Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
04/08/2023, 16:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5dd0d3a94206a0f5d6fa145bddd5f081_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
5dd0d3a94206a0f5d6fa145bddd5f081_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
5dd0d3a94206a0f5d6fa145bddd5f081_mafia_JC.exe
-
Size
520KB
-
MD5
5dd0d3a94206a0f5d6fa145bddd5f081
-
SHA1
b72a9ecaa3e7ebb12a25cfdb599998888cac6618
-
SHA256
dd6534119558f086b47d004fd33230297d1ec53cafd612d7889decb5dcefe0cb
-
SHA512
c352670b2bf9cdbb69e308007fb624a9bccf40e9f8ab5ede45e5535a34454a39a354da9a225dabb4f78407af5c853367849848b182092665afbe51509ec30957
-
SSDEEP
12288:gBZhW5l16roR2LMIqQIrm8BWoL3v24AfItsNZ:gBK5iroR2LGVWC3vMfIKN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4020 D11B.tmp 3608 D1C7.tmp 1312 D273.tmp 1088 D36D.tmp 1300 D476.tmp 1736 D513.tmp 4144 D5BF.tmp 3020 D64B.tmp 5084 D6E7.tmp 1400 D774.tmp 1724 D8FB.tmp 2752 D9B6.tmp 856 DACF.tmp 1992 DBC9.tmp 4216 DC66.tmp 4272 DD31.tmp 4660 DDEC.tmp 2152 DED7.tmp 3632 DF83.tmp 3520 E06D.tmp 2748 E148.tmp 4280 E203.tmp 4024 E2FD.tmp 4688 E3D8.tmp 3668 E484.tmp 1848 E54F.tmp 3256 E659.tmp 1064 E753.tmp 2592 E82D.tmp 2888 E927.tmp 1628 EA12.tmp 2156 EB5A.tmp 4000 EC54.tmp 4476 ECF0.tmp 2072 EDCB.tmp 2032 EE57.tmp 2988 EEF4.tmp 1056 EF90.tmp 5064 F01D.tmp 4824 F0C8.tmp 3188 F174.tmp 2996 F201.tmp 4888 F28E.tmp 4500 F30B.tmp 468 F3A7.tmp 3784 F424.tmp 4396 F4A1.tmp 4952 F53D.tmp 4748 F5D9.tmp 1088 F676.tmp 2216 F6F3.tmp 1700 F77F.tmp 1712 F82B.tmp 3780 F8B8.tmp 2124 F935.tmp 3308 F9D1.tmp 4920 FA5E.tmp 3332 FB19.tmp 1156 FBC5.tmp 1992 FC32.tmp 4204 FCAF.tmp 4436 FD1D.tmp 4660 FDC9.tmp 2428 FE26.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2016 wrote to memory of 4020 2016 5dd0d3a94206a0f5d6fa145bddd5f081_mafia_JC.exe 85 PID 2016 wrote to memory of 4020 2016 5dd0d3a94206a0f5d6fa145bddd5f081_mafia_JC.exe 85 PID 2016 wrote to memory of 4020 2016 5dd0d3a94206a0f5d6fa145bddd5f081_mafia_JC.exe 85 PID 4020 wrote to memory of 3608 4020 D11B.tmp 86 PID 4020 wrote to memory of 3608 4020 D11B.tmp 86 PID 4020 wrote to memory of 3608 4020 D11B.tmp 86 PID 3608 wrote to memory of 1312 3608 D1C7.tmp 87 PID 3608 wrote to memory of 1312 3608 D1C7.tmp 87 PID 3608 wrote to memory of 1312 3608 D1C7.tmp 87 PID 1312 wrote to memory of 1088 1312 D273.tmp 88 PID 1312 wrote to memory of 1088 1312 D273.tmp 88 PID 1312 wrote to memory of 1088 1312 D273.tmp 88 PID 1088 wrote to memory of 1300 1088 D36D.tmp 90 PID 1088 wrote to memory of 1300 1088 D36D.tmp 90 PID 1088 wrote to memory of 1300 1088 D36D.tmp 90 PID 1300 wrote to memory of 1736 1300 D476.tmp 91 PID 1300 wrote to memory of 1736 1300 D476.tmp 91 PID 1300 wrote to memory of 1736 1300 D476.tmp 91 PID 1736 wrote to memory of 4144 1736 D513.tmp 92 PID 1736 wrote to memory of 4144 1736 D513.tmp 92 PID 1736 wrote to memory of 4144 1736 D513.tmp 92 PID 4144 wrote to memory of 3020 4144 D5BF.tmp 93 PID 4144 wrote to memory of 3020 4144 D5BF.tmp 93 PID 4144 wrote to memory of 3020 4144 D5BF.tmp 93 PID 3020 wrote to memory of 5084 3020 D64B.tmp 94 PID 3020 wrote to memory of 5084 3020 D64B.tmp 94 PID 3020 wrote to memory of 5084 3020 D64B.tmp 94 PID 5084 wrote to memory of 1400 5084 D6E7.tmp 95 PID 5084 wrote to memory of 1400 5084 D6E7.tmp 95 PID 5084 wrote to memory of 1400 5084 D6E7.tmp 95 PID 1400 wrote to memory of 1724 1400 D774.tmp 96 PID 1400 wrote to memory of 1724 1400 D774.tmp 96 PID 1400 wrote to memory of 1724 1400 D774.tmp 96 PID 1724 wrote to memory of 2752 1724 D8FB.tmp 97 PID 1724 wrote to memory of 2752 1724 D8FB.tmp 97 PID 1724 wrote to memory of 2752 1724 D8FB.tmp 97 PID 2752 wrote to memory of 856 2752 D9B6.tmp 98 PID 2752 wrote to memory of 856 2752 D9B6.tmp 98 PID 2752 wrote to memory of 856 2752 D9B6.tmp 98 PID 856 wrote to memory of 1992 856 DACF.tmp 99 PID 856 wrote to memory of 1992 856 DACF.tmp 99 PID 856 wrote to memory of 1992 856 DACF.tmp 99 PID 1992 wrote to memory of 4216 1992 DBC9.tmp 100 PID 1992 wrote to memory of 4216 1992 DBC9.tmp 100 PID 1992 wrote to memory of 4216 1992 DBC9.tmp 100 PID 4216 wrote to memory of 4272 4216 DC66.tmp 101 PID 4216 wrote to memory of 4272 4216 DC66.tmp 101 PID 4216 wrote to memory of 4272 4216 DC66.tmp 101 PID 4272 wrote to memory of 4660 4272 DD31.tmp 102 PID 4272 wrote to memory of 4660 4272 DD31.tmp 102 PID 4272 wrote to memory of 4660 4272 DD31.tmp 102 PID 4660 wrote to memory of 2152 4660 DDEC.tmp 105 PID 4660 wrote to memory of 2152 4660 DDEC.tmp 105 PID 4660 wrote to memory of 2152 4660 DDEC.tmp 105 PID 2152 wrote to memory of 3632 2152 DED7.tmp 106 PID 2152 wrote to memory of 3632 2152 DED7.tmp 106 PID 2152 wrote to memory of 3632 2152 DED7.tmp 106 PID 3632 wrote to memory of 3520 3632 DF83.tmp 107 PID 3632 wrote to memory of 3520 3632 DF83.tmp 107 PID 3632 wrote to memory of 3520 3632 DF83.tmp 107 PID 3520 wrote to memory of 2748 3520 E06D.tmp 108 PID 3520 wrote to memory of 2748 3520 E06D.tmp 108 PID 3520 wrote to memory of 2748 3520 E06D.tmp 108 PID 2748 wrote to memory of 4280 2748 E148.