Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
24/08/2023, 17:35
Static task
static1
Behavioral task
behavioral1
Sample
863c2a51aa208b79fc8abdf0ad1b71e0_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
863c2a51aa208b79fc8abdf0ad1b71e0_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
863c2a51aa208b79fc8abdf0ad1b71e0_mafia_JC.exe
-
Size
486KB
-
MD5
863c2a51aa208b79fc8abdf0ad1b71e0
-
SHA1
ad96c9555554159a8dc372aeba2d82f5fae021c1
-
SHA256
a1c4d11a572f77b80a860e8ae1c181b5cd51998e005b789094fc964a360bfe49
-
SHA512
1039f5359cf172aa67dfca805350a832836a8cfad334a236d1f6d8a3fb54f3617d5b50ec0b17b18a5dd1fe9edcb8ca61d157fd039cd0712303141d11a5d23065
-
SSDEEP
6144:Forf3lPvovsgZnqG2C7mOTeiLfD7N2PeDk0NupDYlVLxZ3SUP4bafUnhRvscyVLv:UU5rCOTeiDFDkkiSvCfg2E2b9UNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2236 6C75.tmp 4528 6D41.tmp 3916 6DFC.tmp 2128 6ED7.tmp 3100 6FD1.tmp 5012 708C.tmp 3804 7138.tmp 884 71E4.tmp 364 72AF.tmp 4440 736B.tmp 4732 7407.tmp 4728 7501.tmp 4996 75DC.tmp 2916 7678.tmp 1804 77B0.tmp 648 782D.tmp 3860 78D9.tmp 464 79A4.tmp 4172 7A50.tmp 2392 7B2B.tmp 3728 7C35.tmp 4208 7CE1.tmp 5072 7DBB.tmp 3192 7E29.tmp 5088 7EB5.tmp 528 7F52.tmp 4736 7FDE.tmp 1168 807A.tmp 5000 8174.tmp 5048 827E.tmp 4156 8359.tmp 1988 83E5.tmp 2708 8482.tmp 3516 84FF.tmp 4540 858B.tmp 3876 8608.tmp 4160 8685.tmp 3324 8722.tmp 2456 879F.tmp 1868 880C.tmp 4704 8899.tmp 4084 8916.tmp 440 89C1.tmp 4240 8A6D.tmp 3184 8AFA.tmp 684 8B87.tmp 3360 8C32.tmp 1228 8CDE.tmp 4020 8D5B.tmp 3752 8E17.tmp 400 8ED2.tmp 436 8F40.tmp 4992 8FCC.tmp 2428 9069.tmp 2340 90E6.tmp 4528 9163.tmp 3004 91EF.tmp 412 926C.tmp 2128 92DA.tmp 1580 9337.tmp 3100 93C4.tmp 5012 9441.tmp 3064 94DD.tmp 1088 9579.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3464 wrote to memory of 2236 3464 863c2a51aa208b79fc8abdf0ad1b71e0_mafia_JC.exe 81 PID 3464 wrote to memory of 2236 3464 863c2a51aa208b79fc8abdf0ad1b71e0_mafia_JC.exe 81 PID 3464 wrote to memory of 2236 3464 863c2a51aa208b79fc8abdf0ad1b71e0_mafia_JC.exe 81 PID 2236 wrote to memory of 4528 2236 6C75.tmp 82 PID 2236 wrote to memory of 4528 2236 6C75.tmp 82 PID 2236 wrote to memory of 4528 2236 6C75.tmp 82 PID 4528 wrote to memory of 3916 4528 6D41.tmp 83 PID 4528 wrote to memory of 3916 4528 6D41.tmp 83 PID 4528 wrote to memory of 3916 4528 6D41.tmp 83 PID 3916 wrote to memory of 2128 3916 6DFC.tmp 84 PID 3916 wrote to memory of 2128 3916 6DFC.tmp 84 PID 3916 wrote to memory of 2128 3916 6DFC.tmp 84 PID 2128 wrote to memory of 3100 2128 6ED7.tmp 85 PID 2128 wrote to memory of 3100 2128 6ED7.tmp 85 PID 2128 wrote to memory of 3100 2128 6ED7.tmp 85 PID 3100 wrote to memory of 5012 3100 6FD1.tmp 86 PID 3100 wrote to memory of 5012 3100 6FD1.tmp 86 PID 3100 wrote to memory of 5012 3100 6FD1.tmp 86 PID 5012 wrote to memory of 3804 5012 708C.tmp 87 PID 5012 wrote to memory of 3804 5012 708C.tmp 87 PID 5012 wrote to memory of 3804 5012 708C.tmp 87 PID 3804 wrote to memory of 884 3804 7138.tmp 88 PID 3804 wrote to memory of 884 3804 7138.tmp 88 PID 3804 wrote to memory of 884 3804 7138.tmp 88 PID 884 wrote to memory of 364 884 71E4.tmp 89 PID 884 wrote to memory of 364 884 71E4.tmp 89 PID 884 wrote to memory of 364 884 71E4.tmp 89 PID 364 wrote to memory of 4440 364 72AF.tmp 90 PID 364 wrote to memory of 4440 364 72AF.tmp 90 PID 364 wrote to memory of 4440 364 72AF.tmp 90 PID 4440 wrote to memory of 4732 4440 736B.tmp 91 PID 4440 wrote to memory of 4732 4440 736B.tmp 91 PID 4440 wrote to memory of 4732 4440 736B.tmp 91 PID 4732 wrote to memory of 4728 4732 7407.tmp 92 PID 4732 wrote to memory of 4728 4732 7407.tmp 92 PID 4732 wrote to memory of 4728 4732 7407.tmp 92 PID 4728 wrote to memory of 4996 4728 7501.tmp 93 PID 4728 wrote to memory of 4996 4728 7501.tmp 93 PID 4728 wrote to memory of 4996 4728 7501.tmp 93 PID 4996 wrote to memory of 2916 4996 75DC.tmp 94 PID 4996 wrote to memory of 2916 4996 75DC.tmp 94 PID 4996 wrote to memory of 2916 4996 75DC.tmp 94 PID 2916 wrote to memory of 1804 2916 7678.tmp 95 PID 2916 wrote to memory of 1804 2916 7678.tmp 95 PID 2916 wrote to memory of 1804 2916 7678.tmp 95 PID 1804 wrote to memory of 648 1804 77B0.tmp 96 PID 1804 wrote to memory of 648 1804 77B0.tmp 96 PID 1804 wrote to memory of 648 1804 77B0.tmp 96 PID 648 wrote to memory of 3860 648 782D.tmp 97 PID 648 wrote to memory of 3860 648 782D.tmp 97 PID 648 wrote to memory of 3860 648 782D.tmp 97 PID 3860 wrote to memory of 464 3860 78D9.tmp 100 PID 3860 wrote to memory of 464 3860 78D9.tmp 100 PID 3860 wrote to memory of 464 3860 78D9.tmp 100 PID 464 wrote to memory of 4172 464 79A4.tmp 101 PID 464 wrote to memory of 4172 464 79A4.tmp 101 PID 464 wrote to memory of 4172 464 79A4.tmp 101 PID 4172 wrote to memory of 2392 4172 7A50.tmp 102 PID 4172 wrote to memory of 2392 4172 7A50.tmp 102 PID 4172 wrote to memory of 2392 4172 7A50.tmp 102 PID 2392 wrote to memory of 3728 2392 7B2B.tmp 103 PID 2392 wrote to memory of 3728 2392 7B2B.tmp 103 PID 2392 wrote to memory of 3728 2392 7B2B.tmp 103 PID 3728 wrote to memory of 4208 3728 7C35.