Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2023, 16:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
36ceb3220117d996869cae460c84c194_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
36ceb3220117d996869cae460c84c194_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
36ceb3220117d996869cae460c84c194_mafia_JC.exe
-
Size
520KB
-
MD5
36ceb3220117d996869cae460c84c194
-
SHA1
a250b524c10bb7e6c901feafc5b316dc1d28c4a1
-
SHA256
9d8aa12b8d66f84bfcb8a1f2532b520935ede969029d804cb14f28d5bd2ef795
-
SHA512
c10ca6971ef1665513abf356c2d20406eb36e2659712f95ee62bd1b858f1a1cb70d50d17914228e53dc90cbd44e6ad4825e6b88bb57d136c5fce91e1a80a5ac3
-
SSDEEP
12288:gj8fuxR21t5i8fhqetZP/Ko2rrI+oKjJNZ:gj8fuK1GY8etItI+zJN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1956 E9E3.tmp 1028 EB89.tmp 2172 EC15.tmp 2364 ED1F.tmp 3504 EDCB.tmp 4816 EEC5.tmp 2632 EF90.tmp 228 F05B.tmp 2296 F627.tmp 3256 F6F3.tmp 3972 F7FC.tmp 3156 F8F6.tmp 3836 F9F0.tmp 2400 FACB.tmp 4776 FB77.tmp 2520 FC32.tmp 4728 FCDE.tmp 4912 FD6B.tmp 3824 FE46.tmp 1980 FF40.tmp 1424 FFDC.tmp 4464 C6.tmp 5012 1A1.tmp 5104 26C.tmp 320 356.tmp 4560 3F3.tmp 3496 4DD.tmp 1348 599.tmp 5064 625.tmp 1908 6E1.tmp 2060 78D.tmp 4952 829.tmp 3984 923.tmp 1168 9A0.tmp 1520 A2C.tmp 2824 AB9.tmp 3088 B36.tmp 4700 BB3.tmp 2244 C40.tmp 2232 CBD.tmp 3632 D3A.tmp 2024 DC6.tmp 740 E43.tmp 4496 EC0.tmp 2812 F3D.tmp 1548 FCA.tmp 4416 1037.tmp 3828 10C4.tmp 576 1160.tmp 3296 11FC.tmp 216 1299.tmp 2740 1325.tmp 5024 13C2.tmp 3904 14BC.tmp 2728 1548.tmp 1956 15D5.tmp 1448 1661.tmp 1388 16EE.tmp 1200 175B.tmp 2464 17C9.tmp 4460 1875.tmp 2064 1911.tmp 3316 199E.tmp 2408 1A1B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4036 wrote to memory of 1956 4036 36ceb3220117d996869cae460c84c194_mafia_JC.exe 81 PID 4036 wrote to memory of 1956 4036 36ceb3220117d996869cae460c84c194_mafia_JC.exe 81 PID 4036 wrote to memory of 1956 4036 36ceb3220117d996869cae460c84c194_mafia_JC.exe 81 PID 1956 wrote to memory of 1028 1956 E9E3.tmp 82 PID 1956 wrote to memory of 1028 1956 E9E3.tmp 82 PID 1956 wrote to memory of 1028 1956 E9E3.tmp 82 PID 1028 wrote to memory of 2172 1028 EB89.tmp 83 PID 1028 wrote to memory of 2172 1028 EB89.tmp 83 PID 1028 wrote to memory of 2172 1028 EB89.tmp 83 PID 2172 wrote to memory of 2364 2172 EC15.tmp 84 PID 2172 wrote to memory of 2364 2172 EC15.tmp 84 PID 2172 wrote to memory of 2364 2172 EC15.tmp 84 PID 2364 wrote to memory of 3504 2364 ED1F.tmp 85 PID 2364 wrote to memory of 3504 2364 ED1F.tmp 85 PID 2364 wrote to memory of 3504 2364 ED1F.tmp 85 PID 3504 wrote to memory of 4816 3504 EDCB.tmp 86 PID 3504 wrote to memory of 4816 3504 EDCB.tmp 86 PID 3504 wrote to memory of 4816 3504 EDCB.tmp 86 PID 4816 wrote to memory of 2632 4816 EEC5.tmp 87 PID 4816 wrote to memory of 2632 4816 EEC5.tmp 87 PID 4816 wrote to memory of 2632 4816 EEC5.tmp 87 PID 2632 wrote to memory of 228 2632 EF90.tmp 88 PID 2632 wrote to memory of 228 2632 EF90.tmp 88 PID 2632 wrote to memory of 228 2632 EF90.tmp 88 PID 228 wrote to memory of 2296 228 F05B.tmp 89 PID 228 wrote to memory of 2296 228 F05B.tmp 89 PID 228 wrote to memory of 2296 228 F05B.tmp 89 PID 2296 wrote to memory of 3256 2296 F627.tmp 90 PID 2296 wrote to memory of 3256 2296 F627.tmp 90 PID 2296 wrote to memory of 3256 2296 F627.tmp 90 PID 3256 wrote to memory of 3972 3256 F6F3.tmp 91 PID 3256 wrote to memory of 3972 3256 F6F3.tmp 91 PID 3256 wrote to memory of 3972 3256 F6F3.tmp 91 PID 3972 wrote to memory of 3156 3972 F7FC.tmp 92 PID 3972 wrote to memory of 3156 3972 F7FC.tmp 92 PID 3972 