Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2023, 15:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
339b28b683beb4fba78cfbca9fe7f45b_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
339b28b683beb4fba78cfbca9fe7f45b_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
339b28b683beb4fba78cfbca9fe7f45b_mafia_JC.exe
-
Size
486KB
-
MD5
339b28b683beb4fba78cfbca9fe7f45b
-
SHA1
788815b0a7b0f3a116a1afb698e8589fdf6be53d
-
SHA256
d20908dad732fe8633487a99d7ba1cef3c62c8bfdab78fa7ccc3db4a39da25f9
-
SHA512
a6ec512734fe1420be3bbb8216baf3007b3fd6a1727adb1b03bbb8c766e90087926f1f11ab04285c4332e705cc4fd42d4f23e51e0456767c376f7e263c0c963b
-
SSDEEP
12288:/U5rCOTeiDMN6APAZ15Nmq7G/SptHGbR/NZ:/UQOJDG6v15NmT/dN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4812 616.tmp 4688 72F.tmp 2460 7DB.tmp 3888 8D5.tmp 5076 9A0.tmp 2972 A5B.tmp 2228 B36.tmp 636 BE2.tmp 1136 C9D.tmp 4188 D69.tmp 988 E34.tmp 1164 F3D.tmp 3060 1037.tmp 2792 1112.tmp 3916 11FC.tmp 656 12C8.tmp 3804 13C2.tmp 4604 14BC.tmp 780 1587.tmp 1152 1652.tmp 3636 170D.tmp 3464 179A.tmp 1744 1865.tmp 4564 194F.tmp 4556 1A49.tmp 3596 1AF5.tmp 3868 1BA1.tmp 3772 1CAB.tmp 4028 1D86.tmp 3480 1E22.tmp 4024 1F0C.tmp 3572 1F99.tmp 4984 2035.tmp 860 20C2.tmp 752 216E.tmp 4760 21FA.tmp 4748 22B6.tmp 2704 2333.tmp 4728 23FE.tmp 1416 247B.tmp 3028 2517.tmp 2156 25A4.tmp 4880 2630.tmp 4792 26DC.tmp 3920 274A.tmp 1984 27B7.tmp 1432 2853.tmp 3148 28C1.tmp 492 292E.tmp 5004 29BB.tmp 3468 2A57.tmp 972 2AD4.tmp 2592 2B70.tmp 4272 2C0C.tmp 5016 2C89.tmp 2308 2D93.tmp 1636 2E3F.tmp 2956 2ECB.tmp 112 2F39.tmp 3184 2FE5.tmp 3560 3062.tmp 2984 30CF.tmp 4884 314C.tmp 2696 31F8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3096 wrote to memory of 4812 3096 339b28b683beb4fba78cfbca9fe7f45b_mafia_JC.exe 82 PID 3096 wrote to memory of 4812 3096 339b28b683beb4fba78cfbca9fe7f45b_mafia_JC.exe 82 PID 3096 wrote to memory of 4812 3096 339b28b683beb4fba78cfbca9fe7f45b_mafia_JC.exe 82 PID 4812 wrote to memory of 4688 4812 616.tmp 83 PID 4812 wrote to memory of 4688 4812 616.tmp 83 PID 4812 wrote to memory of 4688 4812 616.tmp 83 PID 4688 wrote to memory of 2460 4688 72F.tmp 84 PID 4688 wrote to memory of 2460 4688 72F.tmp 84 PID 4688 wrote to memory of 2460 4688 72F.tmp 84 PID 2460 wrote to memory of 3888 2460 7DB.tmp 85 PID 2460 wrote to memory of 3888 2460 7DB.tmp 85 PID 2460 wrote to memory of 3888 2460 7DB.tmp 85 PID 3888 wrote to memory of 5076 3888 8D5.tmp 86 PID 3888 wrote to memory of 5076 3888 8D5.tmp 86 PID 3888 wrote to memory of 5076 3888 8D5.tmp 86 PID 5076 wrote to memory of 2972 5076 9A0.tmp 87 PID 5076 wrote to memory of 2972 5076 9A0.tmp 87 PID 5076 wrote to memory of 2972 5076 9A0.tmp 87 PID 2972 wrote to memory of 2228 2972 A5B.tmp 88 PID 2972 wrote to memory of 2228 2972 A5B.tmp 88 PID 2972 wrote to memory of 2228 2972 A5B.tmp 88 PID 2228 wrote to memory of 636 2228 B36.tmp 89 PID 2228 wrote to memory of 636 2228 B36.tmp 89 PID 2228 wrote to memory of 636 2228 B36.tmp 89 PID 636 wrote to memory of 1136 636 BE2.tmp 90 PID 636 wrote to memory of 1136 636 BE2.tmp 90 PID 636 wrote to memory of 1136 636 BE2.tmp 90 PID 1136 wrote to memory of 4188 1136 C9D.tmp 91 PID 1136 wrote to memory of 4188 1136 C9D.tmp 91 PID 1136 wrote to memory of 4188 1136 C9D.tmp 91 PID 4188 wrote to memory of 988 4188 D69.tmp 92 PID 4188 wrote to memory of 988 4188 D69.tmp 92 PID 4188 wrote to memory of 988 4188 D69.tmp 92 PID 988 wrote to memory of 1164 988 E34.tmp 93 PID 988 wrote to memory of 1164 988 E34.tmp 93 PID 988 wrote to memory of 1164 988 E34.tmp 93 PID 1164 wrote to memory