Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2023, 17:11
Static task
static1
Behavioral task
behavioral1
Sample
7abcf145790298297a37200b4680ec95_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
7abcf145790298297a37200b4680ec95_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
7abcf145790298297a37200b4680ec95_mafia_JC.exe
-
Size
488KB
-
MD5
7abcf145790298297a37200b4680ec95
-
SHA1
a0bf9ae91d60e0dc0f2589305cb02e66c2e8622a
-
SHA256
fcdabdd7f735cf90b05b64432959c98b266e582dcc44a49b6bf4071a8d91e602
-
SHA512
14b076ebdf387a8c6fa657f3c411116bcf830715eba2295b0b5c907265e9e4bff0c68a05f7f9d45b4f50ee7e9f2ae1917948dca9f3e88b32c1bd0a94a2c3bd2e
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7Ox1i3U2q/3VV0E4AHcg454IxDR5dHUuMITRZ:/U5rCOTeiDw1i3UNz03Lc/WNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3444 8194.tmp 3804 828E.tmp 4968 832A.tmp 2932 83F5.tmp 4132 84DF.tmp 4896 857C.tmp 2248 8618.tmp 1768 86D3.tmp 632 8760.tmp 4196 886A.tmp 2428 8944.tmp 3016 8A00.tmp 5008 8AAC.tmp 4268 8BA6.tmp 3864 8C71.tmp 3356 8D3C.tmp 5064 8DD8.tmp 3680 8EE2.tmp 5004 8FAD.tmp 4412 91EF.tmp 3036 927C.tmp 2692 9328.tmp 3904 93F3.tmp 2468 94CE.tmp 1436 955A.tmp 2920 95E7.tmp 4924 9673.tmp 1392 971F.tmp 2476 97AC.tmp 4912 9877.tmp 4228 9981.tmp 3668 9A3C.tmp 4248 9B17.tmp 3576 9BA4.tmp 3580 9C11.tmp 3836 9C9E.tmp 2816 9D49.tmp 5076 9DC6.tmp 1340 9E53.tmp 3692 9EE0.tmp 560 9F5D.tmp 4696 9FE9.tmp 4952 A076.tmp 3860 A0F3.tmp 1792 A18F.tmp 2724 A23B.tmp 1276 A2D7.tmp 4684 A354.tmp 4556 A43F.tmp 4020 A4BC.tmp 1112 A577.tmp 3060 A613.tmp 4236 A6BF.tmp 3656 A72D.tmp 2240 A7AA.tmp 2904 A836.tmp 4840 A8D3.tmp 1212 A97E.tmp 1768 A9FB.tmp 4748 AA98.tmp 4620 AB15.tmp 4440 AB82.tmp 1400 ABEF.tmp 4376 AC6C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3328 wrote to memory of 3444 3328 7abcf145790298297a37200b4680ec95_mafia_JC.exe 83 PID 3328 wrote to memory of 3444 3328 7abcf145790298297a37200b4680ec95_mafia_JC.exe 83 PID 3328 wrote to memory of 3444 3328 7abcf145790298297a37200b4680ec95_mafia_JC.exe 83 PID 3444 wrote to memory of 3804 3444 8194.tmp 84 PID 3444 wrote to memory of 3804 3444 8194.tmp 84 PID 3444 wrote to memory of 3804 3444 8194.tmp 84 PID 3804 wrote to memory of 4968 3804 828E.tmp 85 PID 3804 wrote to memory of 4968 3804 828E.tmp 85 PID 3804 wrote to memory of 4968 3804 828E.tmp 85 PID 4968 wrote to memory of 2932 4968 832A.tmp 86 PID 4968 wrote to memory of 2932 4968 832A.tmp 86 PID 4968 wrote to memory of 2932 4968 832A.tmp 86 PID 2932 wrote to memory of 4132 2932 83F5.tmp 87 PID 2932 wrote to memory of 4132 2932 83F5.tmp 87 PID 2932 wrote to memory of 4132 2932 83F5.tmp 87 PID 4132 wrote to memory of 4896 4132 84DF.tmp 88 PID 4132 wrote to memory of 4896 4132 84DF.tmp 88 PID 4132 wrote to memory of 4896 4132 84DF.tmp 88 PID 4896 wrote to memory of 2248 4896 857C.tmp 89 PID 4896 wrote to memory of 2248 4896 857C.tmp 89 PID 4896 wrote to memory of 2248 4896 857C.tmp 89 PID 2248 wrote to memory of 1768 2248 8618.tmp 90 PID 2248 wrote to memory of 1768 2248 8618.tmp 90 PID 2248 wrote to memory of 1768 2248 8618.tmp 90 PID 1768 wrote to memory of 632 1768 86D3.tmp 91 PID 1768 wrote to memory of 632 1768 86D3.tmp 91 PID 1768 wrote to memory of 632 1768 86D3.tmp 91 PID 632 wrote to memory of 4196 632 8760.tmp 92 PID 632 wrote to memory of 4196 632 8760.tmp 92 PID 632 wrote to memory of 4196 632 8760.tmp 92 PID 4196 wrote to memory of 2428 4196 886A.tmp 93 PID 4196 wrote to memory of 2428 4196 886A.tmp 93 PID 4196 wrote to memory of 2428 4196 886A.tmp 93 PID 2428 wrote to memory of 3016 2428 8944.tmp 94 PID 2428 wrote to memory of 3016 2428 8944.tmp 94 PID 2428 wrote to memory of 3016 2428 8944.tmp 94 PID 3016 wrote to memory of 5008 3016 8A00.tmp 95 PID 3016 wrote to memory of 5008 3016 8A00.tmp 95 PID 3016 wrote to memory of 5008 3016 8A00.tmp 95 PID 5008 wrote to memory of 4268 5008 8AAC.tmp 96 PID 5008 wrote to memory of 4268 5008 8AAC.tmp 96 PID 5008 wrote to memory of 4268 5008 8AAC.tmp 96 PID 4268 wrote to memory of 3864 4268 8BA6.tmp 97 PID 4268 wrote to memory of 3864 4268 8BA6.tmp 97 PID 4268 wrote to memory of 3864 4268 8BA6.tmp 97 PID 3864 wrote to memory of 3356 3864 8C71.tmp 98 PID 3864 wrote to memory of 3356 3864 8C71.tmp 98 PID 3864 wrote to memory of 3356 3864 8C71.tmp 98 PID 3356 wrote to memory of 5064 3356 8D3C.tmp 101 PID 3356 wrote to memory of 5064 3356 8D3C.tmp 101 PID 3356 wrote to memory of 5064 3356 8D3C.tmp 101 PID 5064 wrote to memory of 3680 5064 8DD8.tmp 102 PID 5064 wrote to memory of 3680 5064 8DD8.tmp 102 PID 5064 wrote to memory of 3680 5064 8DD8.tmp 102 PID 3680 wrote to memory of 5004 3680 8EE2.tmp 103 PID 3680 wrote to memory of 5004 3680 8EE2.tmp 103 PID 3680 wrote to memory of 5004 3680 8EE2.tmp 103 PID 5004 wrote to memory of 4412 5004 8FAD.tmp 104 PID 5004 wrote to memory of 4412 5004 8FAD.tmp 104 PID 5004 wrote to memory of 4412 5004 8FAD.tmp 104 PID 4412 wrote to memory of 3036 4412 91EF.tmp 106 PID 4412 wrote to memory of 3036 4412 91EF.tmp 106 PID 4412 wrote to memory of 3036 4412 91EF.tmp 106 PID 3036 wrote to memory of 2692 3036 927C.