Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
06/08/2023, 15:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8d77c2ead080899f88dced4871eed2f8_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
8d77c2ead080899f88dced4871eed2f8_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
8d77c2ead080899f88dced4871eed2f8_mafia_JC.exe
-
Size
520KB
-
MD5
8d77c2ead080899f88dced4871eed2f8
-
SHA1
2779875d845f12199407d6e89315ec8e7dbfa373
-
SHA256
3ea2c54c80820810a29dab031a2e97e460c08f9badef3bcc56189eb4e28a4eb0
-
SHA512
55d543c72de312edb412da13ccafce77cdb0b3d5f9b39b0fc5887e1334f0fa0c066bac846122adaf99775efde7809c1624d6af034e94090cdb0b961e02804186
-
SSDEEP
12288:++61BadpH+ZczvsVpvm5Sg74TsxF/rCSmNZ:+fCdcSzvs65SW4EF/+N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3060 F1C2.tmp 2328 F31A.tmp 5064 F433.tmp 2972 F50E.tmp 4816 F637.tmp 2196 F721.tmp 4084 F83B.tmp 4812 F8E7.tmp 1512 FA0F.tmp 4888 FADB.tmp 3384 FBC5.tmp 4980 FCCF.tmp 1460 FDB9.tmp 1600 FEB3.tmp 4752 FFBD.tmp 2272 3A.tmp 1960 153.tmp 3664 1FF.tmp 216 2BA.tmp 4352 356.tmp 2664 412.tmp 3008 4DD.tmp 4108 599.tmp 4616 635.tmp 4792 6F0.tmp 4332 819.tmp 3116 8B5.tmp 3832 981.tmp 5060 A1D.tmp 1820 AD8.tmp 2000 B94.tmp 868 C5F.tmp 3920 D2A.tmp 3640 DA7.tmp 1232 E34.tmp 2240 EA1.tmp 1276 F5D.tmp 3932 FE9.tmp 4864 10A5.tmp 1464 1122.tmp 3308 11AE.tmp 5084 123B.tmp 1076 12D7.tmp 2448 1354.tmp 3196 1410.tmp 4536 14AC.tmp 4396 1690.tmp 4292 16FE.tmp 1396 177B.tmp 2040 1817.tmp 2856 18E2.tmp 4180 197E.tmp 680 1A0B.tmp 1052 1A98.tmp 1688 1B34.tmp 4272 1BC0.tmp 3528 1C5D.tmp 3744 1D57.tmp 2388 1DD4.tmp 2328 1E70.tmp 380 1F0C.tmp 4832 1F99.tmp 3676 2045.tmp 5048 20B2.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1044 wrote to memory of 3060 1044 8d77c2ead080899f88dced4871eed2f8_mafia_JC.exe 80 PID 1044 wrote to memory of 3060 1044 8d77c2ead080899f88dced4871eed2f8_mafia_JC.exe 80 PID 1044 wrote to memory of 3060 1044 8d77c2ead080899f88dced4871eed2f8_mafia_JC.exe 80 PID 3060 wrote to memory of 2328 3060 F1C2.tmp 81 PID 3060 wrote to memory of 2328 3060 F1C2.tmp 81 PID 3060 wrote to memory of 2328 3060 F1C2.tmp 81 PID 2328 wrote to memory of 5064 2328 F31A.tmp 82 PID 2328 wrote to memory of 5064 2328 F31A.tmp 82 PID 2328 wrote to memory of 5064 2328 F31A.tmp 82 PID 5064 wrote to memory of 2972 5064 F433.tmp 83 PID 5064 wrote to memory of 2972 5064 F433.tmp 83 PID 5064 wrote to memory of 2972 5064 F433.tmp 83 PID 2972 wrote to memory of 4816 2972 F50E.tmp 84 PID 2972 wrote to memory of 4816 2972 F50E.tmp 84 PID 2972 wrote to memory of 4816 2972 F50E.tmp 84 PID 4816 wrote to memory of 2196 4816 F637.tmp 85 PID 4816 wrote to memory of 2196 4816 F637.tmp 85 PID 4816 wrote to memory of 2196 4816 F637.tmp 85 PID 2196 wrote to memory of 4084 2196 F721.tmp 86 PID 2196 wrote to memory of 4084 2196 F721.tmp 86 PID 2196 wrote to memory of 4084 2196 F721.tmp 86 PID 4084 wrote to memory of 4812 4084 F83B.tmp 87 PID 4084 wrote to memory of 4812 4084 F83B.tmp 87 PID 4084 wrote to memory of 4812 4084 F83B.tmp 87 PID 4812 wrote to memory of 1512 4812 F8E7.tmp 88 PID 4812 wrote to memory of 1512 4812 F8E7.tmp 88 PID 4812 wrote to memory of 1512 4812 F8E7.tmp 88 PID 1512 wrote to memory of 4888 1512 FA0F.tmp 89 PID 1512 wrote to memory of 4888 1512 FA0F.tmp 89 PID 1512 wrote to memory of 4888 1512 FA0F.tmp 89 PID 4888 wrote to memory of 3384 4888 FADB.tmp 90 PID 4888 wrote to memory of 3384 4888 FADB.tmp 90 PID 4888 wrote to memory of 3384 4888 FADB.tmp 90 PID 3384 wrote to memory of 4980 3384 FBC5.tmp 91 PID 3384 wrote to memory of 4980 3384 FBC5.tmp 91 PID 3384 wrote to memory of 4980 3384 FBC5.tmp 91 PID 4980 wrote to memory of 1460 4980 FCCF.tmp 92 PID 4980 wrote to memory of 1460 4980 FCCF.tmp 92 PID 4980 wrote to memory of 1460 4980 FCCF.tmp 92 PID 1460 wrote to memory of 1600 1460 FDB9.tmp 93 PID 1460 wrote to memory of 1600 1460 FDB9.tmp 93 PID 1460 wrote to memory of 1600 1460 FDB9.tmp 93 PID 1600 wrote to memory of 4752 1600 FEB3.tmp 94 PID 1600 wrote to memory of 4752 1600 FEB3.tmp 94 PID 1600 wrote to memory of 4752 1600 FEB3.tmp 94 PID 4752 wrote to memory of 2272 4752 FFBD.tmp 95 PID 4752 wrote to memory of 2272 4752 FFBD.tmp 95 PID 4752 wrote to memory of 2272 4752 FFBD.tmp 95 PID 2272 wrote to memory of 1960 2272 3A.tmp 96 PID 2272 wrote to memory of 1960 2272 3A.tmp 96 