Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
05/08/2023, 10:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6b57019269b42434ebeb14f1855be068_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
6b57019269b42434ebeb14f1855be068_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
6b57019269b42434ebeb14f1855be068_mafia_JC.exe
-
Size
486KB
-
MD5
6b57019269b42434ebeb14f1855be068
-
SHA1
55400b310a42b47312b7b7f86a0ad76f359f88cf
-
SHA256
25a27050f542e4436fb0ff3106282b65bf384f95ed8698e1d1361b7a8f6e2a7d
-
SHA512
2be3a7065eb00d30bdb005bfae3ed891539d9f652898909b79517317589d5ff319acd38934236b164f11e3066828df415524ccb9521e0ec9af281ba9d15e88ee
-
SSDEEP
12288:/U5rCOTeiDz9sYIgUsZI6qfVamyHkB/NZ:/UQOJDJss66gVDpB/N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3080 831A.tmp 4932 83E5.tmp 3448 84C0.tmp 2012 858B.tmp 224 8628.tmp 4732 86E3.tmp 3552 8770.tmp 4160 882B.tmp 2360 88E7.tmp 4208 8964.tmp 5000 8A2F.tmp 1072 8ABB.tmp 552 8B48.tmp 3632 8C04.tmp 1324 8D5B.tmp 4688 8DE8.tmp 2044 8EC3.tmp 2912 8F5F.tmp 4356 9069.tmp 3688 9191.tmp 1844 91FF.tmp 1864 929B.tmp 2404 9318.tmp 1568 93E3.tmp 1284 948F.tmp 844 952B.tmp 5008 95C8.tmp 8 96D1.tmp 2720 97EA.tmp 2960 98D5.tmp 4012 99BF.tmp 1008 9A8A.tmp 1364 9B75.tmp 2776 9C11.tmp 4992 9CDC.tmp 4664 9D88.tmp 4040 9E05.tmp 2512 9EA1.tmp 1552 9F3D.tmp 5056 9FCA.tmp 4556 A057.tmp 1880 A0F3.tmp 3796 A170.tmp 2296 A22B.tmp 3908 A2B8.tmp 1556 A345.tmp 4672 A3D1.tmp 2088 A45E.tmp 3720 A4FA.tmp 3192 A577.tmp 1304 A613.tmp 1744 A690.tmp 4916 A71D.tmp 232 A7B9.tmp 4164 A865.tmp 3396 A8F2.tmp 4128 A97E.tmp 2308 AA0B.tmp 3340 AA88.tmp 1932 AB05.tmp 4388 AB63.tmp 4800 ABC1.tmp 2916 AC1E.tmp 3392 ACBB.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1440 wrote to memory of 3080 1440 6b57019269b42434ebeb14f1855be068_mafia_JC.exe 82 PID 1440 wrote to memory of 3080 1440 6b57019269b42434ebeb14f1855be068_mafia_JC.exe 82 PID 1440 wrote to memory of 3080 1440 6b57019269b42434ebeb14f1855be068_mafia_JC.exe 82 PID 3080 wrote to memory of 4932 3080 831A.tmp 83 PID 3080 wrote to memory of 4932 3080 831A.tmp 83 PID 3080 wrote to memory of 4932 3080 831A.tmp 83 PID 4932 wrote to memory of 3448 4932 83E5.tmp 84 PID 4932 wrote to memory of 3448 4932 83E5.tmp 84 PID 4932 wrote to memory of 3448 4932 83E5.tmp 84 PID 3448 wrote to memory of 2012 3448 84C0.tmp 85 PID 3448 wrote to memory of 2012 3448 84C0.tmp 85 PID 3448 wrote to memory of 2012 3448 84C0.tmp 85 PID 2012 wrote to memory of 224 2012 858B.tmp 86 PID 2012 wrote to memory of 224 2012 858B.tmp 86 PID 2012 wrote to memory of 224 2012 858B.tmp 86 PID 224 wrote to memory of 4732 224 8628.tmp 87 PID 224 wrote to memory of 4732 224 8628.tmp 87 PID 224 wrote to memory of 4732 224 8628.tmp 87 PID 4732 wrote to memory of 3552 4732 86E3.tmp 88 PID 4732 wrote to memory of 3552 4732 86E3.tmp 88 PID 4732 wrote to memory of 3552 4732 86E3.tmp 88 PID 3552 wrote to memory of 4160 3552 8770.tmp 89 PID 3552 wrote to memory of 4160 3552 8770.tmp 89 PID 3552 wrote to memory of 4160 3552 8770.tmp 89 PID 4160 wrote to memory of 2360 4160 882B.tmp 91 PID 4160 wrote to memory of 2360 4160 882B.tmp 91 PID 4160 wrote to memory of 2360 4160 882B.tmp 91 PID 2360 wrote to memory of 4208 2360 88E7.tmp 92 PID 2360 wrote to memory of 4208 2360 88E7.tmp 92 PID 2360 wrote to memory of 4208 2360 88E7.tmp 92 PID 4208 wrote to memory of 5000 4208 8964.tmp 93 PID 4208 wrote to memory of 5000 4208 8964.tmp 93 PID 4208 wrote to memory of 5000 4208 8964.tmp 93 PID 5000 wrote to memory of 1072 5000 8A2F.tmp 94 PID 5000 wrote to memory of 1072 5000 8A2F.tmp 94 PID 5000 wrote to memory of 1072 5000 8A2F.tmp 94 PID 1072 wrote to memory of 552 1072 8ABB.tmp 95 PID 1072 wrote to memory of 552 1072 8ABB.tmp 95 PID 1072 wrote to memory of 552 1072 8ABB.tmp 95 PID 552 wrote to memory of 3632 552 8B48.tmp 96 PID 552 wrote to memory of 3632 552 8B48.tmp 96 PID 552 wrote to memory of 3632 552 8B48.tmp 96 PID 3632 wrote to memory of 1324 3632 8C04.tmp 97 PID 3632 wrote to memory of 1324 3632 8C04.tmp 97 PID 3632 wrote to memory of 1324 3632 8C04.tmp 97 PID 1324 wrote to memory of 4688 1324 8D5B.tmp 100 PID 1324 wrote to memory of 4688 1324 8D5B.tmp 100 PID 1324 wrote to memory of 4688 1324 8D5B.tmp 100 PID 4688 wrote to memory of 2044 4688 8DE8.tmp 101 PID 4688 wrote to memory of 2044 4688 8DE8.tmp 101 PID 4688 wrote to memory of 2044 4688 8DE8.tmp 101 PID 2044 wrote to memory of 2912 2044 8EC3.tmp 102 PID 2044 wrote to memory of 2912 2044 8EC3.tmp 102 PID 2044 wrote to memory of 2912 2044 8EC3.tmp 102 PID 2912 wrote to memory of 4356 2912 8F5F.tmp 103 PID 2912 wrote to memory of 4356 2912 8F5F.tmp 103 PID 2912 wrote to memory of 4356 2912 8F5F.tmp 103 PID 4356 wrote to memory of 3688 4356 9069.tmp 104 PID 4356 wrote to memory of 3688 4356 9069.tmp 104 PID 4356 wrote to memory of 3688 4356 9069.tmp 104 PID 3688 wrote to memory of 1844 3688 9191.tmp 106 PID 3688 wrote to memory of 1844 3688 9191.tmp 106 PID 3688 wrote to memory of 1844 3688 9191.tmp 106 PID 1844 wrote to memory of 1864 1844 91FF.