Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2023, 15:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
323a5d38607ff8103f3a0a446a2b826c_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
323a5d38607ff8103f3a0a446a2b826c_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
323a5d38607ff8103f3a0a446a2b826c_mafia_JC.exe
-
Size
488KB
-
MD5
323a5d38607ff8103f3a0a446a2b826c
-
SHA1
50cb728e030a48e39a3bc4230c9c1a28051518c7
-
SHA256
6f645631ba908bf042ac6d4aadec125ef7ecf45566e9293dd16a00b8814395ed
-
SHA512
58ccb43036f7db8529ad59612060b1454b8719a6ab7e8db236860cd044523f27a768c217fe32d427bc413f4bd20383f962a3f35598225e669f35cc938b133ce0
-
SSDEEP
12288:/U5rCOTeiDmhjy3yOi08/P0ynbEqnLXcmGNZ:/UQOJDcaM08n04bbLXcrN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2748 877.tmp 3076 981.tmp 4144 A5B.tmp 2068 B84.tmp 3780 C5F.tmp 1116 D49.tmp 4308 E14.tmp 836 ED0.tmp 5036 FBA.tmp 3056 1076.tmp 3892 11DD.tmp 2152 1325.tmp 3804 141F.tmp 4544 14DB.tmp 3680 15A6.tmp 3316 1671.tmp 1580 172D.tmp 3540 1807.tmp 2248 18D2.tmp 3452 196F.tmp 3856 1A49.tmp 2328 1B24.tmp 2952 1C0F.tmp 1848 1CCA.tmp 516 1DD4.tmp 2968 1E8F.tmp 5048 1F3B.tmp 2132 2025.tmp 1516 20B2.tmp 3368 217D.tmp 3096 2258.tmp 4408 2313.tmp 2220 23B0.tmp 2820 242D.tmp 2368 24B9.tmp 2400 2536.tmp 1960 25A4.tmp 1140 2630.tmp 3224 26BD.tmp 3272 274A.tmp 2332 27B7.tmp 3512 2844.tmp 2012 28C1.tmp 752 293E.tmp 1104 29DA.tmp 2580 2A57.tmp 3880 2AD4.tmp 1992 2B51.tmp 2900 2BBE.tmp 4292 2C2C.tmp 1744 2CC8.tmp 4176 2D45.tmp 1040 2DE1.tmp 1108 2E5E.tmp 4164 2EDB.tmp 760 2F68.tmp 2216 2FE5.tmp 4144 3081.tmp 4196 312D.tmp 1368 31C9.tmp 4792 3265.tmp 3956 338E.tmp 3664 33FC.tmp 828 34A7.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1108 wrote to memory of 2748 1108 323a5d38607ff8103f3a0a446a2b826c_mafia_JC.exe 82 PID 1108 wrote to memory of 2748 1108 323a5d38607ff8103f3a0a446a2b826c_mafia_JC.exe 82 PID 1108 wrote to memory of 2748 1108 323a5d38607ff8103f3a0a446a2b826c_mafia_JC.exe 82 PID 2748 wrote to memory of 3076 2748 877.tmp 83 PID 2748 wrote to memory of 3076 2748 877.tmp 83 PID 2748 wrote to memory of 3076 2748 877.tmp 83 PID 3076 wrote to memory of 4144 3076 981.tmp 84 PID 3076 wrote to memory of 4144 3076 981.tmp 84 PID 3076 wrote to memory of 4144 3076 981.tmp 84 PID 4144 wrote to memory of 2068 4144 A5B.tmp 85 PID 4144 wrote to memory of 2068 4144 A5B.tmp 85 PID 4144 wrote to memory of 2068 4144 A5B.tmp 85 PID 2068 wrote to memory of 3780 2068 B84.tmp 86 PID 2068 wrote to memory of 3780 2068 B84.tmp 86 PID 2068 wrote to memory of 3780 2068 B84.tmp 86 PID 3780 wrote to memory of 1116 3780 C5F.tmp 87 PID 3780 wrote to memory of 1116 3780 C5F.tmp 87 PID 3780 wrote to memory of 1116 3780 C5F.tmp 87 PID 1116 wrote to memory of 4308 1116 D49.tmp 88 PID 1116 wrote to memory of 4308 1116 D49.tmp 88 PID 1116 wrote to memory of 4308 1116 D49.tmp 88 PID 4308 wrote to memory of 836 4308 E14.tmp 89 PID 4308 wrote to memory of 836 4308 E14.tmp 89 PID 4308 wrote to memory of 836 4308 E14.tmp 89 PID 836 wrote to memory of 5036 836 ED0.tmp 90 PID 836 wrote to memory of 5036 836 ED0.tmp 90 PID 836 wrote to memory of 5036 836 ED0.tmp 90 PID 5036 wrote to memory of 3056 5036 FBA.tmp 91 PID 5036 wrote to memory of 3056 5036 FBA.tmp 91 PID 5036 wrote to memory of 3056 5036 FBA.tmp 91 PID 3056 wrote to memory of 3892 3056 1076.tmp 92 PID 3056 wrote to memory of 3892 3056 1076.tmp 92 PID 3056 wrote to memory of 3892 3056 1076.tmp 92 PID 3892 wrote to memory of 2152 3892 11DD.tmp 93 PID 3892 wrote to memory of 2152 3892 11DD.tmp 93 PID 3892 wrote to memory of 2152 3892 11DD.tmp 93 PID 2152 wrote to memory of 3804 2152 1325.tmp 