of 3060 1164 F3D.tmp 94 PID 1164 wrote to memory of 3060 1164 F3D.tmp 94 PID 1164 wrote to memory of 3060 1164 F3D.tmp 94 PID 3060 wrote to memory of 2792 3060 1037.tmp 95 PID 3060 wrote to memory of 2792 3060 1037.tmp 95 PID 3060 wrote to memory of 2792 3060 1037.tmp 95 PID 2792 wrote to memory of 3916 2792 1112.tmp 96 PID 2792 wrote to memory of 3916 2792 1112.tmp 96 PID 2792 wrote to memory of 3916 2792 1112.tmp 96 PID 3916 wrote to memory of 656 3916 11FC.tmp 97 PID 3916 wrote to memory of 656 3916 11FC.tmp 97 PID 3916 wrote to memory of 656 3916 11FC.tmp 97 PID 656 wrote to memory of 3804 656 12C8.tmp 98 PID 656 wrote to memory of 3804 656 12C8.tmp 98 PID 656 wrote to memory of 3804 656 12C8.tmp 98 PID 3804 wrote to memory of 4604 3804 13C2.tmp 100 PID 3804 wrote to memory of 4604 3804 13C2.tmp 100 PID 3804 wrote to memory of 4604 3804 13C2.tmp 100 PID 4604 wrote to memory of 780 4604 14BC.tmp 101 PID 4604 wrote to memory of 780 4604 14BC.tmp 101 PID 4604 wrote to memory of 780 4604 14BC.tmp 101 PID 780 wrote to memory of 1152 780 1587.tmp 102 PID 780 wrote to memory of 1152 780 1587.tmp 102 PID 780 wrote to memory of 1152 780 1587.tmp 102 PID 1152 wrote to memory of 3636 1152 1652.tmp 103 PID 1152 wrote to memory of 3636 1152 1652.tmp 103 PID 1152 wrote to memory of 3636 1152 1652.tmp 103 PID 3636 wrote to memory of 3464 3636 170D.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\339b28b683beb4fba78cfbca9fe7f45b_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\339b28b683beb4fba78cfbca9fe7f45b_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\616.tmp"C:\Users\Admin\AppData\Local\Temp\616.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\72F.tmp"C:\Users\Admin\AppData\Local\Temp\72F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\7DB.tmp"C:\Users\Admin\AppData\Local\Temp\7DB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\8D5.tmp"C:\Users\Admin\AppData\Local\Temp\8D5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\9A0.tmp"C:\Users\Admin\AppData\Local\Temp\9A0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\A5B.tmp"C:\Users\Admin\AppData\Local\Temp\A5B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\B36.tmp"C:\Users\Admin\AppData\Local\Temp\B36.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\BE2.tmp"C:\Users\Admin\AppData\Local\Temp\BE2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\C9D.tmp"C:\Users\Admin\AppData\Local\Temp\C9D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\D69.tmp"C:\Users\Admin\AppData\Local\Temp\D69.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\F3D.tmp"C:\Users\Admin\AppData\Local\Temp\F3D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\1037.tmp"C:\Users\Admin\AppData\Local\Temp\1037.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\1112.tmp"C:\Users\Admin\AppData\Local\Temp\1112.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\11FC.tmp"C:\Users\Admin\AppData\Local\Temp\11FC.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\12C8.tmp"C:\Users\Admin\AppData\Local\Temp\12C8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Users\Admin\AppData\Local\Temp\13C2.tmp"C:\Users\Admin\AppData\Local\Temp\13C2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\14BC.tmp"C:\Users\Admin\AppData\Local\Temp\14BC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\1587.tmp"C:\Users\Admin\AppData\Local\Temp\1587.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Users\Admin\AppData\Local\Temp\1652.tmp"C:\Users\Admin\AppData\Local\Temp\1652.