Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
21/02/2024, 12:24
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-21_c2faaddcb93123a4b00144fed50a7d56_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-02-21_c2faaddcb93123a4b00144fed50a7d56_mafia.exe
Resource
win10v2004-20240221-en
General
-
Target
2024-02-21_c2faaddcb93123a4b00144fed50a7d56_mafia.exe
-
Size
487KB
-
MD5
c2faaddcb93123a4b00144fed50a7d56
-
SHA1
c69a6fcd6bf1a41f0e9a7066a78772628e7e9e5d
-
SHA256
b4e859421115ff4e0f7d3d7042e44d9b7a99faf2ca31c6e5ec53c21aff00df8e
-
SHA512
da90deaf36e9eea04bdd897aa3a10ff8c7d64c90d49d9c04015eeb817563d439b03bfeb4535913ce790e7a70b5fd516ca55cf30b1c6f732af3376d1f512e57cb
-
SSDEEP
12288:HU5rCOTeiJwSW5ZzDEYTReNkqFgWEYXhlNdZ2NZ:HUQOJJwnjDbzEnNdZ2N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 952 F31A.tmp 2140 F433.tmp 3116 F51E.tmp 2388 F5CA.tmp 4760 F6A4.tmp 3580 F78F.tmp 4520 F85A.tmp 4532 FBB5.tmp 4708 FCA0.tmp 828 FE55.tmp 1964 FF20.tmp 4924 FFCC.tmp 2532 E5.tmp 4360 182.tmp 3200 25C.tmp 3264 337.tmp 1908 422.tmp 3440 4CD.tmp 3936 589.tmp 1188 664.tmp 2392 700.tmp 1484 7CB.tmp 640 896.tmp 3340 942.tmp 2108 A3C.tmp 1828 B26.tmp 1428 BB3.tmp 224 CEC.tmp 5080 DF5.tmp 4068 F0E.tmp 1760 1008.tmp 4864 10E3.tmp 3728 117F.tmp 2708 120C.tmp 3272 1279.tmp 5040 12F6.tmp 4952 1364.tmp 5016 13E1.tmp 2792 146D.tmp 1164 150A.tmp 4072 15A6.tmp 1804 1652.tmp 3256 16FE.tmp 1972 17C9.tmp 2072 1865.tmp 3696 1930.tmp 5056 19DC.tmp 3376 1A88.tmp 2272 1B34.tmp 2076 1BB1.tmp 1624 1C4D.tmp 264 1CDA.tmp 3600 1D76.tmp 4112 1E12.tmp 2988 1ECE.tmp 2912 1F99.tmp 4640 2016.tmp 4560 20C2.tmp 4764 219C.tmp 4376 2258.tmp 4876 22E5.tmp 468 2381.tmp 4676 24D9.tmp 4584 2575.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2720 wrote to memory of 952 2720 2024-02-21_c2faaddcb93123a4b00144fed50a7d56_mafia.exe 80 PID 2720 wrote to memory of 952 2720 2024-02-21_c2faaddcb93123a4b00144fed50a7d56_mafia.exe 80 PID 2720 wrote to memory of 952 2720 2024-02-21_c2faaddcb93123a4b00144fed50a7d56_mafia.exe 80 PID 952 wrote to memory of 2140 952 F31A.tmp 81 PID 952 wrote to memory of 2140 952 F31A.tmp 81 PID 952 wrote to memory of 2140 952 F31A.tmp 81 PID 2140 wrote to memory of 3116 2140 F433.tmp 82 PID 2140 wrote to memory of 3116 2140 F433.tmp 82 PID 2140 wrote to memory of 3116 2140 F433.tmp 82 PID 3116 wrote to memory of 2388 3116 F51E.tmp 83 PID 3116 wrote to memory of 2388 3116 F51E.tmp 83 PID 3116 wrote to memory of 2388 3116 F51E.tmp 83 PID 2388 wrote to memory of 4760 2388 F5CA.tmp 84 PID 2388 wrote to memory of 4760 2388 F5CA.tmp 84 PID 2388 wrote to memory of 4760 2388 F5CA.tmp 84 PID 4760 wrote to memory of 3580 4760 F6A4.tmp 85 PID 4760 wrote to memory of 3580 4760 F6A4.tmp 85 PID 4760 wrote to memory of 3580 4760 F6A4.tmp 85 PID 3580 wrote to memory of 4520 3580 F78F.tmp 86 PID 3580 wrote to memory of 4520 3580 F78F.tmp 86 PID 3580 wrote to memory of 4520 3580 F78F.tmp 86 PID 4520 wrote to memory of 4532 4520 F85A.tmp 87 PID 4520 wrote to memory of 4532 4520 F85A.tmp 87 PID 4520 wrote to memory of 4532 4520 F85A.tmp 87 PID 4532 wrote to memory of 4708 4532 FBB5.tmp 88 PID 4532 wrote to memory of 4708 4532 FBB5.tmp 88 PID 4532 wrote to memory of 4708 4532 FBB5.tmp 88 PID 4708 wrote to memory of 828 4708 FCA0.tmp 89 PID 4708 wrote to memory of 828 4708 FCA0.tmp 89 PID 4708 wrote to memory of 828 4708 FCA0.tmp 89 PID 828 wrote to memory of 1964 828 FE55.tmp 90 PID 828 wrote to memory of 1964 828 FE55.tmp 90 PID 828 wrote to memory of 1964 828 FE55.tmp 90 PID 1964 wrote to memory of 4924 1964 FF20.tmp 91 PID 1964 wrote to memory of 4924 1964 FF20.tmp 91 PID 1964 wrote to memory of 4924 1964 FF20.tmp 91 PID 4924 wrote to memory of 2532 4924 FFCC.tmp 92 PID 4924 wrote to memory of 2532 4924 FFCC.tmp 92 PID 4924 wrote to memory of 2532 4924 FFCC.tmp 92 PID 2532 wrote to memory of 4360 2532 E5.tmp 93 PID 2532 wrote to memory of 4360 2532 E5.tmp 93 PID 2532 wrote to memory of 4360 2532 E5.tmp 93 PID 4360 wrote to memory of 3200 4360 182.tmp 94 PID 4360 wrote to memory of 3200 4360 182.tmp 94 PID 4360 wrote to memory of 3200 4360 182.tmp 94 PID 3200 wrote to memory of 3264 3200 25C.tmp 95 PID 3200 wrote to memory of 3264 3200 25C.tmp 95 PID 3200 wrote to memory of 3264 3200 25C.tmp 95 PID 3264 wrote to memory of 1908 3264 337.tmp 96 PID 3264 wrote to memory of 1908 3264 337.tmp 96 PID 3264 wrote to memory of 1908 3264 337.tmp 96 PID 