Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2023, 18:02
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-26_507e2780007777123c8c3554a1699ee3_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-26_507e2780007777123c8c3554a1699ee3_mafia_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2023-08-26_507e2780007777123c8c3554a1699ee3_mafia_JC.exe
-
Size
488KB
-
MD5
507e2780007777123c8c3554a1699ee3
-
SHA1
6f701713267dc2f3dae96e446e3ffd68252c1e84
-
SHA256
8ff0db872f83a699cfd7574990b8c4d887047654edaad382f8756aea6b1185f6
-
SHA512
6b094d5636a19be464a457bd777a1bdd5f97e19197fb8579e499570429acea6f4596d6badf7dbeb32b5b7460c8ac3fb25f2f885f5f5a504ea864564ebdc16e7e
-
SSDEEP
12288:/U5rCOTeiDayTJLN0lsJH9K3KloHrnDp2YFR4NZ:/UQOJDayTRe3ioLnDI9N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4636 FBD5.tmp 2200 FCAF.tmp 3840 FD4C.tmp 2980 FE55.tmp 1524 FF20.tmp 884 B.tmp 4500 B7.tmp 824 191.tmp 5056 22E.tmp 1452 2CA.tmp 1816 347.tmp 2532 3F3.tmp 4696 74E.tmp 3352 80A.tmp 1812 8D5.tmp 3832 981.tmp 1512 A1D.tmp 2828 AE8.tmp 576 BB3.tmp 1080 C7E.tmp 1948 D3A.tmp 5048 DD6.tmp 2920 EB1.tmp 4796 F3D.tmp 4592 FCA.tmp 3952 1057.tmp 1144 1112.tmp 3308 11DD.tmp 1196 12C8.tmp 2852 13C2.tmp 3304 148D.tmp 4424 1587.tmp 1376 1661.tmp 180 16CF.tmp 3032 175B.tmp 2552 17F8.tmp 2036 1875.tmp 4892 1B63.tmp 3696 1C1E.tmp 4740 1C9B.tmp 3408 1D18.tmp 4420 1D86.tmp 1868 1E03.tmp 2928 1E8F.tmp 4388 1EFD.tmp 652 1F89.tmp 5004 2025.tmp 884 20A2.tmp 4376 213F.tmp 3048 21EB.tmp 2308 2296.tmp 5056 2313.tmp 2704 23A0.tmp 4852 249A.tmp 4356 2527.tmp 4736 2594.tmp 656 2621.tmp 3020 269E.tmp 804 270B.tmp 4476 2788.tmp 1512 2815.tmp 3544 2882.tmp 4672 28FF.tmp 3708 298C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4980 wrote to memory of 4636 4980 2023-08-26_507e2780007777123c8c3554a1699ee3_mafia_JC.exe 82 PID 4980 wrote to memory of 4636 4980 2023-08-26_507e2780007777123c8c3554a1699ee3_mafia_JC.exe 82 PID 4980 wrote to memory of 4636 4980 2023-08-26_507e2780007777123c8c3554a1699ee3_mafia_JC.exe 82 PID 4636 wrote to memory of 2200 4636 FBD5.tmp 83 PID 4636 wrote to memory of 2200 4636 FBD5.tmp 83 PID 4636 wrote to memory of 2200 4636 FBD5.tmp 83 PID 2200 wrote to memory of 3840 2200 FCAF.tmp 85 PID 2200 wrote to memory of 3840 2200 FCAF.tmp 85 PID 2200 wrote to memory of 3840 2200 FCAF.tmp 85 PID 3840 wrote to memory of 2980 3840 FD4C.tmp 86 PID 3840 wrote to memory of 2980 3840 FD4C.tmp 86 PID 3840 wrote to memory of 2980 3840 FD4C.tmp 86 PID 2980 wrote to memory of 1524 2980 FE55.tmp 87 PID 2980 wrote to memory of 1524 2980 FE55.tmp 87 PID 2980 wrote to memory of 1524 2980 FE55.tmp 87 PID 1524 wrote to memory of 884 1524 FF20.tmp 88 PID 1524 wrote to memory of 884 1524 FF20.tmp 88 PID 1524 wrote to memory of 884 1524 FF20.tmp 88 PID 884 wrote to memory of 4500 884 B.tmp 89 PID 884 wrote to memory of 4500 884 B.tmp 89 PID 884 wrote to memory of 4500 884 B.tmp 89 PID 4500 wrote to memory of 824 4500 B7.tmp 90 PID 4500 wrote to memory of 824 4500 B7.tmp 90 PID 4500 wrote to memory of 824 4500 B7.tmp 90 PID 824 wrote to memory of 5056 824 191.tmp 92 PID 824 wrote to memory of 5056 824 191.tmp 92 PID 824 wrote to memory of 5056 824 191.tmp 92 PID 5056 wrote to memory of 1452 5056 22E.tmp 93 PID 5056 wrote to memory of 1452 5056 22E.tmp 93 PID 5056 wrote to memory of 1452 5056 22E.tmp 93 PID 1452 wrote to memory of 1816 1452 2CA.tmp 94 PID 1452 wrote to memory of 1816 1452 2CA.tmp 94 PID 1452 wrote to memory of 1816 1452 2CA.tmp 94 PID 1816 wrote to memory of 2532 1816 347.tmp 95 PID 1816 wrote to memory of 2532 1816 347.tmp 95 PID 1816 wrote