Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
30/08/2023, 17:53
Static task
static1
Behavioral task
behavioral1
Sample
e7c94b051e74badffd5e984b54cf4d21_mafia_JC.exe
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
e7c94b051e74badffd5e984b54cf4d21_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
e7c94b051e74badffd5e984b54cf4d21_mafia_JC.exe
-
Size
527KB
-
MD5
e7c94b051e74badffd5e984b54cf4d21
-
SHA1
329f21f925434d8ac7257cfc83af35a03c2627aa
-
SHA256
e0124d2de6cb75e1c2f9d1f9f59e77780872fd0e2e5e58880d3d5eec9bea6e2b
-
SHA512
fba10c81349080fb5eb119faa9cee37f82b7f58ba56c103f24d7737332a5b2b8e112cf642777be58e38e57f4c3e67d5a68736c6c11c4157af444bb82f4283c73
-
SSDEEP
6144:yorf3lPvovsgZnqG2C7mOTeiLRDYMS0WBqZdB7mXZKLDZI7PE20Ha6z3InxgxsHU:fU5rCOTeid+CZdVmEXZiPB06W3IJDZu
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2556 7CF0.tmp 1380 7D8C.tmp 2296 7E38.tmp 1164 7F03.tmp 1920 7FDE.tmp 1892 808A.tmp 3256 8126.tmp 4280 8211.tmp 392 82CC.tmp 3408 8397.tmp 624 8443.tmp 4140 84D0.tmp 436 856C.tmp 2808 8656.tmp 3780 878F.tmp 3328 884A.tmp 5112 88D7.tmp 1100 8983.tmp 848 8A2F.tmp 4880 8ACB.tmp 2824 8B58.tmp 2740 8C23.tmp 1372 8D1D.tmp 1004 8E75.tmp 516 8F20.tmp 724 8FAD.tmp 1292 9049.tmp 4764 9105.tmp 4048 91B1.tmp 1208 925D.tmp 216 9318.tmp 1436 93E3.tmp 3160 9441.tmp 4908 94ED.tmp 2476 956A.tmp 3336 95D7.tmp 1528 9654.tmp 4536 96E1.tmp 2892 975E.tmp 1008 97EA.tmp 4448 9887.tmp 4920 9913.tmp 3300 9981.tmp 5040 9A2D.tmp 4100 9AAA.tmp 928 9B27.tmp 4548 9BA4.tmp 1032 9C40.tmp 336 9CDC.tmp 4876 9D78.tmp 4840 9DE6.tmp 2404 9E82.tmp 3804 9F0F.tmp 3792 9FAB.tmp 1920 A037.tmp 2832 A0D4.tmp 3640 A131.tmp 2528 A1BE.tmp 2164 A24B.tmp 3704 A2D7.tmp 4188 A354.tmp 4444 A3D1.tmp 4208 A46E.tmp 4700 A4FA.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2276 wrote to memory of 2556 2276 e7c94b051e74badffd5e984b54cf4d21_mafia_JC.exe 81 PID 2276 wrote to memory of 2556 2276 e7c94b051e74badffd5e984b54cf4d21_mafia_JC.exe 81 PID 2276 wrote to memory of 2556 2276 e7c94b051e74badffd5e984b54cf4d21_mafia_JC.exe 81 PID 2556 wrote to memory of 1380 2556 7CF0.tmp 82 PID 2556 wrote to memory of 1380 2556 7CF0.tmp 82 PID 2556 wrote to memory of 1380 2556 7CF0.tmp 82 PID 1380 wrote to memory of 2296 1380 7D8C.tmp 83 PID 1380 wrote to memory of 2296 1380 7D8C.tmp 83 PID 1380 wrote to memory of 2296 1380 7D8C.tmp 83 PID 2296 wrote to memory of 1164 2296 7E38.tmp 84 PID 2296 wrote to memory of 1164 2296 7E38.tmp 84 PID 2296 wrote to memory of 1164 2296 7E38.tmp 84 PID 1164 wrote to memory of 1920 1164 7F03.tmp 85 PID 1164 wrote to memory of 1920 1164 7F03.tmp 85 PID 1164 wrote to memory of 1920 1164 7F03.tmp 85 PID 1920 wrote to memory of 1892 1920 7FDE.tmp 86 PID 1920 wrote to memory of 1892 1920 7FDE.tmp 86 PID 1920 wrote to memory of 1892 1920 7FDE.tmp 86 PID 1892 wrote to memory of 3256 1892 808A.tmp 87 PID 1892 wrote to memory of 3256 1892 808A.tmp 87 PID 1892 wrote to memory of 3256 1892 808A.tmp 87 PID 3256 wrote to memory of 4280 3256 8126.tmp 88 PID 3256 wrote to memory of 4280 3256 8126.tmp 88 PID 3256 wrote to memory of 4280 3256 8126.tmp 88 PID 4280 wrote to memory of 392 4280 8211.tmp 89 PID 4280 wrote to memory of 392 4280 8211.tmp 89 PID 4280 wrote to memory of 392 4280 8211.tmp 89 PID 392 wrote to memory of 3408 392 82CC.tmp 91 PID 392 wrote to memory of 3408 392 82CC.tmp 91 PID 392 wrote to memory of 3408 392 82CC.tmp 91 PID 3408 wrote to memory of 624 3408 8397.tmp 92 PID 3408 wrote to memory of 624 3408 8397.tmp 92 PID 3408 wrote to memory of 624 3408 8397.tmp 92 PID 624 wrote to memory of 4140 624 8443.tmp 93 PID 624 wrote to memory of 4140 624 8443.tmp 93 PID 624 wrote to memory of 4140 624 8443.tmp 93 PID 4140 wrote to memory of 436 4140 84D0.tmp 94 PID 4140 wrote to memory of 436 4140 84D0.tmp 94 PID 4140 wrote to memory of 436 4140 84D0.tmp 94 PID 436 wrote to memory of 2808 436 856C.tmp 95 PID 436 wrote to memory of 2808 436 856C.tmp 95 PID 436 wrote to memory of 2808 436 856C.tmp 95 PID 2808 wrote to memory of 3780 2808 8656.tmp 96 PID 2808 wrote to memory of 3780 2808 8656.tmp 96 PID 2808 wrote to memory of 3780 2808 8656.tmp 96 PID 3780 wrote to memory of 3328 3780 878F.tmp 97 PID 3780 wrote to memory of 3328 3780 878F.tmp 97 PID 3780 wrote to memory of 3328 3780 878F.tmp 97 PID 3328 wrote to memory of 5112 3328 884A.tmp 98 PID 3328 wrote to memory of 5112 3328 884A.tmp 98 PID 3328 wrote to memory of 5112 3328 884A.tmp 98 PID 5112 wrote to memory of 1100 5112 88D7.tmp 99 PID 5112 wrote to memory of 1100 5112 88D7.tmp 99 PID 5112 wrote to memory of 1100 5112 88D7.tmp 99 PID 1100 wrote to memory of 848 1100 8983.tmp 100 PID 1100 wrote to memory of 848 1100 8983.tmp 100 PID 1100 wrote to memory of 848 1100 8983.tmp 100 PID 848 wrote to memory of 4880 848 8A2F.tmp 103 PID 848 wrote to memory of 4880 848 8A2F.tmp 103 PID 848 wrote to memory of 4880 848 8A2F.tmp 103 PID 4880 wrote to memory of 2824 4880 8ACB.tmp 104 PID 4880 wrote to memory of 2824 4880 8ACB.tmp 104 PID 4880 wrote to memory of 2824 4880 8ACB.tmp 104 PID 2824 wrote to memory of 2740 2824 8B58.