wrote to memory of 3156 3972 F7FC.tmp 92 PID 3156 wrote to memory of 3836 3156 F8F6.tmp 93 PID 3156 wrote to memory of 3836 3156 F8F6.tmp 93 PID 3156 wrote to memory of 3836 3156 F8F6.tmp 93 PID 3836 wrote to memory of 2400 3836 F9F0.tmp 94 PID 3836 wrote to memory of 2400 3836 F9F0.tmp 94 PID 3836 wrote to memory of 2400 3836 F9F0.tmp 94 PID 2400 wrote to memory of 4776 2400 FACB.tmp 95 PID 2400 wrote to memory of 4776 2400 FACB.tmp 95 PID 2400 wrote to memory of 4776 2400 FACB.tmp 95 PID 4776 wrote to memory of 2520 4776 FB77.tmp 96 PID 4776 wrote to memory of 2520 4776 FB77.tmp 96 PID 4776 wrote to memory of 2520 4776 FB77.tmp 96 PID 2520 wrote to memory of 4728 2520 FC32.tmp 97 PID 2520 wrote to memory of 4728 2520 FC32.tmp 97 PID 2520 wrote to memory of 4728 2520 FC32.tmp 97 PID 4728 wrote to memory of 4912 4728 FCDE.tmp 98 PID 4728 wrote to memory of 4912 4728 FCDE.tmp 98 PID 4728 wrote to memory of 4912 4728 FCDE.tmp 98 PID 4912 wrote to memory of 3824 4912 FD6B.tmp 99 PID 4912 wrote to memory of 3824 4912 FD6B.tmp 99 PID 4912 wrote to memory of 3824 4912 FD6B.tmp 99 PID 3824 wrote to memory of 1980 3824 FE46.tmp 101 PID 3824 wrote to memory of 1980 3824 FE46.tmp 101 PID 3824 wrote to memory of 1980 3824 FE46.tmp 101 PID 1980 wrote to memory of 1424 1980 FF40.tmp 102 PID 1980 wrote to memory of 1424 1980 FF40.tmp 102 PID 1980 wrote to memory of 1424 1980 FF40.tmp 102 PID 1424 wrote to memory of 4464 1424 FFDC.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\36ceb3220117d996869cae460c84c194_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\36ceb3220117d996869cae460c84c194_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\E9E3.tmp"C:\Users\Admin\AppData\Local\Temp\E9E3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\EB89.tmp"C:\Users\Admin\AppData\Local\Temp\EB89.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\EC15.tmp"C:\Users\Admin\AppData\Local\Temp\EC15.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\EDCB.tmp"C:\Users\Admin\AppData\Local\Temp\EDCB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\EEC5.tmp"C:\Users\Admin\AppData\Local\Temp\EEC5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\EF90.tmp"C:\Users\Admin\AppData\Local\Temp\EF90.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\F05B.tmp"C:\Users\Admin\AppData\Local\Temp\F05B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\F627.tmp"C:\Users\Admin\AppData\Local\Temp\F627.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\F7FC.tmp"C:\Users\Admin\AppData\Local\Temp\F7FC.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\F8F6.tmp"C:\Users\Admin\AppData\Local\Temp\F8F6.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\F9F0.tmp"C:\Users\Admin\AppData\Local\Temp\F9F0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\FACB.tmp"C:\Users\Admin\AppData\Local\Temp\FACB.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\FB77.tmp"C:\Users\Admin\AppData\Local\Temp\FB77.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\FC32.tmp"C:\Users\Admin\AppData\Local\Temp\FC32.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\FCDE.tmp"C:\Users\Admin\AppData\Local\Temp\FCDE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\FD6B.tmp"C:\Users\Admin\AppData\Local\Temp\FD6B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\FE46.tmp"C:\Users\Admin\AppData\Local\Temp\FE46.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\FF40.tmp"C:\Users\Admin\AppData\Local\Temp\FF40.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\C6.tmp"C:\Users\Admin\AppData\Local\Temp\C6.tmp"23⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\1A1.tmp"C:\Users\Admin\AppData\Local\Temp\1A1.tmp"24⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\26C.tmp"C:\Users\Admin\AppData\Local\Temp\26C.tmp"25⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\356.tmp"C:\Users\Admin\AppData\Local\Temp\356.tmp"26⤵
