Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
22/08/2023, 15:54
Static task
static1
Behavioral task
behavioral1
Sample
69b8c7db3d1b667dc61dd15edd434ac2_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
69b8c7db3d1b667dc61dd15edd434ac2_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
69b8c7db3d1b667dc61dd15edd434ac2_mafia_JC.exe
-
Size
520KB
-
MD5
69b8c7db3d1b667dc61dd15edd434ac2
-
SHA1
776a5cabf270ec65bc043efb6fd4cc510c1c6f1d
-
SHA256
f7da1f75de0deb3c71980ae384cdee604d4c3b4979345788c68c6a5c23129a5a
-
SHA512
88832ce55708f4fd1c96faff9cc4e69190f71067cc611922f42daf85ef70aba65e7f33c7b617049ae72ce9e98ffca6873bc92414e7a08cdcec82730436dfbb3c
-
SSDEEP
12288:0q5XOi3U+ByUrE3T5eOOHz+8La/A+eQHh18Umu+mtCrboWNZ:0qYi3By0Ej4OOHz/4VHT8/uIVN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2228 E30D.tmp 4000 E3F7.tmp 4668 E4C2.tmp 1732 E57E.tmp 4060 E649.tmp 1112 E724.tmp 1412 E7FE.tmp 4756 E8BA.tmp 4952 E9A4.tmp 2188 EA50.tmp 4684 EAFC.tmp 3148 EBA8.tmp 4636 EC73.tmp 4640 ED2F.tmp 4532 EDFA.tmp 4820 EEB5.tmp 4164 EF71.tmp 3540 F02C.tmp 3160 F0C8.tmp 1196 F230.tmp 2376 F2BC.tmp 4852 F3B6.tmp 1992 F51E.tmp 2700 F618.tmp 4604 F702.tmp 3336 F7DD.tmp 5088 F85A.tmp 4988 F935.tmp 3520 F9F0.tmp 4208 FB58.tmp 3952 FC13.tmp 2644 FCFD.tmp 1584 FDE8.tmp 2036 FE84.tmp 2868 3A.tmp 864 B7.tmp 2020 162.tmp 3280 25C.tmp 2180 2F9.tmp 4204 3C4.tmp 1248 47F.tmp 3848 52B.tmp 3388 5B8.tmp 4444 664.tmp 1580 72F.tmp 4916 7CB.tmp 4508 867.tmp 380 913.tmp 1556 9A0.tmp 2208 A7B.tmp 1420 B84.tmp 2960 C40.tmp 4948 D1A.tmp 4000 DE6.tmp 3312 E91.tmp 4580 EFF.tmp 3900 F7C.tmp 1728 FF9.tmp 1816 1095.tmp 4004 1112.tmp 4216 119F.tmp 2860 124B.tmp 4480 1316.tmp 3148 13B2.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2820 wrote to memory of 2228 2820 69b8c7db3d1b667dc61dd15edd434ac2_mafia_JC.exe 81 PID 2820 wrote to memory of 2228 2820 69b8c7db3d1b667dc61dd15edd434ac2_mafia_JC.exe 81 PID 2820 wrote to memory of 2228 2820 69b8c7db3d1b667dc61dd15edd434ac2_mafia_JC.exe 81 PID 2228 wrote to memory of 4000 2228 E30D.tmp 82 PID 2228 wrote to memory of 4000 2228 E30D.tmp 82 PID 2228 wrote to memory of 4000 2228 E30D.tmp 82 PID 4000 wrote to memory of 4668 4000 E3F7.tmp 83 PID 4000 wrote to memory of 4668 4000 E3F7.tmp 83 PID 4000 wrote to memory of 4668 4000 E3F7.tmp 83 PID 4668 wrote to memory of 1732 4668 E4C2.tmp 84 PID 4668 wrote to memory of 1732 4668 E4C2.tmp 84 PID 4668 wrote to memory of 1732 4668 E4C2.tmp 84 PID 1732 wrote to memory of 4060 1732 E57E.tmp 85 PID 1732 wrote to memory of 4060 1732 E57E.tmp 85 PID 1732 wrote to memory of 4060 1732 E57E.tmp 85 PID 4060 wrote to memory of 1112 4060 E649.tmp 86 PID 4060 wrote to memory of 1112 4060 E649.tmp 86 PID 4060 wrote to memory of 1112 4060 E649.tmp 86 PID 1112 wrote to memory of 1412 1112 E724.tmp 87 PID 1112 wrote to memory of 1412 1112 E724.tmp 87 PID 1112 wrote to memory of 1412 1112 E724.tmp 87 PID 1412 wrote to memory of 4756 1412 E7FE.tmp 88 PID 1412 wrote to memory of 4756 1412 E7FE.tmp 88 PID 1412 wrote to memory of 4756 1412 E7FE.tmp 88 PID 4756 wrote to memory of 4952 4756 E8BA.tmp 90 PID 4756 wrote to memory of 4952 4756 E8BA.tmp 90 PID 4756 wrote to memory of 4952 4756 E8BA.tmp 90 PID 4952 wrote to memory of 2188 4952 E9A4.tmp 91 PID 4952 wrote to memory of 2188 4952 E9A4.tmp 91 PID 4952 wrote to memory of 2188 4952 E9A4.tmp 91 PID 2188 wrote to memory of 4684 2188 EA50.tmp 92 PID 2188 wrote to memory of 4684 2188 EA50.tmp 92 PID 2188 wrote to memory of 4684 2188 EA50.tmp 92 PID 4684 wrote to memory of 3148 4684 EAFC.tmp 93 PID 4684 wrote to memory of 3148 4684 EAFC.tmp 93 PID 4684 wrote to memory of 3148 4684 EAFC.tmp 93 PID 3148 wrote to memory of 4636 3148 EBA8.tmp 94 PID 3148 wrote to memory of 4636 3148 EBA8.tmp 94 PID 3148 wrote to memory of 4636 3148 EBA8.tmp 94 PID 4636 wrote to memory of 4640 4636 EC73.tmp 95 PID 4636 wrote to memory of 4640 4636 EC73.tmp 95 PID 4636 wrote to memory of 4640 4636 EC73.tmp 95 PID 4640 wrote to memory of 4532 4640 ED2F.tmp 96 PID 4640 wrote to memory of 4532 4640 ED2F.tmp 96 PID 4640 wrote to memory of 4532 4640 ED2F.tmp 96 PID 4532 wrote to memory of 4820 4532 EDFA.tmp 97 PID 4532 wrote to memory of 4820 4532 EDFA.tmp 97 PID 4532 wrote to memory of 4820 4532 EDFA.tmp 97 PID 4820 wrote to memory