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7c94b051e74badffd5e984b54cf4d21_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\e7c94b051e74badffd5e984b54cf4d21_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\7E38.tmp"C:\Users\Admin\AppData\Local\Temp\7E38.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\7F03.tmp"C:\Users\Admin\AppData\Local\Temp\7F03.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\808A.tmp"C:\Users\Admin\AppData\Local\Temp\808A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\8126.tmp"C:\Users\Admin\AppData\Local\Temp\8126.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\84D0.tmp"C:\Users\Admin\AppData\Local\Temp\84D0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\856C.tmp"C:\Users\Admin\AppData\Local\Temp\856C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\878F.tmp"C:\Users\Admin\AppData\Local\Temp\878F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\8983.tmp"C:\Users\Admin\AppData\Local\Temp\8983.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\8B58.tmp"C:\Users\Admin\AppData\Local\Temp\8B58.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\8C23.tmp"C:\Users\Admin\AppData\Local\Temp\8C23.tmp"23⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"24⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\8E75.tmp"C:\Users\Admin\AppData\Local\Temp\8E75.tmp"25⤵
- Executes dropped EXE
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\8F20.tmp"C:\Users\Admin\AppData\Local\Temp\8F20.tmp"26⤵
- Executes dropped EXE
PID:516 -
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"27⤵
- Executes dropped EXE
PID:724 -
C:\Users\Admin\AppData\Local\Temp\9049.tmp"C:\Users\Admin\AppData\Local\Temp\9049.tmp"28⤵
- Executes dropped EXE
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"29⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\91B1.tmp"C:\Users\Admin\AppData\Local\Temp\91B1.tmp"30⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"31⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"32⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"33⤵
- Executes dropped EXE
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\9441.tmp"C:\Users\Admin\AppData\Local\Temp\9441.tmp"34⤵
- Executes dropped EXE
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\94ED.tmp"C:\Users\Admin\AppData\Local\Temp\94ED.tmp"35⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\956A.tmp"C:\Users\Admin\AppData\Local\Temp\956A.tmp"36⤵
- Executes dropped EXE
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\95D7.tmp"C:\Users\Admin\AppData\Local\Temp\95D7.tmp"37⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\9654.tmp"C:\Users\Admin\AppData\Local\Temp\9654.tmp"38⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\96E1.tmp"C:\Users\Admin\AppData\Local\Temp\96E1.tmp"39⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"40⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\97EA.tmp"C:\Users\Admin\AppData\Local\Temp\97EA.tmp"41⤵
- Executes dropped EXE
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"42⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"43⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"44⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"45⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"46⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"47⤵
- Executes dropped EXE
PID:928 -
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"48⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"49⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"50⤵
- Executes dropped EXE
PID:336 -
C:\Users\Admin\AppData\Local\Temp\9D78.tmp"C:\Users\Admin\AppData\Local\Temp\9D78.tmp"51⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"52⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"53⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"54⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"55⤵
- Executes dropped EXE
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"56⤵
- Executes dropped EXE
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"57⤵
- Executes dropped EXE
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"58⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"59⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\A24B.tmp"C:\Users\Admin\AppData\Local\Temp\A24B.tmp"60⤵
- Executes dropped EXE
