Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
20/08/2023, 11:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5620bb69f7dc9525097c959908429a82_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
5620bb69f7dc9525097c959908429a82_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
5620bb69f7dc9525097c959908429a82_mafia_JC.exe
-
Size
486KB
-
MD5
5620bb69f7dc9525097c959908429a82
-
SHA1
f7344411bf55afe0c3bc0cece89802a5b6c8fef8
-
SHA256
adeb20ec2cb91ac6acb1d7420adc46f013a54d5ccd0770110b9f995ff9402f8c
-
SHA512
76d7dafe759eb0eef1f157593a0a78316c893f729928f527aa5beddc5b55b79799aee64d9562b1b0235bda6fca7923cf012f4f8ebf30133697ec9ec9343f0a47
-
SSDEEP
12288:/U5rCOTeiDe2ANupgUbRWaD/lhH/7gXzhaQcaaVPNZ:/UQOJDePmgUVLD/LH/7gXAOCN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2960 68CC.tmp 2308 6968.tmp 3332 6A24.tmp 2464 6B0E.tmp 520 6BD9.tmp 4860 6C95.tmp 4000 6D41.tmp 5016 6E1B.tmp 2656 6ED7.tmp 1476 6FC1.tmp 2812 707D.tmp 2772 7129.tmp 768 7232.tmp 4892 72EE.tmp 3784 739A.tmp 4900 7426.tmp 3424 74D2.tmp 3672 75CC.tmp 3420 7668.tmp 4952 76F5.tmp 456 7782.tmp 2372 783D.tmp 1188 7908.tmp 908 7985.tmp 2108 7A12.tmp 400 7ABE.tmp 736 7B6A.tmp 916 7C25.tmp 1200 7C92.tmp 1768 7D9C.tmp 1700 7E48.tmp 5056 7F32.tmp 1420 7FCF.tmp 4788 806B.tmp 4692 80F7.tmp 4212 81B3.tmp 4168 829D.tmp 2860 8359.tmp 904 83C6.tmp 860 8453.tmp 2260 84D0.tmp 2180 855C.tmp 4648 85E9.tmp 3552 8695.tmp 2172 8760.tmp 224 881C.tmp 2240 88A8.tmp 4720 8944.tmp 1012 89E1.tmp 1344 8A9C.tmp 2796 8B48.tmp 4460 8BD5.tmp 4188 8C61.tmp 3988 8D0D.tmp 1360 8D9A.tmp 2948 8E46.tmp 4856 8ED2.tmp 4472 8F6F.tmp 408 901A.tmp 2328 90A7.tmp 3164 9114.tmp 780 91A1.tmp 3012 920E.tmp 3520 928B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2332 wrote to memory of 2960 2332 5620bb69f7dc9525097c959908429a82_mafia_JC.exe 81 PID 2332 wrote to memory of 2960 2332 5620bb69f7dc9525097c959908429a82_mafia_JC.exe 81 PID 2332 wrote to memory of 2960 2332 5620bb69f7dc9525097c959908429a82_mafia_JC.exe 81 PID 2960 wrote to memory of 2308 2960 68CC.tmp 82 PID 2960 wrote to memory of 2308 2960 68CC.tmp 82 PID 2960 wrote to memory of 2308 2960 68CC.tmp 82 PID 2308 wrote to memory of 3332 2308 6968.tmp 83 PID 2308 wrote to memory of 3332 2308 6968.tmp 83 PID 2308 wrote to memory of 3332 2308 6968.tmp 83 PID 3332 wrote to memory of 2464 3332 6A24.tmp 84 PID 3332 wrote to memory of 2464 3332 6A24.tmp 84 PID 3332 wrote to memory of 2464 3332 6A24.tmp 84 PID 2464 wrote to memory of 520 2464 6B0E.tmp 85 PID 2464 wrote to memory of 520 2464 6B0E.tmp 85 PID 2464 wrote to memory of 520 2464 6B0E.tmp 85 PID 520 wrote to memory of 4860 520 6BD9.tmp 86 PID 520 wrote to memory of 4860 520 6BD9.tmp 86 PID 520 wrote to memory of 4860 520 6BD9.tmp 86 PID 4860 wrote to memory of 4000 4860 6C95.tmp 87 PID 4860 wrote to memory of 4000 4860 6C95.tmp 87 PID 4860 wrote to memory of 4000 4860 6C95.tmp 87 PID 4000 wrote to memory of 5016 4000 6D41.tmp 88 PID 4000 wrote to memory of 5016 4000 6D41.tmp 88 PID 4000 wrote to memory of 5016 4000 6D41.tmp 88 PID 5016 wrote to memory of 2656 5016 6E1B.tmp 90 PID 5016 wrote to memory of 2656 5016 6E1B.tmp 90 PID 5016 wrote to memory of 2656 5016 6E1B.tmp 90 PID 2656 wrote to memory of 1476 2656 6ED7.tmp 91 PID 2656 wrote to memory of 1476 2656 6ED7.tmp 91 PID 2656 wrote to memory of 1476 2656 6ED7.tmp 91 PID 1476 wrote to memory of 2812 1476 6FC1.tmp 92 PID 1476 wrote to memory of 2812 1476 6FC1.tmp 92 PID 1476 wrote to memory of 2812 1476 6FC1.tmp 92 PID 2812 wrote to memory of 2772 2812 707D.tmp 93 PID 2812 wrote to memory of 2772 2812 707D.tmp 93 PID 2812 wrote to memory of 2772 2812 707D.tmp 93 PID 2772 wrote to memory of 768 2772 7129.tmp 94 PID 2772 wrote to memory of 768 2772 7129.tmp 94 PID 2772 wrote to memory of 768 2772 7129.tmp 94 PID 768 wrote to memory of 4892 768 7232.tmp 95 PID 768 wrote to memory of 4892 768 7232.tmp 95 PID 768 wrote to memory of 4892 768 7232.tmp 95 PID 4892 wrote to memory of 3784 4892 72EE.tmp 96 PID 4892 wrote to memory of 3784 4892 72EE.tmp 96 PID 4892 wrote to memory of 3784 4892 72EE.tmp 96 PID 3784 wrote to memory of 4900 3784 739A.tmp 97 PID 3784 wrote to memory of 4900 3784 739A.tmp 97 PID 3784 wrote to memory of 4900 3784 739A.tmp 97 PID 4900 wrote to memory of 3424 4900 7426.tmp 98 PID 4900 wrote to memory of 3424 4900 7426.tmp 98 PID 4900 wrote to memory of 3424 4900 7426.tmp 98 PID 3424 wrote to memory of 3672 3424 74D2.tmp 101 PID 3424 wrote to memory of 3672 3424 74D2.tmp 101 PID 3424 wrote to memory of 3672 3424 74D2.tmp 101 PID 3672 wrote to memory of 3420 3672 75CC.tmp 102 PID 3672 wrote to memory of 3420 3672 75CC.tmp 102 PID 3672 wrote to memory of 3420 3672 75CC.tmp 102 PID 3420 wrote to memory of 4952 3420 7668.tmp 103 PID 3420 wrote to memory of 4952 3420 7668.tmp 103 PID 3420 wrote to memory of 4952 3420 7668.tmp 103 PID 4952 wrote to memory of 456 4952 76F5.tmp 104 PID 4952 wrote to memory of 456 4952 76F5.tmp 104 PID 4952 wrote to memory of 456 4952 76F5.tmp 104 PID 456 wrote to memory of 2372 456 7782.