Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2023, 14:47
Static task
static1
Behavioral task
behavioral1
Sample
127960365a170145adb362e9023d3b3b_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
127960365a170145adb362e9023d3b3b_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
127960365a170145adb362e9023d3b3b_mafia_JC.exe
-
Size
488KB
-
MD5
127960365a170145adb362e9023d3b3b
-
SHA1
effc3e619a6d341b2119a8a024df1e43c8cb9d12
-
SHA256
edec708320363a64ed68646578e518c8ac08f5c99eb160dde74c35cf767c4252
-
SHA512
b99481d9ff3cd401ebfff44ed3a4b4605ed616e02ff8f94177eaf6555f95f8bd2d3d099b331448e33d69cd3ec0b7e0d96311bd0e0987fd52701be1876bf35b4b
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7wNPf2uy6SALr5T59Md+i7FGQM4M5gsH3dZ:/U5rCOTeiDOPLbb9TMfF7qpNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4760 13C2.tmp 1956 15F4.tmp 4508 16CF.tmp 1832 1865.tmp 3032 196F.tmp 4656 1A59.tmp 2116 1B72.tmp 2412 1C7C.tmp 2112 1D76.tmp 1536 1E70.tmp 2628 1F7A.tmp 4524 2064.tmp 3328 213F.tmp 4532 2229.tmp 1428 2313.tmp 440 241D.tmp 1360 2527.tmp 2164 2611.tmp 3024 26CD.tmp 3444 2778.tmp 1500 2834.tmp 1628 290F.tmp 4088 29DA.tmp 3296 2A95.tmp 1736 2B51.tmp 3648 2BFD.tmp 1416 2CE7.tmp 884 2DC2.tmp 4400 2EAC.tmp 2180 2F58.tmp 4892 2FF4.tmp 3004 30B0.tmp 4872 316B.tmp 5004 3227.tmp 2120 32C3.tmp 4968 339E.tmp 4600 343A.tmp 948 3573.tmp 1156 361E.tmp 3372 36DA.tmp 1688 3776.tmp 3864 37E4.tmp 1724 3870.tmp 4664 390C.tmp 3104 3999.tmp 2816 3A45.tmp 1984 3AF1.tmp 2792 3B7D.tmp 3428 3BEB.tmp 5116 3C68.tmp 4312 3CE5.tmp 4676 3D62.tmp 2168 3DDF.tmp 4808 3E7B.tmp 4756 3F37.tmp 4388 3FA4.tmp 3880 40EC.tmp 2492 4263.tmp 2716 431F.tmp 388 438C.tmp 1712 4457.tmp 4216 44D4.tmp 1636 4561.tmp 3172 45FD.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1512 wrote to memory of 4760 1512 127960365a170145adb362e9023d3b3b_mafia_JC.exe 82 PID 1512 wrote to memory of 4760 1512 127960365a170145adb362e9023d3b3b_mafia_JC.exe 82 PID 1512 wrote to memory of 4760 1512 127960365a170145adb362e9023d3b3b_mafia_JC.exe 82 PID 4760 wrote to memory of 1956 4760 13C2.tmp 83 PID 4760 wrote to memory of 1956 4760 13C2.tmp 83 PID 4760 wrote to memory of 1956 4760 13C2.tmp 83 PID 1956 wrote to memory of 4508 1956 15F4.tmp 84 PID 1956 wrote to memory of 4508 1956 15F4.tmp 84 PID 1956 wrote to memory of 4508 1956 15F4.tmp 84 PID 4508 wrote to memory of 1832 4508 16CF.tmp 85 PID 4508 wrote to memory of 1832 4508 16CF.tmp 85 PID 4508 wrote to memory of 1832 4508 16CF.tmp 85 PID 1832 wrote to memory of 3032 1832 1865.tmp 86 PID 1832 wrote to memory of 3032 1832 1865.tmp 86 PID 1832 wrote to memory of 3032 1832 1865.tmp 86 PID 3032 wrote to memory of 4656 3032 196F.tmp 87 PID 3032 wrote to memory of 4656 3032 196F.tmp 87 PID 3032 wrote to memory of 4656 3032 196F.tmp 87 PID 4656 wrote to memory of 2116 4656 1A59.tmp 88 PID 4656 wrote to memory of 2116 4656 1A59.tmp 88 PID 4656 wrote to memory of 2116 4656 1A59.tmp 88 PID 2116 wrote to memory of 2412 2116 1B72.tmp 89 PID 2116 wrote to memory of 2412 2116 1B72.tmp 89 PID 2116 wrote to memory of 2412 2116 1B72.tmp 89 PID 2412 wrote to memory of 2112 2412 1C7C.tmp 90 PID 2412 wrote to memory of 2112 2412 1C7C.tmp 90 PID 2412 wrote to memory of 2112 2412 1C7C.tmp 90 PID 2112 wrote to memory of 1536 2112 1D76.tmp 91 PID 2112 wrote to memory of 1536 2112 1D76.tmp 91 PID 2112 wrote to memory of 1536 2112 1D76.tmp 91 PID 1536 wrote to memory of 2628 1536 1E70.tmp 92 PID 1536 wrote to memory of 2628 1536 1E70.tmp 92 PID 1536 wrote to memory of 2628 1536 1E70.tmp 92 PID 2628 wrote to memory of 4524 2628 1F7A.tmp 93 PID 2628 wrote to memory of 4524 2628 1F7A.tmp 93 PID 2628 wrote to memory of 4524 2628 