Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
28/08/2023, 16:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bd695d83a819eec597016d1542f8f667_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
bd695d83a819eec597016d1542f8f667_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
bd695d83a819eec597016d1542f8f667_mafia_JC.exe
-
Size
486KB
-
MD5
bd695d83a819eec597016d1542f8f667
-
SHA1
6c026656b729d783e2bf68ebd8996d3390d0789c
-
SHA256
f7f251bcbf9185875b39e75a3d8ee4b26796d7e6e7ca1d018b0a0a2da0d71b11
-
SHA512
efe0eae722ede4e2ae3ba37d718f316696421732f2e59bcf2f611f02f31eb1d362283e7b4a2c47f142d92e3defb8f427f1710d34d7438e68e1264cfa52eedbda
-
SSDEEP
12288:/U5rCOTeiDdCALdbl3utR/EcHwzQlcNZ:/UQOJDdh3utRNH3cN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 548 7B48.tmp 2840 7BD4.tmp 2948 7CCE.tmp 2820 7DB8.tmp 2504 7E54.tmp 2752 7F0F.tmp 2624 7FCA.tmp 2900 8085.tmp 2748 8160.tmp 2392 81FC.tmp 268 82C7.tmp 796 8391.tmp 772 845C.tmp 1204 8537.tmp 3052 85C3.tmp 2088 866F.tmp 2384 8768.tmp 2056 8862.tmp 2012 894C.tmp 2024 89F7.tmp 2196 8B10.tmp 2200 8BDB.tmp 3060 8C96.tmp 3032 8D9F.tmp 2684 8E89.tmp 2256 8F16.tmp 1076 8F93.tmp 2172 9000.tmp 2544 907D.tmp 1348 90DA.tmp 2480 9138.tmp 1580 91A5.tmp 2516 9231.tmp 2308 92AE.tmp 1152 931B.tmp 1020 9389.tmp 2332 93F6.tmp 840 9463.tmp 1552 94E0.tmp 1664 956C.tmp 1328 95D9.tmp 1036 9666.tmp 1560 96C3.tmp 1084 9731.tmp 908 979E.tmp 936 980B.tmp 1396 9878.tmp 2796 98D6.tmp 3056 9943.tmp 1248 99A1.tmp 2272 9A0E.tmp 2800 9A6B.tmp 2508 9AE8.tmp 2080 9B65.tmp 3004 9BD2.tmp 1708 9C30.tmp 2064 9CAD.tmp 548 9D39.tmp 2928 9D97.tmp 2156 9E04.tmp 2976 9E61.tmp 2844 9ECF.tmp 2432 9F3C.tmp 2504 9F99.tmp -
Loads dropped DLL 64 IoCs
pid Process 2296 bd695d83a819eec597016d1542f8f667_mafia_JC.exe 548 7B48.tmp 2840 7BD4.tmp 2948 7CCE.tmp 2820 7DB8.tmp 2504 7E54.tmp 2752 7F0F.tmp 2624 7FCA.tmp 2900 8085.tmp 2748 8160.tmp 2392 81FC.tmp 268 82C7.tmp 796 8391.tmp 772 845C.tmp 1204 8537.tmp 3052 85C3.tmp 2088 866F.tmp 2384 8768.tmp 2056 8862.tmp 2012 894C.tmp 2024 89F7.tmp 2196 8B10.tmp 2200 8BDB.tmp 3060 8C96.tmp 3032 8D9F.tmp 2684 8E89.tmp 2256 8F16.tmp 1076 8F93.tmp 2172 9000.tmp 2544 907D.tmp 1348 90DA.tmp 2480 9138.tmp 1580 91A5.tmp 2516 9231.tmp 2308 92AE.tmp 1152 931B.tmp 1020 9389.tmp 2332 93F6.tmp 840 9463.tmp 1552 94E0.tmp 1664 956C.tmp 1328 95D9.tmp 1036 9666.tmp 1560 96C3.tmp 1084 9731.tmp 908 979E.tmp 936 980B.tmp 1396 9878.tmp 2796 98D6.tmp 3056 9943.tmp 1248 99A1.tmp 2272 9A0E.tmp 2800 9A6B.tmp 2508 9AE8.tmp 2080 9B65.tmp 3004 9BD2.tmp 1708 9C30.tmp 2064 9CAD.tmp 548 9D39.tmp 2928 9D97.tmp 2156 9E04.tmp 2976 9E61.tmp 2844 9ECF.tmp 2432 9F3C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2296 wrote to memory of 548 2296 bd695d83a819eec597016d1542f8f667_mafia_JC.exe 16 PID 2296 wrote to memory of 548 2296 bd695d83a819eec597016d1542f8f667_mafia_JC.exe 16 PID 2296 wrote to memory of 548 2296 bd695d83a819eec597016d1542f8f667_mafia_JC.exe 16 PID 2296 wrote to memory of 548 2296 bd695d83a819eec597016d1542f8f667_mafia_JC.exe 16 PID 548 wrote to memory of 2840 548 7B48.tmp 15 PID 548 wrote to memory of 2840 548 7B48.tmp 15 PID 548 wrote to memory of 2840 548 7B48.tmp 15 PID 548 wrote to memory of 2840 548 7B48.tmp 15 PID 2840 wrote to memory of 2948 2840 7BD4.tmp 14 PID 2840 wrote to memory of 2948 2840 7BD4.tmp 14 PID 2840 wrote to memory of 2948 2840 7BD4.tmp 14 PID 2840 wrote to memory of 2948 2840 7BD4.tmp 14 PID 2948 wrote to memory of 2820 2948 7CCE.tmp 13 PID 2948 wrote to memory of 2820 2948 7CCE.tmp 13 PID 2948 wrote to memory of 2820 2948 7CCE.tmp 13 PID 2948 wrote to memory of 2820 2948 7CCE.tmp 13 PID 2820 wrote to memory of 2504 2820 7DB8.tmp 12 PID 2820 wrote to memory of 