Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
10/03/2024, 06:14
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-10_9f0b73d98aef1e1e793a149067d1bcbb_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-03-10_9f0b73d98aef1e1e793a149067d1bcbb_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-03-10_9f0b73d98aef1e1e793a149067d1bcbb_mafia.exe
-
Size
765KB
-
MD5
9f0b73d98aef1e1e793a149067d1bcbb
-
SHA1
8bc0d74183ff9c25cacf7e61ed9ddaa28c9ede41
-
SHA256
be19fac27ea2b85ab5a725905d673ea3c95ce79942bd656fb7caa3c9983bf7b2
-
SHA512
202092f0d2af9e19039d744b5516e3742a31b6e78ebbabcc6a90f343ff8ab2dca9e47a6cb6c32c08c3c94fe5f4ce38b3724c51b92dfa0b1ee9dc049197b83b7a
-
SSDEEP
12288:ZU5rCOTeiD5Fs3pvfiU3iz/aPEmAtekO3ZF5rn5rLOa54U5w5A:ZUQOJDfspSU3rPLAte/3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3576 4D16.tmp 468 4DD2.tmp 4468 4E3F.tmp 4672 4EBC.tmp 2928 4F58.tmp 1904 4FC6.tmp 1092 5043.tmp 4832 50B0.tmp 4956 511D.tmp 4924 519A.tmp 4696 51F8.tmp 2004 5256.tmp 3192 52A4.tmp 4904 5311.tmp 1248 536F.tmp 4604 53BD.tmp 3588 541B.tmp 4808 5469.tmp 3980 54B7.tmp 2192 5515.tmp 860 5563.tmp 2936 55B1.tmp 216 560F.tmp 3612 567C.tmp 1136 5786.tmp 4968 5813.tmp 2880 5861.tmp 948 58BF.tmp 412 590D.tmp 3488 597A.tmp 744 59F7.tmp 1804 5A64.tmp 1724 5AD2.tmp 2336 5B30.tmp 4892 5B9D.tmp 3152 5BFB.tmp 3636 5C49.tmp 4536 5C97.tmp 3844 5CF5.tmp 3448 5D52.tmp 4188 5DA1.tmp 4948 5DFE.tmp 2940 5E4C.tmp 4176 5E9B.tmp 4504 5EE9.tmp 4200 5F46.tmp 2984 5F95.tmp 1100 5FF2.tmp 2404 6040.tmp 736 608F.tmp 3176 60DD.tmp 4636 612B.tmp 516 6179.tmp 4216 61C7.tmp 4540 6215.tmp 1036 6263.tmp 4116 62C1.tmp 3576 630F.tmp 4616 635D.tmp 4656 63AB.tmp 3064 63FA.tmp 2924 6448.tmp 4520 64A5.tmp 4672 6503.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4160 wrote to memory of 3576 4160 2024-03-10_9f0b73d98aef1e1e793a149067d1bcbb_mafia.exe 85 PID 4160 wrote to memory of 3576 4160 2024-03-10_9f0b73d98aef1e1e793a149067d1bcbb_mafia.exe 85 PID 4160 wrote to memory of 3576 4160 2024-03-10_9f0b73d98aef1e1e793a149067d1bcbb_mafia.exe 85 PID 3576 wrote to memory of 468 3576 4D16.tmp 86 PID 3576 wrote to memory of 468 3576 4D16.tmp 86 PID 3576 wrote to memory of 468 3576 4D16.tmp 86 PID 468 wrote to memory of 4468 468 4DD2.tmp 87 PID 468 wrote to memory of 4468 468 4DD2.tmp 87 PID 468 wrote to memory of 4468 468 4DD2.tmp 87 PID 4468 wrote to memory of 4672 4468 4E3F.tmp 88 PID 4468 wrote to memory of 4672 4468 4E3F.tmp 88 PID 4468 wrote to memory of 4672 4468 4E3F.tmp 88 PID 4672 wrote to memory of 2928 4672 4EBC.tmp 89 PID 4672 wrote to memory of 2928 4672 4EBC.tmp 89 PID 4672 wrote to memory of 2928 4672 4EBC.tmp 89 PID 2928 wrote to memory of 1904 2928 4F58.tmp 90 PID 2928 wrote to memory of 1904 2928 4F58.tmp 90 PID 2928 wrote to memory of 1904 2928 4F58.tmp 90 PID 1904 wrote to memory of 1092 1904 4FC6.tmp 91 PID 1904 wrote to memory of 1092 1904 4FC6.tmp 91 PID 1904 wrote to memory of 1092 1904 4FC6.tmp 91 PID 1092 wrote to memory of 4832 1092 5043.tmp 92 PID 1092 wrote to memory of 4832 1092 5043.tmp 92 PID 1092 wrote to memory of 4832 1092 5043.tmp 92 PID 4832 wrote to memory of 4956 4832 50B0.tmp 93 PID 4832 wrote to memory of 4956 4832 50B0.tmp 93 PID 4832 wrote to memory of 4956 4832 50B0.tmp 93 PID 4956 wrote to memory of 4924 4956 511D.tmp 94 PID 4956 wrote to memory of 4924 4956 511D.tmp 94 PID 4956 wrote to memory of 4924 4956 511D.tmp 94 PID 4924 wrote to memory of 4696 4924 519A.tmp 95 PID 4924 wrote to memory of 4696 4924 519A.tmp 95 PID 4924 wrote to memory of 4696 4924 519A.tmp 95 PID 4696 wrote to memory of 2004 4696 51F8.tmp 96 PID 4696 wrote to memory of 2004 4696 51F8.tmp 96 PID 4696 wrote to memory of 2004 4696 51F8.tmp 96 PID 2004 wrote to memory of 3192 2004 5256.tmp 97 PID 2004 wrote to memory of 3192 2004 5256.tmp 97 PID 2004 wrote to memory of 3192 2004 5256.tmp 97 PID 3192 wrote to memory of 4904 3192 52A4.tmp 98 PID 3192 wrote to memory of 4904 3192 52A4.tmp 98 PID 3192 wrote to memory of 4904 3192 52A4.tmp 98 PID 4904 wrote to memory of 1248 4904 5311.tmp 99 PID 4904 wrote to memory of 1248 4904 5311.tmp 99 PID 4904 wrote to memory of 1248 4904 5311.tmp 99 PID 1248 wrote to memory of 4604 1248 536F.tmp 100 PID 1248 wrote to memory of 4604 1248 536F.tmp 100 PID 1248 wrote to memory of 4604 1248 536F.tmp 100 PID 4604 wrote to memory of 3588 4604 53BD.tmp 101 PID 4604 wrote to memory of 3588 4604 53BD.tmp 101 PID 4604 wrote to memory of 3588 4604 53BD.tmp 101 PID 3588 wrote to memory of 4808 3588 541B.tmp 102 PID 3588 wrote to memory of 4808 3588 541B.tmp 102 PID 3588 wrote to memory of 4808 3588 541B.tmp 102 PID 4808 wrote to memory of 3980 4808 5469.tmp 103 PID 4808 wrote to memory of 3980 4808 5469.tmp 103 PID 4808 wrote to memory of 3980 4808 5469.tmp 103 PID 3980 wrote to memory of 2192 3980 54B7.tmp 104 PID 3980 wrote to memory of 2192 3980 54B7.tmp 104 PID 3980 wrote to memory of 2192 3980 54B7.tmp 104 PID 2192 wrote to memory of 860 2192 5515.tmp 105 PID 2192 wrote to memory of 860 2192 5515.tmp 105 PID 2192 wrote to memory of 860 2192 5515.tmp 105 PID 860 wrote to memory of 2936 860 5563.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-10_9f0b73d98aef1e1e793a149067d1bcbb_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-10_9f0b73d98aef1e1e793a149067d1bcbb_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"23⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"24⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"25⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"26⤵
- Executes dropped EXE
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"27⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"28⤵
- Executes dropped EXE
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"29⤵
- Executes dropped EXE
PID:948 -
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"30⤵
- Executes dropped EXE
PID:412 -