1F7A.tmp 93 PID 4524 wrote to memory of 3328 4524 2064.tmp 94 PID 4524 wrote to memory of 3328 4524 2064.tmp 94 PID 4524 wrote to memory of 3328 4524 2064.tmp 94 PID 3328 wrote to memory of 4532 3328 213F.tmp 95 PID 3328 wrote to memory of 4532 3328 213F.tmp 95 PID 3328 wrote to memory of 4532 3328 213F.tmp 95 PID 4532 wrote to memory of 1428 4532 2229.tmp 96 PID 4532 wrote to memory of 1428 4532 2229.tmp 96 PID 4532 wrote to memory of 1428 4532 2229.tmp 96 PID 1428 wrote to memory of 440 1428 2313.tmp 97 PID 1428 wrote to memory of 440 1428 2313.tmp 97 PID 1428 wrote to memory of 440 1428 2313.tmp 97 PID 440 wrote to memory of 1360 440 241D.tmp 98 PID 440 wrote to memory of 1360 440 241D.tmp 98 PID 440 wrote to memory of 1360 440 241D.tmp 98 PID 1360 wrote to memory of 2164 1360 2527.tmp 99 PID 1360 wrote to memory of 2164 1360 2527.tmp 99 PID 1360 wrote to memory of 2164 1360 2527.tmp 99 PID 2164 wrote to memory of 3024 2164 2611.tmp 100 PID 2164 wrote to memory of 3024 2164 2611.tmp 100 PID 2164 wrote to memory of 3024 2164 2611.tmp 100 PID 3024 wrote to memory of 3444 3024 26CD.tmp 101 PID 3024 wrote to memory of 3444 3024 26CD.tmp 101 PID 3024 wrote to memory of 3444 3024 26CD.tmp 101 PID 3444 wrote to memory of 1500 3444 2778.tmp 102 PID 3444 wrote to memory of 1500 3444 2778.tmp 102 PID 3444 wrote to memory of 1500 3444 2778.tmp 102 PID 1500 wrote to memory of 1628 1500 2834.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\127960365a170145adb362e9023d3b3b_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\127960365a170145adb362e9023d3b3b_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\13C2.tmp"C:\Users\Admin\AppData\Local\Temp\13C2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\15F4.tmp"C:\Users\Admin\AppData\Local\Temp\15F4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\16CF.tmp"C:\Users\Admin\AppData\Local\Temp\16CF.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\1865.tmp"C:\Users\Admin\AppData\Local\Temp\1865.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\196F.tmp"C:\Users\Admin\AppData\Local\Temp\196F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\1A59.tmp"C:\Users\Admin\AppData\Local\Temp\1A59.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\1B72.tmp"C:\Users\Admin\AppData\Local\Temp\1B72.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\1C7C.tmp"C:\Users\Admin\AppData\Local\Temp\1C7C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\1D76.tmp"C:\Users\Admin\AppData\Local\Temp\1D76.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\1E70.tmp"C:\Users\Admin\AppData\Local\Temp\1E70.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\1F7A.tmp"C:\Users\Admin\AppData\Local\Temp\1F7A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\2064.tmp"C:\Users\Admin\AppData\Local\Temp\2064.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\213F.tmp"C:\Users\Admin\AppData\Local\Temp\213F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\2229.tmp"C:\Users\Admin\AppData\Local\Temp\2229.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\2313.tmp"C:\Users\Admin\AppData\Local\Temp\2313.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\241D.tmp"C:\Users\Admin\AppData\Local\Temp\241D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\2527.tmp"C:\Users\Admin\AppData\Local\Temp\2527.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\2611.tmp"C:\Users\Admin\AppData\Local\Temp\2611.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\26CD.tmp"C:\Users\Admin\AppData\Local\Temp\26CD.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\2778.tmp"C:\Users\Admin\AppData\Local\Temp\2778.