94 PID 2152 wrote to memory of 3804 2152 1325.tmp 94 PID 2152 wrote to memory of 3804 2152 1325.tmp 94 PID 3804 wrote to memory of 4544 3804 141F.tmp 96 PID 3804 wrote to memory of 4544 3804 141F.tmp 96 PID 3804 wrote to memory of 4544 3804 141F.tmp 96 PID 4544 wrote to memory of 3680 4544 14DB.tmp 97 PID 4544 wrote to memory of 3680 4544 14DB.tmp 97 PID 4544 wrote to memory of 3680 4544 14DB.tmp 97 PID 3680 wrote to memory of 3316 3680 15A6.tmp 98 PID 3680 wrote to memory of 3316 3680 15A6.tmp 98 PID 3680 wrote to memory of 3316 3680 15A6.tmp 98 PID 3316 wrote to memory of 1580 3316 1671.tmp 99 PID 3316 wrote to memory of 1580 3316 1671.tmp 99 PID 3316 wrote to memory of 1580 3316 1671.tmp 99 PID 1580 wrote to memory of 3540 1580 172D.tmp 100 PID 1580 wrote to memory of 3540 1580 172D.tmp 100 PID 1580 wrote to memory of 3540 1580 172D.tmp 100 PID 3540 wrote to memory of 2248 3540 1807.tmp 101 PID 3540 wrote to memory of 2248 3540 1807.tmp 101 PID 3540 wrote to memory of 2248 3540 1807.tmp 101 PID 2248 wrote to memory of 3452 2248 18D2.tmp 102 PID 2248 wrote to memory of 3452 2248 18D2.tmp 102 PID 2248 wrote to memory of 3452 2248 18D2.tmp 102 PID 3452 wrote to memory of 3856 3452 196F.tmp 103 PID 3452 wrote to memory of 3856 3452 196F.tmp 103 PID 3452 wrote to memory of 3856 3452 196F.tmp 103 PID 3856 wrote to memory of 2328 3856 1A49.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\323a5d38607ff8103f3a0a446a2b826c_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\323a5d38607ff8103f3a0a446a2b826c_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\877.tmp"C:\Users\Admin\AppData\Local\Temp\877.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\981.tmp"C:\Users\Admin\AppData\Local\Temp\981.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\A5B.tmp"C:\Users\Admin\AppData\Local\Temp\A5B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\B84.tmp"C:\Users\Admin\AppData\Local\Temp\B84.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\C5F.tmp"C:\Users\Admin\AppData\Local\Temp\C5F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\D49.tmp"C:\Users\Admin\AppData\Local\Temp\D49.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\E14.tmp"C:\Users\Admin\AppData\Local\Temp\E14.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\1076.tmp"C:\Users\Admin\AppData\Local\Temp\1076.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\11DD.tmp"C:\Users\Admin\AppData\Local\Temp\11DD.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\1325.tmp"C:\Users\Admin\AppData\Local\Temp\1325.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\141F.tmp"C:\Users\Admin\AppData\Local\Temp\141F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\14DB.tmp"C:\Users\Admin\AppData\Local\Temp\14DB.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\15A6.tmp"C:\Users\Admin\AppData\Local\Temp\15A6.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\1671.tmp"C:\Users\Admin\AppData\Local\Temp\1671.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\172D.tmp"C:\Users\Admin\AppData\Local\Temp\172D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\1807.tmp"C:\Users\Admin\AppData\Local\Temp\1807.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\18D2.tmp"C:\Users\Admin\AppData\Local\Temp\18D2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\196F.tmp"C:\Users\Admin\AppData\Local\Temp\196F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\1A49.tmp"C:\Users\Admin\AppData\Local\Temp\1A49.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\1B24.tmp"C:\Users\Admin\AppData\Local\Temp\1B24.tmp"23⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\1C0F.tmp"C:\Users\Admin\AppData\Local\Temp\1C0F.tmp"24⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"25⤵
