Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
26/08/2023, 20:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a653f4d5960786608523e05848059a4b_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
a653f4d5960786608523e05848059a4b_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
a653f4d5960786608523e05848059a4b_mafia_JC.exe
-
Size
486KB
-
MD5
a653f4d5960786608523e05848059a4b
-
SHA1
4d74bc86c542b40e72e499b6632200d4785b5547
-
SHA256
b894a0d4b6f3b34bffd444934d9060dac4e170999c082fa2931fa311cb2e79e1
-
SHA512
7cd55194f4b4352e623b6fec4b379bbd6ecceb9063bbf456ab5646c4b605751972e2d5344489cd43f17c77bf7befa8b1fd874e2572a3cb4041021d3980834654
-
SSDEEP
12288:oU5rCOTeiDbeQnhHZ6gkv/JDc5xw6qxHVLLNZ:oUQOJDCQ1bk3JDc5S6qxHVnN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2960 6A04.tmp 3752 6AD0.tmp 2580 6B9B.tmp 2468 6C47.tmp 4256 6CE3.tmp 664 6D9E.tmp 3836 6EA8.tmp 4488 6F44.tmp 488 7000.tmp 3524 708C.tmp 1080 70FA.tmp 3248 71A6.tmp 4972 7251.tmp 2396 736B.tmp 1308 7417.tmp 4560 74B3.tmp 2004 753F.tmp 1348 75BC.tmp 3672 7649.tmp 3720 76E5.tmp 3376 77D0.tmp 4416 78CA.tmp 4760 7976.tmp 5032 7A60.tmp 5044 7ACD.tmp 2072 7B5A.tmp 4364 7BE7.tmp 3408 7C92.tmp 1724 7D2F.tmp 4960 7DDB.tmp 1700 7E96.tmp 628 7F80.tmp 1420 804C.tmp 4788 80B9.tmp 4692 8136.tmp 4212 81C3.tmp 4168 824F.tmp 452 82DC.tmp 2752 8368.tmp 3632 8405.tmp 3840 8482.tmp 3400 851E.tmp 2180 85BA.tmp 4496 8666.tmp 1916 86D3.tmp 4728 8750.tmp 1012 87BE.tmp 4556 884A.tmp 1108 88F6.tmp 4204 8993.tmp 4132 8A10.tmp 1432 8A9C.tmp 1100 8B0A.tmp 2480 8BB5.tmp 2124 8C42.tmp 4528 8CDE.tmp 3104 8D7B.tmp 1332 8E26.tmp 4708 8EA3.tmp 4136 8F30.tmp 1472 8FCC.tmp 5016 9059.tmp 1208 90D6.tmp 944 9153.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1432 wrote to memory of 2960 1432 a653f4d5960786608523e05848059a4b_mafia_JC.exe 82 PID 1432 wrote to memory of 2960 1432 a653f4d5960786608523e05848059a4b_mafia_JC.exe 82 PID 1432 wrote to memory of 2960 1432 a653f4d5960786608523e05848059a4b_mafia_JC.exe 82 PID 2960 wrote to memory of 3752 2960 6A04.tmp 83 PID 2960 wrote to memory of 3752 2960 6A04.tmp 83 PID 2960 wrote to memory of 3752 2960 6A04.tmp 83 PID 3752 wrote to memory of 2580 3752 6AD0.tmp 84 PID 3752 wrote to memory of 2580 3752 6AD0.tmp 84 PID 3752 wrote to memory of 2580 3752 6AD0.tmp 84 PID 2580 wrote to memory of 2468 2580 6B9B.tmp 85 PID 2580 wrote to memory of 2468 2580 6B9B.tmp 85 PID 2580 wrote to memory of 2468 2580 6B9B.tmp 85 PID 2468 wrote to memory of 4256 2468 6C47.tmp 86 PID 2468 wrote to memory of 4256 2468 6C47.tmp 86 PID 2468 wrote to memory of 4256 2468 6C47.tmp 86 PID 4256 wrote to memory of 664 4256 6CE3.tmp 87 PID 4256 wrote to memory of 664 4256 6CE3.tmp 87 PID 4256 wrote to memory of 664 4256 6CE3.tmp 87 PID 664 wrote to memory of 3836 664 6D9E.tmp 88 PID 664 wrote to memory of 3836 664 6D9E.tmp 88 PID 664 wrote to memory of 3836 664 6D9E.tmp 88 PID 3836 wrote to memory of 4488 3836 6EA8.tmp 89 PID 3836 wrote to memory of 4488 3836 6EA8.tmp 89 PID 3836 wrote to memory of 4488 3836 6EA8.tmp 89 PID 4488 wrote to memory of 488 4488 6F44.tmp 90 PID 4488 wrote to memory of 488 4488 6F44.tmp 90 PID 4488 wrote to memory of 488 4488 6F44.tmp 90 PID 488 wrote to memory of 3524 488 7000.tmp 92 PID 488 wrote to memory of 3524 488 7000.tmp 92 PID 488 wrote to memory of 3524 488 7000.tmp 92 PID 3524 wrote to memory of 1080 3524 708C.tmp 93 PID 3524 wrote to memory of 1080 3524 708C.tmp 93 PID 3524 wrote to memory of 1080 3524 708C.tmp 93 PID 1080 wrote to memory of 3248 1080 70FA.tmp 94 PID 1080 wrote to memory of 3248 1080 70FA.tmp 94 PID 1080 wrote to memory of 3248 1080 70FA.tmp 94 PID 3248 wrote to memory of 4972 3248 71A6.tmp 95 PID 3248 wrote to memory of 4972 3248 71A6.tmp 95 PID 3248 wrote to memory of 4972 3248 71A6.tmp 95 PID 4972 wrote to memory of 2396 4972 7251.tmp 96 PID 4972 wrote to memory of 2396 4972 7251.tmp 96 PID 4972 wrote to memory of 2396 4972 7251.tmp 96 PID 2396 wrote to memory of 1308 2396 736B.tmp 97 PID 2396 wrote to memory of 1308 2396 736B.tmp 97 PID 2396 wrote to memory of 1308 2396 736B.tmp 97 PID 1308 wrote to memory of 4560 1308 7417.tmp 98 PID 1308 wrote to memory of 4560 1308 7417.tmp 98 PID 1308 wrote to memory of 4560 1308 7417.tmp 98 PID 4560 wrote to memory of 2004 4560 74B3.tmp 99 PID 4560 wrote to memory of 2004 4560 74B3.tmp 99 PID 4560 wrote to memory of 2004 4560 74B3.tmp 99 PID 2004 wrote to memory of 1348 2004 753F.tmp 100 PID 2004 wrote to memory of 1348 2004 753F.tmp 100 PID 2004 wrote to memory of 1348 2004 753F.tmp 100 PID 1348 wrote to memory of 3672 1348 75BC.tmp 103 PID 1348 wrote to memory of 3672 1348 75BC.tmp 103 PID 1348 wrote to memory of 3672 1348 75BC.tmp 103 PID 3672 wrote to memory of 3720 3672 7649.tmp 104 PID 3672 wrote to memory of 3720 3672 7649.tmp 104 PID 3672 wrote to memory of 3720 3672 7649.tmp 104 PID 3720 wrote to memory of 3376 3720 76E5.tmp 105 PID 3720 wrote to memory of 3376 3720 76E5.tmp 105 PID 3720 wrote to memory of 3376 3720 76E5.tmp 105 PID 3376 wrote to memory of 4416 3376 77D0.