- Executes dropped EXE
PID:320 -
C:\Users\Admin\AppData\Local\Temp\3F3.tmp"C:\Users\Admin\AppData\Local\Temp\3F3.tmp"27⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\4DD.tmp"C:\Users\Admin\AppData\Local\Temp\4DD.tmp"28⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\599.tmp"C:\Users\Admin\AppData\Local\Temp\599.tmp"29⤵
- Executes dropped EXE
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\625.tmp"C:\Users\Admin\AppData\Local\Temp\625.tmp"30⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\6E1.tmp"C:\Users\Admin\AppData\Local\Temp\6E1.tmp"31⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\78D.tmp"C:\Users\Admin\AppData\Local\Temp\78D.tmp"32⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\829.tmp"C:\Users\Admin\AppData\Local\Temp\829.tmp"33⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\923.tmp"C:\Users\Admin\AppData\Local\Temp\923.tmp"34⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\9A0.tmp"C:\Users\Admin\AppData\Local\Temp\9A0.tmp"35⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\A2C.tmp"C:\Users\Admin\AppData\Local\Temp\A2C.tmp"36⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\AB9.tmp"C:\Users\Admin\AppData\Local\Temp\AB9.tmp"37⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\B36.tmp"C:\Users\Admin\AppData\Local\Temp\B36.tmp"38⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\BB3.tmp"C:\Users\Admin\AppData\Local\Temp\BB3.tmp"39⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\C40.tmp"C:\Users\Admin\AppData\Local\Temp\C40.tmp"40⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\CBD.tmp"C:\Users\Admin\AppData\Local\Temp\CBD.tmp"41⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\D3A.tmp"C:\Users\Admin\AppData\Local\Temp\D3A.tmp"42⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\DC6.tmp"C:\Users\Admin\AppData\Local\Temp\DC6.tmp"43⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\E43.tmp"C:\Users\Admin\AppData\Local\Temp\E43.tmp"44⤵
- Executes dropped EXE
PID:740 -
C:\Users\Admin\AppData\Local\Temp\EC0.tmp"C:\Users\Admin\AppData\Local\Temp\EC0.tmp"45⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\F3D.tmp"C:\Users\Admin\AppData\Local\Temp\F3D.tmp"46⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\FCA.tmp"C:\Users\Admin\AppData\Local\Temp\FCA.tmp"47⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\1037.tmp"C:\Users\Admin\AppData\Local\Temp\1037.tmp"48⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\10C4.tmp"C:\Users\Admin\AppData\Local\Temp\10C4.tmp"49⤵
- Executes dropped EXE
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\1160.tmp"C:\Users\Admin\AppData\Local\Temp\1160.tmp"50⤵
- Executes dropped EXE
PID:576 -
C:\Users\Admin\AppData\Local\Temp\11FC.tmp"C:\Users\Admin\AppData\Local\Temp\11FC.tmp"51⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\1299.tmp"C:\Users\Admin\AppData\Local\Temp\1299.tmp"52⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\1325.tmp"C:\Users\Admin\AppData\Local\Temp\1325.tmp"53⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\13C2.tmp"C:\Users\Admin\AppData\Local\Temp\13C2.tmp"54⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\143F.tmp"C:\Users\Admin\AppData\Local\Temp\143F.tmp"55⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