Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
171s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
18/01/2024, 23:20
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-18_c460e3cad0bb84560554f2defb42646c_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-18_c460e3cad0bb84560554f2defb42646c_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-18_c460e3cad0bb84560554f2defb42646c_mafia.exe
-
Size
486KB
-
MD5
c460e3cad0bb84560554f2defb42646c
-
SHA1
7e1a1bd6ae9a2c6ff9e7d2a03f5f2c97f15b37f8
-
SHA256
b2195337467d79a40b13229ddb212d8e6e2313a9726e6e343c42f7fa322842da
-
SHA512
f9d5a545bdabf05993ceb7445b3c9c03d12f154a94c7edc7b8cc99f3b4c1ebb9f76218f8281c095fa19d107751689cf85bb76cb78f19ea484edb380bb348d5f3
-
SSDEEP
12288:oU5rCOTeiDN3zQjP/yE7BCcoUuzzkqWrNZ:oUQOJDN3zQGEt0rWrN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3824 F30B.tmp 1120 F397.tmp 2508 F424.tmp 4612 F50E.tmp 3948 F5AA.tmp 2572 F676.tmp 3888 F741.tmp 2700 F7CD.tmp 408 F86A.tmp 3980 F925.tmp 3632 F9D1.tmp 4876 FA7D.tmp 3896 FB09.tmp 3552 FBB5.tmp 3436 FCCF.tmp 3732 FDD8.tmp 2304 FE94.tmp 3672 FF4F.tmp 1652 FFEB.tmp 1168 B7.tmp 772 191.tmp 1072 2F9.tmp 1756 366.tmp 2036 54A.tmp 4100 5D7.tmp 1296 6A2.tmp 5092 79C.tmp 2892 981.tmp 5056 A1D.tmp 3960 BE2.tmp 3840 C9D.tmp 4872 E24.tmp 960 142F.tmp 4200 2B80.tmp 3176 2DF1.tmp 1136 2E4E.tmp 904 2EBC.tmp 916 2FD5.tmp 3188 3062.tmp 1908 3246.tmp 1900 45DE.tmp 4884 50AB.tmp 4400 5781.tmp 2512 57EF.tmp 2160 584C.tmp 4748 58AA.tmp 1348 6F3F.tmp 4232 7867.tmp 3100 8150.tmp 2860 81AE.tmp 2732 820C.tmp 1500 82A8.tmp 5080 8325.tmp 532 83F0.tmp 772 847D.tmp 4028 8529.tmp 2000 85D5.tmp 1384 8652.tmp 4844 871D.tmp 3544 91EA.tmp 2036 9749.tmp 4624 9CC8.tmp 1312 9D54.tmp 1344 9F96.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4972 wrote to memory of 3824 4972 2024-01-18_c460e3cad0bb84560554f2defb42646c_mafia.exe 87 PID 4972 wrote to memory of 3824 4972 2024-01-18_c460e3cad0bb84560554f2defb42646c_mafia.exe 87 PID 4972 wrote to memory of 3824 4972 2024-01-18_c460e3cad0bb84560554f2defb42646c_mafia.exe 87 PID 3824 wrote to memory of 1120 3824 F30B.tmp 88 PID 3824 wrote to memory of 1120 3824 F30B.tmp 88 PID 3824 wrote to memory of 1120 3824 F30B.tmp 88 PID 1120 wrote to memory of 2508 1120 F397.tmp 89 PID 1120 wrote to memory of 2508 1120 F397.tmp 89 PID 1120 wrote to memory of 2508 1120 F397.tmp 89 PID 2508 wrote to memory of 4612 2508 F424.tmp 90 PID 2508 wrote to memory of 4612 2508 F424.tmp 90 PID 2508 wrote to memory of 4612 2508 F424.tmp 90 PID 4612 wrote to memory of 3948 4612 F50E.tmp 91 PID 4612 wrote to memory of 3948 4612 F50E.tmp 91 PID 4612 wrote to memory of 3948 4612 F50E.tmp 91 PID 3948 wrote to memory of 2572 3948 F5AA.tmp 92 PID 3948 wrote to memory of 2572 3948 F5AA.tmp 92 PID 3948 wrote to memory of 2572 3948 F5AA.tmp 92 PID 2572 wrote to memory of 3888 2572 F676.tmp 94 PID 2572 wrote to memory of 3888 2572 F676.tmp 94 PID 2572 wrote to memory of 3888 2572 F676.tmp 94 PID 3888 wrote to memory of 2700 3888 F741.tmp 95 PID 3888 wrote to memory of 2700 3888 F741.tmp 95 PID 3888 wrote to memory of 2700 3888 F741.tmp 95 PID 2700 wrote to memory of 408 2700 F7CD.tmp 96 PID 2700 wrote to memory of 408 2700 F7CD.tmp 96 PID 2700 wrote to memory of 408 2700 F7CD.tmp 96 PID 408 wrote to memory of 3980 408 F86A.tmp 97 PID 408 wrote to memory of 3980 408 F86A.tmp 97 PID 408 wrote to memory of 3980 408 F86A.tmp 97 PID 3980 wrote to memory of 3632 3980 F925.tmp 98 PID 3980 wrote to memory of 3632 3980 F925.tmp 98 PID 3980 wrote to memory of 3632 3980 F925.tmp 98 PID 3632 wrote to memory of 4876 3632 F9D1.tmp 99 PID 3632 wrote to