Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
24/08/2023, 17:13
Static task
static1
Behavioral task
behavioral1
Sample
856d8b23d0d012782deac4e194c71a51_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
856d8b23d0d012782deac4e194c71a51_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
856d8b23d0d012782deac4e194c71a51_mafia_JC.exe
-
Size
520KB
-
MD5
856d8b23d0d012782deac4e194c71a51
-
SHA1
e2746c204e30e0b26cf3568380f3a909728378a5
-
SHA256
5b32166a5297a53e3c2abdde3b162fd6ff0358d784d19fbfe81c6ebb0b9f58af
-
SHA512
64a4db676d6da1b9732c4f022323b02cfe0f7fb618fbb8853335efb7b65fc9bf6bcd2dc7ec2f6da6f594bf10b5844a591d18743fa27ed384a51f66dd54d6a7e3
-
SSDEEP
6144:Aj/hrXj2PAEh5ACnPu07aWiHr94WgOx859tKx0BmXdVt9JOTTpNRh5fQzdTJ94Ba:YcRnG07aWiJ4We9tBEtD2TTxQ5FCGNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2072 69D6.tmp 1428 6A91.tmp 1088 6B2D.tmp 5104 6BF8.tmp 1668 6CB4.tmp 3384 6DAE.tmp 4828 6E98.tmp 976 6F15.tmp 4360 6F92.tmp 796 705D.tmp 2172 7119.tmp 740 733C.tmp 4528 73D8.tmp 3676 74A3.tmp 4660 758E.tmp 1728 7639.tmp 4616 7782.tmp 1740 780E.tmp 1972 78BA.tmp 2696 7947.tmp 3892 79E3.tmp 4376 7A70.tmp 4248 7B1B.tmp 1636 7B89.tmp 5108 7C35.tmp 4296 7D00.tmp 1756 7DEA.tmp 3480 7E86.tmp 4784 7F52.tmp 3680 7FFD.tmp 3520 80D8.tmp 3664 81D2.tmp 2104 828E.tmp 3640 82FB.tmp 5068 8397.tmp 3604 8414.tmp 764 84B1.tmp 964 853D.tmp 4552 85D9.tmp 4228 8666.tmp 4652 86F3.tmp 2936 877F.tmp 1900 885A.tmp 4332 88F6.tmp 2468 8993.tmp 3208 8A2F.tmp 3544 8ABB.tmp 4344 8B58.tmp 528 8BD5.tmp 4536 8C71.tmp 2564 8CFE.tmp 4924 8D9A.tmp 4492 8E07.tmp 4944 8EA3.tmp 3624 8F30.tmp 3708 8FBD.tmp 440 903A.tmp 5104 90B7.tmp 3384 9143.tmp 1464 91B1.tmp 4360 920E.tmp 796 928B.tmp 212 92E9.tmp 740 9347.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5052 wrote to memory of 2072 5052 856d8b23d0d012782deac4e194c71a51_mafia_JC.exe 83 PID 5052 wrote to memory of 2072 5052 856d8b23d0d012782deac4e194c71a51_mafia_JC.exe 83 PID 5052 wrote to memory of 2072 5052 856d8b23d0d012782deac4e194c71a51_mafia_JC.exe 83 PID 2072 wrote to memory of 1428 2072 69D6.tmp 84 PID 2072 wrote to memory of 1428 2072 69D6.tmp 84 PID 2072 wrote to memory of 1428 2072 69D6.tmp 84 PID 1428 wrote to memory of 1088 1428 6A91.tmp 85 PID 1428 wrote to memory of 1088 1428 6A91.tmp 85 PID 1428 wrote to memory of 1088 1428 6A91.tmp 85 PID 1088 wrote to memory of 5104 1088 6B2D.tmp 86 PID 1088 wrote to memory of 5104 1088 6B2D.tmp 86 PID 1088 wrote to memory of 5104 1088 6B2D.tmp 86 PID 5104 wrote to memory of 1668 5104 6BF8.tmp 87 PID 5104 wrote to memory of 1668 5104 6BF8.tmp 87 PID 5104 wrote to memory of 1668 5104 6BF8.tmp 87 PID 1668 wrote to memory of 3384 1668 6CB4.tmp 88 PID 1668 wrote to memory of 3384 1668 6CB4.tmp 88 PID 1668 wrote to memory of 3384 1668 6CB4.tmp 88 PID 3384 wrote to memory of 4828 3384 6DAE.tmp 89 PID 3384 wrote to memory of 4828 3384 6DAE.tmp 89 PID 3384 wrote to memory of 4828 3384 6DAE.tmp 89 PID 4828 wrote to memory of 976 4828 6E98.tmp 90 PID 4828 wrote to memory of 976 4828 6E98.tmp 90 PID 4828 wrote to memory of 976 4828 6E98.tmp 90 PID 976 wrote to memory of 4360 976 6F15.tmp 91 PID 976 wrote to memory of 4360 976 6F15.tmp 91 PID 976 wrote to memory of 4360 976 6F15.tmp 91 PID 4360 wrote to memory of 796 4360 6F92.tmp 92 PID 4360 wrote to memory of 796 4360 6F92.tmp 92 PID 4360 wrote to memory of 796 4360 6F92.tmp 92 PID 796 wrote to memory of 2172 796 705D.tmp 93 PID 796 wrote to memory of 2172 796 705D.tmp 93 PID 796 wrote to memory of 2172 796 705D.tmp 93 PID 2172 wrote to memory of 740 2172 7119.tmp 94 PID 2172 wrote to memory of 740 2172 7119.tmp 94 PID 2172 wrote to memory of 740 2172 7119.tmp 94 PID 740 wrote to memory of 4528 740 733C.tmp 95 PID 740 wrote to memory of 4528 740 733C.tmp 95 PID 740 wrote to memory of 4528 740 733C.tmp 95 PID 4528 wrote to memory of 3676 4528 73D8.tmp 98 PID 4528 wrote to memory of 3676 4528 73D8.tmp 98 PID 4528 wrote to memory of 3676 4528 73D8.tmp 98 PID 3676 wrote to memory of 4660 3676 74A3.tmp 99 PID 3676 wrote to memory of 4660 3676 74A3.tmp 99 PID 3676 wrote to memory of 4660 3676 74A3.tmp 99 PID 4660 wrote to memory of 1728 4660 758E.tmp 100 PID 4660 wrote to memory of 1728 4660 758E.tmp 100 PID 4660 wrote to memory of 1728 4660 758E.tmp 100 PID 1728 wrote to memory of 4616 1728 7639.tmp 101 PID 1728 wrote to memory of 4616 1728 7639.tmp 101 PID 1728 wrote to memory of 4616 1728 7639.tmp 101 PID 4616 wrote to memory of 1740 4616 7782.tmp 102 PID 4616 wrote to memory of 1740 4616 7782.tmp 102 PID 4616 wrote to memory of 1740 4616 7782.tmp 102 PID 1740 wrote to memory of 1972 1740 780E.tmp 103 PID 1740 wrote to memory of 1972 1740 780E.tmp 103 PID 1740 wrote to memory of 1972 1740 780E.tmp 103 PID 1972 wrote to memory of 2696 1972 78BA.tmp 105 PID 1972 wrote to memory of 2696 1972 78BA.tmp 105 PID 1972 wrote to memory of 2696 1972 78BA.tmp 105 PID 2696 wrote to memory of 3892 2696 7947.tmp 106 PID 2696 wrote to memory of 3892 2696 7947.tmp 106 PID 2696 wrote to memory of 3892 2696 7947.tmp 106 PID 3892 wrote to memory of 4376 3892 79E3.