2504 2820 7DB8.tmp 12 PID 2820 wrote to memory of 2504 2820 7DB8.tmp 12 PID 2820 wrote to memory of 2504 2820 7DB8.tmp 12 PID 2504 wrote to memory of 2752 2504 7E54.tmp 11 PID 2504 wrote to memory of 2752 2504 7E54.tmp 11 PID 2504 wrote to memory of 2752 2504 7E54.tmp 11 PID 2504 wrote to memory of 2752 2504 7E54.tmp 11 PID 2752 wrote to memory of 2624 2752 7F0F.tmp 10 PID 2752 wrote to memory of 2624 2752 7F0F.tmp 10 PID 2752 wrote to memory of 2624 2752 7F0F.tmp 10 PID 2752 wrote to memory of 2624 2752 7F0F.tmp 10 PID 2624 wrote to memory of 2900 2624 7FCA.tmp 9 PID 2624 wrote to memory of 2900 2624 7FCA.tmp 9 PID 2624 wrote to memory of 2900 2624 7FCA.tmp 9 PID 2624 wrote to memory of 2900 2624 7FCA.tmp 9 PID 2900 wrote to memory of 2748 2900 8085.tmp 8 PID 2900 wrote to memory of 2748 2900 8085.tmp 8 PID 2900 wrote to memory of 2748 2900 8085.tmp 8 PID 2900 wrote to memory of 2748 2900 8085.tmp 8 PID 2748 wrote to memory of 2392 2748 8160.tmp 7 PID 2748 wrote to memory of 2392 2748 8160.tmp 7 PID 2748 wrote to memory of 2392 2748 8160.tmp 7 PID 2748 wrote to memory of 2392 2748 8160.tmp 7 PID 2392 wrote to memory of 268 2392 81FC.tmp 6 PID 2392 wrote to memory of 268 2392 81FC.tmp 6 PID 2392 wrote to memory of 268 2392 81FC.tmp 6 PID 2392 wrote to memory of 268 2392 81FC.tmp 6 PID 268 wrote to memory of 796 268 82C7.tmp 5 PID 268 wrote to memory of 796 268 82C7.tmp 5 PID 268 wrote to memory of 796 268 82C7.tmp 5 PID 268 wrote to memory of 796 268 82C7.tmp 5 PID 796 wrote to memory of 772 796 8391.tmp 4 PID 796 wrote to memory of 772 796 8391.tmp 4 PID 796 wrote to memory of 772 796 8391.tmp 4 PID 796 wrote to memory of 772 796 8391.tmp 4 PID 772 wrote to memory of 1204 772 845C.tmp 3 PID 772 wrote to memory of 1204 772 845C.tmp 3 PID 772 wrote to memory of 1204 772 845C.tmp 3 PID 772 wrote to memory of 1204 772 845C.tmp 3 PID 1204 wrote to memory of 3052 1204 8537.tmp 2 PID 1204 wrote to memory of 3052 1204 8537.tmp 2 PID 1204 wrote to memory of 3052 1204 8537.tmp 2 PID 1204 wrote to memory of 3052 1204 8537.tmp 2 PID 3052 wrote to memory of 2088 3052 85C3.tmp 1 PID 3052 wrote to memory of 2088 3052 85C3.tmp 1 PID 3052 wrote to memory of 2088 3052 85C3.tmp 1 PID 3052 wrote to memory of 2088 3052 85C3.tmp 1
Processes
-
C:\Users\Admin\AppData\Local\Temp\866F.tmp"C:\Users\Admin\AppData\Local\Temp\866F.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\8768.tmp"C:\Users\Admin\AppData\Local\Temp\8768.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\8862.tmp"C:\Users\Admin\AppData\Local\Temp\8862.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\894C.tmp"C:\Users\Admin\AppData\Local\Temp\894C.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\89F7.tmp"C:\Users\Admin\AppData\Local\Temp\89F7.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\8B10.tmp"C:\Users\Admin\AppData\Local\Temp\8B10.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\8BDB.tmp"C:\Users\Admin\AppData\Local\Temp\8BDB.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\8C96.tmp"C:\Users\Admin\AppData\Local\Temp\8C96.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\8D9F.tmp"C:\Users\Admin\AppData\Local\Temp\8D9F.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\8E89.tmp"C:\Users\Admin\AppData\Local\Temp\8E89.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\8F16.tmp"C:\Users\Admin\AppData\Local\Temp\8F16.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\8F93.tmp"C:\Users\Admin\AppData\Local\Temp\8F93.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\9000.tmp"C:\Users\Admin\AppData\Local\Temp\9000.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\907D.tmp"C:\Users\Admin\AppData\Local\Temp\907D.