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\5620bb69f7dc9525097c959908429a82_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\5620bb69f7dc9525097c959908429a82_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\7232.tmp"C:\Users\Admin\AppData\Local\Temp\7232.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\72EE.tmp"C:\Users\Admin\AppData\Local\Temp\72EE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\76F5.tmp"C:\Users\Admin\AppData\Local\Temp\76F5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\783D.tmp"C:\Users\Admin\AppData\Local\Temp\783D.tmp"23⤵
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\7908.tmp"C:\Users\Admin\AppData\Local\Temp\7908.tmp"24⤵
- Executes dropped EXE
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"25⤵
- Executes dropped EXE
PID:908 -
C:\Users\Admin\AppData\Local\Temp\7A12.tmp"C:\Users\Admin\AppData\Local\Temp\7A12.tmp"26⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"27⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"28⤵
- Executes dropped EXE
PID:736 -
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"29⤵
- Executes dropped EXE
PID:916 -
C:\Users\Admin\AppData\Local\Temp\7C92.tmp"C:\Users\Admin\AppData\Local\Temp\7C92.tmp"30⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"31⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\7E48.tmp"C:\Users\Admin\AppData\Local\Temp\7E48.tmp"32⤵
- Executes dropped EXE
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\7F32.tmp"C:\Users\Admin\AppData\Local\Temp\7F32.tmp"33⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"34⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"35⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\80F7.tmp"C:\Users\Admin\AppData\Local\Temp\80F7.tmp"36⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\81B3.tmp"C:\Users\Admin\AppData\Local\Temp\81B3.tmp"37⤵
- Executes dropped EXE
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\829D.tmp"C:\Users\Admin\AppData\Local\Temp\829D.tmp"38⤵
- Executes dropped EXE
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\8359.tmp"C:\Users\Admin\AppData\Local\Temp\8359.tmp"39⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\83C6.tmp"C:\Users\Admin\AppData\Local\Temp\83C6.tmp"40⤵
- Executes dropped EXE
PID:904 -
C:\Users\Admin\AppData\Local\Temp\8453.tmp"C:\Users\Admin\AppData\Local\Temp\8453.tmp"41⤵
- Executes dropped EXE
PID:860 -
C:\Users\Admin\AppData\Local\Temp\84D0.tmp"C:\Users\Admin\AppData\Local\Temp\84D0.tmp"42⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\855C.tmp"C:\Users\Admin\AppData\Local\Temp\855C.tmp"43⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"44⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\8695.tmp"C:\Users\Admin\AppData\Local\Temp\8695.tmp"45⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\8760.tmp"C:\Users\Admin\AppData\Local\Temp\8760.tmp"46⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\881C.tmp"C:\Users\Admin\AppData\Local\Temp\881C.tmp"47⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\88A8.tmp"C:\Users\Admin\AppData\Local\Temp\88A8.tmp"48⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"49⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\89E1.tmp"C:\Users\Admin\AppData\Local\Temp\89E1.tmp"50⤵
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"51⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\8B48.tmp"C:\Users\Admin\AppData\Local\Temp\8B48.tmp"52⤵
- Executes dropped EXE
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"53⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\8C61.tmp"C:\Users\Admin\AppData\Local\Temp\8C61.tmp"54⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"55⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"56⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\8E46.tmp"C:\Users\Admin\AppData\Local\Temp\8E46.tmp"57⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"58⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"59⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\901A.tmp"C:\Users\Admin\AppData\Local\Temp\901A.tmp"60⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\90A7.tmp"C:\Users\Admin\AppData\Local\Temp\90A7.tmp"61⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\9114.tmp"C:\Users\Admin\AppData\Local\Temp\9114.tmp"62⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"63⤵
