Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
27/08/2023, 14:27
Static task
static1
Behavioral task
behavioral1
Sample
aa6d9b6df6d5c85141103f4eadbd0bb4_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
aa6d9b6df6d5c85141103f4eadbd0bb4_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
aa6d9b6df6d5c85141103f4eadbd0bb4_mafia_JC.exe
-
Size
520KB
-
MD5
aa6d9b6df6d5c85141103f4eadbd0bb4
-
SHA1
6ba617fbc75606b418527b9113cf086b1637d8dc
-
SHA256
29f2f8ca8dcb6923a5ada0176f9d6c95568bb82e5a918822e4d10aacf841f9f8
-
SHA512
07b90dc88d523a9b46f07c4893790b1956807f28e4186ee373ee1493a59c1efc1ac6ce2b184c9eabf2dcbf8a1fa4c0f4d68742fd46b8f9e6846f6ab9e16459c8
-
SSDEEP
6144:Oj3Y8/pT2jXBuELD1CnLVrSXRib1JXf+lceZYrAhm9PG7eZ9FPMxOn39WmqmgsHT:XbB1mLVrSh8JAZnTC1PdhquNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2964 827E.tmp 4388 8359.tmp 2424 8424.tmp 4460 84EF.tmp 4432 8608.tmp 2724 8702.tmp 1904 87ED.tmp 4068 8899.tmp 4064 8983.tmp 3188 8A1F.tmp 4356 8ADB.tmp 4600 8BC5.tmp 940 8CA0.tmp 5008 8D6B.tmp 5040 8E17.tmp 2732 8F6F.tmp 1136 902A.tmp 4136 90D6.tmp 4100 9191.tmp 4620 925D.tmp 4280 9366.tmp 3748 9441.tmp 2716 952B.tmp 1128 95F6.tmp 796 9693.tmp 4836 976D.tmp 472 980A.tmp 4636 98F4.tmp 4984 99DE.tmp 2368 9A8A.tmp 532 9B17.tmp 3540 9BF2.tmp 4548 9C9E.tmp 5000 9D2A.tmp 4728 9DD6.tmp 3928 9E63.tmp 4368 9EEF.tmp 4008 9F8C.tmp 2124 A037.tmp 4380 A0E3.tmp 1036 A170.tmp 2964 A1ED.tmp 1364 A26A.tmp 2176 A316.tmp 2456 A393.tmp 5076 A410.tmp 4460 A48D.tmp 2136 A519.tmp 1272 A596.tmp 4616 A633.tmp 2808 A6BF.tmp 1468 A75C.tmp 4844 A7D9.tmp 4856 A875.tmp 4848 A8F2.tmp 3548 A95F.tmp 3004 A9FB.tmp 4408 AA69.tmp 5044 AAE6.tmp 2316 AB72.tmp 4980 ABFF.tmp 3188 AC7C.tmp 2812 AD09.tmp 4608 AD86.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4472 wrote to memory of 2964 4472 aa6d9b6df6d5c85141103f4eadbd0bb4_mafia_JC.exe 81 PID 4472 wrote to memory of 2964 4472 aa6d9b6df6d5c85141103f4eadbd0bb4_mafia_JC.exe 81 PID 4472 wrote to memory of 2964 4472 aa6d9b6df6d5c85141103f4eadbd0bb4_mafia_JC.exe 81 PID 2964 wrote to memory of 4388 2964 827E.tmp 82 PID 2964 wrote to memory of 4388 2964 827E.tmp 82 PID 2964 wrote to memory of 4388 2964 827E.tmp 82 PID 4388 wrote to memory of 2424 4388 8359.tmp 83 PID 4388 wrote to memory of 2424 4388 8359.tmp 83 PID 4388 wrote to memory of 2424 4388 8359.tmp 83 PID 2424 wrote to memory of 4460 2424 8424.tmp 84 PID 2424 wrote to memory of 4460 2424 8424.tmp 84 PID 2424 wrote to memory of 4460 2424 8424.tmp 84 PID 4460 wrote to memory of 4432 4460 84EF.tmp 85 PID 4460 wrote to memory of 4432 4460 84EF.tmp 85 PID 4460 wrote to memory of 4432 4460 84EF.tmp 85 PID 4432 wrote to memory of 2724 4432 8608.tmp 86 PID 4432 wrote to memory of 2724 4432 8608.tmp 86 PID 4432 wrote to memory of 2724 4432 8608.tmp 86 PID 2724 wrote to memory of 1904 2724 8702.tmp 87 PID 2724 wrote to memory of 1904 2724 8702.tmp 87 PID 2724 wrote to memory of 1904 2724 8702.tmp 87 PID 1904 wrote to memory of 4068 1904 87ED.tmp 88 PID 1904 wrote to memory of 4068 1904 87ED.tmp 88 PID 1904 wrote to memory of 4068 1904 87ED.tmp 88 PID 4068 wrote to memory of 4064 4068 8899.tmp 89 PID 4068 wrote to memory of 4064 4068 8899.tmp 89 PID 4068 wrote to memory of 4064 4068 8899.tmp 89 PID 4064 wrote to memory of 3188 4064 8983.tmp 90 PID 4064 wrote to memory of 3188 4064 8983.tmp 90 PID 4064 wrote to memory of 3188 4064 8983.tmp 90 PID 3188 wrote to memory of 4356 3188 8A1F.tmp 91 PID 3188 wrote to memory of 4356 3188 8A1F.tmp 91 PID 3188 wrote to memory of 4356 3188 8A1F.tmp 91 PID 4356 wrote to memory of 4600 4356 8ADB.tmp 92 PID 4356 wrote to memory of 4600 4356 8ADB.tmp 92 PID 4356 wrote to memory of 4600 4356 8ADB.tmp 92 PID 4600 wrote to memory of 940 4600 8BC5.tmp 93 PID 4600 wrote to memory of 940 4600 8BC5.tmp 93 PID 4600 wrote to memory of 940 4600 8BC5.tmp 93 PID 940 wrote to memory of 5008 940 8CA0.tmp 94 PID 940 wrote to memory of 5008 940 8CA0.tmp 94 PID 940 wrote to memory of 5008 940 8CA0.tmp 94 PID 5008 wrote to memory of 5040 5008 8D6B.tmp 95 PID 5008 wrote to memory of 5040 5008 8D6B.tmp 95 PID 5008 wrote to memory of 5040 5008 8D6B.tmp 95 PID 5040 wrote to memory of 2732 5040 8E17.tmp 96 PID 5040 wrote to memory of 2732 5040 8E17.tmp 96 PID 5040 wrote to memory of 2732 5040 8E17.tmp 96 PID 2732 wrote to memory of 1136 2732 8F6F.tmp 97 PID 2732 wrote to memory of 1136 2732 8F6F.tmp 97 PID 2732 wrote to memory of 1136 2732 8F6F.tmp 97 PID 1136 wrote to memory of 4136 1136 902A.tmp 98 PID 1136 wrote to memory of 4136 1136 902A.tmp 98 PID 1136 wrote to memory of 4136 1136 902A.tmp 98 PID 4136 wrote to memory of 4100 4136 90D6.tmp 101 PID 4136 wrote to memory of 4100 4136 90D6.tmp 101 PID 4136 wrote to memory of 4100 4136 90D6.tmp 101 PID 4100 wrote to memory of 4620 4100 9191.tmp 102 PID 4100 wrote to memory of 4620 4100 9191.tmp 102 PID 4100 wrote to memory of 4620 4100 9191.tmp 102 PID 4620 wrote to memory of 4280 4620 925D.tmp 103 PID 4620 wrote to memory of 4280 4620 925D.tmp 103 PID 4620 wrote to memory of 4280 4620 925D.tmp 103 PID 4280 wrote to memory of 3748 4280 9366.