Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2023, 15:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
14fe438d45d25dd468c82fc67d6be740_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
14fe438d45d25dd468c82fc67d6be740_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
14fe438d45d25dd468c82fc67d6be740_mafia_JC.exe
-
Size
486KB
-
MD5
14fe438d45d25dd468c82fc67d6be740
-
SHA1
8fc35a1467a8a2ed390aa481a6bb5f052a3bd893
-
SHA256
5c9c2b4c7ac864b2caebd30b8b37ba937497d9ee090ea5971635a10159bebc9c
-
SHA512
f4ac7b0b0f091f7e047e94cc0d4a891e94f05888e618e97f30f93552bf1bb01520853b3961d49fe3cd7b64a0eec0c50510c183ba196afe1d81e3259fa99b40cc
-
SSDEEP
12288:/U5rCOTeiDuTgwtPGTiD7sewjeZVVLaNZ:/UQOJD8guuGD0e/LaN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 732 FA5E.tmp 3588 1A.tmp 2288 105.tmp 4916 20E.tmp 2032 2E9.tmp 4372 395.tmp 3764 47F.tmp 4392 53B.tmp 1788 5C7.tmp 4440 673.tmp 4920 72F.tmp 1844 7BB.tmp 808 848.tmp 2280 923.tmp 1420 9EE.tmp 4368 A9A.tmp 2132 B36.tmp 944 BD2.tmp 3376 C8E.tmp 4724 D69.tmp 2516 E34.tmp 1576 F0E.tmp 4024 FDA.tmp 880 10A5.tmp 4652 1141.tmp 4672 123B.tmp 3576 1306.tmp 3468 1400.tmp 1440 147D.tmp 2220 1519.tmp 1544 1604.tmp 4576 16BF.tmp 3076 175B.tmp 4736 1836.tmp 1708 18A4.tmp 1656 1930.tmp 4940 1A49.tmp 1388 1AB7.tmp 3956 1B53.tmp 1372 1BE0.tmp 4792 1C7C.tmp 3080 1D09.tmp 3732 1D95.tmp 1124 1E22.tmp 4404 1EBE.tmp 1648 1F4B.tmp 3628 1FE7.tmp 4360 2093.tmp 1380 212F.tmp 4780 21CB.tmp 2036 2248.tmp 3384 22C5.tmp 4164 2352.tmp 1340 23FE.tmp 2860 246B.tmp 1672 24D9.tmp 3776 2546.tmp 4588 25E2.tmp 1088 2650.tmp 408 26CD.tmp 5008 273A.tmp 1020 27C7.tmp 180 2863.tmp 4840 28FF.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1672 wrote to memory of 732 1672 14fe438d45d25dd468c82fc67d6be740_mafia_JC.exe 81 PID 1672 wrote to memory of 732 1672 14fe438d45d25dd468c82fc67d6be740_mafia_JC.exe 81 PID 1672 wrote to memory of 732 1672 14fe438d45d25dd468c82fc67d6be740_mafia_JC.exe 81 PID 732 wrote to memory of 3588 732 FA5E.tmp 82 PID 732 wrote to memory of 3588 732 FA5E.tmp 82 PID 732 wrote to memory of 3588 732 FA5E.tmp 82 PID 3588 wrote to memory of 2288 3588 1A.tmp 83 PID 3588 wrote to memory of 2288 3588 1A.tmp 83 PID 3588 wrote to memory of 2288 3588 1A.tmp 83 PID 2288 wrote to memory of 4916 2288 105.tmp 84 PID 2288 wrote to memory of 4916 2288 105.tmp 84 PID 2288 wrote to memory of 4916 2288 105.tmp 84 PID 4916 wrote to memory of 2032 4916 20E.tmp 85 PID 4916 wrote to memory of 2032 4916 20E.tmp 85 PID 4916 wrote to memory of 2032 4916 20E.tmp 85 PID 2032 wrote to memory of 4372 2032 2E9.tmp 86 PID 2032 wrote to memory of 4372 2032 2E9.tmp 86 PID 2032 wrote to memory of 4372 2032 2E9.tmp 86 PID 4372 wrote to memory of 3764 4372 395.tmp 87 PID 4372 wrote to memory of 3764 4372 395.tmp 87 PID 4372 wrote to memory of 3764 4372 395.tmp 87 PID 3764 wrote to memory of 4392 3764 47F.tmp 88 PID 3764 wrote to memory of 4392 3764 47F.tmp 88 PID 3764 wrote to memory of 4392 3764 47F.tmp 88 PID 4392 wrote to memory of 1788 4392 53B.tmp 89 PID 4392 wrote to memory of 1788 4392 53B.tmp 89 PID 4392 wrote to memory of 1788 4392 53B.tmp 89 PID 1788 wrote to memory of 4440 1788 5C7.tmp 90 PID 1788 wrote to memory of 4440 1788 5C7.tmp 90 PID 1788 wrote to memory of 4440 1788 5C7.tmp 90 PID 4440 wrote to memory of 4920 4440 673.tmp 91 PID 4440 wrote to memory of 4920 4440 673.tmp 91 PID 4440 wrote to memory of 4920 4440 673.tmp 91 PID 4920 wrote to memory of 1844 4920 72F.tmp 92 PID 4920 wrote to memory of 1844 4920 72F.tmp 92 PID 4920 wrote to memory of 1844 4920 72F.tmp 92 PID 1844 wrote to memory of 808 1844 7BB.tmp 93 PID 1844 wrote to memory of 808 1844 7BB.tmp 93 PID 1844 wrote to memory of 808 1844 7BB.tmp 93 PID 808 wrote to memory of 2280 808 848.tmp 94 PID 808 wrote to memory of 2280 808 848.tmp 94 PID 808 wrote to memory of 2280 808 848.tmp 94 PID 2280 wrote to memory of 1420 2280 923.tmp 95 PID 2280 wrote to memory of 1420 2280 923.tmp 95 PID 2280 wrote to memory of 1420 2280 923.tmp 95 PID 1420 wrote to memory of 4368 1420 9EE.tmp 97 PID 1420 wrote to memory of 4368 1420 9EE.tmp 97 PID 1420 wrote to memory of 4368 1420 9EE.tmp 97 PID 4368 wrote to memory of 2132 4368 A9A.tmp 98 PID 4368 wrote to memory of 2132 4368 A9A.tmp 98 PID 4368 wrote to memory of 2132 4368 A9A.tmp 98 PID 2132 wrote to memory of 944 2132 B36.tmp 99 PID 2132 wrote to memory of 944 2132 B36.tmp 99 PID 2132 wrote to memory of 944 2132 B36.tmp 99 PID 944 wrote to memory of 3376 944 BD2.tmp 100 PID 944 wrote to memory of 3376 944 BD2.tmp 100 PID 944 wrote to memory of 3376 944 BD2.tmp 100 PID 3376 wrote to memory of 4724 3376 C8E.tmp 101 PID 3376 wrote to memory of 4724 3376 C8E.tmp 101 PID 3376 wrote to memory of 4724 3376 C8E.tmp 101 PID 4724 wrote to memory of 2516 4724 D69.tmp 102 PID 4724 wrote to memory of 2516 4724 D69.tmp 102 PID 4724 wrote to memory of 2516 4724 D69.tmp 102 PID 2516 wrote to memory of 1576 2516 E34.