PID 2272 wrote to memory of 1960 2272 3A.tmp 96 PID 1960 wrote to memory of 3664 1960 153.tmp 97 PID 1960 wrote to memory of 3664 1960 153.tmp 97 PID 1960 wrote to memory of 3664 1960 153.tmp 97 PID 3664 wrote to memory of 216 3664 1FF.tmp 98 PID 3664 wrote to memory of 216 3664 1FF.tmp 98 PID 3664 wrote to memory of 216 3664 1FF.tmp 98 PID 216 wrote to memory of 4352 216 2BA.tmp 99 PID 216 wrote to memory of 4352 216 2BA.tmp 99 PID 216 wrote to memory of 4352 216 2BA.tmp 99 PID 4352 wrote to memory of 2664 4352 356.tmp 100 PID 4352 wrote to memory of 2664 4352 356.tmp 100 PID 4352 wrote to memory of 2664 4352 356.tmp 100 PID 2664 wrote to memory of 3008 2664 412.tmp 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d77c2ead080899f88dced4871eed2f8_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\8d77c2ead080899f88dced4871eed2f8_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\F31A.tmp"C:\Users\Admin\AppData\Local\Temp\F31A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\F433.tmp"C:\Users\Admin\AppData\Local\Temp\F433.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\F50E.tmp"C:\Users\Admin\AppData\Local\Temp\F50E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\F637.tmp"C:\Users\Admin\AppData\Local\Temp\F637.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\F721.tmp"C:\Users\Admin\AppData\Local\Temp\F721.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\F83B.tmp"C:\Users\Admin\AppData\Local\Temp\F83B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\FA0F.tmp"C:\Users\Admin\AppData\Local\Temp\FA0F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\FADB.tmp"C:\Users\Admin\AppData\Local\Temp\FADB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\FDB9.tmp"C:\Users\Admin\AppData\Local\Temp\FDB9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\FEB3.tmp"C:\Users\Admin\AppData\Local\Temp\FEB3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\153.tmp"C:\Users\Admin\AppData\Local\Temp\153.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\1FF.tmp"C:\Users\Admin\AppData\Local\Temp\1FF.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\2BA.tmp"C:\Users\Admin\AppData\Local\Temp\2BA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\356.tmp"C:\Users\Admin\AppData\Local\Temp\356.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\412.tmp"C:\Users\Admin\AppData\Local\Temp\412.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\4DD.tmp"C:\Users\Admin\AppData\Local\Temp\4DD.tmp"23⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\599.tmp"C:\Users\Admin\AppData\Local\Temp\599.tmp"24⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\635.tmp"C:\Users\Admin\AppData\Local\Temp\635.tmp"25⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\6F0.tmp"C:\Users\Admin\AppData\Local\Temp\6F0.tmp"26⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\819.tmp"C:\Users\Admin\AppData\Local\Temp\819.tmp"27⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\8B5.tmp"C:\Users\Admin\AppData\Local\Temp\8B5.tmp"28⤵
- Executes dropped EXE
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\981.tmp"C:\Users\Admin\AppData\Local\Temp\981.tmp"29⤵
- Executes dropped EXE
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\A1D.tmp"C:\Users\Admin\AppData\Local\Temp\A1D.tmp"30⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\AD8.tmp"C:\Users\Admin\AppData\Local\Temp\AD8.tmp"31⤵
- Executes dropped EXE
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\B94.tmp"C:\Users\Admin\AppData\Local\Temp\B94.tmp"32⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\C5F.tmp"C:\Users\Admin\AppData\Local\Temp\C5F.tmp"33⤵
- Executes dropped EXE
PID:868 -
C:\Users\Admin\AppData\Local\Temp\D2A.tmp"C:\Users\Admin\AppData\Local\Temp\D2A.tmp"34⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"35⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"36⤵
- Executes dropped EXE
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\EA1.tmp"C:\Users\Admin\AppData\Local\Temp\EA1.tmp"37⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\F5D.tmp"C:\Users\Admin\AppData\Local\Temp\F5D.tmp"38⤵
- Executes dropped EXE