to memory of 2532 1816 347.tmp 95 PID 2532 wrote to memory of 4696 2532 3F3.tmp 96 PID 2532 wrote to memory of 4696 2532 3F3.tmp 96 PID 2532 wrote to memory of 4696 2532 3F3.tmp 96 PID 4696 wrote to memory of 3352 4696 74E.tmp 97 PID 4696 wrote to memory of 3352 4696 74E.tmp 97 PID 4696 wrote to memory of 3352 4696 74E.tmp 97 PID 3352 wrote to memory of 1812 3352 80A.tmp 98 PID 3352 wrote to memory of 1812 3352 80A.tmp 98 PID 3352 wrote to memory of 1812 3352 80A.tmp 98 PID 1812 wrote to memory of 3832 1812 8D5.tmp 101 PID 1812 wrote to memory of 3832 1812 8D5.tmp 101 PID 1812 wrote to memory of 3832 1812 8D5.tmp 101 PID 3832 wrote to memory of 1512 3832 981.tmp 102 PID 3832 wrote to memory of 1512 3832 981.tmp 102 PID 3832 wrote to memory of 1512 3832 981.tmp 102 PID 1512 wrote to memory of 2828 1512 A1D.tmp 103 PID 1512 wrote to memory of 2828 1512 A1D.tmp 103 PID 1512 wrote to memory of 2828 1512 A1D.tmp 103 PID 2828 wrote to memory of 576 2828 AE8.tmp 104 PID 2828 wrote to memory of 576 2828 AE8.tmp 104 PID 2828 wrote to memory of 576 2828 AE8.tmp 104 PID 576 wrote to memory of 1080 576 BB3.tmp 105 PID 576 wrote to memory of 1080 576 BB3.tmp 105 PID 576 wrote to memory of 1080 576 BB3.tmp 105 PID 1080 wrote to memory of 1948 1080 C7E.tmp 106 PID 1080 wrote to memory of 1948 1080 C7E.tmp 106 PID 1080 wrote to memory of 1948 1080 C7E.tmp 106 PID 1948 wrote to memory of 5048 1948 D3A.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-26_507e2780007777123c8c3554a1699ee3_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-26_507e2780007777123c8c3554a1699ee3_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\FD4C.tmp"C:\Users\Admin\AppData\Local\Temp\FD4C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\FE55.tmp"C:\Users\Admin\AppData\Local\Temp\FE55.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\FF20.tmp"C:\Users\Admin\AppData\Local\Temp\FF20.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\B.tmp"C:\Users\Admin\AppData\Local\Temp\B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\191.tmp"C:\Users\Admin\AppData\Local\Temp\191.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\22E.tmp"C:\Users\Admin\AppData\Local\Temp\22E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\2CA.tmp"C:\Users\Admin\AppData\Local\Temp\2CA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\347.tmp"C:\Users\Admin\AppData\Local\Temp\347.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\3F3.tmp"C:\Users\Admin\AppData\Local\Temp\3F3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\74E.tmp"C:\Users\Admin\AppData\Local\Temp\74E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\80A.tmp"C:\Users\Admin\AppData\Local\Temp\80A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\8D5.tmp"C:\Users\Admin\AppData\Local\Temp\8D5.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\981.tmp"C:\Users\Admin\AppData\Local\Temp\981.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\A1D.tmp"C:\Users\Admin\AppData\Local\Temp\A1D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\AE8.tmp"C:\Users\Admin\AppData\Local\Temp\AE8.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\BB3.tmp"C:\Users\Admin\AppData\Local\Temp\BB3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Users\Admin\AppData\Local\Temp\C7E.tmp"C:\Users\Admin\AppData\Local\Temp\C7E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\D3A.tmp"C:\Users\Admin\AppData\Local\Temp\D3A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\DD6.tmp"C:\Users\Admin\AppData\Local\Temp\DD6.tmp"23⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\EB1.tmp"C:\Users\Admin\AppData\Local\Temp\EB1.tmp"24⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\F3D.tmp"C:\Users\Admin\AppData\Local\Temp\F3D.tmp"25⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\FCA.tmp"C:\Users\Admin\AppData\Local\Temp\FCA.tmp"26⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\1057.tmp"C:\Users\Admin\AppData\Local\Temp\1057.tmp"27⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\1112.tmp"C:\Users\Admin\AppData\Local\Temp\1112.tmp"28⤵
