Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
04/09/2023, 15:57
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-23_527f4bb6111a3bdaa9808bf9c1c477a1_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-23_527f4bb6111a3bdaa9808bf9c1c477a1_mafia_JC.exe
Resource
win10v2004-20230831-en
General
-
Target
2023-08-23_527f4bb6111a3bdaa9808bf9c1c477a1_mafia_JC.exe
-
Size
520KB
-
MD5
527f4bb6111a3bdaa9808bf9c1c477a1
-
SHA1
bccc7720ec57be01e278f7fbd3789759c0cf8f60
-
SHA256
18736be80632cc8ef40c9a8e73548c0bd00065afdaa9cde32cc2a8ce9b80c731
-
SHA512
079178c60816f83ba8f16643e7c2609499b0fdd7b41db22c78056ec74cfe1e19f0cc2f141f5897e1049ab4d3d55cc4413443fa544d83b8613b2f5b25d83cda22
-
SSDEEP
12288:gj8fuxR21t5i8fKPcCel0JsaCwNbGwE1mFAvheZzNZ:gj8fuK1GYKkCe2qa/Ne1mFAJepN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 928 FC03.tmp 1636 48F.tmp 3444 635.tmp 4256 710.tmp 3692 80A.tmp 2508 8C5.tmp 2764 981.tmp 1520 A9A.tmp 4372 B75.tmp 4936 C5F.tmp 2684 D49.tmp 8 E63.tmp 4528 F3D.tmp 4788 1028.tmp 4576 1102.tmp 4000 11CE.tmp 4104 1299.tmp 2780 1383.tmp 2280 142F.tmp 4004 150A.tmp 4696 15E4.tmp 4976 1681.tmp 3512 171D.tmp 436 1807.tmp 824 1894.tmp 3268 194F.tmp 4636 1A1B.tmp 1300 1AE6.tmp 2704 1BB1.tmp 3008 1CAB.tmp 4736 1DA5.tmp 3312 1E51.tmp 4356 1F2B.tmp 3356 1FC8.tmp 3376 2074.tmp 4444 2100.tmp 4468 218D.tmp 4852 2229.tmp 3980 22B6.tmp 3804 2342.tmp 4668 23CF.tmp 3236 244C.tmp 316 24B9.tmp 4076 2565.tmp 1108 2621.tmp 4680 269E.tmp 3720 272A.tmp 1260 2798.tmp 4320 2815.tmp 1636 28C1.tmp 4964 295D.tmp 3384 29F9.tmp 4256 2A76.tmp 1544 2B22.tmp 2408 2BBE.tmp 1868 2C4B.tmp 2880 2CB8.tmp 1540 2D26.tmp 4232 2DB2.tmp 2492 2E3F.tmp 5112 2F0A.tmp 4100 2FA6.tmp 976 3023.tmp 1916 30A0.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1772 wrote to memory of 928 1772 2023-08-23_527f4bb6111a3bdaa9808bf9c1c477a1_mafia_JC.exe 85 PID 1772 wrote to memory of 928 1772 2023-08-23_527f4bb6111a3bdaa9808bf9c1c477a1_mafia_JC.exe 85 PID 1772 wrote to memory of 928 1772 2023-08-23_527f4bb6111a3bdaa9808bf9c1c477a1_mafia_JC.exe 85 PID 928 wrote to memory of 1636 928 FC03.tmp 87 PID 928 wrote to memory of 1636 928 FC03.tmp 87 PID 928 wrote to memory of 1636 928 FC03.tmp 87 PID 1636 wrote to memory of 3444 1636 48F.tmp 88 PID 1636 wrote to memory of 3444 1636 48F.tmp 88 PID 1636 wrote to memory of 3444 1636 48F.tmp 88 PID 3444 wrote to memory of 4256 3444 635.tmp 89 PID 3444 wrote to memory of 4256 3444 635.tmp 89 PID 3444 wrote to memory of 4256 3444 635.tmp 89 PID 4256 wrote to memory of 3692 4256 710.tmp 91 PID 4256 wrote to memory of 3692 4256 710.tmp 91 PID 4256 wrote to memory of 3692 4256 710.tmp 91 PID 3692 wrote to memory of 2508 3692 80A.tmp 92 PID 3692 wrote to memory of 2508 3692 80A.tmp 92 PID 3692 wrote to memory of 2508 3692 80A.tmp 92 PID 2508 wrote to memory of 2764 2508 8C5.tmp 93 PID 2508 wrote to memory of 2764 2508 8C5.tmp 93 PID 2508 wrote to memory of 2764 2508 8C5.tmp 93 PID 2764 wrote to memory of 1520 2764 981.tmp 94 PID 2764 wrote to memory of 1520 2764 981.tmp 94 PID 2764 wrote to memory of 1520 2764 981.tmp 94 PID 1520 wrote to memory of 4372 1520 A9A.tmp 95 PID 1520 wrote to memory of 4372 1520 A9A.tmp 95 PID 1520 wrote to memory of 4372 1520 A9A.tmp 95 PID 4372 wrote to memory of 4936 4372 B75.tmp 96 PID 4372 wrote to memory of 4936 4372 B75.tmp 96 PID 4372 wrote to memory of 4936 4372 B75.tmp 96 PID 4936 wrote to memory of 2684 4936 C5F.tmp 97 PID 4936 wrote to memory of 2684 4936 C5F.tmp 97 PID 4936 wrote to memory of 2684 4936 C5F.tmp 97 PID 2684 wrote to memory of 8 2684 D49.tmp 98 PID 2684 wrote to memory of 8 2684 D49.tmp 98 PID 2684 wrote to