Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2023, 16:04
Static task
static1
Behavioral task
behavioral1
Sample
33e2c893bf5386614225d0e7a0170c4d_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
33e2c893bf5386614225d0e7a0170c4d_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
33e2c893bf5386614225d0e7a0170c4d_mafia_JC.exe
-
Size
488KB
-
MD5
33e2c893bf5386614225d0e7a0170c4d
-
SHA1
6ae5ed07d45b6dc7abc4c6ced10cf0931ba93dc9
-
SHA256
1bd78376961d4d61802422f95430d6ae35d61de4087c24ad0b39a1590f15e81e
-
SHA512
b888cfa8b595e9a7ed7807e84850176ea406cdd5670cd766e7904349e48f63eccd84e2ea09c3a91b0e6ae434db128048c57cdca5031145839812bd2b271a2119
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7GLOVsUNx6NTjdLHtRGyn9uQuBtp7OXT/ZGnx:/U5rCOTeiDd1xEXlHHwQquhGnhNxNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1416 7EC5.tmp 4060 7F80.tmp 3860 801D.tmp 3388 8107.tmp 4468 8194.tmp 1972 828E.tmp 3704 8349.tmp 3772 8414.tmp 4268 84D0.tmp 4764 857C.tmp 1612 86F3.tmp 3404 880C.tmp 2272 8916.tmp 3928 89A2.tmp 3304 8A3E.tmp 3632 8B0A.tmp 1244 8BC5.tmp 2452 8C52.tmp 1672 8D6B.tmp 1012 8E36.tmp 1384 8EE2.tmp 3400 8F8E.tmp 676 8FFB.tmp 3236 90D6.tmp 2992 9163.tmp 4872 920E.tmp 1140 92DA.tmp 1744 9385.tmp 2168 9412.tmp 2288 94BE.tmp 4828 9599.tmp 2376 9625.tmp 3356 96D1.tmp 2144 978D.tmp 4464 9839.tmp 1128 98D5.tmp 4860 9981.tmp 4220 9A0D.tmp 864 9AAA.tmp 4836 9B27.tmp 668 9BB3.tmp 3368 9C4F.tmp 1804 9CEC.tmp 3140 9DA7.tmp 2160 9E43.tmp 208 9EE0.tmp 4008 9F4D.tmp 3476 9FDA.tmp 808 A076.tmp 3828 A0F3.tmp 3208 A180.tmp 5048 A21C.tmp 2904 A299.tmp 3484 A335.tmp 3860 A3D1.tmp 3568 A45E.tmp 4100 A4DB.tmp 3328 A568.tmp 3424 A5E5.tmp 4480 A681.tmp 2268 A70D.tmp 644 A77B.tmp 3204 A7F8.tmp 4940 A875.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4420 wrote to memory of 1416 4420 33e2c893bf5386614225d0e7a0170c4d_mafia_JC.exe 83 PID 4420 wrote to memory of 1416 4420 33e2c893bf5386614225d0e7a0170c4d_mafia_JC.exe 83 PID 4420 wrote to memory of 1416 4420 33e2c893bf5386614225d0e7a0170c4d_mafia_JC.exe 83 PID 1416 wrote to memory of 4060 1416 7EC5.tmp 84 PID 1416 wrote to memory of 4060 1416 7EC5.tmp 84 PID 1416 wrote to memory of 4060 1416 7EC5.tmp 84 PID 4060 wrote to memory of 3860 4060 7F80.tmp 85 PID 4060 wrote to memory of 3860 4060 7F80.tmp 85 PID 4060 wrote to memory of 3860 4060 7F80.tmp 85 PID 3860 wrote to memory of 3388 3860 801D.tmp 86 PID 3860 wrote to memory of 3388 3860 801D.tmp 86 PID 3860 wrote to memory of 3388 3860 801D.tmp 86 PID 3388 wrote to memory of 4468 3388 8107.tmp 87 PID 3388 wrote to memory of 4468 3388 8107.tmp 87 PID 3388 wrote to memory of 4468 3388 8107.tmp 87 PID 4468 wrote to memory of 1972 4468 8194.tmp 88 PID 4468 wrote to memory of 1972 4468 8194.tmp 88 PID 4468 wrote to memory of 1972 4468 8194.tmp 88 PID 1972 wrote to memory of 3704 1972 828E.tmp 89 PID 1972 wrote to memory of 3704 1972 828E.tmp 89 PID 1972 wrote to memory of 3704 1972 828E.tmp 89 PID 3704 wrote to memory of 3772 3704 8349.tmp 90 PID 3704 wrote to memory of 3772 3704 8349.tmp 90 PID 3704 wrote to memory of 3772 3704 8349.tmp 90 PID 3772 wrote to memory of 4268 3772 8414.tmp 91 PID 3772 wrote to memory of 4268 3772 8414.tmp 91 PID 3772 wrote to memory of 4268 3772 8414.tmp 91 PID 4268 wrote to memory of 4764 4268 84D0.tmp 92 PID 4268 wrote to memory of 4764 4268 84D0.tmp 92 PID 4268 wrote to memory of 4764 4268 84D0.tmp 92 PID 4764 wrote to memory of 1612 4764 857C.tmp 93 PID 4764 wrote to memory of 1612 4764 857C.tmp 93 PID 4764 wrote to memory of 1612 4764 857C.tmp 93 PID 1612 wrote to memory of 3404 1612 86F3.tmp 94 PID 1612 wrote to memory of 3404 1612 86F3.tmp 94 PID 1612 wrote to memory of 3404 1612 86F3.tmp 94 PID 3404 wrote to memory of 2272 3404 880C.tmp 95 PID 3404 wrote to memory of 2272 3404 880C.tmp 95 PID 3404 wrote to memory of 2272 3404 880C.tmp 95 PID 2272 wrote to memory of 3928 2272 8916.tmp 96 PID 2272 wrote to memory of 3928 2272 8916.tmp 96 PID 2272 wrote to memory of 3928 2272 8916.tmp 96 PID 3928 wrote to memory of 3304 3928 89A2.tmp 97 PID 3928 wrote to memory of 3304 3928 89A2.tmp 97 PID 3928 wrote to memory of 3304 3928 89A2.tmp 97 PID 3304 wrote to memory of 3632 3304 8A3E.tmp 100 PID 3304 wrote to memory of 3632 3304 8A3E.tmp 100 PID 3304 wrote to memory of 3632 3304 8A3E.tmp 100 PID 3632 wrote to memory of 1244 3632 8B0A.tmp 101 PID 3632 wrote to memory of 1244 3632 8B0A.tmp 101 PID 3632 wrote to memory of 1244 3632 8B0A.tmp 101 PID 1244 wrote to memory of 2452 1244 8BC5.tmp 102 PID 1244 wrote to memory of 2452 1244 8BC5.tmp 102 PID 1244 wrote to memory of 2452 1244 8BC5.tmp 102 PID 2452 wrote to memory of 1672 2452 8C52.tmp 103 PID 2452 wrote to memory of 1672 2452 8C52.tmp 103 PID 2452 wrote to memory of 1672 2452 8C52.tmp 103 PID 1672 wrote to memory of 1012 1672 8D6B.tmp 104 PID 1672 wrote to memory of 1012 1672 8D6B.tmp 104 PID 1672 wrote to memory of 1012 1672 8D6B.tmp 104 PID 1012 wrote to memory of 1384 1012 8E36.tmp 105 PID 1012 wrote to memory of 1384 1012 8E36.tmp 105 PID 1012 wrote to memory of 1384 1012 8E36.tmp 105 PID 1384 wrote to memory of 3400 1384 8EE2.