- Executes dropped EXE
PID:780 -
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"64⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"65⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\92F9.tmp"C:\Users\Admin\AppData\Local\Temp\92F9.tmp"66⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\9366.tmp"C:\Users\Admin\AppData\Local\Temp\9366.tmp"67⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\9402.tmp"C:\Users\Admin\AppData\Local\Temp\9402.tmp"68⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\9460.tmp"C:\Users\Admin\AppData\Local\Temp\9460.tmp"69⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\94DD.tmp"C:\Users\Admin\AppData\Local\Temp\94DD.tmp"70⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\956A.tmp"C:\Users\Admin\AppData\Local\Temp\956A.tmp"71⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\9606.tmp"C:\Users\Admin\AppData\Local\Temp\9606.tmp"72⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"73⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\9710.tmp"C:\Users\Admin\AppData\Local\Temp\9710.tmp"74⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\977D.tmp"C:\Users\Admin\AppData\Local\Temp\977D.tmp"75⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\97EA.tmp"C:\Users\Admin\AppData\Local\Temp\97EA.tmp"76⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\98F4.tmp"C:\Users\Admin\AppData\Local\Temp\98F4.tmp"77⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"78⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"79⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"80⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"81⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"82⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"83⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"84⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"85⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"86⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"87⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"88⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"89⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"90⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"91⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\A095.tmp"C:\Users\Admin\AppData\Local\Temp\A095.tmp"92⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"93⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"94⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"95⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"96⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\A383.tmp"C:\Users\Admin\AppData\Local\Temp\A383.tmp"97⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"98⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"99⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"100⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"101⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"102⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"103⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\A74C.tmp"C:\Users\Admin\AppData\Local\Temp\A74C.tmp"104⤵PID:180
-
C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"105⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"106⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"107⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\A99E.tmp"C:\Users\Admin\AppData\Local\Temp\A99E.tmp"108⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"109⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"110⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\AB72.tmp"C:\Users\Admin\AppData\Local\Temp\AB72.tmp"111⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"112⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"113⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\AD38.tmp"C:\Users\Admin\AppData\Local\Temp\AD38.tmp"114⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"115⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\AE51.tmp"C:\Users\Admin\AppData\Local\Temp\AE51.tmp"116⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"117⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"118⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"119⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\B083.tmp"C:\Users\Admin\AppData\Local\Temp\B083.tmp"120⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"121⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\B14E.tmp"C:\Users\Admin\AppData\Local\Temp\B14E.tmp"122⤵PID:2432
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-