memory of 8 2684 D49.tmp 98 PID 8 wrote to memory of 4528 8 E63.tmp 99 PID 8 wrote to memory of 4528 8 E63.tmp 99 PID 8 wrote to memory of 4528 8 E63.tmp 99 PID 4528 wrote to memory of 4788 4528 F3D.tmp 100 PID 4528 wrote to memory of 4788 4528 F3D.tmp 100 PID 4528 wrote to memory of 4788 4528 F3D.tmp 100 PID 4788 wrote to memory of 4576 4788 1028.tmp 101 PID 4788 wrote to memory of 4576 4788 1028.tmp 101 PID 4788 wrote to memory of 4576 4788 1028.tmp 101 PID 4576 wrote to memory of 4000 4576 1102.tmp 102 PID 4576 wrote to memory of 4000 4576 1102.tmp 102 PID 4576 wrote to memory of 4000 4576 1102.tmp 102 PID 4000 wrote to memory of 4104 4000 11CE.tmp 103 PID 4000 wrote to memory of 4104 4000 11CE.tmp 103 PID 4000 wrote to memory of 4104 4000 11CE.tmp 103 PID 4104 wrote to memory of 2780 4104 1299.tmp 104 PID 4104 wrote to memory of 2780 4104 1299.tmp 104 PID 4104 wrote to memory of 2780 4104 1299.tmp 104 PID 2780 wrote to memory of 2280 2780 1383.tmp 105 PID 2780 wrote to memory of 2280 2780 1383.tmp 105 PID 2780 wrote to memory of 2280 2780 1383.tmp 105 PID 2280 wrote to memory of 4004 2280 142F.tmp 106 PID 2280 wrote to memory of 4004 2280 142F.tmp 106 PID 2280 wrote to memory of 4004 2280 142F.tmp 106 PID 4004 wrote to memory of 4696 4004 150A.tmp 107 PID 4004 wrote to memory of 4696 4004 150A.tmp 107 PID 4004 wrote to memory of 4696 4004 150A.tmp 107 PID 4696 wrote to memory of 4976 4696 15E4.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-23_527f4bb6111a3bdaa9808bf9c1c477a1_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-23_527f4bb6111a3bdaa9808bf9c1c477a1_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\FC03.tmp"C:\Users\Admin\AppData\Local\Temp\FC03.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Users\Admin\AppData\Local\Temp\48F.tmp"C:\Users\Admin\AppData\Local\Temp\48F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\635.tmp"C:\Users\Admin\AppData\Local\Temp\635.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\710.tmp"C:\Users\Admin\AppData\Local\Temp\710.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\80A.tmp"C:\Users\Admin\AppData\Local\Temp\80A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\8C5.tmp"C:\Users\Admin\AppData\Local\Temp\8C5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\981.tmp"C:\Users\Admin\AppData\Local\Temp\981.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\A9A.tmp"C:\Users\Admin\AppData\Local\Temp\A9A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\B75.tmp"C:\Users\Admin\AppData\Local\Temp\B75.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\C5F.tmp"C:\Users\Admin\AppData\Local\Temp\C5F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\D49.tmp"C:\Users\Admin\AppData\Local\Temp\D49.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\E63.tmp"C:\Users\Admin\AppData\Local\Temp\E63.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\F3D.tmp"C:\Users\Admin\AppData\Local\Temp\F3D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\1028.tmp"C:\Users\Admin\AppData\Local\Temp\1028.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\1102.tmp"C:\Users\Admin\AppData\Local\Temp\1102.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\11CE.tmp"C:\Users\Admin\AppData\Local\Temp\11CE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\1299.tmp"C:\Users\Admin\AppData\Local\Temp\1299.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\1383.tmp"C:\Users\Admin\AppData\Local\Temp\1383.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\142F.tmp"C:\Users\Admin\AppData\Local\Temp\142F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\150A.tmp"C:\Users\Admin\AppData\Local\Temp\150A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\15E4.tmp"C:\Users\Admin\AppData\Local\Temp\15E4.