Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
04/08/2023, 17:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
63d80c7e32c47461c5fd07d868225e1a_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
63d80c7e32c47461c5fd07d868225e1a_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
63d80c7e32c47461c5fd07d868225e1a_mafia_JC.exe
-
Size
486KB
-
MD5
63d80c7e32c47461c5fd07d868225e1a
-
SHA1
35b377ffba639c4aef01a54a1022d692ea49513a
-
SHA256
8bba15526ffd302481a4382c54a7d367b1ab2b50f01a82d750d2e4f8a7ad4fdb
-
SHA512
ea3c910211aec8e49bbef14d1dce7452239803dbf58c510892aa4edde780758816cfdf7cbb7b2ff5cf8fccbb5410e77eb2281f707140904394910a47e64773ea
-
SSDEEP
12288:/U5rCOTeiDcKoPc24CGeb09liT/8p9aHiNZ:/UQOJDcDc24CGkWFaHiN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1492 664B.tmp 4220 6755.tmp 3312 6801.tmp 3792 68CC.tmp 2304 6987.tmp 2444 6A53.tmp 1524 6AFE.tmp 2612 6C08.tmp 1272 6CA4.tmp 4128 6D21.tmp 4300 6DAE.tmp 2980 6EB8.tmp 2508 6F54.tmp 3656 70BB.tmp 4540 71C5.tmp 4652 7271.tmp 4216 734B.tmp 4736 73E8.tmp 208 74B3.tmp 832 75EB.tmp 3084 76C6.tmp 2340 7782.tmp 2420 781E.tmp 2728 78AA.tmp 2968 7956.tmp 4916 7A31.tmp 2084 7ACD.tmp 4528 7B89.tmp 1844 7C64.tmp 1952 7D2F.tmp 2196 7E19.tmp 2256 7E86.tmp 3200 7F52.tmp 4444 7FCF.tmp 1392 806B.tmp 4868 8107.tmp 2064 81A3.tmp 1068 824F.tmp 4180 82CC.tmp 4172 8349.tmp 1684 83E5.tmp 3240 8472.tmp 116 84FF.tmp 4432 858B.tmp 4480 8628.tmp 3844 86C4.tmp 4564 8760.tmp 4316 87DD.tmp 4272 885A.tmp 444 88F6.tmp 3836 8983.tmp 1164 8A00.tmp 3192 8A7D.tmp 1548 8B0A.tmp 4220 8BA6.tmp 1820 8C32.tmp 888 8CAF.tmp 3312 8D2C.tmp 4556 8DB9.tmp 4848 8E55.tmp 3356 8EE2.tmp 5048 8F7E.tmp 4028 8FEC.tmp 2612 9059.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 220 wrote to memory of 1492 220 63d80c7e32c47461c5fd07d868225e1a_mafia_JC.exe 81 PID 220 wrote to memory of 1492 220 63d80c7e32c47461c5fd07d868225e1a_mafia_JC.exe 81 PID 220 wrote to memory of 1492 220 63d80c7e32c47461c5fd07d868225e1a_mafia_JC.exe 81 PID 1492 wrote to memory of 4220 1492 664B.tmp 82 PID 1492 wrote to memory of 4220 1492 664B.tmp 82 PID 1492 wrote to memory of 4220 1492 664B.tmp 82 PID 4220 wrote to memory of 3312 4220 6755.tmp 83 PID 4220 wrote to memory of 3312 4220 6755.tmp 83 PID 4220 wrote to memory of 3312 4220 6755.tmp 83 PID 3312 wrote to memory of 3792 3312 6801.tmp 84 PID 3312 wrote to memory of 3792 3312 6801.tmp 84 PID 3312 wrote to memory of 3792 3312 6801.tmp 84 PID 3792 wrote to memory of 2304 3792 68CC.tmp 85 PID 3792 wrote to memory of 2304 3792 68CC.tmp 85 PID 3792 wrote to memory of 2304 3792 68CC.tmp 85 PID 2304 wrote to memory of 2444 2304 6987.tmp 86 PID 2304 wrote to memory of 2444 2304 6987.tmp 86 PID 2304 wrote to memory of 2444 2304 6987.tmp 86 PID 2444 wrote to memory of 1524 2444 6A53.tmp 87 PID 2444 wrote to memory of 1524 2444 6A53.tmp 87 PID 2444 wrote to memory of 1524 2444 6A53.tmp 87 PID 1524 wrote to memory of 2612 1524 6AFE.tmp 88 PID 1524 wrote to memory of 2612 1524 6AFE.tmp 88 PID 1524 wrote to memory of 2612 1524 6AFE.tmp 88 PID 2612 wrote to memory of 1272 2612 6C08.tmp 90 PID 2612 wrote to memory of 1272 2612 6C08.tmp 90 PID 2612 wrote to memory of 1272 2612 6C08.tmp 90 PID 1272 wrote to memory of 4128 1272 6CA4.tmp 91 PID 1272 wrote to memory of 4128 1272 6CA4.tmp 91 PID 1272 wrote to memory of 4128 1272 6CA4.tmp 91 PID 4128 wrote to memory of 4300 4128 6D21.tmp 92 PID 4128 wrote to memory of 4300 4128 6D21.tmp 92 PID 4128 wrote to memory of 4300 4128 6D21.tmp 92 PID 4300 wrote to memory of 2980 4300 6DAE.tmp 93 PID 4300 wrote to memory of 2980 4300 6DAE.tmp 93 PID 4300 wrote to memory of 2980 4300 6DAE.tmp 93 PID 2980 wrote to memory of 2508 2980 6EB8.tmp 94 PID 2980 wrote to memory of 2508 2980 6EB8.tmp 94 PID 2980 wrote to memory of 2508 2980 6EB8.tmp 94 PID 2508 wrote to memory of 3656 2508 6F54.tmp 95 PID 2508 wrote to memory of 3656 2508 6F54.tmp 95 PID 2508 wrote to memory of 3656 2508 6F54.tmp 95 PID 3656 wrote to memory of 4540 3656 70BB.tmp 96 PID 3656 wrote to memory of 4540 3656 70BB.tmp 96 PID 3656 wrote to memory of 4540 3656 70BB.tmp 96 PID 4540 wrote to memory of 4652 4540 71C5.tmp 97 PID 4540 wrote to memory of 4652 4540 71C5.tmp 97 PID 4540 wrote to memory of 4652 4540 71C5.tmp 97 PID 4652 wrote to memory of 4216 4652 7271.tmp 98 PID 4652 wrote to memory of 4216 4652 7271.tmp 98 PID 4652 wrote to memory of 4216 4652 7271.tmp 98 PID 4216 wrote to memory of 4736 4216 734B.tmp 101 PID 4216 wrote to memory of 4736 4216 734B.tmp 101 PID 4216 wrote to memory of 4736 4216 734B.tmp 101 PID 4736 wrote to memory of 208 4736 73E8.tmp 102 PID 4736 wrote to memory of 208 4736 73E8.tmp 102 PID 4736 wrote to memory of 208 4736 73E8.tmp 102 PID 208 wrote to memory of 832 208 74B3.tmp 103 PID 208 wrote to memory of 832 208 74B3.tmp 103 PID 208 wrote to memory of 832 208 74B3.tmp 103 PID 832 wrote to memory of 3084 832 75EB.tmp 104 PID 832 wrote to memory of 3084 832 75EB.tmp 104 PID 832 wrote to memory of 3084 832 75EB.tmp 104 PID 3084 wrote to memory of 2340 3084 76C6.