1908 wrote to memory of 3440 1908 422.tmp 97 PID 1908 wrote to memory of 3440 1908 422.tmp 97 PID 1908 wrote to memory of 3440 1908 422.tmp 97 PID 3440 wrote to memory of 3936 3440 4CD.tmp 98 PID 3440 wrote to memory of 3936 3440 4CD.tmp 98 PID 3440 wrote to memory of 3936 3440 4CD.tmp 98 PID 3936 wrote to memory of 1188 3936 589.tmp 99 PID 3936 wrote to memory of 1188 3936 589.tmp 99 PID 3936 wrote to memory of 1188 3936 589.tmp 99 PID 1188 wrote to memory of 2392 1188 664.tmp 100 PID 1188 wrote to memory of 2392 1188 664.tmp 100 PID 1188 wrote to memory of 2392 1188 664.tmp 100 PID 2392 wrote to memory of 1484 2392 700.tmp 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-21_c2faaddcb93123a4b00144fed50a7d56_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-21_c2faaddcb93123a4b00144fed50a7d56_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\F31A.tmp"C:\Users\Admin\AppData\Local\Temp\F31A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Temp\F433.tmp"C:\Users\Admin\AppData\Local\Temp\F433.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\F51E.tmp"C:\Users\Admin\AppData\Local\Temp\F51E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\F78F.tmp"C:\Users\Admin\AppData\Local\Temp\F78F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\F85A.tmp"C:\Users\Admin\AppData\Local\Temp\F85A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\FE55.tmp"C:\Users\Admin\AppData\Local\Temp\FE55.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\FF20.tmp"C:\Users\Admin\AppData\Local\Temp\FF20.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\FFCC.tmp"C:\Users\Admin\AppData\Local\Temp\FFCC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\E5.tmp"C:\Users\Admin\AppData\Local\Temp\E5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\182.tmp"C:\Users\Admin\AppData\Local\Temp\182.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\25C.tmp"C:\Users\Admin\AppData\Local\Temp\25C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\337.tmp"C:\Users\Admin\AppData\Local\Temp\337.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\422.tmp"C:\Users\Admin\AppData\Local\Temp\422.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\4CD.tmp"C:\Users\Admin\AppData\Local\Temp\4CD.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\589.tmp"C:\Users\Admin\AppData\Local\Temp\589.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\664.tmp"C:\Users\Admin\AppData\Local\Temp\664.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\700.tmp"C:\Users\Admin\AppData\Local\Temp\700.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\7CB.tmp"C:\Users\Admin\AppData\Local\Temp\7CB.tmp"23⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\896.tmp"C:\Users\Admin\AppData\Local\Temp\896.tmp"24⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\942.tmp"C:\Users\Admin\AppData\Local\Temp\942.tmp"25⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\A3C.tmp"C:\Users\Admin\AppData\Local\Temp\A3C.tmp"26⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\B26.tmp"C:\Users\Admin\AppData\Local\Temp\B26.tmp"27⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\BB3.tmp"C:\Users\Admin\AppData\Local\Temp\BB3.tmp"28⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\CEC.tmp"C:\Users\Admin\AppData\Local\Temp\CEC.tmp"29⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\DF5.tmp"C:\Users\Admin\AppData\Local\Temp\DF5.tmp"30⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\F0E.tmp"C:\Users\Admin\AppData\Local\Temp\F0E.tmp"31⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"32⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\10E3.tmp"C:\Users\Admin\AppData\Local\Temp\10E3.tmp"33⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\117F.tmp"C:\Users\Admin\AppData\Local\Temp\117F.tmp"34⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\120C.tmp"C:\Users\Admin\AppData\Local\Temp\120C.tmp"35⤵
- Executes dropped EXE
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\1279.tmp"C:\Users\Admin\AppData\Local\Temp\1279.tmp"36⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\12F6.tmp"C:\Users\Admin\AppData\Local\Temp\12F6.tmp"37⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\1364.tmp"C:\Users\Admin\AppData\Local\Temp\1364.tmp"38⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\13E1.tmp"C:\Users\Admin\AppData\Local\Temp\13E1.tmp"39⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\146D.tmp"C:\Users\Admin\AppData\Local\Temp\146D.tmp"40⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\150A.tmp"C:\Users\Admin\AppData\Local\Temp\150A.tmp"41⤵