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\1681.tmp"C:\Users\Admin\AppData\Local\Temp\1681.tmp"23⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\171D.tmp"C:\Users\Admin\AppData\Local\Temp\171D.tmp"24⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\1807.tmp"C:\Users\Admin\AppData\Local\Temp\1807.tmp"25⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\1894.tmp"C:\Users\Admin\AppData\Local\Temp\1894.tmp"26⤵
- Executes dropped EXE
PID:824 -
C:\Users\Admin\AppData\Local\Temp\194F.tmp"C:\Users\Admin\AppData\Local\Temp\194F.tmp"27⤵
- Executes dropped EXE
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"28⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\1AE6.tmp"C:\Users\Admin\AppData\Local\Temp\1AE6.tmp"29⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"30⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"31⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\1DA5.tmp"C:\Users\Admin\AppData\Local\Temp\1DA5.tmp"32⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\1E51.tmp"C:\Users\Admin\AppData\Local\Temp\1E51.tmp"33⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\1F2B.tmp"C:\Users\Admin\AppData\Local\Temp\1F2B.tmp"34⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\1FC8.tmp"C:\Users\Admin\AppData\Local\Temp\1FC8.tmp"35⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\2074.tmp"C:\Users\Admin\AppData\Local\Temp\2074.tmp"36⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\2100.tmp"C:\Users\Admin\AppData\Local\Temp\2100.tmp"37⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\218D.tmp"C:\Users\Admin\AppData\Local\Temp\218D.tmp"38⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\2229.tmp"C:\Users\Admin\AppData\Local\Temp\2229.tmp"39⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\22B6.tmp"C:\Users\Admin\AppData\Local\Temp\22B6.tmp"40⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\2342.tmp"C:\Users\Admin\AppData\Local\Temp\2342.tmp"41⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\23CF.tmp"C:\Users\Admin\AppData\Local\Temp\23CF.tmp"42⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\244C.tmp"C:\Users\Admin\AppData\Local\Temp\244C.tmp"43⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\24B9.tmp"C:\Users\Admin\AppData\Local\Temp\24B9.tmp"44⤵
- Executes dropped EXE
PID:316 -
C:\Users\Admin\AppData\Local\Temp\2565.tmp"C:\Users\Admin\AppData\Local\Temp\2565.tmp"45⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\25C3.tmp"C:\Users\Admin\AppData\Local\Temp\25C3.tmp"46⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\2621.tmp"C:\Users\Admin\AppData\Local\Temp\2621.tmp"47⤵
- Executes dropped EXE
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\269E.tmp"C:\Users\Admin\AppData\Local\Temp\269E.tmp"48⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\272A.tmp"C:\Users\Admin\AppData\Local\Temp\272A.tmp"49⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\2798.tmp"C:\Users\Admin\AppData\Local\Temp\2798.tmp"50⤵
- Executes dropped EXE
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\2815.tmp"C:\Users\Admin\AppData\Local\Temp\2815.tmp"51⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\28C1.tmp"C:\Users\Admin\AppData\Local\Temp\28C1.tmp"52⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\295D.tmp"C:\Users\Admin\AppData\Local\Temp\295D.tmp"53⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\29F9.tmp"C:\Users\Admin\AppData\Local\Temp\29F9.tmp"54⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\2A76.tmp"C:\Users\Admin\AppData\Local\Temp\2A76.tmp"55⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\2B22.tmp"C:\Users\Admin\AppData\Local\Temp\2B22.tmp"56⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\2BBE.tmp"C:\Users\Admin\AppData\Local\Temp\2BBE.tmp"57⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"58⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\2CB8.tmp"C:\Users\Admin\AppData\Local\Temp\2CB8.tmp"59⤵
