Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14/03/2024, 06:48
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-14_4aa2def1f11ae6988836774b4149567e_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-14_4aa2def1f11ae6988836774b4149567e_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-14_4aa2def1f11ae6988836774b4149567e_mafia.exe
-
Size
488KB
-
MD5
4aa2def1f11ae6988836774b4149567e
-
SHA1
20525535e3067d207e74da4d76324fc0045b1b00
-
SHA256
4673e7294caabc1c6ded9b649dd342f94c3610db4f4b605366e086593a6f2efd
-
SHA512
b0610179163f86b853634f66cf40f166012fe4e57a84cd169cfec4f092335744d4d4c0fd90ffaa8025f204acece3f9c24d06edb6a30dac3cf39b91859737e2b6
-
SSDEEP
12288:/U5rCOTeiD9a1vxuZW68NPtRvz9W7W78/NZ:/UQOJD90gx0jQ/N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 316 43DF.tmp 3352 444C.tmp 1804 44AA.tmp 4472 4517.tmp 2352 4594.tmp 3204 45E2.tmp 4124 465F.tmp 1852 46BD.tmp 3572 470B.tmp 4216 4779.tmp 4564 47D6.tmp 2556 4834.tmp 1512 4882.tmp 2636 48F0.tmp 3412 494D.tmp 1668 49BB.tmp 4896 4A28.tmp 2064 4A76.tmp 2116 4AE4.tmp 5020 4B41.tmp 4200 4BAF.tmp 3704 4BFD.tmp 1476 4C6A.tmp 1676 4CD8.tmp 4912 4D35.tmp 4760 4D84.tmp 4836 4DD2.tmp 4344 4E4F.tmp 4868 4EAC.tmp 696 4F1A.tmp 4348 4F87.tmp 3200 5004.tmp 3896 5052.tmp 536 50A0.tmp 3564 50EF.tmp 3752 513D.tmp 4428 518B.tmp 4472 51E9.tmp 2344 5237.tmp 2616 5285.tmp 3416 52D3.tmp 2160 5331.tmp 4680 538E.tmp 2276 53DD.tmp 3044 542B.tmp 228 5479.tmp 3792 54C7.tmp 2428 5515.tmp 3828 5573.tmp 5056 55D1.tmp 1500 562E.tmp 4144 567C.tmp 3596 56DA.tmp 1784 5728.tmp 4364 5786.tmp 4224 57D4.tmp 3324 5822.tmp 3616 5880.tmp 2772 58DE.tmp 2476 592C.tmp 1496 598A.tmp 4860 59D8.tmp 880 5A26.tmp 1392 5A84.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3304 wrote to memory of 316 3304 2024-03-14_4aa2def1f11ae6988836774b4149567e_mafia.exe 90 PID 3304 wrote to memory of 316 3304 2024-03-14_4aa2def1f11ae6988836774b4149567e_mafia.exe 90 PID 3304 wrote to memory of 316 3304 2024-03-14_4aa2def1f11ae6988836774b4149567e_mafia.exe 90 PID 316 wrote to memory of 3352 316 43DF.tmp 91 PID 316 wrote to memory of 3352 316 43DF.tmp 91 PID 316 wrote to memory of 3352 316 43DF.tmp 91 PID 3352 wrote to memory of 1804 3352 444C.tmp 92 PID 3352 wrote to memory of 1804 3352 444C.tmp 92 PID 3352 wrote to memory of 1804 3352 444C.tmp 92 PID 1804 wrote to memory of 4472 1804 44AA.tmp 93 PID 1804 wrote to memory of 4472 1804 44AA.tmp 93 PID 1804 wrote to memory of 4472 1804 44AA.tmp 93 PID 4472 wrote to memory of 2352 4472 4517.tmp 94 PID 4472 wrote to memory of 2352 4472 4517.tmp 94 PID 4472 wrote to memory of 2352 4472 4517.tmp 94 PID 2352 wrote to memory of 3204 2352 4594.tmp 95 PID 2352 wrote to memory of 3204 2352 4594.tmp 95 PID 2352 wrote to memory of 3204 2352 4594.tmp 95 PID 3204 wrote to memory of 4124 3204 45E2.tmp 97 PID 3204 wrote to memory of 4124 3204 45E2.tmp 97 PID 3204 wrote to memory of 4124 3204 45E2.tmp 97 PID 4124 wrote to memory of 1852 4124 465F.tmp 100 PID 4124 wrote to memory of 1852 4124 465F.tmp 100 PID 4124 wrote to memory of 1852 4124 465F.tmp 100 PID 1852 wrote to memory of 3572 1852 46BD.tmp 101 PID 1852 wrote to memory of 3572 1852 46BD.tmp 101 PID 1852 wrote to memory of 3572 1852 46BD.tmp 101 PID 3572 wrote to memory of 4216 3572 470B.tmp 102 PID 3572 wrote to memory of 4216 3572 470B.tmp 102 PID 3572 wrote to memory of 4216 3572 470B.tmp 102 PID 4216 wrote to memory of 4564 4216 4779.tmp 103 PID 4216 wrote to memory of 4564 4216 4779.tmp 103 PID 4216 wrote to memory of 4564 4216 4779.tmp 103 PID 4564 wrote to memory of 2556 4564 47D6.tmp 104 PID 4564 wrote to memory of 2556 4564 47D6.tmp 104 PID 4564 wrote to memory of 2556 4564 47D6.tmp 104 PID 2556 wrote to memory of 1512 2556 4834.tmp 105 PID 2556 wrote to memory of 1512 2556 4834.tmp 105 PID 2556 wrote to memory of 1512 2556 4834.tmp 105 PID 1512 wrote to memory of 2636 1512 4882.tmp 106 PID 1512 wrote to memory of 2636 1512 4882.tmp 106 PID 1512 wrote to memory of 2636 1512 4882.tmp 106 PID 2636 wrote to memory of 3412 2636 48F0.tmp 107 PID 2636 wrote to memory of 3412 2636 48F0.tmp 107 PID 2636 wrote to memory of 3412 2636 48F0.tmp 107 PID 3412 wrote to memory of 1668 3412 494D.tmp 108 PID 3412 wrote to memory of 1668 3412 494D.tmp 108 PID 3412 wrote to memory of 1668 3412 494D.tmp 108 PID 1668 wrote to memory of 4896 1668 49BB.tmp 109 PID 1668 wrote to memory of 4896 1668 49BB.tmp 109 PID 1668 wrote to memory of 4896 1668 49BB.tmp 109 PID 4896 wrote to memory of 2064 4896 4A28.tmp 110 PID 4896 wrote to memory of 2064 4896 4A28.tmp 110 PID 4896 wrote to memory of 2064 4896 4A28.tmp 110 PID 2064 wrote to memory of 2116 2064 4A76.tmp 111 PID 2064 wrote to memory of 2116 2064 4A76.tmp 111 PID 2064 wrote to memory of 2116 2064 4A76.tmp 111 PID 2116 wrote to memory of 5020 2116 4AE4.tmp 112 PID 2116 wrote to memory of 5020 2116 4AE4.tmp 112 PID 2116 wrote to memory of 5020 2116 4AE4.tmp 112 PID 5020 wrote to memory of 4200 5020 4B41.tmp 113 PID 5020 wrote to memory of 4200 5020 4B41.tmp 113 PID 5020 wrote to memory of 4200 5020 4B41.tmp 113 PID 4200 wrote to memory of 3704 4200 4BAF.tmp 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-14_4aa2def1f11ae6988836774b4149567e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-14_4aa2def1f11ae6988836774b4149567e_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\44AA.tmp"C:\Users\Admin\AppData\Local\Temp\44AA.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"23⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"24⤵
- Executes dropped EXE
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"25⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"26⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"27⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"28⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"29⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"30⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"31⤵
