Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25/03/2024, 22:49
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-25_c431e56f83c4e5795e47f2ec37e7c2a5_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-03-25_c431e56f83c4e5795e47f2ec37e7c2a5_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-25_c431e56f83c4e5795e47f2ec37e7c2a5_mafia.exe
-
Size
486KB
-
MD5
c431e56f83c4e5795e47f2ec37e7c2a5
-
SHA1
7f54be147505ff33c4c33ce6d62f00a232466425
-
SHA256
420d32165c16434e173614fe2327d8ef4433c68163f0625ade1e8d3cf446aafe
-
SHA512
62ae8d984da6bd4e7293407fe66f7522cc6b09efbc6fdf573acb315f99b96e2e40087da1be5ec0a248b479a9eaef8e26b3a929a596a9e3569045b5adc55bdc89
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD75H2wffK8HhFQiGoJw2c0kYJmgCqYgsXxwcJe:/U5rCOTeiD52ofhDGMw2c0kYOjwLzNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4588 7C73.tmp 2020 7D00.tmp 3948 7D8C.tmp 1784 7E67.tmp 844 7EF4.tmp 4748 7FBF.tmp 2352 805B.tmp 3508 80E8.tmp 1116 81A3.tmp 1324 8240.tmp 4600 82CC.tmp 2808 8378.tmp 4968 8434.tmp 1004 855C.tmp 948 8608.tmp 1768 86A5.tmp 2560 8722.tmp 3552 87BE.tmp 4648 884A.tmp 1716 88D7.tmp 3136 8A6D.tmp 4972 8AFA.tmp 3504 8B96.tmp 848 8C04.tmp 2996 8CBF.tmp 2904 8D5B.tmp 2564 8DF8.tmp 4960 8EE2.tmp 4280 900B.tmp 3348 90C6.tmp 4232 9153.tmp 1884 920E.tmp 3388 92AB.tmp 1112 92F9.tmp 5020 9366.tmp 4768 93F3.tmp 1088 948F.tmp 2992 951C.tmp 1324 95A8.tmp 464 9616.tmp 4420 96A2.tmp 3088 9829.tmp 4968 98B6.tmp 2580 9952.tmp 4712 9A0D.tmp 4496 9A9A.tmp 3452 9B46.tmp 3132 9BE2.tmp 3552 9C5F.tmp 3564 9CEC.tmp 2068 9D59.tmp 672 9DD6.tmp 4964 9E53.tmp 1196 9EE0.tmp 2948 9F7C.tmp 1560 A018.tmp 4632 A076.tmp 4072 A0F3.tmp 4672 A180.tmp 4664 A21C.tmp 3396 A2B8.tmp 4960 A345.tmp 4280 A3D1.tmp 1988 A45E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4832 wrote to memory of 4588 4832 2024-03-25_c431e56f83c4e5795e47f2ec37e7c2a5_mafia.exe 87 PID 4832 wrote to memory of 4588 4832 2024-03-25_c431e56f83c4e5795e47f2ec37e7c2a5_mafia.exe 87 PID 4832 wrote to memory of 4588 4832 2024-03-25_c431e56f83c4e5795e47f2ec37e7c2a5_mafia.exe 87 PID 4588 wrote to memory of 2020 4588 7C73.tmp 88 PID 4588 wrote to memory of 2020 4588 7C73.tmp 88 PID 4588 wrote to memory of 2020 4588 7C73.tmp 88 PID 2020 wrote to memory of 3948 2020 7D00.tmp 89 PID 2020 wrote to memory of 3948 2020 7D00.tmp 89 PID 2020 wrote to memory of 3948 2020 7D00.tmp 89 PID 3948 wrote to memory of 1784 3948 7D8C.tmp 90 PID 3948 wrote to memory of 1784 3948 7D8C.tmp 90 PID 3948 wrote to memory of 1784 3948 7D8C.tmp 90 PID 1784 wrote to memory of 844 1784 7E67.tmp 92 PID 1784 wrote to memory of 844 1784 7E67.tmp 92 PID 1784 wrote to memory of 844 1784 7E67.tmp 92 PID 844 wrote to memory of 4748 844 7EF4.tmp 93 PID 844 wrote to memory of 4748 844 7EF4.tmp 93 PID 844 wrote to memory of 4748 844 7EF4.tmp 93 PID 4748 wrote to memory of 2352 4748 7FBF.tmp 95 PID 4748 wrote to memory of 2352 4748 7FBF.tmp 95 PID 4748 wrote to memory of 2352 4748 7FBF.tmp 95 PID 2352 wrote to memory of 3508 2352 805B.tmp 96 PID 2352 wrote to memory of 3508 2352 805B.tmp 96 PID 2352 wrote to memory of 3508 2352 805B.tmp 96 PID 3508 wrote to memory of 1116 3508 80E8.tmp 98 PID 3508 wrote to memory of 1116 3508 80E8.tmp 98 PID 3508 wrote to memory of 1116 3508 80E8.tmp 98 PID 1116 wrote to memory of 1324 1116 81A3.tmp 99 PID 1116 wrote to memory of 1324 1116 81A3.tmp 99 PID 1116 wrote to memory of 1324 1116 81A3.tmp 99 PID 1324 wrote to memory of 4600 1324 8240.tmp 100 PID 1324 wrote to memory of 4600 1324 8240.tmp 100 PID 1324 wrote to memory of 4600 1324 8240.tmp 100 PID 4600 wrote to memory of 2808 4600 82CC.tmp 101 PID 4600 wrote to memory of 2808 4600 82CC.tmp 101 PID 4600 wrote to memory of 2808 4600 82CC.tmp 101 PID 2808 wrote to memory of 4968 2808 8378.tmp 102 PID 2808 wrote to memory of 4968 2808 8378.tmp 102 PID 2808 wrote to memory of 4968 2808 8378.tmp 102 PID 4968 wrote to memory of 1004 4968 8434.tmp 103 PID 4968 wrote to memory of 1004 4968 8434.tmp 103 PID 4968 wrote to memory of 1004 4968 8434.tmp 103 PID 1004 wrote to memory of 948 1004 855C.tmp 104 PID 1004 wrote to memory of 948 1004 855C.tmp 104 PID 1004 wrote to memory of 948 1004 855C.tmp 104 PID 948 wrote to memory of 1768 948 8608.tmp 105 PID 948 wrote to memory of 1768 948 8608.tmp 105 PID 948 wrote to memory of 1768 948 8608.tmp 105 PID 1768 wrote to memory of 2560 1768 86A5.tmp 106 PID 1768 wrote to memory