Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
23/08/2023, 17:11
Static task
static1
Behavioral task
behavioral1
Sample
7abcf145790298297a37200b4680ec95_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
7abcf145790298297a37200b4680ec95_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
7abcf145790298297a37200b4680ec95_mafia_JC.exe
-
Size
488KB
-
MD5
7abcf145790298297a37200b4680ec95
-
SHA1
a0bf9ae91d60e0dc0f2589305cb02e66c2e8622a
-
SHA256
fcdabdd7f735cf90b05b64432959c98b266e582dcc44a49b6bf4071a8d91e602
-
SHA512
14b076ebdf387a8c6fa657f3c411116bcf830715eba2295b0b5c907265e9e4bff0c68a05f7f9d45b4f50ee7e9f2ae1917948dca9f3e88b32c1bd0a94a2c3bd2e
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7Ox1i3U2q/3VV0E4AHcg454IxDR5dHUuMITRZ:/U5rCOTeiDw1i3UNz03Lc/WNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2564 AD01.tmp 2188 AD6F.tmp 2024 ADBD.tmp 2284 AE0B.tmp 2224 AE68.tmp 2656 AED5.tmp 2792 AF33.tmp 1792 AF81.tmp 2508 AFDF.tmp 2936 B03C.tmp 2836 B09A.tmp 2276 B0F7.tmp 2880 B145.tmp 2084 B1A3.tmp 2940 B201.tmp 2760 B2BC.tmp 2468 B319.tmp 1204 B377.tmp 752 B3D5.tmp 268 B432.tmp 760 B480.tmp 3036 B4ED.tmp 1500 B53B.tmp 1652 B589.tmp 1632 B5E7.tmp 1796 B645.tmp 1604 B6C1.tmp 1760 B72F.tmp 2120 B7BB.tmp 3048 B838.tmp 1144 B8B5.tmp 2368 B931.tmp 1420 B97F.tmp 1588 BA4A.tmp 2132 BAA8.tmp 1820 BB25.tmp 2680 BB82.tmp 2240 BC0F.tmp 1912 BC8B.tmp 1276 BD37.tmp 960 BDB4.tmp 1860 BEDC.tmp 1440 BF3A.tmp 1968 BFC6.tmp 1480 C024.tmp 2040 C091.tmp 2380 C14C.tmp 2036 C1B9.tmp 2808 C217.tmp 796 C284.tmp 928 C2F1.tmp 2060 C36E.tmp 852 C40A.tmp 2356 C4A6.tmp 832 C504.tmp 1556 C590.tmp 1564 C5FD.tmp 1992 C66B.tmp 112 C6C8.tmp 1148 C745.tmp 2016 C7A3.tmp 2640 C84E.tmp 2432 C8BB.tmp 2320 C919.tmp -
Loads dropped DLL 64 IoCs
pid Process 2212 7abcf145790298297a37200b4680ec95_mafia_JC.exe 2564 AD01.tmp 2188 AD6F.tmp 2024 ADBD.tmp 2284 AE0B.tmp 2224 AE68.tmp 2656 AED5.tmp 2792 AF33.tmp 1792 AF81.tmp 2508 AFDF.tmp 2936 B03C.tmp 2836 B09A.tmp 2276 B0F7.tmp 2880 B145.tmp 2084 B1A3.tmp 2940 B201.tmp 2760 B2BC.tmp 2468 B319.tmp 1204 B377.tmp 752 B3D5.tmp 268 B432.tmp 760 B480.tmp 3036 B4ED.tmp 1500 B53B.tmp 1652 B589.tmp 1632 B5E7.tmp 1796 B645.tmp 1604 B6C1.tmp 1760 B72F.tmp 2120 B7BB.tmp 3048 B838.tmp 1144 B8B5.tmp 2368 B931.tmp 1420 B97F.tmp 1588 BA4A.tmp 2132 BAA8.tmp 1820 BB25.tmp 2680 BB82.tmp 2240 BC0F.tmp 1912 BC8B.tmp 1276 BD37.tmp 960 BDB4.tmp 1860 BEDC.tmp 1440 BF3A.tmp 1968 BFC6.tmp 1480 C024.tmp 2040 C091.tmp 2380 C14C.tmp 2036 C1B9.tmp 2808 C217.tmp 796 C284.tmp 928 C2F1.tmp 2060 C36E.tmp 852 C40A.tmp 2356 C4A6.tmp 832 C504.tmp 1556 C590.tmp 1564 C5FD.tmp 1992 C66B.tmp 112 C6C8.tmp 1148 C745.tmp 2016 C7A3.tmp 2640 C84E.tmp 2432 C8BB.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2212 wrote to memory of 2564 2212 7abcf145790298297a37200b4680ec95_mafia_JC.exe 28 PID 2212 wrote to memory of 2564 2212 7abcf145790298297a37200b4680ec95_mafia_JC.exe 28 PID 2212 wrote to memory of 2564 2212 7abcf145790298297a37200b4680ec95_mafia_JC.exe 28 PID 2212 wrote to memory of 2564 2212 7abcf145790298297a37200b4680ec95_mafia_JC.exe 28 PID 2564 wrote to memory of 2188 2564 AD01.tmp 29 PID 2564 wrote to memory of 2188 2564 AD01.tmp 29 PID 2564 wrote to memory of 2188 2564 AD01.tmp 29 PID 2564 wrote to memory of 2188 2564 AD01.tmp 29 PID 2188 wrote to memory of 2024 2188 AD6F.tmp 30 PID 2188 wrote to memory of 2024 2188 AD6F.tmp 30 PID 2188 wrote to memory of 2024 2188 AD6F.tmp 30 PID 2188 wrote to memory of 2024 2188 AD6F.tmp 30 PID 2024 wrote to memory of 2284 2024 ADBD.tmp 31 PID 2024 wrote to memory of 2284 2024 ADBD.tmp 31 PID 2024 wrote to memory of 2284 2024 ADBD.tmp 31 PID 2024 wrote to memory of 2284 2024 ADBD.tmp 31 PID 2284 wrote to memory of 2224 2284 AE0B.tmp 54 PID 2284 wrote to memory of 2224 2284 AE0B.tmp 54 PID 2284 wrote to memory of 2224 2284 AE0B.tmp 54 PID 2284 wrote to memory of 2224 2284 AE0B.tmp 54 PID 2224 wrote to memory of 2656 2224 AE68.tmp 53 PID 2224 wrote to memory of 2656 2224 AE68.tmp 53 PID 2224 wrote to memory of 2656 