- Executes dropped EXE
PID:696 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"32⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"33⤵
- Executes dropped EXE
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"34⤵
- Executes dropped EXE
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"35⤵
- Executes dropped EXE
PID:536 -
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"36⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"37⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"38⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"39⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"40⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"41⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"42⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"43⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"44⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"45⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"46⤵
- Executes dropped EXE
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"47⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"48⤵
- Executes dropped EXE
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"49⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"50⤵
- Executes dropped EXE
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"51⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"52⤵
- Executes dropped EXE
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"53⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"54⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"55⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"56⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"57⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"58⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"59⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"60⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"61⤵
- Executes dropped EXE
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"62⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"63⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"64⤵
- Executes dropped EXE
PID:880 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"65⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"66⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"67⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"68⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"69⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"70⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"71⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"72⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"73⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"74⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"75⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"76⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"77⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"78⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"79⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"80⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"81⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"82⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"83⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"84⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"85⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"86⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"87⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"88⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"89⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"90⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"91⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"92⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"93⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"94⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"95⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"96⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"97⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"98⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"99⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"100⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"101⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"102⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"103⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"104⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"105⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"106⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"107⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"108⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"109⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"110⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"111⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"112⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"113⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"114⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"115⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"116⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"117⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"118⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"119⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"120⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"121⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"122⤵PID:464
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-