memory of 4876 3632 F9D1.tmp 99 PID 3632 wrote to memory of 4876 3632 F9D1.tmp 99 PID 4876 wrote to memory of 3896 4876 FA7D.tmp 100 PID 4876 wrote to memory of 3896 4876 FA7D.tmp 100 PID 4876 wrote to memory of 3896 4876 FA7D.tmp 100 PID 3896 wrote to memory of 3552 3896 FB09.tmp 101 PID 3896 wrote to memory of 3552 3896 FB09.tmp 101 PID 3896 wrote to memory of 3552 3896 FB09.tmp 101 PID 3552 wrote to memory of 3436 3552 FBB5.tmp 102 PID 3552 wrote to memory of 3436 3552 FBB5.tmp 102 PID 3552 wrote to memory of 3436 3552 FBB5.tmp 102 PID 3436 wrote to memory of 3732 3436 FCCF.tmp 104 PID 3436 wrote to memory of 3732 3436 FCCF.tmp 104 PID 3436 wrote to memory of 3732 3436 FCCF.tmp 104 PID 3732 wrote to memory of 2304 3732 FDD8.tmp 105 PID 3732 wrote to memory of 2304 3732 FDD8.tmp 105 PID 3732 wrote to memory of 2304 3732 FDD8.tmp 105 PID 2304 wrote to memory of 3672 2304 FE94.tmp 106 PID 2304 wrote to memory of 3672 2304 FE94.tmp 106 PID 2304 wrote to memory of 3672 2304 FE94.tmp 106 PID 3672 wrote to memory of 1652 3672 FF4F.tmp 108 PID 3672 wrote to memory of 1652 3672 FF4F.tmp 108 PID 3672 wrote to memory of 1652 3672 FF4F.tmp 108 PID 1652 wrote to memory of 1168 1652 FFEB.tmp 109 PID 1652 wrote to memory of 1168 1652 FFEB.tmp 109 PID 1652 wrote to memory of 1168 1652 FFEB.tmp 109 PID 1168 wrote to memory of 772 1168 B7.tmp 110 PID 1168 wrote to memory of 772 1168 B7.tmp 110 PID 1168 wrote to memory of 772 1168 B7.tmp 110 PID 772 wrote to memory of 1072 772 191.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-18_c460e3cad0bb84560554f2defb42646c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-18_c460e3cad0bb84560554f2defb42646c_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\F30B.tmp"C:\Users\Admin\AppData\Local\Temp\F30B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\F397.tmp"C:\Users\Admin\AppData\Local\Temp\F397.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\F424.tmp"C:\Users\Admin\AppData\Local\Temp\F424.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\F50E.tmp"C:\Users\Admin\AppData\Local\Temp\F50E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\F5AA.tmp"C:\Users\Admin\AppData\Local\Temp\F5AA.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\F676.tmp"C:\Users\Admin\AppData\Local\Temp\F676.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\F741.tmp"C:\Users\Admin\AppData\Local\Temp\F741.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\F7CD.tmp"C:\Users\Admin\AppData\Local\Temp\F7CD.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\F86A.tmp"C:\Users\Admin\AppData\Local\Temp\F86A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\F925.tmp"C:\Users\Admin\AppData\Local\Temp\F925.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\FA7D.tmp"C:\Users\Admin\AppData\Local\Temp\FA7D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\FB09.tmp"C:\Users\Admin\AppData\Local\Temp\FB09.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\FDD8.tmp"C:\Users\Admin\AppData\Local\Temp\FDD8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\FE94.tmp"C:\Users\Admin\AppData\Local\Temp\FE94.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\FF4F.tmp"C:\Users\Admin\AppData\Local\Temp\FF4F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\FFEB.tmp"C:\Users\Admin\AppData\Local\Temp\FFEB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\191.tmp"C:\Users\Admin\AppData\Local\Temp\191.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\2F9.tmp"C:\Users\Admin\AppData\Local\Temp\2F9.tmp"23⤵
- Executes dropped EXE
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\366.tmp"C:\Users\Admin\AppData\Local\Temp\366.tmp"24⤵