2224 AE68.tmp 53 PID 2224 wrote to memory of 2656 2224 AE68.tmp 53 PID 2656 wrote to memory of 2792 2656 AED5.tmp 52 PID 2656 wrote to memory of 2792 2656 AED5.tmp 52 PID 2656 wrote to memory of 2792 2656 AED5.tmp 52 PID 2656 wrote to memory of 2792 2656 AED5.tmp 52 PID 2792 wrote to memory of 1792 2792 AF33.tmp 51 PID 2792 wrote to memory of 1792 2792 AF33.tmp 51 PID 2792 wrote to memory of 1792 2792 AF33.tmp 51 PID 2792 wrote to memory of 1792 2792 AF33.tmp 51 PID 1792 wrote to memory of 2508 1792 AF81.tmp 50 PID 1792 wrote to memory of 2508 1792 AF81.tmp 50 PID 1792 wrote to memory of 2508 1792 AF81.tmp 50 PID 1792 wrote to memory of 2508 1792 AF81.tmp 50 PID 2508 wrote to memory of 2936 2508 AFDF.tmp 49 PID 2508 wrote to memory of 2936 2508 AFDF.tmp 49 PID 2508 wrote to memory of 2936 2508 AFDF.tmp 49 PID 2508 wrote to memory of 2936 2508 AFDF.tmp 49 PID 2936 wrote to memory of 2836 2936 B03C.tmp 48 PID 2936 wrote to memory of 2836 2936 B03C.tmp 48 PID 2936 wrote to memory of 2836 2936 B03C.tmp 48 PID 2936 wrote to memory of 2836 2936 B03C.tmp 48 PID 2836 wrote to memory of 2276 2836 B09A.tmp 47 PID 2836 wrote to memory of 2276 2836 B09A.tmp 47 PID 2836 wrote to memory of 2276 2836 B09A.tmp 47 PID 2836 wrote to memory of 2276 2836 B09A.tmp 47 PID 2276 wrote to memory of 2880 2276 B0F7.tmp 46 PID 2276 wrote to memory of 2880 2276 B0F7.tmp 46 PID 2276 wrote to memory of 2880 2276 B0F7.tmp 46 PID 2276 wrote to memory of 2880 2276 B0F7.tmp 46 PID 2880 wrote to memory of 2084 2880 B145.tmp 32 PID 2880 wrote to memory of 2084 2880 B145.tmp 32 PID 2880 wrote to memory of 2084 2880 B145.tmp 32 PID 2880 wrote to memory of 2084 2880 B145.tmp 32 PID 2084 wrote to memory of 2940 2084 B1A3.tmp 45 PID 2084 wrote to memory of 2940 2084 B1A3.tmp 45 PID 2084 wrote to memory of 2940 2084 B1A3.tmp 45 PID 2084 wrote to memory of 2940 2084 B1A3.tmp 45 PID 2940 wrote to memory of 2760 2940 B201.tmp 44 PID 2940 wrote to memory of 2760 2940 B201.tmp 44 PID 2940 wrote to memory of 2760 2940 B201.tmp 44 PID 2940 wrote to memory of 2760 2940 B201.tmp 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\7abcf145790298297a37200b4680ec95_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\7abcf145790298297a37200b4680ec95_mafia_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\AD01.tmp"C:\Users\Admin\AppData\Local\Temp\AD01.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\AD6F.tmp"C:\Users\Admin\AppData\Local\Temp\AD6F.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\ADBD.tmp"C:\Users\Admin\AppData\Local\Temp\ADBD.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\AE0B.tmp"C:\Users\Admin\AppData\Local\Temp\AE0B.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\AE68.tmp"C:\Users\Admin\AppData\Local\Temp\AE68.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2224
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\B1A3.tmp"C:\Users\Admin\AppData\Local\Temp\B1A3.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\B201.tmp"C:\Users\Admin\AppData\Local\Temp\B201.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2940
-
-
C:\Users\Admin\AppData\Local\Temp\B53B.tmp"C:\Users\Admin\AppData\Local\Temp\B53B.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\B589.tmp"C:\Users\Admin\AppData\Local\Temp\B589.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\B5E7.tmp"C:\Users\Admin\AppData\Local\Temp\B5E7.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\B645.tmp"C:\Users\Admin\AppData\Local\Temp\B645.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\B6C1.tmp"C:\Users\Admin\AppData\Local\Temp\B6C1.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\B72F.tmp"C:\Users\Admin\AppData\Local\Temp\B72F.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\B7BB.tmp"C:\Users\Admin\AppData\Local\Temp\B7BB.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\B838.tmp"C:\Users\Admin\AppData\Local\Temp\B838.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\B8B5.tmp"C:\Users\Admin\AppData\Local\Temp\B8B5.