Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
03/09/2023, 16:46
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-23_16c924fe09357e705395b07c2b19cad1_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-23_16c924fe09357e705395b07c2b19cad1_mafia_JC.exe
Resource
win10v2004-20230831-en
General
-
Target
2023-08-23_16c924fe09357e705395b07c2b19cad1_mafia_JC.exe
-
Size
486KB
-
MD5
16c924fe09357e705395b07c2b19cad1
-
SHA1
10ed2136d19617bc9e937d0a1b55d4bb085746c5
-
SHA256
dac603692237c34f628926abf795488e6579e26c6c3d119d8c4f75b98edd60db
-
SHA512
9979b2a97cfbc5874909ce57291621f8e8613a0d2e8cd6fd4428a3080d0e9aa1ec721de813277dd7dced8e80d66d06690a5864a33fc62db5c027d732a0b84ed9
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7MOTPFvC3Ene9PXBTXNh8DkdecsyY2/CgAMMu:/U5rCOTeiDMioKevTdOwdJsSCgf0cNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3820 C6BB.tmp 3876 C7D4.tmp 1876 C851.tmp 4488 C8DE.tmp 5048 C9A9.tmp 4732 CA64.tmp 4860 CB20.tmp 4800 CBEB.tmp 3816 CCA6.tmp 2052 CD81.tmp 4524 CE4C.tmp 4556 CF08.tmp 3868 CFD3.tmp 1852 D06F.tmp 1260 D11B.tmp 4368 D188.tmp 4128 D225.tmp 4004 D2D1.tmp 2808 D3BB.tmp 1708 D496.tmp 1676 D542.tmp 4960 D5ED.tmp 4512 D699.tmp 1788 D726.tmp 1628 D84F.tmp 3944 D939.tmp 3704 D9F5.tmp 2300 DA91.tmp 1752 DAFE.tmp 4884 DB9B.tmp 116 DC66.tmp 5108 DD02.tmp 3404 DDEC.tmp 3552 DE5A.tmp 4468 DED7.tmp 4480 DF34.tmp 4808 DFE0.tmp 5112 E04E.tmp 4776 E0DA.tmp 5032 E167.tmp 4736 E1E4.tmp 4592 E290.tmp 1428 E2FD.tmp 4284 E399.tmp 2176 E416.tmp 4132 E4A3.tmp 2636 E53F.tmp 5100 E5AD.tmp 4464 E668.tmp 4756 E714.tmp 4168 E7B0.tmp 1824 E84D.tmp 4452 E8E9.tmp 4276 E985.tmp 4732 E9F2.tmp 4612 EA6F.tmp 4860 EAFC.tmp 2160 EB69.tmp 2264 EBF6.tmp 580 EC83.tmp 1380 ED1F.tmp 4896 EDBB.tmp 2728 EE29.tmp 3912 EE96.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2636 wrote to memory of 3820 2636 2023-08-23_16c924fe09357e705395b07c2b19cad1_mafia_JC.exe 83 PID 2636 wrote to memory of 3820 2636 2023-08-23_16c924fe09357e705395b07c2b19cad1_mafia_JC.exe 83 PID 2636 wrote to memory of 3820 2636 2023-08-23_16c924fe09357e705395b07c2b19cad1_mafia_JC.exe 83 PID 3820 wrote to memory of 3876 3820 C6BB.tmp 84 PID 3820 wrote to memory of 3876 3820 C6BB.tmp 84 PID 3820 wrote to memory of 3876 3820 C6BB.tmp 84 PID 3876 wrote to memory of 1876 3876 C7D4.tmp 85 PID 3876 wrote to memory of 1876 3876 C7D4.tmp 85 PID 3876 wrote to memory of 1876 3876 C7D4.tmp 85 PID 1876 wrote to memory of 4488 1876 C851.tmp 86 PID 1876 wrote to memory of 4488 1876 C851.tmp 86 PID 1876 wrote to memory of 4488 1876 C851.tmp 86 PID 4488 wrote to memory of 5048 4488 C8DE.tmp 87 PID 4488 wrote to memory of 5048 4488 C8DE.tmp 87 PID 4488 wrote to memory of 5048 4488 C8DE.tmp 87 PID 5048 wrote to memory of 4732 5048 C9A9.tmp 88 PID 5048 wrote to memory of 4732 5048 C9A9.tmp 88 PID 5048 wrote to memory of 4732 5048 C9A9.tmp 88 PID 4732 wrote to memory of 4860 4732 CA64.tmp 89 PID 4732 wrote to memory of 4860 4732 CA64.tmp 89 PID 4732 wrote to memory of 4860 4732 CA64.tmp 89 PID 4860 wrote to memory of 4800 4860 CB20.tmp 90 PID 4860 wrote to memory of 4800 4860 CB20.tmp 90 PID 4860 wrote to memory of 4800 4860 CB20.tmp 90 PID 4800 wrote to memory of 3816 4800 CBEB.tmp 91 PID 4800 wrote to memory of 3816 4800 CBEB.tmp 91 PID 4800 wrote to memory of 3816 4800 CBEB.tmp 91 PID 3816 wrote to memory of 2052 3816 CCA6.tmp 92 PID 3816 wrote to memory of 2052 3816 CCA6.tmp 92 PID 3816 wrote to memory of 2052 3816 CCA6.tmp 92 PID 2052 wrote to memory of 4524 2052 CD81.tmp 93 PID 2052 wrote to memory of 4524 2052 CD81.tmp 93 PID 2052 wrote to memory of 4524 2052 CD81.tmp 93 PID 4524 wrote to memory of 4556 4524 CE4C.tmp 94 PID 4524 wrote to memory of 4556 4524 CE4C.tmp 94 PID 4524 wrote to memory of 4556 4524 CE4C.tmp 94 PID 4556 wrote to memory of 3868 4556 CF08.tmp 95 PID 4556 wrote to memory of 3868 4556 CF08.tmp 95 PID 4556 wrote to memory of 3868 4556 CF08.tmp 95 PID 3868 wrote to memory of 1852 3868 CFD3.tmp 96 PID 3868 wrote to memory of 1852 3868 CFD3.tmp 96 PID 3868 wrote to memory of 1852 3868 CFD3.tmp 96 PID 1852 wrote to memory of 1260 1852 D06F.tmp 97 PID 1852 wrote to memory of 1260 1852 D06F.tmp 97 PID 1852 wrote to memory of 1260 