of 2560 1768 86A5.tmp 106 PID 1768 wrote to memory of 2560 1768 86A5.tmp 106 PID 2560 wrote to memory of 3552 2560 8722.tmp 108 PID 2560 wrote to memory of 3552 2560 8722.tmp 108 PID 2560 wrote to memory of 3552 2560 8722.tmp 108 PID 3552 wrote to memory of 4648 3552 87BE.tmp 109 PID 3552 wrote to memory of 4648 3552 87BE.tmp 109 PID 3552 wrote to memory of 4648 3552 87BE.tmp 109 PID 4648 wrote to memory of 1716 4648 884A.tmp 110 PID 4648 wrote to memory of 1716 4648 884A.tmp 110 PID 4648 wrote to memory of 1716 4648 884A.tmp 110 PID 1716 wrote to memory of 3136 1716 88D7.tmp 112 PID 1716 wrote to memory of 3136 1716 88D7.tmp 112 PID 1716 wrote to memory of 3136 1716 88D7.tmp 112 PID 3136 wrote to memory of 4972 3136 8A6D.tmp 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-25_c431e56f83c4e5795e47f2ec37e7c2a5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-25_c431e56f83c4e5795e47f2ec37e7c2a5_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\7C73.tmp"C:\Users\Admin\AppData\Local\Temp\7C73.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\7D00.tmp"C:\Users\Admin\AppData\Local\Temp\7D00.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\7E67.tmp"C:\Users\Admin\AppData\Local\Temp\7E67.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\805B.tmp"C:\Users\Admin\AppData\Local\Temp\805B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\80E8.tmp"C:\Users\Admin\AppData\Local\Temp\80E8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\81A3.tmp"C:\Users\Admin\AppData\Local\Temp\81A3.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\8240.tmp"C:\Users\Admin\AppData\Local\Temp\8240.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\8378.tmp"C:\Users\Admin\AppData\Local\Temp\8378.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\8434.tmp"C:\Users\Admin\AppData\Local\Temp\8434.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\855C.tmp"C:\Users\Admin\AppData\Local\Temp\855C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\8608.tmp"C:\Users\Admin\AppData\Local\Temp\8608.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\86A5.tmp"C:\Users\Admin\AppData\Local\Temp\86A5.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\8722.tmp"C:\Users\Admin\AppData\Local\Temp\8722.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\87BE.tmp"C:\Users\Admin\AppData\Local\Temp\87BE.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"23⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\8B96.tmp"C:\Users\Admin\AppData\Local\Temp\8B96.tmp"24⤵
- Executes dropped EXE
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\8C04.tmp"C:\Users\Admin\AppData\Local\Temp\8C04.tmp"25⤵
- Executes dropped EXE
PID:848 -
C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"26⤵
- Executes dropped EXE
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"27⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"28⤵
- Executes dropped EXE
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"29⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\900B.tmp"C:\Users\Admin\AppData\Local\Temp\900B.tmp"30⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"31⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\9153.tmp"C:\Users\Admin\AppData\Local\Temp\9153.tmp"32⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"33⤵
- Executes dropped EXE
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\92AB.tmp"C:\Users\Admin\AppData\Local\Temp\92AB.tmp"34⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\92F9.tmp"C:\Users\Admin\AppData\Local\Temp\92F9.tmp"35⤵
- Executes dropped EXE
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\9366.tmp"C:\Users\Admin\AppData\Local\Temp\9366.tmp"36⤵
- Executes dropped EXE
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\93F3.tmp"C:\Users\Admin\AppData\Local\Temp\93F3.tmp"37⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\948F.tmp"C:\Users\Admin\AppData\Local\Temp\948F.tmp"38⤵
- Executes dropped EXE
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\951C.tmp"C:\Users\Admin\AppData\Local\Temp\951C.tmp"39⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"40⤵
- Executes dropped EXE