- Executes dropped EXE
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\11DD.tmp"C:\Users\Admin\AppData\Local\Temp\11DD.tmp"29⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\12C8.tmp"C:\Users\Admin\AppData\Local\Temp\12C8.tmp"30⤵
- Executes dropped EXE
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\13C2.tmp"C:\Users\Admin\AppData\Local\Temp\13C2.tmp"31⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\148D.tmp"C:\Users\Admin\AppData\Local\Temp\148D.tmp"32⤵
- Executes dropped EXE
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\1587.tmp"C:\Users\Admin\AppData\Local\Temp\1587.tmp"33⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\1661.tmp"C:\Users\Admin\AppData\Local\Temp\1661.tmp"34⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\16CF.tmp"C:\Users\Admin\AppData\Local\Temp\16CF.tmp"35⤵
- Executes dropped EXE
PID:180 -
C:\Users\Admin\AppData\Local\Temp\175B.tmp"C:\Users\Admin\AppData\Local\Temp\175B.tmp"36⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\17F8.tmp"C:\Users\Admin\AppData\Local\Temp\17F8.tmp"37⤵
- Executes dropped EXE
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\1875.tmp"C:\Users\Admin\AppData\Local\Temp\1875.tmp"38⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\18E2.tmp"C:\Users\Admin\AppData\Local\Temp\18E2.tmp"39⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\1B63.tmp"C:\Users\Admin\AppData\Local\Temp\1B63.tmp"40⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"41⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\1C9B.tmp"C:\Users\Admin\AppData\Local\Temp\1C9B.tmp"42⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\1D18.tmp"C:\Users\Admin\AppData\Local\Temp\1D18.tmp"43⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\1D86.tmp"C:\Users\Admin\AppData\Local\Temp\1D86.tmp"44⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\1E03.tmp"C:\Users\Admin\AppData\Local\Temp\1E03.tmp"45⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\1E8F.tmp"C:\Users\Admin\AppData\Local\Temp\1E8F.tmp"46⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"47⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\1F89.tmp"C:\Users\Admin\AppData\Local\Temp\1F89.tmp"48⤵
- Executes dropped EXE
PID:652 -
C:\Users\Admin\AppData\Local\Temp\2025.tmp"C:\Users\Admin\AppData\Local\Temp\2025.tmp"49⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\20A2.tmp"C:\Users\Admin\AppData\Local\Temp\20A2.tmp"50⤵
- Executes dropped EXE
PID:884 -
C:\Users\Admin\AppData\Local\Temp\213F.tmp"C:\Users\Admin\AppData\Local\Temp\213F.tmp"51⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\21EB.tmp"C:\Users\Admin\AppData\Local\Temp\21EB.tmp"52⤵
- Executes dropped EXE
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\2296.tmp"C:\Users\Admin\AppData\Local\Temp\2296.tmp"53⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\2313.tmp"C:\Users\Admin\AppData\Local\Temp\2313.tmp"54⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\23A0.tmp"C:\Users\Admin\AppData\Local\Temp\23A0.tmp"55⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\249A.tmp"C:\Users\Admin\AppData\Local\Temp\249A.tmp"56⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\2527.tmp"C:\Users\Admin\AppData\Local\Temp\2527.tmp"57⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\2594.tmp"C:\Users\Admin\AppData\Local\Temp\2594.tmp"58⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\2621.tmp"C:\Users\Admin\AppData\Local\Temp\2621.tmp"59⤵
