Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
20/08/2023, 09:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4b1cdced09dbf8f9c81bed74412d2326_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
4b1cdced09dbf8f9c81bed74412d2326_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
4b1cdced09dbf8f9c81bed74412d2326_mafia_JC.exe
-
Size
487KB
-
MD5
4b1cdced09dbf8f9c81bed74412d2326
-
SHA1
5b1233a37e0e09a3d6b22f7982d87088ad81f320
-
SHA256
f30386e66bc7bba10ba55e022e00514c59d0a9de3c0caae18a9edf9624839966
-
SHA512
211e9d11cb31be6ffc0ca40c3835ed5d179ed152ed934c656fa814583a6b43a664f0ec772e6bca5867de9b25e94d177024021015e54e595426a7c7b53db2c05b
-
SSDEEP
12288:HU5rCOTeiJpSjB+uMZ2AT032I1eduvKtBaeNZ:HUQOJJpSAB84oitBaeN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5060 5D4E.tmp 2832 5E96.tmp 4696 5F61.tmp 2552 6685.tmp 1268 681B.tmp 3592 68F6.tmp 3880 69C1.tmp 1708 6ABB.tmp 4500 6B86.tmp 5000 6C23.tmp 2928 6CDE.tmp 2404 6DE8.tmp 212 6EA3.tmp 4352 6F8E.tmp 2376 7049.tmp 380 70E5.tmp 1232 7191.tmp 4496 724D.tmp 4872 72F9.tmp 3388 73E3.tmp 1184 749E.tmp 1756 7579.tmp 4580 7625.tmp 3892 7700.tmp 3952 77AC.tmp 3436 7886.tmp 1832 7952.tmp 2416 79FD.tmp 3692 7AE8.tmp 1596 7BA3.tmp 1740 7C30.tmp 2372 7CEB.tmp 2572 7DD6.tmp 4836 7E62.tmp 2032 7EDF.tmp 420 7F5C.tmp 4780 7FE9.tmp 1948 8066.tmp 1860 8102.tmp 3652 8170.tmp 4448 821C.tmp 3048 82A8.tmp 1000 8344.tmp 3696 83D1.tmp 1424 845E.tmp 1064 84FA.tmp 1848 8596.tmp 3632 8623.tmp 4152 86AF.tmp 2456 874C.tmp 2720 87E8.tmp 4456 8865.tmp 3420 8901.tmp 396 89BD.tmp 812 8A49.tmp 3948 8AF5.tmp 4524 8B72.tmp 2960 8BFF.tmp 3308 8C6C.tmp 4844 8CE9.tmp 4972 8D57.tmp 4700 8DD4.tmp 3148 8E60.tmp 3304 8EFC.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 640 wrote to memory of 5060 640 4b1cdced09dbf8f9c81bed74412d2326_mafia_JC.exe 81 PID 640 wrote to memory of 5060 640 4b1cdced09dbf8f9c81bed74412d2326_mafia_JC.exe 81 PID 640 wrote to memory of 5060 640 4b1cdced09dbf8f9c81bed74412d2326_mafia_JC.exe 81 PID 5060 wrote to memory of 2832 5060 5D4E.tmp 82 PID 5060 wrote to memory of 2832 5060 5D4E.tmp 82 PID 5060 wrote to memory of 2832 5060 5D4E.tmp 82 PID 2832 wrote to memory of 4696 2832 5E96.tmp 83 PID 2832 wrote to memory of 4696 2832 5E96.tmp 83 PID 2832 wrote to memory of 4696 2832 5E96.tmp 83 PID 4696 wrote to memory of 2552 4696 5F61.tmp 84 PID 4696 wrote to memory of 2552 4696 5F61.tmp 84 PID 4696 wrote to memory of 2552 4696 5F61.tmp 84 PID 2552 wrote to memory of 1268 2552 6685.tmp 85 PID 2552 wrote to memory of 1268 2552 6685.tmp 85 PID 2552 wrote to memory of 1268 2552 6685.tmp 85 PID 1268 wrote to memory of 3592 1268 681B.tmp 86 PID 1268 wrote to memory of 3592 1268 681B.tmp 86 PID 1268 wrote to memory of 3592 1268 681B.tmp 86 PID 3592 wrote to memory of 3880 3592 68F6.tmp 87 PID 3592 wrote to memory of 3880 3592 68F6.tmp 87 PID 3592 wrote to memory of 3880 3592 68F6.tmp 87 PID 3880 wrote to memory of 1708 3880 69C1.tmp 88 PID 3880 wrote to memory of 1708 3880 69C1.tmp 88 PID 3880 wrote to memory of 1708 3880 69C1.tmp 88 PID 1708 wrote to memory of 4500 1708 6ABB.tmp 89 PID 1708 wrote to memory of 4500 1708 6ABB.tmp 89 PID 1708 wrote to memory of 4500 1708 6ABB.tmp 89 PID 4500 wrote to memory of 5000 4500 6B86.tmp 90 PID 4500 wrote to memory of 5000 4500 6B86.tmp 90 PID 4500 wrote to memory of 5000 4500 6B86.tmp 90 PID 5000 wrote to memory of 2928 5000 6C23.tmp 91 PID 5000 wrote to memory of 2928 5000 6C23.tmp 91 PID 5000 wrote to memory of 2928 5000 6C23.tmp 91 PID 2928 wrote to memory of 2404 2928 6CDE.tmp 92 PID 2928 wrote to memory of 2404 2928 6CDE.tmp 92 PID 2928 wrote to memory of 2404 2928 6CDE.tmp 92 PID 2404 wrote to memory of 212 2404 6DE8.tmp 93 PID 2404 wrote to memory of 212 2404 6DE8.tmp 93 PID 