Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
29/09/2023, 19:55
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-26_d60c38cf6d86a3b741e4f4f99d6a5ef9_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-26_d60c38cf6d86a3b741e4f4f99d6a5ef9_mafia_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2023-08-26_d60c38cf6d86a3b741e4f4f99d6a5ef9_mafia_JC.exe
-
Size
486KB
-
MD5
d60c38cf6d86a3b741e4f4f99d6a5ef9
-
SHA1
949805086415b4c20655f68cc1e24f6bfc5956b5
-
SHA256
b9c8f59127bc30a20c44a513918c1edb3a9a2c194afb6129d80aff4918545b72
-
SHA512
bc89907561600a2840fb07fcd4a5150e6cf3a1ea28c68118bff6b3e57ddf1566d420010c9d72f5a09d035038b78fda27d1ab9393160d24048aa5572899b7758e
-
SSDEEP
12288:/U5rCOTeiDtuMam+pdmbHPwi3cGlKonjWXhANZ:/UQOJDtEmwgPwlGZKRAN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3968 BD83.tmp 1188 BE3F.tmp 1940 BEFA.tmp 1016 BF97.tmp 628 C071.tmp 3632 C12D.tmp 3992 C208.tmp 1124 C2C3.tmp 1392 C35F.tmp 3668 C40B.tmp 3436 C479.tmp 1484 C544.tmp 1332 C5F0.tmp 2408 C776.tmp 4396 C832.tmp 1232 C8FD.tmp 4792 C9C8.tmp 3736 CAA3.tmp 3356 CB6E.tmp 1908 CC0A.tmp 1436 CC78.tmp 3104 CD04.tmp 1152 CDC0.tmp 4920 CEAA.tmp 3684 CF75.tmp 3268 D021.tmp 332 D0BD.tmp 5060 D169.tmp 1164 D234.tmp 1256 D2D1.tmp 3336 D3AB.tmp 828 D486.tmp 4696 D59F.tmp 1604 D64B.tmp 4120 D6C8.tmp 4112 D774.tmp 4876 D7E1.tmp 4296 D83F.tmp 1940 D8AD.tmp 904 D92A.tmp 3204 D987.tmp 628 DA04.tmp 4108 DA81.tmp 3748 DB1E.tmp 3368 DBBA.tmp 3996 DD31.tmp 2568 DDAE.tmp 988 DE2B.tmp 4804 DEC7.tmp 1372 DF73.tmp 2700 DFD1.tmp 1796 E04E.tmp 4964 E0DA.tmp 4396 E177.tmp 4616 E1E4.tmp 1028 E261.tmp 4792 E2EE.tmp 3800 E35B.tmp 2512 E3E8.tmp 4984 E474.tmp 4912 E530.tmp 4928 E58D.tmp 3844 E61A.tmp 1780 E6A7.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5112 wrote to memory of 3968 5112 2023-08-26_d60c38cf6d86a3b741e4f4f99d6a5ef9_mafia_JC.exe 85 PID 5112 wrote to memory of 3968 5112 2023-08-26_d60c38cf6d86a3b741e4f4f99d6a5ef9_mafia_JC.exe 85 PID 5112 wrote to memory of 3968 5112 2023-08-26_d60c38cf6d86a3b741e4f4f99d6a5ef9_mafia_JC.exe 85 PID 3968 wrote to memory of 1188 3968 BD83.tmp 86 PID 3968 wrote to memory of 1188 3968 BD83.tmp 86 PID 3968 wrote to memory of 1188 3968 BD83.tmp 86 PID 1188 wrote to memory of 1940 1188 BE3F.tmp 87 PID 1188 wrote to memory of 1940 1188 BE3F.tmp 87 PID 1188 wrote to memory of 1940 1188 BE3F.tmp 87 PID 1940 wrote to memory of 1016 1940 BEFA.tmp 88 PID 1940 wrote to memory of 1016 1940 BEFA.tmp 88 PID 1940 wrote to memory of 1016 1940 BEFA.tmp 88 PID 1016 wrote to memory of 628 1016 BF97.tmp 89 PID 1016 wrote to memory of 628 1016 BF97.tmp 89 PID 1016 wrote to memory of 628 1016 BF97.tmp 89 PID 628 wrote to memory of 3632 628 C071.tmp 90 PID 628 wrote to memory of 3632 628 C071.tmp 90 PID 628 wrote to memory of 3632 628 C071.tmp 90 PID 3632 wrote to memory of 3992 3632 C12D.tmp 91 PID 3632 wrote to memory of 3992 3632 C12D.tmp 91 PID 3632 wrote to memory of 3992 3632 C12D.tmp 91 PID 3992 wrote to memory of 1124 3992 C208.tmp 93 PID 3992 wrote to memory of 1124 3992 C208.tmp 93 PID 3992 wrote to memory of 1124 3992 C208.tmp 93 PID 1124 wrote to memory of 1392 1124 C2C3.tmp 94 PID 1124 wrote to memory of 1392 1124 C2C3.tmp 94 PID 1124 wrote to memory of 1392 1124 C2C3.tmp 94 PID 1392 wrote to memory of 3668 1392 C35F.tmp 95 PID 1392 wrote to memory of 3668 1392 C35F.tmp 95 PID 1392 wrote to memory of 3668 1392 C35F.tmp 95 PID 3668 wrote to memory of 3436 3668 C40B.tmp 96 PID 3668 wrote to memory of 3436 3668 C40B.tmp 96 PID 3668 wrote to memory of 3436 3668 C40B.tmp 96 PID 3436 wrote to memory of 1484 3436 C479.tmp 97 PID 3436 wrote to memory of 1484 3436 C479.tmp 97 PID 3436 wrote to memory of 1484 3436 C479.tmp 97 PID 1484 wrote to memory of 1332 1484 C544.tmp 98 PID 1484 wrote to memory of 1332 1484 C544.tmp 98 PID 1484 wrote to memory of 1332 1484 C544.tmp 98 PID 1332 wrote to memory of 2408 1332 C5F0.tmp 99 PID 1332 wrote to memory of 2408 1332 C5F0.tmp 99 PID 1332 wrote to memory of 2408 1332 C5F0.tmp 99 PID 2408 wrote to memory of 4396 2408 C776.tmp 100 PID 2408 wrote to memory of 4396 2408 C776.tmp 100 PID 2408 wrote to memory of 4396 2408 C776.tmp 100 PID 4396 wrote to memory of 1232 4396 C832.tmp 101 PID 4396 wrote to memory of 