- Executes dropped EXE
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\54A.tmp"C:\Users\Admin\AppData\Local\Temp\54A.tmp"25⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\5D7.tmp"C:\Users\Admin\AppData\Local\Temp\5D7.tmp"26⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\6A2.tmp"C:\Users\Admin\AppData\Local\Temp\6A2.tmp"27⤵
- Executes dropped EXE
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\79C.tmp"C:\Users\Admin\AppData\Local\Temp\79C.tmp"28⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\981.tmp"C:\Users\Admin\AppData\Local\Temp\981.tmp"29⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\A1D.tmp"C:\Users\Admin\AppData\Local\Temp\A1D.tmp"30⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\BE2.tmp"C:\Users\Admin\AppData\Local\Temp\BE2.tmp"31⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\C9D.tmp"C:\Users\Admin\AppData\Local\Temp\C9D.tmp"32⤵
- Executes dropped EXE
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"33⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\142F.tmp"C:\Users\Admin\AppData\Local\Temp\142F.tmp"34⤵
- Executes dropped EXE
PID:960 -
C:\Users\Admin\AppData\Local\Temp\2B80.tmp"C:\Users\Admin\AppData\Local\Temp\2B80.tmp"35⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"36⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"37⤵
- Executes dropped EXE
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"38⤵
- Executes dropped EXE
PID:904 -
C:\Users\Admin\AppData\Local\Temp\2FD5.tmp"C:\Users\Admin\AppData\Local\Temp\2FD5.tmp"39⤵
- Executes dropped EXE
PID:916 -
C:\Users\Admin\AppData\Local\Temp\3062.tmp"C:\Users\Admin\AppData\Local\Temp\3062.tmp"40⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\3246.tmp"C:\Users\Admin\AppData\Local\Temp\3246.tmp"41⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\45DE.tmp"C:\Users\Admin\AppData\Local\Temp\45DE.tmp"42⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\50AB.tmp"C:\Users\Admin\AppData\Local\Temp\50AB.tmp"43⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\5781.tmp"C:\Users\Admin\AppData\Local\Temp\5781.tmp"44⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\57EF.tmp"C:\Users\Admin\AppData\Local\Temp\57EF.tmp"45⤵
- Executes dropped EXE
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\584C.tmp"C:\Users\Admin\AppData\Local\Temp\584C.tmp"46⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\58AA.tmp"C:\Users\Admin\AppData\Local\Temp\58AA.tmp"47⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\6F3F.tmp"C:\Users\Admin\AppData\Local\Temp\6F3F.tmp"48⤵
- Executes dropped EXE
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\7867.tmp"C:\Users\Admin\AppData\Local\Temp\7867.tmp"49⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\8150.tmp"C:\Users\Admin\AppData\Local\Temp\8150.tmp"50⤵
- Executes dropped EXE
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\81AE.tmp"C:\Users\Admin\AppData\Local\Temp\81AE.tmp"51⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\820C.tmp"C:\Users\Admin\AppData\Local\Temp\820C.tmp"52⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\82A8.tmp"C:\Users\Admin\AppData\Local\Temp\82A8.tmp"53⤵
- Executes dropped EXE
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\8325.tmp"C:\Users\Admin\AppData\Local\Temp\8325.tmp"54⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\83F0.tmp"C:\Users\Admin\AppData\Local\Temp\83F0.tmp"55⤵
- Executes dropped EXE
PID:532 -
C:\Users\Admin\AppData\Local\Temp\847D.tmp"C:\Users\Admin\AppData\Local\Temp\847D.tmp"56⤵
- Executes dropped EXE
PID:772 -