2404 wrote to memory of 212 2404 6DE8.tmp 93 PID 212 wrote to memory of 4352 212 6EA3.tmp 95 PID 212 wrote to memory of 4352 212 6EA3.tmp 95 PID 212 wrote to memory of 4352 212 6EA3.tmp 95 PID 4352 wrote to memory of 2376 4352 6F8E.tmp 96 PID 4352 wrote to memory of 2376 4352 6F8E.tmp 96 PID 4352 wrote to memory of 2376 4352 6F8E.tmp 96 PID 2376 wrote to memory of 380 2376 7049.tmp 97 PID 2376 wrote to memory of 380 2376 7049.tmp 97 PID 2376 wrote to memory of 380 2376 7049.tmp 97 PID 380 wrote to memory of 1232 380 70E5.tmp 98 PID 380 wrote to memory of 1232 380 70E5.tmp 98 PID 380 wrote to memory of 1232 380 70E5.tmp 98 PID 1232 wrote to memory of 4496 1232 7191.tmp 99 PID 1232 wrote to memory of 4496 1232 7191.tmp 99 PID 1232 wrote to memory of 4496 1232 7191.tmp 99 PID 4496 wrote to memory of 4872 4496 724D.tmp 100 PID 4496 wrote to memory of 4872 4496 724D.tmp 100 PID 4496 wrote to memory of 4872 4496 724D.tmp 100 PID 4872 wrote to memory of 3388 4872 72F9.tmp 101 PID 4872 wrote to memory of 3388 4872 72F9.tmp 101 PID 4872 wrote to memory of 3388 4872 72F9.tmp 101 PID 3388 wrote to memory of 1184 3388 73E3.tmp 102 PID 3388 wrote to memory of 1184 3388 73E3.tmp 102 PID 3388 wrote to memory of 1184 3388 73E3.tmp 102 PID 1184 wrote to memory of 1756 1184 749E.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b1cdced09dbf8f9c81bed74412d2326_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\4b1cdced09dbf8f9c81bed74412d2326_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\5D4E.tmp"C:\Users\Admin\AppData\Local\Temp\5D4E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\5E96.tmp"C:\Users\Admin\AppData\Local\Temp\5E96.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\5F61.tmp"C:\Users\Admin\AppData\Local\Temp\5F61.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\6685.tmp"C:\Users\Admin\AppData\Local\Temp\6685.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\681B.tmp"C:\Users\Admin\AppData\Local\Temp\681B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\68F6.tmp"C:\Users\Admin\AppData\Local\Temp\68F6.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\69C1.tmp"C:\Users\Admin\AppData\Local\Temp\69C1.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\6ABB.tmp"C:\Users\Admin\AppData\Local\Temp\6ABB.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\6B86.tmp"C:\Users\Admin\AppData\Local\Temp\6B86.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\6C23.tmp"C:\Users\Admin\AppData\Local\Temp\6C23.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\6CDE.tmp"C:\Users\Admin\AppData\Local\Temp\6CDE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\6DE8.tmp"C:\Users\Admin\AppData\Local\Temp\6DE8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\6EA3.tmp"C:\Users\Admin\AppData\Local\Temp\6EA3.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\6F8E.tmp"C:\Users\Admin\AppData\Local\Temp\6F8E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\7049.tmp"C:\Users\Admin\AppData\Local\Temp\7049.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\70E5.tmp"C:\Users\Admin\AppData\Local\Temp\70E5.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\7191.tmp"C:\Users\Admin\AppData\Local\Temp\7191.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\724D.tmp"C:\Users\Admin\AppData\Local\Temp\724D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\72F9.tmp"C:\Users\Admin\AppData\Local\Temp\72F9.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\73E3.tmp"C:\Users\Admin\AppData\Local\Temp\73E3.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\749E.tmp"C:\Users\Admin\AppData\Local\Temp\749E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\7579.tmp"C:\Users\Admin\AppData\Local\Temp\7579.tmp"23⤵
- Executes dropped EXE
