Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
06/08/2023, 18:23
Static task
static1
Behavioral task
behavioral1
Sample
9101d77a0dfbf2378c6374daf4cf157b_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
9101d77a0dfbf2378c6374daf4cf157b_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
9101d77a0dfbf2378c6374daf4cf157b_mafia_JC.exe
-
Size
520KB
-
MD5
9101d77a0dfbf2378c6374daf4cf157b
-
SHA1
1afb3422fecd997f2a3f4dfe813764f8faa31fd4
-
SHA256
862ef36d5c3a332e86b75b1d6ac15529b88ac2f729fc5b7a885acd5c6988b14e
-
SHA512
ddf2cb92b4b908979d2c784b19f6a4c07749df539e3edd714b56d1cf49f830b4399faf58405600bda80455f24820685aba13dedf278c071c35bccb10b3e64ab1
-
SSDEEP
6144:vL/aqvx96HhCKprBJlKXxrVL2m36zLlUklgJe05Gk+8n6ELywXsb+zJQBRX5i/D7:2b1ZSxhL2m3zpe05P+CEuS5J8iU/NZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5040 69E5.tmp 2212 6AA1.tmp 1784 6B3D.tmp 1556 6C37.tmp 4236 6CF2.tmp 1948 6DBE.tmp 2248 6E5A.tmp 1620 6F25.tmp 868 6FD1.tmp 4664 707D.tmp 220 7129.tmp 3364 7271.tmp 3380 732C.tmp 1016 7474.tmp 1676 7520.tmp 3156 75DC.tmp 4160 7688.tmp 4464 7772.tmp 2760 781E.tmp 4152 7937.tmp 4528 7A12.tmp 3132 7ADD.tmp 4796 7B79.tmp 2132 7C54.tmp 4832 7D1F.tmp 3628 7DDB.tmp 724 7E77.tmp 4816 7F32.tmp 2196 800D.tmp 4544 80A9.tmp 1440 8194.tmp 4492 8230.tmp 1816 82CC.tmp 4000 833A.tmp 3120 83A7.tmp 1428 8453.tmp 2952 84EF.tmp 628 859B.tmp 872 8618.tmp 2748 86A5.tmp 4164 8741.tmp 2252 87CD.tmp 2660 886A.tmp 4828 8916.tmp 4208 89A2.tmp 3964 8A2F.tmp 788 8ADB.tmp 4176 8B67.tmp 4192 8BE4.tmp 3396 8C71.tmp 1812 8D0D.tmp 2288 8D8A.tmp 3780 8E07.tmp 1900 8E94.tmp 876 8F20.tmp 3612 8F9D.tmp 740 902A.tmp 4236 90B7.tmp 4644 9143.tmp 792 91E0.tmp 668 927C.tmp 1872 92F9.tmp 2664 9376.tmp 1716 93E3.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 536 wrote to memory of 5040 536 9101d77a0dfbf2378c6374daf4cf157b_mafia_JC.exe 83 PID 536 wrote to memory of 5040 536 9101d77a0dfbf2378c6374daf4cf157b_mafia_JC.exe 83 PID 536 wrote to memory of 5040 536 9101d77a0dfbf2378c6374daf4cf157b_mafia_JC.exe 83 PID 5040 wrote to memory of 2212 5040 69E5.tmp 84 PID 5040 wrote to memory of 2212 5040 69E5.tmp 84 PID 5040 wrote to memory of 2212 5040 69E5.tmp 84 PID 2212 wrote to memory of 1784 2212 6AA1.tmp 85 PID 2212 wrote to memory of 1784 2212 6AA1.tmp 85 PID 2212 wrote to memory of 1784 2212 6AA1.tmp 85 PID 1784 wrote to memory of 1556 1784 6B3D.tmp 86 PID 1784 wrote to memory of 1556 1784 6B3D.tmp 86 PID 1784 wrote to memory of 1556 1784 6B3D.tmp 86 PID 1556 wrote to memory of 4236 1556 6C37.tmp 87 PID 1556 wrote to memory of 4236 1556 6C37.tmp 87 PID 1556 wrote to memory of 4236 1556 6C37.tmp 87 PID 4236 wrote to memory of 1948 4236 6CF2.tmp 88 PID 4236 wrote to memory of 1948 4236 6CF2.tmp 88 PID 4236 wrote to memory of 1948 4236 6CF2.tmp 88 PID 1948 wrote to memory of 2248 1948 6DBE.tmp 89 PID 1948 wrote to memory of 2248 1948 6DBE.tmp 89 PID 1948 wrote to memory of 2248 1948 6DBE.tmp 89 PID 2248 wrote to memory of 1620 2248 6E5A.tmp 90 PID 2248 wrote to memory of 1620 2248 6E5A.tmp 90 PID 2248 wrote to memory of 1620 2248 6E5A.tmp 90 PID 1620 wrote to memory of 868 1620 6F25.tmp 91 PID 1620 wrote to memory of 868 1620 6F25.tmp 91 PID 1620 wrote to memory of 868 1620 6F25.tmp 91 PID 868 wrote to memory of 4664 868 6FD1.tmp 92 PID 868 wrote to memory of 4664 868 6FD1.tmp 92 PID 868 wrote to memory of 4664 868 6FD1.tmp 92 PID 4664 wrote to memory of 220 4664 707D.tmp 93 PID 4664 wrote to memory of 220 4664 707D.tmp 93 PID 4664 wrote to memory of 220 4664 707D.tmp 93 PID 220 wrote to memory of 3364 220 7129.tmp 94 PID 220 wrote to memory of 3364 220 7129.tmp 94 PID 220 wrote to memory of 3364 220 7129.tmp 94 PID 3364 wrote to memory of 3380 3364 7271.tmp 95 PID 3364 wrote to memory of 3380 3364 7271.tmp 95 PID 3364 wrote to memory of 3380 3364 7271.tmp 95 PID 3380 wrote to memory of 1016 3380 732C.tmp 96 PID 3380 wrote to memory of 1016 3380 732C.tmp 96 PID 3380 wrote to memory of 1016 3380 732C.tmp 96 PID 1016 wrote to memory of 1676 1016 7474.tmp 97 PID 1016 wrote to memory of 1676 1016 7474.tmp 97 PID 1016 wrote to memory of 1676 1016 7474.tmp 97 PID 1676 wrote to memory of 3156 1676 7520.tmp 100 PID 1676 wrote to memory of 3156 1676 7520.tmp 100 PID 1676 wrote to memory of 3156 1676 7520.tmp 100 PID 3156 wrote to memory of 4160 3156 75DC.tmp 101 PID 3156 wrote to memory of 4160 3156 75DC.tmp 101 PID 3156 wrote to memory of 4160 3156 75DC.tmp 101 PID 4160 wrote to memory of 4464 4160 7688.tmp 102 PID 4160 wrote to memory of 4464 4160 7688.tmp 102 PID 4160 wrote to memory of 4464 4160 7688.tmp 102 PID 4464 wrote to memory of 2760 4464 7772.tmp 103 PID 4464 wrote to memory of 2760 4464 7772.tmp 103 PID 4464 wrote to memory of 2760 4464 7772.tmp 103 PID 2760 wrote to memory of 4152 2760 781E.tmp 104 PID 2760 wrote to memory of 4152 2760 781E.tmp 104 PID 2760 wrote to memory of 4152 2760 781E.tmp 104 PID 4152 wrote to memory of 4528 4152 7937.tmp 105 PID 4152 wrote to memory of 4528 4152 7937.tmp 105 PID 4152 wrote to memory of 4528 4152 7937.tmp 105 PID 4528 wrote to memory of 3132 4528 7A12.