Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
04/09/2023, 16:39
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-23_6090cff4ed434d1fb70bd28110228646_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-23_6090cff4ed434d1fb70bd28110228646_mafia_JC.exe
Resource
win10v2004-20230831-en
General
-
Target
2023-08-23_6090cff4ed434d1fb70bd28110228646_mafia_JC.exe
-
Size
487KB
-
MD5
6090cff4ed434d1fb70bd28110228646
-
SHA1
72eb52c9e47402f05011de59c8c61b61d0d10117
-
SHA256
25dbe89266f5ae265e0c7aeb0c68cebad3d71695c4b1251ec28d8a48d0b8179e
-
SHA512
a9495c4c6012a3355abd69362c763caafe7ba2bfa43465a751e4727f1d0a964cea9d9094455975474d6e7931d62cf64c2bab04a3f28091b8c6d02d1a7496797b
-
SSDEEP
12288:yU5rCOTeiNoM2gHu9DC1/AQZd6mTEflYfCbZ:yUQOJNoM2gHge1/AQZdpT0eKb
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 560 6C37.tmp 3544 6CC4.tmp 4512 6D50.tmp 3556 6E2B.tmp 3388 6ED7.tmp 3628 6F73.tmp 1596 6FF0.tmp 824 706D.tmp 968 70FA.tmp 2392 7196.tmp 4468 7223.tmp 2428 72A0.tmp 1416 731D.tmp 4840 73D8.tmp 1688 7474.tmp 4900 7520.tmp 3708 75BC.tmp 3308 7649.tmp 3808 76D6.tmp 3356 7762.tmp 4576 784D.tmp 3040 78F9.tmp 4916 7966.tmp 3580 79F3.tmp 3728 7A9E.tmp 4692 7B5A.tmp 4288 7C35.tmp 1248 7D0F.tmp 1960 7DEA.tmp 5092 7EB5.tmp 1176 7FA0.tmp 4600 808A.tmp 764 8117.tmp 2916 81B3.tmp 1184 8240.tmp 3448 82AD.tmp 3932 833A.tmp 4796 83C6.tmp 4904 8491.tmp 2244 850E.tmp 4644 859B.tmp 4240 8618.tmp 4176 86B4.tmp 2028 8731.tmp 668 87CD.tmp 4388 883B.tmp 4476 88B8.tmp 1520 8935.tmp 5080 89E1.tmp 3748 8A7D.tmp 1512 8AEA.tmp 4296 8B67.tmp 2300 8BE4.tmp 3336 8C61.tmp 4360 8CEE.tmp 4208 8D8A.tmp 1492 8E26.tmp 1900 8EB3.tmp 3696 8F4F.tmp 2424 8FDC.tmp 4196 9069.tmp 3340 90D6.tmp 3168 9182.tmp 1272 920E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3552 wrote to memory of 560 3552 2023-08-23_6090cff4ed434d1fb70bd28110228646_mafia_JC.exe 85 PID 3552 wrote to memory of 560 3552 2023-08-23_6090cff4ed434d1fb70bd28110228646_mafia_JC.exe 85 PID 3552 wrote to memory of 560 3552 2023-08-23_6090cff4ed434d1fb70bd28110228646_mafia_JC.exe 85 PID 560 wrote to memory of 3544 560 6C37.tmp 86 PID 560 wrote to memory of 3544 560 6C37.tmp 86 PID 560 wrote to memory of 3544 560 6C37.tmp 86 PID 3544 wrote to memory of 4512 3544 6CC4.tmp 87 PID 3544 wrote to memory of 4512 3544 6CC4.tmp 87 PID 3544 wrote to memory of 4512 3544 6CC4.tmp 87 PID 4512 wrote to memory of 3556 4512 6D50.tmp 88 PID 4512 wrote to memory of 3556 4512 6D50.tmp 88 PID 4512 wrote to memory of 3556 4512 6D50.tmp 88 PID 3556 wrote to memory of 3388 3556 6E2B.tmp 89 PID 3556 wrote to memory of 3388 3556 6E2B.tmp 89 PID 3556 wrote to memory of 3388 3556 6E2B.tmp 89 PID 3388 wrote to memory of 3628 3388 6ED7.tmp 90 PID 3388 wrote to memory of 3628 3388 6ED7.tmp 90 PID 3388 wrote to memory of 3628 3388 6ED7.tmp 90 PID 3628 wrote to memory of 1596 3628 6F73.tmp 91 PID 3628 wrote to memory of 1596 3628 6F73.tmp 91 PID 3628 wrote to memory of 1596 3628 6F73.tmp 91 PID 1596 wrote to memory of 824 1596 6FF0.tmp 92 PID 1596 wrote to memory of 824 1596 6FF0.tmp 92 PID 1596 wrote to memory of 824 1596 6FF0.tmp 92 PID 824 wrote to memory of 968 824 706D.tmp 93 PID 824 wrote to memory of 968 824 706D.tmp 93 PID 824 wrote to memory of 968 824 706D.tmp 93 PID 968 wrote to memory of 2392 968 70FA.tmp 94 PID 968 wrote to memory of 2392 968 70FA.tmp 94 PID 968 wrote to memory of 2392 968 70FA.tmp 94 PID 2392 wrote to memory of 4468 2392 7196.tmp 95 PID 2392 wrote to memory of 4468 2392 7196.tmp 95 PID 2392 wrote to memory of 4468 2392 7196.tmp 95 PID 4468 wrote to memory of 2428 4468 7223.tmp 96 PID 4468 wrote to memory of 2428 4468 7223.tmp 96 PID 4468 wrote to memory of 2428 4468 7223.tmp 96 PID 2428 wrote to memory of 1416 2428 72A0.tmp 97 PID 2428 wrote to memory of 1416 2428 72A0.tmp 97 PID 2428 wrote to memory of 1416 2428 72A0.tmp 97 PID 1416 wrote to memory of 4840 1416 731D.tmp 99 PID 1416 wrote to memory of 4840 1416 731D.tmp 99 PID 1416 wrote to memory of 4840 1416 731D.tmp 99 PID 4840 wrote to memory of 1688 4840 73D8.tmp 100 PID 4840 wrote to memory of 1688 4840 73D8.tmp 100 PID 4840 wrote to memory of 1688 4840 73D8.tmp 100 PID 1688 wrote to memory of 4900 1688 7474.tmp 101 PID 1688 wrote to memory of 4900 1688 7474.tmp 101 PID 1688 wrote to memory of 4900 1688 7474.tmp 101 PID 4900 wrote to memory of 3708 4900 7520.tmp 102 PID 4900 wrote to memory of 3708 4900 7520.tmp 102 PID 4900 wrote to memory of 3708 4900 7520.tmp 102 PID 3708 wrote to memory of 3308 3708 75BC.tmp 104 PID 3708 wrote to memory of 3308 3708 75BC.tmp 104 PID 3708 wrote to memory of 3308 3708 75BC.tmp 104 PID 3308 wrote to memory of 3808 3308 7649.tmp 105 PID 3308 wrote to memory of 3808 3308 7649.tmp 105 PID 3308 wrote to memory of 3808 3308 7649.tmp 105 PID 3808 wrote to memory of 3356 3808 76D6.tmp 106 PID 3808 wrote to memory of 3356 3808 76D6.tmp 106 PID 3808 wrote to memory of 3356 3808 76D6.tmp 106 PID 3356 wrote to memory of 4576 3356 7762.tmp 107 PID 3356 wrote to memory of 4576 3356 7762.tmp 107 PID 3356 wrote to memory of 4576 3356 7762.tmp 107 PID 4576 wrote to memory of 3040 4576 784D.