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\7625.tmp"C:\Users\Admin\AppData\Local\Temp\7625.tmp"24⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\7700.tmp"C:\Users\Admin\AppData\Local\Temp\7700.tmp"25⤵
- Executes dropped EXE
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\77AC.tmp"C:\Users\Admin\AppData\Local\Temp\77AC.tmp"26⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\7886.tmp"C:\Users\Admin\AppData\Local\Temp\7886.tmp"27⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\7952.tmp"C:\Users\Admin\AppData\Local\Temp\7952.tmp"28⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\79FD.tmp"C:\Users\Admin\AppData\Local\Temp\79FD.tmp"29⤵
- Executes dropped EXE
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\7AE8.tmp"C:\Users\Admin\AppData\Local\Temp\7AE8.tmp"30⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\7BA3.tmp"C:\Users\Admin\AppData\Local\Temp\7BA3.tmp"31⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\7C30.tmp"C:\Users\Admin\AppData\Local\Temp\7C30.tmp"32⤵
- Executes dropped EXE
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\7CEB.tmp"C:\Users\Admin\AppData\Local\Temp\7CEB.tmp"33⤵
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\7DD6.tmp"C:\Users\Admin\AppData\Local\Temp\7DD6.tmp"34⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\7E62.tmp"C:\Users\Admin\AppData\Local\Temp\7E62.tmp"35⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\7EDF.tmp"C:\Users\Admin\AppData\Local\Temp\7EDF.tmp"36⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\7F5C.tmp"C:\Users\Admin\AppData\Local\Temp\7F5C.tmp"37⤵
- Executes dropped EXE
PID:420 -
C:\Users\Admin\AppData\Local\Temp\7FE9.tmp"C:\Users\Admin\AppData\Local\Temp\7FE9.tmp"38⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\8066.tmp"C:\Users\Admin\AppData\Local\Temp\8066.tmp"39⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\8102.tmp"C:\Users\Admin\AppData\Local\Temp\8102.tmp"40⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\8170.tmp"C:\Users\Admin\AppData\Local\Temp\8170.tmp"41⤵
- Executes dropped EXE
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\821C.tmp"C:\Users\Admin\AppData\Local\Temp\821C.tmp"42⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\82A8.tmp"C:\Users\Admin\AppData\Local\Temp\82A8.tmp"43⤵
- Executes dropped EXE
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\8344.tmp"C:\Users\Admin\AppData\Local\Temp\8344.tmp"44⤵
- Executes dropped EXE
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\83D1.tmp"C:\Users\Admin\AppData\Local\Temp\83D1.tmp"45⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\845E.tmp"C:\Users\Admin\AppData\Local\Temp\845E.tmp"46⤵
- Executes dropped EXE
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\84FA.tmp"C:\Users\Admin\AppData\Local\Temp\84FA.tmp"47⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\8596.tmp"C:\Users\Admin\AppData\Local\Temp\8596.tmp"48⤵
- Executes dropped EXE
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\8623.tmp"C:\Users\Admin\AppData\Local\Temp\8623.tmp"49⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\86AF.tmp"C:\Users\Admin\AppData\Local\Temp\86AF.tmp"50⤵
- Executes dropped EXE
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\874C.tmp"C:\Users\Admin\AppData\Local\Temp\874C.tmp"51⤵
- Executes dropped EXE
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\87E8.tmp"C:\Users\Admin\AppData\Local\Temp\87E8.tmp"52⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\8865.tmp"C:\Users\Admin\AppData\Local\Temp\8865.tmp"53⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\8901.tmp"C:\Users\Admin\AppData\Local\Temp\8901.tmp"54⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\89BD.tmp"C:\Users\Admin\AppData\Local\Temp\89BD.tmp"55⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\8A49.tmp"C:\Users\Admin\AppData\Local\Temp\8A49.tmp"56⤵