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\90DA.tmp"C:\Users\Admin\AppData\Local\Temp\90DA.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\9138.tmp"C:\Users\Admin\AppData\Local\Temp\9138.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\91A5.tmp"C:\Users\Admin\AppData\Local\Temp\91A5.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\9231.tmp"C:\Users\Admin\AppData\Local\Temp\9231.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\92AE.tmp"C:\Users\Admin\AppData\Local\Temp\92AE.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\931B.tmp"C:\Users\Admin\AppData\Local\Temp\931B.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\9389.tmp"C:\Users\Admin\AppData\Local\Temp\9389.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\93F6.tmp"C:\Users\Admin\AppData\Local\Temp\93F6.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\9463.tmp"C:\Users\Admin\AppData\Local\Temp\9463.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840 -
C:\Users\Admin\AppData\Local\Temp\94E0.tmp"C:\Users\Admin\AppData\Local\Temp\94E0.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\956C.tmp"C:\Users\Admin\AppData\Local\Temp\956C.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\95D9.tmp"C:\Users\Admin\AppData\Local\Temp\95D9.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\9666.tmp"C:\Users\Admin\AppData\Local\Temp\9666.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\96C3.tmp"C:\Users\Admin\AppData\Local\Temp\96C3.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\9731.tmp"C:\Users\Admin\AppData\Local\Temp\9731.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\979E.tmp"C:\Users\Admin\AppData\Local\Temp\979E.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:908 -
C:\Users\Admin\AppData\Local\Temp\980B.tmp"C:\Users\Admin\AppData\Local\Temp\980B.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:936 -
C:\Users\Admin\AppData\Local\Temp\9878.tmp"C:\Users\Admin\AppData\Local\Temp\9878.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\98D6.tmp"C:\Users\Admin\AppData\Local\Temp\98D6.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\9943.tmp"C:\Users\Admin\AppData\Local\Temp\9943.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\99A1.tmp"C:\Users\Admin\AppData\Local\Temp\99A1.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\9A0E.tmp"C:\Users\Admin\AppData\Local\Temp\9A0E.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\9D39.tmp"C:\Users\Admin\AppData\Local\Temp\9D39.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:548 -
C:\Users\Admin\AppData\Local\Temp\9D97.tmp"C:\Users\Admin\AppData\Local\Temp\9D97.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\9E04.tmp"C:\Users\Admin\AppData\Local\Temp\9E04.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\9E61.tmp"C:\Users\Admin\AppData\Local\Temp\9E61.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\9ECF.tmp"C:\Users\Admin\AppData\Local\Temp\9ECF.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\9F3C.tmp"C:\Users\Admin\AppData\Local\Temp\9F3C.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\9F99.tmp"C:\Users\Admin\AppData\Local\Temp\9F99.tmp"49⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\A007.tmp"C:\Users\Admin\AppData\Local\Temp\A007.tmp"50⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\A074.tmp"C:\Users\Admin\AppData\Local\Temp\A074.tmp"51⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\A0F1.tmp"C:\Users\Admin\AppData\Local\Temp\A0F1.tmp"52⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\A14E.tmp"C:\Users\Admin\AppData\Local\Temp\A14E.tmp"53⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\A1CB.tmp"C:\Users\Admin\AppData\Local\Temp\A1CB.tmp"54⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