Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
22/08/2023, 16:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6b63edd2321d74ea9064c22c559a08da_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
6b63edd2321d74ea9064c22c559a08da_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
6b63edd2321d74ea9064c22c559a08da_mafia_JC.exe
-
Size
488KB
-
MD5
6b63edd2321d74ea9064c22c559a08da
-
SHA1
737bdb2839eba79d54e908ca76d090eb4e6f0807
-
SHA256
161a70c0010f7a61576a939341d7693734c39b424cb05f914022766c4ad22fd6
-
SHA512
b911c08afd1f7576e4b221fa1a30d761cae5f0307b3946fa728944c64bdcd19ead1f60a8462dc4c4244279e375974c74f28b7031551087ee5217be05ce096323
-
SSDEEP
12288:/U5rCOTeiDC4ZaN+ON0EYU/PsOKyVWS0zNZ:/UQOJDhwN50EH/PX6N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4528 6B5C.tmp 4976 6C08.tmp 1496 6C85.tmp 892 6D60.tmp 3384 6DEC.tmp 1484 6E98.tmp 1536 6F35.tmp 5020 6FE0.tmp 2148 70EA.tmp 4256 71C5.tmp 4432 72A0.tmp 4900 738A.tmp 4720 7426.tmp 4896 74D2.tmp 4360 762A.tmp 2284 7714.tmp 3588 780E.tmp 2536 78E9.tmp 3536 79C4.tmp 804 7B1B.tmp 3760 7BD7.tmp 4344 7C54.tmp 4800 7CE1.tmp 3532 7D7D.tmp 320 7E19.tmp 4792 7EF4.tmp 2888 7F90.tmp 3792 804C.tmp 456 8146.tmp 1232 8220.tmp 2192 830B.tmp 1448 83C6.tmp 2936 8443.tmp 4332 84EF.tmp 4228 858B.tmp 3056 8656.tmp 4888 86E3.tmp 4936 8770.tmp 3920 87FC.tmp 4092 8889.tmp 2208 8906.tmp 4072 8993.tmp 3904 8A2F.tmp 1900 8ACB.tmp 652 8BE4.tmp 2564 8C71.tmp 3660 8D1D.tmp 4596 8DA9.tmp 1272 8E36.tmp 956 8ED2.tmp 504 8F6F.tmp 5116 9069.tmp 1140 9105.tmp 4528 91A1.tmp 1576 922E.tmp 4320 92BA.tmp 4412 9328.tmp 3360 9395.tmp 1464 9412.tmp 472 9470.tmp 404 94ED.tmp 3976 9599.tmp 4252 9616.tmp 2664 9693.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1064 wrote to memory of 4528 1064 6b63edd2321d74ea9064c22c559a08da_mafia_JC.exe 81 PID 1064 wrote to memory of 4528 1064 6b63edd2321d74ea9064c22c559a08da_mafia_JC.exe 81 PID 1064 wrote to memory of 4528 1064 6b63edd2321d74ea9064c22c559a08da_mafia_JC.exe 81 PID 4528 wrote to memory of 4976 4528 6B5C.tmp 82 PID 4528 wrote to memory of 4976 4528 6B5C.tmp 82 PID 4528 wrote to memory of 4976 4528 6B5C.tmp 82 PID 4976 wrote to memory of 1496 4976 6C08.tmp 83 PID 4976 wrote to memory of 1496 4976 6C08.tmp 83 PID 4976 wrote to memory of 1496 4976 6C08.tmp 83 PID 1496 wrote to memory of 892 1496 6C85.tmp 84 PID 1496 wrote to memory of 892 1496 6C85.tmp 84 PID 1496 wrote to memory of 892 1496 6C85.tmp 84 PID 892 wrote to memory of 3384 892 6D60.tmp 85 PID 892 wrote to memory of 3384 892 6D60.tmp 85 PID 892 wrote to memory of 3384 892 6D60.tmp 85 PID 3384 wrote to memory of 1484 3384 6DEC.tmp 86 PID 3384 wrote to memory of 1484 3384 6DEC.tmp 86 PID 3384 wrote to memory of 1484 3384 6DEC.tmp 86 PID 1484 wrote to memory of 1536 1484 6E98.tmp 87 PID 1484 wrote to memory of 1536 1484 6E98.tmp 87 PID 1484 wrote to memory of 1536 1484 6E98.tmp 87 PID 1536 wrote to memory of 5020 1536 6F35.tmp 88 PID 1536 wrote to memory of 5020 1536 6F35.tmp 88 PID 1536 wrote to memory of 5020 1536 6F35.tmp 88 PID 5020 wrote to memory of 2148 5020 6FE0.tmp 89 PID 5020 wrote to memory of 2148 5020 6FE0.tmp 89 PID 5020 wrote to memory of 2148 5020 6FE0.tmp 89 PID 2148 wrote to memory of 4256 2148 70EA.tmp 90 PID 2148 wrote to memory of 4256 2148 70EA.tmp 90 PID 2148 wrote to memory of 4256 2148 70EA.tmp 90 PID 4256 wrote to memory of 4432 4256 71C5.tmp 91 PID 4256 wrote to memory of 4432 4256 71C5.tmp 91 PID 4256 wrote to memory of 4432 4256 71C5.tmp 91 PID 4432 wrote to memory of 4900 4432 72A0.tmp 92 PID 4432 wrote to memory of 4900 4432 72A0.tmp 92 PID 4432 wrote to memory of 4900 4432 72A0.tmp 92 PID 4900 wrote to memory of 4720 4900 738A.tmp 93 PID 4900 wrote to memory of 4720 4900 738A.tmp 93 PID 4900 wrote to memory of 4720 4900 738A.tmp 93 PID 4720 wrote to memory of 4896 4720 7426.tmp 94 PID 4720 wrote to memory of 4896 4720 7426.tmp 94 PID 4720 wrote to memory of 4896 4720 7426.tmp 94 PID 4896 wrote to memory of 4360 4896 74D2.tmp 97 PID 4896 wrote to memory of 4360 4896 74D2.tmp 97 PID 4896 wrote to memory of 4360 4896 74D2.tmp 97 PID 4360 wrote to memory of 2284 4360 762A.tmp 98 PID 4360 wrote to memory of 2284 4360 762A.tmp 98 PID 4360 wrote to memory of 2284 4360 762A.tmp 98 PID 2284 wrote to memory of 3588 2284 7714.tmp 99 PID 2284 wrote to memory of 3588 2284 7714.tmp 99 PID 2284 wrote to memory of 3588 2284 7714.tmp 99 PID 3588 wrote to memory of 2536 3588 780E.tmp 100 PID 3588 wrote to memory of 2536 3588 780E.tmp 100 PID 3588 wrote to memory of 2536 3588 780E.tmp 100 PID 2536 wrote to memory of 3536 2536 78E9.tmp 101 PID 2536 wrote to memory of 3536 2536 78E9.tmp 101 PID 2536 wrote to memory of 3536 2536 78E9.tmp 101 PID 3536 wrote to memory of 804 3536 79C4.tmp 103 PID 3536 wrote to memory of 804 3536 79C4.tmp 103 PID 3536 wrote to memory of 804 3536 79C4.tmp 103 PID 804 wrote to memory of 3760 804 7B1B.tmp 104 PID 804 wrote to memory of 3760 804 7B1B.tmp 104 PID 804 wrote to memory of 3760 804 7B1B.tmp 104 PID 3760 wrote to memory of 4344 3760 7BD7.