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\9101d77a0dfbf2378c6374daf4cf157b_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\9101d77a0dfbf2378c6374daf4cf157b_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\7772.tmp"C:\Users\Admin\AppData\Local\Temp\7772.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\7937.tmp"C:\Users\Admin\AppData\Local\Temp\7937.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\7A12.tmp"C:\Users\Admin\AppData\Local\Temp\7A12.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"23⤵
- Executes dropped EXE
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\7B79.tmp"C:\Users\Admin\AppData\Local\Temp\7B79.tmp"24⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\7C54.tmp"C:\Users\Admin\AppData\Local\Temp\7C54.tmp"25⤵
- Executes dropped EXE
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"26⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"27⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\7E77.tmp"C:\Users\Admin\AppData\Local\Temp\7E77.tmp"28⤵
- Executes dropped EXE
PID:724 -
C:\Users\Admin\AppData\Local\Temp\7F32.tmp"C:\Users\Admin\AppData\Local\Temp\7F32.tmp"29⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\800D.tmp"C:\Users\Admin\AppData\Local\Temp\800D.tmp"30⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\80A9.tmp"C:\Users\Admin\AppData\Local\Temp\80A9.tmp"31⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\8194.tmp"C:\Users\Admin\AppData\Local\Temp\8194.tmp"32⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\8230.tmp"C:\Users\Admin\AppData\Local\Temp\8230.tmp"33⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"34⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\833A.tmp"C:\Users\Admin\AppData\Local\Temp\833A.tmp"35⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\83A7.tmp"C:\Users\Admin\AppData\Local\Temp\83A7.tmp"36⤵
- Executes dropped EXE
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\8453.tmp"C:\Users\Admin\AppData\Local\Temp\8453.tmp"37⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\84EF.tmp"C:\Users\Admin\AppData\Local\Temp\84EF.tmp"38⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\859B.tmp"C:\Users\Admin\AppData\Local\Temp\859B.tmp"39⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\8618.tmp"C:\Users\Admin\AppData\Local\Temp\8618.tmp"40⤵
- Executes dropped EXE
PID:872 -
C:\Users\Admin\AppData\Local\Temp\86A5.tmp"C:\Users\Admin\AppData\Local\Temp\86A5.tmp"41⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\8741.tmp"C:\Users\Admin\AppData\Local\Temp\8741.tmp"42⤵
- Executes dropped EXE
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\87CD.tmp"C:\Users\Admin\AppData\Local\Temp\87CD.tmp"43⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\886A.tmp"C:\Users\Admin\AppData\Local\Temp\886A.tmp"44⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\8916.tmp"C:\Users\Admin\AppData\Local\Temp\8916.tmp"45⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\89A2.tmp"C:\Users\Admin\AppData\Local\Temp\89A2.tmp"46⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"47⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"48⤵
- Executes dropped EXE
PID:788 -
C:\Users\Admin\AppData\Local\Temp\8B67.tmp"C:\Users\Admin\AppData\Local\Temp\8B67.tmp"49⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"50⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\8C71.tmp"C:\Users\Admin\AppData\Local\Temp\8C71.tmp"51⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"52⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"53⤵
- Executes dropped EXE
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\8E07.tmp"C:\Users\Admin\AppData\Local\Temp\8E07.tmp"54⤵
- Executes dropped EXE
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\8E94.tmp"C:\Users\Admin\AppData\Local\Temp\8E94.tmp"55⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\8F20.tmp"C:\Users\Admin\AppData\Local\Temp\8F20.tmp"56⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"57⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\902A.tmp"C:\Users\Admin\AppData\Local\Temp\902A.tmp"58⤵
- Executes dropped EXE
PID:740 -
C:\Users\Admin\AppData\Local\Temp\90B7.tmp"C:\Users\Admin\AppData\Local\Temp\90B7.tmp"59⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\9143.tmp"C:\Users\Admin\AppData\Local\Temp\9143.tmp"60⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\91E0.tmp"C:\Users\Admin\AppData\Local\Temp\91E0.tmp"61⤵
- Executes dropped EXE
PID:792 -
C:\Users\Admin\AppData\Local\Temp\927C.tmp"C:\Users\Admin\AppData\Local\Temp\927C.tmp"62⤵
- Executes dropped EXE
