Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
23/01/2024, 05:00
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-23_a1fd2b572f7f19edc04590ca6acd86ba_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-01-23_a1fd2b572f7f19edc04590ca6acd86ba_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-23_a1fd2b572f7f19edc04590ca6acd86ba_mafia.exe
-
Size
486KB
-
MD5
a1fd2b572f7f19edc04590ca6acd86ba
-
SHA1
a821839995064684ee0c75fdaf26c28b816a6b00
-
SHA256
8ee0765a7fbef742711bd4e75d15797901f88cd279716863fc5cee2e76956808
-
SHA512
efe94c0ea66da73e47127c785641dbb3329f4c06535260e26b89f7cee8c01ff757bee0f1761c5db53be87b1af3d2d58afa04befd03f087848553e3a8586a52f2
-
SSDEEP
12288:oU5rCOTeiD8oULnrWpYJzjqltoBNiWdFNZ:oUQOJD8oULntJzqmNiWLN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3104 FBD5.tmp 4292 FCEE.tmp 4776 FD9A.tmp 336 FE65.tmp 60 FF40.tmp 1852 B.tmp 3100 105.tmp 808 1EF.tmp 1120 971.tmp 3640 BA3.tmp 208 C7E.tmp 5080 D49.tmp 4856 E05.tmp 2524 EC0.tmp 1440 F7C.tmp 996 1037.tmp 2420 1112.tmp 2724 11FC.tmp 1772 12F6.tmp 1672 13C2.tmp 212 14BC.tmp 1200 1558.tmp 4660 1633.tmp 4608 16EE.tmp 4704 17F8.tmp 3432 18D2.tmp 4216 19AD.tmp 3328 1B15.tmp 1028 1BFF.tmp 3572 1CF9.tmp 3584 1E03.tmp 5060 1ECE.tmp 4960 1F6A.tmp 4824 1FE7.tmp 3192 20A2.tmp 3116 212F.tmp 4848 219C.tmp 3252 2239.tmp 1212 22D5.tmp 3244 2390.tmp 3852 242D.tmp 3524 249A.tmp 1344 2507.tmp 3468 25E2.tmp 1932 268E.tmp 4772 274A.tmp 1128 2805.tmp 2780 2882.tmp 3340 296C.tmp 5116 2A47.tmp 1828 2AF3.tmp 3612 2C1C.tmp 4032 2CE7.tmp 3512 2DC2.tmp 2304 2E2F.tmp 4400 2ECB.tmp 5080 2F68.tmp 2440 313C.tmp 4900 31B9.tmp 4368 3265.tmp 1440 3311.tmp 3720 338E.tmp 1156 343A.tmp 3004 34F6.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1388 wrote to memory of 3104 1388 2024-01-23_a1fd2b572f7f19edc04590ca6acd86ba_mafia.exe 86 PID 1388 wrote to memory of 3104 1388 2024-01-23_a1fd2b572f7f19edc04590ca6acd86ba_mafia.exe 86 PID 1388 wrote to memory of 3104 1388 2024-01-23_a1fd2b572f7f19edc04590ca6acd86ba_mafia.exe 86 PID 3104 wrote to memory of 4292 3104 FBD5.tmp 88 PID 3104 wrote to memory of 4292 3104 FBD5.tmp 88 PID 3104 wrote to memory of 4292 3104 FBD5.tmp 88 PID 4292 wrote to memory of 4776 4292 FCEE.tmp 89 PID 4292 wrote to memory of 4776 4292 FCEE.tmp 89 PID 4292 wrote to memory of 4776 4292 FCEE.tmp 89 PID 4776 wrote to memory of 336 4776 FD9A.tmp 90 PID 4776 wrote to memory of 336 4776 FD9A.tmp 90 PID 4776 wrote to memory of 336 4776 FD9A.tmp 90 PID 336 wrote to memory of 60 336 FE65.tmp 91 PID 336 wrote to memory of 60 336 FE65.tmp 91 PID 336 wrote to memory of 60 336 FE65.tmp 91 PID 60 wrote to memory of 1852 60 FF40.tmp 92 PID 60 wrote to memory of 1852 60 FF40.tmp 92 PID 60 wrote to memory of 1852 60 FF40.tmp 92 PID 1852 wrote to memory of 3100 1852 B.tmp 93 PID 1852 wrote to memory of 3100 1852 B.tmp 93 PID 1852 wrote to memory of 3100 1852 B.tmp 93 PID 3100 wrote to memory of 808 3100 105.tmp 94 PID 3100 wrote to memory of 808 3100 105.tmp 94 PID 3100 wrote to memory of 808 3100 105.tmp 94 PID 808 wrote to memory of 1120 808 1EF.tmp 95 PID 808 wrote to memory of 1120 808 1EF.tmp 95 PID 808 wrote to memory of 1120 808 1EF.tmp 95 PID 1120 wrote to memory of 3640 1120 971.tmp 96 PID 1120 wrote to memory of 3640 1120 971.tmp 96 PID 1120 wrote to memory of 3640 1120 971.tmp 96 PID 3640 wrote to memory of 208 3640 BA3.tmp 97 PID 3640 wrote to memory of 208 3640 BA3.tmp 97 PID 3640 wrote to memory of 208 3640 BA3.tmp 97 PID 208 wrote to memory of 5080 208 C7E.tmp 98 PID 208 wrote to memory of 5080 208 C7E.tmp 98 PID 208 wrote to memory of 5080 208 C7E.tmp 98 PID 5080 wrote to memory of 4856 5080 D49.tmp 99 PID 5080 wrote to memory of 4856 5080 D49.tmp 99 PID 5080 wrote to memory of 4856 5080 D49.tmp 99 PID 4856 wrote to memory of 2524 4856 E05.tmp 100 PID 4856 wrote to memory of 2524 4856 E05.tmp 100 PID 4856 wrote to memory of 2524 4856 E05.tmp 100 PID 2524 wrote to memory of 1440 2524 EC0.tmp 101 PID 2524 wrote to memory of 1440 2524 EC0.tmp 101 PID 2524 wrote to memory of 1440 2524 EC0.tmp 101 PID 1440 wrote to memory of 996 1440 F7C.tmp 102 PID 1440 wrote to memory of 996 1440 F7C.tmp 102 PID 1440 wrote to memory of 996 1440 F7C.tmp 102 PID 996 wrote to memory of 2420 996 1037.tmp 103 PID 996 wrote to memory of 2420 996 1037.tmp 103 PID 996 wrote to memory of 2420 996 1037.tmp 103 PID 2420 wrote to memory of 2724 2420 1112.tmp 104 PID 2420 wrote to memory of 2724 2420 1112.tmp 104 PID 2420 wrote to memory of 2724 2420 1112.tmp 104 PID 2724 wrote to memory of 1772 2724 11FC.tmp 105 PID 2724 wrote to memory of 1772 2724 11FC.tmp 105 PID 2724 wrote to memory of 1772 2724 11FC.tmp 105 PID 1772 wrote to memory of 1672 1772 12F6.tmp 106 PID 1772 wrote to memory of 1672 1772 12F6.tmp 106 PID 1772 wrote to memory of 1672 1772 12F6.tmp 106 PID 1672 wrote to memory of 212 1672 13C2.tmp 107 PID 1672 wrote to memory of 212 1672 13C2.tmp 107 PID 1672 wrote to memory of 212 1672 13C2.tmp 107 PID 212 wrote to memory of 1200 212 14BC.