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\856d8b23d0d012782deac4e194c71a51_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\856d8b23d0d012782deac4e194c71a51_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\780E.tmp"C:\Users\Admin\AppData\Local\Temp\780E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\78BA.tmp"C:\Users\Admin\AppData\Local\Temp\78BA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\7A70.tmp"C:\Users\Admin\AppData\Local\Temp\7A70.tmp"23⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"24⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\7B89.tmp"C:\Users\Admin\AppData\Local\Temp\7B89.tmp"25⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\7C35.tmp"C:\Users\Admin\AppData\Local\Temp\7C35.tmp"26⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\7D00.tmp"C:\Users\Admin\AppData\Local\Temp\7D00.tmp"27⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"28⤵
- Executes dropped EXE
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"29⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\7F52.tmp"C:\Users\Admin\AppData\Local\Temp\7F52.tmp"30⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"31⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\80D8.tmp"C:\Users\Admin\AppData\Local\Temp\80D8.tmp"32⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\81D2.tmp"C:\Users\Admin\AppData\Local\Temp\81D2.tmp"33⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\828E.tmp"C:\Users\Admin\AppData\Local\Temp\828E.tmp"34⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\82FB.tmp"C:\Users\Admin\AppData\Local\Temp\82FB.tmp"35⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"36⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\8414.tmp"C:\Users\Admin\AppData\Local\Temp\8414.tmp"37⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\84B1.tmp"C:\Users\Admin\AppData\Local\Temp\84B1.tmp"38⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\853D.tmp"C:\Users\Admin\AppData\Local\Temp\853D.tmp"39⤵
- Executes dropped EXE
PID:964 -
C:\Users\Admin\AppData\Local\Temp\85D9.tmp"C:\Users\Admin\AppData\Local\Temp\85D9.tmp"40⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\8666.tmp"C:\Users\Admin\AppData\Local\Temp\8666.tmp"41⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\86F3.tmp"C:\Users\Admin\AppData\Local\Temp\86F3.tmp"42⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\877F.tmp"C:\Users\Admin\AppData\Local\Temp\877F.tmp"43⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\885A.tmp"C:\Users\Admin\AppData\Local\Temp\885A.tmp"44⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\88F6.tmp"C:\Users\Admin\AppData\Local\Temp\88F6.tmp"45⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\8993.tmp"C:\Users\Admin\AppData\Local\Temp\8993.tmp"46⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"47⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"48⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\8B58.tmp"C:\Users\Admin\AppData\Local\Temp\8B58.tmp"49⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"50⤵
- Executes dropped EXE
PID:528 -
C:\Users\Admin\AppData\Local\Temp\8C71.tmp"C:\Users\Admin\AppData\Local\Temp\8C71.tmp"51⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"52⤵
- Executes dropped EXE
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"53⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\8E07.tmp"C:\Users\Admin\AppData\Local\Temp\8E07.tmp"54⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"55⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\8F30.tmp"C:\Users\Admin\AppData\Local\Temp\8F30.tmp"56⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"57⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\903A.tmp"C:\Users\Admin\AppData\Local\Temp\903A.tmp"58⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\90B7.tmp"C:\Users\Admin\AppData\Local\Temp\90B7.tmp"59⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\9143.tmp"C:\Users\Admin\AppData\Local\Temp\9143.tmp"60⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\91B1.tmp"C:\Users\Admin\AppData\Local\Temp\91B1.tmp"61⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"62⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"63⤵
- Executes dropped EXE