PID:668 -
C:\Users\Admin\AppData\Local\Temp\92F9.tmp"C:\Users\Admin\AppData\Local\Temp\92F9.tmp"63⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\9376.tmp"C:\Users\Admin\AppData\Local\Temp\9376.tmp"64⤵
- Executes dropped EXE
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"65⤵
- Executes dropped EXE
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\9460.tmp"C:\Users\Admin\AppData\Local\Temp\9460.tmp"66⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\94CE.tmp"C:\Users\Admin\AppData\Local\Temp\94CE.tmp"67⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"68⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\95B8.tmp"C:\Users\Admin\AppData\Local\Temp\95B8.tmp"69⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\9625.tmp"C:\Users\Admin\AppData\Local\Temp\9625.tmp"70⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\96C2.tmp"C:\Users\Admin\AppData\Local\Temp\96C2.tmp"71⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"72⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\97DB.tmp"C:\Users\Admin\AppData\Local\Temp\97DB.tmp"73⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\9848.tmp"C:\Users\Admin\AppData\Local\Temp\9848.tmp"74⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\98B6.tmp"C:\Users\Admin\AppData\Local\Temp\98B6.tmp"75⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"76⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\99A0.tmp"C:\Users\Admin\AppData\Local\Temp\99A0.tmp"77⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"78⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"79⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"80⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"81⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"82⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"83⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"84⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\9D69.tmp"C:\Users\Admin\AppData\Local\Temp\9D69.tmp"85⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"86⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"87⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"88⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"89⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"90⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\A066.tmp"C:\Users\Admin\AppData\Local\Temp\A066.tmp"91⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"92⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"93⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\A20C.tmp"C:\Users\Admin\AppData\Local\Temp\A20C.tmp"94⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"95⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"96⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\A354.tmp"C:\Users\Admin\AppData\Local\Temp\A354.tmp"97⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"98⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"99⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"100⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\A577.tmp"C:\Users\Admin\AppData\Local\Temp\A577.tmp"101⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\A613.tmp"C:\Users\Admin\AppData\Local\Temp\A613.tmp"102⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"103⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"104⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"105⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\A827.tmp"C:\Users\Admin\AppData\Local\Temp\A827.tmp"106⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"107⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\A921.tmp"C:\Users\Admin\AppData\Local\Temp\A921.tmp"108⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"109⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"110⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\AB05.tmp"C:\Users\Admin\AppData\Local\Temp\AB05.tmp"111⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\AB82.tmp"C:\Users\Admin\AppData\Local\Temp\AB82.tmp"112⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"113⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"114⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"115⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"116⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\AE12.tmp"C:\Users\Admin\AppData\Local\Temp\AE12.tmp"117⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"118⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"119⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"120⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\B064.tmp"C:\Users\Admin\AppData\Local\Temp\B064.tmp"121⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\B100.tmp"C:\Users\Admin\AppData\Local\Temp\B100.tmp"122⤵PID:2248
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-