Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2023, 14:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2db2186aaffcf46f44adde5f6da24449_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2db2186aaffcf46f44adde5f6da24449_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
2db2186aaffcf46f44adde5f6da24449_mafia_JC.exe
-
Size
487KB
-
MD5
2db2186aaffcf46f44adde5f6da24449
-
SHA1
ab00319ceccfd64d51dbcdac51a3f171e5a173ae
-
SHA256
1657e3650eba7c9ccdf7ce44fb13fafc995447d91e459ee7fe0c00fbefd894e6
-
SHA512
c26abc5e92da33dd84e646103fafe3bb24755c88c9b171f3d652bc23cd6156067c608eb2b4542bbf2b867303281881425d617366e159bfc16e11b9505b8761a1
-
SSDEEP
12288:yU5rCOTeiNZ04ME+j3JCPf0WExRZUqXbZ:yUQOJNZyrj3MUWEK+b
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1660 636D.tmp 2652 6438.tmp 4896 6522.tmp 4128 662C.tmp 4492 66E8.tmp 764 6784.tmp 4304 6820.tmp 2092 68DC.tmp 1496 6968.tmp 4952 6A04.tmp 4520 6A91.tmp 1768 6B3D.tmp 2348 6C18.tmp 492 6D02.tmp 3236 6D9E.tmp 4848 6E69.tmp 3756 6F63.tmp 2356 700F.tmp 408 707D.tmp 2536 7119.tmp 1936 71C5.tmp 4324 7261.tmp 652 733C.tmp 2252 73B9.tmp 984 759D.tmp 648 7649.tmp 3036 76D6.tmp 4828 7762.tmp 1956 782D.tmp 4104 78E9.tmp 3216 7995.tmp 524 7A7F.tmp 2808 7B2B.tmp 1404 7BA8.tmp 388 7C15.tmp 888 7CA2.tmp 2988 7D0F.tmp 2272 7D8C.tmp 4540 7E29.tmp 1336 7E96.tmp 4208 7F03.tmp 868 7FAF.tmp 840 803C.tmp 1756 80B9.tmp 2448 8165.tmp 3132 81F1.tmp 4296 826E.tmp 2900 8378.tmp 3224 83F5.tmp 2488 8472.tmp 116 84FF.tmp 4420 858B.tmp 2568 8637.tmp 1516 86B4.tmp 3456 8741.tmp 2728 87BE.tmp 4640 883B.tmp 2380 88B8.tmp 4492 8935.tmp 2576 89D1.tmp 4844 8A5E.tmp 216 8AEA.tmp 404 8B77.tmp 4228 8C13.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 436 wrote to memory of 1660 436 2db2186aaffcf46f44adde5f6da24449_mafia_JC.exe 81 PID 436 wrote to memory of 1660 436 2db2186aaffcf46f44adde5f6da24449_mafia_JC.exe 81 PID 436 wrote to memory of 1660 436 2db2186aaffcf46f44adde5f6da24449_mafia_JC.exe 81 PID 1660 wrote to memory of 2652 1660 636D.tmp 82 PID 1660 wrote to memory of 2652 1660 636D.tmp 82 PID 1660 wrote to memory of 2652 1660 636D.tmp 82 PID 2652 wrote to memory of 4896 2652 6438.tmp 83 PID 2652 wrote to memory of 4896 2652 6438.tmp 83 PID 2652 wrote to memory of 4896 2652 6438.tmp 83 PID 4896 wrote to memory of 4128 4896 6522.tmp 84 PID 4896 wrote to memory of 4128 4896 6522.tmp 84 PID 4896 wrote to memory of 4128 4896 6522.tmp 84 PID 4128 wrote to memory of 4492 4128 662C.tmp 85 PID 4128 wrote to memory of 4492 4128 662C.tmp 85 PID 4128 wrote to memory of 4492 4128 662C.tmp 85 PID 4492 wrote to memory of 764 4492 66E8.tmp 86 PID 4492 wrote to memory of 764 4492 66E8.tmp 86 PID 4492 wrote to memory of 764 4492 66E8.tmp 86 PID 764 wrote to memory of 4304 764 6784.tmp 87 PID 764 wrote to memory of 4304 764 6784.tmp 87 PID 764 wrote to memory of 4304 764 6784.tmp 87 PID 4304 wrote to memory of 2092 4304 6820.tmp 88 PID 4304 wrote to memory of 2092 4304 6820.tmp 88 PID 4304 wrote to memory of 2092 4304 6820.tmp 88 PID 2092 wrote to memory of 1496 2092 68DC.tmp 89 PID 2092 wrote to memory of 1496 2092 68DC.tmp 89 PID 2092 wrote to memory of 1496 2092 68DC.tmp 89 PID 1496 wrote to memory of 4952 1496 6968.tmp 90 PID 1496 wrote to memory of 4952 1496 6968.tmp 90 PID 1496 wrote to memory of 4952 1496 6968.tmp 90 PID 4952 wrote to memory of 4520 4952 6A04.tmp 92 PID 4952 wrote to memory of 4520 4952 6A04.tmp 92 PID 4952 wrote to memory of 4520 4952 6A04.tmp 92 PID 4520 wrote to memory of 1768 4520 6A91.tmp 93 PID 4520 wrote to memory of 1768 4520 6A91.tmp 93 PID 4520 wrote to memory of 1768 4520 6A91.tmp 93 PID 1768 wrote to memory of 2348 1768 6B3D.tmp 94 PID 1768 wrote to memory of 2348 1768 6B3D.tmp 94 PID 1768 wrote to memory of 2348 1768 6B3D.tmp 94 PID 2348 wrote to memory of 492 2348 6C18.tmp 95 PID 2348 wrote to memory of 492 2348 6C18.tmp 95 PID 2348 wrote to memory of 492 2348 6C18.tmp 95 PID 492 wrote to memory of 3236 492 6D02.tmp 96 PID 492 wrote to memory of 3236 492 6D02.tmp 96 PID 492 wrote to memory of 3236 492 6D02.tmp 96 PID 3236 wrote to memory of 4848 3236 6D9E.tmp 97 PID 3236 wrote to memory of 4848 3236 6D9E.tmp 97 PID 3236 wrote to memory of 4848 3236 6D9E.tmp 97 PID 4848 wrote to memory of 3756 4848 6E69.tmp 98 PID 4848 wrote to memory of 3756 4848 6E69.tmp 98 PID 4848 wrote to memory of 3756 4848 6E69.tmp 98 PID 3756 wrote to memory of 2356 3756 6F63.tmp 99 PID 3756 wrote to memory of 2356 3756 6F63.tmp 99 PID 3756 wrote to memory of 2356 3756 6F63.tmp 99 PID 2356 wrote to memory of 408 2356 700F.tmp 100 PID 2356 wrote to memory of 408 2356 700F.tmp 100 PID 2356 wrote to memory of 408 2356 700F.tmp 100 PID 408 wrote to memory of 2536 408 707D.tmp 101 PID 408 wrote to memory of 2536 408 707D.tmp 101 PID 408 wrote to memory of 2536 408 707D.tmp 101 PID 2536 wrote to memory of 1936 2536 7119.tmp 104 PID 2536 wrote to memory of 1936 2536 7119.tmp 104 PID 2536 wrote to memory of 1936 2536 7119.tmp 104 PID 1936 wrote to memory of 4324 1936 71C5.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2db2186aaffcf46f44adde5f6da24449_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2db2186aaffcf46f44adde5f6da24449_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:492 -