- Executes dropped EXE
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\2D26.tmp"C:\Users\Admin\AppData\Local\Temp\2D26.tmp"60⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\2DB2.tmp"C:\Users\Admin\AppData\Local\Temp\2DB2.tmp"61⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\2E3F.tmp"C:\Users\Admin\AppData\Local\Temp\2E3F.tmp"62⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\2F0A.tmp"C:\Users\Admin\AppData\Local\Temp\2F0A.tmp"63⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"64⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\3023.tmp"C:\Users\Admin\AppData\Local\Temp\3023.tmp"65⤵
- Executes dropped EXE
PID:976 -
C:\Users\Admin\AppData\Local\Temp\30A0.tmp"C:\Users\Admin\AppData\Local\Temp\30A0.tmp"66⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\313C.tmp"C:\Users\Admin\AppData\Local\Temp\313C.tmp"67⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\31AA.tmp"C:\Users\Admin\AppData\Local\Temp\31AA.tmp"68⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\3294.tmp"C:\Users\Admin\AppData\Local\Temp\3294.tmp"69⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"70⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\33AD.tmp"C:\Users\Admin\AppData\Local\Temp\33AD.tmp"71⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\342A.tmp"C:\Users\Admin\AppData\Local\Temp\342A.tmp"72⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\3498.tmp"C:\Users\Admin\AppData\Local\Temp\3498.tmp"73⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"74⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\35A1.tmp"C:\Users\Admin\AppData\Local\Temp\35A1.tmp"75⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\363E.tmp"C:\Users\Admin\AppData\Local\Temp\363E.tmp"76⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\36CA.tmp"C:\Users\Admin\AppData\Local\Temp\36CA.tmp"77⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\3757.tmp"C:\Users\Admin\AppData\Local\Temp\3757.tmp"78⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\37C4.tmp"C:\Users\Admin\AppData\Local\Temp\37C4.tmp"79⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\3851.tmp"C:\Users\Admin\AppData\Local\Temp\3851.tmp"80⤵PID:496
-
C:\Users\Admin\AppData\Local\Temp\38CE.tmp"C:\Users\Admin\AppData\Local\Temp\38CE.tmp"81⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\396A.tmp"C:\Users\Admin\AppData\Local\Temp\396A.tmp"82⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\39F7.tmp"C:\Users\Admin\AppData\Local\Temp\39F7.tmp"83⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\3A64.tmp"C:\Users\Admin\AppData\Local\Temp\3A64.tmp"84⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\3AD2.tmp"C:\Users\Admin\AppData\Local\Temp\3AD2.tmp"85⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\3B4F.tmp"C:\Users\Admin\AppData\Local\Temp\3B4F.tmp"86⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\3BDB.tmp"C:\Users\Admin\AppData\Local\Temp\3BDB.tmp"87⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\3C68.tmp"C:\Users\Admin\AppData\Local\Temp\3C68.tmp"88⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\3D04.tmp"C:\Users\Admin\AppData\Local\Temp\3D04.tmp"89⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