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\a653f4d5960786608523e05848059a4b_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\a653f4d5960786608523e05848059a4b_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:488 -
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"23⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\7976.tmp"C:\Users\Admin\AppData\Local\Temp\7976.tmp"24⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\7A60.tmp"C:\Users\Admin\AppData\Local\Temp\7A60.tmp"25⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"26⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"27⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"28⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\7C92.tmp"C:\Users\Admin\AppData\Local\Temp\7C92.tmp"29⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"30⤵
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"31⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\7E96.tmp"C:\Users\Admin\AppData\Local\Temp\7E96.tmp"32⤵
- Executes dropped EXE
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\7F80.tmp"C:\Users\Admin\AppData\Local\Temp\7F80.tmp"33⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\804C.tmp"C:\Users\Admin\AppData\Local\Temp\804C.tmp"34⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\80B9.tmp"C:\Users\Admin\AppData\Local\Temp\80B9.tmp"35⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\8136.tmp"C:\Users\Admin\AppData\Local\Temp\8136.tmp"36⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\81C3.tmp"C:\Users\Admin\AppData\Local\Temp\81C3.tmp"37⤵
- Executes dropped EXE
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\824F.tmp"C:\Users\Admin\AppData\Local\Temp\824F.tmp"38⤵
- Executes dropped EXE
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\82DC.tmp"C:\Users\Admin\AppData\Local\Temp\82DC.tmp"39⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\8368.tmp"C:\Users\Admin\AppData\Local\Temp\8368.tmp"40⤵
- Executes dropped EXE
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\8405.tmp"C:\Users\Admin\AppData\Local\Temp\8405.tmp"41⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\8482.tmp"C:\Users\Admin\AppData\Local\Temp\8482.tmp"42⤵
- Executes dropped EXE
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\851E.tmp"C:\Users\Admin\AppData\Local\Temp\851E.tmp"43⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\85BA.tmp"C:\Users\Admin\AppData\Local\Temp\85BA.tmp"44⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\8666.tmp"C:\Users\Admin\AppData\Local\Temp\8666.tmp"45⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\86D3.tmp"C:\Users\Admin\AppData\Local\Temp\86D3.tmp"46⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\8750.tmp"C:\Users\Admin\AppData\Local\Temp\8750.tmp"47⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\87BE.tmp"C:\Users\Admin\AppData\Local\Temp\87BE.tmp"48⤵
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"49⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\88F6.tmp"C:\Users\Admin\AppData\Local\Temp\88F6.tmp"50⤵
- Executes dropped EXE
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\8993.tmp"C:\Users\Admin\AppData\Local\Temp\8993.tmp"51⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\8A10.tmp"C:\Users\Admin\AppData\Local\Temp\8A10.tmp"52⤵
- Executes dropped EXE
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"53⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"54⤵
- Executes dropped EXE
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"55⤵
- Executes dropped EXE
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\8C42.tmp"C:\Users\Admin\AppData\Local\Temp\8C42.tmp"56⤵
- Executes dropped EXE
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"57⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"58⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\8E26.tmp"C:\Users\Admin\AppData\Local\Temp\8E26.tmp"59⤵
- Executes dropped EXE