- Executes dropped EXE
PID:656 -
C:\Users\Admin\AppData\Local\Temp\269E.tmp"C:\Users\Admin\AppData\Local\Temp\269E.tmp"60⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\270B.tmp"C:\Users\Admin\AppData\Local\Temp\270B.tmp"61⤵
- Executes dropped EXE
PID:804 -
C:\Users\Admin\AppData\Local\Temp\2788.tmp"C:\Users\Admin\AppData\Local\Temp\2788.tmp"62⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\2815.tmp"C:\Users\Admin\AppData\Local\Temp\2815.tmp"63⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\2882.tmp"C:\Users\Admin\AppData\Local\Temp\2882.tmp"64⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\28FF.tmp"C:\Users\Admin\AppData\Local\Temp\28FF.tmp"65⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\298C.tmp"C:\Users\Admin\AppData\Local\Temp\298C.tmp"66⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\2A18.tmp"C:\Users\Admin\AppData\Local\Temp\2A18.tmp"67⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\2A95.tmp"C:\Users\Admin\AppData\Local\Temp\2A95.tmp"68⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\2B12.tmp"C:\Users\Admin\AppData\Local\Temp\2B12.tmp"69⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\2BAF.tmp"C:\Users\Admin\AppData\Local\Temp\2BAF.tmp"70⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\2C2C.tmp"C:\Users\Admin\AppData\Local\Temp\2C2C.tmp"71⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\2CA9.tmp"C:\Users\Admin\AppData\Local\Temp\2CA9.tmp"72⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\2D16.tmp"C:\Users\Admin\AppData\Local\Temp\2D16.tmp"73⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\2DA3.tmp"C:\Users\Admin\AppData\Local\Temp\2DA3.tmp"74⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\2E10.tmp"C:\Users\Admin\AppData\Local\Temp\2E10.tmp"75⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\2F87.tmp"C:\Users\Admin\AppData\Local\Temp\2F87.tmp"76⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\2FE5.tmp"C:\Users\Admin\AppData\Local\Temp\2FE5.tmp"77⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\30A0.tmp"C:\Users\Admin\AppData\Local\Temp\30A0.tmp"78⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\312D.tmp"C:\Users\Admin\AppData\Local\Temp\312D.tmp"79⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\319A.tmp"C:\Users\Admin\AppData\Local\Temp\319A.tmp"80⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\3227.tmp"C:\Users\Admin\AppData\Local\Temp\3227.tmp"81⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\32C3.tmp"C:\Users\Admin\AppData\Local\Temp\32C3.tmp"82⤵PID:180
-
C:\Users\Admin\AppData\Local\Temp\336F.tmp"C:\Users\Admin\AppData\Local\Temp\336F.tmp"83⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"84⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"85⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\3544.tmp"C:\Users\Admin\AppData\Local\Temp\3544.tmp"86⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\35B1.tmp"C:\Users\Admin\AppData\Local\Temp\35B1.tmp"87⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\361E.tmp"C:\Users\Admin\AppData\Local\Temp\361E.tmp"88⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\36AB.tmp"C:\Users\Admin\AppData\Local\Temp\36AB.tmp"89⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\3