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-23_a1fd2b572f7f19edc04590ca6acd86ba_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-23_a1fd2b572f7f19edc04590ca6acd86ba_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\FD9A.tmp"C:\Users\Admin\AppData\Local\Temp\FD9A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\FE65.tmp"C:\Users\Admin\AppData\Local\Temp\FE65.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Users\Admin\AppData\Local\Temp\FF40.tmp"C:\Users\Admin\AppData\Local\Temp\FF40.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\B.tmp"C:\Users\Admin\AppData\Local\Temp\B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\105.tmp"C:\Users\Admin\AppData\Local\Temp\105.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\1EF.tmp"C:\Users\Admin\AppData\Local\Temp\1EF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\971.tmp"C:\Users\Admin\AppData\Local\Temp\971.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\BA3.tmp"C:\Users\Admin\AppData\Local\Temp\BA3.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\C7E.tmp"C:\Users\Admin\AppData\Local\Temp\C7E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\D49.tmp"C:\Users\Admin\AppData\Local\Temp\D49.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\E05.tmp"C:\Users\Admin\AppData\Local\Temp\E05.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\EC0.tmp"C:\Users\Admin\AppData\Local\Temp\EC0.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\F7C.tmp"C:\Users\Admin\AppData\Local\Temp\F7C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\1037.tmp"C:\Users\Admin\AppData\Local\Temp\1037.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\1112.tmp"C:\Users\Admin\AppData\Local\Temp\1112.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\11FC.tmp"C:\Users\Admin\AppData\Local\Temp\11FC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\12F6.tmp"C:\Users\Admin\AppData\Local\Temp\12F6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\13C2.tmp"C:\Users\Admin\AppData\Local\Temp\13C2.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\14BC.tmp"C:\Users\Admin\AppData\Local\Temp\14BC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\1558.tmp"C:\Users\Admin\AppData\Local\Temp\1558.tmp"23⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\1633.tmp"C:\Users\Admin\AppData\Local\Temp\1633.tmp"24⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\16EE.tmp"C:\Users\Admin\AppData\Local\Temp\16EE.tmp"25⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\17F8.tmp"C:\Users\Admin\AppData\Local\Temp\17F8.tmp"26⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\18D2.tmp"C:\Users\Admin\AppData\Local\Temp\18D2.tmp"27⤵
- Executes dropped EXE
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\19AD.tmp"C:\Users\Admin\AppData\Local\Temp\19AD.tmp"28⤵
- Executes dropped EXE
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\1B15.tmp"C:\Users\Admin\AppData\Local\Temp\1B15.tmp"29⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\1BFF.tmp"C:\Users\Admin\AppData\Local\Temp\1BFF.tmp"30⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"31⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\1E03.tmp"C:\Users\Admin\AppData\Local\Temp\1E03.tmp"32⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\1ECE.tmp"C:\Users\Admin\AppData\Local\Temp\1ECE.tmp"33⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\1F6A.tmp"C:\Users\Admin\AppData\Local\Temp\1F6A.tmp"34⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"35⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\20A2.tmp"C:\Users\Admin\AppData\Local\Temp\20A2.tmp"36⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\212F.tmp"C:\Users\Admin\AppData\Local\Temp\212F.tmp"37⤵
- Executes dropped EXE
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\219C.tmp"C:\Users\Admin\AppData\Local\Temp\219C.tmp"38⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\2239.tmp"C:\Users\Admin\AppData\Local\Temp\2239.tmp"39⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\22D5.tmp"C:\Users\Admin\AppData\Local\Temp\22D5.tmp"40⤵
