Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
157s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
30/08/2023, 17:30
Static task
static1
Behavioral task
behavioral1
Sample
e5f6fc87101b95996b072b2a1d7149b5_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
e5f6fc87101b95996b072b2a1d7149b5_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
e5f6fc87101b95996b072b2a1d7149b5_mafia_JC.exe
-
Size
486KB
-
MD5
e5f6fc87101b95996b072b2a1d7149b5
-
SHA1
63e185818d2784dac96a8f29090e762dbc8bae3f
-
SHA256
381a4762ad675c8dbc545fed8a773af0fbd8847e72353fc9ef1e04d07f30e43f
-
SHA512
cfca23b720fcd484847fc8ad2ce3939e87b5ebc992ff839c0a02170375337cda7fb106221e32a797ea804b4f96293764ad82e17de462319064d5d45b50d5a1d3
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7/sY3RGHflcFBOgAdWn4wbFhIdv79dlOUdsHT:/U5rCOTeiD/X30SXsdkbFhEfKNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2604 B064.tmp 4904 B110.tmp 1956 B1BC.tmp 5108 B277.tmp 4508 B333.tmp 4876 B3EE.tmp 3716 B49A.tmp 3404 B536.tmp 3572 B5C3.tmp 4972 B65F.tmp 1444 B72A.tmp 4384 B7E6.tmp 4704 B882.tmp 4032 B92E.tmp 1048 B9DA.tmp 1412 BAA5.tmp 2984 BB70.tmp 4180 BC0C.tmp 4916 BC89.tmp 1368 BCF7.tmp 4664 BDC2.tmp 3400 BE6E.tmp 1484 BF1A.tmp 4856 BFC6.tmp 1980 C071.tmp 1468 C11D.tmp 4288 C19A.tmp 2912 C275.tmp 3076 C2F2.tmp 1064 C37F.tmp 3924 C40B.tmp 3456 C4D6.tmp 4672 C573.tmp 1832 C5E0.tmp 3804 C66D.tmp 4056 C6DA.tmp 3580 C747.tmp 5056 C7B5.tmp 1236 C822.tmp 3688 C8BE.tmp 4120 C92C.tmp 4584 C9A9.tmp 3516 CA26.tmp 1080 CAC2.tmp 5044 CB4F.tmp 2652 CBBC.tmp 3776 CC58.tmp 3348 CD14.tmp 2824 CDA0.tmp 4240 CE1D.tmp 4208 CE9A.tmp 4116 CF37.tmp 2640 CFB4.tmp 4812 D050.tmp 1644 D0DD.tmp 492 D15A.tmp 2248 D1F6.tmp 4612 D292.tmp 3256 D32E.tmp 2584 D3BB.tmp 3448 D448.tmp 3392 D4D4.tmp 776 D542.tmp 1120 D5ED.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3300 wrote to memory of 2604 3300 e5f6fc87101b95996b072b2a1d7149b5_mafia_JC.exe 81 PID 3300 wrote to memory of 2604 3300 e5f6fc87101b95996b072b2a1d7149b5_mafia_JC.exe 81 PID 3300 wrote to memory of 2604 3300 e5f6fc87101b95996b072b2a1d7149b5_mafia_JC.exe 81 PID 2604 wrote to memory of 4904 2604 B064.tmp 82 PID 2604 wrote to memory of 4904 2604 B064.tmp 82 PID 2604 wrote to memory of 4904 2604 B064.tmp 82 PID 4904 wrote to memory of 1956 4904 B110.tmp 83 PID 4904 wrote to memory of 1956 4904 B110.tmp 83 PID 4904 wrote to memory of 1956 4904 B110.tmp 83 PID 1956 wrote to memory of 5108 1956 B1BC.tmp 84 PID 1956 wrote to memory of 5108 1956 B1BC.tmp 84 PID 1956 wrote to memory of 5108 1956 B1BC.tmp 84 PID 5108 wrote to memory of 4508 5108 B277.tmp 85 PID 5108 wrote to memory of 4508 5108 B277.tmp 85 PID 5108 wrote to memory of 4508 5108 B277.tmp 85 PID 4508 wrote to memory of 4876 4508 B333.tmp 86 PID 4508 wrote to memory of 4876 4508 B333.tmp 86 PID 4508 wrote to memory of 4876 4508 B333.tmp 86 PID 4876 wrote to memory of 3716 4876 B3EE.tmp 87 PID 4876 wrote to memory of 3716 4876 B3EE.tmp 87 PID 4876 wrote to memory of 3716 4876 B3EE.tmp 87 PID 3716 wrote to memory of 3404 3716 B49A.tmp 88 PID 3716 wrote to memory of 3404 3716 B49A.tmp 88 PID 3716 wrote to memory of 3404 3716 B49A.tmp 88 PID 3404 wrote to memory of 3572 3404 B536.tmp 89 PID 3404 wrote to memory of 3572 3404 B536.tmp 89 PID 3404 wrote to memory of 3572 3404 B536.tmp 89 PID 3572 wrote to memory of 4972 3572 B5C3.tmp 90 PID 3572 wrote to memory of 4972 3572 B5C3.tmp 90 PID 3572 wrote to memory of 4972 3572 B5C3.tmp 90 PID 4972 wrote to memory of 1444 4972 B65F.tmp 92 PID 4972 wrote to memory of 1444 4972 B65F.tmp 92 PID 4972 wrote to memory of 1444 4972 B65F.tmp 92 PID 1444 wrote to memory of 4384 1444 B72A.tmp 93 PID 1444 wrote to memory of 4384 1444 B72A.tmp 93 PID 1444 wrote to memory of 4384 1444 B72A.tmp 93 PID 4384 wrote to memory of 4704 4384 B7E6.tmp 94 PID 4384 wrote to memory of 4704 4384 B7E6.tmp 94 PID 4384 wrote to memory of 4704 4384 B7E6.tmp 94 PID 4704 wrote to memory of 4032 4704 B882.tmp 95 PID 4704 wrote to memory of 4032 4704 