Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2023, 19:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ca6624b3d94ab1d1fab6978e2bfbdf5a_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
ca6624b3d94ab1d1fab6978e2bfbdf5a_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
ca6624b3d94ab1d1fab6978e2bfbdf5a_mafia_JC.exe
-
Size
520KB
-
MD5
ca6624b3d94ab1d1fab6978e2bfbdf5a
-
SHA1
3cee287b78deb39ebe0b9bbc1e886b8947a152f1
-
SHA256
efd344ddad89ecad5b7bf6e7b241379d489d89e24ce60d654c1b44368e7bdba9
-
SHA512
8b75858579ae44f69416fa95bd4cb59b8a90ab8674b95e8cd7353fdad07875c24d5b2e8326bdaa872841d2a9ad9ebed869bdc216208ad8eb4ad0341387244ed0
-
SSDEEP
12288:gj8fuxR21t5i8fH8l66sYtKWiZ6rghZUu6hKO4GyNZ:gj8fuK1GYHENUVZQghaubjhN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3748 8405.tmp 408 84A1.tmp 4252 855C.tmp 4748 8656.tmp 468 8731.tmp 388 880C.tmp 928 88B8.tmp 3888 8944.tmp 1916 89D1.tmp 4644 8A6D.tmp 3796 8B29.tmp 4928 8C52.tmp 4496 8D9A.tmp 3772 8E75.tmp 5116 8F11.tmp 916 8FAD.tmp 3272 9049.tmp 800 9124.tmp 1892 92AB.tmp 2712 93A5.tmp 3196 949F.tmp 3276 954B.tmp 3808 95C8.tmp 2396 9664.tmp 3920 96F0.tmp 3140 977D.tmp 4852 9829.tmp 3908 98F4.tmp 1944 99A0.tmp 3728 9A4C.tmp 1080 9AD8.tmp 4968 9BA4.tmp 1492 9C30.tmp 1364 9CAD.tmp 1824 9D2A.tmp 440 9DC6.tmp 2988 9E53.tmp 1640 9EFF.tmp 1644 9F7C.tmp 4472 A009.tmp 4176 A095.tmp 1236 A131.tmp 3936 A1CE.tmp 3184 A27A.tmp 4072 A306.tmp 3972 A383.tmp 4896 A400.tmp 1992 A49C.tmp 3748 A529.tmp 4312 A5C5.tmp 620 A642.tmp 4392 A6EE.tmp 3492 A75C.tmp 4256 A7E8.tmp 1688 A865.tmp 4824 A8F2.tmp 940 A97E.tmp 1308 A9FB.tmp 640 AA88.tmp 928 AB05.tmp 3148 AB92.tmp 3888 ABFF.tmp 1120 AC8C.tmp 540 ACE9.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4332 wrote to memory of 3748 4332 ca6624b3d94ab1d1fab6978e2bfbdf5a_mafia_JC.exe 81 PID 4332 wrote to memory of 3748 4332 ca6624b3d94ab1d1fab6978e2bfbdf5a_mafia_JC.exe 81 PID 4332 wrote to memory of 3748 4332 ca6624b3d94ab1d1fab6978e2bfbdf5a_mafia_JC.exe 81 PID 3748 wrote to memory of 408 3748 8405.tmp 82 PID 3748 wrote to memory of 408 3748 8405.tmp 82 PID 3748 wrote to memory of 408 3748 8405.tmp 82 PID 408 wrote to memory of 4252 408 84A1.tmp 83 PID 408 wrote to memory of 4252 408 84A1.tmp 83 PID 408 wrote to memory of 4252 408 84A1.tmp 83 PID 4252 wrote to memory of 4748 4252 855C.tmp 84 PID 4252 wrote to memory of 4748 4252 855C.tmp 84 PID 4252 wrote to memory of 4748 4252 855C.tmp 84 PID 4748 wrote to memory of 468 4748 8656.tmp 85 PID 4748 wrote to memory of 468 4748 8656.tmp 85 PID 4748 wrote to memory of 468 4748 8656.tmp 85 PID 468 wrote to memory of 388 468 8731.tmp 86 PID 468 wrote to memory of 388 468 8731.tmp 86 PID 468 wrote to memory of 388 468 8731.tmp 86 PID 388 wrote to memory of 928 388 880C.tmp 87 PID 388 wrote to memory of 928 388 880C.tmp 87 PID 388 wrote to memory of 928 388 880C.tmp 87 PID 928 wrote to memory of 3888 928 88B8.tmp 88 PID 928 wrote to memory of 3888 928 88B8.tmp 88 PID 928 wrote to memory of 3888 928 88B8.tmp 88 PID 3888 wrote to memory of 1916 3888 8944.tmp 90 PID 3888 wrote to memory of 1916 3888 8944.tmp 90 PID 3888 wrote to memory of 1916 3888 8944.tmp 90 PID 1916 wrote to memory of 4644 1916 89D1.tmp 91 PID 1916 wrote to memory of 4644 1916 89D1.tmp 91 PID 1916 wrote to memory of 4644 1916 89D1.tmp 91 PID 4644 wrote to memory of 3796 4644 8A6D.tmp 92 PID 4644 wrote to memory of 3796 4644 8A6D.tmp 92 PID 4644 wrote to memory of 3796 4644 8A6D.tmp 92 PID 3796 wrote to memory of 4928 3796 8B29.tmp 93 PID 3796 wrote to memory of 4928 3796 8B29.tmp 93 PID 3796 wrote to memory of 4928 3796 8B29.tmp 93 PID 4928 wrote to memory of 4496 4928 8C52.tmp 94 PID 4928 wrote to memory of 4496 4928 8C52.tmp 94 PID 4928 wrote to memory of 4496 4928 8C52.tmp 94 PID 4496 wrote to memory of 3772 4496 8D9A.tmp 95 PID 4496 wrote to memory of 3772 4496 8D9A.tmp 95 PID 4496 wrote to memory of 3772 4496 8D9A.tmp 95 PID 3772 wrote to memory of 5116 3772 8E75.tmp 96 PID 3772 wrote to memory of 5116 3772 8E75.tmp 96 PID 3772 wrote to memory of 5116 3772 8E75.tmp 96 PID 5116 wrote to memory of 916 5116 8F11.tmp 97 PID 5116 wrote to memory of 916 5116 8F11.tmp 97 PID 5116 wrote to memory of 916 5116 8F11.tmp 97 PID 916 wrote to memory of 3272 916 8FAD.tmp 100 PID 916 wrote to memory of 3272 916 8FAD.tmp 100 PID 916 wrote to memory of 3272 916 8FAD.tmp 100 PID 3272 wrote to memory of 800 3272 9049.tmp 101 PID 3272 wrote to memory of 800 3272 9049.tmp 101 PID 3272 wrote to memory of 800 3272 9049.tmp 101 PID 800 wrote to memory of 1892 800 9124.tmp 102 PID 800 wrote to memory of 1892 800 9124.tmp 102 PID 800 wrote to memory of 1892 800 9124.tmp 102 PID 1892 wrote to memory of 2712 1892 92AB.tmp 103 PID 1892 wrote to memory of 2712 1892 92AB.tmp 103 PID 1892 wrote to memory of 2712 1892 92AB.tmp 103 PID 2712 wrote to memory of 3196 2712 93A5.tmp 105 PID 2712 wrote to memory of 3196 2712 93A5.tmp 105 PID 2712 wrote to memory of 3196 2712 93A5.tmp 105 PID 3196 wrote to memory of 3276 3196 949F.