Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
02/08/2023, 16:37
Static task
static1
Behavioral task
behavioral1
Sample
394b254123aaf89ed9459744bb67fc37_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
394b254123aaf89ed9459744bb67fc37_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
394b254123aaf89ed9459744bb67fc37_mafia_JC.exe
-
Size
486KB
-
MD5
394b254123aaf89ed9459744bb67fc37
-
SHA1
4fa6fad6f88b5ed4f843a8ceab497df6885466e0
-
SHA256
73f5022479040ced3a59356cad4cd4b648c0680dcb60e238f874c4f04cd3e517
-
SHA512
149285762a50189f9c021fd8f8020a7f0edbce5084be6ba6da9bc842a40b4bcaff2ddf07295a43bb136b00b16d7561b24ac8bb5d3b6fba838c63e77e09c1809c
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7yG73wv20vIIhR7JXiGbepmBIBJzUpSRLW0Ga:/U5rCOTeiDye3RATyGozB4SRLhNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4692 30BF.tmp 3592 35B1.tmp 2184 368C.tmp 5032 3786.tmp 2044 388F.tmp 1668 396A.tmp 4180 39E7.tmp 2652 3B2F.tmp 3456 3C29.tmp 4184 3D33.tmp 1588 3E1D.tmp 3512 3ED9.tmp 940 3FC3.tmp 564 407F.tmp 936 412B.tmp 4336 41E6.tmp 2136 4282.tmp 1880 432E.tmp 544 4438.tmp 1652 4522.tmp 1576 461C.tmp 3928 484F.tmp 4100 4949.tmp 4728 4A23.tmp 2012 4B3D.tmp 2804 4C46.tmp 4900 4D6F.tmp 3144 4E69.tmp 3772 4F63.tmp 2488 503E.tmp 4092 50F9.tmp 3372 51B5.tmp 4032 5242.tmp 3384 52FD.tmp 3196 538A.tmp 1440 5436.tmp 3448 54B3.tmp 2284 556E.tmp 2436 561A.tmp 3700 56B6.tmp 4740 5762.tmp 548 57FE.tmp 3884 589B.tmp 4768 5946.tmp 924 59B4.tmp 1100 5A40.tmp 4672 5ACD.tmp 3400 5B4A.tmp 4808 5BD7.tmp 3780 5CA2.tmp 5008 5D5D.tmp 2116 5DCB.tmp 1704 5E57.tmp 5020 5EE4.tmp 4280 5F71.tmp 2196 5FDE.tmp 3968 605B.tmp 1340 60E8.tmp 2812 6155.tmp 1152 61D2.tmp 444 625F.tmp 2184 62EB.tmp 1580 6368.tmp 2400 6424.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4168 wrote to memory of 4692 4168 394b254123aaf89ed9459744bb67fc37_mafia_JC.exe 82 PID 4168 wrote to memory of 4692 4168 394b254123aaf89ed9459744bb67fc37_mafia_JC.exe 82 PID 4168 wrote to memory of 4692 4168 394b254123aaf89ed9459744bb67fc37_mafia_JC.exe 82 PID 4692 wrote to memory of 3592 4692 30BF.tmp 83 PID 4692 wrote to memory of 3592 4692 30BF.tmp 83 PID 4692 wrote to memory of 3592 4692 30BF.tmp 83 PID 3592 wrote to memory of 2184 3592 35B1.tmp 84 PID 3592 wrote to memory of 2184 3592 35B1.tmp 84 PID 3592 wrote to memory of 2184 3592 35B1.tmp 84 PID 2184 wrote to memory of 5032 2184 368C.tmp 85 PID 2184 wrote to memory of 5032 2184 368C.tmp 85 PID 2184 wrote to memory of 5032 2184 368C.tmp 85 PID 5032 wrote to memory of 2044 5032 3786.tmp 86 PID 5032 wrote to memory of 2044 5032 3786.tmp 86 PID 5032 wrote to memory of 2044 5032 3786.tmp 86 PID 2044 wrote to memory of 1668 2044 388F.tmp 87 PID 2044 wrote to memory of 1668 2044 388F.tmp 87 PID 2044 wrote to memory of 1668 2044 388F.tmp 87 PID 1668 wrote to memory of 4180 1668 396A.tmp 88 PID 1668 wrote to memory of 4180 1668 396A.tmp 88 PID 1668 wrote to memory of 4180 1668 396A.tmp 88 PID 4180 wrote to memory of 2652 4180 39E7.tmp 89 PID 4180 wrote to memory of 2652 4180 39E7.tmp 89 PID 4180 wrote to memory of 2652 4180 39E7.tmp 89 PID 2652 wrote to memory of 3456 2652 3B2F.tmp 90 PID 2652 wrote to memory of 3456 2652 3B2F.tmp 90 PID 2652 wrote to memory of 3456 2652 3B2F.tmp 90 PID 3456 wrote to memory of 4184 3456 3C29.tmp 91 PID 3456 wrote to memory of 4184 3456 3C29.tmp 91 PID 3456 wrote to memory of 4184 3456 3C29.tmp 91 PID 4184 wrote to memory of 1588 4184 3D33.tmp 92 PID 4184 wrote to memory of 1588 4184 3D33.tmp 92 PID 4184 wrote to memory of 1588 4184 3D33.tmp 92 PID 1588 wrote to memory of 3512 1588 3E1D.tmp 93 PID 1588 wrote to memory of 3512 1588 3E1D.tmp 93 PID 1588 wrote to memory of 3512 1588 3E1D.tmp 93 PID 