of 4164 4820 EEB5.tmp 98 PID 4820 wrote to memory of 4164 4820 EEB5.tmp 98 PID 4820 wrote to memory of 4164 4820 EEB5.tmp 98 PID 4164 wrote to memory of 3540 4164 EF71.tmp 101 PID 4164 wrote to memory of 3540 4164 EF71.tmp 101 PID 4164 wrote to memory of 3540 4164 EF71.tmp 101 PID 3540 wrote to memory of 3160 3540 F02C.tmp 102 PID 3540 wrote to memory of 3160 3540 F02C.tmp 102 PID 3540 wrote to memory of 3160 3540 F02C.tmp 102 PID 3160 wrote to memory of 1196 3160 F0C8.tmp 103 PID 3160 wrote to memory of 1196 3160 F0C8.tmp 103 PID 3160 wrote to memory of 1196 3160 F0C8.tmp 103 PID 1196 wrote to memory of 2376 1196 F230.tmp 104 PID 1196 wrote to memory of 2376 1196 F230.tmp 104 PID 1196 wrote to memory of 2376 1196 F230.tmp 104 PID 2376 wrote to memory of 4852 2376 F2BC.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\69b8c7db3d1b667dc61dd15edd434ac2_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\69b8c7db3d1b667dc61dd15edd434ac2_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\E30D.tmp"C:\Users\Admin\AppData\Local\Temp\E30D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\E3F7.tmp"C:\Users\Admin\AppData\Local\Temp\E3F7.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\E4C2.tmp"C:\Users\Admin\AppData\Local\Temp\E4C2.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\E57E.tmp"C:\Users\Admin\AppData\Local\Temp\E57E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\E649.tmp"C:\Users\Admin\AppData\Local\Temp\E649.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\E724.tmp"C:\Users\Admin\AppData\Local\Temp\E724.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\EA50.tmp"C:\Users\Admin\AppData\Local\Temp\EA50.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\EAFC.tmp"C:\Users\Admin\AppData\Local\Temp\EAFC.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\EC73.tmp"C:\Users\Admin\AppData\Local\Temp\EC73.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\EDFA.tmp"C:\Users\Admin\AppData\Local\Temp\EDFA.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\EF71.tmp"C:\Users\Admin\AppData\Local\Temp\EF71.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\F02C.tmp"C:\Users\Admin\AppData\Local\Temp\F02C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\F230.tmp"C:\Users\Admin\AppData\Local\Temp\F230.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"23⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\F51E.tmp"C:\Users\Admin\AppData\Local\Temp\F51E.tmp"24⤵
- Executes dropped EXE
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\F618.tmp"C:\Users\Admin\AppData\Local\Temp\F618.tmp"25⤵
- Executes dropped EXE
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\F702.tmp"C:\Users\Admin\AppData\Local\Temp\F702.tmp"26⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"27⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\F85A.tmp"C:\Users\Admin\AppData\Local\Temp\F85A.tmp"28⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\F935.tmp"C:\Users\Admin\AppData\Local\Temp\F935.tmp"29⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\F9F0.tmp"C:\Users\Admin\AppData\Local\Temp\F9F0.tmp"30⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\FB58.tmp"C:\Users\Admin\AppData\Local\Temp\FB58.tmp"31⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\FC13.tmp"C:\Users\Admin\AppData\Local\Temp\FC13.tmp"32⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\FCFD.tmp"C:\Users\Admin\AppData\Local\Temp\FCFD.tmp"33⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"34⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\FE84.tmp"C:\Users\Admin\AppData\Local\Temp\FE84.tmp"35⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A.tmp"36⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7.tmp"37⤵
- Executes dropped EXE
PID:864 -
C:\Users\Admin\AppData\Local\Temp\162.tmp"C:\Users\Admin\AppData\Local\Temp\162.tmp"38⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\25C.tmp"C:\Users\Admin\AppData\Local\Temp\25C.tmp"39⤵
- Executes dropped EXE
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\2F9.tmp"C:\Users\Admin\AppData\Local\Temp\2F9.tmp"40⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\3C4.tmp"C:\Users\Admin\AppData\Local\Temp\3C4.tmp"41⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\47F.tmp"C:\Users\Admin\AppData\Local\Temp\47F.tmp"42⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\52B.tmp"C:\Users\Admin\AppData\Local\Temp\52B.tmp"43⤵