C:\Users\Admin\AppData\Local\Temp\8529.tmp"C:\Users\Admin\AppData\Local\Temp\8529.tmp"57⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\85D5.tmp"C:\Users\Admin\AppData\Local\Temp\85D5.tmp"58⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\8652.tmp"C:\Users\Admin\AppData\Local\Temp\8652.tmp"59⤵
- Executes dropped EXE
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\871D.tmp"C:\Users\Admin\AppData\Local\Temp\871D.tmp"60⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\91EA.tmp"C:\Users\Admin\AppData\Local\Temp\91EA.tmp"61⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\9749.tmp"C:\Users\Admin\AppData\Local\Temp\9749.tmp"62⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\9CC8.tmp"C:\Users\Admin\AppData\Local\Temp\9CC8.tmp"63⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\9D54.tmp"C:\Users\Admin\AppData\Local\Temp\9D54.tmp"64⤵
- Executes dropped EXE
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\9F96.tmp"C:\Users\Admin\AppData\Local\Temp\9F96.tmp"65⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\A090.tmp"C:\Users\Admin\AppData\Local\Temp\A090.tmp"66⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\A1E8.tmp"C:\Users\Admin\AppData\Local\Temp\A1E8.tmp"67⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\A2C3.tmp"C:\Users\Admin\AppData\Local\Temp\A2C3.tmp"68⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\A3EC.tmp"C:\Users\Admin\AppData\Local\Temp\A3EC.tmp"69⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\A4E6.tmp"C:\Users\Admin\AppData\Local\Temp\A4E6.tmp"70⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\A5FF.tmp"C:\Users\Admin\AppData\Local\Temp\A5FF.tmp"71⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\A6CA.tmp"C:\Users\Admin\AppData\Local\Temp\A6CA.tmp"72⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"73⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\A8FD.tmp"C:\Users\Admin\AppData\Local\Temp\A8FD.tmp"74⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\A9B8.tmp"C:\Users\Admin\AppData\Local\Temp\A9B8.tmp"75⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\AB10.tmp"C:\Users\Admin\AppData\Local\Temp\AB10.tmp"76⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\AC48.tmp"C:\Users\Admin\AppData\Local\Temp\AC48.tmp"77⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\ADFE.tmp"C:\Users\Admin\AppData\Local\Temp\ADFE.tmp"78⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\AE5C.tmp"C:\Users\Admin\AppData\Local\Temp\AE5C.tmp"79⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\AEB9.tmp"C:\Users\Admin\AppData\Local\Temp\AEB9.tmp"80⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\AFF2.tmp"C:\Users\Admin\AppData\Local\Temp\AFF2.tmp"81⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\B05F.tmp"C:\Users\Admin\AppData\Local\Temp\B05F.tmp"82⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\B0EC.tmp"C:\Users\Admin\AppData\Local\Temp\B0EC.tmp"83⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\B1B7.tmp"C:\Users\Admin\AppData\Local\Temp\B1B7.tmp"84⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\B292.tmp"C:\Users\Admin\AppData\Local\Temp\B292.tmp"85⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\B32E.tmp"C:\Users\Admin\AppData\Local\Temp\B32E.tmp"86⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\B438.tmp"C:\Users\Admin\AppData\Local\Temp\B438.tmp"87⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\B4C4.tmp"C:\Users\Admin\AppData\Local\Temp\B4C4.tmp"88⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\B5CE.tmp"C:\Users\Admin\AppData\Local\Temp\B5CE.tmp"89⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\B64B.tmp"C:\Users\Admin\AppData\Local\Temp\B64B.tmp"90⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\B6C8.tmp"C:\Users\Admin\AppData\Local\Temp\B6C8.tmp"91⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\B745.tmp"C:\Users\Admin\AppData\Local\Temp\B745.tmp"92⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\B86E.tmp"C:\Users\Admin\AppData\Local\Temp\B86E.tmp"93⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\B8FA.tmp"C:\Users\Admin\AppData\Local\Temp\B8FA.tmp"94⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\BA14.tmp"C:\Users\Admin\AppData\Local\Temp\BA14.tmp"95⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\BB0E.tmp"C:\Users\Admin\AppData\Local\Temp\BB0E.tmp"96⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\BC85.tmp"C:\Users\Admin\AppData\Local\Temp\BC85.tmp"97⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\BD11.tmp"C:\Users\Admin\AppData\Local\Temp\BD11.tmp"98⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\BD7F.tmp"C:\Users\Admin\AppData\Local\Temp\BD7F.tmp"99⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\BDFC.tmp"C:\Users\Admin\AppData\Local\Temp\BDFC.tmp"100⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\BE98.tmp"C:\Users\Admin\AppData\Local\Temp\BE98.tmp"101⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\BF63.tmp"C:\Users\Admin\AppData\Local\Temp\BF63.tmp"102⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\BFE0.tmp"C:\Users\Admin\AppData\Local\Temp\BFE0.tmp"103⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\C04D.tmp"C:\Users\Admin\AppData\Local\Temp\C04D.tmp"104⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\C0BB.tmp"C:\Users\Admin\AppData\Local\Temp\C0BB.tmp"105⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\C147.tmp"C:\Users\Admin\AppData\Local\Temp\C147.tmp"106⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\C1E4.tmp"C:\Users\Admin\AppData\Local\Temp\C1E4.tmp"107⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\C270.tmp"C:\Users\Admin\AppData\Local\Temp\C270.tmp"108⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\C2CE.tmp"C:\Users\Admin\AppData\Local\Temp\C2CE.tmp"109⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\C34B.tmp"C:\Users\Admin\AppData\Local\Temp\C34B.tmp"110⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\D184.tmp"C:\Users\Admin\AppData\Local\Temp\D184.tmp"111⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\D4B0.tmp"C:\Users\Admin\AppData\Local\Temp\D4B0.tmp"112⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\D52D.tmp"C:\Users\Admin\AppData\Local\Temp\D52D.tmp"113⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\E3A4.tmp"C:\Users\Admin\AppData\Local\Temp\E3A4.tmp"114⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\E431.tmp"C:\Users\Admin\AppData\Local\Temp\E431.tmp"115⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\E4AE.tmp"C:\Users\Admin\AppData\Local\Temp\E4AE.tmp"116⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\E53B.tmp"C:\Users\Admin\AppData\Local\Temp\E53B.tmp"117⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\E5D7.tmp"C:\Users\Admin\AppData\Local\Temp\E5D7.tmp"118⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\E663.tmp"C:\Users\Admin\AppData\Local\Temp\E663.tmp"119⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\E886.tmp"C:\Users\Admin\AppData\Local\Temp\E886.tmp"120⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\E903.tmp"C:\Users\Admin\AppData\Local\Temp\E903.tmp"121⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\E980.tmp"C:\Users\Admin\AppData\Local\Temp\E980.tmp"122⤵PID:4160
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-