Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
27/08/2023, 14:14
Static task
static1
Behavioral task
behavioral1
Sample
a9bc96abc3ef0f7c54b91c8debca4423_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
a9bc96abc3ef0f7c54b91c8debca4423_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
a9bc96abc3ef0f7c54b91c8debca4423_mafia_JC.exe
-
Size
520KB
-
MD5
a9bc96abc3ef0f7c54b91c8debca4423
-
SHA1
1f0b9ae4a3bf62080741c43c943f10cbbb4a52e8
-
SHA256
217adcf40343cafd3f3a2b9e810e9370ed8ecedcd285d538cc3c8af7e267cc6e
-
SHA512
6c8397185513aa2c6eb7f8cf6ee673b1682826c20ee9e735386673f8cbef65dbac931c4c6f77a5a9efd8c7ff8f99b51160eab3496200342b613545a8f161e543
-
SSDEEP
6144:lLvd/XzCjUIF1UuXLyQjmOH+JjLHFIe32DgIinAtm1hP8panrlaqgkZHb1eEtsHT:roRXOQjmOyXy6qTtmjLAcbIEiNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3540 6C37.tmp 960 6D21.tmp 3792 6DEC.tmp 4428 6EF6.tmp 1256 6FB2.tmp 3836 702F.tmp 536 7129.tmp 4492 71D4.tmp 3400 7251.tmp 2760 72EE.tmp 3972 738A.tmp 5048 7455.tmp 4432 754F.tmp 3052 7649.tmp 4204 76E5.tmp 1984 7782.tmp 2288 787C.tmp 3564 7927.tmp 3696 79C4.tmp 3616 7ACD.tmp 4000 7B89.tmp 1208 7C44.tmp 1372 7D0F.tmp 2024 7DEA.tmp 2924 7E86.tmp 1572 7F42.tmp 8 7FDE.tmp 1512 807A.tmp 640 8155.tmp 4628 81F1.tmp 2336 832A.tmp 2868 8405.tmp 4500 84B1.tmp 4600 853D.tmp 4036 85D9.tmp 464 8695.tmp 3340 8731.tmp 748 87BE.tmp 2204 886A.tmp 4784 8916.tmp 4740 89A2.tmp 1788 8A1F.tmp 3456 8ACB.tmp 228 8B58.tmp 3864 8C04.tmp 1980 8C90.tmp 3240 8D1D.tmp 1996 8DA9.tmp 4964 8E36.tmp 3888 8ED2.tmp 1240 8F4F.tmp 4196 8FDC.tmp 4504 9069.tmp 2276 90F5.tmp 4120 9163.tmp 2396 91FF.tmp 4720 92AB.tmp 1000 9337.tmp 1532 93B4.tmp 4216 9460.tmp 2284 94DD.tmp 4616 955A.tmp 4648 95D7.tmp 4032 9645.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1240 wrote to memory of 3540 1240 a9bc96abc3ef0f7c54b91c8debca4423_mafia_JC.exe 83 PID 1240 wrote to memory of 3540 1240 a9bc96abc3ef0f7c54b91c8debca4423_mafia_JC.exe 83 PID 1240 wrote to memory of 3540 1240 a9bc96abc3ef0f7c54b91c8debca4423_mafia_JC.exe 83 PID 3540 wrote to memory of 960 3540 6C37.tmp 84 PID 3540 wrote to memory of 960 3540 6C37.tmp 84 PID 3540 wrote to memory of 960 3540 6C37.tmp 84 PID 960 wrote to memory of 3792 960 6D21.tmp 85 PID 960 wrote to memory of 3792 960 6D21.tmp 85 PID 960 wrote to memory of 3792 960 6D21.tmp 85 PID 3792 wrote to memory of 4428 3792 6DEC.tmp 86 PID 3792 wrote to memory of 4428 3792 6DEC.tmp 86 PID 3792 wrote to memory of 4428 3792 6DEC.tmp 86 PID 4428 wrote to memory of 1256 4428 6EF6.tmp 87 PID 4428 wrote to memory of 1256 4428 6EF6.tmp 87 PID 4428 wrote to memory of 1256 4428 6EF6.tmp 87 PID 1256 wrote to memory of 3836 1256 6FB2.tmp 88 PID 1256 wrote to memory of 3836 1256 6FB2.tmp 88 PID 1256 wrote to memory of 3836 1256 6FB2.tmp 88 PID 3836 wrote to memory of 536 3836 702F.tmp 89 PID 3836 wrote to memory of 536 3836 702F.tmp 89 PID 3836 wrote to memory of 536 3836 702F.tmp 89 PID 536 wrote to memory of 4492 536 7129.tmp 91 PID 536 wrote to memory of 4492 536 7129.tmp 91 PID 536 wrote to memory of 4492 536 7129.tmp 91 PID 4492 wrote to memory of 3400 4492 71D4.tmp 92 PID 4492 wrote to memory of 3400 4492 71D4.tmp 92 PID 4492 wrote to memory of 3400 4492 71D4.tmp 92 PID 3400 wrote to memory of 2760 3400 7251.tmp 93 PID 3400 wrote to memory of 2760 3400 7251.tmp 93 PID 3400 wrote to memory of 2760 3400 7251.tmp 93 PID 2760 wrote to memory of 3972 2760 72EE.tmp 94 PID 2760 wrote to memory of 3972 2760 72EE.tmp 94 PID 2760 wrote to memory of 3972 2760 72EE.tmp 94 PID 3972 wrote to memory of 5048 3972 738A.tmp 95 PID 3972 wrote to memory of 5048 3972 738A.tmp 95 PID 3972 wrote to memory of 5048 3972 738A.tmp 95 PID 5048 wrote to memory of 4432 5048 7455.tmp 96 PID 5048 wrote to memory of 4432 5048 7455.tmp 96 PID 5048 wrote to memory of 4432 5048 7455.tmp 96 PID 4432 wrote to memory of 3052 4432 754F.tmp 97 PID 4432 wrote to memory of 3052 4432 754F.tmp 97 PID 4432 wrote to memory of 3052 4432 754F.tmp 97 PID 3052 wrote to memory of 4204 3052 7649.tmp 98 PID 3052 wrote to memory of 4204 3052 7649.tmp 98 PID 3052 wrote to memory of 4204 3052 7649.tmp 98 PID 4204 wrote to memory of 1984 4204 76E5.tmp 99 PID 4204 wrote to memory of 1984 4204 76E5.tmp 99 PID 4204 wrote to memory of 1984 4204 76E5.tmp 99 PID 1984 wrote to memory of 2288 1984 7782.tmp 100 PID 1984 wrote to memory of 2288 1984 7782.tmp 100 PID 1984 wrote to memory of 2288 1984 7782.tmp 100 PID 2288 wrote to memory of 3564 2288 787C.tmp 101 PID 2288 wrote to memory of 3564 2288 787C.tmp 101 PID 2288 wrote to memory of 3564 2288 787C.tmp 101 PID 3564 wrote to memory of 3696 3564 7927.tmp 102 PID 3564 wrote to memory of 3696 3564 7927.tmp 102 PID 3564 wrote to memory of 3696 3564 7927.tmp 102 PID 3696 wrote to memory of 3616 3696 79C4.tmp 105 PID 3696 wrote to memory of 3616 3696 79C4.tmp 105 PID 3696 wrote to memory of 3616 3696 79C4.tmp 105 PID 3616 wrote to memory of 4000 3616 7ACD.tmp 106 PID 3616 wrote to memory of 4000 3616 7ACD.tmp 106 PID 3616 wrote to memory of 4000 3616 7ACD.tmp 106 PID 4000 wrote to memory of 1208 4000 7B89.