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\B931.tmp"C:\Users\Admin\AppData\Local\Temp\B931.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\B97F.tmp"C:\Users\Admin\AppData\Local\Temp\B97F.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\BA4A.tmp"C:\Users\Admin\AppData\Local\Temp\BA4A.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\BAA8.tmp"C:\Users\Admin\AppData\Local\Temp\BAA8.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\BB25.tmp"C:\Users\Admin\AppData\Local\Temp\BB25.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\BB82.tmp"C:\Users\Admin\AppData\Local\Temp\BB82.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\BC0F.tmp"C:\Users\Admin\AppData\Local\Temp\BC0F.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\BC8B.tmp"C:\Users\Admin\AppData\Local\Temp\BC8B.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\BD37.tmp"C:\Users\Admin\AppData\Local\Temp\BD37.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\BDB4.tmp"C:\Users\Admin\AppData\Local\Temp\BDB4.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\BEDC.tmp"C:\Users\Admin\AppData\Local\Temp\BEDC.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\BF3A.tmp"C:\Users\Admin\AppData\Local\Temp\BF3A.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\C024.tmp"C:\Users\Admin\AppData\Local\Temp\C024.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\C091.tmp"C:\Users\Admin\AppData\Local\Temp\C091.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\C1B9.tmp"C:\Users\Admin\AppData\Local\Temp\C1B9.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\C217.tmp"C:\Users\Admin\AppData\Local\Temp\C217.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\C284.tmp"C:\Users\Admin\AppData\Local\Temp\C284.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:796 -
C:\Users\Admin\AppData\Local\Temp\C2F1.tmp"C:\Users\Admin\AppData\Local\Temp\C2F1.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:928 -
C:\Users\Admin\AppData\Local\Temp\C36E.tmp"C:\Users\Admin\AppData\Local\Temp\C36E.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\C40A.tmp"C:\Users\Admin\AppData\Local\Temp\C40A.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:852 -
C:\Users\Admin\AppData\Local\Temp\C4A6.tmp"C:\Users\Admin\AppData\Local\Temp\C4A6.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\C504.tmp"C:\Users\Admin\AppData\Local\Temp\C504.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:832 -
C:\Users\Admin\AppData\Local\Temp\C590.tmp"C:\Users\Admin\AppData\Local\Temp\C590.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\C5FD.tmp"C:\Users\Admin\AppData\Local\Temp\C5FD.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\C66B.tmp"C:\Users\Admin\AppData\Local\Temp\C66B.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\C6C8.tmp"C:\Users\Admin\AppData\Local\Temp\C6C8.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:112 -
C:\Users\Admin\AppData\Local\Temp\C745.tmp"C:\Users\Admin\AppData\Local\Temp\C745.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\C7A3.tmp"C:\Users\Admin\AppData\Local\Temp\C7A3.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\C84E.tmp"C:\Users\Admin\AppData\Local\Temp\C84E.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\C8BB.tmp"C:\Users\Admin\AppData\Local\Temp\C8BB.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\C919.tmp"C:\Users\Admin\AppData\Local\Temp\C919.tmp"42⤵
- Executes dropped EXE
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\C977.tmp"C:\Users\Admin\AppData\Local\Temp\C977.tmp"43⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\C9E4.tmp"C:\Users\Admin\AppData\Local\Temp\C9E4.tmp"44⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\CA51.tmp"C:\Users\Admin\AppData\Local\Temp\CA51.tmp"45⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\CADD.tmp"C:\Users\Admin\AppData\Local\Temp\CADD.tmp"46⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\CB4B.tmp"C:\Users\Admin\AppData\Local\Temp\CB4B.tmp"47⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\CBB8.tmp"C:\Users\Admin\AppData\Local