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\170D.tmp"C:\Users\Admin\AppData\Local\Temp\170D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\179A.tmp"C:\Users\Admin\AppData\Local\Temp\179A.tmp"23⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\1865.tmp"C:\Users\Admin\AppData\Local\Temp\1865.tmp"24⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\194F.tmp"C:\Users\Admin\AppData\Local\Temp\194F.tmp"25⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\1A49.tmp"C:\Users\Admin\AppData\Local\Temp\1A49.tmp"26⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"27⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"28⤵
- Executes dropped EXE
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"29⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\1D86.tmp"C:\Users\Admin\AppData\Local\Temp\1D86.tmp"30⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\1E22.tmp"C:\Users\Admin\AppData\Local\Temp\1E22.tmp"31⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"32⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\1F99.tmp"C:\Users\Admin\AppData\Local\Temp\1F99.tmp"33⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\2035.tmp"C:\Users\Admin\AppData\Local\Temp\2035.tmp"34⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\20C2.tmp"C:\Users\Admin\AppData\Local\Temp\20C2.tmp"35⤵
- Executes dropped EXE
PID:860 -
C:\Users\Admin\AppData\Local\Temp\216E.tmp"C:\Users\Admin\AppData\Local\Temp\216E.tmp"36⤵
- Executes dropped EXE
PID:752 -
C:\Users\Admin\AppData\Local\Temp\21FA.tmp"C:\Users\Admin\AppData\Local\Temp\21FA.tmp"37⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\22B6.tmp"C:\Users\Admin\AppData\Local\Temp\22B6.tmp"38⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\2333.tmp"C:\Users\Admin\AppData\Local\Temp\2333.tmp"39⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\23FE.tmp"C:\Users\Admin\AppData\Local\Temp\23FE.tmp"40⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\247B.tmp"C:\Users\Admin\AppData\Local\Temp\247B.tmp"41⤵
- Executes dropped EXE
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\2517.tmp"C:\Users\Admin\AppData\Local\Temp\2517.tmp"42⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\25A4.tmp"C:\Users\Admin\AppData\Local\Temp\25A4.tmp"43⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\2630.tmp"C:\Users\Admin\AppData\Local\Temp\2630.tmp"44⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\26DC.tmp"C:\Users\Admin\AppData\Local\Temp\26DC.tmp"45⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\274A.tmp"C:\Users\Admin\AppData\Local\Temp\274A.tmp"46⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\27B7.tmp"C:\Users\Admin\AppData\Local\Temp\27B7.tmp"47⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\2853.tmp"C:\Users\Admin\AppData\Local\Temp\2853.tmp"48⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\28C1.tmp"C:\Users\Admin\AppData\Local\Temp\28C1.tmp"49⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\292E.tmp"C:\Users\Admin\AppData\Local\Temp\292E.tmp"50⤵
- Executes dropped EXE
PID:492 -
C:\Users\Admin\AppData\Local\Temp\29BB.tmp"C:\Users\Admin\AppData\Local\Temp\29BB.tmp"51⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\2A57.tmp"C:\Users\Admin\AppData\Local\Temp\2A57.tmp"52⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\2AD4.tmp"C:\Users\Admin\AppData\Local\Temp\2AD4.tmp"53⤵
- Executes dropped EXE
PID:972 -
C:\Users\Admin\AppData\Local\Temp\2B70.tmp"C:\Users\Admin\AppData\Local\Temp\2B70.tmp"54⤵
- Executes dropped EXE