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-23_6090cff4ed434d1fb70bd28110228646_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-23_6090cff4ed434d1fb70bd28110228646_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\72A0.tmp"C:\Users\Admin\AppData\Local\Temp\72A0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\7762.tmp"C:\Users\Admin\AppData\Local\Temp\7762.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\78F9.tmp"C:\Users\Admin\AppData\Local\Temp\78F9.tmp"23⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\7966.tmp"C:\Users\Admin\AppData\Local\Temp\7966.tmp"24⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"25⤵
- Executes dropped EXE
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"26⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"27⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\7C35.tmp"C:\Users\Admin\AppData\Local\Temp\7C35.tmp"28⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"29⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"30⤵
- Executes dropped EXE
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"31⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"32⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\808A.tmp"C:\Users\Admin\AppData\Local\Temp\808A.tmp"33⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\8117.tmp"C:\Users\Admin\AppData\Local\Temp\8117.tmp"34⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\81B3.tmp"C:\Users\Admin\AppData\Local\Temp\81B3.tmp"35⤵
- Executes dropped EXE
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\8240.tmp"C:\Users\Admin\AppData\Local\Temp\8240.tmp"36⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\82AD.tmp"C:\Users\Admin\AppData\Local\Temp\82AD.tmp"37⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\833A.tmp"C:\Users\Admin\AppData\Local\Temp\833A.tmp"38⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\83C6.tmp"C:\Users\Admin\AppData\Local\Temp\83C6.tmp"39⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\8491.tmp"C:\Users\Admin\AppData\Local\Temp\8491.tmp"40⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\850E.tmp"C:\Users\Admin\AppData\Local\Temp\850E.tmp"41⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\859B.tmp"C:\Users\Admin\AppData\Local\Temp\859B.tmp"42⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\8618.tmp"C:\Users\Admin\AppData\Local\Temp\8618.tmp"43⤵
- Executes dropped EXE
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"44⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\8731.tmp"C:\Users\Admin\AppData\Local\Temp\8731.tmp"45⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\87CD.tmp"C:\Users\Admin\AppData\Local\Temp\87CD.tmp"46⤵
- Executes dropped EXE
PID:668 -
C:\Users\Admin\AppData\Local\Temp\883B.tmp"C:\Users\Admin\AppData\Local\Temp\883B.tmp"47⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\88B8.tmp"C:\Users\Admin\AppData\Local\Temp\88B8.tmp"48⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\8935.tmp"C:\Users\Admin\AppData\Local\Temp\8935.tmp"49⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\89E1.tmp"C:\Users\Admin\AppData\Local\Temp\89E1.tmp"50⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"51⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"52⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\8B67.tmp"C:\Users\Admin\AppData\Local\Temp\8B67.tmp"53⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"54⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\8C61.tmp"C:\Users\Admin\AppData\Local\Temp\8C61.tmp"55⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"56⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"57⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\8E26.tmp"C:\Users\Admin\AppData\Local\Temp\8E26.tmp"58⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"59⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"60⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"61⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"62⤵