1232 4396 C832.tmp 101 PID 4396 wrote to memory of 1232 4396 C832.tmp 101 PID 1232 wrote to memory of 4792 1232 C8FD.tmp 104 PID 1232 wrote to memory of 4792 1232 C8FD.tmp 104 PID 1232 wrote to memory of 4792 1232 C8FD.tmp 104 PID 4792 wrote to memory of 3736 4792 C9C8.tmp 105 PID 4792 wrote to memory of 3736 4792 C9C8.tmp 105 PID 4792 wrote to memory of 3736 4792 C9C8.tmp 105 PID 3736 wrote to memory of 3356 3736 CAA3.tmp 107 PID 3736 wrote to memory of 3356 3736 CAA3.tmp 107 PID 3736 wrote to memory of 3356 3736 CAA3.tmp 107 PID 3356 wrote to memory of 1908 3356 CB6E.tmp 108 PID 3356 wrote to memory of 1908 3356 CB6E.tmp 108 PID 3356 wrote to memory of 1908 3356 CB6E.tmp 108 PID 1908 wrote to memory of 1436 1908 CC0A.tmp 109 PID 1908 wrote to memory of 1436 1908 CC0A.tmp 109 PID 1908 wrote to memory of 1436 1908 CC0A.tmp 109 PID 1436 wrote to memory of 3104 1436 CC78.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-26_d60c38cf6d86a3b741e4f4f99d6a5ef9_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-26_d60c38cf6d86a3b741e4f4f99d6a5ef9_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\BD83.tmp"C:\Users\Admin\AppData\Local\Temp\BD83.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\BF97.tmp"C:\Users\Admin\AppData\Local\Temp\BF97.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\C071.tmp"C:\Users\Admin\AppData\Local\Temp\C071.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\C208.tmp"C:\Users\Admin\AppData\Local\Temp\C208.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\C35F.tmp"C:\Users\Admin\AppData\Local\Temp\C35F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\C40B.tmp"C:\Users\Admin\AppData\Local\Temp\C40B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\C479.tmp"C:\Users\Admin\AppData\Local\Temp\C479.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\C544.tmp"C:\Users\Admin\AppData\Local\Temp\C544.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\C5F0.tmp"C:\Users\Admin\AppData\Local\Temp\C5F0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\C776.tmp"C:\Users\Admin\AppData\Local\Temp\C776.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\C832.tmp"C:\Users\Admin\AppData\Local\Temp\C832.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\C9C8.tmp"C:\Users\Admin\AppData\Local\Temp\C9C8.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\CC0A.tmp"C:\Users\Admin\AppData\Local\Temp\CC0A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\CC78.tmp"C:\Users\Admin\AppData\Local\Temp\CC78.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\CD04.tmp"C:\Users\Admin\AppData\Local\Temp\CD04.tmp"23⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\CDC0.tmp"C:\Users\Admin\AppData\Local\Temp\CDC0.tmp"24⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\CEAA.tmp"C:\Users\Admin\AppData\Local\Temp\CEAA.tmp"25⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\CF75.tmp"C:\Users\Admin\AppData\Local\Temp\CF75.tmp"26⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\D021.tmp"C:\Users\Admin\AppData\Local\Temp\D021.tmp"27⤵
- Executes dropped EXE
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"28⤵
- Executes dropped EXE
PID:332 -
C:\Users\Admin\AppData\Local\Temp\D169.tmp"C:\Users\Admin\AppData\Local\Temp\D169.tmp"29⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\D234.tmp"C:\Users\Admin\AppData\Local\Temp\D234.tmp"30⤵
- Executes dropped EXE
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"31⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"32⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\D486.tmp"C:\Users\Admin\AppData\Local\Temp\D486.tmp"33⤵
- Executes dropped EXE
PID:828 -
C:\Users\Admin\AppData\Local\Temp\D59F.tmp"C:\Users\Admin\AppData\Local\Temp\D59F.tmp"34⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\D64B.tmp"C:\Users\Admin\AppData\Local\Temp\D64B.tmp"35⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"36⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\D774.tmp"C:\Users\Admin\AppData\Local\Temp\D774.tmp"37⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\D7E1.tmp"C:\Users\Admin\AppData\Local\Temp\D7E1.tmp"38⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\D83F.tmp"C:\Users\Admin\AppData\Local\Temp\D83F.tmp"39⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\D8AD.tmp"C:\Users\Admin\AppData\Local\Temp\D8AD.tmp"40⤵