\Temp\CBB8.tmp"48⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\CC35.tmp"C:\Users\Admin\AppData\Local\Temp\CC35.tmp"49⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\CCE0.tmp"C:\Users\Admin\AppData\Local\Temp\CCE0.tmp"50⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\CD2E.tmp"C:\Users\Admin\AppData\Local\Temp\CD2E.tmp"51⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\CD8C.tmp"C:\Users\Admin\AppData\Local\Temp\CD8C.tmp"52⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\CDE9.tmp"C:\Users\Admin\AppData\Local\Temp\CDE9.tmp"53⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\CE47.tmp"C:\Users\Admin\AppData\Local\Temp\CE47.tmp"54⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\CEB4.tmp"C:\Users\Admin\AppData\Local\Temp\CEB4.tmp"55⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\CF21.tmp"C:\Users\Admin\AppData\Local\Temp\CF21.tmp"56⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\CF7F.tmp"C:\Users\Admin\AppData\Local\Temp\CF7F.tmp"57⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\CFFC.tmp"C:\Users\Admin\AppData\Local\Temp\CFFC.tmp"58⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\D059.tmp"C:\Users\Admin\AppData\Local\Temp\D059.tmp"59⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\D0C7.tmp"C:\Users\Admin\AppData\Local\Temp\D0C7.tmp"60⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\D134.tmp"C:\Users\Admin\AppData\Local\Temp\D134.tmp"61⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\D1DF.tmp"C:\Users\Admin\AppData\Local\Temp\D1DF.tmp"62⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\D24D.tmp"C:\Users\Admin\AppData\Local\Temp\D24D.tmp"63⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\D2D9.tmp"C:\Users\Admin\AppData\Local\Temp\D2D9.tmp"64⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\D346.tmp"C:\Users\Admin\AppData\Local\Temp\D346.tmp"65⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\D3E2.tmp"C:\Users\Admin\AppData\Local\Temp\D3E2.tmp"66⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\D440.tmp"C:\Users\Admin\AppData\Local\Temp\D440.tmp"67⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\D49D.tmp"C:\Users\Admin\AppData\Local\Temp\D49D.tmp"68⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\D50B.tmp"C:\Users\Admin\AppData\Local\Temp\D50B.tmp"69⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\D578.tmp"C:\Users\Admin\AppData\Local\Temp\D578.tmp"70⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\D5E5.tmp"C:\Users\Admin\AppData\Local\Temp\D5E5.tmp"71⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\D662.tmp"C:\Users\Admin\AppData\Local\Temp\D662.tmp"72⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\D76B.tmp"C:\Users\Admin\AppData\Local\Temp\D76B.tmp"73⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\D7F7.tmp"C:\Users\Admin\AppData\Local\Temp\D7F7.tmp"74⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\D855.tmp"C:\Users\Admin\AppData\Local\Temp\D855.tmp"75⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\D8E1.tmp"C:\Users\Admin\AppData\Local\Temp\D8E1.tmp"76⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\D97D.tmp"C:\Users\Admin\AppData\Local\Temp\D97D.tmp"77⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\DA19.tmp"C:\Users\Admin\AppData\Local\Temp\DA19.tmp"78⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\DAA6.tmp"C:\Users\Admin\AppData\Local\Temp\DAA6.tmp"79⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\DB13.tmp"C:\Users\Admin\AppData\Local\Temp\DB13.tmp"80⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\DB80.tmp"C:\Users\Admin\AppData\Local\Temp\DB80.tmp"81⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\DBDE.tmp"C:\Users\Admin\AppData\Local\Temp\DBDE.tmp"82⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\DC4B.tmp"C:\Users\Admin\AppData\Local\Temp\DC4B.tmp"83⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\DCA9.tmp"C:\Users\Admin\AppData\Local\Temp\DCA9.tmp"84⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\DCF7.