Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2023, 16:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
615807153cc7c75e9feb190c4f0fda65_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
615807153cc7c75e9feb190c4f0fda65_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
615807153cc7c75e9feb190c4f0fda65_mafia_JC.exe
-
Size
486KB
-
MD5
615807153cc7c75e9feb190c4f0fda65
-
SHA1
c62a047fe19f779164e54fae15e44481d41f67b3
-
SHA256
0ad0003ff579133c59940c7303879fcf713698ee23988c90f9bb863a707b241c
-
SHA512
da2643016b50c08c3e121ebd6aa57611dde4c684a3be1b387fd3e8111e4cbf8b4e030586840b53bfc3f2bd92b7595347cc5beeec7a566cc331822a47520e0bb6
-
SSDEEP
12288:UU5rCOTeiD/L9uUim0e7RzKNgbFoBi83jaENZ:UUQOJD/Df0e12GZoBi8XN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2144 6E2B.tmp 4924 6EF6.tmp 224 6FB2.tmp 2844 708C.tmp 4028 7177.tmp 2860 7232.tmp 1760 72FD.tmp 1228 7407.tmp 1264 74D2.tmp 4388 758E.tmp 2740 7678.tmp 932 7743.tmp 2108 787C.tmp 2036 7956.tmp 5012 7A31.tmp 1584 7B0C.tmp 4908 7BA8.tmp 2776 7C92.tmp 2192 7DCB.tmp 1896 7E86.tmp 4364 7F42.tmp 4660 800D.tmp 2136 80A9.tmp 1056 8165.tmp 3512 8201.tmp 1492 829D.tmp 744 831A.tmp 2056 83B7.tmp 408 8462.tmp 2536 851E.tmp 3704 85BA.tmp 464 8666.tmp 512 8712.tmp 2676 87AE.tmp 4980 882B.tmp 2396 88D7.tmp 4836 8983.tmp 3892 8A00.tmp 3868 8AAC.tmp 1956 8B38.tmp 1484 8BD5.tmp 2208 8C52.tmp 3236 8CEE.tmp 964 8D9A.tmp 4920 8E36.tmp 3940 8EE2.tmp 3028 8F5F.tmp 4276 8FFB.tmp 2356 9088.tmp 1804 9124.tmp 372 91B1.tmp 2840 923D.tmp 4936 92DA.tmp 212 9366.tmp 1808 93C4.tmp 4772 9441.tmp 952 94BE.tmp 3652 955A.tmp 908 95F6.tmp 1864 9664.tmp 848 9710.tmp 4948 979C.tmp 4756 980A.tmp 780 9887.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 208 wrote to memory of 2144 208 615807153cc7c75e9feb190c4f0fda65_mafia_JC.exe 83 PID 208 wrote to memory of 2144 208 615807153cc7c75e9feb190c4f0fda65_mafia_JC.exe 83 PID 208 wrote to memory of 2144 208 615807153cc7c75e9feb190c4f0fda65_mafia_JC.exe 83 PID 2144 wrote to memory of 4924 2144 6E2B.tmp 84 PID 2144 wrote to memory of 4924 2144 6E2B.tmp 84 PID 2144 wrote to memory of 4924 2144 6E2B.tmp 84 PID 4924 wrote to memory of 224 4924 6EF6.tmp 85 PID 4924 wrote to memory of 224 4924 6EF6.tmp 85 PID 4924 wrote to memory of 224 4924 6EF6.tmp 85 PID 224 wrote to memory of 2844 224 6FB2.tmp 86 PID 224 wrote to memory of 2844 224 6FB2.tmp 86 PID 224 wrote to memory of 2844 224 6FB2.tmp 86 PID 2844 wrote to memory of 4028 2844 708C.tmp 87 PID 2844 wrote to memory of 4028 2844 708C.tmp 87 PID 2844 wrote to memory of 4028 2844 708C.tmp 87 PID 4028 wrote to memory of 2860 4028 7177.tmp 88 PID 4028 wrote to memory of 2860 4028 7177.tmp 88 PID 4028 wrote to memory of 2860 4028 7177.tmp 88 PID 2860 wrote to memory of 1760 2860 7232.tmp 89 PID 2860 wrote to memory of 1760 2860 7232.tmp 89 PID 2860 wrote to memory of 1760 2860 7232.tmp 89 PID 1760 wrote to memory of 1228 1760 72FD.tmp 90 PID 1760 wrote to memory of 1228 1760 72FD.tmp 90 PID 1760 wrote to memory of 1228 1760 72FD.tmp 90 PID 1228 wrote to memory of 1264 1228 7407.tmp 91 PID 1228 wrote to memory of 1264 1228 7407.tmp 91 PID 1228 wrote to memory of 1264 1228 7407.tmp 91 PID 1264 wrote to memory of 4388 1264 74D2.tmp 92 PID 1264 wrote to memory of 4388 1264 74D2.tmp 92 PID 1264 wrote to memory of 4388 1264 74D2.tmp 92 PID 4388 wrote to memory of 2740 4388 758E.tmp 93 PID 4388 wrote to memory of 2740 4388 758E.tmp 93 PID 4388 wrote to memory of 2740 4388 758E.tmp 93 PID 2740 wrote to memory of 932 2740 7678.tmp 94 PID 2740 wrote to memory of 932 2740 7678.tmp 94 PID 2740 wrote to memory of 932 2740 7678.tmp 94 PID 932 wrote to memory of 2108 932 7743.tmp 95 PID 932 wrote to memory of 2108 932 7743.tmp 95 PID 932 wrote to memory of 2108 932 7743.tmp 95 PID 2108 wrote to memory of 2036 2108 787C.tmp 96 PID 2108 wrote to memory of 2036 2108 787C.tmp 96 PID 2108 wrote to memory of 2036 2108 787C.tmp 96 PID 2036 wrote to memory of 5012 2036 7956.tmp 97 PID 2036 wrote to memory of 5012 2036 7956.tmp 97 PID 2036 wrote to memory of 5012 2036 7956.tmp 97 PID 5012 wrote to memory of 1584 5012 7A31.tmp 98 PID 5012 wrote to memory of 1584 5012 7A31.tmp 98 PID 5012 wrote to memory of 1584 5012 7A31.tmp 98 PID 1584 wrote to memory of 4908 1584 7B0C.tmp 101 PID 1584 wrote to memory of 4908 1584 7B0C.tmp 101 PID 1584 wrote to memory of 4908 1584 7B0C.tmp 101 PID 4908 wrote to memory of 2776 4908 7BA8.tmp 102 PID 4908 wrote to memory of 2776 4908 7BA8.tmp 102 PID 4908 wrote to memory of 2776 4908 7BA8.tmp 102 PID 2776 wrote to memory of 2192 2776 7C92.tmp 103 PID 2776 wrote to memory of 2192 2776 7C92.tmp 103 PID 2776 wrote to memory of 2192 2776 7C92.tmp 103 PID 2192 wrote to memory of 1896 2192 7DCB.tmp 104 PID 2192 wrote to memory of 1896 2192 7DCB.tmp 104 PID 2192 wrote to memory of 1896 2192 7DCB.tmp 104 PID 1896 wrote to memory of 4364 1896 7E86.tmp 105 PID 1896 wrote to memory of 4364 1896 7E86.tmp 105 PID 1896 wrote to memory of 4364 1896 7E86.tmp 105 PID 4364 wrote to memory of 4660 4364 7F42.