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9bc96abc3ef0f7c54b91c8debca4423_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\a9bc96abc3ef0f7c54b91c8debca4423_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\72EE.tmp"C:\Users\Admin\AppData\Local\Temp\72EE.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\754F.tmp"C:\Users\Admin\AppData\Local\Temp\754F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\7927.tmp"C:\Users\Admin\AppData\Local\Temp\7927.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\79C4.tmp"C:\Users\Admin\AppData\Local\Temp\79C4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\7B89.tmp"C:\Users\Admin\AppData\Local\Temp\7B89.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\7C44.tmp"C:\Users\Admin\AppData\Local\Temp\7C44.tmp"23⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"24⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"25⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"26⤵
- Executes dropped EXE
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\7F42.tmp"C:\Users\Admin\AppData\Local\Temp\7F42.tmp"27⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"28⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\807A.tmp"C:\Users\Admin\AppData\Local\Temp\807A.tmp"29⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\8155.tmp"C:\Users\Admin\AppData\Local\Temp\8155.tmp"30⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\81F1.tmp"C:\Users\Admin\AppData\Local\Temp\81F1.tmp"31⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"32⤵
- Executes dropped EXE
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\8405.tmp"C:\Users\Admin\AppData\Local\Temp\8405.tmp"33⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\84B1.tmp"C:\Users\Admin\AppData\Local\Temp\84B1.tmp"34⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\853D.tmp"C:\Users\Admin\AppData\Local\Temp\853D.tmp"35⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\85D9.tmp"C:\Users\Admin\AppData\Local\Temp\85D9.tmp"36⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\8695.tmp"C:\Users\Admin\AppData\Local\Temp\8695.tmp"37⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\8731.tmp"C:\Users\Admin\AppData\Local\Temp\8731.tmp"38⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\87BE.tmp"C:\Users\Admin\AppData\Local\Temp\87BE.tmp"39⤵
- Executes dropped EXE
PID:748 -
C:\Users\Admin\AppData\Local\Temp\886A.tmp"C:\Users\Admin\AppData\Local\Temp\886A.tmp"40⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\8916.tmp"C:\Users\Admin\AppData\Local\Temp\8916.tmp"41⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\89A2.tmp"C:\Users\Admin\AppData\Local\Temp\89A2.tmp"42⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"43⤵
- Executes dropped EXE
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"44⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\8B58.tmp"C:\Users\Admin\AppData\Local\Temp\8B58.tmp"45⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\8C04.tmp"C:\Users\Admin\AppData\Local\Temp\8C04.tmp"46⤵
- Executes dropped EXE
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"47⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"48⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"49⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp"50⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"51⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"52⤵
- Executes dropped EXE
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"53⤵
- Executes dropped EXE
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"54⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"55⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\9163.tmp"C:\Users\Admin\AppData\Local\Temp\9163.tmp"56⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"57⤵
- Executes dropped EXE
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\92AB.tmp"C:\Users\Admin\AppData\Local\Temp\92AB.tmp"58⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\9337.tmp"C:\Users\Admin\AppData\Local\Temp\9337.tmp"59⤵
- Executes dropped EXE
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\93B4.tmp"C:\Users\Admin\AppData\Local\Temp\93B4.tmp"60⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\9460.tmp"C:\Users\Admin\AppData\Local\Temp\9460.tmp"61⤵
- Executes dropped EXE
