Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
05/08/2023, 13:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
72c6d3d00b6f5463e7df5502c779748c_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
72c6d3d00b6f5463e7df5502c779748c_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
72c6d3d00b6f5463e7df5502c779748c_mafia_JC.exe
-
Size
487KB
-
MD5
72c6d3d00b6f5463e7df5502c779748c
-
SHA1
7e420d123572a6bef7ac15ece593730342aaa945
-
SHA256
72cbee2ebc603c58a7754d9e253ee9344a8009940ff2699a8cc0aabec43a6aec
-
SHA512
5b5a206c733739f3a6618a699ed1cc8f0f2c845c3aa3dabf0e49d02e5d17cde350640175ff41a295c5a8c01ce7af2784d05476621b7a2265b4a548ca81e14ff8
-
SSDEEP
12288:HU5rCOTeiJ92yJxK9alO+8f8/IR5JnHlUuHNZ:HUQOJJMyHjCpJnHDHN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2308 DE79.tmp 4680 DF83.tmp 3852 E05D.tmp 3912 E177.tmp 884 E261.tmp 228 E9B4.tmp 2376 EADD.tmp 3556 EBA8.tmp 2424 EC73.tmp 1424 ED2F.tmp 1564 EDFA.tmp 4704 EEF4.tmp 928 EF80.tmp 3152 F00D.tmp 1508 F0C8.tmp 4748 F1A3.tmp 4344 F2BC.tmp 560 F3C6.tmp 3812 F472.tmp 4124 F59B.tmp 880 F676.tmp 2452 F906.tmp 2112 FA3E.tmp 1436 FBC5.tmp 3432 FD2C.tmp 1684 FDC9.tmp 2148 FE65.tmp 4612 FEF1.tmp 3832 FF8E.tmp 3336 97.tmp 4812 172.tmp 1608 23D.tmp 1824 2F9.tmp 3688 376.tmp 2356 402.tmp 2208 47F.tmp 4716 50C.tmp 1688 5B8.tmp 4984 664.tmp 3880 71F.tmp 1092 7AC.tmp 2792 819.tmp 1400 896.tmp 1636 942.tmp 3612 9FE.tmp 3824 A8A.tmp 4916 B26.tmp 4972 BA3.tmp 2180 C6F.tmp 5088 D2A.tmp 400 DE6.tmp 5048 EC0.tmp 2164 F5D.tmp 4016 FF9.tmp 3272 1095.tmp 3040 1131.tmp 656 11AE.tmp 4680 1279.tmp 1904 1325.tmp 1520 1393.tmp 4220 145E.tmp 3096 150A.tmp 2912 1596.tmp 2476 1613.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4140 wrote to memory of 2308 4140 72c6d3d00b6f5463e7df5502c779748c_mafia_JC.exe 80 PID 4140 wrote to memory of 2308 4140 72c6d3d00b6f5463e7df5502c779748c_mafia_JC.exe 80 PID 4140 wrote to memory of 2308 4140 72c6d3d00b6f5463e7df5502c779748c_mafia_JC.exe 80 PID 2308 wrote to memory of 4680 2308 DE79.tmp 81 PID 2308 wrote to memory of 4680 2308 DE79.tmp 81 PID 2308 wrote to memory of 4680 2308 DE79.tmp 81 PID 4680 wrote to memory of 3852 4680 DF83.tmp 82 PID 4680 wrote to memory of 3852 4680 DF83.tmp 82 PID 4680 wrote to memory of 3852 4680 DF83.tmp 82 PID 3852 wrote to memory of 3912 3852 E05D.tmp 83 PID 3852 wrote to memory of 3912 3852 E05D.tmp 83 PID 3852 wrote to memory of 3912 3852 E05D.tmp 83 PID 3912 wrote to memory of 884 3912 E177.tmp 84 PID 3912 wrote to memory of 884 3912 E177.tmp 84 PID 3912 wrote to memory of 884 3912 E177.tmp 84 PID 884 wrote to memory of 228 884 E261.tmp 85 PID 884 wrote to memory of 228 884 E261.tmp 85 PID 884 wrote to memory of 228 884 E261.tmp 85 PID 228 wrote to memory of 2376 228 E9B4.tmp 86 PID 228 wrote to memory of 2376 228 E9B4.tmp 86 PID 228 wrote to memory of 2376 228 E9B4.tmp 86 PID 2376 wrote to memory of 3556 2376 EADD.tmp 87 PID 2376 wrote to memory of 3556 2376 EADD.tmp 87 PID 2376 wrote to memory of 3556 2376 EADD.tmp 87 PID 3556 wrote to memory of 2424 3556 EBA8.tmp 88 PID 3556 wrote to memory of 2424 3556 EBA8.tmp 88 PID 3556 wrote to memory of 2424 3556 EBA8.tmp 88 PID 2424 wrote to memory of 1424 2424 EC73.tmp 89 PID 2424 wrote to memory of 1424 2424 EC73.tmp 89 PID 2424 wrote to memory of 1424 2424 EC73.tmp 89 PID 1424 wrote to memory of 1564 1424 ED2F.tmp 90 PID 1424 wrote to memory of 1564 1424 ED2F.tmp 90 PID 1424 wrote to memory of 1564 1424 ED2F.tmp 90 PID 1564 wrote to memory of 4704 1564 EDFA.tmp 91 PID 1564 wrote to memory of 4704 1564 EDFA.tmp 91 PID 1564 wrote to memory of 4704 1564 EDFA.tmp 91 PID 4704 wrote to memory of 928 4704 EEF4.tmp 92 PID 4704 wrote to memory of 928 4704 EEF4.tmp 92 PID 4704 wrote to memory of 928 4704 EEF4.tmp 92 PID 928 wrote to memory of 3152 928 EF80.tmp 93 PID 928 wrote to memory of 3152 928 EF80.tmp 93 PID 928 wrote to memory of 3152 928 EF80.tmp 93 PID 3152 wrote to memory of 1508 3152 F00D.tmp 94 PID 3152 wrote to memory of 1508 3152 F00D.tmp 94 PID 3152 wrote to memory of 1508 3152 F00D.tmp 94 PID 1508 wrote to memory of 4748 1508 F0C8.tmp 96 PID 1508 wrote to memory of 4748 1508 F0C8.tmp 96 PID 1508 wrote to memory of 4748 1508 F0C8.tmp 96 PID 4748 wrote to memory of 4344 4748 F1A3.tmp 97 PID 4748 wrote to memory of 4344 4748 F1A3.tmp 97 PID 4748 wrote to memory of 4344 4748 F1A3.tmp 97 PID 4344 wrote to memory of 560 4344 F2BC.tmp 98 PID 4344 wrote to memory of 560 4344 F2BC.tmp 98 PID 4344 wrote to memory of 560 4344 F2BC.tmp 98 PID 560 wrote to memory of 3812 560 F3C6.tmp 99 PID 560 wrote to memory of 3812 560 F3C6.tmp 99 PID 560 wrote to memory of 3812 560 F3C6.tmp 99 PID 3812 wrote to memory of 4124 3812 F472.tmp 100 PID 3812 wrote to memory of 4124 3812 F472.tmp 100 PID 3812 wrote to memory of 4124 3812 F472.tmp 100 PID 4124 wrote to memory of 880 4124 F59B.tmp 101 PID 4124 wrote to memory of 880 4124 F59B.tmp 101 PID 4124 wrote to memory of 880 4124 F59B.tmp 101 PID 880 wrote to memory of 2452 880 F676.