Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2023, 16:21
Static task
static1
Behavioral task
behavioral1
Sample
5f13120fedcc27f1f53f4e6b8d175511_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
5f13120fedcc27f1f53f4e6b8d175511_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
5f13120fedcc27f1f53f4e6b8d175511_mafia_JC.exe
-
Size
486KB
-
MD5
5f13120fedcc27f1f53f4e6b8d175511
-
SHA1
838c87d8742b90fc79c4a3b58e97e10ac035179b
-
SHA256
b4a1497a642623cfe9728887bc8c2f3caf092222b36b12533d34dd463fc4ecfe
-
SHA512
42ac543a132969aa72f8949f86c9c328dfaeab34bf22768e2ac25765b9a711d473d00a50db4e9d7f6e61439302c0f95e3e1e0dfe28865e678fc0cd65a0514d4e
-
SSDEEP
6144:Forf3lPvovsgZnqG2C7mOTeiLfD74kJPCc2ip5VEpYp0AUAJQYagcF3GuI6dJR3x:UU5rCOTeiD4kJbVEe73QpgcIE3hNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4848 A306.tmp 3504 A856.tmp 2084 A901.tmp 2396 A9AD.tmp 2032 AA4A.tmp 4500 AB15.tmp 2000 ABB1.tmp 3028 AC6C.tmp 2856 AD09.tmp 3780 ADA5.tmp 1640 AE51.tmp 4244 AF3B.tmp 464 AFD7.tmp 2528 B083.tmp 380 B13F.tmp 3188 B1BC.tmp 1100 B248.tmp 3368 B2D5.tmp 3220 B381.tmp 3292 B44C.tmp 2136 B508.tmp 1304 B611.tmp 5004 B6BD.tmp 4592 B769.tmp 2508 B7F6.tmp 4088 B882.tmp 3764 B91E.tmp 544 B9F9.tmp 4232 BAC4.tmp 3852 BB9F.tmp 4448 BC5B.tmp 556 BD45.tmp 4596 BDC2.tmp 3024 BE3F.tmp 4804 BECC.tmp 684 BF77.tmp 4768 C004.tmp 2632 C081.tmp 3680 C11D.tmp 4052 C1AA.tmp 1072 C246.tmp 4336 C2E2.tmp 2164 C350.tmp 2028 C3CD.tmp 3088 C469.tmp 3276 C4F6.tmp 1216 C582.tmp 1908 C60F.tmp 224 C6AB.tmp 4800 C738.tmp 4704 C7C4.tmp 1944 C851.tmp 2712 C8CE.tmp 512 C96A.tmp 3608 C9E7.tmp 3816 CA74.tmp 3700 CB10.tmp 1436 CB9D.tmp 1848 CC49.tmp 748 CCC6.tmp 4024 CD62.tmp 396 CDCF.tmp 812 CE4C.tmp 2996 CEE9.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2176 wrote to memory of 4848 2176 5f13120fedcc27f1f53f4e6b8d175511_mafia_JC.exe 82 PID 2176 wrote to memory of 4848 2176 5f13120fedcc27f1f53f4e6b8d175511_mafia_JC.exe 82 PID 2176 wrote to memory of 4848 2176 5f13120fedcc27f1f53f4e6b8d175511_mafia_JC.exe 82 PID 4848 wrote to memory of 3504 4848 A306.tmp 83 PID 4848 wrote to memory of 3504 4848 A306.tmp 83 PID 4848 wrote to memory of 3504 4848 A306.tmp 83 PID 3504 wrote to memory of 2084 3504 A856.tmp 84 PID 3504 wrote to memory of 2084 3504 A856.tmp 84 PID 3504 wrote to memory of 2084 3504 A856.tmp 84 PID 2084 wrote to memory of 2396 2084 A901.tmp 85 PID 2084 wrote to memory of 2396 2084 A901.tmp 85 PID 2084 wrote to memory of 2396 2084 A901.tmp 85 PID 2396 wrote to memory of 2032 2396 A9AD.tmp 86 PID 2396 wrote to memory of 2032 2396 A9AD.tmp 86 PID 2396 wrote to memory of 2032 2396 A9AD.tmp 86 PID 2032 wrote to memory of 4500 2032 AA4A.tmp 88 PID 2032 wrote to memory of 4500 2032 AA4A.tmp 88 PID 2032 wrote to memory of 4500 2032 AA4A.tmp 88 PID 4500 wrote to memory of 2000 4500 AB15.tmp 89 PID 4500 wrote to memory of 2000 4500 AB15.tmp 89 PID 4500 wrote to memory of 2000 4500 AB15.tmp 89 PID 2000 wrote to memory of 3028 2000 ABB1.tmp 90 PID 2000 wrote to memory of 3028 2000 ABB1.tmp 90 PID 2000 wrote to memory of 3028 2000 ABB1.tmp 90 PID 3028 wrote to memory of 2856 3028 AC6C.tmp 91 PID 3028 wrote to memory of 2856 3028 AC6C.tmp 91 PID 3028 wrote to memory of 2856 3028 AC6C.tmp 91 PID 2856 wrote to memory of 3780 2856 AD09.tmp 92 PID 2856 wrote to memory of 3780 2856 AD09.tmp 92 PID 2856 wrote to memory of 3780 2856 AD09.tmp 92 PID 3780 wrote to memory of 1640 3780 ADA5.tmp 93 PID 3780 wrote to memory of 1640 3780 ADA5.tmp 93 PID 3780 wrote to memory of 1640 3780 ADA5.tmp 93 PID 1640 wrote to memory of 4244 1640 AE51.tmp 94 PID 1640 wrote to memory of 4244 1640 AE51.tmp 94 PID 1640 wrote to memory of 4244 1640 AE51.tmp 94 PID 4244 wrote to memory of 464 4244 AF3B.tmp 95 PID 4244 wrote to memory of 464 4244 AF3B.tmp 95 PID 4244 wrote to memory of 464 4244 AF3B.tmp 95 PID 464 wrote to memory of 2528 464 AFD7.tmp 96 PID 464 wrote to memory of 2528 464 AFD7.tmp 96 PID 464 wrote to memory of 2528 464 AFD7.tmp 