1852 D06F.tmp 97 PID 1260 wrote to memory of 4368 1260 D11B.tmp 98 PID 1260 wrote to memory of 4368 1260 D11B.tmp 98 PID 1260 wrote to memory of 4368 1260 D11B.tmp 98 PID 4368 wrote to memory of 4128 4368 D188.tmp 99 PID 4368 wrote to memory of 4128 4368 D188.tmp 99 PID 4368 wrote to memory of 4128 4368 D188.tmp 99 PID 4128 wrote to memory of 4004 4128 D225.tmp 100 PID 4128 wrote to memory of 4004 4128 D225.tmp 100 PID 4128 wrote to memory of 4004 4128 D225.tmp 100 PID 4004 wrote to memory of 2808 4004 D2D1.tmp 101 PID 4004 wrote to memory of 2808 4004 D2D1.tmp 101 PID 4004 wrote to memory of 2808 4004 D2D1.tmp 101 PID 2808 wrote to memory of 1708 2808 D3BB.tmp 103 PID 2808 wrote to memory of 1708 2808 D3BB.tmp 103 PID 2808 wrote to memory of 1708 2808 D3BB.tmp 103 PID 1708 wrote to memory of 1676 1708 D496.tmp 104 PID 1708 wrote to memory of 1676 1708 D496.tmp 104 PID 1708 wrote to memory of 1676 1708 D496.tmp 104 PID 1676 wrote to memory of 4960 1676 D542.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-23_16c924fe09357e705395b07c2b19cad1_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-23_16c924fe09357e705395b07c2b19cad1_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\C851.tmp"C:\Users\Admin\AppData\Local\Temp\C851.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\CA64.tmp"C:\Users\Admin\AppData\Local\Temp\CA64.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\CB20.tmp"C:\Users\Admin\AppData\Local\Temp\CB20.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\CD81.tmp"C:\Users\Admin\AppData\Local\Temp\CD81.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\CF08.tmp"C:\Users\Admin\AppData\Local\Temp\CF08.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\D06F.tmp"C:\Users\Admin\AppData\Local\Temp\D06F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\D11B.tmp"C:\Users\Admin\AppData\Local\Temp\D11B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\D188.tmp"C:\Users\Admin\AppData\Local\Temp\D188.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\D225.tmp"C:\Users\Admin\AppData\Local\Temp\D225.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\D496.tmp"C:\Users\Admin\AppData\Local\Temp\D496.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\D542.tmp"C:\Users\Admin\AppData\Local\Temp\D542.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\D5ED.tmp"C:\Users\Admin\AppData\Local\Temp\D5ED.tmp"23⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\D699.tmp"C:\Users\Admin\AppData\Local\Temp\D699.tmp"24⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\D726.tmp"C:\Users\Admin\AppData\Local\Temp\D726.tmp"25⤵
- Executes dropped EXE
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\D84F.tmp"C:\Users\Admin\AppData\Local\Temp\D84F.tmp"26⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\D939.tmp"C:\Users\Admin\AppData\Local\Temp\D939.tmp"27⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\D9F5.tmp"C:\Users\Admin\AppData\Local\Temp\D9F5.tmp"28⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\DA91.tmp"C:\Users\Admin\AppData\Local\Temp\DA91.tmp"29⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\DAFE.tmp"C:\Users\Admin\AppData\Local\Temp\DAFE.tmp"30⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"31⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\DC66.tmp"C:\Users\Admin\AppData\Local\Temp\DC66.tmp"32⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\DD02.tmp"C:\Users\Admin\AppData\Local\Temp\DD02.tmp"33⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\DDEC.tmp"C:\Users\Admin\AppData\Local\Temp\DDEC.tmp"34⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\DE5A.tmp"C:\Users\Admin\AppData\Local\Temp\DE5A.tmp"35⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\DED7.tmp"C:\Users\Admin\AppData\Local\Temp\DED7.tmp"36⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\DF34.tmp"C:\Users\Admin\AppData\Local\Temp\DF34.tmp"37⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\DFE0.tmp"C:\Users\Admin\AppData\Local\Temp\DFE0.tmp"38⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\E04E.tmp"C:\Users\Admin\AppData\Local\Temp\E04E.tmp"39⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"40⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