- Executes dropped EXE
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"26⤵
- Executes dropped EXE
PID:516 -
C:\Users\Admin\AppData\Local\Temp\1E8F.tmp"C:\Users\Admin\AppData\Local\Temp\1E8F.tmp"27⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\1F3B.tmp"C:\Users\Admin\AppData\Local\Temp\1F3B.tmp"28⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\2025.tmp"C:\Users\Admin\AppData\Local\Temp\2025.tmp"29⤵
- Executes dropped EXE
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\20B2.tmp"C:\Users\Admin\AppData\Local\Temp\20B2.tmp"30⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\217D.tmp"C:\Users\Admin\AppData\Local\Temp\217D.tmp"31⤵
- Executes dropped EXE
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\2258.tmp"C:\Users\Admin\AppData\Local\Temp\2258.tmp"32⤵
- Executes dropped EXE
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\2313.tmp"C:\Users\Admin\AppData\Local\Temp\2313.tmp"33⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\23B0.tmp"C:\Users\Admin\AppData\Local\Temp\23B0.tmp"34⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\242D.tmp"C:\Users\Admin\AppData\Local\Temp\242D.tmp"35⤵
- Executes dropped EXE
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\24B9.tmp"C:\Users\Admin\AppData\Local\Temp\24B9.tmp"36⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\2536.tmp"C:\Users\Admin\AppData\Local\Temp\2536.tmp"37⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\25A4.tmp"C:\Users\Admin\AppData\Local\Temp\25A4.tmp"38⤵
- Executes dropped EXE
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\2630.tmp"C:\Users\Admin\AppData\Local\Temp\2630.tmp"39⤵
- Executes dropped EXE
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\26BD.tmp"C:\Users\Admin\AppData\Local\Temp\26BD.tmp"40⤵
- Executes dropped EXE
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\274A.tmp"C:\Users\Admin\AppData\Local\Temp\274A.tmp"41⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\27B7.tmp"C:\Users\Admin\AppData\Local\Temp\27B7.tmp"42⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\2844.tmp"C:\Users\Admin\AppData\Local\Temp\2844.tmp"43⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\28C1.tmp"C:\Users\Admin\AppData\Local\Temp\28C1.tmp"44⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\293E.tmp"C:\Users\Admin\AppData\Local\Temp\293E.tmp"45⤵
- Executes dropped EXE
PID:752 -
C:\Users\Admin\AppData\Local\Temp\29DA.tmp"C:\Users\Admin\AppData\Local\Temp\29DA.tmp"46⤵
- Executes dropped EXE
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\2A57.tmp"C:\Users\Admin\AppData\Local\Temp\2A57.tmp"47⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\2AD4.tmp"C:\Users\Admin\AppData\Local\Temp\2AD4.tmp"48⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\2B51.tmp"C:\Users\Admin\AppData\Local\Temp\2B51.tmp"49⤵
- Executes dropped EXE
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\2BBE.tmp"C:\Users\Admin\AppData\Local\Temp\2BBE.tmp"50⤵
- Executes dropped EXE
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\2C2C.tmp"C:\Users\Admin\AppData\Local\Temp\2C2C.tmp"51⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"52⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\2D45.tmp"C:\Users\Admin\AppData\Local\Temp\2D45.tmp"53⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\2DE1.tmp"C:\Users\Admin\AppData\Local\Temp\2DE1.tmp"54⤵
- Executes dropped EXE
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\2E5E.tmp"C:\Users\Admin\AppData\Local\Temp\2E5E.tmp"55⤵
- Executes dropped EXE