3512 wrote to memory of 940 3512 3ED9.tmp 94 PID 3512 wrote to memory of 940 3512 3ED9.tmp 94 PID 3512 wrote to memory of 940 3512 3ED9.tmp 94 PID 940 wrote to memory of 564 940 3FC3.tmp 95 PID 940 wrote to memory of 564 940 3FC3.tmp 95 PID 940 wrote to memory of 564 940 3FC3.tmp 95 PID 564 wrote to memory of 936 564 407F.tmp 96 PID 564 wrote to memory of 936 564 407F.tmp 96 PID 564 wrote to memory of 936 564 407F.tmp 96 PID 936 wrote to memory of 4336 936 412B.tmp 97 PID 936 wrote to memory of 4336 936 412B.tmp 97 PID 936 wrote to memory of 4336 936 412B.tmp 97 PID 4336 wrote to memory of 2136 4336 41E6.tmp 98 PID 4336 wrote to memory of 2136 4336 41E6.tmp 98 PID 4336 wrote to memory of 2136 4336 41E6.tmp 98 PID 2136 wrote to memory of 1880 2136 4282.tmp 99 PID 2136 wrote to memory of 1880 2136 4282.tmp 99 PID 2136 wrote to memory of 1880 2136 4282.tmp 99 PID 1880 wrote to memory of 544 1880 432E.tmp 100 PID 1880 wrote to memory of 544 1880 432E.tmp 100 PID 1880 wrote to memory of 544 1880 432E.tmp 100 PID 544 wrote to memory of 1652 544 4438.tmp 101 PID 544 wrote to memory of 1652 544 4438.tmp 101 PID 544 wrote to memory of 1652 544 4438.tmp 101 PID 1652 wrote to memory of 1576 1652 4522.tmp 102 PID 1652 wrote to memory of 1576 1652 4522.tmp 102 PID 1652 wrote to memory of 1576 1652 4522.tmp 102 PID 1576 wrote to memory of 3928 1576 461C.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\394b254123aaf89ed9459744bb67fc37_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\394b254123aaf89ed9459744bb67fc37_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\30BF.tmp"C:\Users\Admin\AppData\Local\Temp\30BF.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\35B1.tmp"C:\Users\Admin\AppData\Local\Temp\35B1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\368C.tmp"C:\Users\Admin\AppData\Local\Temp\368C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\3786.tmp"C:\Users\Admin\AppData\Local\Temp\3786.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\388F.tmp"C:\Users\Admin\AppData\Local\Temp\388F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\396A.tmp"C:\Users\Admin\AppData\Local\Temp\396A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\39E7.tmp"C:\Users\Admin\AppData\Local\Temp\39E7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\3B2F.tmp"C:\Users\Admin\AppData\Local\Temp\3B2F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\3C29.tmp"C:\Users\Admin\AppData\Local\Temp\3C29.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\3D33.tmp"C:\Users\Admin\AppData\Local\Temp\3D33.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\3E1D.tmp"C:\Users\Admin\AppData\Local\Temp\3E1D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\3ED9.tmp"C:\Users\Admin\AppData\Local\Temp\3ED9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\3FC3.tmp"C:\Users\Admin\AppData\Local\Temp\3FC3.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\407F.tmp"C:\Users\Admin\AppData\Local\Temp\407F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Users\Admin\AppData\Local\Temp\412B.tmp"C:\Users\Admin\AppData\Local\Temp\412B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\41E6.tmp"C:\Users\Admin\AppData\Local\Temp\41E6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\4282.tmp"C:\Users\Admin\AppData\Local\Temp\4282.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\432E.tmp"C:\Users\Admin\AppData\Local\Temp\432E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\4438.tmp"C:\Users\Admin\AppData\Local\Temp\4438.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Users\Admin\AppData\Local\Temp\4522.tmp"C:\Users\Admin\AppData\Local\Temp\4522.