- Executes dropped EXE
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\15A6.tmp"C:\Users\Admin\AppData\Local\Temp\15A6.tmp"42⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\1652.tmp"C:\Users\Admin\AppData\Local\Temp\1652.tmp"43⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\16FE.tmp"C:\Users\Admin\AppData\Local\Temp\16FE.tmp"44⤵
- Executes dropped EXE
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\17C9.tmp"C:\Users\Admin\AppData\Local\Temp\17C9.tmp"45⤵
- Executes dropped EXE
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\1865.tmp"C:\Users\Admin\AppData\Local\Temp\1865.tmp"46⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\1930.tmp"C:\Users\Admin\AppData\Local\Temp\1930.tmp"47⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\19DC.tmp"C:\Users\Admin\AppData\Local\Temp\19DC.tmp"48⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\1A88.tmp"C:\Users\Admin\AppData\Local\Temp\1A88.tmp"49⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\1B34.tmp"C:\Users\Admin\AppData\Local\Temp\1B34.tmp"50⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"51⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\1C4D.tmp"C:\Users\Admin\AppData\Local\Temp\1C4D.tmp"52⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"53⤵
- Executes dropped EXE
PID:264 -
C:\Users\Admin\AppData\Local\Temp\1D76.tmp"C:\Users\Admin\AppData\Local\Temp\1D76.tmp"54⤵
- Executes dropped EXE
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\1E12.tmp"C:\Users\Admin\AppData\Local\Temp\1E12.tmp"55⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\1ECE.tmp"C:\Users\Admin\AppData\Local\Temp\1ECE.tmp"56⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\1F99.tmp"C:\Users\Admin\AppData\Local\Temp\1F99.tmp"57⤵
- Executes dropped EXE
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\2016.tmp"C:\Users\Admin\AppData\Local\Temp\2016.tmp"58⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\20C2.tmp"C:\Users\Admin\AppData\Local\Temp\20C2.tmp"59⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\219C.tmp"C:\Users\Admin\AppData\Local\Temp\219C.tmp"60⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\2258.tmp"C:\Users\Admin\AppData\Local\Temp\2258.tmp"61⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\22E5.tmp"C:\Users\Admin\AppData\Local\Temp\22E5.tmp"62⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\2381.tmp"C:\Users\Admin\AppData\Local\Temp\2381.tmp"63⤵
- Executes dropped EXE
PID:468 -
C:\Users\Admin\AppData\Local\Temp\24D9.tmp"C:\Users\Admin\AppData\Local\Temp\24D9.tmp"64⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\2575.tmp"C:\Users\Admin\AppData\Local\Temp\2575.tmp"65⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\2621.tmp"C:\Users\Admin\AppData\Local\Temp\2621.tmp"66⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\26BD.tmp"C:\Users\Admin\AppData\Local\Temp\26BD.tmp"67⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\273A.tmp"C:\Users\Admin\AppData\Local\Temp\273A.tmp"68⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\27C7.tmp"C:\Users\Admin\AppData\Local\Temp\27C7.tmp"69⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\2872.tmp"C:\Users\Admin\AppData\Local\Temp\2872.tmp"70⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\28E0.tmp"C:\Users\Admin\AppData\Local\Temp\28E0.tmp"71⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\297C.tmp"C:\Users\Admin\AppData\Local\Temp\297C.tmp"72⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\29E9.tmp"C:\Users\Admin\AppData\Local\Temp\29E9.tmp"73⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\2A95.tmp"C:\Users\Admin\AppData\Local\Temp\2A95.tmp"74⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\2B41.tmp"C:\Users\Admin\AppData\Local\Temp\2B41.tmp"75⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\2BCE.tmp"C:\Users\Admin\AppData\Local\Temp\2BCE.tmp"76⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\2C5A.tmp"C:\Users\Admin\AppData\Local\Temp\2C5A.tmp"77⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\2D06.tmp"C:\Users\Admin\AppData\Local\Temp\2D06.tmp"78⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\2D83.tmp"C:\Users\Admin\AppData\Local\Temp\2D83.tmp"79⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