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\33e2c893bf5386614225d0e7a0170c4d_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\33e2c893bf5386614225d0e7a0170c4d_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\7F80.tmp"C:\Users\Admin\AppData\Local\Temp\7F80.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\801D.tmp"C:\Users\Admin\AppData\Local\Temp\801D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\8107.tmp"C:\Users\Admin\AppData\Local\Temp\8107.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\8194.tmp"C:\Users\Admin\AppData\Local\Temp\8194.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\828E.tmp"C:\Users\Admin\AppData\Local\Temp\828E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\8349.tmp"C:\Users\Admin\AppData\Local\Temp\8349.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\8414.tmp"C:\Users\Admin\AppData\Local\Temp\8414.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\84D0.tmp"C:\Users\Admin\AppData\Local\Temp\84D0.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\857C.tmp"C:\Users\Admin\AppData\Local\Temp\857C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\86F3.tmp"C:\Users\Admin\AppData\Local\Temp\86F3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\880C.tmp"C:\Users\Admin\AppData\Local\Temp\880C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\8916.tmp"C:\Users\Admin\AppData\Local\Temp\8916.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\89A2.tmp"C:\Users\Admin\AppData\Local\Temp\89A2.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"23⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"24⤵
- Executes dropped EXE
PID:676 -
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"25⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\9163.tmp"C:\Users\Admin\AppData\Local\Temp\9163.tmp"26⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"27⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\92DA.tmp"C:\Users\Admin\AppData\Local\Temp\92DA.tmp"28⤵
- Executes dropped EXE
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\9385.tmp"C:\Users\Admin\AppData\Local\Temp\9385.tmp"29⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\9412.tmp"C:\Users\Admin\AppData\Local\Temp\9412.tmp"30⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\94BE.tmp"C:\Users\Admin\AppData\Local\Temp\94BE.tmp"31⤵
- Executes dropped EXE
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\9599.tmp"C:\Users\Admin\AppData\Local\Temp\9599.tmp"32⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\9625.tmp"C:\Users\Admin\AppData\Local\Temp\9625.tmp"33⤵
- Executes dropped EXE
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\96D1.tmp"C:\Users\Admin\AppData\Local\Temp\96D1.tmp"34⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\978D.tmp"C:\Users\Admin\AppData\Local\Temp\978D.tmp"35⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\9839.tmp"C:\Users\Admin\AppData\Local\Temp\9839.tmp"36⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\98D5.tmp"C:\Users\Admin\AppData\Local\Temp\98D5.tmp"37⤵
- Executes dropped EXE
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"38⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"39⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"40⤵
- Executes dropped EXE
PID:864 -
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"41⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"42⤵
- Executes dropped EXE
PID:668 -
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"43⤵
- Executes dropped EXE
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"44⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"45⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"46⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"47⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"48⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"49⤵
- Executes dropped EXE
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\A076.tmp"C:\Users\Admin\AppData\Local\Temp\A076.tmp"50⤵
- Executes dropped EXE
PID:808 -
C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"51⤵
- Executes dropped EXE
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\A180.tmp"C:\Users\Admin\AppData\Local\Temp\A180.tmp"52⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\A21C.tmp"C:\Users\Admin\AppData\Local\Temp\A21C.tmp"53⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\A299.tmp"C:\Users\Admin\AppData\Local\Temp\A299.tmp"54⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"55⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"56⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"57⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"58⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"59⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"60⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"61⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"62⤵