- Executes dropped EXE
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"63⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\9182.tmp"C:\Users\Admin\AppData\Local\Temp\9182.tmp"64⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"65⤵
- Executes dropped EXE
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"66⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\9308.tmp"C:\Users\Admin\AppData\Local\Temp\9308.tmp"67⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\9385.tmp"C:\Users\Admin\AppData\Local\Temp\9385.tmp"68⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\9422.tmp"C:\Users\Admin\AppData\Local\Temp\9422.tmp"69⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\94AE.tmp"C:\Users\Admin\AppData\Local\Temp\94AE.tmp"70⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"71⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\95C8.tmp"C:\Users\Admin\AppData\Local\Temp\95C8.tmp"72⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"73⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\96B2.tmp"C:\Users\Admin\AppData\Local\Temp\96B2.tmp"74⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"75⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\97DB.tmp"C:\Users\Admin\AppData\Local\Temp\97DB.tmp"76⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"77⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\98E4.tmp"C:\Users\Admin\AppData\Local\Temp\98E4.tmp"78⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"79⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"80⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"81⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"82⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"83⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"84⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"85⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"86⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"87⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"88⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"89⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"90⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"91⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"92⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"93⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"94⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\A23B.tmp"C:\Users\Admin\AppData\Local\Temp\A23B.tmp"95⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"96⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"97⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"98⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"99⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"100⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"101⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"102⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\A642.tmp"C:\Users\Admin\AppData\Local\Temp\A642.tmp"103⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"104⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\A78A.tmp"C:\Users\Admin\AppData\Local\Temp\A78A.tmp"105⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\A817.tmp"C:\Users\Admin\AppData\Local\Temp\A817.tmp"106⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"107⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"108⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"109⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"110⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"111⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"112⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"113⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"114⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"115⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"116⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"117⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"118⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"119⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"120⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\B074.tmp"C:\Users\Admin\AppData\Local\Temp\B074.tmp"121⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"122⤵PID:952
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-