B882.tmp 95 PID 4704 wrote to memory of 4032 4704 B882.tmp 95 PID 4032 wrote to memory of 1048 4032 B92E.tmp 96 PID 4032 wrote to memory of 1048 4032 B92E.tmp 96 PID 4032 wrote to memory of 1048 4032 B92E.tmp 96 PID 1048 wrote to memory of 1412 1048 B9DA.tmp 97 PID 1048 wrote to memory of 1412 1048 B9DA.tmp 97 PID 1048 wrote to memory of 1412 1048 B9DA.tmp 97 PID 1412 wrote to memory of 2984 1412 BAA5.tmp 98 PID 1412 wrote to memory of 2984 1412 BAA5.tmp 98 PID 1412 wrote to memory of 2984 1412 BAA5.tmp 98 PID 2984 wrote to memory of 4180 2984 BB70.tmp 99 PID 2984 wrote to memory of 4180 2984 BB70.tmp 99 PID 2984 wrote to memory of 4180 2984 BB70.tmp 99 PID 4180 wrote to memory of 4916 4180 BC0C.tmp 100 PID 4180 wrote to memory of 4916 4180 BC0C.tmp 100 PID 4180 wrote to memory of 4916 4180 BC0C.tmp 100 PID 4916 wrote to memory of 1368 4916 BC89.tmp 103 PID 4916 wrote to memory of 1368 4916 BC89.tmp 103 PID 4916 wrote to memory of 1368 4916 BC89.tmp 103 PID 1368 wrote to memory of 4664 1368 BCF7.tmp 104 PID 1368 wrote to memory of 4664 1368 BCF7.tmp 104 PID 1368 wrote to memory of 4664 1368 BCF7.tmp 104 PID 4664 wrote to memory of 3400 4664 BDC2.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5f6fc87101b95996b072b2a1d7149b5_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\e5f6fc87101b95996b072b2a1d7149b5_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\B064.tmp"C:\Users\Admin\AppData\Local\Temp\B064.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\B110.tmp"C:\Users\Admin\AppData\Local\Temp\B110.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\B277.tmp"C:\Users\Admin\AppData\Local\Temp\B277.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\B49A.tmp"C:\Users\Admin\AppData\Local\Temp\B49A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\B536.tmp"C:\Users\Admin\AppData\Local\Temp\B536.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\B72A.tmp"C:\Users\Admin\AppData\Local\Temp\B72A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\B882.tmp"C:\Users\Admin\AppData\Local\Temp\B882.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\BB70.tmp"C:\Users\Admin\AppData\Local\Temp\BB70.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\BC89.tmp"C:\Users\Admin\AppData\Local\Temp\BC89.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"23⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"24⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"25⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\C071.tmp"C:\Users\Admin\AppData\Local\Temp\C071.tmp"26⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\C11D.tmp"C:\Users\Admin\AppData\Local\Temp\C11D.tmp"27⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"28⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\C275.tmp"C:\Users\Admin\AppData\Local\Temp\C275.tmp"29⤵
- Executes dropped EXE
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"30⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\C37F.tmp"C:\Users\Admin\AppData\Local\Temp\C37F.tmp"31⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\C40B.tmp"C:\Users\Admin\AppData\Local\Temp\C40B.tmp"32⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"33⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\C573.tmp"C:\Users\Admin\AppData\Local\Temp\C573.tmp"34⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"35⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\C66D.tmp"C:\Users\Admin\AppData\Local\Temp\C66D.tmp"36⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\C6DA.tmp"C:\Users\Admin\AppData\Local\Temp\C6DA.tmp"37⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\C747.tmp"C:\Users\Admin\AppData\Local\Temp\C747.tmp"38⤵
- Executes dropped EXE
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"39⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\C822.tmp"C:\Users\Admin\AppData\Local\Temp\C822.tmp"40⤵
- Executes dropped EXE
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"41⤵
- Executes dropped EXE