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\6F63.tmp"C:\Users\Admin\AppData\Local\Temp\6F63.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"23⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"24⤵
- Executes dropped EXE
PID:652 -
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"25⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"26⤵
- Executes dropped EXE
PID:984 -
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"27⤵
- Executes dropped EXE
PID:648 -
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"28⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\7762.tmp"C:\Users\Admin\AppData\Local\Temp\7762.tmp"29⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\782D.tmp"C:\Users\Admin\AppData\Local\Temp\782D.tmp"30⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"31⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\7995.tmp"C:\Users\Admin\AppData\Local\Temp\7995.tmp"32⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"33⤵
- Executes dropped EXE
PID:524 -
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"34⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"35⤵
- Executes dropped EXE
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\7C15.tmp"C:\Users\Admin\AppData\Local\Temp\7C15.tmp"36⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"37⤵
- Executes dropped EXE
PID:888 -
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"38⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"39⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\7E29.tmp"C:\Users\Admin\AppData\Local\Temp\7E29.tmp"40⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\7E96.tmp"C:\Users\Admin\AppData\Local\Temp\7E96.tmp"41⤵
- Executes dropped EXE
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\7F03.tmp"C:\Users\Admin\AppData\Local\Temp\7F03.tmp"42⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"43⤵
- Executes dropped EXE
PID:868 -
C:\Users\Admin\AppData\Local\Temp\803C.tmp"C:\Users\Admin\AppData\Local\Temp\803C.tmp"44⤵
- Executes dropped EXE
PID:840 -
C:\Users\Admin\AppData\Local\Temp\80B9.tmp"C:\Users\Admin\AppData\Local\Temp\80B9.tmp"45⤵
- Executes dropped EXE
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\8165.tmp"C:\Users\Admin\AppData\Local\Temp\8165.tmp"46⤵
- Executes dropped EXE
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\81F1.tmp"C:\Users\Admin\AppData\Local\Temp\81F1.tmp"47⤵
- Executes dropped EXE
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"48⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\82FB.tmp"C:\Users\Admin\AppData\Local\Temp\82FB.tmp"49⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\8378.tmp"C:\Users\Admin\AppData\Local\Temp\8378.tmp"50⤵
- Executes dropped EXE
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\83F5.tmp"C:\Users\Admin\AppData\Local\Temp\83F5.tmp"51⤵
- Executes dropped EXE
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\8472.tmp"C:\Users\Admin\AppData\Local\Temp\8472.tmp"52⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\84FF.tmp"C:\Users\Admin\AppData\Local\Temp\84FF.tmp"53⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\858B.tmp"C:\Users\Admin\AppData\Local\Temp\858B.tmp"54⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\8637.tmp"C:\Users\Admin\AppData\Local\Temp\8637.tmp"55⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"56⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\8741.tmp"C:\Users\Admin\AppData\Local\Temp\8741.tmp"57⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\87BE.tmp"C:\Users\Admin\AppData\Local\Temp\87BE.tmp"58⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\883B.tmp"C:\Users\Admin\AppData\Local\Temp\883B.tmp"59⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\88B8.tmp"C:\Users\Admin\AppData\Local\Temp\88B8.tmp"60⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\8935.tmp"C:\Users\Admin\AppData\Local\Temp\8935.tmp"61⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\89D1.tmp"C:\Users\Admin\AppData\Local\Temp\89D1.tmp"62⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"63⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