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\72c6d3d00b6f5463e7df5502c779748c_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\72c6d3d00b6f5463e7df5502c779748c_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\DE79.tmp"C:\Users\Admin\AppData\Local\Temp\DE79.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\DF83.tmp"C:\Users\Admin\AppData\Local\Temp\DF83.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\E05D.tmp"C:\Users\Admin\AppData\Local\Temp\E05D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\E177.tmp"C:\Users\Admin\AppData\Local\Temp\E177.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\E261.tmp"C:\Users\Admin\AppData\Local\Temp\E261.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\EADD.tmp"C:\Users\Admin\AppData\Local\Temp\EADD.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\EC73.tmp"C:\Users\Admin\AppData\Local\Temp\EC73.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\EDFA.tmp"C:\Users\Admin\AppData\Local\Temp\EDFA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\EEF4.tmp"C:\Users\Admin\AppData\Local\Temp\EEF4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\EF80.tmp"C:\Users\Admin\AppData\Local\Temp\EF80.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Users\Admin\AppData\Local\Temp\F00D.tmp"C:\Users\Admin\AppData\Local\Temp\F00D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\F1A3.tmp"C:\Users\Admin\AppData\Local\Temp\F1A3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\F3C6.tmp"C:\Users\Admin\AppData\Local\Temp\F3C6.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\F472.tmp"C:\Users\Admin\AppData\Local\Temp\F472.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\F59B.tmp"C:\Users\Admin\AppData\Local\Temp\F59B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\F676.tmp"C:\Users\Admin\AppData\Local\Temp\F676.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\F906.tmp"C:\Users\Admin\AppData\Local\Temp\F906.tmp"23⤵
- Executes dropped EXE
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\FA3E.tmp"C:\Users\Admin\AppData\Local\Temp\FA3E.tmp"24⤵
- Executes dropped EXE
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"25⤵
- Executes dropped EXE
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"26⤵
- Executes dropped EXE
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"27⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\FE65.tmp"C:\Users\Admin\AppData\Local\Temp\FE65.tmp"28⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"29⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\FF8E.tmp"C:\Users\Admin\AppData\Local\Temp\FF8E.tmp"30⤵
- Executes dropped EXE
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\97.tmp"C:\Users\Admin\AppData\Local\Temp\97.tmp"31⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\172.tmp"C:\Users\Admin\AppData\Local\Temp\172.tmp"32⤵
- Executes dropped EXE
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\23D.tmp"C:\Users\Admin\AppData\Local\Temp\23D.tmp"33⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\2F9.tmp"C:\Users\Admin\AppData\Local\Temp\2F9.tmp"34⤵
- Executes dropped EXE
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\376.tmp"C:\Users\Admin\AppData\Local\Temp\376.tmp"35⤵
- Executes dropped EXE