\3D81.tmp"C:\Users\Admin\AppData\Local\Temp\3D81.tmp"90⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\3E1D.tmp"C:\Users\Admin\AppData\Local\Temp\3E1D.tmp"91⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\3E8B.tmp"C:\Users\Admin\AppData\Local\Temp\3E8B.tmp"92⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\3F08.tmp"C:\Users\Admin\AppData\Local\Temp\3F08.tmp"93⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\3FA4.tmp"C:\Users\Admin\AppData\Local\Temp\3FA4.tmp"94⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\4021.tmp"C:\Users\Admin\AppData\Local\Temp\4021.tmp"95⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\40BD.tmp"C:\Users\Admin\AppData\Local\Temp\40BD.tmp"96⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\413A.tmp"C:\Users\Admin\AppData\Local\Temp\413A.tmp"97⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\41E6.tmp"C:\Users\Admin\AppData\Local\Temp\41E6.tmp"98⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\4282.tmp"C:\Users\Admin\AppData\Local\Temp\4282.tmp"99⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\42F0.tmp"C:\Users\Admin\AppData\Local\Temp\42F0.tmp"100⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\437C.tmp"C:\Users\Admin\AppData\Local\Temp\437C.tmp"101⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\4409.tmp"C:\Users\Admin\AppData\Local\Temp\4409.tmp"102⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\4496.tmp"C:\Users\Admin\AppData\Local\Temp\4496.tmp"103⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\4513.tmp"C:\Users\Admin\AppData\Local\Temp\4513.tmp"104⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\4590.tmp"C:\Users\Admin\AppData\Local\Temp\4590.tmp"105⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\461C.tmp"C:\Users\Admin\AppData\Local\Temp\461C.tmp"106⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\46A9.tmp"C:\Users\Admin\AppData\Local\Temp\46A9.tmp"107⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\4716.tmp"C:\Users\Admin\AppData\Local\Temp\4716.tmp"108⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\47A3.tmp"C:\Users\Admin\AppData\Local\Temp\47A3.tmp"109⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\482F.tmp"C:\Users\Admin\AppData\Local\Temp\482F.tmp"110⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\48AC.tmp"C:\Users\Admin\AppData\Local\Temp\48AC.tmp"111⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\4949.tmp"C:\Users\Admin\AppData\Local\Temp\4949.tmp"112⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\49C6.tmp"C:\Users\Admin\AppData\Local\Temp\49C6.tmp"113⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\4A33.tmp"C:\Users\Admin\AppData\Local\Temp\4A33.tmp"114⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"115⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\4B4C.tmp"C:\Users\Admin\AppData\Local\Temp\4B4C.tmp"116⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\4BD9.tmp"C:\Users\Admin\AppData\Local\Temp\4BD9.tmp"117⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\4C46.tmp"C:\Users\Admin\AppData\Local\Temp\4C46.tmp"118⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\4CD3.tmp"C:\Users\Admin\AppData\Local\Temp\4CD3.tmp"119⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\4D60.tmp"C:\Users\Admin\AppData\Local\Temp\4D60.tmp"120⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\4DCD.tmp"C:\Users\Admin\AppData\Local\Temp\4DCD.tmp"121⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\4E3A.tmp"C:\Users\Admin\AppData\Local\Temp\4E3A.tmp"122⤵PID:2516
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-