- Executes dropped EXE
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\5B8.tmp"C:\Users\Admin\AppData\Local\Temp\5B8.tmp"44⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\664.tmp"C:\Users\Admin\AppData\Local\Temp\664.tmp"45⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\72F.tmp"C:\Users\Admin\AppData\Local\Temp\72F.tmp"46⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\7CB.tmp"C:\Users\Admin\AppData\Local\Temp\7CB.tmp"47⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\867.tmp"C:\Users\Admin\AppData\Local\Temp\867.tmp"48⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\913.tmp"C:\Users\Admin\AppData\Local\Temp\913.tmp"49⤵
- Executes dropped EXE
PID:380 -
C:\Users\Admin\AppData\Local\Temp\9A0.tmp"C:\Users\Admin\AppData\Local\Temp\9A0.tmp"50⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\A7B.tmp"C:\Users\Admin\AppData\Local\Temp\A7B.tmp"51⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\AF8.tmp"C:\Users\Admin\AppData\Local\Temp\AF8.tmp"52⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\B84.tmp"C:\Users\Admin\AppData\Local\Temp\B84.tmp"53⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\C40.tmp"C:\Users\Admin\AppData\Local\Temp\C40.tmp"54⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\D1A.tmp"C:\Users\Admin\AppData\Local\Temp\D1A.tmp"55⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\DE6.tmp"C:\Users\Admin\AppData\Local\Temp\DE6.tmp"56⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\E91.tmp"C:\Users\Admin\AppData\Local\Temp\E91.tmp"57⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\EFF.tmp"C:\Users\Admin\AppData\Local\Temp\EFF.tmp"58⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\F7C.tmp"C:\Users\Admin\AppData\Local\Temp\F7C.tmp"59⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\FF9.tmp"C:\Users\Admin\AppData\Local\Temp\FF9.tmp"60⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\1095.tmp"C:\Users\Admin\AppData\Local\Temp\1095.tmp"61⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\1112.tmp"C:\Users\Admin\AppData\Local\Temp\1112.tmp"62⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\119F.tmp"C:\Users\Admin\AppData\Local\Temp\119F.tmp"63⤵
- Executes dropped EXE
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\124B.tmp"C:\Users\Admin\AppData\Local\Temp\124B.tmp"64⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\1316.tmp"C:\Users\Admin\AppData\Local\Temp\1316.tmp"65⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\13B2.tmp"C:\Users\Admin\AppData\Local\Temp\13B2.tmp"66⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\147D.tmp"C:\Users\Admin\AppData\Local\Temp\147D.tmp"67⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\14EA.tmp"C:\Users\Admin\AppData\Local\Temp\14EA.tmp"68⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\1558.tmp"C:\Users\Admin\AppData\Local\Temp\1558.tmp"69⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\1604.tmp"C:\Users\Admin\AppData\Local\Temp\1604.tmp"70⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\16A0.tmp"C:\Users\Admin\AppData\Local\Temp\16A0.tmp"71⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\172D.tmp"C:\Users\Admin\AppData\Local\Temp\172D.tmp"72⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\17C9.tmp"C:\Users\Admin\AppData\Local\Temp\17C9.tmp"73⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\1875.tmp"C:\Users\Admin\AppData\Local\Temp\1875.tmp"74⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\1921.tmp"C:\Users\Admin\AppData\Local\Temp\1921.tmp"75⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\199E.tmp"C:\Users\Admin\AppData\Local\Temp\199E.tmp"76⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\1A3A.tmp"C:\Users\Admin\AppData\Local\Temp\1A3A.tmp"77⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"78⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\1B43.tmp"C:\Users\Admin\AppData\Local\Temp\1B43.tmp"79⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\1BC0.tmp"C:\Users\Admin\AppData\Local\Temp\1BC0.tmp"80⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"81⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