Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
16/08/2023, 18:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f1c68b5f42196333beff857ef7dd0b1_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
0f1c68b5f42196333beff857ef7dd0b1_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
0f1c68b5f42196333beff857ef7dd0b1_mafia_JC.exe
-
Size
520KB
-
MD5
0f1c68b5f42196333beff857ef7dd0b1
-
SHA1
27e9d96008a4db797e656ae650fd92723afbf06f
-
SHA256
c9d55b17fe53a6d4b5cc409a3c49096f91775297524510857d64322e5c053841
-
SHA512
3f41e6df42bdaa120a895c2b72f544288e0b236e2452a69eebd79a32e9d38c873d5f3765e82f494da07537a8897f21a1edc35667d479d98d382b95891708878a
-
SSDEEP
12288:roRXOQjmOymtLerhaUcgOi5dVTvNNLGjNZ:rogQ9yqLAEUu+dVTV5yN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4128 83E5.tmp 644 84A1.tmp 3652 85AB.tmp 4584 8695.tmp 2164 8741.tmp 3844 881C.tmp 940 88C7.tmp 4884 8973.tmp 4068 8A10.tmp 3164 8AAC.tmp 3796 8B67.tmp 4292 8C23.tmp 4460 8D1D.tmp 3772 8E17.tmp 2104 8EE2.tmp 1232 8FDC.tmp 4572 9078.tmp 4376 9114.tmp 2728 925D.tmp 2712 9357.tmp 2708 9431.tmp 4732 94ED.tmp 4728 9599.tmp 2680 9693.tmp 4408 975E.tmp 5104 9887.tmp 2648 9961.tmp 1464 9A0D.tmp 4384 9AD8.tmp 3984 9B75.tmp 1576 9BF2.tmp 960 9CEC.tmp 1484 9DD6.tmp 2456 9E72.tmp 4876 9F1E.tmp 1208 9FAB.tmp 2720 A037.tmp 4056 A0D4.tmp 2276 A170.tmp 4440 A1ED.tmp 2316 A26A.tmp 3936 A2E7.tmp 3208 A374.tmp 4076 A410.tmp 4560 A4BC.tmp 448 A548.tmp 1296 A5D5.tmp 1992 A652.tmp 3056 A6EE.tmp 408 A76B.tmp 4392 A7E8.tmp 3652 A865.tmp 3780 A901.tmp 1688 A97E.tmp 2164 AA2A.tmp 2908 AAD6.tmp 5068 AB63.tmp 928 ABFF.tmp 116 AC6C.tmp 1908 ACF9.tmp 3892 AD57.tmp 5052 ADD4.tmp 3164 AE32.tmp 3792 AEBE.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4332 wrote to memory of 4128 4332 0f1c68b5f42196333beff857ef7dd0b1_mafia_JC.exe 81 PID 4332 wrote to memory of 4128 4332 0f1c68b5f42196333beff857ef7dd0b1_mafia_JC.exe 81 PID 4332 wrote to memory of 4128 4332 0f1c68b5f42196333beff857ef7dd0b1_mafia_JC.exe 81 PID 4128 wrote to memory of 644 4128 83E5.tmp 82 PID 4128 wrote to memory of 644 4128 83E5.tmp 82 PID 4128 wrote to memory of 644 4128 83E5.tmp 82 PID 644 wrote to memory of 3652 644 84A1.tmp 83 PID 644 wrote to memory of 3652 644 84A1.tmp 83 PID 644 wrote to memory of 3652 644 84A1.tmp 83 PID 3652 wrote to memory of 4584 3652 85AB.tmp 84 PID 3652 wrote to memory of 4584 3652 85AB.tmp 84 PID 3652 wrote to memory of 4584 3652 85AB.tmp 84 PID 4584 wrote to memory of 2164 4584 8695.tmp 85 PID 4584 wrote to memory of 2164 4584 8695.tmp 85 PID 4584 wrote to memory of 2164 4584 8695.tmp 85 PID 2164 wrote to memory of 3844 2164 8741.tmp 86 PID 2164 wrote to memory of 3844 2164 8741.tmp 86 PID 2164 wrote to memory of 3844 2164 8741.tmp 86 PID 3844 wrote to memory of 940 3844 881C.tmp 87 PID 3844 wrote to memory of 940 3844 881C.tmp 87 PID 3844 wrote to memory of 940 3844 881C.tmp 87 PID 940 wrote to memory of 4884 940 88C7.tmp 89 PID 940 wrote to memory of 4884 940 88C7.tmp 89 PID 940 wrote to memory of 4884 940 88C7.tmp 89 PID 4884 wrote to memory of 4068 4884 8973.tmp 90 PID 4884 wrote to memory of 4068 4884 8973.tmp 90 PID 4884 wrote to memory of 4068 4884 8973.tmp 90 PID 4068 wrote to memory of 3164 4068 8A10.tmp 91 PID 4068 wrote to memory of 3164 4068 8A10.tmp 91 PID 4068 wrote to memory of 3164 4068 8A10.tmp 91 PID 3164 wrote to memory of 3796 3164 8AAC.tmp 92 PID 3164 wrote to memory of 3796 3164 8AAC.tmp 92 PID 3164 wrote to memory of 3796 3164 8AAC.tmp 92 PID 3796 wrote to memory of 4292 3796 8B67.tmp 93 PID 3796 wrote to memory of 4292 3796 8B67.tmp 93 PID 3796 wrote to memory of 4292 3796 8B67.tmp 93 PID 4292 wrote to memory of 4460 4292 8C23.tmp 94 PID 4292 wrote to memory of 4460 4292 8C23.tmp 94 PID 4292 wrote to memory of 4460 4292 8C23.tmp 94 PID 4460 wrote to memory of 3772 4460 8D1D.tmp 95 PID 4460 wrote to memory of 3772 4460 8D1D.tmp 95 PID 4460 wrote to memory of 3772 4460 8D1D.tmp 95 PID 3772 wrote to memory of 2104 3772 8E17.tmp 96 PID 3772 wrote to memory of 2104 3772 8E17.tmp 96 PID 3772 wrote to memory of 2104 3772 8E17.tmp 96 PID 2104 wrote to memory of 1232 2104 8EE2.tmp 99 PID 2104 wrote to memory of 1232 2104 8EE2.tmp 99 PID 2104 wrote to memory of 1232 2104 8EE2.tmp 99 PID 1232 wrote to memory of 4572 1232 8FDC.tmp 100 PID 1232 wrote to memory of 4572 1232 8FDC.tmp 100 PID 1232 wrote to memory of 4572 1232 8FDC.tmp 100 PID 4572 wrote to memory of 4376 4572 9078.tmp 101 PID 4572 wrote to memory of 4376 4572 9078.tmp 101 PID 4572 wrote to memory of 4376 4572 9078.tmp 101 PID 4376 wrote to memory of 2728 4376 9114.tmp 102 PID 4376 wrote to memory of 2728 4376 9114.tmp 102 PID 4376 wrote to memory of 2728 4376 9114.tmp 102 PID 2728 wrote to memory of 2712 2728 925D.tmp 103 PID 2728 wrote to memory of 2712 2728 925D.tmp 103 PID 2728 wrote to memory of 2712 2728 925D.tmp 103 PID 2712 wrote to memory of 2708 2712 9357.tmp 105 PID 2712 wrote to memory of 2708 2712 9357.tmp 105 PID 2712 wrote to memory of 2708 2712 9357.tmp 105 PID 2708 wrote to memory of 4732 2708 9431.