- Executes dropped EXE
PID:812 -
C:\Users\Admin\AppData\Local\Temp\8AF5.tmp"C:\Users\Admin\AppData\Local\Temp\8AF5.tmp"57⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\8B72.tmp"C:\Users\Admin\AppData\Local\Temp\8B72.tmp"58⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\8BFF.tmp"C:\Users\Admin\AppData\Local\Temp\8BFF.tmp"59⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\8C6C.tmp"C:\Users\Admin\AppData\Local\Temp\8C6C.tmp"60⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\8CE9.tmp"C:\Users\Admin\AppData\Local\Temp\8CE9.tmp"61⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\8D57.tmp"C:\Users\Admin\AppData\Local\Temp\8D57.tmp"62⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\8DD4.tmp"C:\Users\Admin\AppData\Local\Temp\8DD4.tmp"63⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\8E60.tmp"C:\Users\Admin\AppData\Local\Temp\8E60.tmp"64⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\8EFC.tmp"C:\Users\Admin\AppData\Local\Temp\8EFC.tmp"65⤵
- Executes dropped EXE
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\8F6A.tmp"C:\Users\Admin\AppData\Local\Temp\8F6A.tmp"66⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\9006.tmp"C:\Users\Admin\AppData\Local\Temp\9006.tmp"67⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\9073.tmp"C:\Users\Admin\AppData\Local\Temp\9073.tmp"68⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\90E1.tmp"C:\Users\Admin\AppData\Local\Temp\90E1.tmp"69⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\914E.tmp"C:\Users\Admin\AppData\Local\Temp\914E.tmp"70⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\91EA.tmp"C:\Users\Admin\AppData\Local\Temp\91EA.tmp"71⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\9258.tmp"C:\Users\Admin\AppData\Local\Temp\9258.tmp"72⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\92C5.tmp"C:\Users\Admin\AppData\Local\Temp\92C5.tmp"73⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\9352.tmp"C:\Users\Admin\AppData\Local\Temp\9352.tmp"74⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\93CF.tmp"C:\Users\Admin\AppData\Local\Temp\93CF.tmp"75⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\943C.tmp"C:\Users\Admin\AppData\Local\Temp\943C.tmp"76⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\94D8.tmp"C:\Users\Admin\AppData\Local\Temp\94D8.tmp"77⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\9546.tmp"C:\Users\Admin\AppData\Local\Temp\9546.tmp"78⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\95C3.tmp"C:\Users\Admin\AppData\Local\Temp\95C3.tmp"79⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\9640.tmp"C:\Users\Admin\AppData\Local\Temp\9640.tmp"80⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\96AD.tmp"C:\Users\Admin\AppData\Local\Temp\96AD.tmp"81⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\9749.tmp"C:\Users\Admin\AppData\Local\Temp\9749.tmp"82⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\97B7.tmp"C:\Users\Admin\AppData\Local\Temp\97B7.tmp"83⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\9834.tmp"C:\Users\Admin\AppData\Local\Temp\9834.tmp"84⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\98A1.tmp"C:\Users\Admin\AppData\Local\Temp\98A1.tmp"85⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\991E.tmp"C:\Users\Admin\AppData\Local\Temp\991E.tmp"86⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\99BA.tmp"C:\Users\Admin\AppData\Local\Temp\99BA.tmp"87⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\9A57.tmp"C:\Users\Admin\AppData\Local\Temp\9A57.tmp"88⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\9AE3.tmp"C:\Users