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\2EDB.tmp"C:\Users\Admin\AppData\Local\Temp\2EDB.tmp"56⤵
- Executes dropped EXE
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\2F68.tmp"C:\Users\Admin\AppData\Local\Temp\2F68.tmp"57⤵
- Executes dropped EXE
PID:760 -
C:\Users\Admin\AppData\Local\Temp\2FE5.tmp"C:\Users\Admin\AppData\Local\Temp\2FE5.tmp"58⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\3081.tmp"C:\Users\Admin\AppData\Local\Temp\3081.tmp"59⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\312D.tmp"C:\Users\Admin\AppData\Local\Temp\312D.tmp"60⤵
- Executes dropped EXE
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\31C9.tmp"C:\Users\Admin\AppData\Local\Temp\31C9.tmp"61⤵
- Executes dropped EXE
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\3265.tmp"C:\Users\Admin\AppData\Local\Temp\3265.tmp"62⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"63⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"64⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"65⤵
- Executes dropped EXE
PID:828 -
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"66⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\35F0.tmp"C:\Users\Admin\AppData\Local\Temp\35F0.tmp"67⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\36AB.tmp"C:\Users\Admin\AppData\Local\Temp\36AB.tmp"68⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\3728.tmp"C:\Users\Admin\AppData\Local\Temp\3728.tmp"69⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\37D4.tmp"C:\Users\Admin\AppData\Local\Temp\37D4.tmp"70⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\3851.tmp"C:\Users\Admin\AppData\Local\Temp\3851.tmp"71⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\38BE.tmp"C:\Users\Admin\AppData\Local\Temp\38BE.tmp"72⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\395B.tmp"C:\Users\Admin\AppData\Local\Temp\395B.tmp"73⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\39C8.tmp"C:\Users\Admin\AppData\Local\Temp\39C8.tmp"74⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\3A74.tmp"C:\Users\Admin\AppData\Local\Temp\3A74.tmp"75⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\3AF1.tmp"C:\Users\Admin\AppData\Local\Temp\3AF1.tmp"76⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\3B8D.tmp"C:\Users\Admin\AppData\Local\Temp\3B8D.tmp"77⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\3C1A.tmp"C:\Users\Admin\AppData\Local\Temp\3C1A.tmp"78⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\3CC6.tmp"C:\Users\Admin\AppData\Local\Temp\3CC6.tmp"79⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\3D62.tmp"C:\Users\Admin\AppData\Local\Temp\3D62.tmp"80⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\3DDF.tmp"C:\Users\Admin\AppData\Local\Temp\3DDF.tmp"81⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\3E7B.tmp"C:\Users\Admin\AppData\Local\Temp\3E7B.tmp"82⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\3F17.tmp"C:\Users\Admin\AppData\Local\Temp\3F17.tmp"83⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"84⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\4031.tmp"C:\Users\Admin\AppData\Local\Temp\4031.tmp"85⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\40AE.tmp"C:\Users\Admin\AppData\Local\Temp\40AE.tmp"86⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\4159.tmp"C:\Users\Admin\AppData\Local\Temp\4159.tmp"87⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\41E6.tmp"C:\Users\Admin\AppData\Local\Temp\41E6.tmp"88⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\4292.tmp"C:\Users\Admin\AppData\Local\Temp\4292.tmp"89⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\432E.tmp