- Executes dropped EXE
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\D92A.tmp"C:\Users\Admin\AppData\Local\Temp\D92A.tmp"41⤵
- Executes dropped EXE
PID:904 -
C:\Users\Admin\AppData\Local\Temp\D987.tmp"C:\Users\Admin\AppData\Local\Temp\D987.tmp"42⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\DA04.tmp"C:\Users\Admin\AppData\Local\Temp\DA04.tmp"43⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\DA81.tmp"C:\Users\Admin\AppData\Local\Temp\DA81.tmp"44⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"45⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\DBBA.tmp"C:\Users\Admin\AppData\Local\Temp\DBBA.tmp"46⤵
- Executes dropped EXE
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\DD31.tmp"C:\Users\Admin\AppData\Local\Temp\DD31.tmp"47⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"48⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\DE2B.tmp"C:\Users\Admin\AppData\Local\Temp\DE2B.tmp"49⤵
- Executes dropped EXE
PID:988 -
C:\Users\Admin\AppData\Local\Temp\DEC7.tmp"C:\Users\Admin\AppData\Local\Temp\DEC7.tmp"50⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\DF73.tmp"C:\Users\Admin\AppData\Local\Temp\DF73.tmp"51⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"52⤵
- Executes dropped EXE
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\E04E.tmp"C:\Users\Admin\AppData\Local\Temp\E04E.tmp"53⤵
- Executes dropped EXE
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"54⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\E177.tmp"C:\Users\Admin\AppData\Local\Temp\E177.tmp"55⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"56⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\E261.tmp"C:\Users\Admin\AppData\Local\Temp\E261.tmp"57⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\E2EE.tmp"C:\Users\Admin\AppData\Local\Temp\E2EE.tmp"58⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\E35B.tmp"C:\Users\Admin\AppData\Local\Temp\E35B.tmp"59⤵
- Executes dropped EXE
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\E3E8.tmp"C:\Users\Admin\AppData\Local\Temp\E3E8.tmp"60⤵
- Executes dropped EXE
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\E474.tmp"C:\Users\Admin\AppData\Local\Temp\E474.tmp"61⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\E530.tmp"C:\Users\Admin\AppData\Local\Temp\E530.tmp"62⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\E58D.tmp"C:\Users\Admin\AppData\Local\Temp\E58D.tmp"63⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\E61A.tmp"C:\Users\Admin\AppData\Local\Temp\E61A.tmp"64⤵
- Executes dropped EXE
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"65⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\E724.tmp"C:\Users\Admin\AppData\Local\Temp\E724.tmp"66⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\E791.tmp"C:\Users\Admin\AppData\Local\Temp\E791.tmp"67⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\E81E.tmp"C:\Users\Admin\AppData\Local\Temp\E81E.tmp"68⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\E88B.tmp"C:\Users\Admin\AppData\Local\Temp\E88B.tmp"69⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\E918.tmp"C:\Users\Admin\AppData\Local\Temp\E918.tmp"70⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\E995.tmp"C:\Users\Admin\AppData\Local\Temp\E995.tmp"71⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\EA21.tmp"C:\Users\Admin\AppData\Local\Temp\EA21.tmp"72⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"73⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"74⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"75⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\EC25.tmp"C:\Users\Admin\AppData\Local\Temp\EC25.tmp"76⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\ECA2.tmp"C:\Users\Admin\AppData\Local\Temp\ECA2.tmp"77⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\ED00.tmp"C:\Users\Admin\AppData\Local\Temp\ED00.tmp"78⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\ED6D.tmp"C:\Users\Admin\AppData\Local\Temp\ED6D.tmp"79⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\EE09.tmp"C:\Users\Admin\AppData\Local\Temp\EE09.tmp"80⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