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\FE9.tmp"C:\Users\Admin\AppData\Local\Temp\FE9.tmp"39⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\10A5.tmp"C:\Users\Admin\AppData\Local\Temp\10A5.tmp"40⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\1122.tmp"C:\Users\Admin\AppData\Local\Temp\1122.tmp"41⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\11AE.tmp"C:\Users\Admin\AppData\Local\Temp\11AE.tmp"42⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\123B.tmp"C:\Users\Admin\AppData\Local\Temp\123B.tmp"43⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\12D7.tmp"C:\Users\Admin\AppData\Local\Temp\12D7.tmp"44⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\1354.tmp"C:\Users\Admin\AppData\Local\Temp\1354.tmp"45⤵
- Executes dropped EXE
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\1410.tmp"C:\Users\Admin\AppData\Local\Temp\1410.tmp"46⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\14AC.tmp"C:\Users\Admin\AppData\Local\Temp\14AC.tmp"47⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\1690.tmp"C:\Users\Admin\AppData\Local\Temp\1690.tmp"48⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\16FE.tmp"C:\Users\Admin\AppData\Local\Temp\16FE.tmp"49⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\177B.tmp"C:\Users\Admin\AppData\Local\Temp\177B.tmp"50⤵
- Executes dropped EXE
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\1817.tmp"C:\Users\Admin\AppData\Local\Temp\1817.tmp"51⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\18E2.tmp"C:\Users\Admin\AppData\Local\Temp\18E2.tmp"52⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\197E.tmp"C:\Users\Admin\AppData\Local\Temp\197E.tmp"53⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"54⤵
- Executes dropped EXE
PID:680 -
C:\Users\Admin\AppData\Local\Temp\1A98.tmp"C:\Users\Admin\AppData\Local\Temp\1A98.tmp"55⤵
- Executes dropped EXE
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\1B34.tmp"C:\Users\Admin\AppData\Local\Temp\1B34.tmp"56⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\1BC0.tmp"C:\Users\Admin\AppData\Local\Temp\1BC0.tmp"57⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"58⤵
- Executes dropped EXE
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\1D57.tmp"C:\Users\Admin\AppData\Local\Temp\1D57.tmp"59⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"60⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\1E70.tmp"C:\Users\Admin\AppData\Local\Temp\1E70.tmp"61⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"62⤵
- Executes dropped EXE
PID:380 -
C:\Users\Admin\AppData\Local\Temp\1F99.tmp"C:\Users\Admin\AppData\Local\Temp\1F99.tmp"63⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\2045.tmp"C:\Users\Admin\AppData\Local\Temp\2045.tmp"64⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\20B2.tmp"C:\Users\Admin\AppData\Local\Temp\20B2.tmp"65⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\213F.tmp"C:\Users\Admin\AppData\Local\Temp\213F.tmp"66⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\21EB.tmp"C:\Users\Admin\AppData\Local\Temp\21EB.tmp"67⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\2296.tmp"C:\Users\Admin\AppData\Local\Temp\2296.tmp"68⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\2323.tmp"C:\Users\Admin\AppData\Local\Temp\2323.tmp"69⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\23B0.tmp"C:\Users\Admin\AppData\Local\Temp\23B0.tmp"70⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\244C.tmp"C:\Users\Admin\AppData\Local\Temp\244C.tmp"71⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\24E8.tmp"C:\Users\Admin\AppData\Local\Temp\24E8.tmp"72⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\2594.tmp"C:\Users\Admin\AppData\Local\Temp\2594.tmp"73⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\2650.tmp"C:\Users\Admin\AppData\Local\Temp\2650.tmp"74⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\26EC.tmp"C:\Users\Admin\AppData\Local\Temp\26EC.tmp"75⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\2788.tmp"C:\Users\Admin\AppData\Local\Temp\2788.tmp"76⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\2815.tmp"C:\Users\Admin\AppData\Local\Temp\2815.tmp"77⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\28A1.tmp"C:\Users\Admin\AppData\Local\Temp\28A1.tmp"78⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\293E.tmp"C:\Users\Admin\AppData\Local\Temp\293E.tmp"79⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\29E9.tmp"C:\Users\Admin\AppData\Local\Temp\29E9.tmp"80⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