"C:\Users\Admin\AppData\Local\Temp\432E.tmp"90⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\43CA.tmp"C:\Users\Admin\AppData\Local\Temp\43CA.tmp"91⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\4457.tmp"C:\Users\Admin\AppData\Local\Temp\4457.tmp"92⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\44E4.tmp"C:\Users\Admin\AppData\Local\Temp\44E4.tmp"93⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\4590.tmp"C:\Users\Admin\AppData\Local\Temp\4590.tmp"94⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\462C.tmp"C:\Users\Admin\AppData\Local\Temp\462C.tmp"95⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\46B8.tmp"C:\Users\Admin\AppData\Local\Temp\46B8.tmp"96⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\4735.tmp"C:\Users\Admin\AppData\Local\Temp\4735.tmp"97⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\47D2.tmp"C:\Users\Admin\AppData\Local\Temp\47D2.tmp"98⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\485E.tmp"C:\Users\Admin\AppData\Local\Temp\485E.tmp"99⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\48CC.tmp"C:\Users\Admin\AppData\Local\Temp\48CC.tmp"100⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\4949.tmp"C:\Users\Admin\AppData\Local\Temp\4949.tmp"101⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\49D5.tmp"C:\Users\Admin\AppData\Local\Temp\49D5.tmp"102⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\4A72.tmp"C:\Users\Admin\AppData\Local\Temp\4A72.tmp"103⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\4AEF.tmp"C:\Users\Admin\AppData\Local\Temp\4AEF.tmp"104⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\4B9A.tmp"C:\Users\Admin\AppData\Local\Temp\4B9A.tmp"105⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\4C27.tmp"C:\Users\Admin\AppData\Local\Temp\4C27.tmp"106⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\4CB4.tmp"C:\Users\Admin\AppData\Local\Temp\4CB4.tmp"107⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\4D7F.tmp"C:\Users\Admin\AppData\Local\Temp\4D7F.tmp"108⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\4E2B.tmp"C:\Users\Admin\AppData\Local\Temp\4E2B.tmp"109⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\4E98.tmp"C:\Users\Admin\AppData\Local\Temp\4E98.tmp"110⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\4F25.tmp"C:\Users\Admin\AppData\Local\Temp\4F25.tmp"111⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\4FA2.tmp"C:\Users\Admin\AppData\Local\Temp\4FA2.tmp"112⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\502E.tmp"C:\Users\Admin\AppData\Local\Temp\502E.tmp"113⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\50AB.tmp"C:\Users\Admin\AppData\Local\Temp\50AB.tmp"114⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\5167.tmp"C:\Users\Admin\AppData\Local\Temp\5167.tmp"115⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\51E4.tmp"C:\Users\Admin\AppData\Local\Temp\51E4.tmp"116⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\5280.tmp"C:\Users\Admin\AppData\Local\Temp\5280.tmp"117⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\52ED.tmp"C:\Users\Admin\AppData\Local\Temp\52ED.tmp"118⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\536A.tmp"C:\Users\Admin\AppData\Local\Temp\536A.tmp"119⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\53F7.tmp"C:\Users\Admin\AppData\Local\Temp\53F7.tmp"120⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\5493.tmp"C:\Users\Admin\AppData\Local\Temp\5493.tmp"121⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\553F.tmp"C:\Users\Admin\AppData\Local\Temp\553F.tmp"122⤵PID:1116
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-