Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
04/08/2023, 15:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5bd1e24638864028a63dee84786632b2_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
5bd1e24638864028a63dee84786632b2_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
5bd1e24638864028a63dee84786632b2_mafia_JC.exe
-
Size
486KB
-
MD5
5bd1e24638864028a63dee84786632b2
-
SHA1
132155c24d0efcab2b4fbb987d7164b24bdb9ce7
-
SHA256
8873aefdc54797a1353d2dc8ca8b922913023463a1915ea4047b3399458fb174
-
SHA512
6e5889b8f2fc9e6388d85b44a52b93faef9d15a22bf3a0af283362a936c07a5b938a447309e4a2e91fbd6d29fe121eab378fce0ca47ebc7096c5f00241a71092
-
SSDEEP
12288:/U5rCOTeiD7pnYjiYanqXmeM5mwY2IpjKNZ:/UQOJD7pns1XmeM5BN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1088 BFD5.tmp 4328 C091.tmp 1116 C14C.tmp 572 C7C4.tmp 4332 C89F.tmp 4592 C94B.tmp 2072 C9F7.tmp 1624 CA84.tmp 1148 CB2F.tmp 4488 CBDB.tmp 3936 CC97.tmp 3280 CD52.tmp 4892 CDFE.tmp 4676 CE6C.tmp 848 CF08.tmp 1692 CFA4.tmp 2124 D031.tmp 2140 D0CD.tmp 5100 D179.tmp 1964 D1F6.tmp 1464 D2D1.tmp 4368 D38C.tmp 2956 D419.tmp 880 D4A5.tmp 4816 D570.tmp 3808 D60D.tmp 1152 D68A.tmp 916 D755.tmp 3424 D801.tmp 4056 D8AD.tmp 2980 D939.tmp 2984 D9E5.tmp 2184 DAC0.tmp 1604 DB2D.tmp 3764 DD02.tmp 3564 DDAE.tmp 5032 DE3A.tmp 2356 DEC7.tmp 680 DF54.tmp 2852 DFD1.tmp 2020 E07D.tmp 4328 E138.tmp 4224 E1F4.tmp 2464 E280.tmp 4332 E2FD.tmp 1796 E3A9.tmp 4488 E436.tmp 3232 E4B3.tmp 1124 E53F.tmp 5104 E5BC.tmp 3688 E639.tmp 5056 E6A7.tmp 536 E724.tmp 3068 E9B4.tmp 4808 EA31.tmp 2544 EACD.tmp 4548 EB5A.tmp 4860 EBE6.tmp 1464 EC73.tmp 2812 ECF0.tmp 2292 ED7D.tmp 3400 EEC5.tmp 4568 EF32.tmp 404 EFAF.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4408 wrote to memory of 1088 4408 5bd1e24638864028a63dee84786632b2_mafia_JC.exe 84 PID 4408 wrote to memory of 1088 4408 5bd1e24638864028a63dee84786632b2_mafia_JC.exe 84 PID 4408 wrote to memory of 1088 4408 5bd1e24638864028a63dee84786632b2_mafia_JC.exe 84 PID 1088 wrote to memory of 4328 1088 BFD5.tmp 85 PID 1088 wrote to memory of 4328 1088 BFD5.tmp 85 PID 1088 wrote to memory of 4328 1088 BFD5.tmp 85 PID 4328 wrote to memory of 1116 4328 C091.tmp 87 PID 4328 wrote to memory of 1116 4328 C091.tmp 87 PID 4328 wrote to memory of 1116 4328 C091.tmp 87 PID 1116 wrote to memory of 572 1116 C14C.tmp 88 PID 1116 wrote to memory of 572 1116 C14C.tmp 88 PID 1116 wrote to memory of 572 1116 C14C.tmp 88 PID 572 wrote to memory of 4332 572 C7C4.tmp 89 PID 572 wrote to memory of 4332 572 C7C4.tmp 89 PID 572 wrote to memory of 4332 572 C7C4.tmp 89 PID 4332 wrote to memory of 4592 4332 C89F.tmp 90 PID 4332 wrote to memory of 4592 4332 C89F.tmp 90 PID 4332 wrote to memory of 4592 4332 C89F.tmp 90 PID 4592 wrote to memory of 2072 4592 C94B.tmp 91 PID 4592 wrote to memory of 2072 4592 C94B.tmp 91 PID 4592 wrote to memory of 2072 4592 C94B.tmp 91 PID 2072 wrote to memory of 1624 2072 C9F7.tmp 92 PID 2072 wrote to memory of 1624 2072 C9F7.tmp 92 PID 2072 wrote to memory of 1624 2072 C9F7.tmp 92 PID 1624 wrote to memory of 1148 1624 CA84.tmp 94 PID 1624 wrote to memory of 1148 1624 CA84.tmp 94 PID 1624 wrote to memory of 1148 1624 CA84.tmp 94 PID 1148 wrote to memory of 4488 1148 CB2F.tmp 95 PID 1148 wrote to memory of 4488 1148 CB2F.tmp 95 PID 1148 wrote to memory of 4488 1148 CB2F.tmp 95 PID 4488 wrote to memory of 3936 4488 CBDB.tmp 96 PID 4488 wrote to memory of 3936 4488 CBDB.tmp 96 PID 4488 wrote to memory of 3936 4488 CBDB.tmp 96 PID 3936 wrote to memory of 3280 3936 CC97.tmp 97 PID 3936 wrote to memory of 3280 3936 CC97.tmp 97 PID 3936 wrote to memory of 3280 3936 CC97.tmp 97 PID 3280 wrote to memory of 4892 3280 CD52.tmp 98 PID 3280 wrote to memory of 4892 3280 CD52.tmp 98 PID 3280 wrote to memory of 4892 3280 CD52.tmp 98 PID 4892 wrote to memory of 4676 4892 CDFE.tmp 99 PID 4892 wrote to memory of 4676 4892 CDFE.tmp 99 PID 4892 wrote to memory of 4676 4892 CDFE.tmp 99 PID 4676 wrote to memory of 848 4676 CE6C.tmp 100 PID 4676 wrote to memory of 848 4676 CE6C.tmp 100 PID 4676 wrote to memory of 848 4676 CE6C.tmp 100 PID 848 wrote to memory of 1692 848 CF08.tmp 101 PID 848 wrote to memory of 1692 848 CF08.tmp 101 PID 848 