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\2834.tmp"C:\Users\Admin\AppData\Local\Temp\2834.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\290F.tmp"C:\Users\Admin\AppData\Local\Temp\290F.tmp"23⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\29DA.tmp"C:\Users\Admin\AppData\Local\Temp\29DA.tmp"24⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\2A95.tmp"C:\Users\Admin\AppData\Local\Temp\2A95.tmp"25⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\2B51.tmp"C:\Users\Admin\AppData\Local\Temp\2B51.tmp"26⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\2BFD.tmp"C:\Users\Admin\AppData\Local\Temp\2BFD.tmp"27⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"28⤵
- Executes dropped EXE
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"29⤵
- Executes dropped EXE
PID:884 -
C:\Users\Admin\AppData\Local\Temp\2EAC.tmp"C:\Users\Admin\AppData\Local\Temp\2EAC.tmp"30⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\2F58.tmp"C:\Users\Admin\AppData\Local\Temp\2F58.tmp"31⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\2FF4.tmp"C:\Users\Admin\AppData\Local\Temp\2FF4.tmp"32⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\30B0.tmp"C:\Users\Admin\AppData\Local\Temp\30B0.tmp"33⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\316B.tmp"C:\Users\Admin\AppData\Local\Temp\316B.tmp"34⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\3227.tmp"C:\Users\Admin\AppData\Local\Temp\3227.tmp"35⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\32C3.tmp"C:\Users\Admin\AppData\Local\Temp\32C3.tmp"36⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"37⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"38⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\3573.tmp"C:\Users\Admin\AppData\Local\Temp\3573.tmp"39⤵
- Executes dropped EXE
PID:948 -
C:\Users\Admin\AppData\Local\Temp\361E.tmp"C:\Users\Admin\AppData\Local\Temp\361E.tmp"40⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\36DA.tmp"C:\Users\Admin\AppData\Local\Temp\36DA.tmp"41⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\3776.tmp"C:\Users\Admin\AppData\Local\Temp\3776.tmp"42⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\37E4.tmp"C:\Users\Admin\AppData\Local\Temp\37E4.tmp"43⤵
- Executes dropped EXE
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\3870.tmp"C:\Users\Admin\AppData\Local\Temp\3870.tmp"44⤵
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\390C.tmp"C:\Users\Admin\AppData\Local\Temp\390C.tmp"45⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\3999.tmp"C:\Users\Admin\AppData\Local\Temp\3999.tmp"46⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\3A45.tmp"C:\Users\Admin\AppData\Local\Temp\3A45.tmp"47⤵
- Executes dropped EXE
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\3AF1.tmp"C:\Users\Admin\AppData\Local\Temp\3AF1.tmp"48⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\3B7D.tmp"C:\Users\Admin\AppData\Local\Temp\3B7D.tmp"49⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\3BEB.tmp"C:\Users\Admin\AppData\Local\Temp\3BEB.tmp"50⤵
- Executes dropped EXE
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\3C68.tmp"C:\Users\Admin\AppData\Local\Temp\3C68.tmp"51⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\3CE5.tmp"C:\Users\Admin\AppData\Local\Temp\3CE5.tmp"52⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\3D62.tmp"C:\Users\Admin\AppData\Local\Temp\3D62.tmp"53⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\3DDF.tmp"C:\Users\Admin\AppData\Local\Temp\3DDF.tmp"54⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\3E7B.tmp"C:\Users\Admin\AppData\Local\Temp\3E7B.tmp"55⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\3F37.tmp"C:\Users\Admin\AppData\Local\Temp\3F37.tmp"56⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\3FA4.tmp"C:\Users\Admin\AppData\Local\Temp\3FA4.tmp"57⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\40EC.tmp"C:\Users\Admin\AppData\Local\Temp\40EC.tmp"58⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\4263.tmp"C:\Users\Admin\AppData\Local\Temp\4263.tmp"59⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\431F.tmp"C:\Users\Admin\AppData\Local\Temp\431F.tmp"60⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\438C.tmp"C:\Users\Admin\AppData\Local\Temp\438C.tmp"61⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\4457.tmp"C:\Users\Admin\AppData\Local\Temp\4457.tmp"62⤵
- Executes dropped EXE
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\44D4.tmp"C:\Users\Admin\AppData\Local\Temp\44D4.tmp"63⤵
- Executes dropped EXE
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\4561.tmp"C:\Users\Admin\AppData\Local\Temp\4561.tmp"64⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\45FD.tmp"C:\Users\Admin\AppData\Local\Temp\45FD.tmp"65⤵
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\467A.tmp"C:\Users\Admin\AppData\Local\Temp\467A.tmp"66⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\4707.tmp"C:\Users\Admin\AppData\Local\Temp\4707.tmp"67⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\4793.tmp"C:\Users\Admin\AppData\Local\Temp\4793.tmp"68⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\4820.tmp"C:\Users\Admin\AppData\Local\Temp\4820.tmp"69⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\488D.tmp"C:\Users\Admin\AppData\Local\Temp\488D.tmp"70⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\490A.tmp"C:\Users\Admin\AppData\Local\Temp\490A.tmp"71⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\4987.tmp"C:\Users\Admin\AppData\Local\Temp\4987.tmp"72⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\4A04.tmp"C:\Users\Admin\AppData\Local\Temp\4A04.tmp"73⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\4A91.tmp"C:\Users\Admin\AppData\Local\Temp\4A91.tmp"74⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\4B0E.tmp"C:\Users\Admin\AppData\Local\Temp\4B0E.tmp"75⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\4B9A.tmp"C:\Users\Admin\AppData\Local\Temp\4B9A.tmp"76⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\4CA4.tmp"C:\Users\Admin\AppData\Local\Temp\4CA4.tmp"77⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\4D8E.tmp"C:\Users\Admin\AppData\Local\Temp\4D8E.tmp"78⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\4DFC.tmp"C:\Users\Admin\AppData\Local\Temp\4DFC.tmp"79⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\4E79.tmp"C:\Users\Admin\AppData\Local\Temp\4E79.tmp"80⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\4F25.tmp"C:\Users\Admin\AppData\Local\Temp\4F25.tmp"81⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\4FC1.tmp"C:\Users\Admin\AppData\Local\Temp\4FC1.tmp"82⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\505D.tmp"C:\Users\Admin\AppData\Local\Temp\505D.tmp"83⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\50CB.tmp"C:\Users\Admin\AppData\Local\Temp\50CB.tmp"84⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\5176.tmp"C:\Users\Admin\AppData\Local\Temp\5176.tmp"85⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\5203.tmp"C:\Users\Admin\AppData\Local\Temp\5203.tmp"86⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\529F.tmp"C:\Users\Admin\AppData\Local\Temp\529F.tmp"87⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\532C.tmp"C:\Users\Admin\AppData\Local\Temp\532C.tmp"88⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\53A9.tmp"C:\Users\Admin\AppData\