Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
30/08/2023, 18:44
Static task
static1
Behavioral task
behavioral1
Sample
eabbb617864e51ba42d7326c74bcd6a0_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
eabbb617864e51ba42d7326c74bcd6a0_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
eabbb617864e51ba42d7326c74bcd6a0_mafia_JC.exe
-
Size
486KB
-
MD5
eabbb617864e51ba42d7326c74bcd6a0
-
SHA1
ebf563471dbe508e6e12e6ec6abdba182d8cb30d
-
SHA256
3ed8d2c10c46b6f0e5687d5db60bf187e4fdfed81668423bbb93fe4c2ef87585
-
SHA512
63d0e586007dab69a3ebf30c0667351a8fe31d19ec8c50b75673c5e2540390104040d872c46ebde3b8d9980733e648b38565e0d92d19b9b0ffe3ee626d3f86dc
-
SSDEEP
6144:Forf3lPvovsgZnqG2C7mOTeiLfD7Mzor5l3YeYD9uX1vmd7Jm/pX0PIwAsH3dZ:UU5rCOTeiDMAl3Xy7JmzCNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1468 D91A.tmp 1560 D9D5.tmp 3452 DE79.tmp 5036 DF44.tmp 3736 E03E.tmp 4996 E0CB.tmp 4840 E196.tmp 4420 E222.tmp 1964 E2BF.tmp 3296 E399.tmp 4724 E416.tmp 2100 E520.tmp 4784 E5EB.tmp 4848 E697.tmp 3968 E753.tmp 1944 E7FE.tmp 2800 E8AA.tmp 3468 E975.tmp 4404 EA31.tmp 3220 EABE.tmp 2520 EB98.tmp 2228 EC83.tmp 4004 ED00.tmp 1192 ED8C.tmp 1752 EE19.tmp 2636 EEB5.tmp 3696 EF42.tmp 4844 EFFD.tmp 3096 F0B9.tmp 3412 F155.tmp 972 F230.tmp 3088 F2BC.tmp 540 F397.tmp 452 F424.tmp 2356 F4A1.tmp 2260 F50E.tmp 772 F58B.tmp 2060 F627.tmp 4692 F6E3.tmp 3416 F770.tmp 3324 F7FC.tmp 4800 F889.tmp 4564 F954.tmp 1556 F9D1.tmp 1096 FA6D.tmp 3288 FAEA.tmp 1516 FB67.tmp 1952 FBF4.tmp 1768 FC80.tmp 4616 FD1D.tmp 4536 FDA9.tmp 4396 FE26.tmp 264 FEC3.tmp 4172 FFDC.tmp 4620 78.tmp 4168 105.tmp 4028 21E.tmp 2232 2CA.tmp 3472 356.tmp 2560 3F3.tmp 1416 470.tmp 5084 4DD.tmp 1928 54A.tmp 4308 5C7.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1532 wrote to memory of 1468 1532 eabbb617864e51ba42d7326c74bcd6a0_mafia_JC.exe 80 PID 1532 wrote to memory of 1468 1532 eabbb617864e51ba42d7326c74bcd6a0_mafia_JC.exe 80 PID 1532 wrote to memory of 1468 1532 eabbb617864e51ba42d7326c74bcd6a0_mafia_JC.exe 80 PID 1468 wrote to memory of 1560 1468 D91A.tmp 81 PID 1468 wrote to memory of 1560 1468 D91A.tmp 81 PID 1468 wrote to memory of 1560 1468 D91A.tmp 81 PID 1560 wrote to memory of 3452 1560 D9D5.tmp 82 PID 1560 wrote to memory of 3452 1560 D9D5.tmp 82 PID 1560 wrote to memory of 3452 1560 D9D5.tmp 82 PID 3452 wrote to memory of 5036 3452 DE79.tmp 83 PID 3452 wrote to memory of 5036 3452 DE79.tmp 83 PID 3452 wrote to memory of 5036 3452 DE79.tmp 83 PID 5036 wrote to memory of 3736 5036 DF44.tmp 84 PID 5036 wrote to memory of 3736 5036 DF44.tmp 84 PID 5036 wrote to memory of 3736 5036 DF44.tmp 84 PID 3736 wrote to memory of 4996 3736 E03E.tmp 85 PID 3736 wrote to memory of 4996 3736 E03E.tmp 85 PID 3736 wrote to memory of 4996 3736 E03E.tmp 85 PID 4996 wrote to memory of 4840 4996 E0CB.tmp 87 PID 4996 wrote to memory of 4840 4996 E0CB.tmp 87 PID 4996 wrote to memory of 4840 4996 E0CB.tmp 87 PID 4840 wrote to memory of 4420 4840 E196.tmp 88 PID 4840 wrote to memory of 4420 4840 E196.tmp 88 PID 4840 wrote to memory of 4420 4840 E196.tmp 88 PID 4420 wrote to memory of 1964 4420 E222.tmp 89 PID 4420 wrote to memory of 1964 4420 E222.tmp 89 PID 4420 wrote to memory of 1964 4420 E222.tmp 89 PID 1964 wrote to memory of 3296 1964 E2BF.tmp 90 PID 1964 wrote to memory of 3296 1964 E2BF.tmp 90 PID 1964 wrote to memory of 3296 1964 E2BF.tmp 90 PID 3296 wrote to memory of 4724 3296 E399.tmp 91 PID 3296 wrote to memory of 4724 3296 E399.tmp 91 PID 3296 wrote to memory of 4724 3296 E399.tmp 91 PID 4724 wrote to memory of 2100 4724 E416.tmp 92 PID 4724 wrote to memory of 2100 4724 E416.tmp 92 PID 4724 wrote to memory of 2100 4724 E416.tmp 92 PID 2100 wrote to memory of 4784 2100 E520.tmp 93 PID 2100 wrote to memory of 4784 2100 E520.tmp 93 PID 2100 wrote to memory of 4784 2100 E520.tmp 93 PID 4784 wrote to memory of 4848 4784 E5EB.tmp 94 PID 4784 wrote to memory of 4848 4784 E5EB.tmp 94 PID 4784 wrote to memory of 4848 4784 E5EB.tmp 94 PID 4848 wrote to memory of 3968 4848 E697.tmp 95 PID 4848 wrote to memory of 3968 4848 E697.tmp 95 PID 4848 wrote to memory of 3968 4848 E697.tmp 95 PID 3968 wrote to memory of 1944 3968 E753.tmp 98 PID 3968 wrote to memory of 1944 3968 E753.tmp 98 PID 3968 wrote to memory of 1944 3968 E753.tmp 98 PID 1944 wrote to memory of 2800 1944 E7FE.tmp 99 PID 1944 wrote to memory of 2800 1944 E7FE.tmp 99 PID 1944 wrote to memory of 2800 1944 E7FE.tmp 99 PID 2800 wrote to memory of 3468 2800 E8AA.tmp 100 PID 2800 wrote to memory of 3468 2800 E8AA.tmp 100 PID 2800 wrote to memory of 3468 2800 E8AA.tmp 100 PID 3468 wrote to memory of 4404 3468 E975.tmp 101 PID 3468 wrote to memory of 4404 3468 E975.tmp 101 PID 3468 wrote to memory of 4404 3468 E975.tmp 101 PID 4404 wrote to memory of 3220 4404 EA31.tmp 102 PID 4404 wrote to memory of 3220 4404 EA31.tmp 102 PID 4404 wrote to memory of 3220 4404 EA31.tmp 102 PID 3220 wrote to memory of 2520 3220 EABE.tmp 103 PID 3220 wrote to memory of 2520 3220 EABE.tmp 103 PID 3220 wrote to memory of 2520 3220 EABE.tmp 103 PID 2520 wrote to memory of 2228 2520 EB98.