tmp"C:\Users\Admin\AppData\Local\Temp\DCF7.tmp"85⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\DD54.tmp"C:\Users\Admin\AppData\Local\Temp\DD54.tmp"86⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\DDC2.tmp"C:\Users\Admin\AppData\Local\Temp\DDC2.tmp"87⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\DE1F.tmp"C:\Users\Admin\AppData\Local\Temp\DE1F.tmp"88⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\DE6D.tmp"C:\Users\Admin\AppData\Local\Temp\DE6D.tmp"89⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\DEEA.tmp"C:\Users\Admin\AppData\Local\Temp\DEEA.tmp"90⤵PID:328
-
C:\Users\Admin\AppData\Local\Temp\DF48.tmp"C:\Users\Admin\AppData\Local\Temp\DF48.tmp"91⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\DFA5.tmp"C:\Users\Admin\AppData\Local\Temp\DFA5.tmp"92⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\E003.tmp"C:\Users\Admin\AppData\Local\Temp\E003.tmp"93⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\E060.tmp"C:\Users\Admin\AppData\Local\Temp\E060.tmp"94⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\E0CE.tmp"C:\Users\Admin\AppData\Local\Temp\E0CE.tmp"95⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\E11C.tmp"C:\Users\Admin\AppData\Local\Temp\E11C.tmp"96⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\E179.tmp"C:\Users\Admin\AppData\Local\Temp\E179.tmp"97⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\E1D7.tmp"C:\Users\Admin\AppData\Local\Temp\E1D7.tmp"98⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\E244.tmp"C:\Users\Admin\AppData\Local\Temp\E244.tmp"99⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\E2A2.tmp"C:\Users\Admin\AppData\Local\Temp\E2A2.tmp"100⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\E2FF.tmp"C:\Users\Admin\AppData\Local\Temp\E2FF.tmp"101⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\E38C.tmp"C:\Users\Admin\AppData\Local\Temp\E38C.tmp"102⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\E3F9.tmp"C:\Users\Admin\AppData\Local\Temp\E3F9.tmp"103⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\E456.tmp"C:\Users\Admin\AppData\Local\Temp\E456.tmp"104⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\E4C4.tmp"C:\Users\Admin\AppData\Local\Temp\E4C4.tmp"105⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\E521.tmp"C:\Users\Admin\AppData\Local\Temp\E521.tmp"106⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\E57F.tmp"C:\Users\Admin\AppData\Local\Temp\E57F.tmp"107⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"108⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"109⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\E772.tmp"C:\Users\Admin\AppData\Local\Temp\E772.tmp"110⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"111⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\E83D.tmp"C:\Users\Admin\AppData\Local\Temp\E83D.tmp"112⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\E89A.tmp"C:\Users\Admin\AppData\Local\Temp\E89A.tmp"113⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\E927.tmp"C:\Users\Admin\AppData\Local\Temp\E927.tmp"114⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\E984.tmp"C:\Users\Admin\AppData\Local\Temp\E984.tmp"115⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\E9E2.tmp"C:\Users\Admin\AppData\Local\Temp\E9E2.tmp"116⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\EA4F.tmp"C:\Users\Admin\AppData\Local\Temp\EA4F.tmp"117⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\EACC.tmp"C:\Users\Admin\AppData\Local\Temp\EACC.tmp"118⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\EB1A.tmp"C:\Users\Admin\AppData\Local\Temp\EB1A.tmp"119⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\EBA6.tmp"C:\Users\Admin\AppData\Local\Temp\EBA6.tmp"120⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\EC04.tmp"C:\Users\Admin\AppData\Local\Temp\EC04.tmp"121⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\EC71.tmp"C:\Users\Admin\AppData\Local\Temp\EC71.tmp"122⤵PID:2192
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-