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"31⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"32⤵
- Executes dropped EXE
PID:744 -
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"33⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"34⤵
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"35⤵
- Executes dropped EXE
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"36⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"37⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"38⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"39⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"40⤵
- Executes dropped EXE
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"41⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"42⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"43⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"44⤵
- Executes dropped EXE
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"45⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"46⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"47⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"48⤵
- Executes dropped EXE
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"49⤵
- Executes dropped EXE
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"50⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"51⤵
- Executes dropped EXE
PID:736 -
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"52⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"53⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"54⤵
- Executes dropped EXE
PID:516 -
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"55⤵
- Executes dropped EXE
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"56⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"57⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"58⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"59⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"60⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"61⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"62⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"63⤵
- Executes dropped EXE
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"64⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"65⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"66⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"67⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"68⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"69⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"70⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"71⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"72⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"73⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"74⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"75⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"76⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"77⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"78⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"79⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"80⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"81⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"82⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"83⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"84⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"85⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"86⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\6C56.tmp"C:\Users\Admin\AppData\Local\Temp\6C56.tmp"87⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"88⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"89⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"90⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"91⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"92⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"93⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"94⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"95⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"96⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"97⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"98⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"99⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"100⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\70DA.tmp"C:\Users\Admin\AppData\Local\Temp\70DA.tmp"101⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"102⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\7177.tmp"C:\Users\Admin\AppData\Local\Temp\7177.tmp"103⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"104⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"105⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"106⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\72BF.tmp"C:\Users\Admin\AppData\Local\Temp\72BF.tmp"107⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"108⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"109⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"110⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"111⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"112⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"113⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"114⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"115⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"116⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"117⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"118⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"119⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\7714.tmp"C:\Users\Admin\AppData\Local\Temp\7714.tmp"120⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\7762.tmp"C:\Users\Admin\AppData\Local\Temp\7762.tmp"121⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"122⤵PID:4420
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-