\Admin\AppData\Local\Temp\9AE3.tmp"89⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\9B60.tmp"C:\Users\Admin\AppData\Local\Temp\9B60.tmp"90⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\9BED.tmp"C:\Users\Admin\AppData\Local\Temp\9BED.tmp"91⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\9C7A.tmp"C:\Users\Admin\AppData\Local\Temp\9C7A.tmp"92⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\9CE7.tmp"C:\Users\Admin\AppData\Local\Temp\9CE7.tmp"93⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\9D54.tmp"C:\Users\Admin\AppData\Local\Temp\9D54.tmp"94⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\9DC2.tmp"C:\Users\Admin\AppData\Local\Temp\9DC2.tmp"95⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\9E6E.tmp"C:\Users\Admin\AppData\Local\Temp\9E6E.tmp"96⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\9EFA.tmp"C:\Users\Admin\AppData\Local\Temp\9EFA.tmp"97⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\9F77.tmp"C:\Users\Admin\AppData\Local\Temp\9F77.tmp"98⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\A004.tmp"C:\Users\Admin\AppData\Local\Temp\A004.tmp"99⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\A081.tmp"C:\Users\Admin\AppData\Local\Temp\A081.tmp"100⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\A0EE.tmp"C:\Users\Admin\AppData\Local\Temp\A0EE.tmp"101⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\A15C.tmp"C:\Users\Admin\AppData\Local\Temp\A15C.tmp"102⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\A1D9.tmp"C:\Users\Admin\AppData\Local\Temp\A1D9.tmp"103⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\A246.tmp"C:\Users\Admin\AppData\Local\Temp\A246.tmp"104⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\A2F2.tmp"C:\Users\Admin\AppData\Local\Temp\A2F2.tmp"105⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\A38E.tmp"C:\Users\Admin\AppData\Local\Temp\A38E.tmp"106⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\A3FB.tmp"C:\Users\Admin\AppData\Local\Temp\A3FB.tmp"107⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\A488.tmp"C:\Users\Admin\AppData\Local\Temp\A488.tmp"108⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\A515.tmp"C:\Users\Admin\AppData\Local\Temp\A515.tmp"109⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\A5A1.tmp"C:\Users\Admin\AppData\Local\Temp\A5A1.tmp"110⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\A64D.tmp"C:\Users\Admin\AppData\Local\Temp\A64D.tmp"111⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\A6DA.tmp"C:\Users\Admin\AppData\Local\Temp\A6DA.tmp"112⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\A766.tmp"C:\Users\Admin\AppData\Local\Temp\A766.tmp"113⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\A822.tmp"C:\Users\Admin\AppData\Local\Temp\A822.tmp"114⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\A89F.tmp"C:\Users\Admin\AppData\Local\Temp\A89F.tmp"115⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\A95A.tmp"C:\Users\Admin\AppData\Local\Temp\A95A.tmp"116⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\A9D7.tmp"C:\Users\Admin\AppData\Local\Temp\A9D7.tmp"117⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\AA54.tmp"C:\Users\Admin\AppData\Local\Temp\AA54.tmp"118⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\AAE1.tmp"C:\Users\Admin\AppData\Local\Temp\AAE1.tmp"119⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\AB6E.tmp"C:\Users\Admin\AppData\Local\Temp\AB6E.tmp"120⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\ABDB.tmp"C:\Users\Admin\AppData\Local\Temp\ABDB.tmp"121⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\AC58.tmp"C:\Users\Admin\AppData\Local\Temp\AC58.tmp"122⤵PID:3260
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-