738.tmp"C:\Users\Admin\AppData\Local\Temp\3738.tmp"90⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\37A5.tmp"C:\Users\Admin\AppData\Local\Temp\37A5.tmp"91⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\3841.tmp"C:\Users\Admin\AppData\Local\Temp\3841.tmp"92⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\38CE.tmp"C:\Users\Admin\AppData\Local\Temp\38CE.tmp"93⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\3A26.tmp"C:\Users\Admin\AppData\Local\Temp\3A26.tmp"94⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\3AC2.tmp"C:\Users\Admin\AppData\Local\Temp\3AC2.tmp"95⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\3B2F.tmp"C:\Users\Admin\AppData\Local\Temp\3B2F.tmp"96⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\3BCC.tmp"C:\Users\Admin\AppData\Local\Temp\3BCC.tmp"97⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\3C58.tmp"C:\Users\Admin\AppData\Local\Temp\3C58.tmp"98⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\3CE5.tmp"C:\Users\Admin\AppData\Local\Temp\3CE5.tmp"99⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\3D62.tmp"C:\Users\Admin\AppData\Local\Temp\3D62.tmp"100⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\3E0E.tmp"C:\Users\Admin\AppData\Local\Temp\3E0E.tmp"101⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"102⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\3F17.tmp"C:\Users\Admin\AppData\Local\Temp\3F17.tmp"103⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\3FA4.tmp"C:\Users\Admin\AppData\Local\Temp\3FA4.tmp"104⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\405F.tmp"C:\Users\Admin\AppData\Local\Temp\405F.tmp"105⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\40DC.tmp"C:\Users\Admin\AppData\Local\Temp\40DC.tmp"106⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\4169.tmp"C:\Users\Admin\AppData\Local\Temp\4169.tmp"107⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\4205.tmp"C:\Users\Admin\AppData\Local\Temp\4205.tmp"108⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\42A2.tmp"C:\Users\Admin\AppData\Local\Temp\42A2.tmp"109⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\435D.tmp"C:\Users\Admin\AppData\Local\Temp\435D.tmp"110⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\4409.tmp"C:\Users\Admin\AppData\Local\Temp\4409.tmp"111⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\4476.tmp"C:\Users\Admin\AppData\Local\Temp\4476.tmp"112⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\4503.tmp"C:\Users\Admin\AppData\Local\Temp\4503.tmp"113⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\4580.tmp"C:\Users\Admin\AppData\Local\Temp\4580.tmp"114⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\45FD.tmp"C:\Users\Admin\AppData\Local\Temp\45FD.tmp"115⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\4699.tmp"C:\Users\Admin\AppData\Local\Temp\4699.tmp"116⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\4764.tmp"C:\Users\Admin\AppData\Local\Temp\4764.tmp"117⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\47D2.tmp"C:\Users\Admin\AppData\Local\Temp\47D2.tmp"118⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\485E.tmp"C:\Users\Admin\AppData\Local\Temp\485E.tmp"119⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\48FB.tmp"C:\Users\Admin\AppData\Local\Temp\48FB.tmp"120⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\4997.tmp"C:\Users\Admin\AppData\Local\Temp\4997.tmp"121⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\4A43.tmp"C:\Users\Admin\AppData\Local\Temp\4A43.tmp"122⤵PID:2812
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-