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b57019269b42434ebeb14f1855be068_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\6b57019269b42434ebeb14f1855be068_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\83E5.tmp"C:\Users\Admin\AppData\Local\Temp\83E5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\84C0.tmp"C:\Users\Admin\AppData\Local\Temp\84C0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\858B.tmp"C:\Users\Admin\AppData\Local\Temp\858B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\8628.tmp"C:\Users\Admin\AppData\Local\Temp\8628.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\86E3.tmp"C:\Users\Admin\AppData\Local\Temp\86E3.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\8770.tmp"C:\Users\Admin\AppData\Local\Temp\8770.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\882B.tmp"C:\Users\Admin\AppData\Local\Temp\882B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\88E7.tmp"C:\Users\Admin\AppData\Local\Temp\88E7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\8964.tmp"C:\Users\Admin\AppData\Local\Temp\8964.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\8B48.tmp"C:\Users\Admin\AppData\Local\Temp\8B48.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\8C04.tmp"C:\Users\Admin\AppData\Local\Temp\8C04.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\9191.tmp"C:\Users\Admin\AppData\Local\Temp\9191.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\929B.tmp"C:\Users\Admin\AppData\Local\Temp\929B.tmp"23⤵
- Executes dropped EXE
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"24⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"25⤵
- Executes dropped EXE
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\948F.tmp"C:\Users\Admin\AppData\Local\Temp\948F.tmp"26⤵
- Executes dropped EXE
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"27⤵
- Executes dropped EXE
PID:844 -
C:\Users\Admin\AppData\Local\Temp\95C8.tmp"C:\Users\Admin\AppData\Local\Temp\95C8.tmp"28⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\96D1.tmp"C:\Users\Admin\AppData\Local\Temp\96D1.tmp"29⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\97EA.tmp"C:\Users\Admin\AppData\Local\Temp\97EA.tmp"30⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\98D5.tmp"C:\Users\Admin\AppData\Local\Temp\98D5.tmp"31⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\99BF.tmp"C:\Users\Admin\AppData\Local\Temp\99BF.tmp"32⤵
- Executes dropped EXE
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"33⤵
- Executes dropped EXE
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"34⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"35⤵
- Executes dropped EXE
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"36⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"37⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"38⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"39⤵
- Executes dropped EXE
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"40⤵
- Executes dropped EXE
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"41⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"42⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"43⤵
- Executes dropped EXE
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"44⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"45⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"46⤵
- Executes dropped EXE
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"47⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"48⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"49⤵
- Executes dropped EXE
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"50⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\A577.tmp"C:\Users\Admin\AppData\Local\Temp\A577.tmp"51⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\A613.tmp"C:\Users\Admin\AppData\Local\Temp\A613.tmp"52⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"53⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"54⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"55⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"56⤵
- Executes dropped EXE
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"57⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"58⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"59⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\AA88.tmp"C:\Users\Admin\AppData\Local\Temp\AA88.tmp"60⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\AB05.tmp"C:\Users\Admin\AppData\Local\Temp\AB05.tmp"61⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"62⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"63⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"64⤵
