Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2023, 14:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
12f9cfe307512c544c55c524024657f5_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
12f9cfe307512c544c55c524024657f5_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
12f9cfe307512c544c55c524024657f5_mafia_JC.exe
-
Size
527KB
-
MD5
12f9cfe307512c544c55c524024657f5
-
SHA1
79c3a4787a45447c9c4eecee4c01a3f8ac61fcd1
-
SHA256
9e906e3deb5f2ee005d289376d58ada946b352cd74f60922364bbf2869b06ea3
-
SHA512
af822202122d2348949a3b8197bae4ee55d3ffb7830ac4304ea383a8f7b4a1596645520041d06238643836b5707226b8c3dd22f1eb36b9019b7dada485df9e05
-
SSDEEP
12288:fU5rCOTeidjGolN2fYB6xUaBxFkXvJ9mQDZu:fUQOJdjGolN4Umx497Do
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2560 6503.tmp 4100 65AF.tmp 4304 666B.tmp 3596 6736.tmp 2428 6830.tmp 1212 6BAA.tmp 3428 6C85.tmp 5048 7455.tmp 1744 7501.tmp 1504 75CC.tmp 3480 76A7.tmp 3520 7733.tmp 2060 77C0.tmp 1300 78AA.tmp 2700 7937.tmp 3228 79D3.tmp 1696 7A9E.tmp 3736 7B3B.tmp 1264 7BD7.tmp 2300 7C64.tmp 1144 7D3E.tmp 3968 7E19.tmp 1108 7F13.tmp 4992 7FCF.tmp 3404 807A.tmp 4768 8107.tmp 656 81A3.tmp 3920 8240.tmp 2276 82EB.tmp 5008 8388.tmp 3260 85CA.tmp 2344 8656.tmp 4496 86F3.tmp 4112 877F.tmp 4284 882B.tmp 2248 88C7.tmp 2136 8973.tmp 3948 89E1.tmp 3924 8A4E.tmp 3652 8ACB.tmp 2756 8B67.tmp 4208 8BE4.tmp 568 8C71.tmp 2860 8CFE.tmp 2088 8D6B.tmp 4180 8DD8.tmp 1216 8E75.tmp 464 8F30.tmp 996 8FCC.tmp 4952 9059.tmp 4764 9172.tmp 3908 91FF.tmp 1176 927C.tmp 1252 9318.tmp 5076 93A5.tmp 3944 9431.tmp 4656 94CE.tmp 2836 956A.tmp 1720 95E7.tmp 3096 9683.tmp 4160 9700.tmp 1212 979C.tmp 2816 980A.tmp 4900 9877.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 928 wrote to memory of 2560 928 12f9cfe307512c544c55c524024657f5_mafia_JC.exe 83 PID 928 wrote to memory of 2560 928 12f9cfe307512c544c55c524024657f5_mafia_JC.exe 83 PID 928 wrote to memory of 2560 928 12f9cfe307512c544c55c524024657f5_mafia_JC.exe 83 PID 2560 wrote to memory of 4100 2560 6503.tmp 84 PID 2560 wrote to memory of 4100 2560 6503.tmp 84 PID 2560 wrote to memory of 4100 2560 6503.tmp 84 PID 4100 wrote to memory of 4304 4100 65AF.tmp 85 PID 4100 wrote to memory of 4304 4100 65AF.tmp 85 PID 4100 wrote to memory of 4304 4100 65AF.tmp 85 PID 4304 wrote to memory of 3596 4304 666B.tmp 86 PID 4304 wrote to memory of 3596 4304 666B.tmp 86 PID 4304 wrote to memory of 3596 4304 666B.tmp 86 PID 3596 wrote to memory of 2428 3596 6736.tmp 87 PID 3596 wrote to memory of 2428 3596 6736.tmp 87 PID 3596 wrote to memory of 2428 3596 6736.tmp 87 PID 2428 wrote to memory of 1212 2428 6830.tmp 88 PID 2428 wrote to memory of 1212 2428 6830.tmp 88 PID 2428 wrote to memory of 1212 2428 6830.tmp 88 PID 1212 wrote to memory of 3428 1212 6BAA.tmp 89 PID 1212 wrote to memory of 3428 1212 6BAA.tmp 89 PID 1212 wrote to memory of 3428 1212 6BAA.tmp 89 PID 3428 wrote to memory of 5048 3428 6C85.tmp 90 PID 3428 wrote to memory of 5048 3428 6C85.tmp 90 PID 3428 wrote to memory of 5048 3428 6C85.tmp 90 PID 5048 wrote to memory of 1744 5048 7455.tmp 91 PID 5048 wrote to memory of 1744 5048 7455.tmp 91 PID 5048 wrote to memory of 1744 5048 7455.tmp 91 PID 1744 wrote to memory of 1504 1744 7501.tmp 92 PID 1744 wrote to memory of 1504 1744 7501.tmp 92 PID 1744 wrote to memory of 1504 1744 7501.tmp 92 PID 1504 wrote to memory of 3480 1504 75CC.tmp 93 PID 1504 wrote to memory of 3480 1504 75CC.tmp 93 PID 1504 wrote to memory of 3480 1504 75CC.tmp 93 PID 3480 wrote to memory of 3520 3480 76A7.tmp 94 PID 3480 wrote to memory of 3520 3480 76A7.tmp 94 PID 3480 wrote to memory of 3520 3480 76A7.tmp 94 PID 3520 wrote to memory of 2060 3520 7733.tmp 95 PID 3520 wrote to memory of 2060 3520 7733.tmp 95 PID 3520 wrote to memory of 2060 3520 7733.tmp 95 PID 2060 wrote to memory of 1300 2060 77C0.tmp 96 PID 2060 wrote to memory of 1300 2060 77C0.tmp 96 PID 2060 wrote to memory of 1300 2060 77C0.tmp 96 PID 1300 wrote to memory of 2700 1300 78AA.tmp 97 PID 1300 wrote to memory of 2700 1300 78AA.tmp 97 PID 1300 wrote to memory of 2700 1300 78AA.tmp 97 PID 2700 wrote to memory of 3228 2700 7937.tmp 98 PID 2700 wrote to memory of 3228 2700 7937.tmp 98 PID 2700 wrote to memory of 3228 2700 7937.tmp 98 PID 3228 wrote to memory of 1696 3228 79D3.tmp 99 PID 3228 wrote to memory of 1696 3228 79D3.tmp 99 PID 3228 wrote to memory of 1696 3228 79D3.tmp 99 PID 1696 wrote to memory of 3736 1696 7A9E.tmp 100 PID 1696 wrote to memory of 3736 1696 7A9E.tmp 100 PID 1696 wrote to memory of 3736 1696 7A9E.tmp 100 PID 3736 wrote to memory of 1264 3736 7B3B.tmp 101 PID 3736 wrote to memory of 1264 3736 7B3B.tmp 101 PID 3736 wrote to memory of 1264 3736 7B3B.tmp 101 PID 1264 wrote to memory of 2300 1264 7BD7.tmp 102 PID 1264 wrote to memory of 2300 1264 7BD7.tmp 102 PID 1264 wrote to memory of 2300 1264 7BD7.tmp 102 PID 2300 wrote to memory of 1144 2300 7C64.tmp 105 PID 2300 wrote to memory of 1144 2300 7C64.tmp 105 PID 2300 wrote to memory of 1144 2300 7C64.tmp 105 PID 1144 wrote to memory of 3968 1144 7D3E.