wrote to memory of 1692 848 CF08.tmp 101 PID 1692 wrote to memory of 2124 1692 CFA4.tmp 102 PID 1692 wrote to memory of 2124 1692 CFA4.tmp 102 PID 1692 wrote to memory of 2124 1692 CFA4.tmp 102 PID 2124 wrote to memory of 2140 2124 D031.tmp 103 PID 2124 wrote to memory of 2140 2124 D031.tmp 103 PID 2124 wrote to memory of 2140 2124 D031.tmp 103 PID 2140 wrote to memory of 5100 2140 D0CD.tmp 104 PID 2140 wrote to memory of 5100 2140 D0CD.tmp 104 PID 2140 wrote to memory of 5100 2140 D0CD.tmp 104 PID 5100 wrote to memory of 1964 5100 D179.tmp 106 PID 5100 wrote to memory of 1964 5100 D179.tmp 106 PID 5100 wrote to memory of 1964 5100 D179.tmp 106 PID 1964 wrote to memory of 1464 1964 D1F6.tmp 108 PID 1964 wrote to memory of 1464 1964 D1F6.tmp 108 PID 1964 wrote to memory of 1464 1964 D1F6.tmp 108 PID 1464 wrote to memory of 4368 1464 D2D1.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bd1e24638864028a63dee84786632b2_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\5bd1e24638864028a63dee84786632b2_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\C091.tmp"C:\Users\Admin\AppData\Local\Temp\C091.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Users\Admin\AppData\Local\Temp\C89F.tmp"C:\Users\Admin\AppData\Local\Temp\C89F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\C94B.tmp"C:\Users\Admin\AppData\Local\Temp\C94B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\CA84.tmp"C:\Users\Admin\AppData\Local\Temp\CA84.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\CC97.tmp"C:\Users\Admin\AppData\Local\Temp\CC97.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\CD52.tmp"C:\Users\Admin\AppData\Local\Temp\CD52.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\CF08.tmp"C:\Users\Admin\AppData\Local\Temp\CF08.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\D031.tmp"C:\Users\Admin\AppData\Local\Temp\D031.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\D179.tmp"C:\Users\Admin\AppData\Local\Temp\D179.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\D1F6.tmp"C:\Users\Admin\AppData\Local\Temp\D1F6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\D38C.tmp"C:\Users\Admin\AppData\Local\Temp\D38C.tmp"23⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\D419.tmp"C:\Users\Admin\AppData\Local\Temp\D419.tmp"24⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"25⤵
- Executes dropped EXE
PID:880 -
C:\Users\Admin\AppData\Local\Temp\D570.tmp"C:\Users\Admin\AppData\Local\Temp\D570.tmp"26⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\D60D.tmp"C:\Users\Admin\AppData\Local\Temp\D60D.tmp"27⤵
- Executes dropped EXE
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\D68A.tmp"C:\Users\Admin\AppData\Local\Temp\D68A.tmp"28⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\D755.tmp"C:\Users\Admin\AppData\Local\Temp\D755.tmp"29⤵
- Executes dropped EXE
PID:916 -
C:\Users\Admin\AppData\Local\Temp\D801.tmp"C:\Users\Admin\AppData\Local\Temp\D801.tmp"30⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\D8AD.tmp"C:\Users\Admin\AppData\Local\Temp\D8AD.tmp"31⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\D939.tmp"C:\Users\Admin\AppData\Local\Temp\D939.tmp"32⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\D9E5.tmp"C:\Users\Admin\AppData\Local\Temp\D9E5.tmp"33⤵
- Executes dropped EXE
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"34⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\DB2D.tmp"C:\Users\Admin\AppData\Local\Temp\DB2D.tmp"35⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\DD02.tmp"C:\Users\Admin\AppData\Local\Temp\DD02.tmp"36⤵
- Executes dropped EXE
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"37⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\DE3A.tmp"C:\Users\Admin\AppData\Local\Temp\DE3A.tmp"38⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\DEC7.tmp"C:\Users\Admin\AppData\Local\Temp\DEC7.tmp"39⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\DF54.tmp"C:\Users\Admin\AppData\Local\Temp\DF54.tmp"40⤵
- Executes dropped EXE
PID:680 -