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa6d9b6df6d5c85141103f4eadbd0bb4_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\aa6d9b6df6d5c85141103f4eadbd0bb4_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\827E.tmp"C:\Users\Admin\AppData\Local\Temp\827E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\8359.tmp"C:\Users\Admin\AppData\Local\Temp\8359.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\8424.tmp"C:\Users\Admin\AppData\Local\Temp\8424.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\84EF.tmp"C:\Users\Admin\AppData\Local\Temp\84EF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\8608.tmp"C:\Users\Admin\AppData\Local\Temp\8608.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\8702.tmp"C:\Users\Admin\AppData\Local\Temp\8702.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\8899.tmp"C:\Users\Admin\AppData\Local\Temp\8899.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\8983.tmp"C:\Users\Admin\AppData\Local\Temp\8983.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\8E17.tmp"C:\Users\Admin\AppData\Local\Temp\8E17.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\902A.tmp"C:\Users\Admin\AppData\Local\Temp\902A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\9191.tmp"C:\Users\Admin\AppData\Local\Temp\9191.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\9366.tmp"C:\Users\Admin\AppData\Local\Temp\9366.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\9441.tmp"C:\Users\Admin\AppData\Local\Temp\9441.tmp"23⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"24⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\95F6.tmp"C:\Users\Admin\AppData\Local\Temp\95F6.tmp"25⤵
- Executes dropped EXE
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\9693.tmp"C:\Users\Admin\AppData\Local\Temp\9693.tmp"26⤵
- Executes dropped EXE
PID:796 -
C:\Users\Admin\AppData\Local\Temp\976D.tmp"C:\Users\Admin\AppData\Local\Temp\976D.tmp"27⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"28⤵
- Executes dropped EXE
PID:472 -
C:\Users\Admin\AppData\Local\Temp\98F4.tmp"C:\Users\Admin\AppData\Local\Temp\98F4.tmp"29⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"30⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"31⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"32⤵
- Executes dropped EXE
PID:532 -
C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"33⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"34⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"35⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"36⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\9E63.tmp"C:\Users\Admin\AppData\Local\Temp\9E63.tmp"37⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"38⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"39⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"40⤵
- Executes dropped EXE
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"41⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"42⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"43⤵
- Executes dropped EXE
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\A26A.tmp"C:\Users\Admin\AppData\Local\Temp\A26A.tmp"44⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"45⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"46⤵
- Executes dropped EXE
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\A410.tmp"C:\Users\Admin\AppData\Local\Temp\A410.tmp"47⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"48⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\A519.tmp"C:\Users\Admin\AppData\Local\Temp\A519.tmp"49⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"50⤵
- Executes dropped EXE
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\A633.tmp"C:\Users\Admin\AppData\Local\Temp\A633.tmp"51⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"52⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"53⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"54⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"55⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"56⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"57⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"58⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\AA69.tmp"C:\Users\Admin\AppData\Local\Temp\AA69.tmp"59⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"60⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\AB72.tmp"C:\Users\Admin\AppData\Local\Temp\AB72.tmp"61⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"62⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"63⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\AD09.tmp"C:\Users\Admin\AppData\Local\Temp\AD09.tmp"64⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"65⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"66⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\AE60