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\7abcf145790298297a37200b4680ec95_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\7abcf145790298297a37200b4680ec95_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\8194.tmp"C:\Users\Admin\AppData\Local\Temp\8194.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\828E.tmp"C:\Users\Admin\AppData\Local\Temp\828E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\83F5.tmp"C:\Users\Admin\AppData\Local\Temp\83F5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\84DF.tmp"C:\Users\Admin\AppData\Local\Temp\84DF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\857C.tmp"C:\Users\Admin\AppData\Local\Temp\857C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\8618.tmp"C:\Users\Admin\AppData\Local\Temp\8618.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\86D3.tmp"C:\Users\Admin\AppData\Local\Temp\86D3.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\8760.tmp"C:\Users\Admin\AppData\Local\Temp\8760.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\886A.tmp"C:\Users\Admin\AppData\Local\Temp\886A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\8A00.tmp"C:\Users\Admin\AppData\Local\Temp\8A00.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\8C71.tmp"C:\Users\Admin\AppData\Local\Temp\8C71.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\91EF.tmp"C:\Users\Admin\AppData\Local\Temp\91EF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\927C.tmp"C:\Users\Admin\AppData\Local\Temp\927C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\9328.tmp"C:\Users\Admin\AppData\Local\Temp\9328.tmp"23⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\93F3.tmp"C:\Users\Admin\AppData\Local\Temp\93F3.tmp"24⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\94CE.tmp"C:\Users\Admin\AppData\Local\Temp\94CE.tmp"25⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"26⤵
- Executes dropped EXE
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\95E7.tmp"C:\Users\Admin\AppData\Local\Temp\95E7.tmp"27⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\9673.tmp"C:\Users\Admin\AppData\Local\Temp\9673.tmp"28⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"29⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"30⤵
- Executes dropped EXE
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\9877.tmp"C:\Users\Admin\AppData\Local\Temp\9877.tmp"31⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"32⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"33⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"34⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"35⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"36⤵
- Executes dropped EXE
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"37⤵
- Executes dropped EXE
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"38⤵
- Executes dropped EXE
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"39⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\9E53.tmp"C:\Users\Admin\AppData\Local\Temp\9E53.tmp"40⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"41⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"42⤵
- Executes dropped EXE
PID:560 -
C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"43⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\A076.tmp"C:\Users\Admin\AppData\Local\Temp\A076.tmp"44⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"45⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\A18F.tmp"C:\Users\Admin\AppData\Local\Temp\A18F.tmp"46⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\A23B.tmp"C:\Users\Admin\AppData\Local\Temp\A23B.tmp"47⤵
- Executes dropped EXE
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"48⤵
- Executes dropped EXE
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\A354.tmp"C:\Users\Admin\AppData\Local\Temp\A354.tmp"49⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\A43F.tmp"C:\Users\Admin\AppData\Local\Temp\A43F.tmp"50⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"51⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\A577.tmp"C:\Users\Admin\AppData\Local\Temp\A577.tmp"52⤵
- Executes dropped EXE
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\A613.tmp"C:\Users\Admin\AppData\Local\Temp\A613.tmp"53⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"54⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"55⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"56⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\A836.tmp"C:\Users\Admin\AppData\Local\Temp\A836.tmp"57⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"58⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"59⤵
- Executes dropped EXE