\2A86.tmp"C:\Users\Admin\AppData\Local\Temp\2A86.tmp"81⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\2B32.tmp"C:\Users\Admin\AppData\Local\Temp\2B32.tmp"82⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\2BAF.tmp"C:\Users\Admin\AppData\Local\Temp\2BAF.tmp"83⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\2C2C.tmp"C:\Users\Admin\AppData\Local\Temp\2C2C.tmp"84⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"85⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\2D64.tmp"C:\Users\Admin\AppData\Local\Temp\2D64.tmp"86⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"87⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\2E6E.tmp"C:\Users\Admin\AppData\Local\Temp\2E6E.tmp"88⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\2EFA.tmp"C:\Users\Admin\AppData\Local\Temp\2EFA.tmp"89⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\2F77.tmp"C:\Users\Admin\AppData\Local\Temp\2F77.tmp"90⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\2FF4.tmp"C:\Users\Admin\AppData\Local\Temp\2FF4.tmp"91⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\3091.tmp"C:\Users\Admin\AppData\Local\Temp\3091.tmp"92⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\310E.tmp"C:\Users\Admin\AppData\Local\Temp\310E.tmp"93⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\31D9.tmp"C:\Users\Admin\AppData\Local\Temp\31D9.tmp"94⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\3265.tmp"C:\Users\Admin\AppData\Local\Temp\3265.tmp"95⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"96⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"97⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"98⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\3498.tmp"C:\Users\Admin\AppData\Local\Temp\3498.tmp"99⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"100⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\364D.tmp"C:\Users\Admin\AppData\Local\Temp\364D.tmp"101⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\36BB.tmp"C:\Users\Admin\AppData\Local\Temp\36BB.tmp"102⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\3757.tmp"C:\Users\Admin\AppData\Local\Temp\3757.tmp"103⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\3841.tmp"C:\Users\Admin\AppData\Local\Temp\3841.tmp"104⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\38BE.tmp"C:\Users\Admin\AppData\Local\Temp\38BE.tmp"105⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\394B.tmp"C:\Users\Admin\AppData\Local\Temp\394B.tmp"106⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\39D8.tmp"C:\Users\Admin\AppData\Local\Temp\39D8.tmp"107⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\3A64.tmp"C:\Users\Admin\AppData\Local\Temp\3A64.tmp"108⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\3C58.tmp"C:\Users\Admin\AppData\Local\Temp\3C58.tmp"109⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\3CD5.tmp"C:\Users\Admin\AppData\Local\Temp\3CD5.tmp"110⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\3D91.tmp"C:\Users\Admin\AppData\Local\Temp\3D91.tmp"111⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"112⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\4031.tmp"C:\Users\Admin\AppData\Local\Temp\4031.tmp"113⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\40BD.tmp"C:\Users\Admin\AppData\Local\Temp\40BD.tmp"114⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\41D6.tmp"C:\Users\Admin\AppData\Local\Temp\41D6.tmp"115⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\4273.tmp"C:\Users\Admin\AppData\Local\Temp\4273.tmp"116⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\42F0.tmp"C:\Users\Admin\AppData\Local\Temp\42F0.tmp"117⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\439C.tmp"C:\Users\Admin\AppData\Local\Temp\439C.tmp"118⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\4419.tmp"C:\Users\Admin\AppData\Local\Temp\4419.tmp"119⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\4486.tmp"C:\Users\Admin\AppData\Local\Temp\4486.tmp"120⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\4532.tmp"C:\Users\Admin\AppData\Local\Temp\4532.tmp"121⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\45BE.tmp"C:\Users\Admin\AppData\Local\Temp\45BE.tmp"122⤵PID:4612
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-