.tmp"C:\Users\Admin\AppData\Local\Temp\AE60.tmp"67⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\AECE.tmp"C:\Users\Admin\AppData\Local\Temp\AECE.tmp"68⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"69⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"70⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\B083.tmp"C:\Users\Admin\AppData\Local\Temp\B083.tmp"71⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\B100.tmp"C:\Users\Admin\AppData\Local\Temp\B100.tmp"72⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\B17D.tmp"C:\Users\Admin\AppData\Local\Temp\B17D.tmp"73⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\B20A.tmp"C:\Users\Admin\AppData\Local\Temp\B20A.tmp"74⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"75⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"76⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\B381.tmp"C:\Users\Admin\AppData\Local\Temp\B381.tmp"77⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"78⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\B48B.tmp"C:\Users\Admin\AppData\Local\Temp\B48B.tmp"79⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\B536.tmp"C:\Users\Admin\AppData\Local\Temp\B536.tmp"80⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"81⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\B640.tmp"C:\Users\Admin\AppData\Local\Temp\B640.tmp"82⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"83⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\B779.tmp"C:\Users\Admin\AppData\Local\Temp\B779.tmp"84⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\B815.tmp"C:\Users\Admin\AppData\Local\Temp\B815.tmp"85⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\B882.tmp"C:\Users\Admin\AppData\Local\Temp\B882.tmp"86⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\B91E.tmp"C:\Users\Admin\AppData\Local\Temp\B91E.tmp"87⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"88⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\BA28.tmp"C:\Users\Admin\AppData\Local\Temp\BA28.tmp"89⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"90⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\BB41.tmp"C:\Users\Admin\AppData\Local\Temp\BB41.tmp"91⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"92⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"93⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"94⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\BD45.tmp"C:\Users\Admin\AppData\Local\Temp\BD45.tmp"95⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"96⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"97⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"98⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\BF68.tmp"C:\Users\Admin\AppData\Local\Temp\BF68.tmp"99⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"100⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\C071.tmp"C:\Users\Admin\AppData\Local\Temp\C071.tmp"101⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\C10E.tmp"C:\Users\Admin\AppData\Local\Temp\C10E.tmp"102⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\C18B.tmp"C:\Users\Admin\AppData\Local\Temp\C18B.tmp"103⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\C208.tmp"C:\Users\Admin\AppData\Local\Temp\C208.tmp"104⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\C285.tmp"C:\Users\Admin\AppData\Local\Temp\C285.tmp"105⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\C311.tmp"C:\Users\Admin\AppData\Local\Temp\C311.tmp"106⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\C39E.tmp"C:\Users\Admin\AppData\Local\Temp\C39E.tmp"107⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\C43A.tmp"C:\Users\Admin\AppData\Local\Temp\C43A.tmp"108⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"109⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\C573.tmp"C:\Users\Admin\AppData\Local\Temp\C573.tmp"110⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"111⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\C63E.tmp"C:\Users\Admin\AppData\Local\Temp\C63E.tmp"112⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"113⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\C719.tmp"C:\Users\Admin\AppData\Local\Temp\C719.tmp"114⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"115⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\C841.tmp"C:\Users\Admin\AppData\Local\Temp\C841.tmp"116⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"117⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\C95B.tmp"C:\Users\Admin\AppData\Local\Temp\C95B.tmp"118⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\C9D8.tmp"C:\Users\Admin\AppData\Local\Temp\C9D8.tmp"119⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\CA55.tmp"C:\Users\Admin\AppData\Local\Temp\CA55.tmp"120⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"121⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"122⤵PID:4408
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-