"64⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\8B77.tmp"C:\Users\Admin\AppData\Local\Temp\8B77.tmp"65⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\8C13.tmp"C:\Users\Admin\AppData\Local\Temp\8C13.tmp"66⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"67⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"68⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"69⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp"70⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\8E94.tmp"C:\Users\Admin\AppData\Local\Temp\8E94.tmp"71⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"72⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"73⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"74⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\9078.tmp"C:\Users\Admin\AppData\Local\Temp\9078.tmp"75⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"76⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"77⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"78⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\927C.tmp"C:\Users\Admin\AppData\Local\Temp\927C.tmp"79⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\92F9.tmp"C:\Users\Admin\AppData\Local\Temp\92F9.tmp"80⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\9366.tmp"C:\Users\Admin\AppData\Local\Temp\9366.tmp"81⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"82⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\9470.tmp"C:\Users\Admin\AppData\Local\Temp\9470.tmp"83⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\94FC.tmp"C:\Users\Admin\AppData\Local\Temp\94FC.tmp"84⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\956A.tmp"C:\Users\Admin\AppData\Local\Temp\956A.tmp"85⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\95F6.tmp"C:\Users\Admin\AppData\Local\Temp\95F6.tmp"86⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"87⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\972F.tmp"C:\Users\Admin\AppData\Local\Temp\972F.tmp"88⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"89⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\9839.tmp"C:\Users\Admin\AppData\Local\Temp\9839.tmp"90⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\98A6.tmp"C:\Users\Admin\AppData\Local\Temp\98A6.tmp"91⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\9923.tmp"C:\Users\Admin\AppData\Local\Temp\9923.tmp"92⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\99BF.tmp"C:\Users\Admin\AppData\Local\Temp\99BF.tmp"93⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"94⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"95⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"96⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"97⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"98⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"99⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"100⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"101⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"102⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"103⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"104⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"105⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"106⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\A086.tmp"C:\Users\Admin\AppData\Local\Temp\A086.tmp"107⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\A103.tmp"C:\Users\Admin\AppData\Local\Temp\A103.tmp"108⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\A180.tmp"C:\Users\Admin\AppData\Local\Temp\A180.tmp"109⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\A21C.tmp"C:\Users\Admin\AppData\Local\Temp\A21C.tmp"110⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"111⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\A306.tmp"C:\Users\Admin\AppData\Local\Temp\A306.tmp"112⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"113⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\A410.tmp"C:\Users\Admin\AppData\Local\Temp\A410.tmp"114⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"115⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"116⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\A577.tmp"C:\Users\Admin\AppData\Local\Temp\A577.tmp"117⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"118⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"119⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"120⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"121⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\A836.tmp"C:\Users\Admin\AppData\Local\Temp\A836.tmp"122⤵PID:404
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-