\14BC.tmp"C:\Users\Admin\AppData\Local\Temp\14BC.tmp"56⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\1548.tmp"C:\Users\Admin\AppData\Local\Temp\1548.tmp"57⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\15D5.tmp"C:\Users\Admin\AppData\Local\Temp\15D5.tmp"58⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\1661.tmp"C:\Users\Admin\AppData\Local\Temp\1661.tmp"59⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\16EE.tmp"C:\Users\Admin\AppData\Local\Temp\16EE.tmp"60⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\175B.tmp"C:\Users\Admin\AppData\Local\Temp\175B.tmp"61⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\17C9.tmp"C:\Users\Admin\AppData\Local\Temp\17C9.tmp"62⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\1875.tmp"C:\Users\Admin\AppData\Local\Temp\1875.tmp"63⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\1911.tmp"C:\Users\Admin\AppData\Local\Temp\1911.tmp"64⤵
- Executes dropped EXE
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\199E.tmp"C:\Users\Admin\AppData\Local\Temp\199E.tmp"65⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"66⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\1A98.tmp"C:\Users\Admin\AppData\Local\Temp\1A98.tmp"67⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\1B43.tmp"C:\Users\Admin\AppData\Local\Temp\1B43.tmp"68⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"69⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"70⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\1D09.tmp"C:\Users\Admin\AppData\Local\Temp\1D09.tmp"71⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\1D95.tmp"C:\Users\Admin\AppData\Local\Temp\1D95.tmp"72⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\1E12.tmp"C:\Users\Admin\AppData\Local\Temp\1E12.tmp"73⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"74⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\1F3B.tmp"C:\Users\Admin\AppData\Local\Temp\1F3B.tmp"75⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\1FB8.tmp"C:\Users\Admin\AppData\Local\Temp\1FB8.tmp"76⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\2054.tmp"C:\Users\Admin\AppData\Local\Temp\2054.tmp"77⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\2100.tmp"C:\Users\Admin\AppData\Local\Temp\2100.tmp"78⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\217D.tmp"C:\Users\Admin\AppData\Local\Temp\217D.tmp"79⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\220A.tmp"C:\Users\Admin\AppData\Local\Temp\220A.tmp"80⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\2287.tmp"C:\Users\Admin\AppData\Local\Temp\2287.tmp"81⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\2342.tmp"C:\Users\Admin\AppData\Local\Temp\2342.tmp"82⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\23CF.tmp"C:\Users\Admin\AppData\Local\Temp\23CF.tmp"83⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\244C.tmp"C:\Users\Admin\AppData\Local\Temp\244C.tmp"84⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\24B9.tmp"C:\Users\Admin\AppData\Local\Temp\24B9.tmp"85⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\2546.tmp"C:\Users\Admin\AppData\Local\Temp\2546.tmp"86⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\25C3.tmp"C:\Users\Admin\AppData\Local\Temp\25C3.tmp"87⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\2640.tmp"C:\Users\Admin\AppData\Local\Temp\2640.tmp"88⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\26BD.tmp"C:\Users\Admin\AppData\Local\Temp\26BD.tmp"89⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