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\C92C.tmp"C:\Users\Admin\AppData\Local\Temp\C92C.tmp"42⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"43⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\CA26.tmp"C:\Users\Admin\AppData\Local\Temp\CA26.tmp"44⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\CAC2.tmp"C:\Users\Admin\AppData\Local\Temp\CAC2.tmp"45⤵
- Executes dropped EXE
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"46⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\CBBC.tmp"C:\Users\Admin\AppData\Local\Temp\CBBC.tmp"47⤵
- Executes dropped EXE
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\CC58.tmp"C:\Users\Admin\AppData\Local\Temp\CC58.tmp"48⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\CD14.tmp"C:\Users\Admin\AppData\Local\Temp\CD14.tmp"49⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\CDA0.tmp"C:\Users\Admin\AppData\Local\Temp\CDA0.tmp"50⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"51⤵
- Executes dropped EXE
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"52⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\CF37.tmp"C:\Users\Admin\AppData\Local\Temp\CF37.tmp"53⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"54⤵
- Executes dropped EXE
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\D050.tmp"C:\Users\Admin\AppData\Local\Temp\D050.tmp"55⤵
- Executes dropped EXE
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\D0DD.tmp"C:\Users\Admin\AppData\Local\Temp\D0DD.tmp"56⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\D15A.tmp"C:\Users\Admin\AppData\Local\Temp\D15A.tmp"57⤵
- Executes dropped EXE
PID:492 -
C:\Users\Admin\AppData\Local\Temp\D1F6.tmp"C:\Users\Admin\AppData\Local\Temp\D1F6.tmp"58⤵
- Executes dropped EXE
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\D292.tmp"C:\Users\Admin\AppData\Local\Temp\D292.tmp"59⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\D32E.tmp"C:\Users\Admin\AppData\Local\Temp\D32E.tmp"60⤵
- Executes dropped EXE
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"61⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\D448.tmp"C:\Users\Admin\AppData\Local\Temp\D448.tmp"62⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\D4D4.tmp"C:\Users\Admin\AppData\Local\Temp\D4D4.tmp"63⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\D542.tmp"C:\Users\Admin\AppData\Local\Temp\D542.tmp"64⤵
- Executes dropped EXE
PID:776 -
C:\Users\Admin\AppData\Local\Temp\D5ED.tmp"C:\Users\Admin\AppData\Local\Temp\D5ED.tmp"65⤵
- Executes dropped EXE
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\D68A.tmp"C:\Users\Admin\AppData\Local\Temp\D68A.tmp"66⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\D707.tmp"C:\Users\Admin\AppData\Local\Temp\D707.tmp"67⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"68⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\D83F.tmp"C:\Users\Admin\AppData\Local\Temp\D83F.tmp"69⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"70⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\D968.tmp"C:\Users\Admin\AppData\Local\Temp\D968.tmp"71⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\D9E5.tmp"C:\Users\Admin\AppData\Local\Temp\D9E5.tmp"72⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\DA62.tmp"C:\Users\Admin\AppData\Local\Temp\DA62.tmp"73⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"74⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"75⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"76⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\DC08.tmp"C:\Users\Admin\AppData\Local\Temp\DC08.tmp"77⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\DC95.tmp"C:\Users\Admin\AppData\Local\Temp\DC95.tmp"78⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\DD40.tmp"C:\Users\Admin\AppData\Local\Temp\DD40.tmp"79⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"80⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\DE4A.tmp"C:\Users\Admin\AppData\Local\Temp\DE4A.tmp"81⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"82⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\DF54.tmp"C:\Users\Admin\AppData\Local\Temp\DF54.tmp"83⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\DFC1.tmp"C:\Users\Admin\AppData\Local\Temp\DFC1.tmp"84⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\E02E.tmp"C:\Users\Admin\AppData\Local\Temp\E02E.tmp"85⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\E0AB.tmp"C:\Users\Admin\AppData\Local\Temp\E0AB.tmp"86⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\E138.tmp"C:\Users\Admin\AppData\Local\Temp\E138.tmp"87⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\E1D4.tmp"C:\Users\Admin\AppData\Local\Temp\E1D4.tmp"88⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\E242.tmp"C:\Users\Admin\AppData\Local\Temp\E242.tmp"89⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"90⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\E31C.tmp"C:\Users\Admin\AppData\Local\Temp\E31C.tmp"91⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\E3A9.tmp"C:\Users\Admin\AppData\Local\Temp\E3A9.tmp"92⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\E445.tmp"C:\Users\Admin\AppData\Local\Temp\E445.tmp"93⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\E4C2.tmp"C:\Users\Admin\AppData\Local\Temp\E4C2.tmp"94⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\E53F.tmp"C:\Users\Admin\AppData\Local\Temp\E53F.tmp"95⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\E5EB.tmp"C:\Users\Admin\AppData\Local\Temp\E5EB.tmp"96⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\E668.tmp"C:\Users\Admin\AppData\Local\Temp\E668.tmp"97⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"98⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\E762.tmp"C:\Users\Admin\AppData\Local\Temp\E762.tmp"99⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"100⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\E87B.tmp"C:\Users\Admin\AppData\Local\Temp\E87B.tmp"101⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\E918.tmp"C:\Users\Admin\AppData\Local\Temp\E918.tmp"102⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"103⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\EA21.tmp"C:\Users\Admin\AppData\Local\Temp\EA21.tmp"104⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\EA9E.tmp"C:\Users\Admin\AppData\Local\Temp\EA9E.tmp"105⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"106⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\EB89.tmp"C:\Users\Admin\AppData\Local\Temp\EB89.tmp"107⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\EC06.tmp"C:\Users\Admin\AppData\Local\Temp\EC06.tmp"108⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\EC83.tmp"C:\Users\Admin\AppData\Local\Temp\EC83.tmp"109⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"110⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"111⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\EE09.tmp"C:\Users\Admin\AppData\Local\Temp\EE09.tmp"112⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\EE86.tmp"C:\Users\Admin\AppData\Local\Temp\EE86.tmp"113⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\EF23.tmp"C:\Users\Admin\AppData\Local\Temp\EF23.tmp"114⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\EFAF.tmp"C:\Users\Admin\AppData\Local\Temp\EFAF.tmp"115⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\F04B.tmp"C:\Users\Admin\AppData\Local\Temp\F04B.tmp"116⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"117⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\F145.tmp"C:\Users\Admin\AppData\Local\Temp\F145.tmp"118⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"119⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\F27E.tmp"C:\Users\Admin\AppData\Local\Temp\F27E.tmp"120⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\F2EB.tmp"C:\Users\Admin\AppData\Local\Temp\F2EB.tmp"121⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\F368.tmp"C:\Users\Admin\AppData\Local\Temp\F368.tmp"122⤵PID:1976
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-