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"60⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"61⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\AB15.tmp"C:\Users\Admin\AppData\Local\Temp\AB15.tmp"62⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\AB82.tmp"C:\Users\Admin\AppData\Local\Temp\AB82.tmp"63⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"64⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"65⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"66⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\AD66.tmp"C:\Users\Admin\AppData\Local\Temp\AD66.tmp"67⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"68⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\AE60.tmp"C:\Users\Admin\AppData\Local\Temp\AE60.tmp"69⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"70⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"71⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"72⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\B093.tmp"C:\Users\Admin\AppData\Local\Temp\B093.tmp"73⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\B120.tmp"C:\Users\Admin\AppData\Local\Temp\B120.tmp"74⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\B19D.tmp"C:\Users\Admin\AppData\Local\Temp\B19D.tmp"75⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"76⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\B268.tmp"C:\Users\Admin\AppData\Local\Temp\B268.tmp"77⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"78⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\B371.tmp"C:\Users\Admin\AppData\Local\Temp\B371.tmp"79⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"80⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\B46B.tmp"C:\Users\Admin\AppData\Local\Temp\B46B.tmp"81⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"82⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"83⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"84⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\B650.tmp"C:\Users\Admin\AppData\Local\Temp\B650.tmp"85⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"86⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\B73A.tmp"C:\Users\Admin\AppData\Local\Temp\B73A.tmp"87⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\B798.tmp"C:\Users\Admin\AppData\Local\Temp\B798.tmp"88⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\B815.tmp"C:\Users\Admin\AppData\Local\Temp\B815.tmp"89⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\B882.tmp"C:\Users\Admin\AppData\Local\Temp\B882.tmp"90⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\B90F.tmp"C:\Users\Admin\AppData\Local\Temp\B90F.tmp"91⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"92⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\BA47.tmp"C:\Users\Admin\AppData\Local\Temp\BA47.tmp"93⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"94⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\BB32.tmp"C:\Users\Admin\AppData\Local\Temp\BB32.tmp"95⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"96⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"97⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"98⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\BD64.tmp"C:\Users\Admin\AppData\Local\Temp\BD64.tmp"99⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"100⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"101⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"102⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\BF77.tmp"C:\Users\Admin\AppData\Local\Temp\BF77.tmp"103⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\C004.tmp"C:\Users\Admin\AppData\Local\Temp\C004.tmp"104⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"105⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"106⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"107⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\C256.tmp"C:\Users\Admin\AppData\Local\Temp\C256.tmp"108⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"109⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\C35F.tmp"C:\Users\Admin\AppData\Local\Temp\C35F.tmp"110⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"111⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\C469.tmp"C:\Users\Admin\AppData\Local\Temp\C469.tmp"112⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"113⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\C582.tmp"C:\Users\Admin\AppData\Local\Temp\C582.tmp"114⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\C61F.tmp"C:\Users\Admin\AppData\Local\Temp\C61F.tmp"115⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"116⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\C747.tmp"C:\Users\Admin\AppData\Local\Temp\C747.tmp"117⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"118⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\C841.tmp"C:\Users\Admin\AppData\Local\Temp\C841.tmp"119⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\C90D.tmp"C:\Users\Admin\AppData\Local\Temp\C90D.tmp"120⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"121⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\CA45.tmp"C:\Users\Admin\AppData\Local\Temp\CA45.tmp"122⤵PID:3744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-