Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
30/08/2023, 17:37
Static task
static1
Behavioral task
behavioral1
Sample
e63d65ff4d02bd0c4bb122186d01f6e4_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
e63d65ff4d02bd0c4bb122186d01f6e4_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
e63d65ff4d02bd0c4bb122186d01f6e4_mafia_JC.exe
-
Size
487KB
-
MD5
e63d65ff4d02bd0c4bb122186d01f6e4
-
SHA1
f0483b3a727b8527cb3444d9b6e1e69161842293
-
SHA256
1826c4cbb0756b69c5be4e36aa4d50ab5cc98c73a9df6d6460fc57bce62acc80
-
SHA512
dc94e7978443bb45c097eb46ee21674a1d66d44a3d32bb9e7a9725115385af88e8401bca143b00078faf946195130fafa65271486d3f2b9a8c37997e1bf1028d
-
SSDEEP
6144:qorf3lPvovsgZnqG2C7mOTeiL9DU3ZVsgdxHG81xf4H7KNpHzdHC1OvJXVRJ6G09:HU5rCOTeiJhPOxgH76bisvJXTh0suNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2120 99DE.tmp 4924 9AAA.tmp 4192 9B55.tmp 1512 9C21.tmp 3456 9CEC.tmp 4372 9D98.tmp 2772 9E43.tmp 3068 9F2E.tmp 3988 A028.tmp 1492 A122.tmp 2684 A1AE.tmp 1636 A25A.tmp 4316 A3B2.tmp 2700 A4CB.tmp 4724 A577.tmp 3892 A642.tmp 1364 A6EE.tmp 568 A79A.tmp 2080 A894.tmp 556 A930.tmp 2352 A9EC.tmp 1320 AAA7.tmp 1884 AB53.tmp 100 AC0F.tmp 2616 ACBB.tmp 380 AD47.tmp 2272 ADD4.tmp 2996 AE80.tmp 4112 AF3B.tmp 4312 AFC8.tmp 1532 B054.tmp 824 B100.tmp 648 B1BC.tmp 3980 B239.tmp 1976 B2D5.tmp 3828 B371.tmp 1476 B40E.tmp 3872 B4B9.tmp 1712 B536.tmp 3052 B5A4.tmp 440 B630.tmp 4056 B6BD.tmp 5044 B759.tmp 4272 B7E6.tmp 4836 B882.tmp 1816 B93E.tmp 4792 B9CA.tmp 2984 BA47.tmp 4760 BAC4.tmp 4380 BB61.tmp 4864 BBFD.tmp 4012 BC89.tmp 2520 BD16.tmp 2244 BDA3.tmp 1028 BE5E.tmp 4000 BEFA.tmp 4432 BF97.tmp 1348 C052.tmp 2120 C0DF.tmp 1984 C14C.tmp 552 C1D9.tmp 4536 C256.tmp 4204 C2F2.tmp 1392 C36F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4124 wrote to memory of 2120 4124 e63d65ff4d02bd0c4bb122186d01f6e4_mafia_JC.exe 82 PID 4124 wrote to memory of 2120 4124 e63d65ff4d02bd0c4bb122186d01f6e4_mafia_JC.exe 82 PID 4124 wrote to memory of 2120 4124 e63d65ff4d02bd0c4bb122186d01f6e4_mafia_JC.exe 82 PID 2120 wrote to memory of 4924 2120 99DE.tmp 83 PID 2120 wrote to memory of 4924 2120 99DE.tmp 83 PID 2120 wrote to memory of 4924 2120 99DE.tmp 83 PID 4924 wrote to memory of 4192 4924 9AAA.tmp 84 PID 4924 wrote to memory of 4192 4924 9AAA.tmp 84 PID 4924 wrote to memory of 4192 4924 9AAA.tmp 84 PID 4192 wrote to memory of 1512 4192 9B55.tmp 85 PID 4192 wrote to memory of 1512 4192 9B55.tmp 85 PID 4192 wrote to memory of 1512 4192 9B55.tmp 85 PID 1512 wrote to memory of 3456 1512 9C21.tmp 86 PID 1512 wrote to memory of 3456 1512 9C21.tmp 86 PID 1512 wrote to memory of 3456 1512 9C21.tmp 86 PID 3456 wrote to memory of 4372 3456 9CEC.tmp 87 PID 3456 wrote to memory of 4372 3456 9CEC.tmp 87 PID 3456 wrote to memory of 4372 3456 9CEC.tmp 87 PID 4372 wrote to memory of 2772 4372 9D98.tmp 88 PID 4372 wrote to memory of 2772 4372 9D98.tmp 88 PID 4372 wrote to memory of 2772 4372 9D98.tmp 88 PID 2772 wrote to memory of 3068 2772 9E43.tmp 89 PID 2772 wrote to memory of 3068 2772 9E43.tmp 89 PID 2772 wrote to memory of 3068 2772 9E43.tmp 89 PID 3068 wrote to memory of 3988 3068 9F2E.tmp 91 PID 3068 wrote to memory of 3988 3068 9F2E.tmp 91 PID 3068 wrote to memory of 3988 3068 9F2E.tmp 91 PID 3988 wrote to memory of 1492 3988 A028.tmp 92 PID 3988 wrote to memory of 1492 3988 A028.tmp 92 PID 3988 wrote to memory of 1492 3988 A028.tmp 92 PID 1492 wrote to memory of 2684 1492 A122.tmp 93 PID 1492 wrote to memory of 2684 1492 A122.tmp 93 PID 1492 wrote to memory of 2684 1492 A122.tmp 93 PID 2684 wrote to memory of 1636 2684 A1AE.tmp 94 PID 2684 wrote to memory of 1636 2684 A1AE.tmp 94 PID 2684 wrote to memory of 1636 2684 A1AE.tmp 94 PID 1636 wrote to memory of 4316 1636 A25A.tmp 95 PID 1636 wrote to memory of 4316 1636 A25A.tmp 95 PID 1636 wrote to memory of 4316 1636 A25A.tmp 95 PID 4316 wrote to