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\615807153cc7c75e9feb190c4f0fda65_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\615807153cc7c75e9feb190c4f0fda65_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\7177.tmp"C:\Users\Admin\AppData\Local\Temp\7177.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\7232.tmp"C:\Users\Admin\AppData\Local\Temp\7232.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\7743.tmp"C:\Users\Admin\AppData\Local\Temp\7743.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\7956.tmp"C:\Users\Admin\AppData\Local\Temp\7956.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\7C92.tmp"C:\Users\Admin\AppData\Local\Temp\7C92.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\7F42.tmp"C:\Users\Admin\AppData\Local\Temp\7F42.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\800D.tmp"C:\Users\Admin\AppData\Local\Temp\800D.tmp"23⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\80A9.tmp"C:\Users\Admin\AppData\Local\Temp\80A9.tmp"24⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\8165.tmp"C:\Users\Admin\AppData\Local\Temp\8165.tmp"25⤵
- Executes dropped EXE
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\8201.tmp"C:\Users\Admin\AppData\Local\Temp\8201.tmp"26⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\829D.tmp"C:\Users\Admin\AppData\Local\Temp\829D.tmp"27⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"28⤵
- Executes dropped EXE
PID:744 -
C:\Users\Admin\AppData\Local\Temp\83B7.tmp"C:\Users\Admin\AppData\Local\Temp\83B7.tmp"29⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\8462.tmp"C:\Users\Admin\AppData\Local\Temp\8462.tmp"30⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\851E.tmp"C:\Users\Admin\AppData\Local\Temp\851E.tmp"31⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\85BA.tmp"C:\Users\Admin\AppData\Local\Temp\85BA.tmp"32⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\8666.tmp"C:\Users\Admin\AppData\Local\Temp\8666.tmp"33⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\8712.tmp"C:\Users\Admin\AppData\Local\Temp\8712.tmp"34⤵
- Executes dropped EXE
PID:512 -
C:\Users\Admin\AppData\Local\Temp\87AE.tmp"C:\Users\Admin\AppData\Local\Temp\87AE.tmp"35⤵
- Executes dropped EXE
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\882B.tmp"C:\Users\Admin\AppData\Local\Temp\882B.tmp"36⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"37⤵
- Executes dropped EXE
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\8983.tmp"C:\Users\Admin\AppData\Local\Temp\8983.tmp"38⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\8A00.tmp"C:\Users\Admin\AppData\Local\Temp\8A00.tmp"39⤵
- Executes dropped EXE
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"40⤵
- Executes dropped EXE
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\8B38.tmp"C:\Users\Admin\AppData\Local\Temp\8B38.tmp"41⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"42⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"43⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"44⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"45⤵
- Executes dropped EXE
PID:964 -
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp"46⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"47⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"48⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"49⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"50⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"51⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\91B1.tmp"C:\Users\Admin\AppData\Local\Temp\91B1.tmp"52⤵
- Executes dropped EXE
PID:372 -
C:\Users\Admin\AppData\Local\Temp\923D.tmp"C:\Users\Admin\AppData\Local\Temp\923D.tmp"53⤵
- Executes dropped EXE
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\92DA.tmp"C:\Users\Admin\AppData\Local\Temp\92DA.tmp"54⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\9366.tmp"C:\Users\Admin\AppData\Local\Temp\9366.tmp"55⤵
- Executes dropped EXE
PID:212 -
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"56⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\9441.tmp"C:\Users\Admin\AppData\Local\Temp\9441.tmp"57⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\94BE.tmp"C:\Users\Admin\AppData\Local\Temp\94BE.tmp"58⤵