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f1c68b5f42196333beff857ef7dd0b1_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\0f1c68b5f42196333beff857ef7dd0b1_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\83E5.tmp"C:\Users\Admin\AppData\Local\Temp\83E5.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\84A1.tmp"C:\Users\Admin\AppData\Local\Temp\84A1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\85AB.tmp"C:\Users\Admin\AppData\Local\Temp\85AB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\8695.tmp"C:\Users\Admin\AppData\Local\Temp\8695.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\8741.tmp"C:\Users\Admin\AppData\Local\Temp\8741.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\881C.tmp"C:\Users\Admin\AppData\Local\Temp\881C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\88C7.tmp"C:\Users\Admin\AppData\Local\Temp\88C7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\8973.tmp"C:\Users\Admin\AppData\Local\Temp\8973.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\8A10.tmp"C:\Users\Admin\AppData\Local\Temp\8A10.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\8B67.tmp"C:\Users\Admin\AppData\Local\Temp\8B67.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\8C23.tmp"C:\Users\Admin\AppData\Local\Temp\8C23.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\8E17.tmp"C:\Users\Admin\AppData\Local\Temp\8E17.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\9078.tmp"C:\Users\Admin\AppData\Local\Temp\9078.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\9114.tmp"C:\Users\Admin\AppData\Local\Temp\9114.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\94ED.tmp"C:\Users\Admin\AppData\Local\Temp\94ED.tmp"23⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\9599.tmp"C:\Users\Admin\AppData\Local\Temp\9599.tmp"24⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\9693.tmp"C:\Users\Admin\AppData\Local\Temp\9693.tmp"25⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"26⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"27⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"28⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"29⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"30⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"31⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"32⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"33⤵
- Executes dropped EXE
PID:960 -
C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"34⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\9E72.tmp"C:\Users\Admin\AppData\Local\Temp\9E72.tmp"35⤵
- Executes dropped EXE
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"36⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"37⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"38⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"39⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"40⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"41⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\A26A.tmp"C:\Users\Admin\AppData\Local\Temp\A26A.tmp"42⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"43⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\A374.tmp"C:\Users\Admin\AppData\Local\Temp\A374.tmp"44⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\A410.tmp"C:\Users\Admin\AppData\Local\Temp\A410.tmp"45⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"46⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"47⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"48⤵
- Executes dropped EXE
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"49⤵
- Executes dropped EXE
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"50⤵
- Executes dropped EXE
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\A76B.tmp"C:\Users\Admin\AppData\Local\Temp\A76B.tmp"51⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"52⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"53⤵
- Executes dropped EXE
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"54⤵
- Executes dropped EXE
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"55⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"56⤵
- Executes dropped EXE
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"57⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"58⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"59⤵
- Executes dropped EXE
PID:928 -
C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"60⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"61⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\AD57.tmp"C:\Users\Admin\AppData\Local\Temp\AD57.tmp"62⤵
- Executes dropped EXE
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"63⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"64⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"65⤵