\E167.tmp"C:\Users\Admin\AppData\Local\Temp\E167.tmp"41⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"42⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\E290.tmp"C:\Users\Admin\AppData\Local\Temp\E290.tmp"43⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\E2FD.tmp"C:\Users\Admin\AppData\Local\Temp\E2FD.tmp"44⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\E399.tmp"C:\Users\Admin\AppData\Local\Temp\E399.tmp"45⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\E416.tmp"C:\Users\Admin\AppData\Local\Temp\E416.tmp"46⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"47⤵
- Executes dropped EXE
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\E53F.tmp"C:\Users\Admin\AppData\Local\Temp\E53F.tmp"48⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"49⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\E668.tmp"C:\Users\Admin\AppData\Local\Temp\E668.tmp"50⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\E714.tmp"C:\Users\Admin\AppData\Local\Temp\E714.tmp"51⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"52⤵
- Executes dropped EXE
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\E84D.tmp"C:\Users\Admin\AppData\Local\Temp\E84D.tmp"53⤵
- Executes dropped EXE
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"54⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\E985.tmp"C:\Users\Admin\AppData\Local\Temp\E985.tmp"55⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"56⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"57⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\EAFC.tmp"C:\Users\Admin\AppData\Local\Temp\EAFC.tmp"58⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\EB69.tmp"C:\Users\Admin\AppData\Local\Temp\EB69.tmp"59⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"60⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\EC83.tmp"C:\Users\Admin\AppData\Local\Temp\EC83.tmp"61⤵
- Executes dropped EXE
PID:580 -
C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"62⤵
- Executes dropped EXE
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"63⤵
- Executes dropped EXE
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\EE29.tmp"C:\Users\Admin\AppData\Local\Temp\EE29.tmp"64⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\EE96.tmp"C:\Users\Admin\AppData\Local\Temp\EE96.tmp"65⤵
- Executes dropped EXE
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\EF61.tmp"C:\Users\Admin\AppData\Local\Temp\EF61.tmp"66⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\EFDE.tmp"C:\Users\Admin\AppData\Local\Temp\EFDE.tmp"67⤵PID:420
-
C:\Users\Admin\AppData\Local\Temp\F06B.tmp"C:\Users\Admin\AppData\Local\Temp\F06B.tmp"68⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"69⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\F174.tmp"C:\Users\Admin\AppData\Local\Temp\F174.tmp"70⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\F1F1.tmp"C:\Users\Admin\AppData\Local\Temp\F1F1.tmp"71⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\F27E.tmp"C:\Users\Admin\AppData\Local\Temp\F27E.tmp"72⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\F2FB.tmp"C:\Users\Admin\AppData\Local\Temp\F2FB.tmp"73⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\F368.tmp"C:\Users\Admin\AppData\Local\Temp\F368.tmp"74⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\F3F5.tmp"C:\Users\Admin\AppData\Local\Temp\F3F5.tmp"75⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\F472.tmp"C:\Users\Admin\AppData\Local\Temp\F472.tmp"76⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\F4DF.tmp"C:\Users\Admin\AppData\Local\Temp\F4DF.tmp"77⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\F55C.tmp"C:\Users\Admin\AppData\Local\Temp\F55C.tmp"78⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\F5F9.tmp"C:\Users\Admin\AppData\Local\Temp\F5F9.tmp"79⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\F676.tmp"C:\Users\Admin\AppData\Local\Temp\F676.tmp"80⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"81⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\F770.tmp"C:\Users\Admin\AppData\Local\Temp\F770.tmp"82⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\F7ED.tmp"C:\Users