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\461C.tmp"C:\Users\Admin\AppData\Local\Temp\461C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\484F.tmp"C:\Users\Admin\AppData\Local\Temp\484F.tmp"23⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\4949.tmp"C:\Users\Admin\AppData\Local\Temp\4949.tmp"24⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\4A23.tmp"C:\Users\Admin\AppData\Local\Temp\4A23.tmp"25⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\4B3D.tmp"C:\Users\Admin\AppData\Local\Temp\4B3D.tmp"26⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\4C46.tmp"C:\Users\Admin\AppData\Local\Temp\4C46.tmp"27⤵
- Executes dropped EXE
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\4D6F.tmp"C:\Users\Admin\AppData\Local\Temp\4D6F.tmp"28⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\4E69.tmp"C:\Users\Admin\AppData\Local\Temp\4E69.tmp"29⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\4F63.tmp"C:\Users\Admin\AppData\Local\Temp\4F63.tmp"30⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\503E.tmp"C:\Users\Admin\AppData\Local\Temp\503E.tmp"31⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\50F9.tmp"C:\Users\Admin\AppData\Local\Temp\50F9.tmp"32⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\51B5.tmp"C:\Users\Admin\AppData\Local\Temp\51B5.tmp"33⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\5242.tmp"C:\Users\Admin\AppData\Local\Temp\5242.tmp"34⤵
- Executes dropped EXE
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\52FD.tmp"C:\Users\Admin\AppData\Local\Temp\52FD.tmp"35⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\538A.tmp"C:\Users\Admin\AppData\Local\Temp\538A.tmp"36⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\5436.tmp"C:\Users\Admin\AppData\Local\Temp\5436.tmp"37⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\54B3.tmp"C:\Users\Admin\AppData\Local\Temp\54B3.tmp"38⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\556E.tmp"C:\Users\Admin\AppData\Local\Temp\556E.tmp"39⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\561A.tmp"C:\Users\Admin\AppData\Local\Temp\561A.tmp"40⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\56B6.tmp"C:\Users\Admin\AppData\Local\Temp\56B6.tmp"41⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\5762.tmp"C:\Users\Admin\AppData\Local\Temp\5762.tmp"42⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\57FE.tmp"C:\Users\Admin\AppData\Local\Temp\57FE.tmp"43⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\589B.tmp"C:\Users\Admin\AppData\Local\Temp\589B.tmp"44⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\5946.tmp"C:\Users\Admin\AppData\Local\Temp\5946.tmp"45⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\59B4.tmp"C:\Users\Admin\AppData\Local\Temp\59B4.tmp"46⤵
- Executes dropped EXE
PID:924 -
C:\Users\Admin\AppData\Local\Temp\5A40.tmp"C:\Users\Admin\AppData\Local\Temp\5A40.tmp"47⤵
- Executes dropped EXE
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\5ACD.tmp"C:\Users\Admin\AppData\Local\Temp\5ACD.tmp"48⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"49⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\5BD7.tmp"C:\Users\Admin\AppData\Local\Temp\5BD7.tmp"50⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\5CA2.tmp"C:\Users\Admin\AppData\Local\Temp\5CA2.tmp"51⤵
- Executes dropped EXE
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\5D5D.tmp"C:\Users\Admin\AppData\Local\Temp\5D5D.tmp"52⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\5DCB.tmp"C:\Users\Admin\AppData\Local\Temp\5DCB.tmp"53⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\5E57.tmp"C:\Users\Admin\AppData\Local\Temp\5E57.tmp"54⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"55⤵
- Executes dropped EXE