memory of 2700 4316 A3B2.tmp 96 PID 4316 wrote to memory of 2700 4316 A3B2.tmp 96 PID 4316 wrote to memory of 2700 4316 A3B2.tmp 96 PID 2700 wrote to memory of 4724 2700 A4CB.tmp 97 PID 2700 wrote to memory of 4724 2700 A4CB.tmp 97 PID 2700 wrote to memory of 4724 2700 A4CB.tmp 97 PID 4724 wrote to memory of 3892 4724 A577.tmp 98 PID 4724 wrote to memory of 3892 4724 A577.tmp 98 PID 4724 wrote to memory of 3892 4724 A577.tmp 98 PID 3892 wrote to memory of 1364 3892 A642.tmp 99 PID 3892 wrote to memory of 1364 3892 A642.tmp 99 PID 3892 wrote to memory of 1364 3892 A642.tmp 99 PID 1364 wrote to memory of 568 1364 A6EE.tmp 100 PID 1364 wrote to memory of 568 1364 A6EE.tmp 100 PID 1364 wrote to memory of 568 1364 A6EE.tmp 100 PID 568 wrote to memory of 2080 568 A79A.tmp 101 PID 568 wrote to memory of 2080 568 A79A.tmp 101 PID 568 wrote to memory of 2080 568 A79A.tmp 101 PID 2080 wrote to memory of 556 2080 A894.tmp 104 PID 2080 wrote to memory of 556 2080 A894.tmp 104 PID 2080 wrote to memory of 556 2080 A894.tmp 104 PID 556 wrote to memory of 2352 556 A930.tmp 105 PID 556 wrote to memory of 2352 556 A930.tmp 105 PID 556 wrote to memory of 2352 556 A930.tmp 105 PID 2352 wrote to memory of 1320 2352 A9EC.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\e63d65ff4d02bd0c4bb122186d01f6e4_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\e63d65ff4d02bd0c4bb122186d01f6e4_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\9C21.tmp"C:\Users\Admin\AppData\Local\Temp\9C21.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\A028.tmp"C:\Users\Admin\AppData\Local\Temp\A028.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\A577.tmp"C:\Users\Admin\AppData\Local\Temp\A577.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\A642.tmp"C:\Users\Admin\AppData\Local\Temp\A642.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Users\Admin\AppData\Local\Temp\A894.tmp"C:\Users\Admin\AppData\Local\Temp\A894.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"23⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\AB53.tmp"C:\Users\Admin\AppData\Local\Temp\AB53.tmp"24⤵
- Executes dropped EXE
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"25⤵
- Executes dropped EXE
PID:100 -
C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"26⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"27⤵
- Executes dropped EXE
PID:380 -
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"28⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\AE80.tmp"C:\Users\Admin\AppData\Local\Temp\AE80.tmp"29⤵
- Executes dropped EXE
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"30⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"31⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\B054.tmp"C:\Users\Admin\AppData\Local\Temp\B054.tmp"32⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\B100.tmp"C:\Users\Admin\AppData\Local\Temp\B100.tmp"33⤵
- Executes dropped EXE
PID:824 -
C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"34⤵
- Executes dropped EXE
PID:648 -
C:\Users\Admin\AppData\Local\Temp\B239.tmp"C:\Users\Admin\AppData\Local\Temp\B239.tmp"35⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"36⤵
- Executes dropped EXE
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\B371.tmp"C:\Users\Admin\AppData\Local\Temp\B371.tmp"37⤵
- Executes dropped EXE
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\B40E.tmp"C:\Users\Admin\AppData\Local\Temp\B40E.tmp"38⤵
- Executes dropped EXE
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"39⤵
- Executes dropped EXE
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\B536.tmp"C:\Users\Admin\AppData\Local\Temp\B536.tmp"40⤵
- Executes dropped EXE