\1CE9.tmp"C:\Users\Admin\AppData\Local\Temp\1CE9.tmp"82⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\1E03.tmp"C:\Users\Admin\AppData\Local\Temp\1E03.tmp"83⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\1E80.tmp"C:\Users\Admin\AppData\Local\Temp\1E80.tmp"84⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"85⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"86⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\2054.tmp"C:\Users\Admin\AppData\Local\Temp\2054.tmp"87⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\2110.tmp"C:\Users\Admin\AppData\Local\Temp\2110.tmp"88⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\219C.tmp"C:\Users\Admin\AppData\Local\Temp\219C.tmp"89⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\2268.tmp"C:\Users\Admin\AppData\Local\Temp\2268.tmp"90⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\22F4.tmp"C:\Users\Admin\AppData\Local\Temp\22F4.tmp"91⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\23A0.tmp"C:\Users\Admin\AppData\Local\Temp\23A0.tmp"92⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\245C.tmp"C:\Users\Admin\AppData\Local\Temp\245C.tmp"93⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\24F8.tmp"C:\Users\Admin\AppData\Local\Temp\24F8.tmp"94⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\2594.tmp"C:\Users\Admin\AppData\Local\Temp\2594.tmp"95⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\2640.tmp"C:\Users\Admin\AppData\Local\Temp\2640.tmp"96⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\26DC.tmp"C:\Users\Admin\AppData\Local\Temp\26DC.tmp"97⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\2769.tmp"C:\Users\Admin\AppData\Local\Temp\2769.tmp"98⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\2824.tmp"C:\Users\Admin\AppData\Local\Temp\2824.tmp"99⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\28A1.tmp"C:\Users\Admin\AppData\Local\Temp\28A1.tmp"100⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\294D.tmp"C:\Users\Admin\AppData\Local\Temp\294D.tmp"101⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\29E9.tmp"C:\Users\Admin\AppData\Local\Temp\29E9.tmp"102⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\2A95.tmp"C:\Users\Admin\AppData\Local\Temp\2A95.tmp"103⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\2B32.tmp"C:\Users\Admin\AppData\Local\Temp\2B32.tmp"104⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\2BED.tmp"C:\Users\Admin\AppData\Local\Temp\2BED.tmp"105⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\2C99.tmp"C:\Users\Admin\AppData\Local\Temp\2C99.tmp"106⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\2D54.tmp"C:\Users\Admin\AppData\Local\Temp\2D54.tmp"107⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\2E00.tmp"C:\Users\Admin\AppData\Local\Temp\2E00.tmp"108⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\2E8D.tmp"C:\Users\Admin\AppData\Local\Temp\2E8D.tmp"109⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\2F29.tmp"C:\Users\Admin\AppData\Local\Temp\2F29.tmp"110⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\2FC5.tmp"C:\Users\Admin\AppData\Local\Temp\2FC5.tmp"111⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\3071.tmp"C:\Users\Admin\AppData\Local\Temp\3071.tmp"112⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\30EE.tmp"C:\Users\Admin\AppData\Local\Temp\30EE.tmp"113⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\31B9.tmp"C:\Users\Admin\AppData\Local\Temp\31B9.tmp"114⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\3265.tmp"C:\Users\Admin\AppData\Local\Temp\3265.tmp"115⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\32F2.tmp"C:\Users\Admin\AppData\Local\Temp\32F2.tmp"116⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\336F.tmp"C:\Users\Admin\AppData\Local\Temp\336F.tmp"117⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"118⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"119⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"120⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\35F0.tmp"C:\Users\Admin\AppData\Local\Temp\35F0.tmp"121⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\369B.tmp"C:\Users\Admin\AppData\Local\Temp\369B.tmp"122⤵PID:3128
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-