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\eabbb617864e51ba42d7326c74bcd6a0_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\eabbb617864e51ba42d7326c74bcd6a0_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\D91A.tmp"C:\Users\Admin\AppData\Local\Temp\D91A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\DE79.tmp"C:\Users\Admin\AppData\Local\Temp\DE79.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\DF44.tmp"C:\Users\Admin\AppData\Local\Temp\DF44.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\E03E.tmp"C:\Users\Admin\AppData\Local\Temp\E03E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\E0CB.tmp"C:\Users\Admin\AppData\Local\Temp\E0CB.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\E196.tmp"C:\Users\Admin\AppData\Local\Temp\E196.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\E222.tmp"C:\Users\Admin\AppData\Local\Temp\E222.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\E399.tmp"C:\Users\Admin\AppData\Local\Temp\E399.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\E416.tmp"C:\Users\Admin\AppData\Local\Temp\E416.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\E520.tmp"C:\Users\Admin\AppData\Local\Temp\E520.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\E5EB.tmp"C:\Users\Admin\AppData\Local\Temp\E5EB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\E697.tmp"C:\Users\Admin\AppData\Local\Temp\E697.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\E753.tmp"C:\Users\Admin\AppData\Local\Temp\E753.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\E8AA.tmp"C:\Users\Admin\AppData\Local\Temp\E8AA.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\E975.tmp"C:\Users\Admin\AppData\Local\Temp\E975.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\EA31.tmp"C:\Users\Admin\AppData\Local\Temp\EA31.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\EABE.tmp"C:\Users\Admin\AppData\Local\Temp\EABE.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\EB98.tmp"C:\Users\Admin\AppData\Local\Temp\EB98.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\EC83.tmp"C:\Users\Admin\AppData\Local\Temp\EC83.tmp"23⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\ED00.tmp"C:\Users\Admin\AppData\Local\Temp\ED00.tmp"24⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"25⤵
- Executes dropped EXE
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\EE19.tmp"C:\Users\Admin\AppData\Local\Temp\EE19.tmp"26⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"27⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\EF42.tmp"C:\Users\Admin\AppData\Local\Temp\EF42.tmp"28⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"29⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\F0B9.tmp"C:\Users\Admin\AppData\Local\Temp\F0B9.tmp"30⤵
- Executes dropped EXE
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\F155.tmp"C:\Users\Admin\AppData\Local\Temp\F155.tmp"31⤵
- Executes dropped EXE
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\F230.tmp"C:\Users\Admin\AppData\Local\Temp\F230.tmp"32⤵
- Executes dropped EXE
PID:972 -
C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"33⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\F397.tmp"C:\Users\Admin\AppData\Local\Temp\F397.tmp"34⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\F424.tmp"C:\Users\Admin\AppData\Local\Temp\F424.tmp"35⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"36⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\F50E.tmp"C:\Users\Admin\AppData\Local\Temp\F50E.tmp"37⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\F58B.tmp"C:\Users\Admin\AppData\Local\Temp\F58B.tmp"38⤵
- Executes dropped EXE
PID:772 -