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\14fe438d45d25dd468c82fc67d6be740_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\14fe438d45d25dd468c82fc67d6be740_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Users\Admin\AppData\Local\Temp\1A.tmp"C:\Users\Admin\AppData\Local\Temp\1A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\105.tmp"C:\Users\Admin\AppData\Local\Temp\105.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\20E.tmp"C:\Users\Admin\AppData\Local\Temp\20E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\2E9.tmp"C:\Users\Admin\AppData\Local\Temp\2E9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\395.tmp"C:\Users\Admin\AppData\Local\Temp\395.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\47F.tmp"C:\Users\Admin\AppData\Local\Temp\47F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\53B.tmp"C:\Users\Admin\AppData\Local\Temp\53B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\5C7.tmp"C:\Users\Admin\AppData\Local\Temp\5C7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\673.tmp"C:\Users\Admin\AppData\Local\Temp\673.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\72F.tmp"C:\Users\Admin\AppData\Local\Temp\72F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\7BB.tmp"C:\Users\Admin\AppData\Local\Temp\7BB.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\848.tmp"C:\Users\Admin\AppData\Local\Temp\848.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\923.tmp"C:\Users\Admin\AppData\Local\Temp\923.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\9EE.tmp"C:\Users\Admin\AppData\Local\Temp\9EE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\A9A.tmp"C:\Users\Admin\AppData\Local\Temp\A9A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\B36.tmp"C:\Users\Admin\AppData\Local\Temp\B36.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\BD2.tmp"C:\Users\Admin\AppData\Local\Temp\BD2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\C8E.tmp"C:\Users\Admin\AppData\Local\Temp\C8E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\D69.tmp"C:\Users\Admin\AppData\Local\Temp\D69.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\F0E.tmp"C:\Users\Admin\AppData\Local\Temp\F0E.tmp"23⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\FDA.tmp"C:\Users\Admin\AppData\Local\Temp\FDA.tmp"24⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\10A5.tmp"C:\Users\Admin\AppData\Local\Temp\10A5.tmp"25⤵
- Executes dropped EXE
PID:880 -
C:\Users\Admin\AppData\Local\Temp\1141.tmp"C:\Users\Admin\AppData\Local\Temp\1141.tmp"26⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\123B.tmp"C:\Users\Admin\AppData\Local\Temp\123B.tmp"27⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\1306.tmp"C:\Users\Admin\AppData\Local\Temp\1306.tmp"28⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\1400.tmp"C:\Users\Admin\AppData\Local\Temp\1400.tmp"29⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\147D.tmp"C:\Users\Admin\AppData\Local\Temp\147D.tmp"30⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\1519.tmp"C:\Users\Admin\AppData\Local\Temp\1519.tmp"31⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\1604.tmp"C:\Users\Admin\AppData\Local\Temp\1604.tmp"32⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\16BF.tmp"C:\Users\Admin\AppData\Local\Temp\16BF.tmp"33⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\175B.tmp"C:\Users\Admin\AppData\Local\Temp\175B.tmp"34⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\1836.tmp"C:\Users\Admin\AppData\Local\Temp\1836.tmp"35⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\18A4.tmp"C:\Users\Admin\AppData\Local\Temp\18A4.tmp"36⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\1930.tmp"C:\Users\Admin\AppData\Local\Temp\1930.tmp"37⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\1A49.tmp"C:\Users\Admin\AppData\Local\Temp\1A49.tmp"38⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\1AB7.tmp"C:\Users\Admin\AppData\Local\Temp\1AB7.tmp"39⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\1B53.tmp"C:\Users\Admin\AppData\Local\Temp\1B53.tmp"40⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"41⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\1C7C.tmp"C:\Users\Admin\AppData\Local\Temp\1C7C.tmp"42⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\1D09.tmp"C:\Users\Admin\AppData\Local\Temp\1D09.tmp"43⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\1D95.tmp"C:\Users\Admin\AppData\Local\Temp\1D95.tmp"44⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\1E22.tmp"C:\Users\Admin\AppData\Local\Temp\1E22.tmp"45⤵