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\12f9cfe307512c544c55c524024657f5_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\12f9cfe307512c544c55c524024657f5_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\7937.tmp"C:\Users\Admin\AppData\Local\Temp\7937.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\79D3.tmp"C:\Users\Admin\AppData\Local\Temp\79D3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\7C64.tmp"C:\Users\Admin\AppData\Local\Temp\7C64.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"23⤵
- Executes dropped EXE
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\7F13.tmp"C:\Users\Admin\AppData\Local\Temp\7F13.tmp"24⤵
- Executes dropped EXE
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"25⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\807A.tmp"C:\Users\Admin\AppData\Local\Temp\807A.tmp"26⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\8107.tmp"C:\Users\Admin\AppData\Local\Temp\8107.tmp"27⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\81A3.tmp"C:\Users\Admin\AppData\Local\Temp\81A3.tmp"28⤵
- Executes dropped EXE
PID:656 -
C:\Users\Admin\AppData\Local\Temp\8240.tmp"C:\Users\Admin\AppData\Local\Temp\8240.tmp"29⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\82EB.tmp"C:\Users\Admin\AppData\Local\Temp\82EB.tmp"30⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\8388.tmp"C:\Users\Admin\AppData\Local\Temp\8388.tmp"31⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\85CA.tmp"C:\Users\Admin\AppData\Local\Temp\85CA.tmp"32⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"33⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\86F3.tmp"C:\Users\Admin\AppData\Local\Temp\86F3.tmp"34⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\877F.tmp"C:\Users\Admin\AppData\Local\Temp\877F.tmp"35⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\882B.tmp"C:\Users\Admin\AppData\Local\Temp\882B.tmp"36⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\88C7.tmp"C:\Users\Admin\AppData\Local\Temp\88C7.tmp"37⤵
- Executes dropped EXE
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\8973.tmp"C:\Users\Admin\AppData\Local\Temp\8973.tmp"38⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\89E1.tmp"C:\Users\Admin\AppData\Local\Temp\89E1.tmp"39⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"40⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"41⤵
- Executes dropped EXE
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\8B67.tmp"C:\Users\Admin\AppData\Local\Temp\8B67.tmp"42⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"43⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\8C71.tmp"C:\Users\Admin\AppData\Local\Temp\8C71.tmp"44⤵
- Executes dropped EXE
PID:568 -
C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"45⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"46⤵
- Executes dropped EXE
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"47⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\8E75.tmp"C:\Users\Admin\AppData\Local\Temp\8E75.tmp"48⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\8F30.tmp"C:\Users\Admin\AppData\Local\Temp\8F30.tmp"49⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"50⤵
- Executes dropped EXE
PID:996 -
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"51⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\90E6.tmp"C:\Users\Admin\AppData\Local\Temp\90E6.tmp"52⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp"53⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"54⤵
- Executes dropped EXE
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\927C.tmp"C:\Users\Admin\AppData\Local\Temp\927C.tmp"55⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"56⤵
- Executes dropped EXE
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\93A5.tmp"C:\Users\Admin\AppData\Local\Temp\93A5.tmp"57⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"58⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\94CE.tmp"C:\Users\Admin\AppData\Local\Temp\94CE.tmp"59⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\956A.tmp"C:\Users\Admin\AppData\Local\Temp\956A.tmp"60⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\95E7.tmp"C:\Users\Admin\AppData\Local\Temp\95E7.tmp"61⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"62⤵
