Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
31/08/2023, 17:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f96a69898a3b71c4fd573f3ae820600f_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
f96a69898a3b71c4fd573f3ae820600f_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
f96a69898a3b71c4fd573f3ae820600f_mafia_JC.exe
-
Size
486KB
-
MD5
f96a69898a3b71c4fd573f3ae820600f
-
SHA1
2740a4e0036b74f51023e17d89b2fe3f0a7c3b8f
-
SHA256
29927c0e1e243a0d166b36e5f9455a4bb19d62cdbff8aa44a5c47c4d1529b43c
-
SHA512
eab1b2e5a35dd98a9ddeb733cfa58d8fd79f1c4851a165ed1b3a0e5b678f9cab074aef16e88687d6db8d3659c266257851bfebfa372bafb809fb9fefe4ebd332
-
SSDEEP
12288:/U5rCOTeiD4Aa2XALowZ6SZ0Jypiist06x/o6NZ:/UQOJDK2Bw0SZ0cee6xA6N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4720 85F9.tmp 5040 86E3.tmp 4168 87AE.tmp 4916 886A.tmp 2320 8906.tmp 2764 89B2.tmp 2648 8A8D.tmp 4376 8B77.tmp 3920 8C42.tmp 1124 8D1D.tmp 4876 8DA9.tmp 5080 8E36.tmp 3672 8F11.tmp 4532 901A.tmp 4304 9105.tmp 3744 91A1.tmp 1500 920E.tmp 4836 92BA.tmp 1292 9357.tmp 2732 9431.tmp 4924 953B.tmp 3940 95E7.tmp 4676 9693.tmp 2948 976D.tmp 392 9848.tmp 3392 98B6.tmp 4884 9923.tmp 1612 99B0.tmp 1856 9A7B.tmp 4024 9B55.tmp 4380 9BF2.tmp 3168 9CAD.tmp 5076 9D69.tmp 2408 9DE6.tmp 2164 9E63.tmp 2748 9EEF.tmp 4056 9F8C.tmp 4584 A047.tmp 4880 A0F3.tmp 4760 A170.tmp 900 A1ED.tmp 3212 A299.tmp 456 A325.tmp 1264 A3C2.tmp 4768 A46E.tmp 4868 A4FA.tmp 4520 A5C5.tmp 4968 A652.tmp 2128 A6FE.tmp 4848 A79A.tmp 3376 A846.tmp 2304 A8F2.tmp 3148 A96F.tmp 3812 AA1B.tmp 1440 AAA7.tmp 1756 AB24.tmp 1196 ABB1.tmp 3296 AC3E.tmp 1780 ACCA.tmp 1676 AD57.tmp 3504 AE03.tmp 4232 AEAF.tmp 1748 AF2C.tmp 3732 AFA9.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2568 wrote to memory of 4720 2568 f96a69898a3b71c4fd573f3ae820600f_mafia_JC.exe 83 PID 2568 wrote to memory of 4720 2568 f96a69898a3b71c4fd573f3ae820600f_mafia_JC.exe 83 PID 2568 wrote to memory of 4720 2568 f96a69898a3b71c4fd573f3ae820600f_mafia_JC.exe 83 PID 4720 wrote to memory of 5040 4720 85F9.tmp 84 PID 4720 wrote to memory of 5040 4720 85F9.tmp 84 PID 4720 wrote to memory of 5040 4720 85F9.tmp 84 PID 5040 wrote to memory of 4168 5040 86E3.tmp 85 PID 5040 wrote to memory of 4168 5040 86E3.tmp 85 PID 5040 wrote to memory of 4168 5040 86E3.tmp 85 PID 4168 wrote to memory of 4916 4168 87AE.tmp 86 PID 4168 wrote to memory of 4916 4168 87AE.tmp 86 PID 4168 wrote to memory of 4916 4168 87AE.tmp 86 PID 4916 wrote to memory of 2320 4916 886A.tmp 87 PID 4916 wrote to memory of 2320 4916 886A.tmp 87 PID 4916 wrote to memory of 2320 4916 886A.tmp 87 PID 2320 wrote to memory of 2764 2320 8906.tmp 88 PID 2320 wrote to memory of 2764 2320 8906.tmp 88 PID 2320 wrote to memory of 2764 2320 8906.tmp 88 PID 2764 wrote to memory of 2648 2764 89B2.tmp 89 PID 2764 wrote to memory of 2648 2764 89B2.tmp 89 PID 2764 wrote to memory of 2648 2764 89B2.tmp 89 PID 2648 wrote to memory of 4376 2648 8A8D.tmp 90 PID 2648 wrote to memory of 4376 2648 8A8D.tmp 90 PID 2648 wrote to memory of 4376 2648 8A8D.tmp 90 PID 4376 wrote to memory of 3920 4376 8B77.tmp 91 PID 4376 wrote to memory of 3920 4376 8B77.tmp 91 PID 4376 wrote to memory of 3920 4376 8B77.tmp 91 PID 3920 wrote to memory of 1124 3920 8C42.tmp 92 PID 3920 wrote to memory of 1124 3920 8C42.tmp 92 PID 3920 wrote to memory of 1124 3920 8C42.tmp 92 PID 1124 wrote to memory of 4876 1124 8D1D.tmp 93 PID 1124 wrote to memory of 4876 1124 8D1D.tmp 93 PID 1124 wrote to memory of 4876 1124 8D1D.tmp 93 PID 4876 wrote to memory of 5080 4876 8DA9.tmp 94 PID 4876 wrote to memory of 5080 4876 8DA9.tmp 94 PID 4876 wrote to memory of 5080 4876 8DA9.tmp 94 PID 5080 wrote to memory of 3672 5080 8E36.tmp 95 PID 5080 wrote to memory of 3672 5080 8E36.tmp 95 PID 5080 wrote to memory of 3672 5080 8E36.tmp 95 PID 3672 wrote to memory of 4532 3672 8F11.tmp 96 PID 3672 wrote to memory of 4532 3672 8F11.tmp 96 PID 3672 wrote to memory of 4532 3672 8F11.tmp 96 PID 4532 wrote to memory of 4304 4532 901A.tmp 97 PID 4532 wrote to memory of 4304 4532 901A.tmp 97 PID 4532 wrote to memory of 4304 4532 901A.tmp 97 PID 4304 wrote to memory of 3744 4304 9105.tmp 98 PID 4304 wrote to memory of 3744 4304 9105.tmp 98 PID 4304 wrote to memory of 3744 4304 9105.tmp 98 PID 3744 wrote to memory of 1500 3744 91A1.tmp 101 PID 3744 wrote to memory of 1500 3744 91A1.tmp 101 PID 3744 wrote to memory of 1500 3744 91A1.tmp 101 PID 1500 wrote to memory of 4836 1500 920E.tmp 102 PID 1500 wrote to memory of 4836 1500 920E.tmp 102 PID 1500 wrote to memory of 4836 1500 920E.tmp 102 PID 4836 wrote to memory of 1292 4836 92BA.tmp 103 PID 4836 wrote to memory of 1292 4836 92BA.tmp 103 PID 4836 wrote to memory of 1292 4836 92BA.tmp 103 PID 1292 wrote to memory of 2732 1292 9357.tmp 104 PID 1292 wrote to memory of 2732 1292 9357.tmp 104 PID 1292 wrote to memory of 2732 1292 9357.tmp 104 PID 2732 wrote to memory of 4924 2732 9431.tmp 105 PID 2732 wrote to memory of 4924 2732 9431.tmp 105 PID 2732 wrote to memory of 4924 2732 9431.tmp 105 PID 4924 wrote to memory of 3940 4924 953B.