\A303.tmp"C:\Users\Admin\AppData\Local\Temp\A303.tmp"55⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\A380.tmp"C:\Users\Admin\AppData\Local\Temp\A380.tmp"56⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\A3ED.tmp"C:\Users\Admin\AppData\Local\Temp\A3ED.tmp"57⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\A43B.tmp"C:\Users\Admin\AppData\Local\Temp\A43B.tmp"58⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\A499.tmp"C:\Users\Admin\AppData\Local\Temp\A499.tmp"59⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\A4E7.tmp"C:\Users\Admin\AppData\Local\Temp\A4E7.tmp"60⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\A563.tmp"C:\Users\Admin\AppData\Local\Temp\A563.tmp"61⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\A5E0.tmp"C:\Users\Admin\AppData\Local\Temp\A5E0.tmp"62⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\A63E.tmp"C:\Users\Admin\AppData\Local\Temp\A63E.tmp"63⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\A69B.tmp"C:\Users\Admin\AppData\Local\Temp\A69B.tmp"64⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\A6E9.tmp"C:\Users\Admin\AppData\Local\Temp\A6E9.tmp"65⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\A757.tmp"C:\Users\Admin\AppData\Local\Temp\A757.tmp"66⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\A7C4.tmp"C:\Users\Admin\AppData\Local\Temp\A7C4.tmp"67⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\A831.tmp"C:\Users\Admin\AppData\Local\Temp\A831.tmp"68⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\A89E.tmp"C:\Users\Admin\AppData\Local\Temp\A89E.tmp"69⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\A91B.tmp"C:\Users\Admin\AppData\Local\Temp\A91B.tmp"70⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\A988.tmp"C:\Users\Admin\AppData\Local\Temp\A988.tmp"71⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\AA05.tmp"C:\Users\Admin\AppData\Local\Temp\AA05.tmp"72⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\AA72.tmp"C:\Users\Admin\AppData\Local\Temp\AA72.tmp"73⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\AADF.tmp"C:\Users\Admin\AppData\Local\Temp\AADF.tmp"74⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\AB4D.tmp"C:\Users\Admin\AppData\Local\Temp\AB4D.tmp"75⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\ABBA.tmp"C:\Users\Admin\AppData\Local\Temp\ABBA.tmp"76⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\AC17.tmp"C:\Users\Admin\AppData\Local\Temp\AC17.tmp"77⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\AC94.tmp"C:\Users\Admin\AppData\Local\Temp\AC94.tmp"78⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\AD01.tmp"C:\Users\Admin\AppData\Local\Temp\AD01.tmp"79⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\AD6F.tmp"C:\Users\Admin\AppData\Local\Temp\AD6F.tmp"80⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\ADDC.tmp"C:\Users\Admin\AppData\Local\Temp\ADDC.tmp"81⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\AE49.tmp"C:\Users\Admin\AppData\Local\Temp\AE49.tmp"82⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\AEA7.tmp"C:\Users\Admin\AppData\Local\Temp\AEA7.tmp"83⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\AF23.tmp"C:\Users\Admin\AppData\Local\Temp\AF23.tmp"84⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\AF81.tmp"C:\Users\Admin\AppData\Local\Temp\AF81.tmp"85⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\AFEE.tmp"C:\Users\Admin\AppData\Local\Temp\AFEE.tmp"86⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\B07B.tmp"C:\Users\Admin\AppData\Local\Temp\B07B.tmp"87⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\B0E8.tmp"C:\Users\Admin\AppData\Local\Temp\B0E8.tmp"88⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