96 PID 2528 wrote to memory of 380 2528 B083.tmp 97 PID 2528 wrote to memory of 380 2528 B083.tmp 97 PID 2528 wrote to memory of 380 2528 B083.tmp 97 PID 380 wrote to memory of 3188 380 B13F.tmp 98 PID 380 wrote to memory of 3188 380 B13F.tmp 98 PID 380 wrote to memory of 3188 380 B13F.tmp 98 PID 3188 wrote to memory of 1100 3188 B1BC.tmp 101 PID 3188 wrote to memory of 1100 3188 B1BC.tmp 101 PID 3188 wrote to memory of 1100 3188 B1BC.tmp 101 PID 1100 wrote to memory of 3368 1100 B248.tmp 102 PID 1100 wrote to memory of 3368 1100 B248.tmp 102 PID 1100 wrote to memory of 3368 1100 B248.tmp 102 PID 3368 wrote to memory of 3220 3368 B2D5.tmp 103 PID 3368 wrote to memory of 3220 3368 B2D5.tmp 103 PID 3368 wrote to memory of 3220 3368 B2D5.tmp 103 PID 3220 wrote to memory of 3292 3220 B381.tmp 104 PID 3220 wrote to memory of 3292 3220 B381.tmp 104 PID 3220 wrote to memory of 3292 3220 B381.tmp 104 PID 3292 wrote to memory of 2136 3292 B44C.tmp 105 PID 3292 wrote to memory of 2136 3292 B44C.tmp 105 PID 3292 wrote to memory of 2136 3292 B44C.tmp 105 PID 2136 wrote to memory of 1304 2136 B508.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f13120fedcc27f1f53f4e6b8d175511_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\5f13120fedcc27f1f53f4e6b8d175511_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\A306.tmp"C:\Users\Admin\AppData\Local\Temp\A306.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\A856.tmp"C:\Users\Admin\AppData\Local\Temp\A856.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\AB15.tmp"C:\Users\Admin\AppData\Local\Temp\AB15.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\AD09.tmp"C:\Users\Admin\AppData\Local\Temp\AD09.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\AE51.tmp"C:\Users\Admin\AppData\Local\Temp\AE51.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\B083.tmp"C:\Users\Admin\AppData\Local\Temp\B083.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\B381.tmp"C:\Users\Admin\AppData\Local\Temp\B381.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\B508.tmp"C:\Users\Admin\AppData\Local\Temp\B508.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\B611.tmp"C:\Users\Admin\AppData\Local\Temp\B611.tmp"23⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"24⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\B769.tmp"C:\Users\Admin\AppData\Local\Temp\B769.tmp"25⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"26⤵
- Executes dropped EXE
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\B882.tmp"C:\Users\Admin\AppData\Local\Temp\B882.tmp"27⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\B91E.tmp"C:\Users\Admin\AppData\Local\Temp\B91E.tmp"28⤵
- Executes dropped EXE
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"29⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"30⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"31⤵
- Executes dropped EXE
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"32⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\BD45.tmp"C:\Users\Admin\AppData\Local\Temp\BD45.tmp"33⤵
- Executes dropped EXE
PID:556 -
C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"34⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"35⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"36⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\BF77.tmp"C:\Users\Admin\AppData\Local\Temp\BF77.tmp"37⤵
- Executes dropped EXE
PID:684 -
C:\Users\Admin\AppData\Local\Temp\C004.tmp"C:\Users\Admin\AppData\Local\Temp\C004.tmp"38⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"39⤵
- Executes dropped EXE
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\C11D.tmp"C:\Users\Admin\AppData\Local\Temp\C11D.tmp"40⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"41⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\C246.tmp"C:\Users\Admin\AppData\Local\Temp\C246.tmp"42⤵
- Executes dropped EXE