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\f96a69898a3b71c4fd573f3ae820600f_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\f96a69898a3b71c4fd573f3ae820600f_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\85F9.tmp"C:\Users\Admin\AppData\Local\Temp\85F9.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\86E3.tmp"C:\Users\Admin\AppData\Local\Temp\86E3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\87AE.tmp"C:\Users\Admin\AppData\Local\Temp\87AE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\886A.tmp"C:\Users\Admin\AppData\Local\Temp\886A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\8906.tmp"C:\Users\Admin\AppData\Local\Temp\8906.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\89B2.tmp"C:\Users\Admin\AppData\Local\Temp\89B2.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\8B77.tmp"C:\Users\Admin\AppData\Local\Temp\8B77.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\8C42.tmp"C:\Users\Admin\AppData\Local\Temp\8C42.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\901A.tmp"C:\Users\Admin\AppData\Local\Temp\901A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\95E7.tmp"C:\Users\Admin\AppData\Local\Temp\95E7.tmp"23⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\9693.tmp"C:\Users\Admin\AppData\Local\Temp\9693.tmp"24⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\976D.tmp"C:\Users\Admin\AppData\Local\Temp\976D.tmp"25⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\9848.tmp"C:\Users\Admin\AppData\Local\Temp\9848.tmp"26⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\98B6.tmp"C:\Users\Admin\AppData\Local\Temp\98B6.tmp"27⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\9923.tmp"C:\Users\Admin\AppData\Local\Temp\9923.tmp"28⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"29⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"30⤵
- Executes dropped EXE
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"31⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"32⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"33⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\9D69.tmp"C:\Users\Admin\AppData\Local\Temp\9D69.tmp"34⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"35⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\9E63.tmp"C:\Users\Admin\AppData\Local\Temp\9E63.tmp"36⤵
- Executes dropped EXE
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"37⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"38⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\A047.tmp"C:\Users\Admin\AppData\Local\Temp\A047.tmp"39⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"40⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"41⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"42⤵
- Executes dropped EXE
PID:900 -
C:\Users\Admin\AppData\Local\Temp\A299.tmp"C:\Users\Admin\AppData\Local\Temp\A299.tmp"43⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\A325.tmp"C:\Users\Admin\AppData\Local\Temp\A325.tmp"44⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"45⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\A46E.tmp"C:\Users\Admin\AppData\Local\Temp\A46E.tmp"46⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"47⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"48⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"49⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"50⤵
- Executes dropped EXE
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"51⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"52⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"53⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\A96F.tmp"C:\Users\Admin\AppData\Local\Temp\A96F.tmp"54⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"55⤵
- Executes dropped EXE
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"56⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"57⤵
- Executes dropped EXE
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"58⤵
- Executes dropped EXE
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"59⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"60⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\AD57.tmp"C:\Users\Admin\AppData\Local\Temp\AD57.tmp"61⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"62⤵
- Executes dropped EXE