\Admin\AppData\Local\Temp\F7ED.tmp"83⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\F898.tmp"C:\Users\Admin\AppData\Local\Temp\F898.tmp"84⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\F906.tmp"C:\Users\Admin\AppData\Local\Temp\F906.tmp"85⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\F992.tmp"C:\Users\Admin\AppData\Local\Temp\F992.tmp"86⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\FA3E.tmp"C:\Users\Admin\AppData\Local\Temp\FA3E.tmp"87⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\FABB.tmp"C:\Users\Admin\AppData\Local\Temp\FABB.tmp"88⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\FB38.tmp"C:\Users\Admin\AppData\Local\Temp\FB38.tmp"89⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"90⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\FC61.tmp"C:\Users\Admin\AppData\Local\Temp\FC61.tmp"91⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"92⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\FD4C.tmp"C:\Users\Admin\AppData\Local\Temp\FD4C.tmp"93⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\FDF7.tmp"C:\Users\Admin\AppData\Local\Temp\FDF7.tmp"94⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\FEB3.tmp"C:\Users\Admin\AppData\Local\Temp\FEB3.tmp"95⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\FF9D.tmp"C:\Users\Admin\AppData\Local\Temp\FF9D.tmp"96⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\2A.tmp"C:\Users\Admin\AppData\Local\Temp\2A.tmp"97⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7.tmp"98⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\124.tmp"C:\Users\Admin\AppData\Local\Temp\124.tmp"99⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\1C0.tmp"C:\Users\Admin\AppData\Local\Temp\1C0.tmp"100⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\26C.tmp"C:\Users\Admin\AppData\Local\Temp\26C.tmp"101⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\2E9.tmp"C:\Users\Admin\AppData\Local\Temp\2E9.tmp"102⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\395.tmp"C:\Users\Admin\AppData\Local\Temp\395.tmp"103⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\422.tmp"C:\Users\Admin\AppData\Local\Temp\422.tmp"104⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\4AE.tmp"C:\Users\Admin\AppData\Local\Temp\4AE.tmp"105⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\53B.tmp"C:\Users\Admin\AppData\Local\Temp\53B.tmp"106⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\5D7.tmp"C:\Users\Admin\AppData\Local\Temp\5D7.tmp"107⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\664.tmp"C:\Users\Admin\AppData\Local\Temp\664.tmp"108⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\6D1.tmp"C:\Users\Admin\AppData\Local\Temp\6D1.tmp"109⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\75E.tmp"C:\Users\Admin\AppData\Local\Temp\75E.tmp"110⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\7EA.tmp"C:\Users\Admin\AppData\Local\Temp\7EA.tmp"111⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\877.tmp"C:\Users\Admin\AppData\Local\Temp\877.tmp"112⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\8E4.tmp"C:\Users\Admin\AppData\Local\Temp\8E4.tmp"113⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\961.tmp"C:\Users\Admin\AppData\Local\Temp\961.tmp"114⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\9DE.tmp"C:\Users\Admin\AppData\Local\Temp\9DE.tmp"115⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\A6B.tmp"C:\Users\Admin\AppData\Local\Temp\A6B.tmp"116⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\AE8.tmp"C:\Users\Admin\AppData\Local\Temp\AE8.tmp"117⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\B84.tmp"C:\Users\Admin\AppData\Local\Temp\B84.tmp"118⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\C11.tmp"C:\Users\Admin\AppData\Local\Temp\C11.tmp"119⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\C9D.tmp"C:\Users\Admin\AppData\Local\Temp\C9D.tmp"120⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\D1A.tmp"C:\Users\Admin\AppData\Local\Temp\D1A.tmp"121⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\DB7.tmp"C:\Users\Admin\AppData\Local\Temp\DB7.tmp"122⤵PID:4948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-