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"41⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"42⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"43⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\B759.tmp"C:\Users\Admin\AppData\Local\Temp\B759.tmp"44⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"45⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\B882.tmp"C:\Users\Admin\AppData\Local\Temp\B882.tmp"46⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\B93E.tmp"C:\Users\Admin\AppData\Local\Temp\B93E.tmp"47⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"48⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\BA47.tmp"C:\Users\Admin\AppData\Local\Temp\BA47.tmp"49⤵
- Executes dropped EXE
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"50⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\BB61.tmp"C:\Users\Admin\AppData\Local\Temp\BB61.tmp"51⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"52⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\BC89.tmp"C:\Users\Admin\AppData\Local\Temp\BC89.tmp"53⤵
- Executes dropped EXE
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\BD16.tmp"C:\Users\Admin\AppData\Local\Temp\BD16.tmp"54⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"55⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"56⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"57⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\BF97.tmp"C:\Users\Admin\AppData\Local\Temp\BF97.tmp"58⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\C052.tmp"C:\Users\Admin\AppData\Local\Temp\C052.tmp"59⤵
- Executes dropped EXE
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"60⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"61⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"62⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\C256.tmp"C:\Users\Admin\AppData\Local\Temp\C256.tmp"63⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"64⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\C36F.tmp"C:\Users\Admin\AppData\Local\Temp\C36F.tmp"65⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\C40B.tmp"C:\Users\Admin\AppData\Local\Temp\C40B.tmp"66⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\C488.tmp"C:\Users\Admin\AppData\Local\Temp\C488.tmp"67⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\C515.tmp"C:\Users\Admin\AppData\Local\Temp\C515.tmp"68⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"69⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\C61F.tmp"C:\Users\Admin\AppData\Local\Temp\C61F.tmp"70⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\C69C.tmp"C:\Users\Admin\AppData\Local\Temp\C69C.tmp"71⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\C719.tmp"C:\Users\Admin\AppData\Local\Temp\C719.tmp"72⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\C776.tmp"C:\Users\Admin\AppData\Local\Temp\C776.tmp"73⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"74⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\C861.tmp"C:\Users\Admin\AppData\Local\Temp\C861.tmp"75⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\C8ED.tmp"C:\Users\Admin\AppData\Local\Temp\C8ED.tmp"76⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\C95B.tmp"C:\Users\Admin\AppData\Local\Temp\C95B.tmp"77⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"78⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\CA55.tmp"C:\Users\Admin\AppData\Local\Temp\CA55.tmp"79⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\CAD2.tmp"C:\Users\Admin\AppData\Local\Temp\CAD2.tmp"80⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"81⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"82⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\CC97.tmp"C:\Users\Admin\AppData\Local\Temp\CC97.tmp"83⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\CD14.tmp"C:\Users\Admin\AppData\Local\Temp\CD14.tmp"84⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\CD81.tmp"C:\Users\Admin\AppData\Local\Temp\CD81.tmp"85⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\CDDF.tmp"C:\Users\Admin\AppData\Local\Temp\CDDF.tmp"86⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"87⤵PID:100