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca6624b3d94ab1d1fab6978e2bfbdf5a_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\ca6624b3d94ab1d1fab6978e2bfbdf5a_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\8405.tmp"C:\Users\Admin\AppData\Local\Temp\8405.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\84A1.tmp"C:\Users\Admin\AppData\Local\Temp\84A1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\855C.tmp"C:\Users\Admin\AppData\Local\Temp\855C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\8731.tmp"C:\Users\Admin\AppData\Local\Temp\8731.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\880C.tmp"C:\Users\Admin\AppData\Local\Temp\880C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Users\Admin\AppData\Local\Temp\88B8.tmp"C:\Users\Admin\AppData\Local\Temp\88B8.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\89D1.tmp"C:\Users\Admin\AppData\Local\Temp\89D1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\8B29.tmp"C:\Users\Admin\AppData\Local\Temp\8B29.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\8E75.tmp"C:\Users\Admin\AppData\Local\Temp\8E75.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\9049.tmp"C:\Users\Admin\AppData\Local\Temp\9049.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\92AB.tmp"C:\Users\Admin\AppData\Local\Temp\92AB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\93A5.tmp"C:\Users\Admin\AppData\Local\Temp\93A5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\954B.tmp"C:\Users\Admin\AppData\Local\Temp\954B.tmp"23⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\95C8.tmp"C:\Users\Admin\AppData\Local\Temp\95C8.tmp"24⤵
- Executes dropped EXE
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\9664.tmp"C:\Users\Admin\AppData\Local\Temp\9664.tmp"25⤵
- Executes dropped EXE
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\96F0.tmp"C:\Users\Admin\AppData\Local\Temp\96F0.tmp"26⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\977D.tmp"C:\Users\Admin\AppData\Local\Temp\977D.tmp"27⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"28⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\98F4.tmp"C:\Users\Admin\AppData\Local\Temp\98F4.tmp"29⤵
- Executes dropped EXE
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\99A0.tmp"C:\Users\Admin\AppData\Local\Temp\99A0.tmp"30⤵
- Executes dropped EXE
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"31⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"32⤵
- Executes dropped EXE
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"33⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"34⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"35⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"36⤵
- Executes dropped EXE
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"37⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\9E53.tmp"C:\Users\Admin\AppData\Local\Temp\9E53.tmp"38⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"39⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"40⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"41⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\A095.tmp"C:\Users\Admin\AppData\Local\Temp\A095.tmp"42⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"43⤵
- Executes dropped EXE
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"44⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"45⤵
- Executes dropped EXE
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\A306.tmp"C:\Users\Admin\AppData\Local\Temp\A306.tmp"46⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\A383.tmp"C:\Users\Admin\AppData\Local\Temp\A383.tmp"47⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"48⤵
- Executes dropped EXE
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"49⤵
- Executes dropped EXE
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"50⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"51⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\A642.tmp"C:\Users\Admin\AppData\Local\Temp\A642.tmp"52⤵
- Executes dropped EXE
PID:620 -
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"53⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"54⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"55⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"56⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"57⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"58⤵
- Executes dropped EXE
PID:940 -
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"59⤵
- Executes dropped EXE
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\AA88.tmp"C:\Users\Admin\AppData\Local\Temp\AA88.tmp"60⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\AB05.tmp"C:\Users\Admin\AppData\Local\Temp\AB05.tmp"61⤵
- Executes dropped EXE
PID:928 -
C:\Users\Admin\AppData\Local\Temp\AB92.tmp"C:\Users\Admin\AppData\Local\Temp\AB92.tmp"62⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"63⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"64⤵