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\402.tmp"C:\Users\Admin\AppData\Local\Temp\402.tmp"36⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\47F.tmp"C:\Users\Admin\AppData\Local\Temp\47F.tmp"37⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\50C.tmp"C:\Users\Admin\AppData\Local\Temp\50C.tmp"38⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\5B8.tmp"C:\Users\Admin\AppData\Local\Temp\5B8.tmp"39⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\664.tmp"C:\Users\Admin\AppData\Local\Temp\664.tmp"40⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\71F.tmp"C:\Users\Admin\AppData\Local\Temp\71F.tmp"41⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\7AC.tmp"C:\Users\Admin\AppData\Local\Temp\7AC.tmp"42⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\819.tmp"C:\Users\Admin\AppData\Local\Temp\819.tmp"43⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\896.tmp"C:\Users\Admin\AppData\Local\Temp\896.tmp"44⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\942.tmp"C:\Users\Admin\AppData\Local\Temp\942.tmp"45⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\9FE.tmp"C:\Users\Admin\AppData\Local\Temp\9FE.tmp"46⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\A8A.tmp"C:\Users\Admin\AppData\Local\Temp\A8A.tmp"47⤵
- Executes dropped EXE
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\B26.tmp"C:\Users\Admin\AppData\Local\Temp\B26.tmp"48⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\BA3.tmp"C:\Users\Admin\AppData\Local\Temp\BA3.tmp"49⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"50⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\D2A.tmp"C:\Users\Admin\AppData\Local\Temp\D2A.tmp"51⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\DE6.tmp"C:\Users\Admin\AppData\Local\Temp\DE6.tmp"52⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\EC0.tmp"C:\Users\Admin\AppData\Local\Temp\EC0.tmp"53⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\F5D.tmp"C:\Users\Admin\AppData\Local\Temp\F5D.tmp"54⤵
- Executes dropped EXE
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\FF9.tmp"C:\Users\Admin\AppData\Local\Temp\FF9.tmp"55⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\1095.tmp"C:\Users\Admin\AppData\Local\Temp\1095.tmp"56⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\1131.tmp"C:\Users\Admin\AppData\Local\Temp\1131.tmp"57⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\11AE.tmp"C:\Users\Admin\AppData\Local\Temp\11AE.tmp"58⤵
- Executes dropped EXE
PID:656 -
C:\Users\Admin\AppData\Local\Temp\1279.tmp"C:\Users\Admin\AppData\Local\Temp\1279.tmp"59⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\1325.tmp"C:\Users\Admin\AppData\Local\Temp\1325.tmp"60⤵
- Executes dropped EXE
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\1393.tmp"C:\Users\Admin\AppData\Local\Temp\1393.tmp"61⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\145E.tmp"C:\Users\Admin\AppData\Local\Temp\145E.tmp"62⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\150A.tmp"C:\Users\Admin\AppData\Local\Temp\150A.tmp"63⤵
- Executes dropped EXE
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\1596.tmp"C:\Users\Admin\AppData\Local\Temp\1596.tmp"64⤵
- Executes dropped EXE
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\1613.tmp"C:\Users\Admin\AppData\Local\Temp\1613.tmp"65⤵
- Executes dropped EXE
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\16A0.tmp"C:\Users\Admin\AppData\Local\Temp\16A0.tmp"66⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\173C.tmp"C:\Users\Admin\AppData\Local\Temp\173C.tmp"67⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\17B9.tmp"C:\Users\Admin\AppData\Local\Temp\17B9.tmp"68⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\1846.tmp"C:\Users\Admin\AppData\Local\Temp\1846.tmp"69⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\18C3.tmp"C:\Users\Admin\AppData\Local\Temp\18C3.tmp"70⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\1940.tmp"C:\Users\Admin\AppData\Local\Temp\1940.tmp"71⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\19BD.tmp"C:\Users\Admin\AppData\Local\Temp\19BD.tmp"72⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\1A49.tmp"C:\Users\Admin\AppData\Local\Temp\1A49.tmp"73⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"74⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\1B53.tmp"C:\Users\Admin\AppData\Local\Temp\1B53.tmp"75⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"76⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\1C4D.tmp"C:\Users\Admin\AppData\Local\Temp\1C4D.tmp"77⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"78⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\1D47.tmp"C:\Users\Admin\AppData\Local\Temp\1D47.tmp"79⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