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b63edd2321d74ea9064c22c559a08da_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\6b63edd2321d74ea9064c22c559a08da_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\72A0.tmp"C:\Users\Admin\AppData\Local\Temp\72A0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\7714.tmp"C:\Users\Admin\AppData\Local\Temp\7714.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\780E.tmp"C:\Users\Admin\AppData\Local\Temp\780E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\79C4.tmp"C:\Users\Admin\AppData\Local\Temp\79C4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\7C54.tmp"C:\Users\Admin\AppData\Local\Temp\7C54.tmp"23⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"24⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"25⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"26⤵
- Executes dropped EXE
PID:320 -
C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"27⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\7F90.tmp"C:\Users\Admin\AppData\Local\Temp\7F90.tmp"28⤵
- Executes dropped EXE
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\804C.tmp"C:\Users\Admin\AppData\Local\Temp\804C.tmp"29⤵
- Executes dropped EXE
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\8146.tmp"C:\Users\Admin\AppData\Local\Temp\8146.tmp"30⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\8220.tmp"C:\Users\Admin\AppData\Local\Temp\8220.tmp"31⤵
- Executes dropped EXE
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\830B.tmp"C:\Users\Admin\AppData\Local\Temp\830B.tmp"32⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\83C6.tmp"C:\Users\Admin\AppData\Local\Temp\83C6.tmp"33⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"34⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\84EF.tmp"C:\Users\Admin\AppData\Local\Temp\84EF.tmp"35⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\858B.tmp"C:\Users\Admin\AppData\Local\Temp\858B.tmp"36⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"37⤵
- Executes dropped EXE
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\86E3.tmp"C:\Users\Admin\AppData\Local\Temp\86E3.tmp"38⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\8770.tmp"C:\Users\Admin\AppData\Local\Temp\8770.tmp"39⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\87FC.tmp"C:\Users\Admin\AppData\Local\Temp\87FC.tmp"40⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\8889.tmp"C:\Users\Admin\AppData\Local\Temp\8889.tmp"41⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\8906.tmp"C:\Users\Admin\AppData\Local\Temp\8906.tmp"42⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\8993.tmp"C:\Users\Admin\AppData\Local\Temp\8993.tmp"43⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"44⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"45⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"46⤵
- Executes dropped EXE
PID:652 -
C:\Users\Admin\AppData\Local\Temp\8C71.tmp"C:\Users\Admin\AppData\Local\Temp\8C71.tmp"47⤵
- Executes dropped EXE
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"48⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"49⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp"50⤵
- Executes dropped EXE
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"51⤵
- Executes dropped EXE
PID:956 -
C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"52⤵
- Executes dropped EXE
PID:504 -
C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"53⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"54⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"55⤵
- Executes dropped EXE
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"56⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\922E.tmp"C:\Users\Admin\AppData\Local\Temp\922E.tmp"57⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"58⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\9328.tmp"C:\Users\Admin\AppData\Local\Temp\9328.tmp"59⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\9395.tmp"C:\Users\Admin\AppData\Local\Temp\9395.tmp"60⤵
- Executes dropped EXE
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\9412.tmp"C:\Users\Admin\AppData\Local\Temp\9412.tmp"61⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\9470.tmp"C:\Users\Admin\AppData\Local\Temp\9470.tmp"62⤵