- Executes dropped EXE
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\1EBE.tmp"C:\Users\Admin\AppData\Local\Temp\1EBE.tmp"46⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"47⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"48⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\2093.tmp"C:\Users\Admin\AppData\Local\Temp\2093.tmp"49⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\212F.tmp"C:\Users\Admin\AppData\Local\Temp\212F.tmp"50⤵
- Executes dropped EXE
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\21CB.tmp"C:\Users\Admin\AppData\Local\Temp\21CB.tmp"51⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\2248.tmp"C:\Users\Admin\AppData\Local\Temp\2248.tmp"52⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\22C5.tmp"C:\Users\Admin\AppData\Local\Temp\22C5.tmp"53⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\2352.tmp"C:\Users\Admin\AppData\Local\Temp\2352.tmp"54⤵
- Executes dropped EXE
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\23FE.tmp"C:\Users\Admin\AppData\Local\Temp\23FE.tmp"55⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\246B.tmp"C:\Users\Admin\AppData\Local\Temp\246B.tmp"56⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\24D9.tmp"C:\Users\Admin\AppData\Local\Temp\24D9.tmp"57⤵
- Executes dropped EXE
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\2546.tmp"C:\Users\Admin\AppData\Local\Temp\2546.tmp"58⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\25E2.tmp"C:\Users\Admin\AppData\Local\Temp\25E2.tmp"59⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\2650.tmp"C:\Users\Admin\AppData\Local\Temp\2650.tmp"60⤵
- Executes dropped EXE
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\26CD.tmp"C:\Users\Admin\AppData\Local\Temp\26CD.tmp"61⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\273A.tmp"C:\Users\Admin\AppData\Local\Temp\273A.tmp"62⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\27C7.tmp"C:\Users\Admin\AppData\Local\Temp\27C7.tmp"63⤵
- Executes dropped EXE
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\2863.tmp"C:\Users\Admin\AppData\Local\Temp\2863.tmp"64⤵
- Executes dropped EXE
PID:180 -
C:\Users\Admin\AppData\Local\Temp\28FF.tmp"C:\Users\Admin\AppData\Local\Temp\28FF.tmp"65⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\297C.tmp"C:\Users\Admin\AppData\Local\Temp\297C.tmp"66⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\2A09.tmp"C:\Users\Admin\AppData\Local\Temp\2A09.tmp"67⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\2A76.tmp"C:\Users\Admin\AppData\Local\Temp\2A76.tmp"68⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"69⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\2B9F.tmp"C:\Users\Admin\AppData\Local\Temp\2B9F.tmp"70⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\2C2C.tmp"C:\Users\Admin\AppData\Local\Temp\2C2C.tmp"71⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\2CB8.tmp"C:\Users\Admin\AppData\Local\Temp\2CB8.tmp"72⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\2D26.tmp"C:\Users\Admin\AppData\Local\Temp\2D26.tmp"73⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\2DA3.tmp"C:\Users\Admin\AppData\Local\Temp\2DA3.tmp"74⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\2E2F.tmp"C:\Users\Admin\AppData\Local\Temp\2E2F.tmp"75⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\2EEB.tmp"C:\Users\Admin\AppData\Local\Temp\2EEB.tmp"76⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\2F77.tmp"C:\Users\Admin\AppData\Local\Temp\2F77.tmp"77⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\2FE5.tmp"C:\Users\Admin\AppData\Local\Temp\2FE5.tmp"78⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\3062.tmp"C:\Users\Admin\AppData\Local\Temp\3062.tmp"79⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\30EE.tmp"C:\Users\Admin\AppData\Local\Temp\30EE.tmp"80⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\317B.tmp"C:\Users\Admin\AppData\Local\Temp\317B.tmp"81⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"82⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\3275.tmp"C:\Users\Admin\AppData\Local\Temp\3275.tmp"83⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\32F2.tmp"C:\Users\Admin\AppData\Local\Temp\32F2.tmp"84⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"85⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"86⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\34D6.tmp"C:\Users\Admin\AppData\Local\Temp\34D6.tmp"87⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\3563.tmp"C:\Users\Admin\AppData\Local\Temp\3563.tmp"88⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\35D0.tmp"C:\Users\Admin\AppData\Local\Temp\35D0.tmp"89⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\363E.tmp"C:\Users\Admin\AppData\Local\Temp\363E.tmp"90⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\36DA.tmp"C:\Users\Admin\AppData\Local\Temp\36DA.tmp"91⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\3757.tmp"C:\Users\Admin\AppData\Local\Temp\3757.tmp"92⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\37D4.tmp"C:\Users\Admin\AppData\Local\Temp\37D4.tmp"93⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\3880.tmp"C:\Users\Admin\AppData\Local\Temp\3880.tmp"94⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\390C.tmp"C:\Users\Admin\AppData\Local\Temp\390C.tmp"95⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\3989.tmp"C:\Users\Admin\AppData\Local\Temp\3989.tmp"96⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\3A26.tmp"C:\Users\Admin\AppData\Local\Temp\3A26.tmp"97⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\3AB2.tmp"C:\Users\Admin\AppData\Local\Temp\3AB2.tmp"98⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\3B2F.tmp"C:\Users\Admin\AppData\Local\Temp\3B2F.tmp"99⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\3BAC.tmp"C:\Users\Admin\AppData\Local\Temp\3BAC.tmp"100⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\3C49.tmp"C:\Users\Admin\AppData\Local\Temp\3C49.tmp"101⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\3CC6.tmp"C:\Users\Admin\AppData\Local\Temp\3CC6.tmp"102⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\3D33.tmp"C:\Users\Admin\AppData\Local\Temp\3D33.tmp"103⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\3DB0.tmp"C:\Users\Admin\AppData\Local\Temp\3DB0.tmp"104⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\3E4C.tmp"C:\Users\Admin\AppData\Local\Temp\3E4C.tmp"105⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\3F65.tmp"C:\Users\Admin\AppData\Local\Temp\3F65.tmp"106⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\3FF2.tmp"C:\Users\Admin\AppData\Local\Temp\3FF2.tmp"107⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\408E.tmp"C:\Users\Admin\AppData\Local\Temp\408E.tmp"108⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\411B.tmp"C:\Users\Admin\AppData\Local\Temp\411B.tmp"109⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\4198.tmp"C:\Users\Admin\AppData\Local\Temp\4198.tmp"110⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\4225.tmp"C:\Users\Admin\AppData\Local\Temp\4225.tmp"111⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\42A2.tmp"C:\Users\Admin\AppData\Local\Temp\42A2.tmp"112⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\432E.tmp"C:\Users\Admin\AppData\Local\Temp\432E.tmp"113⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\43CA.tmp"C:\Users\Admin\AppData\Local\Temp\43CA.tmp"114⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\4457.tmp"C:\Users\Admin\AppData\Local\Temp\4457.tmp"115⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\44C4.tmp"C:\Users\Admin\AppData\Local\Temp\44C4.tmp"116⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\4551.tmp"C:\Users\Admin\AppData\Local\Temp\4551.tmp"117⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\45ED.tmp"C:\Users\Admin\AppData\Local\Temp\45ED.tmp"118⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\468A.tmp"C:\Users\Admin\AppData\Local\Temp\468A.tmp"119⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\4707.tmp"C:\Users\Admin\AppData\Local\Temp\4707.tmp"120⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\4784.tmp"C:\Users\Admin\AppData\Local\Temp\4784.tmp"121⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\4801.tmp"C:\Users\Admin\AppData\Local\Temp\4801.tmp"122⤵PID:1088
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-