C:\Users\Admin\AppData\Local\Temp\F627.tmp"C:\Users\Admin\AppData\Local\Temp\F627.tmp"39⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"40⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\F770.tmp"C:\Users\Admin\AppData\Local\Temp\F770.tmp"41⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\F7FC.tmp"C:\Users\Admin\AppData\Local\Temp\F7FC.tmp"42⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\F889.tmp"C:\Users\Admin\AppData\Local\Temp\F889.tmp"43⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\F954.tmp"C:\Users\Admin\AppData\Local\Temp\F954.tmp"44⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"45⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"46⤵
- Executes dropped EXE
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"47⤵
- Executes dropped EXE
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\FB67.tmp"C:\Users\Admin\AppData\Local\Temp\FB67.tmp"48⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"49⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\FC80.tmp"C:\Users\Admin\AppData\Local\Temp\FC80.tmp"50⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\FD1D.tmp"C:\Users\Admin\AppData\Local\Temp\FD1D.tmp"51⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"52⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\FE26.tmp"C:\Users\Admin\AppData\Local\Temp\FE26.tmp"53⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\FEC3.tmp"C:\Users\Admin\AppData\Local\Temp\FEC3.tmp"54⤵
- Executes dropped EXE
PID:264 -
C:\Users\Admin\AppData\Local\Temp\FF4F.tmp"C:\Users\Admin\AppData\Local\Temp\FF4F.tmp"55⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"56⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\78.tmp"C:\Users\Admin\AppData\Local\Temp\78.tmp"57⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\105.tmp"C:\Users\Admin\AppData\Local\Temp\105.tmp"58⤵
- Executes dropped EXE
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\21E.tmp"C:\Users\Admin\AppData\Local\Temp\21E.tmp"59⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\2CA.tmp"C:\Users\Admin\AppData\Local\Temp\2CA.tmp"60⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\356.tmp"C:\Users\Admin\AppData\Local\Temp\356.tmp"61⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\3F3.tmp"C:\Users\Admin\AppData\Local\Temp\3F3.tmp"62⤵
- Executes dropped EXE
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\470.tmp"C:\Users\Admin\AppData\Local\Temp\470.tmp"63⤵
- Executes dropped EXE
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\4DD.tmp"C:\Users\Admin\AppData\Local\Temp\4DD.tmp"64⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\54A.tmp"C:\Users\Admin\AppData\Local\Temp\54A.tmp"65⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\5C7.tmp"C:\Users\Admin\AppData\Local\Temp\5C7.tmp"66⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\625.tmp"C:\Users\Admin\AppData\Local\Temp\625.tmp"67⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\683.tmp"C:\Users\Admin\AppData\Local\Temp\683.tmp"68⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\700.tmp"C:\Users\Admin\AppData\Local\Temp\700.tmp"69⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\75E.tmp"C:\Users\Admin\AppData\Local\Temp\75E.tmp"70⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\7FA.tmp"C:\Users\Admin\AppData\Local\Temp\7FA.tmp"71⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\877.tmp"C:\Users\Admin\AppData\Local\Temp\877.tmp"72⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\8F4.tmp"C:\Users\Admin\AppData\Local\Temp\8F4.tmp"73⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\971.tmp"C:\Users\Admin\AppData\Local\Temp\971.tmp"74⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\9CF.tmp"C:\Users\Admin\AppData\Local\Temp\9CF.tmp"75⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\A3C.tmp"C:\Users\Admin\AppData\Local\Temp\A3C.tmp"76⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\AA9.tmp"C:\Users\Admin\AppData\Local\Temp\AA9.tmp"77⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\BA3.tmp"C:\Users\Admin\AppData\Local\Temp\BA3.tmp"78⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\C5F.tmp"C:\Users\Admin\AppData\Local\Temp\C5F.tmp"79⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\CCC.tmp"C:\Users\Admin\AppData\Local\Temp\CCC.tmp"80⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\D49.tmp"C:\Users\Admin\AppData\Local\Temp\D49.tmp"81⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\DC6.tmp"C:\Users\Admin\AppData\Local\Temp\DC6.tmp"82⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