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\5dd0d3a94206a0f5d6fa145bddd5f081_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\5dd0d3a94206a0f5d6fa145bddd5f081_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\D11B.tmp"C:\Users\Admin\AppData\Local\Temp\D11B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\D273.tmp"C:\Users\Admin\AppData\Local\Temp\D273.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\D36D.tmp"C:\Users\Admin\AppData\Local\Temp\D36D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\D476.tmp"C:\Users\Admin\AppData\Local\Temp\D476.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\D513.tmp"C:\Users\Admin\AppData\Local\Temp\D513.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\D5BF.tmp"C:\Users\Admin\AppData\Local\Temp\D5BF.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\D64B.tmp"C:\Users\Admin\AppData\Local\Temp\D64B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\D6E7.tmp"C:\Users\Admin\AppData\Local\Temp\D6E7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\D774.tmp"C:\Users\Admin\AppData\Local\Temp\D774.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\D8FB.tmp"C:\Users\Admin\AppData\Local\Temp\D8FB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\DACF.tmp"C:\Users\Admin\AppData\Local\Temp\DACF.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\DC66.tmp"C:\Users\Admin\AppData\Local\Temp\DC66.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\DD31.tmp"C:\Users\Admin\AppData\Local\Temp\DD31.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\DDEC.tmp"C:\Users\Admin\AppData\Local\Temp\DDEC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\DED7.tmp"C:\Users\Admin\AppData\Local\Temp\DED7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\DF83.tmp"C:\Users\Admin\AppData\Local\Temp\DF83.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\E06D.tmp"C:\Users\Admin\AppData\Local\Temp\E06D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\E148.tmp"C:\Users\Admin\AppData\Local\Temp\E148.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\E203.tmp"C:\Users\Admin\AppData\Local\Temp\E203.tmp"23⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\E2FD.tmp"C:\Users\Admin\AppData\Local\Temp\E2FD.tmp"24⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\E3D8.tmp"C:\Users\Admin\AppData\Local\Temp\E3D8.tmp"25⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\E484.tmp"C:\Users\Admin\AppData\Local\Temp\E484.tmp"26⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\E54F.tmp"C:\Users\Admin\AppData\Local\Temp\E54F.tmp"27⤵
- Executes dropped EXE
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\E659.tmp"C:\Users\Admin\AppData\Local\Temp\E659.tmp"28⤵
- Executes dropped EXE
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\E753.tmp"C:\Users\Admin\AppData\Local\Temp\E753.tmp"29⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\E82D.tmp"C:\Users\Admin\AppData\Local\Temp\E82D.tmp"30⤵
- Executes dropped EXE
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\E927.tmp"C:\Users\Admin\AppData\Local\Temp\E927.tmp"31⤵
- Executes dropped EXE
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\EA12.tmp"C:\Users\Admin\AppData\Local\Temp\EA12.tmp"32⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"33⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\EC54.tmp"C:\Users\Admin\AppData\Local\Temp\EC54.tmp"34⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"35⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\EDCB.tmp"C:\Users\Admin\AppData\Local\Temp\EDCB.tmp"36⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\EE57.tmp"C:\Users\Admin\AppData\Local\Temp\EE57.tmp"37⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\EEF4.tmp"C:\Users\Admin\AppData\Local\Temp\EEF4.tmp"38⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\EF90.tmp"C:\Users\Admin\AppData\Local\Temp\EF90.tmp"39⤵