C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"41⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\E07D.tmp"C:\Users\Admin\AppData\Local\Temp\E07D.tmp"42⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\E138.tmp"C:\Users\Admin\AppData\Local\Temp\E138.tmp"43⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\E1F4.tmp"C:\Users\Admin\AppData\Local\Temp\E1F4.tmp"44⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\E280.tmp"C:\Users\Admin\AppData\Local\Temp\E280.tmp"45⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\E2FD.tmp"C:\Users\Admin\AppData\Local\Temp\E2FD.tmp"46⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\E3A9.tmp"C:\Users\Admin\AppData\Local\Temp\E3A9.tmp"47⤵
- Executes dropped EXE
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\E436.tmp"C:\Users\Admin\AppData\Local\Temp\E436.tmp"48⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\E4B3.tmp"C:\Users\Admin\AppData\Local\Temp\E4B3.tmp"49⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\E53F.tmp"C:\Users\Admin\AppData\Local\Temp\E53F.tmp"50⤵
- Executes dropped EXE
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\E5BC.tmp"C:\Users\Admin\AppData\Local\Temp\E5BC.tmp"51⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\E639.tmp"C:\Users\Admin\AppData\Local\Temp\E639.tmp"52⤵
- Executes dropped EXE
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"53⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\E724.tmp"C:\Users\Admin\AppData\Local\Temp\E724.tmp"54⤵
- Executes dropped EXE
PID:536 -
C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"55⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\EA31.tmp"C:\Users\Admin\AppData\Local\Temp\EA31.tmp"56⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\EACD.tmp"C:\Users\Admin\AppData\Local\Temp\EACD.tmp"57⤵
- Executes dropped EXE
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"58⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\EBE6.tmp"C:\Users\Admin\AppData\Local\Temp\EBE6.tmp"59⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\EC73.tmp"C:\Users\Admin\AppData\Local\Temp\EC73.tmp"60⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"61⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\ED7D.tmp"C:\Users\Admin\AppData\Local\Temp\ED7D.tmp"62⤵
- Executes dropped EXE
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\EEC5.tmp"C:\Users\Admin\AppData\Local\Temp\EEC5.tmp"63⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\EF32.tmp"C:\Users\Admin\AppData\Local\Temp\EF32.tmp"64⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\EFAF.tmp"C:\Users\Admin\AppData\Local\Temp\EFAF.tmp"65⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\F03C.tmp"C:\Users\Admin\AppData\Local\Temp\F03C.tmp"66⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\F0E8.tmp"C:\Users\Admin\AppData\Local\Temp\F0E8.tmp"67⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\F174.tmp"C:\Users\Admin\AppData\Local\Temp\F174.tmp"68⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\F25F.tmp"C:\Users\Admin\AppData\Local\Temp\F25F.tmp"69⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\F2DC.tmp"C:\Users\Admin\AppData\Local\Temp\F2DC.tmp"70⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\F368.tmp"C:\Users\Admin\AppData\Local\Temp\F368.tmp"71⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\F424.tmp"C:\Users\Admin\AppData\Local\Temp\F424.tmp"72⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\F491.tmp"C:\Users\Admin\AppData\Local\Temp\F491.tmp"73⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\F50E.tmp"C:\Users\Admin\AppData\Local\Temp\F50E.tmp"74⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\F5BA.tmp"C:\Users\Admin\AppData\Local\Temp\F5BA.tmp"75⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\F627.tmp"C:\Users\Admin\AppData\Local\Temp\F627.tmp"76⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"77⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\F741.tmp"C:\Users\Admin\AppData\Local\Temp\F741.tmp"78⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"79⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\F86A.tmp"C:\Users\Admin\AppData\Local\Temp\F86A.tmp"80⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"81⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\F964.tmp"C:\Users\Admin\AppData\Local\Temp\F964.tmp"82⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