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"43⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\C350.tmp"C:\Users\Admin\AppData\Local\Temp\C350.tmp"44⤵
- Executes dropped EXE
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"45⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\C469.tmp"C:\Users\Admin\AppData\Local\Temp\C469.tmp"46⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"47⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\C582.tmp"C:\Users\Admin\AppData\Local\Temp\C582.tmp"48⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\C60F.tmp"C:\Users\Admin\AppData\Local\Temp\C60F.tmp"49⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"50⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\C738.tmp"C:\Users\Admin\AppData\Local\Temp\C738.tmp"51⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"52⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\C851.tmp"C:\Users\Admin\AppData\Local\Temp\C851.tmp"53⤵
- Executes dropped EXE
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"54⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\C96A.tmp"C:\Users\Admin\AppData\Local\Temp\C96A.tmp"55⤵
- Executes dropped EXE
PID:512 -
C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"56⤵
- Executes dropped EXE
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\CA74.tmp"C:\Users\Admin\AppData\Local\Temp\CA74.tmp"57⤵
- Executes dropped EXE
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\CB10.tmp"C:\Users\Admin\AppData\Local\Temp\CB10.tmp"58⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"59⤵
- Executes dropped EXE
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\CC49.tmp"C:\Users\Admin\AppData\Local\Temp\CC49.tmp"60⤵
- Executes dropped EXE
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\CCC6.tmp"C:\Users\Admin\AppData\Local\Temp\CCC6.tmp"61⤵
- Executes dropped EXE
PID:748 -
C:\Users\Admin\AppData\Local\Temp\CD62.tmp"C:\Users\Admin\AppData\Local\Temp\CD62.tmp"62⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"63⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"64⤵
- Executes dropped EXE
PID:812 -
C:\Users\Admin\AppData\Local\Temp\CEE9.tmp"C:\Users\Admin\AppData\Local\Temp\CEE9.tmp"65⤵
- Executes dropped EXE
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\CF66.tmp"C:\Users\Admin\AppData\Local\Temp\CF66.tmp"66⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"67⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\D031.tmp"C:\Users\Admin\AppData\Local\Temp\D031.tmp"68⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"69⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\D0FC.tmp"C:\Users\Admin\AppData\Local\Temp\D0FC.tmp"70⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\D15A.tmp"C:\Users\Admin\AppData\Local\Temp\D15A.tmp"71⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"72⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\D273.tmp"C:\Users\Admin\AppData\Local\Temp\D273.tmp"73⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\D30F.tmp"C:\Users\Admin\AppData\Local\Temp\D30F.tmp"74⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\D38C.tmp"C:\Users\Admin\AppData\Local\Temp\D38C.tmp"75⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\D409.tmp"C:\Users\Admin\AppData\Local\Temp\D409.tmp"76⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\D486.tmp"C:\Users\Admin\AppData\Local\Temp\D486.tmp"77⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"78⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\D542.tmp"C:\Users\Admin\AppData\Local\Temp\D542.tmp"79⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\D5ED.tmp"C:\Users\Admin\AppData\Local\Temp\D5ED.tmp"80⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\D66A.tmp"C:\Users\Admin\AppData\Local\Temp\D66A.tmp"81⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\D6D8.tmp"C:\Users\Admin\AppData\Local\Temp\D6D8.tmp"82⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\D755.tmp"C:\Users\Admin\AppData\Local\Temp\D755.tmp"83⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