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"63⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"64⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"65⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\B016.tmp"C:\Users\Admin\AppData\Local\Temp\B016.tmp"66⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\B074.tmp"C:\Users\Admin\AppData\Local\Temp\B074.tmp"67⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\B100.tmp"C:\Users\Admin\AppData\Local\Temp\B100.tmp"68⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\B19D.tmp"C:\Users\Admin\AppData\Local\Temp\B19D.tmp"69⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\B20A.tmp"C:\Users\Admin\AppData\Local\Temp\B20A.tmp"70⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"71⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\B352.tmp"C:\Users\Admin\AppData\Local\Temp\B352.tmp"72⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"73⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\B42D.tmp"C:\Users\Admin\AppData\Local\Temp\B42D.tmp"74⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"75⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\B517.tmp"C:\Users\Admin\AppData\Local\Temp\B517.tmp"76⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"77⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\B640.tmp"C:\Users\Admin\AppData\Local\Temp\B640.tmp"78⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"79⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\B779.tmp"C:\Users\Admin\AppData\Local\Temp\B779.tmp"80⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\B824.tmp"C:\Users\Admin\AppData\Local\Temp\B824.tmp"81⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"82⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\B91E.tmp"C:\Users\Admin\AppData\Local\Temp\B91E.tmp"83⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\B99B.tmp"C:\Users\Admin\AppData\Local\Temp\B99B.tmp"84⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\BA38.tmp"C:\Users\Admin\AppData\Local\Temp\BA38.tmp"85⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"86⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\BB41.tmp"C:\Users\Admin\AppData\Local\Temp\BB41.tmp"87⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"88⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"89⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\BC99.tmp"C:\Users\Admin\AppData\Local\Temp\BC99.tmp"90⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\BD35.tmp"C:\Users\Admin\AppData\Local\Temp\BD35.tmp"91⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"92⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"93⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"94⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\BF49.tmp"C:\Users\Admin\AppData\Local\Temp\BF49.tmp"95⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"96⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\C043.tmp"C:\Users\Admin\AppData\Local\Temp\C043.tmp"97⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"98⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\C16B.tmp"C:\Users\Admin\AppData\Local\Temp\C16B.tmp"99⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"100⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\C285.tmp"C:\Users\Admin\AppData\Local\Temp\C285.tmp"101⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\C321.tmp"C:\Users\Admin\AppData\Local\Temp\C321.tmp"102⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\C3DC.tmp"C:\Users\Admin\AppData\Local\Temp\C3DC.tmp"103⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\C469.tmp"C:\Users\Admin\AppData\Local\Temp\C469.tmp"104⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\C515.tmp"C:\Users\Admin\AppData\Local\Temp\C515.tmp"105⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"106⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\C63E.tmp"C:\Users\Admin\AppData\Local\Temp\C63E.tmp"107⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"108⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\C767.tmp"C:\Users\Admin\AppData\Local\Temp\C767.tmp"109⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\C803.tmp"C:\Users\Admin\AppData\Local\Temp\C803.tmp"110⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\C890.tmp"C:\Users\Admin\AppData\Local\Temp\C890.tmp"111⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\C92C.tmp"C:\Users\Admin\AppData\Local\Temp\C92C.tmp"112⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\C9D8.tmp"C:\Users\Admin\AppData\Local\Temp\C9D8.tmp"113⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\CA64.tmp"C:\Users\Admin\AppData\Local\Temp\CA64.tmp"114⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\CB3F.tmp"C:\Users\Admin\AppData\Local\Temp\CB3F.tmp"115⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"116⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\CC68.tmp"C:\Users\Admin\AppData\Local\Temp\CC68.tmp"117⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\CCE5.tmp"C:\Users\Admin\AppData\Local\Temp\CCE5.tmp"118⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\CD81.tmp"C:\Users\Admin\AppData\Local\Temp\CD81.tmp"119⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"120⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"121⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\CF56.tmp"C:\Users\Admin\AppData\Local\Temp\CF56.tmp"122⤵PID:2648
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-