of 3848 3600 8EE2.tmp 89 PID 3848 wrote to memory of 1912 3848 8FEC.tmp 90 PID 3848 wrote to memory of 1912 3848 8FEC.tmp 90 PID 3848 wrote to memory of 1912 3848 8FEC.tmp 90 PID 1912 wrote to memory of 3956 1912 9088.tmp 92 PID 1912 wrote to memory of 3956 1912 9088.tmp 92 PID 1912 wrote to memory of 3956 1912 9088.tmp 92 PID 3956 wrote to memory of 2940 3956 9134.tmp 93 PID 3956 wrote to memory of 2940 3956 9134.tmp 93 PID 3956 wrote to memory of 2940 3956 9134.tmp 93 PID 2940 wrote to memory of 4916 2940 91B1.tmp 94 PID 2940 wrote to memory of 4916 2940 91B1.tmp 94 PID 2940 wrote to memory of 4916 2940 91B1.tmp 94 PID 4916 wrote to memory of 3644 4916 927C.tmp 95 PID 4916 wrote to memory of 3644 4916 927C.tmp 95 PID 4916 wrote to memory of 3644 4916 927C.tmp 95 PID 3644 wrote to memory of 1080 3644 9308.tmp 96 PID 3644 wrote to memory of 1080 3644 9308.tmp 96 PID 3644 wrote to memory of 1080 3644 9308.tmp 96 PID 1080 wrote to memory of 1284 1080 93A5.tmp 97 PID 1080 wrote to memory of 1284 1080 93A5.tmp 97 PID 1080 wrote to memory of 1284 1080 93A5.tmp 97 PID 1284 wrote to memory of 4284 1284 94ED.tmp 98 PID 1284 wrote to memory of 4284 1284 94ED.tmp 98 PID 1284 wrote to memory of 4284 1284 94ED.tmp 98 PID 4284 wrote to memory of 3872 4284 95B8.tmp 99 PID 4284 wrote to memory of 3872 4284 95B8.tmp 99 PID 4284 wrote to memory of 3872 4284 95B8.tmp 99 PID 3872 wrote to memory of 3128 3872 9673.tmp 100 PID 3872 wrote to memory of 3128 3872 9673.tmp 100 PID 3872 wrote to memory of 3128 3872 9673.tmp 100 PID 3128 wrote to memory of 3576 3128 971F.tmp 101 PID 3128 wrote to memory of 3576 3128 971F.tmp 101 PID 3128 wrote to memory of 3576 3128 971F.tmp 101 PID 3576 wrote to memory of 3544 3576 97BC.tmp 102 PID 3576 wrote to memory of 3544 3576 97BC.tmp 102 PID 3576 wrote to memory of 3544 3576 97BC.tmp 102 PID 3544 wrote to memory of 4200 3544 9858.tmp 105 PID 3544 wrote to memory of 4200 3544 9858.tmp 105 PID 3544 wrote to memory of 4200 3544 9858.tmp 105 PID 4200 wrote to memory of 3812 4200 9A0D.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2b44c940be0f7a9eab2b2727a157d3b_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\e2b44c940be0f7a9eab2b2727a157d3b_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\8B38.tmp"C:\Users\Admin\AppData\Local\Temp\8B38.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\8E46.tmp"C:\Users\Admin\AppData\Local\Temp\8E46.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\9134.tmp"C:\Users\Admin\AppData\Local\Temp\9134.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\91B1.tmp"C:\Users\Admin\AppData\Local\Temp\91B1.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\927C.tmp"C:\Users\Admin\AppData\Local\Temp\927C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\9308.tmp"C:\Users\Admin\AppData\Local\Temp\9308.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\93A5.tmp"C:\Users\Admin\AppData\Local\Temp\93A5.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\94ED.tmp"C:\Users\Admin\AppData\Local\Temp\94ED.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\95B8.tmp"C:\Users\Admin\AppData\Local\Temp\95B8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\9673.tmp"C:\Users\Admin\AppData\Local\Temp\9673.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\97BC.tmp"C:\Users\Admin\AppData\Local\Temp\97BC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"23⤵
- Executes dropped EXE
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"24⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"25⤵
- Executes dropped EXE
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\9D69.tmp"C:\Users\Admin\AppData\Local\Temp\9D69.tmp"26⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"27⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"28⤵
- Executes dropped EXE
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"29⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"30⤵
- Executes dropped EXE
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\A076.tmp"C:\Users\Admin\AppData\Local\Temp\A076.tmp"31⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\A112.tmp"C:\Users\Admin\AppData\Local\Temp\A112.tmp"32⤵
- Executes dropped EXE
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\A21C.tmp"C:\Users\Admin\AppData\Local\Temp\A21C.tmp"33⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\A306.tmp"C:\Users\Admin\AppData\Local\Temp\A306.tmp"34⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"35⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"36⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"37⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"38⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"39⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"40⤵
- Executes dropped EXE
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"41⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"42⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\A836.tmp"C:\Users\Admin\AppData\Local\Temp\A836.tmp"43⤵
- Executes dropped EXE
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"44⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\A940.tmp"C:\Users\Admin\AppData\Local\Temp\A940.tmp"45⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"46⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\AA69.tmp"C:\Users\Admin\AppData\Local\Temp\AA69.tmp"47⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\AB05.tmp"C:\Users\Admin\AppData\Local\Temp\AB05.tmp"48⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"49⤵
- Executes dropped EXE
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"50⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"51⤵
- Executes dropped EXE
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"52⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"53⤵