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\5F71.tmp"C:\Users\Admin\AppData\Local\Temp\5F71.tmp"56⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\5FDE.tmp"C:\Users\Admin\AppData\Local\Temp\5FDE.tmp"57⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\605B.tmp"C:\Users\Admin\AppData\Local\Temp\605B.tmp"58⤵
- Executes dropped EXE
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\60E8.tmp"C:\Users\Admin\AppData\Local\Temp\60E8.tmp"59⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\6155.tmp"C:\Users\Admin\AppData\Local\Temp\6155.tmp"60⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\61D2.tmp"C:\Users\Admin\AppData\Local\Temp\61D2.tmp"61⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\625F.tmp"C:\Users\Admin\AppData\Local\Temp\625F.tmp"62⤵
- Executes dropped EXE
PID:444 -
C:\Users\Admin\AppData\Local\Temp\62EB.tmp"C:\Users\Admin\AppData\Local\Temp\62EB.tmp"63⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\6368.tmp"C:\Users\Admin\AppData\Local\Temp\6368.tmp"64⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\6424.tmp"C:\Users\Admin\AppData\Local\Temp\6424.tmp"65⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\64A1.tmp"C:\Users\Admin\AppData\Local\Temp\64A1.tmp"66⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\651E.tmp"C:\Users\Admin\AppData\Local\Temp\651E.tmp"67⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\65BA.tmp"C:\Users\Admin\AppData\Local\Temp\65BA.tmp"68⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\6647.tmp"C:\Users\Admin\AppData\Local\Temp\6647.tmp"69⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\6702.tmp"C:\Users\Admin\AppData\Local\Temp\6702.tmp"70⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\678F.tmp"C:\Users\Admin\AppData\Local\Temp\678F.tmp"71⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\67FC.tmp"C:\Users\Admin\AppData\Local\Temp\67FC.tmp"72⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\6889.tmp"C:\Users\Admin\AppData\Local\Temp\6889.tmp"73⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\6992.tmp"C:\Users\Admin\AppData\Local\Temp\6992.tmp"74⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\6A0F.tmp"C:\Users\Admin\AppData\Local\Temp\6A0F.tmp"75⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\6A8C.tmp"C:\Users\Admin\AppData\Local\Temp\6A8C.tmp"76⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\6B19.tmp"C:\Users\Admin\AppData\Local\Temp\6B19.tmp"77⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\6BD4.tmp"C:\Users\Admin\AppData\Local\Temp\6BD4.tmp"78⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\6C42.tmp"C:\Users\Admin\AppData\Local\Temp\6C42.tmp"79⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\6CCE.tmp"C:\Users\Admin\AppData\Local\Temp\6CCE.tmp"80⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\6D5B.tmp"C:\Users\Admin\AppData\Local\Temp\6D5B.tmp"81⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\6DD8.tmp"C:\Users\Admin\AppData\Local\Temp\6DD8.tmp"82⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\6E74.tmp"C:\Users\Admin\AppData\Local\Temp\6E74.tmp"83⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\6EF1.tmp"C:\Users\Admin\AppData\Local\Temp\6EF1.tmp"84⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\6F5F.tmp"C:\Users\Admin\AppData\Local\Temp\6F5F.tmp"85⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\6FEB.tmp"C:\Users\Admin\AppData\Local\Temp\6FEB.tmp"86⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\7059.tmp"C:\Users\Admin\AppData\Local\Temp\7059.tmp"87⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\70C6.tmp"C:\Users\Admin\AppData\Local\Temp\70C6.tmp"88⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