- Executes dropped EXE
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\9700.tmp"C:\Users\Admin\AppData\Local\Temp\9700.tmp"63⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"64⤵
- Executes dropped EXE
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"65⤵
- Executes dropped EXE
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\9877.tmp"C:\Users\Admin\AppData\Local\Temp\9877.tmp"66⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\9923.tmp"C:\Users\Admin\AppData\Local\Temp\9923.tmp"67⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\99A0.tmp"C:\Users\Admin\AppData\Local\Temp\99A0.tmp"68⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"69⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"70⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"71⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"72⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"73⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"74⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"75⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"76⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"77⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"78⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"79⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"80⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"81⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\A086.tmp"C:\Users\Admin\AppData\Local\Temp\A086.tmp"82⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\A103.tmp"C:\Users\Admin\AppData\Local\Temp\A103.tmp"83⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\A19F.tmp"C:\Users\Admin\AppData\Local\Temp\A19F.tmp"84⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"85⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\A299.tmp"C:\Users\Admin\AppData\Local\Temp\A299.tmp"86⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\A325.tmp"C:\Users\Admin\AppData\Local\Temp\A325.tmp"87⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"88⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"89⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"90⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"91⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"92⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\A642.tmp"C:\Users\Admin\AppData\Local\Temp\A642.tmp"93⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"94⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"95⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"96⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\A827.tmp"C:\Users\Admin\AppData\Local\Temp\A827.tmp"97⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"98⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"99⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"100⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"101⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"102⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\AB53.tmp"C:\Users\Admin\AppData\Local\Temp\AB53.tmp"103⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"104⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"105⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\AD18.tmp"C:\Users\Admin\AppData\Local\Temp\AD18.tmp"106⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\AD95.tmp"C:\Users\Admin\AppData\Local\Temp\AD95.tmp"107⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"108⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"109⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"110⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"111⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\B035.tmp"C:\Users\Admin\AppData\Local\Temp\B035.tmp"112⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"113⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\B14E.tmp"C:\Users\Admin\AppData\Local\Temp\B14E.tmp"114⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"115⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\B277.tmp"C:\Users\Admin\AppData\Local\Temp\B277.tmp"116⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\B304.tmp"C:\Users\Admin\AppData\Local\Temp\B304.tmp"117⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"118⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"119⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"120⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\B546.tmp"C:\Users\Admin\AppData\Local\Temp\B546.tmp"121⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"122⤵PID:3596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-