- Executes dropped EXE
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\F01D.tmp"C:\Users\Admin\AppData\Local\Temp\F01D.tmp"40⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"41⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\F174.tmp"C:\Users\Admin\AppData\Local\Temp\F174.tmp"42⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\F201.tmp"C:\Users\Admin\AppData\Local\Temp\F201.tmp"43⤵
- Executes dropped EXE
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\F28E.tmp"C:\Users\Admin\AppData\Local\Temp\F28E.tmp"44⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\F30B.tmp"C:\Users\Admin\AppData\Local\Temp\F30B.tmp"45⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\F3A7.tmp"C:\Users\Admin\AppData\Local\Temp\F3A7.tmp"46⤵
- Executes dropped EXE
PID:468 -
C:\Users\Admin\AppData\Local\Temp\F424.tmp"C:\Users\Admin\AppData\Local\Temp\F424.tmp"47⤵
- Executes dropped EXE
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"48⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\F53D.tmp"C:\Users\Admin\AppData\Local\Temp\F53D.tmp"49⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"50⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\F676.tmp"C:\Users\Admin\AppData\Local\Temp\F676.tmp"51⤵
- Executes dropped EXE
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"52⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\F77F.tmp"C:\Users\Admin\AppData\Local\Temp\F77F.tmp"53⤵
- Executes dropped EXE
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\F82B.tmp"C:\Users\Admin\AppData\Local\Temp\F82B.tmp"54⤵
- Executes dropped EXE
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\F8B8.tmp"C:\Users\Admin\AppData\Local\Temp\F8B8.tmp"55⤵
- Executes dropped EXE
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\F935.tmp"C:\Users\Admin\AppData\Local\Temp\F935.tmp"56⤵
- Executes dropped EXE
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"57⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"58⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\FB19.tmp"C:\Users\Admin\AppData\Local\Temp\FB19.tmp"59⤵
- Executes dropped EXE
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"60⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\FC32.tmp"C:\Users\Admin\AppData\Local\Temp\FC32.tmp"61⤵
- Executes dropped EXE
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"62⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\FD1D.tmp"C:\Users\Admin\AppData\Local\Temp\FD1D.tmp"63⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"64⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\FE26.tmp"C:\Users\Admin\AppData\Local\Temp\FE26.tmp"65⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\FED2.tmp"C:\Users\Admin\AppData\Local\Temp\FED2.tmp"66⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\FF4F.tmp"C:\Users\Admin\AppData\Local\Temp\FF4F.tmp"67⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"68⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\68.tmp"C:\Users\Admin\AppData\Local\Temp\68.tmp"69⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\F5.tmp"C:\Users\Admin\AppData\Local\Temp\F5.tmp"70⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\162.tmp"C:\Users\Admin\AppData\Local\Temp\162.tmp"71⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\1DF.tmp"C:\Users\Admin\AppData\Local\Temp\1DF.tmp"72⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\24D.tmp"C:\Users\Admin\AppData\Local\Temp\24D.tmp"73⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\2AB.tmp"C:\Users\Admin\AppData\Local\Temp\2AB.tmp"74⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\347.tmp"C:\Users\Admin\AppData\Local\Temp\347.tmp"75⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\3C4.tmp"C:\Users\Admin\AppData\Local\Temp\3C4.tmp"76⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\450.tmp"C:\Users\Admin\AppData\Local\Temp\450.tmp"77⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\50C.tmp"C:\Users\Admin\AppData\Local\Temp\50C.tmp"78⤵PID:420
-