- Executes dropped EXE
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"65⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"66⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"67⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\AE12.tmp"C:\Users\Admin\AppData\Local\Temp\AE12.tmp"68⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"69⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"70⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"71⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\B006.tmp"C:\Users\Admin\AppData\Local\Temp\B006.tmp"72⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\B074.tmp"C:\Users\Admin\AppData\Local\Temp\B074.tmp"73⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"74⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\B15E.tmp"C:\Users\Admin\AppData\Local\Temp\B15E.tmp"75⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\B20A.tmp"C:\Users\Admin\AppData\Local\Temp\B20A.tmp"76⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"77⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\B391.tmp"C:\Users\Admin\AppData\Local\Temp\B391.tmp"78⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\B40E.tmp"C:\Users\Admin\AppData\Local\Temp\B40E.tmp"79⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\B49A.tmp"C:\Users\Admin\AppData\Local\Temp\B49A.tmp"80⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\B536.tmp"C:\Users\Admin\AppData\Local\Temp\B536.tmp"81⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"82⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\B611.tmp"C:\Users\Admin\AppData\Local\Temp\B611.tmp"83⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\B69E.tmp"C:\Users\Admin\AppData\Local\Temp\B69E.tmp"84⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\B73A.tmp"C:\Users\Admin\AppData\Local\Temp\B73A.tmp"85⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"86⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\B863.tmp"C:\Users\Admin\AppData\Local\Temp\B863.tmp"87⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"88⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\B93E.tmp"C:\Users\Admin\AppData\Local\Temp\B93E.tmp"89⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"90⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\BA28.tmp"C:\Users\Admin\AppData\Local\Temp\BA28.tmp"91⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"92⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\BB32.tmp"C:\Users\Admin\AppData\Local\Temp\BB32.tmp"93⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"94⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"95⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"96⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\BD55.tmp"C:\Users\Admin\AppData\Local\Temp\BD55.tmp"97⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"98⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"99⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"100⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\BF77.tmp"C:\Users\Admin\AppData\Local\Temp\BF77.tmp"101⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\C004.tmp"C:\Users\Admin\AppData\Local\Temp\C004.tmp"102⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"103⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"104⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"105⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"106⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"107⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\C331.tmp"C:\Users\Admin\AppData\Local\Temp\C331.tmp"108⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\C39E.tmp"C:\Users\Admin\AppData\Local\Temp\C39E.tmp"109⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\C40B.tmp"C:\Users\Admin\AppData\Local\Temp\C40B.tmp"110⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"111⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\C553.tmp"C:\Users\Admin\AppData\Local\Temp\C553.tmp"112⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"113⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\C65D.tmp"C:\Users\Admin\AppData\Local\Temp\C65D.tmp"114⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"115⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\C776.tmp"C:\Users\Admin\AppData\Local\Temp\C776.tmp"116⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"117⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\C880.tmp"C:\Users\Admin\AppData\Local\Temp\C880.tmp"118⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\C91C.tmp"C:\Users\Admin\AppData\Local\Temp\C91C.tmp"119⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"120⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\CA55.tmp"C:\Users\Admin\AppData\Local\Temp\CA55.tmp"121⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\CAD2.tmp"C:\Users\Admin\AppData\Local\Temp\CAD2.tmp"122⤵PID:1412
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-