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"63⤵
- Executes dropped EXE
PID:644 -
C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"64⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"65⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"66⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\A940.tmp"C:\Users\Admin\AppData\Local\Temp\A940.tmp"67⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"68⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"69⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"70⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"71⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"72⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"73⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"74⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\AD38.tmp"C:\Users\Admin\AppData\Local\Temp\AD38.tmp"75⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"76⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\AE51.tmp"C:\Users\Admin\AppData\Local\Temp\AE51.tmp"77⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"78⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"79⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"80⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"81⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\B14E.tmp"C:\Users\Admin\AppData\Local\Temp\B14E.tmp"82⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"83⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"84⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\B323.tmp"C:\Users\Admin\AppData\Local\Temp\B323.tmp"85⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"86⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\B43C.tmp"C:\Users\Admin\AppData\Local\Temp\B43C.tmp"87⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\B49A.tmp"C:\Users\Admin\AppData\Local\Temp\B49A.tmp"88⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\B527.tmp"C:\Users\Admin\AppData\Local\Temp\B527.tmp"89⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"90⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\B621.tmp"C:\Users\Admin\AppData\Local\Temp\B621.tmp"91⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"92⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\B73A.tmp"C:\Users\Admin\AppData\Local\Temp\B73A.tmp"93⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"94⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\B824.tmp"C:\Users\Admin\AppData\Local\Temp\B824.tmp"95⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"96⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\B90F.tmp"C:\Users\Admin\AppData\Local\Temp\B90F.tmp"97⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"98⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\BA76.tmp"C:\Users\Admin\AppData\Local\Temp\BA76.tmp"99⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\BB41.tmp"C:\Users\Admin\AppData\Local\Temp\BB41.tmp"100⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"101⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"102⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"103⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\BD74.tmp"C:\Users\Admin\AppData\Local\Temp\BD74.tmp"104⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"105⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"106⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"107⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"108⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\C10E.tmp"C:\Users\Admin\AppData\Local\Temp\C10E.tmp"109⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\C17B.tmp"C:\Users\Admin\AppData\Local\Temp\C17B.tmp"110⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"111⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\C256.tmp"C:\Users\Admin\AppData\Local\Temp\C256.tmp"112⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"113⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\C38E.tmp"C:\Users\Admin\AppData\Local\Temp\C38E.tmp"114⤵PID:32
-
C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"115⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\C488.tmp"C:\Users\Admin\AppData\Local\Temp\C488.tmp"116⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\C525.tmp"C:\Users\Admin\AppData\Local\Temp\C525.tmp"117⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"118⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\C61F.tmp"C:\Users\Admin\AppData\Local\Temp\C61F.tmp"119⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"120⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\C757.tmp"C:\Users\Admin\AppData\Local\Temp\C757.tmp"121⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"122⤵PID:3704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-