\B155.tmp"C:\Users\Admin\AppData\Local\Temp\B155.tmp"89⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"90⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\B23F.tmp"C:\Users\Admin\AppData\Local\Temp\B23F.tmp"91⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"92⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\B319.tmp"C:\Users\Admin\AppData\Local\Temp\B319.tmp"93⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\B396.tmp"C:\Users\Admin\AppData\Local\Temp\B396.tmp"94⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\B403.tmp"C:\Users\Admin\AppData\Local\Temp\B403.tmp"95⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\B471.tmp"C:\Users\Admin\AppData\Local\Temp\B471.tmp"96⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\B4CE.tmp"C:\Users\Admin\AppData\Local\Temp\B4CE.tmp"97⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\B53B.tmp"C:\Users\Admin\AppData\Local\Temp\B53B.tmp"98⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\B599.tmp"C:\Users\Admin\AppData\Local\Temp\B599.tmp"99⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\B606.tmp"C:\Users\Admin\AppData\Local\Temp\B606.tmp"100⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\B664.tmp"C:\Users\Admin\AppData\Local\Temp\B664.tmp"101⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\B6D1.tmp"C:\Users\Admin\AppData\Local\Temp\B6D1.tmp"102⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\B7AB.tmp"C:\Users\Admin\AppData\Local\Temp\B7AB.tmp"103⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\B809.tmp"C:\Users\Admin\AppData\Local\Temp\B809.tmp"104⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\B867.tmp"C:\Users\Admin\AppData\Local\Temp\B867.tmp"105⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\B8D4.tmp"C:\Users\Admin\AppData\Local\Temp\B8D4.tmp"106⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\B951.tmp"C:\Users\Admin\AppData\Local\Temp\B951.tmp"107⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\B9BE.tmp"C:\Users\Admin\AppData\Local\Temp\B9BE.tmp"108⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\BA3B.tmp"C:\Users\Admin\AppData\Local\Temp\BA3B.tmp"109⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\BA89.tmp"C:\Users\Admin\AppData\Local\Temp\BA89.tmp"110⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\BAE6.tmp"C:\Users\Admin\AppData\Local\Temp\BAE6.tmp"111⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\BB44.tmp"C:\Users\Admin\AppData\Local\Temp\BB44.tmp"112⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\BBA1.tmp"C:\Users\Admin\AppData\Local\Temp\BBA1.tmp"113⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\BBFF.tmp"C:\Users\Admin\AppData\Local\Temp\BBFF.tmp"114⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\BC6C.tmp"C:\Users\Admin\AppData\Local\Temp\BC6C.tmp"115⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\BCD9.tmp"C:\Users\Admin\AppData\Local\Temp\BCD9.tmp"116⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\BD27.tmp"C:\Users\Admin\AppData\Local\Temp\BD27.tmp"117⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\BD85.tmp"C:\Users\Admin\AppData\Local\Temp\BD85.tmp"118⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\BDE3.tmp"C:\Users\Admin\AppData\Local\Temp\BDE3.tmp"119⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\BE5F.tmp"C:\Users\Admin\AppData\Local\Temp\BE5F.tmp"120⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\BEAD.tmp"C:\Users\Admin\AppData\Local\Temp\BEAD.tmp"121⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\BF1B.tmp"C:\Users\Admin\AppData\Local\Temp\BF1B.tmp"122⤵PID:1988
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-