- Executes dropped EXE
PID:472 -
C:\Users\Admin\AppData\Local\Temp\94ED.tmp"C:\Users\Admin\AppData\Local\Temp\94ED.tmp"63⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\9599.tmp"C:\Users\Admin\AppData\Local\Temp\9599.tmp"64⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"65⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\9693.tmp"C:\Users\Admin\AppData\Local\Temp\9693.tmp"66⤵
- Executes dropped EXE
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\9710.tmp"C:\Users\Admin\AppData\Local\Temp\9710.tmp"67⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"68⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\9819.tmp"C:\Users\Admin\AppData\Local\Temp\9819.tmp"69⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\98A6.tmp"C:\Users\Admin\AppData\Local\Temp\98A6.tmp"70⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\9923.tmp"C:\Users\Admin\AppData\Local\Temp\9923.tmp"71⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"72⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"73⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"74⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"75⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"76⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"77⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"78⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"79⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"80⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"81⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"82⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"83⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"84⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"85⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"86⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"87⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"88⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"89⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"90⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"91⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"92⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\A41F.tmp"C:\Users\Admin\AppData\Local\Temp\A41F.tmp"93⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"94⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\A519.tmp"C:\Users\Admin\AppData\Local\Temp\A519.tmp"95⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"96⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"97⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"98⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"99⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"100⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\A856.tmp"C:\Users\Admin\AppData\Local\Temp\A856.tmp"101⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"102⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"103⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"104⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"105⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"106⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\AB92.tmp"C:\Users\Admin\AppData\Local\Temp\AB92.tmp"107⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"108⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"109⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"110⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"111⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\AE51.tmp"C:\Users\Admin\AppData\Local\Temp\AE51.tmp"112⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\AECE.tmp"C:\Users\Admin\AppData\Local\Temp\AECE.tmp"113⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"114⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"115⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\B083.tmp"C:\Users\Admin\AppData\Local\Temp\B083.tmp"116⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\B110.tmp"C:\Users\Admin\AppData\Local\Temp\B110.tmp"117⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\B17D.tmp"C:\Users\Admin\AppData\Local\Temp\B17D.tmp"118⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\B21A.tmp"C:\Users\Admin\AppData\Local\Temp\B21A.tmp"119⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"120⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\B323.tmp"C:\Users\Admin\AppData\Local\Temp\B323.tmp"121⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"122⤵PID:2092
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-