- Executes dropped EXE
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\2390.tmp"C:\Users\Admin\AppData\Local\Temp\2390.tmp"41⤵
- Executes dropped EXE
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\242D.tmp"C:\Users\Admin\AppData\Local\Temp\242D.tmp"42⤵
- Executes dropped EXE
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\249A.tmp"C:\Users\Admin\AppData\Local\Temp\249A.tmp"43⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\2507.tmp"C:\Users\Admin\AppData\Local\Temp\2507.tmp"44⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\25E2.tmp"C:\Users\Admin\AppData\Local\Temp\25E2.tmp"45⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\268E.tmp"C:\Users\Admin\AppData\Local\Temp\268E.tmp"46⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\274A.tmp"C:\Users\Admin\AppData\Local\Temp\274A.tmp"47⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\2805.tmp"C:\Users\Admin\AppData\Local\Temp\2805.tmp"48⤵
- Executes dropped EXE
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\2882.tmp"C:\Users\Admin\AppData\Local\Temp\2882.tmp"49⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\296C.tmp"C:\Users\Admin\AppData\Local\Temp\296C.tmp"50⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\2A47.tmp"C:\Users\Admin\AppData\Local\Temp\2A47.tmp"51⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"52⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\2C1C.tmp"C:\Users\Admin\AppData\Local\Temp\2C1C.tmp"53⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"54⤵
- Executes dropped EXE
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"55⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\2E2F.tmp"C:\Users\Admin\AppData\Local\Temp\2E2F.tmp"56⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\2ECB.tmp"C:\Users\Admin\AppData\Local\Temp\2ECB.tmp"57⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\2F68.tmp"C:\Users\Admin\AppData\Local\Temp\2F68.tmp"58⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\313C.tmp"C:\Users\Admin\AppData\Local\Temp\313C.tmp"59⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\31B9.tmp"C:\Users\Admin\AppData\Local\Temp\31B9.tmp"60⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\3265.tmp"C:\Users\Admin\AppData\Local\Temp\3265.tmp"61⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\3311.tmp"C:\Users\Admin\AppData\Local\Temp\3311.tmp"62⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"63⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"64⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\34F6.tmp"C:\Users\Admin\AppData\Local\Temp\34F6.tmp"65⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\3573.tmp"C:\Users\Admin\AppData\Local\Temp\3573.tmp"66⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\35F0.tmp"C:\Users\Admin\AppData\Local\Temp\35F0.tmp"67⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\37F3.tmp"C:\Users\Admin\AppData\Local\Temp\37F3.tmp"68⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\3861.tmp"C:\Users\Admin\AppData\Local\Temp\3861.tmp"69⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\38DE.tmp"C:\Users\Admin\AppData\Local\Temp\38DE.tmp"70⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\396A.tmp"C:\Users\Admin\AppData\Local\Temp\396A.tmp"71⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\39D8.tmp"C:\Users\Admin\AppData\Local\Temp\39D8.tmp"72⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\3A45.tmp"C:\Users\Admin\AppData\Local\Temp\3A45.tmp"73⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\3AC2.tmp"C:\Users\Admin\AppData\Local\Temp\3AC2.tmp"74⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"75⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\3BCC.tmp"C:\Users\Admin\AppData\Local\Temp\3BCC.tmp"76⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\3C39.tmp"C:\Users\Admin\AppData\Local\Temp\3C39.tmp"77⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\3CA6.tmp"C:\Users\Admin\AppData\Local\Temp\3CA6.tmp"78⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\3D23.tmp"C:\Users\Admin\AppData\Local\Temp\3D23.tmp"79⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\3DC0.tmp"C:\Users\Admin\AppData\Local\Temp\3DC0.tmp"80⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\3E3D.tmp"C:\Users\Admin\AppData\Local\Temp\3E3D.tmp"81⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\3EBA.tmp"C:\Users\Admin\AppData\Local\Temp\3EBA.tmp"82⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\3F37.tmp"C:\Users\Admin\AppData\Local\Temp\3F37.tmp"83⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\3FE2.tmp"C:\Users\Admin\AppData\Local\Temp\3FE2.tmp"84⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\405F.tmp"C:\Users\Admin\AppData\Local\Temp\405F.tmp"85⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\40EC.tmp"C:\Users\Admin\AppData\Local\Temp\40EC.tmp"86⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\4188.tmp"C:\Users\Admin\AppData\Local\Temp\4188.tmp"87⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\4215.tmp"C:\Users\Admin\AppData\Local\Temp\4215.tmp"88⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\42A2.tmp"C:\Users\Admin\AppData\Local\Temp\42A2.tmp"89⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\432E.tmp"C:\Users\Admin\AppData\Local\Temp\432E.tmp"90⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\43AB.tmp"C:\Users\Admin\AppData\Local\Temp\43AB.tmp"91⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\4438.tmp"C:\Users\Admin\AppData\Local\Temp\4438.tmp"92⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\44B5.tmp"C:\Users\Admin\AppData\Local\Temp\44B5.tmp"93⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\4541.tmp"C:\Users\Admin\AppData\Local\Temp\4541.tmp"94⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\45CE.tmp"C:\Users\Admin\AppData\Local\Temp\45CE.tmp"95⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\464B.tmp"C:\Users\Admin\AppData\Local\Temp\464B.tmp"96⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\46D8.tmp"C:\Users\Admin\AppData\Local\Temp\46D8.tmp"97⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\4764.tmp"C:\Users\Admin\AppData\Local\Temp\4764.tmp"98⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\4801.tmp"C:\Users\Admin\AppData\Local\Temp\4801.tmp"99⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\487E.tmp"C:\Users\Admin\AppData\Local\Temp\487E.tmp"100⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\48FB.tmp"C:\Users\Admin\AppData\Local\Temp\48FB.tmp"101⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\4968.tmp"C:\Users\Admin\AppData\Local\Temp\4968.tmp"102⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\49F5.tmp"C:\Users\Admin\AppData\Local\Temp\49F5.tmp"103⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\4A62.tmp"C:\Users\Admin\AppData\Local\Temp\4A62.tmp"104⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\4ACF.tmp"C:\Users\Admin\AppData\Local\Temp\4ACF.tmp"105⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\4B4C.tmp"C:\Users\Admin\AppData\Local\Temp\4B4C.tmp"106⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\4BE9.tmp"C:\Users\Admin\AppData\Local\Temp\4BE9.tmp"107⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\4C85.tmp"C:\Users\Admin\AppData\Local\Temp\4C85.tmp"108⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\4D11.tmp"C:\Users\Admin\AppData\Local\Temp\4D11.tmp"109⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\4DAE.tmp"C:\Users\Admin\AppData\Local\Temp\4DAE.tmp"110⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\4E2B.tmp"C:\Users\Admin\AppData\Local\Temp\4E2B.tmp"111⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\4EA8.tmp"C:\Users\Admin\AppData\Local\Temp\4EA8.tmp"112⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\4F15.tmp"C:\Users\Admin\AppData\Local\Temp\4F15.tmp"113⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\4F92.tmp"C:\Users\Admin\AppData\Local\Temp\4F92.tmp"114⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\501F.tmp"C:\Users\Admin\AppData\Local\Temp\501F.tmp"115⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\50AB.tmp"C:\Users\Admin\AppData\Local\Temp\50AB.tmp"116⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\5138.tmp"C:\Users\Admin\AppData\Local\Temp\5138.tmp"117⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\51A5.tmp"C:\Users\Admin\AppData\Local\Temp\51A5.tmp"118⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\5232.tmp"C:\Users\Admin\AppData\Local\Temp\5232.tmp"119⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\52AF.tmp"C:\Users\Admin\AppData\Local\Temp\52AF.tmp"120⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\531C.tmp"C:\Users\Admin\AppData\Local\Temp\531C.tmp"121⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\538A.tmp"C:\Users\Admin\AppData\Local\Temp\538A.tmp"122⤵PID:1684
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-