\E53.tmp"C:\Users\Admin\AppData\Local\Temp\E53.tmp"83⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\EB1.tmp"C:\Users\Admin\AppData\Local\Temp\EB1.tmp"84⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\F2E.tmp"C:\Users\Admin\AppData\Local\Temp\F2E.tmp"85⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\FCA.tmp"C:\Users\Admin\AppData\Local\Temp\FCA.tmp"86⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\1066.tmp"C:\Users\Admin\AppData\Local\Temp\1066.tmp"87⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\10D4.tmp"C:\Users\Admin\AppData\Local\Temp\10D4.tmp"88⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\1141.tmp"C:\Users\Admin\AppData\Local\Temp\1141.tmp"89⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\119F.tmp"C:\Users\Admin\AppData\Local\Temp\119F.tmp"90⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\122B.tmp"C:\Users\Admin\AppData\Local\Temp\122B.tmp"91⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\12A8.tmp"C:\Users\Admin\AppData\Local\Temp\12A8.tmp"92⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\1335.tmp"C:\Users\Admin\AppData\Local\Temp\1335.tmp"93⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\13A2.tmp"C:\Users\Admin\AppData\Local\Temp\13A2.tmp"94⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\143F.tmp"C:\Users\Admin\AppData\Local\Temp\143F.tmp"95⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\14CB.tmp"C:\Users\Admin\AppData\Local\Temp\14CB.tmp"96⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\1558.tmp"C:\Users\Admin\AppData\Local\Temp\1558.tmp"97⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\15D5.tmp"C:\Users\Admin\AppData\Local\Temp\15D5.tmp"98⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\16A0.tmp"C:\Users\Admin\AppData\Local\Temp\16A0.tmp"99⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\172D.tmp"C:\Users\Admin\AppData\Local\Temp\172D.tmp"100⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\17B9.tmp"C:\Users\Admin\AppData\Local\Temp\17B9.tmp"101⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\1827.tmp"C:\Users\Admin\AppData\Local\Temp\1827.tmp"102⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\18A4.tmp"C:\Users\Admin\AppData\Local\Temp\18A4.tmp"103⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\1921.tmp"C:\Users\Admin\AppData\Local\Temp\1921.tmp"104⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\19AD.tmp"C:\Users\Admin\AppData\Local\Temp\19AD.tmp"105⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\1A59.tmp"C:\Users\Admin\AppData\Local\Temp\1A59.tmp"106⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\1AE6.tmp"C:\Users\Admin\AppData\Local\Temp\1AE6.tmp"107⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\1B72.tmp"C:\Users\Admin\AppData\Local\Temp\1B72.tmp"108⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\1C2E.tmp"C:\Users\Admin\AppData\Local\Temp\1C2E.tmp"109⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\1CBA.tmp"C:\Users\Admin\AppData\Local\Temp\1CBA.tmp"110⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\1D37.tmp"C:\Users\Admin\AppData\Local\Temp\1D37.tmp"111⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\1DC4.tmp"C:\Users\Admin\AppData\Local\Temp\1DC4.tmp"112⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\1E51.tmp"C:\Users\Admin\AppData\Local\Temp\1E51.tmp"113⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\1EBE.tmp"C:\Users\Admin\AppData\Local\Temp\1EBE.tmp"114⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\1F3B.tmp"C:\Users\Admin\AppData\Local\Temp\1F3B.tmp"115⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\1FD7.tmp"C:\Users\Admin\AppData\Local\Temp\1FD7.tmp"116⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\2064.tmp"C:\Users\Admin\AppData\Local\Temp\2064.tmp"117⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\20E1.tmp"C:\Users\Admin\AppData\Local\Temp\20E1.tmp"118⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\21AC.tmp"C:\Users\Admin\AppData\Local\Temp\21AC.tmp"119⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\2229.tmp"C:\Users\Admin\AppData\Local\Temp\2229.tmp"120⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\22C5.tmp"C:\Users\Admin\AppData\Local\Temp\22C5.tmp"121⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\2352.tmp"C:\Users\Admin\AppData\Local\Temp\2352.tmp"122⤵PID:368
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-