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"61⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\A354.tmp"C:\Users\Admin\AppData\Local\Temp\A354.tmp"62⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"63⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\A46E.tmp"C:\Users\Admin\AppData\Local\Temp\A46E.tmp"64⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"65⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"66⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"67⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"68⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"69⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"70⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"71⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\A884.tmp"C:\Users\Admin\AppData\Local\Temp\A884.tmp"72⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"73⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"74⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\A99E.tmp"C:\Users\Admin\AppData\Local\Temp\A99E.tmp"75⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"76⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"77⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"78⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"79⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"80⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"81⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"82⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\AD95.tmp"C:\Users\Admin\AppData\Local\Temp\AD95.tmp"83⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"84⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"85⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"86⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"87⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\B006.tmp"C:\Users\Admin\AppData\Local\Temp\B006.tmp"88⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\B093.tmp"C:\Users\Admin\AppData\Local\Temp\B093.tmp"89⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"90⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\B15E.tmp"C:\Users\Admin\AppData\Local\Temp\B15E.tmp"91⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"92⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\B268.tmp"C:\Users\Admin\AppData\Local\Temp\B268.tmp"93⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"94⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\B362.tmp"C:\Users\Admin\AppData\Local\Temp\B362.tmp"95⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"96⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\B46B.tmp"C:\Users\Admin\AppData\Local\Temp\B46B.tmp"97⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"98⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\B546.tmp"C:\Users\Admin\AppData\Local\Temp\B546.tmp"99⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"100⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"101⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"102⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\B73A.tmp"C:\Users\Admin\AppData\Local\Temp\B73A.tmp"103⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"104⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\B844.tmp"C:\Users\Admin\AppData\Local\Temp\B844.tmp"105⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"106⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\B94D.tmp"C:\Users\Admin\AppData\Local\Temp\B94D.tmp"107⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"108⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\BA47.tmp"C:\Users\Admin\AppData\Local\Temp\BA47.tmp"109⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"110⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\BB41.tmp"C:\Users\Admin\AppData\Local\Temp\BB41.tmp"111⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"112⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"113⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\BC99.tmp"C:\Users\Admin\AppData\Local\Temp\BC99.tmp"114⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\BD16.tmp"C:\Users\Admin\AppData\Local\Temp\BD16.tmp"115⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"116⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\BE10.tmp"C:\Users\Admin\AppData\Local\Temp\BE10.tmp"117⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"118⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"119⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\BF87.tmp"C:\Users\Admin\AppData\Local\Temp\BF87.tmp"120⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"121⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"122⤵PID:1912
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-