\D7F1.tmp"C:\Users\Admin\AppData\Local\Temp\D7F1.tmp"84⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\D87E.tmp"C:\Users\Admin\AppData\Local\Temp\D87E.tmp"85⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"86⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\D949.tmp"C:\Users\Admin\AppData\Local\Temp\D949.tmp"87⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"88⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\DA52.tmp"C:\Users\Admin\AppData\Local\Temp\DA52.tmp"89⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\DAEF.tmp"C:\Users\Admin\AppData\Local\Temp\DAEF.tmp"90⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\DB6C.tmp"C:\Users\Admin\AppData\Local\Temp\DB6C.tmp"91⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\DBD9.tmp"C:\Users\Admin\AppData\Local\Temp\DBD9.tmp"92⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\DC56.tmp"C:\Users\Admin\AppData\Local\Temp\DC56.tmp"93⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\DCC3.tmp"C:\Users\Admin\AppData\Local\Temp\DCC3.tmp"94⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\DD31.tmp"C:\Users\Admin\AppData\Local\Temp\DD31.tmp"95⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\DDDD.tmp"C:\Users\Admin\AppData\Local\Temp\DDDD.tmp"96⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\DE69.tmp"C:\Users\Admin\AppData\Local\Temp\DE69.tmp"97⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"98⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\DF73.tmp"C:\Users\Admin\AppData\Local\Temp\DF73.tmp"99⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\DFE0.tmp"C:\Users\Admin\AppData\Local\Temp\DFE0.tmp"100⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\E08C.tmp"C:\Users\Admin\AppData\Local\Temp\E08C.tmp"101⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\E119.tmp"C:\Users\Admin\AppData\Local\Temp\E119.tmp"102⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\E186.tmp"C:\Users\Admin\AppData\Local\Temp\E186.tmp"103⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\E213.tmp"C:\Users\Admin\AppData\Local\Temp\E213.tmp"104⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\E2AF.tmp"C:\Users\Admin\AppData\Local\Temp\E2AF.tmp"105⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\E33C.tmp"C:\Users\Admin\AppData\Local\Temp\E33C.tmp"106⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"107⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\E445.tmp"C:\Users\Admin\AppData\Local\Temp\E445.tmp"108⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\E4D2.tmp"C:\Users\Admin\AppData\Local\Temp\E4D2.tmp"109⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\E55F.tmp"C:\Users\Admin\AppData\Local\Temp\E55F.tmp"110⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\E5EB.tmp"C:\Users\Admin\AppData\Local\Temp\E5EB.tmp"111⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\E678.tmp"C:\Users\Admin\AppData\Local\Temp\E678.tmp"112⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\E714.tmp"C:\Users\Admin\AppData\Local\Temp\E714.tmp"113⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"114⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\E81E.tmp"C:\Users\Admin\AppData\Local\Temp\E81E.tmp"115⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"116⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\E947.tmp"C:\Users\Admin\AppData\Local\Temp\E947.tmp"117⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\E9E3.tmp"C:\Users\Admin\AppData\Local\Temp\E9E3.tmp"118⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\EA60.tmp"C:\Users\Admin\AppData\Local\Temp\EA60.tmp"119⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\EACD.tmp"C:\Users\Admin\AppData\Local\Temp\EACD.tmp"120⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\EB69.tmp"C:\Users\Admin\AppData\Local\Temp\EB69.tmp"121⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"122⤵PID:1828
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-