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\863c2a51aa208b79fc8abdf0ad1b71e0_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\863c2a51aa208b79fc8abdf0ad1b71e0_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\77B0.tmp"C:\Users\Admin\AppData\Local\Temp\77B0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\782D.tmp"C:\Users\Admin\AppData\Local\Temp\782D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Users\Admin\AppData\Local\Temp\78D9.tmp"C:\Users\Admin\AppData\Local\Temp\78D9.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\79A4.tmp"C:\Users\Admin\AppData\Local\Temp\79A4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\7A50.tmp"C:\Users\Admin\AppData\Local\Temp\7A50.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\7C35.tmp"C:\Users\Admin\AppData\Local\Temp\7C35.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"23⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"24⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\7E29.tmp"C:\Users\Admin\AppData\Local\Temp\7E29.tmp"25⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"26⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\7F52.tmp"C:\Users\Admin\AppData\Local\Temp\7F52.tmp"27⤵
- Executes dropped EXE
PID:528 -
C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"28⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\807A.tmp"C:\Users\Admin\AppData\Local\Temp\807A.tmp"29⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\8174.tmp"C:\Users\Admin\AppData\Local\Temp\8174.tmp"30⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\827E.tmp"C:\Users\Admin\AppData\Local\Temp\827E.tmp"31⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\8359.tmp"C:\Users\Admin\AppData\Local\Temp\8359.tmp"32⤵
- Executes dropped EXE
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\83E5.tmp"C:\Users\Admin\AppData\Local\Temp\83E5.tmp"33⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\8482.tmp"C:\Users\Admin\AppData\Local\Temp\8482.tmp"34⤵
- Executes dropped EXE
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\84FF.tmp"C:\Users\Admin\AppData\Local\Temp\84FF.tmp"35⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\858B.tmp"C:\Users\Admin\AppData\Local\Temp\858B.tmp"36⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\8608.tmp"C:\Users\Admin\AppData\Local\Temp\8608.tmp"37⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\8685.tmp"C:\Users\Admin\AppData\Local\Temp\8685.tmp"38⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\8722.tmp"C:\Users\Admin\AppData\Local\Temp\8722.tmp"39⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\879F.tmp"C:\Users\Admin\AppData\Local\Temp\879F.tmp"40⤵
- Executes dropped EXE
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\880C.tmp"C:\Users\Admin\AppData\Local\Temp\880C.tmp"41⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\8899.tmp"C:\Users\Admin\AppData\Local\Temp\8899.tmp"42⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\8916.tmp"C:\Users\Admin\AppData\Local\Temp\8916.tmp"43⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\89C1.tmp"C:\Users\Admin\AppData\Local\Temp\89C1.tmp"44⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"45⤵
- Executes dropped EXE
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"46⤵
- Executes dropped EXE
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\8B87.tmp"C:\Users\Admin\AppData\Local\Temp\8B87.tmp"47⤵
- Executes dropped EXE
PID:684 -
C:\Users\Admin\AppData\Local\Temp\8C32.tmp"C:\Users\Admin\AppData\Local\Temp\8C32.tmp"48⤵
- Executes dropped EXE
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"49⤵
- Executes dropped EXE
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"50⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\8E17.tmp"C:\Users\Admin\AppData\Local\Temp\8E17.tmp"51⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"52⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\8F40.tmp"C:\Users\Admin\AppData\Local\Temp\8F40.tmp"53⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"54⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"55⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\90E6.tmp"C:\Users\Admin\AppData\Local\Temp\90E6.tmp"56⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\9163.tmp"C:\Users\Admin\AppData\Local\Temp\9163.tmp"57⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\91EF.tmp"C:\Users\Admin\AppData\Local\Temp\91EF.tmp"58⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\926C.tmp"C:\Users\Admin\AppData\Local\Temp\926C.tmp"59⤵
- Executes dropped EXE