\EE86.tmp"C:\Users\Admin\AppData\Local\Temp\EE86.tmp"81⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\EF32.tmp"C:\Users\Admin\AppData\Local\Temp\EF32.tmp"82⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"83⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\F06B.tmp"C:\Users\Admin\AppData\Local\Temp\F06B.tmp"84⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\F117.tmp"C:\Users\Admin\AppData\Local\Temp\F117.tmp"85⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"86⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\F24F.tmp"C:\Users\Admin\AppData\Local\Temp\F24F.tmp"87⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\F2DC.tmp"C:\Users\Admin\AppData\Local\Temp\F2DC.tmp"88⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\F378.tmp"C:\Users\Admin\AppData\Local\Temp\F378.tmp"89⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\F405.tmp"C:\Users\Admin\AppData\Local\Temp\F405.tmp"90⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\F52D.tmp"C:\Users\Admin\AppData\Local\Temp\F52D.tmp"91⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\F58B.tmp"C:\Users\Admin\AppData\Local\Temp\F58B.tmp"92⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\F637.tmp"C:\Users\Admin\AppData\Local\Temp\F637.tmp"93⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\F6C4.tmp"C:\Users\Admin\AppData\Local\Temp\F6C4.tmp"94⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\F741.tmp"C:\Users\Admin\AppData\Local\Temp\F741.tmp"95⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\F7AE.tmp"C:\Users\Admin\AppData\Local\Temp\F7AE.tmp"96⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\F84A.tmp"C:\Users\Admin\AppData\Local\Temp\F84A.tmp"97⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\F8C7.tmp"C:\Users\Admin\AppData\Local\Temp\F8C7.tmp"98⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\F954.tmp"C:\Users\Admin\AppData\Local\Temp\F954.tmp"99⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\F9F0.tmp"C:\Users\Admin\AppData\Local\Temp\F9F0.tmp"100⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"101⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\FB09.tmp"C:\Users\Admin\AppData\Local\Temp\FB09.tmp"102⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"103⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\FC32.tmp"C:\Users\Admin\AppData\Local\Temp\FC32.tmp"104⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"105⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"106⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"107⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\FE84.tmp"C:\Users\Admin\AppData\Local\Temp\FE84.tmp"108⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\FF40.tmp"C:\Users\Admin\AppData\Local\Temp\FF40.tmp"109⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"110⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\68.tmp"C:\Users\Admin\AppData\Local\Temp\68.tmp"111⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\E5.tmp"C:\Users\Admin\AppData\Local\Temp\E5.tmp"112⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\162.tmp"C:\Users\Admin\AppData\Local\Temp\162.tmp"113⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\1EF.tmp"C:\Users\Admin\AppData\Local\Temp\1EF.tmp"114⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\26C.tmp"C:\Users\Admin\AppData\Local\Temp\26C.tmp"115⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\2E9.tmp"C:\Users\Admin\AppData\Local\Temp\2E9.tmp"116⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\366.tmp"C:\Users\Admin\AppData\Local\Temp\366.tmp"117⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\402.tmp"C:\Users\Admin\AppData\Local\Temp\402.tmp"118⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\4AE.tmp"C:\Users\Admin\AppData\Local\Temp\4AE.tmp"119⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\53B.tmp"C:\Users\Admin\AppData\Local\Temp\53B.tmp"120⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\5A8.tmp"C:\Users\Admin\AppData\Local\Temp\5A8.tmp"121⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\635.tmp"C:\Users\Admin\AppData\Local\Temp\635.tmp"122⤵PID:1016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-