- Executes dropped EXE
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"65⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\AD18.tmp"C:\Users\Admin\AppData\Local\Temp\AD18.tmp"66⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"67⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"68⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\AE80.tmp"C:\Users\Admin\AppData\Local\Temp\AE80.tmp"69⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"70⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"71⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"72⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\B074.tmp"C:\Users\Admin\AppData\Local\Temp\B074.tmp"73⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"74⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"75⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"76⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\B287.tmp"C:\Users\Admin\AppData\Local\Temp\B287.tmp"77⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\B323.tmp"C:\Users\Admin\AppData\Local\Temp\B323.tmp"78⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"79⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\B43C.tmp"C:\Users\Admin\AppData\Local\Temp\B43C.tmp"80⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"81⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\B546.tmp"C:\Users\Admin\AppData\Local\Temp\B546.tmp"82⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"83⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"84⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"85⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\B70B.tmp"C:\Users\Admin\AppData\Local\Temp\B70B.tmp"86⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\B788.tmp"C:\Users\Admin\AppData\Local\Temp\B788.tmp"87⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\B805.tmp"C:\Users\Admin\AppData\Local\Temp\B805.tmp"88⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\B873.tmp"C:\Users\Admin\AppData\Local\Temp\B873.tmp"89⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"90⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\B96D.tmp"C:\Users\Admin\AppData\Local\Temp\B96D.tmp"91⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"92⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\BA67.tmp"C:\Users\Admin\AppData\Local\Temp\BA67.tmp"93⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\BB03.tmp"C:\Users\Admin\AppData\Local\Temp\BB03.tmp"94⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"95⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"96⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"97⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"98⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\BD64.tmp"C:\Users\Admin\AppData\Local\Temp\BD64.tmp"99⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"100⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"101⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"102⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\BF77.tmp"C:\Users\Admin\AppData\Local\Temp\BF77.tmp"103⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"104⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"105⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"106⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"107⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"108⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"109⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\C36F.tmp"C:\Users\Admin\AppData\Local\Temp\C36F.tmp"110⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"111⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\C488.tmp"C:\Users\Admin\AppData\Local\Temp\C488.tmp"112⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\C515.tmp"C:\Users\Admin\AppData\Local\Temp\C515.tmp"113⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\C592.tmp"C:\Users\Admin\AppData\Local\Temp\C592.tmp"114⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\C61F.tmp"C:\Users\Admin\AppData\Local\Temp\C61F.tmp"115⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"116⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\C738.tmp"C:\Users\Admin\AppData\Local\Temp\C738.tmp"117⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"118⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\C841.tmp"C:\Users\Admin\AppData\Local\Temp\C841.tmp"119⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"120⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\C93B.tmp"C:\Users\Admin\AppData\Local\Temp\C93B.tmp"121⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"122⤵PID:4548
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-