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\2C0C.tmp"C:\Users\Admin\AppData\Local\Temp\2C0C.tmp"55⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\2C89.tmp"C:\Users\Admin\AppData\Local\Temp\2C89.tmp"56⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\2D06.tmp"C:\Users\Admin\AppData\Local\Temp\2D06.tmp"57⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\2D93.tmp"C:\Users\Admin\AppData\Local\Temp\2D93.tmp"58⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\2E3F.tmp"C:\Users\Admin\AppData\Local\Temp\2E3F.tmp"59⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\2ECB.tmp"C:\Users\Admin\AppData\Local\Temp\2ECB.tmp"60⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\2F39.tmp"C:\Users\Admin\AppData\Local\Temp\2F39.tmp"61⤵
- Executes dropped EXE
PID:112 -
C:\Users\Admin\AppData\Local\Temp\2FE5.tmp"C:\Users\Admin\AppData\Local\Temp\2FE5.tmp"62⤵
- Executes dropped EXE
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\3062.tmp"C:\Users\Admin\AppData\Local\Temp\3062.tmp"63⤵
- Executes dropped EXE
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\30CF.tmp"C:\Users\Admin\AppData\Local\Temp\30CF.tmp"64⤵
- Executes dropped EXE
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\314C.tmp"C:\Users\Admin\AppData\Local\Temp\314C.tmp"65⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\31F8.tmp"C:\Users\Admin\AppData\Local\Temp\31F8.tmp"66⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\3275.tmp"C:\Users\Admin\AppData\Local\Temp\3275.tmp"67⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"68⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"69⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"70⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"71⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"72⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\35D0.tmp"C:\Users\Admin\AppData\Local\Temp\35D0.tmp"73⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\365D.tmp"C:\Users\Admin\AppData\Local\Temp\365D.tmp"74⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\36EA.tmp"C:\Users\Admin\AppData\Local\Temp\36EA.tmp"75⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\3757.tmp"C:\Users\Admin\AppData\Local\Temp\3757.tmp"76⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\37F3.tmp"C:\Users\Admin\AppData\Local\Temp\37F3.tmp"77⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\3880.tmp"C:\Users\Admin\AppData\Local\Temp\3880.tmp"78⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\391C.tmp"C:\Users\Admin\AppData\Local\Temp\391C.tmp"79⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\39A9.tmp"C:\Users\Admin\AppData\Local\Temp\39A9.tmp"80⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\3A45.tmp"C:\Users\Admin\AppData\Local\Temp\3A45.tmp"81⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\3AB2.tmp"C:\Users\Admin\AppData\Local\Temp\3AB2.tmp"82⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\3B5E.tmp"C:\Users\Admin\AppData\Local\Temp\3B5E.tmp"83⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\3BEB.tmp"C:\Users\Admin\AppData\Local\Temp\3BEB.tmp"84⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\3C68.tmp"C:\Users\Admin\AppData\Local\Temp\3C68.tmp"85⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\3CF4.tmp"C:\Users\Admin\AppData\Local\Temp\3CF4.tmp"86⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\3D71.tmp"C:\Users\Admin\AppData\Local\Temp\3D71.tmp"87⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\3E0E.tmp"C:\Users\Admin\AppData\Local\Temp\3E0E.tmp"88⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\3E6B.tmp"C:\Users\Admin\AppData\Local\Temp\3E6B.tmp"89⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\3EE8.tmp"C:\Users\Admin\AppData\Local\Temp\3EE8.tmp"90⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\3F75.tmp"C:\Users\Admin\AppData\Local\Temp\3F75.tmp"91⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\4021.tmp"C:\Users\Admin\AppData\Local\Temp\4021.tmp"92⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\40AE.tmp"C:\Users\Admin\AppData\Local\Temp\40AE.tmp"93⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\413A.tmp"C:\Users\Admin\AppData\Local\Temp\413A.tmp"94⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\41A8.tmp"C:\Users\Admin\AppData\Local\Temp\41A8.tmp"95⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\4225.tmp"C:\Users\Admin\AppData\Local\Temp\4225.tmp"96⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\42A2.tmp"C:\Users\Admin\AppData\Local\Temp\42A2.tmp"97⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\432E.tmp"C:\Users\Admin\AppData\Local\Temp\432E.tmp"98⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\439C.tmp"C:\Users\Admin\AppData\Local\Temp\439C.tmp"99⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\44B5.tmp"C:\Users\Admin\AppData\Local\Temp\44B5.tmp"100⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\4551.tmp"C:\Users\Admin\AppData\Local\Temp\4551.tmp"101⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\45DE.tmp"C:\Users\Admin\AppData\Local\Temp\45DE.tmp"102⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\465B.tmp"C:\Users\Admin\AppData\Local\Temp\465B.tmp"103⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\4755.tmp"C:\Users\Admin\AppData\Local\Temp\4755.tmp"104⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\47C2.tmp"C:\Users\Admin\AppData\Local\Temp\47C2.tmp"105⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\485E.tmp"C:\Users\Admin\AppData\Local\Temp\485E.tmp"106⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\48CC.tmp"C:\Users\Admin\AppData\Local\Temp\48CC.tmp"107⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\4958.tmp"C:\Users\Admin\AppData\Local\Temp\4958.tmp"108⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\4A23.tmp"C:\Users\Admin\AppData\Local\Temp\4A23.tmp"109⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"110⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\4B2D.tmp"C:\Users\Admin\AppData\Local\Temp\4B2D.tmp"111⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\4BAA.tmp"C:\Users\Admin\AppData\Local\Temp\4BAA.tmp"112⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\4C46.tmp"C:\Users\Admin\AppData\Local\Temp\4C46.tmp"113⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\4CC3.tmp"C:\Users\Admin\AppData\Local\Temp\4CC3.tmp"114⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\4D50.tmp"C:\Users\Admin\AppData\Local\Temp\4D50.tmp"115⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\4DCD.tmp"C:\Users\Admin\AppData\Local\Temp\4DCD.tmp"116⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\4E3A.tmp"C:\Users\Admin\AppData\Local\Temp\4E3A.tmp"117⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\4EB7.tmp"C:\Users\Admin\AppData\Local\Temp\4EB7.tmp"118⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\4F54.tmp"C:\Users\Admin\AppData\Local\Temp\4F54.tmp"119⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\4FC1.tmp"C:\Users\Admin\AppData\Local\Temp\4FC1.tmp"120⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\50AB.tmp"C:\Users\Admin\AppData\Local\Temp\50AB.tmp"121⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\5148.tmp"C:\Users\Admin\AppData\Local\Temp\5148.tmp"122⤵PID:4824
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-