\F9F0.tmp"C:\Users\Admin\AppData\Local\Temp\F9F0.tmp"83⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"84⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\FADB.tmp"C:\Users\Admin\AppData\Local\Temp\FADB.tmp"85⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\FB67.tmp"C:\Users\Admin\AppData\Local\Temp\FB67.tmp"86⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"87⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\FC61.tmp"C:\Users\Admin\AppData\Local\Temp\FC61.tmp"88⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"89⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\FD4C.tmp"C:\Users\Admin\AppData\Local\Temp\FD4C.tmp"90⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\FDD8.tmp"C:\Users\Admin\AppData\Local\Temp\FDD8.tmp"91⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\FEE2.tmp"C:\Users\Admin\AppData\Local\Temp\FEE2.tmp"92⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\FF4F.tmp"C:\Users\Admin\AppData\Local\Temp\FF4F.tmp"93⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"94⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\49.tmp"C:\Users\Admin\AppData\Local\Temp\49.tmp"95⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\C6.tmp"C:\Users\Admin\AppData\Local\Temp\C6.tmp"96⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\134.tmp"C:\Users\Admin\AppData\Local\Temp\134.tmp"97⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\1B1.tmp"C:\Users\Admin\AppData\Local\Temp\1B1.tmp"98⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\21E.tmp"C:\Users\Admin\AppData\Local\Temp\21E.tmp"99⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\27C.tmp"C:\Users\Admin\AppData\Local\Temp\27C.tmp"100⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\2E9.tmp"C:\Users\Admin\AppData\Local\Temp\2E9.tmp"101⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\356.tmp"C:\Users\Admin\AppData\Local\Temp\356.tmp"102⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\3D3.tmp"C:\Users\Admin\AppData\Local\Temp\3D3.tmp"103⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\450.tmp"C:\Users\Admin\AppData\Local\Temp\450.tmp"104⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\4BE.tmp"C:\Users\Admin\AppData\Local\Temp\4BE.tmp"105⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\53B.tmp"C:\Users\Admin\AppData\Local\Temp\53B.tmp"106⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\5A8.tmp"C:\Users\Admin\AppData\Local\Temp\5A8.tmp"107⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\616.tmp"C:\Users\Admin\AppData\Local\Temp\616.tmp"108⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\693.tmp"C:\Users\Admin\AppData\Local\Temp\693.tmp"109⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\710.tmp"C:\Users\Admin\AppData\Local\Temp\710.tmp"110⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\78D.tmp"C:\Users\Admin\AppData\Local\Temp\78D.tmp"111⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\829.tmp"C:\Users\Admin\AppData\Local\Temp\829.tmp"112⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\8B5.tmp"C:\Users\Admin\AppData\Local\Temp\8B5.tmp"113⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\990.tmp"C:\Users\Admin\AppData\Local\Temp\990.tmp"114⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\A1D.tmp"C:\Users\Admin\AppData\Local\Temp\A1D.tmp"115⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\A9A.tmp"C:\Users\Admin\AppData\Local\Temp\A9A.tmp"116⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\B17.tmp"C:\Users\Admin\AppData\Local\Temp\B17.tmp"117⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\BA3.tmp"C:\Users\Admin\AppData\Local\Temp\BA3.tmp"118⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\C40.tmp"C:\Users\Admin\AppData\Local\Temp\C40.tmp"119⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\CDC.tmp"C:\Users\Admin\AppData\Local\Temp\CDC.tmp"120⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\D97.tmp"C:\Users\Admin\AppData\Local\Temp\D97.tmp"121⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\E14.tmp"C:\Users\Admin\AppData\Local\Temp\E14.tmp"122⤵PID:1940
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-