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"60⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\8F30.tmp"C:\Users\Admin\AppData\Local\Temp\8F30.tmp"61⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"62⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"63⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"64⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\9153.tmp"C:\Users\Admin\AppData\Local\Temp\9153.tmp"65⤵
- Executes dropped EXE
PID:944 -
C:\Users\Admin\AppData\Local\Temp\91EF.tmp"C:\Users\Admin\AppData\Local\Temp\91EF.tmp"66⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\926C.tmp"C:\Users\Admin\AppData\Local\Temp\926C.tmp"67⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\92F9.tmp"C:\Users\Admin\AppData\Local\Temp\92F9.tmp"68⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"69⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\93B4.tmp"C:\Users\Admin\AppData\Local\Temp\93B4.tmp"70⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\9412.tmp"C:\Users\Admin\AppData\Local\Temp\9412.tmp"71⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\948F.tmp"C:\Users\Admin\AppData\Local\Temp\948F.tmp"72⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\94FC.tmp"C:\Users\Admin\AppData\Local\Temp\94FC.tmp"73⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\956A.tmp"C:\Users\Admin\AppData\Local\Temp\956A.tmp"74⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\95F6.tmp"C:\Users\Admin\AppData\Local\Temp\95F6.tmp"75⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"76⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"77⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"78⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"79⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"80⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"81⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"82⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"83⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"84⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"85⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"86⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\9D59.tmp"C:\Users\Admin\AppData\Local\Temp\9D59.tmp"87⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"88⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\9E72.tmp"C:\Users\Admin\AppData\Local\Temp\9E72.tmp"89⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"90⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"91⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"92⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"93⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"94⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"95⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"96⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\A24B.tmp"C:\Users\Admin\AppData\Local\Temp\A24B.tmp"97⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"98⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\A383.tmp"C:\Users\Admin\AppData\Local\Temp\A383.tmp"99⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"100⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"101⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"102⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"103⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\A633.tmp"C:\Users\Admin\AppData\Local\Temp\A633.tmp"104⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"105⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\A74C.tmp"C:\Users\Admin\AppData\Local\Temp\A74C.tmp"106⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"107⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"108⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"109⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"110⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"111⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"112⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\AB44.tmp"C:\Users\Admin\AppData\Local\Temp\AB44.tmp"113⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"114⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"115⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"116⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"117⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"118⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\AE51.tmp"C:\Users\Admin\AppData\Local\Temp\AE51.tmp"119⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"120⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"121⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"122⤵PID:4796
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-