\1DC4.tmp"C:\Users\Admin\AppData\Local\Temp\1DC4.tmp"80⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\1E80.tmp"C:\Users\Admin\AppData\Local\Temp\1E80.tmp"81⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\1F1C.tmp"C:\Users\Admin\AppData\Local\Temp\1F1C.tmp"82⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"83⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\2074.tmp"C:\Users\Admin\AppData\Local\Temp\2074.tmp"84⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\2110.tmp"C:\Users\Admin\AppData\Local\Temp\2110.tmp"85⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\218D.tmp"C:\Users\Admin\AppData\Local\Temp\218D.tmp"86⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\220A.tmp"C:\Users\Admin\AppData\Local\Temp\220A.tmp"87⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\2287.tmp"C:\Users\Admin\AppData\Local\Temp\2287.tmp"88⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\2313.tmp"C:\Users\Admin\AppData\Local\Temp\2313.tmp"89⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\23A0.tmp"C:\Users\Admin\AppData\Local\Temp\23A0.tmp"90⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\245C.tmp"C:\Users\Admin\AppData\Local\Temp\245C.tmp"91⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\2527.tmp"C:\Users\Admin\AppData\Local\Temp\2527.tmp"92⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\25F2.tmp"C:\Users\Admin\AppData\Local\Temp\25F2.tmp"93⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\268E.tmp"C:\Users\Admin\AppData\Local\Temp\268E.tmp"94⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\271B.tmp"C:\Users\Admin\AppData\Local\Temp\271B.tmp"95⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\27C7.tmp"C:\Users\Admin\AppData\Local\Temp\27C7.tmp"96⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\2834.tmp"C:\Users\Admin\AppData\Local\Temp\2834.tmp"97⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\28A1.tmp"C:\Users\Admin\AppData\Local\Temp\28A1.tmp"98⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\292E.tmp"C:\Users\Admin\AppData\Local\Temp\292E.tmp"99⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\29AB.tmp"C:\Users\Admin\AppData\Local\Temp\29AB.tmp"100⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\2A28.tmp"C:\Users\Admin\AppData\Local\Temp\2A28.tmp"101⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\2AC4.tmp"C:\Users\Admin\AppData\Local\Temp\2AC4.tmp"102⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\2B51.tmp"C:\Users\Admin\AppData\Local\Temp\2B51.tmp"103⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\2BCE.tmp"C:\Users\Admin\AppData\Local\Temp\2BCE.tmp"104⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\2C5A.tmp"C:\Users\Admin\AppData\Local\Temp\2C5A.tmp"105⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"106⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\2D74.tmp"C:\Users\Admin\AppData\Local\Temp\2D74.tmp"107⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"108⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\2E7D.tmp"C:\Users\Admin\AppData\Local\Temp\2E7D.tmp"109⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\2EFA.tmp"C:\Users\Admin\AppData\Local\Temp\2EFA.tmp"110⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\2F77.tmp"C:\Users\Admin\AppData\Local\Temp\2F77.tmp"111⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\3071.tmp"C:\Users\Admin\AppData\Local\Temp\3071.tmp"112⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\30DF.tmp"C:\Users\Admin\AppData\Local\Temp\30DF.tmp"113⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\315C.tmp"C:\Users\Admin\AppData\Local\Temp\315C.tmp"114⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"115⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"116⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\32F2.tmp"C:\Users\Admin\AppData\Local\Temp\32F2.tmp"117⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\335F.tmp"C:\Users\Admin\AppData\Local\Temp\335F.tmp"118⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"119⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"120⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\34D6.tmp"C:\Users\Admin\AppData\Local\Temp\34D6.tmp"121⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"122⤵PID:3912
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-