PID:796 -
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"64⤵
- Executes dropped EXE
PID:212 -
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"65⤵
- Executes dropped EXE
PID:740 -
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"66⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\947F.tmp"C:\Users\Admin\AppData\Local\Temp\947F.tmp"67⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\94ED.tmp"C:\Users\Admin\AppData\Local\Temp\94ED.tmp"68⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"69⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\95B8.tmp"C:\Users\Admin\AppData\Local\Temp\95B8.tmp"70⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"71⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"72⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\9700.tmp"C:\Users\Admin\AppData\Local\Temp\9700.tmp"73⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\977D.tmp"C:\Users\Admin\AppData\Local\Temp\977D.tmp"74⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\9819.tmp"C:\Users\Admin\AppData\Local\Temp\9819.tmp"75⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"76⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"77⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\99BF.tmp"C:\Users\Admin\AppData\Local\Temp\99BF.tmp"78⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"79⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"80⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"81⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"82⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\9C21.tmp"C:\Users\Admin\AppData\Local\Temp\9C21.tmp"83⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"84⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\9D78.tmp"C:\Users\Admin\AppData\Local\Temp\9D78.tmp"85⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"86⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"87⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"88⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"89⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"90⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"91⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\A076.tmp"C:\Users\Admin\AppData\Local\Temp\A076.tmp"92⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\A103.tmp"C:\Users\Admin\AppData\Local\Temp\A103.tmp"93⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\A19F.tmp"C:\Users\Admin\AppData\Local\Temp\A19F.tmp"94⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\A21C.tmp"C:\Users\Admin\AppData\Local\Temp\A21C.tmp"95⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\A299.tmp"C:\Users\Admin\AppData\Local\Temp\A299.tmp"96⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"97⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"98⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"99⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\A50A.tmp"C:\Users\Admin\AppData\Local\Temp\A50A.tmp"100⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"101⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\A613.tmp"C:\Users\Admin\AppData\Local\Temp\A613.tmp"102⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"103⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"104⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"105⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"106⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"107⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\A96F.tmp"C:\Users\Admin\AppData\Local\Temp\A96F.tmp"108⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"109⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\AA69.tmp"C:\Users\Admin\AppData\Local\Temp\AA69.tmp"110⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"111⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\AB72.tmp"C:\Users\Admin\AppData\Local\Temp\AB72.tmp"112⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"113⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"114⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\AD38.tmp"C:\Users\Admin\AppData\Local\Temp\AD38.tmp"115⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"116⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"117⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"118⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"119⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"120⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\B035.tmp"C:\Users\Admin\AppData\Local\Temp\B035.tmp"121⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"122⤵PID:3908
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-