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\94DD.tmp"C:\Users\Admin\AppData\Local\Temp\94DD.tmp"62⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"63⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\95D7.tmp"C:\Users\Admin\AppData\Local\Temp\95D7.tmp"64⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"65⤵
- Executes dropped EXE
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\96C2.tmp"C:\Users\Admin\AppData\Local\Temp\96C2.tmp"66⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\972F.tmp"C:\Users\Admin\AppData\Local\Temp\972F.tmp"67⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"68⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\9819.tmp"C:\Users\Admin\AppData\Local\Temp\9819.tmp"69⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\98B6.tmp"C:\Users\Admin\AppData\Local\Temp\98B6.tmp"70⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\9952.tmp"C:\Users\Admin\AppData\Local\Temp\9952.tmp"71⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"72⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"73⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"74⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"75⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"76⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"77⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"78⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"79⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"80⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\9E53.tmp"C:\Users\Admin\AppData\Local\Temp\9E53.tmp"81⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"82⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"83⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"84⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\A047.tmp"C:\Users\Admin\AppData\Local\Temp\A047.tmp"85⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"86⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"87⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"88⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\A24B.tmp"C:\Users\Admin\AppData\Local\Temp\A24B.tmp"89⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"90⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"91⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"92⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\A41F.tmp"C:\Users\Admin\AppData\Local\Temp\A41F.tmp"93⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"94⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"95⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"96⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\A662.tmp"C:\Users\Admin\AppData\Local\Temp\A662.tmp"97⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"98⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"99⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"100⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\A894.tmp"C:\Users\Admin\AppData\Local\Temp\A894.tmp"101⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\A921.tmp"C:\Users\Admin\AppData\Local\Temp\A921.tmp"102⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"103⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"104⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"105⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\AB92.tmp"C:\Users\Admin\AppData\Local\Temp\AB92.tmp"106⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"107⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"108⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\AD57.tmp"C:\Users\Admin\AppData\Local\Temp\AD57.tmp"109⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"110⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\AE70.tmp"C:\Users\Admin\AppData\Local\Temp\AE70.tmp"111⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"112⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\AF99.tmp"C:\Users\Admin\AppData\Local\Temp\AF99.tmp"113⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\B035.tmp"C:\Users\Admin\AppData\Local\Temp\B035.tmp"114⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"115⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"116⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"117⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"118⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"119⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\B381.tmp"C:\Users\Admin\AppData\Local\Temp\B381.tmp"120⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\B42D.tmp"C:\Users\Admin\AppData\Local\Temp\B42D.tmp"121⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"122⤵PID:4520
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-