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\63d80c7e32c47461c5fd07d868225e1a_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\63d80c7e32c47461c5fd07d868225e1a_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\73E8.tmp"C:\Users\Admin\AppData\Local\Temp\73E8.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"23⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"24⤵
- Executes dropped EXE
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"25⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\7956.tmp"C:\Users\Admin\AppData\Local\Temp\7956.tmp"26⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"27⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"28⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\7B89.tmp"C:\Users\Admin\AppData\Local\Temp\7B89.tmp"29⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\7C64.tmp"C:\Users\Admin\AppData\Local\Temp\7C64.tmp"30⤵
- Executes dropped EXE
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"31⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"32⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"33⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\7F52.tmp"C:\Users\Admin\AppData\Local\Temp\7F52.tmp"34⤵
- Executes dropped EXE
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"35⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"36⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\8107.tmp"C:\Users\Admin\AppData\Local\Temp\8107.tmp"37⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\81A3.tmp"C:\Users\Admin\AppData\Local\Temp\81A3.tmp"38⤵
- Executes dropped EXE
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\824F.tmp"C:\Users\Admin\AppData\Local\Temp\824F.tmp"39⤵
- Executes dropped EXE
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"40⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\8349.tmp"C:\Users\Admin\AppData\Local\Temp\8349.tmp"41⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\83E5.tmp"C:\Users\Admin\AppData\Local\Temp\83E5.tmp"42⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\8472.tmp"C:\Users\Admin\AppData\Local\Temp\8472.tmp"43⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\84FF.tmp"C:\Users\Admin\AppData\Local\Temp\84FF.tmp"44⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\858B.tmp"C:\Users\Admin\AppData\Local\Temp\858B.tmp"45⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\8628.tmp"C:\Users\Admin\AppData\Local\Temp\8628.tmp"46⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\86C4.tmp"C:\Users\Admin\AppData\Local\Temp\86C4.tmp"47⤵
- Executes dropped EXE
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\8760.tmp"C:\Users\Admin\AppData\Local\Temp\8760.tmp"48⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\87DD.tmp"C:\Users\Admin\AppData\Local\Temp\87DD.tmp"49⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\885A.tmp"C:\Users\Admin\AppData\Local\Temp\885A.tmp"50⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\88F6.tmp"C:\Users\Admin\AppData\Local\Temp\88F6.tmp"51⤵
- Executes dropped EXE
PID:444 -
C:\Users\Admin\AppData\Local\Temp\8983.tmp"C:\Users\Admin\AppData\Local\Temp\8983.tmp"52⤵
- Executes dropped EXE
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\8A00.tmp"C:\Users\Admin\AppData\Local\Temp\8A00.tmp"53⤵
- Executes dropped EXE
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"54⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"55⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"56⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\8C32.tmp"C:\Users\Admin\AppData\Local\Temp\8C32.tmp"57⤵
- Executes dropped EXE
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"58⤵
- Executes dropped EXE
PID:888 -