-
C:\Users\Admin\AppData\Local\Temp\CEC9.tmp"C:\Users\Admin\AppData\Local\Temp\CEC9.tmp"88⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\CF46.tmp"C:\Users\Admin\AppData\Local\Temp\CF46.tmp"89⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"90⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\D060.tmp"C:\Users\Admin\AppData\Local\Temp\D060.tmp"91⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"92⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\D169.tmp"C:\Users\Admin\AppData\Local\Temp\D169.tmp"93⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"94⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\D244.tmp"C:\Users\Admin\AppData\Local\Temp\D244.tmp"95⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\D2B1.tmp"C:\Users\Admin\AppData\Local\Temp\D2B1.tmp"96⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\D31F.tmp"C:\Users\Admin\AppData\Local\Temp\D31F.tmp"97⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\D38C.tmp"C:\Users\Admin\AppData\Local\Temp\D38C.tmp"98⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\D409.tmp"C:\Users\Admin\AppData\Local\Temp\D409.tmp"99⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\D496.tmp"C:\Users\Admin\AppData\Local\Temp\D496.tmp"100⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\D522.tmp"C:\Users\Admin\AppData\Local\Temp\D522.tmp"101⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"102⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\D63C.tmp"C:\Users\Admin\AppData\Local\Temp\D63C.tmp"103⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\D6D8.tmp"C:\Users\Admin\AppData\Local\Temp\D6D8.tmp"104⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\D764.tmp"C:\Users\Admin\AppData\Local\Temp\D764.tmp"105⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\D7E1.tmp"C:\Users\Admin\AppData\Local\Temp\D7E1.tmp"106⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\D88D.tmp"C:\Users\Admin\AppData\Local\Temp\D88D.tmp"107⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\D92A.tmp"C:\Users\Admin\AppData\Local\Temp\D92A.tmp"108⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\D9A7.tmp"C:\Users\Admin\AppData\Local\Temp\D9A7.tmp"109⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\DA33.tmp"C:\Users\Admin\AppData\Local\Temp\DA33.tmp"110⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\DADF.tmp"C:\Users\Admin\AppData\Local\Temp\DADF.tmp"111⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\DB6C.tmp"C:\Users\Admin\AppData\Local\Temp\DB6C.tmp"112⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\DBE9.tmp"C:\Users\Admin\AppData\Local\Temp\DBE9.tmp"113⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\DC75.tmp"C:\Users\Admin\AppData\Local\Temp\DC75.tmp"114⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\DD02.tmp"C:\Users\Admin\AppData\Local\Temp\DD02.tmp"115⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\DD9E.tmp"C:\Users\Admin\AppData\Local\Temp\DD9E.tmp"116⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\DE3A.tmp"C:\Users\Admin\AppData\Local\Temp\DE3A.tmp"117⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\DEC7.tmp"C:\Users\Admin\AppData\Local\Temp\DEC7.tmp"118⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\DF63.tmp"C:\Users\Admin\AppData\Local\Temp\DF63.tmp"119⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\E01F.tmp"C:\Users\Admin\AppData\Local\Temp\E01F.tmp"120⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\E08C.tmp"C:\Users\Admin\AppData\Local\Temp\E08C.tmp"121⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\E128.tmp"C:\Users\Admin\AppData\Local\Temp\E128.tmp"122⤵PID:3724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-