- Executes dropped EXE
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\AE51.tmp"C:\Users\Admin\AppData\Local\Temp\AE51.tmp"54⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"55⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"56⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"57⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"58⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"59⤵
- Executes dropped EXE
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"60⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\B287.tmp"C:\Users\Admin\AppData\Local\Temp\B287.tmp"61⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\B314.tmp"C:\Users\Admin\AppData\Local\Temp\B314.tmp"62⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"63⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\B43C.tmp"C:\Users\Admin\AppData\Local\Temp\B43C.tmp"64⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"65⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"66⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"67⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"68⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"69⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\B73A.tmp"C:\Users\Admin\AppData\Local\Temp\B73A.tmp"70⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\B798.tmp"C:\Users\Admin\AppData\Local\Temp\B798.tmp"71⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\B834.tmp"C:\Users\Admin\AppData\Local\Temp\B834.tmp"72⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"73⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\B91E.tmp"C:\Users\Admin\AppData\Local\Temp\B91E.tmp"74⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"75⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\BA47.tmp"C:\Users\Admin\AppData\Local\Temp\BA47.tmp"76⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"77⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\BB32.tmp"C:\Users\Admin\AppData\Local\Temp\BB32.tmp"78⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"79⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"80⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"81⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\BD26.tmp"C:\Users\Admin\AppData\Local\Temp\BD26.tmp"82⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\BD83.tmp"C:\Users\Admin\AppData\Local\Temp\BD83.tmp"83⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\BE00.tmp"C:\Users\Admin\AppData\Local\Temp\BE00.tmp"84⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"85⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"86⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\BF97.tmp"C:\Users\Admin\AppData\Local\Temp\BF97.tmp"87⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\C014.tmp"C:\Users\Admin\AppData\Local\Temp\C014.tmp"88⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"89⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"90⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"91⤵PID:508
-
C:\Users\Admin\AppData\Local\Temp\C285.tmp"C:\Users\Admin\AppData\Local\Temp\C285.tmp"92⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"93⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\C39E.tmp"C:\Users\Admin\AppData\Local\Temp\C39E.tmp"94⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"95⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\C479.tmp"C:\Users\Admin\AppData\Local\Temp\C479.tmp"96⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"97⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\C563.tmp"C:\Users\Admin\AppData\Local\Temp\C563.tmp"98⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\C60F.tmp"C:\Users\Admin\AppData\Local\Temp\C60F.tmp"99⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\C69C.tmp"C:\Users\Admin\AppData\Local\Temp\C69C.tmp"100⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\C738.tmp"C:\Users\Admin\AppData\Local\Temp\C738.tmp"101⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"102⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\C861.tmp"C:\Users\Admin\AppData\Local\Temp\C861.tmp"103⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"104⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\C94B.tmp"C:\Users\Admin\AppData\Local\Temp\C94B.tmp"105⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"106⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\CA74.tmp"C:\Users\Admin\AppData\Local\Temp\CA74.tmp"107⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"108⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"109⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"110⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"111⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\CD23.tmp"C:\Users\Admin\AppData\Local\Temp\CD23.tmp"112⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"113⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"114⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\CF46.tmp"C:\Users\Admin\AppData\Local\Temp\CF46.tmp"115⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\CFE3.tmp"C:\Users\Admin\AppData\Local\Temp\CFE3.tmp"116⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\D050.tmp"C:\Users\Admin\AppData\Local\Temp\D050.tmp"117⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"118⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\D15A.tmp"C:\Users\Admin\AppData\Local\Temp\D15A.tmp"119⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\D1F6.tmp"C:\Users\Admin\AppData\Local\Temp\D1F6.tmp"120⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\D292.tmp"C:\Users\Admin\AppData\Local\Temp\D292.tmp"121⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\D31F.tmp"C:\Users\Admin\AppData\Local\Temp\D31F.tmp"122⤵PID:1268
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-