\273A.tmp"C:\Users\Admin\AppData\Local\Temp\273A.tmp"90⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\27B7.tmp"C:\Users\Admin\AppData\Local\Temp\27B7.tmp"91⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\2824.tmp"C:\Users\Admin\AppData\Local\Temp\2824.tmp"92⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\28A1.tmp"C:\Users\Admin\AppData\Local\Temp\28A1.tmp"93⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\292E.tmp"C:\Users\Admin\AppData\Local\Temp\292E.tmp"94⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\299B.tmp"C:\Users\Admin\AppData\Local\Temp\299B.tmp"95⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\2A47.tmp"C:\Users\Admin\AppData\Local\Temp\2A47.tmp"96⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\2AA5.tmp"C:\Users\Admin\AppData\Local\Temp\2AA5.tmp"97⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\2B22.tmp"C:\Users\Admin\AppData\Local\Temp\2B22.tmp"98⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\2BBE.tmp"C:\Users\Admin\AppData\Local\Temp\2BBE.tmp"99⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\2C2C.tmp"C:\Users\Admin\AppData\Local\Temp\2C2C.tmp"100⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\2CA9.tmp"C:\Users\Admin\AppData\Local\Temp\2CA9.tmp"101⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\2D35.tmp"C:\Users\Admin\AppData\Local\Temp\2D35.tmp"102⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\2E00.tmp"C:\Users\Admin\AppData\Local\Temp\2E00.tmp"103⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\2E7D.tmp"C:\Users\Admin\AppData\Local\Temp\2E7D.tmp"104⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\2F1A.tmp"C:\Users\Admin\AppData\Local\Temp\2F1A.tmp"105⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\2F97.tmp"C:\Users\Admin\AppData\Local\Temp\2F97.tmp"106⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\3004.tmp"C:\Users\Admin\AppData\Local\Temp\3004.tmp"107⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\3081.tmp"C:\Users\Admin\AppData\Local\Temp\3081.tmp"108⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\318B.tmp"C:\Users\Admin\AppData\Local\Temp\318B.tmp"109⤵PID:504
-
C:\Users\Admin\AppData\Local\Temp\3236.tmp"C:\Users\Admin\AppData\Local\Temp\3236.tmp"110⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\32F2.tmp"C:\Users\Admin\AppData\Local\Temp\32F2.tmp"111⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\336F.tmp"C:\Users\Admin\AppData\Local\Temp\336F.tmp"112⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"113⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"114⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\3515.tmp"C:\Users\Admin\AppData\Local\Temp\3515.tmp"115⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\35B1.tmp"C:\Users\Admin\AppData\Local\Temp\35B1.tmp"116⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\366D.tmp"C:\Users\Admin\AppData\Local\Temp\366D.tmp"117⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\3728.tmp"C:\Users\Admin\AppData\Local\Temp\3728.tmp"118⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\37E4.tmp"C:\Users\Admin\AppData\Local\Temp\37E4.tmp"119⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\3861.tmp"C:\Users\Admin\AppData\Local\Temp\3861.tmp"120⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\38CE.tmp"C:\Users\Admin\AppData\Local\Temp\38CE.tmp"121⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\396A.tmp"C:\Users\Admin\AppData\Local\Temp\396A.tmp"122⤵PID:4460
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-