PID:412 -
C:\Users\Admin\AppData\Local\Temp\92DA.tmp"C:\Users\Admin\AppData\Local\Temp\92DA.tmp"60⤵
- Executes dropped EXE
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\9337.tmp"C:\Users\Admin\AppData\Local\Temp\9337.tmp"61⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"62⤵
- Executes dropped EXE
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\9441.tmp"C:\Users\Admin\AppData\Local\Temp\9441.tmp"63⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\94DD.tmp"C:\Users\Admin\AppData\Local\Temp\94DD.tmp"64⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\9579.tmp"C:\Users\Admin\AppData\Local\Temp\9579.tmp"65⤵
- Executes dropped EXE
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\95F6.tmp"C:\Users\Admin\AppData\Local\Temp\95F6.tmp"66⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\9673.tmp"C:\Users\Admin\AppData\Local\Temp\9673.tmp"67⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\9700.tmp"C:\Users\Admin\AppData\Local\Temp\9700.tmp"68⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\976D.tmp"C:\Users\Admin\AppData\Local\Temp\976D.tmp"69⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\97DB.tmp"C:\Users\Admin\AppData\Local\Temp\97DB.tmp"70⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"71⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\98F4.tmp"C:\Users\Admin\AppData\Local\Temp\98F4.tmp"72⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"73⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"74⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"75⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"76⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"77⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"78⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"79⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"80⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"81⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"82⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"83⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"84⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"85⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"86⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\A095.tmp"C:\Users\Admin\AppData\Local\Temp\A095.tmp"87⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"88⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"89⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"90⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"91⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"92⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"93⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\A410.tmp"C:\Users\Admin\AppData\Local\Temp\A410.tmp"94⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"95⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"96⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"97⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"98⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"99⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\A73C.tmp"C:\Users\Admin\AppData\Local\Temp\A73C.tmp"100⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"101⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"102⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"103⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"104⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"105⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\AA59.tmp"C:\Users\Admin\AppData\Local\Temp\AA59.tmp"106⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"107⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\AB82.tmp"C:\Users\Admin\AppData\Local\Temp\AB82.tmp"108⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"109⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"110⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"111⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"112⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\AE70.tmp"C:\Users\Admin\AppData\Local\Temp\AE70.tmp"113⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"114⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"115⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"116⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"117⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\B14E.tmp"C:\Users\Admin\AppData\Local\Temp\B14E.tmp"118⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"119⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\B258.tmp"C:\Users\Admin\AppData\Local\Temp\B258.tmp"120⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"121⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\B391.tmp"C:\Users\Admin\AppData\Local\Temp\B391.tmp"122⤵PID:2128
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-