Local\Temp\53A9.tmp"89⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\5416.tmp"C:\Users\Admin\AppData\Local\Temp\5416.tmp"90⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\5493.tmp"C:\Users\Admin\AppData\Local\Temp\5493.tmp"91⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\5520.tmp"C:\Users\Admin\AppData\Local\Temp\5520.tmp"92⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\55AD.tmp"C:\Users\Admin\AppData\Local\Temp\55AD.tmp"93⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\562A.tmp"C:\Users\Admin\AppData\Local\Temp\562A.tmp"94⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\56B6.tmp"C:\Users\Admin\AppData\Local\Temp\56B6.tmp"95⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\5733.tmp"C:\Users\Admin\AppData\Local\Temp\5733.tmp"96⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\57B0.tmp"C:\Users\Admin\AppData\Local\Temp\57B0.tmp"97⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\585C.tmp"C:\Users\Admin\AppData\Local\Temp\585C.tmp"98⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\58C9.tmp"C:\Users\Admin\AppData\Local\Temp\58C9.tmp"99⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\5975.tmp"C:\Users\Admin\AppData\Local\Temp\5975.tmp"100⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\5A02.tmp"C:\Users\Admin\AppData\Local\Temp\5A02.tmp"101⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"102⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\5B2B.tmp"C:\Users\Admin\AppData\Local\Temp\5B2B.tmp"103⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\5BC7.tmp"C:\Users\Admin\AppData\Local\Temp\5BC7.tmp"104⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\5C34.tmp"C:\Users\Admin\AppData\Local\Temp\5C34.tmp"105⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\5CF0.tmp"C:\Users\Admin\AppData\Local\Temp\5CF0.tmp"106⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\5D7D.tmp"C:\Users\Admin\AppData\Local\Temp\5D7D.tmp"107⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\5DFA.tmp"C:\Users\Admin\AppData\Local\Temp\5DFA.tmp"108⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\5E77.tmp"C:\Users\Admin\AppData\Local\Temp\5E77.tmp"109⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\5F22.tmp"C:\Users\Admin\AppData\Local\Temp\5F22.tmp"110⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\5FAF.tmp"C:\Users\Admin\AppData\Local\Temp\5FAF.tmp"111⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\603C.tmp"C:\Users\Admin\AppData\Local\Temp\603C.tmp"112⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\60B9.tmp"C:\Users\Admin\AppData\Local\Temp\60B9.tmp"113⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\6165.tmp"C:\Users\Admin\AppData\Local\Temp\6165.tmp"114⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\6201.tmp"C:\Users\Admin\AppData\Local\Temp\6201.tmp"115⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\628D.tmp"C:\Users\Admin\AppData\Local\Temp\628D.tmp"116⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\62FB.tmp"C:\Users\Admin\AppData\Local\Temp\62FB.tmp"117⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\6387.tmp"C:\Users\Admin\AppData\Local\Temp\6387.tmp"118⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\6433.tmp"C:\Users\Admin\AppData\Local\Temp\6433.tmp"119⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\64EF.tmp"C:\Users\Admin\AppData\Local\Temp\64EF.tmp"120⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\657B.tmp"C:\Users\Admin\AppData\Local\Temp\657B.tmp"121⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\65F8.tmp"C:\Users\Admin\AppData\Local\Temp\65F8.tmp"122⤵PID:5064
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-