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"59⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"60⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\8E55.tmp"C:\Users\Admin\AppData\Local\Temp\8E55.tmp"61⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"62⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"63⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"64⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"65⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"66⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\9163.tmp"C:\Users\Admin\AppData\Local\Temp\9163.tmp"67⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\91D0.tmp"C:\Users\Admin\AppData\Local\Temp\91D0.tmp"68⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"69⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\92CA.tmp"C:\Users\Admin\AppData\Local\Temp\92CA.tmp"70⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"71⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"72⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\9451.tmp"C:\Users\Admin\AppData\Local\Temp\9451.tmp"73⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\94DD.tmp"C:\Users\Admin\AppData\Local\Temp\94DD.tmp"74⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\956A.tmp"C:\Users\Admin\AppData\Local\Temp\956A.tmp"75⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"76⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\9693.tmp"C:\Users\Admin\AppData\Local\Temp\9693.tmp"77⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\9700.tmp"C:\Users\Admin\AppData\Local\Temp\9700.tmp"78⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\976D.tmp"C:\Users\Admin\AppData\Local\Temp\976D.tmp"79⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\97EA.tmp"C:\Users\Admin\AppData\Local\Temp\97EA.tmp"80⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\9877.tmp"C:\Users\Admin\AppData\Local\Temp\9877.tmp"81⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\98E4.tmp"C:\Users\Admin\AppData\Local\Temp\98E4.tmp"82⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"83⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"84⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"85⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"86⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"87⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"88⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"89⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"90⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\9D69.tmp"C:\Users\Admin\AppData\Local\Temp\9D69.tmp"91⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"92⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"93⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"94⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"95⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"96⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"97⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"98⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"99⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\A299.tmp"C:\Users\Admin\AppData\Local\Temp\A299.tmp"100⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"101⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"102⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"103⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"104⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"105⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"106⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\A633.tmp"C:\Users\Admin\AppData\Local\Temp\A633.tmp"107⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"108⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"109⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"110⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\A884.tmp"C:\Users\Admin\AppData\Local\Temp\A884.tmp"111⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"112⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"113⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"114⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"115⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"116⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"117⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"118⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"119⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\AD95.tmp"C:\Users\Admin\AppData\Local\Temp\AD95.tmp"120⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"121⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"122⤵PID:2304
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-