- Executes dropped EXE
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"66⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"67⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\B054.tmp"C:\Users\Admin\AppData\Local\Temp\B054.tmp"68⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\B100.tmp"C:\Users\Admin\AppData\Local\Temp\B100.tmp"69⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\B17D.tmp"C:\Users\Admin\AppData\Local\Temp\B17D.tmp"70⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"71⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"72⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\B314.tmp"C:\Users\Admin\AppData\Local\Temp\B314.tmp"73⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"74⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"75⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"76⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\B546.tmp"C:\Users\Admin\AppData\Local\Temp\B546.tmp"77⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"78⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\B640.tmp"C:\Users\Admin\AppData\Local\Temp\B640.tmp"79⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"80⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\B73A.tmp"C:\Users\Admin\AppData\Local\Temp\B73A.tmp"81⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"82⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\B834.tmp"C:\Users\Admin\AppData\Local\Temp\B834.tmp"83⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"84⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\B93E.tmp"C:\Users\Admin\AppData\Local\Temp\B93E.tmp"85⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"86⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\BA09.tmp"C:\Users\Admin\AppData\Local\Temp\BA09.tmp"87⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\BA95.tmp"C:\Users\Admin\AppData\Local\Temp\BA95.tmp"88⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"89⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"90⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\BC99.tmp"C:\Users\Admin\AppData\Local\Temp\BC99.tmp"91⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\BD06.tmp"C:\Users\Admin\AppData\Local\Temp\BD06.tmp"92⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\BD83.tmp"C:\Users\Admin\AppData\Local\Temp\BD83.tmp"93⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\BE00.tmp"C:\Users\Admin\AppData\Local\Temp\BE00.tmp"94⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"95⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"96⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"97⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"98⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"99⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"100⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"101⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\C246.tmp"C:\Users\Admin\AppData\Local\Temp\C246.tmp"102⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"103⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\C350.tmp"C:\Users\Admin\AppData\Local\Temp\C350.tmp"104⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\C3DC.tmp"C:\Users\Admin\AppData\Local\Temp\C3DC.tmp"105⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\C44A.tmp"C:\Users\Admin\AppData\Local\Temp\C44A.tmp"106⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"107⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\C544.tmp"C:\Users\Admin\AppData\Local\Temp\C544.tmp"108⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"109⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\C68C.tmp"C:\Users\Admin\AppData\Local\Temp\C68C.tmp"110⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"111⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\C776.tmp"C:\Users\Admin\AppData\Local\Temp\C776.tmp"112⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\C832.tmp"C:\Users\Admin\AppData\Local\Temp\C832.tmp"113⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\C89F.tmp"C:\Users\Admin\AppData\Local\Temp\C89F.tmp"114⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\C91C.tmp"C:\Users\Admin\AppData\Local\Temp\C91C.tmp"115⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\C999.tmp"C:\Users\Admin\AppData\Local\Temp\C999.tmp"116⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\CA16.tmp"C:\Users\Admin\AppData\Local\Temp\CA16.tmp"117⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"118⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"119⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"120⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\CC29.tmp"C:\Users\Admin\AppData\Local\Temp\CC29.tmp"121⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"122⤵PID:1548
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-