\7162.tmp"C:\Users\Admin\AppData\Local\Temp\7162.tmp"89⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\71FF.tmp"C:\Users\Admin\AppData\Local\Temp\71FF.tmp"90⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\728B.tmp"C:\Users\Admin\AppData\Local\Temp\728B.tmp"91⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\7308.tmp"C:\Users\Admin\AppData\Local\Temp\7308.tmp"92⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\7385.tmp"C:\Users\Admin\AppData\Local\Temp\7385.tmp"93⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\7421.tmp"C:\Users\Admin\AppData\Local\Temp\7421.tmp"94⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\74AE.tmp"C:\Users\Admin\AppData\Local\Temp\74AE.tmp"95⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\751B.tmp"C:\Users\Admin\AppData\Local\Temp\751B.tmp"96⤵PID:420
-
C:\Users\Admin\AppData\Local\Temp\7598.tmp"C:\Users\Admin\AppData\Local\Temp\7598.tmp"97⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\7683.tmp"C:\Users\Admin\AppData\Local\Temp\7683.tmp"98⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\76F0.tmp"C:\Users\Admin\AppData\Local\Temp\76F0.tmp"99⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\776D.tmp"C:\Users\Admin\AppData\Local\Temp\776D.tmp"100⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\77FA.tmp"C:\Users\Admin\AppData\Local\Temp\77FA.tmp"101⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\7896.tmp"C:\Users\Admin\AppData\Local\Temp\7896.tmp"102⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\7903.tmp"C:\Users\Admin\AppData\Local\Temp\7903.tmp"103⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\7971.tmp"C:\Users\Admin\AppData\Local\Temp\7971.tmp"104⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\79FD.tmp"C:\Users\Admin\AppData\Local\Temp\79FD.tmp"105⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\7A7A.tmp"C:\Users\Admin\AppData\Local\Temp\7A7A.tmp"106⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\7AE8.tmp"C:\Users\Admin\AppData\Local\Temp\7AE8.tmp"107⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\7B65.tmp"C:\Users\Admin\AppData\Local\Temp\7B65.tmp"108⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\7BF1.tmp"C:\Users\Admin\AppData\Local\Temp\7BF1.tmp"109⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\7C7E.tmp"C:\Users\Admin\AppData\Local\Temp\7C7E.tmp"110⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\7D0B.tmp"C:\Users\Admin\AppData\Local\Temp\7D0B.tmp"111⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\7D78.tmp"C:\Users\Admin\AppData\Local\Temp\7D78.tmp"112⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\7DE5.tmp"C:\Users\Admin\AppData\Local\Temp\7DE5.tmp"113⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\7E62.tmp"C:\Users\Admin\AppData\Local\Temp\7E62.tmp"114⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\7EDF.tmp"C:\Users\Admin\AppData\Local\Temp\7EDF.tmp"115⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"116⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\7FBA.tmp"C:\Users\Admin\AppData\Local\Temp\7FBA.tmp"117⤵PID:492
-
C:\Users\Admin\AppData\Local\Temp\8056.tmp"C:\Users\Admin\AppData\Local\Temp\8056.tmp"118⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\80E3.tmp"C:\Users\Admin\AppData\Local\Temp\80E3.tmp"119⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\81BE.tmp"C:\Users\Admin\AppData\Local\Temp\81BE.tmp"120⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\8299.tmp"C:\Users\Admin\AppData\Local\Temp\8299.tmp"121⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\8306.tmp"C:\Users\Admin\AppData\Local\Temp\8306.tmp"122⤵PID:1296
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-