C:\Users\Admin\AppData\Local\Temp\589.tmp"C:\Users\Admin\AppData\Local\Temp\589.tmp"79⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\5F6.tmp"C:\Users\Admin\AppData\Local\Temp\5F6.tmp"80⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\664.tmp"C:\Users\Admin\AppData\Local\Temp\664.tmp"81⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\6F0.tmp"C:\Users\Admin\AppData\Local\Temp\6F0.tmp"82⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\77D.tmp"C:\Users\Admin\AppData\Local\Temp\77D.tmp"83⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\7EA.tmp"C:\Users\Admin\AppData\Local\Temp\7EA.tmp"84⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\858.tmp"C:\Users\Admin\AppData\Local\Temp\858.tmp"85⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\913.tmp"C:\Users\Admin\AppData\Local\Temp\913.tmp"86⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\990.tmp"C:\Users\Admin\AppData\Local\Temp\990.tmp"87⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\A1D.tmp"C:\Users\Admin\AppData\Local\Temp\A1D.tmp"88⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\A9A.tmp"C:\Users\Admin\AppData\Local\Temp\A9A.tmp"89⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\B36.tmp"C:\Users\Admin\AppData\Local\Temp\B36.tmp"90⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\BB3.tmp"C:\Users\Admin\AppData\Local\Temp\BB3.tmp"91⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\C5F.tmp"C:\Users\Admin\AppData\Local\Temp\C5F.tmp"92⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\CFB.tmp"C:\Users\Admin\AppData\Local\Temp\CFB.tmp"93⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\D78.tmp"C:\Users\Admin\AppData\Local\Temp\D78.tmp"94⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\DF5.tmp"C:\Users\Admin\AppData\Local\Temp\DF5.tmp"95⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\E82.tmp"C:\Users\Admin\AppData\Local\Temp\E82.tmp"96⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\F0E.tmp"C:\Users\Admin\AppData\Local\Temp\F0E.tmp"97⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\FAB.tmp"C:\Users\Admin\AppData\Local\Temp\FAB.tmp"98⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\1028.tmp"C:\Users\Admin\AppData\Local\Temp\1028.tmp"99⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\10C4.tmp"C:\Users\Admin\AppData\Local\Temp\10C4.tmp"100⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\1131.tmp"C:\Users\Admin\AppData\Local\Temp\1131.tmp"101⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\11BE.tmp"C:\Users\Admin\AppData\Local\Temp\11BE.tmp"102⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\123B.tmp"C:\Users\Admin\AppData\Local\Temp\123B.tmp"103⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\12D7.tmp"C:\Users\Admin\AppData\Local\Temp\12D7.tmp"104⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\1354.tmp"C:\Users\Admin\AppData\Local\Temp\1354.tmp"105⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\13F0.tmp"C:\Users\Admin\AppData\Local\Temp\13F0.tmp"106⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\146D.tmp"C:\Users\Admin\AppData\Local\Temp\146D.tmp"107⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\150A.tmp"C:\Users\Admin\AppData\Local\Temp\150A.tmp"108⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\1596.tmp"C:\Users\Admin\AppData\Local\Temp\1596.tmp"109⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\1604.tmp"C:\Users\Admin\AppData\Local\Temp\1604.tmp"110⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\16A0.tmp"C:\Users\Admin\AppData\Local\Temp\16A0.tmp"111⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\172D.tmp"C:\Users\Admin\AppData\Local\Temp\172D.tmp"112⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\17B9.tmp"C:\Users\Admin\AppData\Local\Temp\17B9.tmp"113⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\1855.tmp"C:\Users\Admin\AppData\Local\Temp\1855.tmp"114⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\18F2.tmp"C:\Users\Admin\AppData\Local\Temp\18F2.tmp"115⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\196F.tmp"C:\Users\Admin\AppData\Local\Temp\196F.tmp"116⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\19EC.tmp"C:\Users\Admin\AppData\Local\Temp\19EC.tmp"117⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\1A78.tmp"C:\Users\Admin\AppData\Local\Temp\1A78.tmp"118⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\1B05.tmp"C:\Users\Admin\AppData\Local\Temp\1B05.tmp"119⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\1B82.tmp"C:\Users\Admin\AppData\Local\Temp\1B82.tmp"120⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"121⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\1CBA.tmp"C:\Users\Admin\AppData\Local\Temp\1CBA.tmp"122⤵PID:4664
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-