\2E10.tmp"C:\Users\Admin\AppData\Local\Temp\2E10.tmp"80⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"81⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\2F77.tmp"C:\Users\Admin\AppData\Local\Temp\2F77.tmp"82⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\3014.tmp"C:\Users\Admin\AppData\Local\Temp\3014.tmp"83⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\30B0.tmp"C:\Users\Admin\AppData\Local\Temp\30B0.tmp"84⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\311D.tmp"C:\Users\Admin\AppData\Local\Temp\311D.tmp"85⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\31AA.tmp"C:\Users\Admin\AppData\Local\Temp\31AA.tmp"86⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\3236.tmp"C:\Users\Admin\AppData\Local\Temp\3236.tmp"87⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\32C3.tmp"C:\Users\Admin\AppData\Local\Temp\32C3.tmp"88⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\3330.tmp"C:\Users\Admin\AppData\Local\Temp\3330.tmp"89⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"90⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"91⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"92⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\35C1.tmp"C:\Users\Admin\AppData\Local\Temp\35C1.tmp"93⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\364D.tmp"C:\Users\Admin\AppData\Local\Temp\364D.tmp"94⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\36DA.tmp"C:\Users\Admin\AppData\Local\Temp\36DA.tmp"95⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\3757.tmp"C:\Users\Admin\AppData\Local\Temp\3757.tmp"96⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\37F3.tmp"C:\Users\Admin\AppData\Local\Temp\37F3.tmp"97⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\3880.tmp"C:\Users\Admin\AppData\Local\Temp\3880.tmp"98⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\393B.tmp"C:\Users\Admin\AppData\Local\Temp\393B.tmp"99⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\39E7.tmp"C:\Users\Admin\AppData\Local\Temp\39E7.tmp"100⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\3A83.tmp"C:\Users\Admin\AppData\Local\Temp\3A83.tmp"101⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"102⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\3BCC.tmp"C:\Users\Admin\AppData\Local\Temp\3BCC.tmp"103⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\3C77.tmp"C:\Users\Admin\AppData\Local\Temp\3C77.tmp"104⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\3CF4.tmp"C:\Users\Admin\AppData\Local\Temp\3CF4.tmp"105⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\3DA0.tmp"C:\Users\Admin\AppData\Local\Temp\3DA0.tmp"106⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\3E0E.tmp"C:\Users\Admin\AppData\Local\Temp\3E0E.tmp"107⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"108⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\3F46.tmp"C:\Users\Admin\AppData\Local\Temp\3F46.tmp"109⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"110⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\4021.tmp"C:\Users\Admin\AppData\Local\Temp\4021.tmp"111⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\40BD.tmp"C:\Users\Admin\AppData\Local\Temp\40BD.tmp"112⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\4198.tmp"C:\Users\Admin\AppData\Local\Temp\4198.tmp"113⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\4215.tmp"C:\Users\Admin\AppData\Local\Temp\4215.tmp"114⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\42A2.tmp"C:\Users\Admin\AppData\Local\Temp\42A2.tmp"115⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\433E.tmp"C:\Users\Admin\AppData\Local\Temp\433E.tmp"116⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\43CA.tmp"C:\Users\Admin\AppData\Local\Temp\43CA.tmp"117⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\4457.tmp"C:\Users\Admin\AppData\Local\Temp\4457.tmp"118⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\44F3.tmp"C:\Users\Admin\AppData\Local\Temp\44F3.tmp"119⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\4561.tmp"C:\Users\Admin\AppData\Local\Temp\4561.tmp"120⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\45FD.tmp"C:\Users\Admin\AppData\Local\Temp\45FD.tmp"121⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\4699.tmp"C:\Users\Admin\AppData\Local\Temp\4699.tmp"122⤵PID:1100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-