- Executes dropped EXE
PID:952 -
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"59⤵
- Executes dropped EXE
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\95F6.tmp"C:\Users\Admin\AppData\Local\Temp\95F6.tmp"60⤵
- Executes dropped EXE
PID:908 -
C:\Users\Admin\AppData\Local\Temp\9664.tmp"C:\Users\Admin\AppData\Local\Temp\9664.tmp"61⤵
- Executes dropped EXE
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\9710.tmp"C:\Users\Admin\AppData\Local\Temp\9710.tmp"62⤵
- Executes dropped EXE
PID:848 -
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"63⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"64⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"65⤵
- Executes dropped EXE
PID:780 -
C:\Users\Admin\AppData\Local\Temp\9904.tmp"C:\Users\Admin\AppData\Local\Temp\9904.tmp"66⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"67⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"68⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"69⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"70⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"71⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"72⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"73⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"74⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"75⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\9E15.tmp"C:\Users\Admin\AppData\Local\Temp\9E15.tmp"76⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"77⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"78⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"79⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"80⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"81⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"82⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"83⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"84⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"85⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"86⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"87⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"88⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"89⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\A539.tmp"C:\Users\Admin\AppData\Local\Temp\A539.tmp"90⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"91⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\A633.tmp"C:\Users\Admin\AppData\Local\Temp\A633.tmp"92⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"93⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\A73C.tmp"C:\Users\Admin\AppData\Local\Temp\A73C.tmp"94⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"95⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"96⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"97⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"98⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"99⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"100⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"101⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"102⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"103⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"104⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"105⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"106⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\AE70.tmp"C:\Users\Admin\AppData\Local\Temp\AE70.tmp"107⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"108⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"109⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"110⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\B054.tmp"C:\Users\Admin\AppData\Local\Temp\B054.tmp"111⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"112⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\B15E.tmp"C:\Users\Admin\AppData\Local\Temp\B15E.tmp"113⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"114⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\B239.tmp"C:\Users\Admin\AppData\Local\Temp\B239.tmp"115⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"116⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"117⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\B42D.tmp"C:\Users\Admin\AppData\Local\Temp\B42D.tmp"118⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"119⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\B517.tmp"C:\Users\Admin\AppData\Local\Temp\B517.tmp"120⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"121⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"122⤵PID:1160
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-