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"41⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"42⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"43⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\98B6.tmp"C:\Users\Admin\AppData\Local\Temp\98B6.tmp"44⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\9952.tmp"C:\Users\Admin\AppData\Local\Temp\9952.tmp"45⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"46⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"47⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"48⤵
- Executes dropped EXE
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"49⤵
- Executes dropped EXE
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"50⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"51⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\9D59.tmp"C:\Users\Admin\AppData\Local\Temp\9D59.tmp"52⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"53⤵
- Executes dropped EXE
PID:672 -
C:\Users\Admin\AppData\Local\Temp\9E53.tmp"C:\Users\Admin\AppData\Local\Temp\9E53.tmp"54⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"55⤵
- Executes dropped EXE
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"56⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"57⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\A076.tmp"C:\Users\Admin\AppData\Local\Temp\A076.tmp"58⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"59⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\A180.tmp"C:\Users\Admin\AppData\Local\Temp\A180.tmp"60⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\A21C.tmp"C:\Users\Admin\AppData\Local\Temp\A21C.tmp"61⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"62⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"63⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"64⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"65⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"66⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"67⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"68⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"69⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"70⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\A78A.tmp"C:\Users\Admin\AppData\Local\Temp\A78A.tmp"71⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\A827.tmp"C:\Users\Admin\AppData\Local\Temp\A827.tmp"72⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"73⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\A921.tmp"C:\Users\Admin\AppData\Local\Temp\A921.tmp"74⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"75⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"76⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"77⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"78⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"79⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\AB82.tmp"C:\Users\Admin\AppData\Local\Temp\AB82.tmp"80⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"81⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"82⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\AD57.tmp"C:\Users\Admin\AppData\Local\Temp\AD57.tmp"83⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"84⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\AE41.tmp"C:\Users\Admin\AppData\Local\Temp\AE41.tmp"85⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"86⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"87⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"88⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\B074.tmp"C:\Users\Admin\AppData\Local\Temp\B074.tmp"89⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"90⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\B17D.tmp"C:\Users\Admin\AppData\Local\Temp\B17D.tmp"91⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\B239.tmp"C:\Users\Admin\AppData\Local\Temp\B239.tmp"92⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"93⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"94⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\B391.tmp"C:\Users\Admin\AppData\Local\Temp\B391.tmp"95⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\B42D.tmp"C:\Users\Admin\AppData\Local\Temp\B42D.tmp"96⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"97⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\B565.tmp"C:\Users\Admin\AppData\Local\Temp\B565.tmp"98⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"99⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\B650.tmp"C:\Users\Admin\AppData\Local\Temp\B650.tmp"100⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"101⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\B769.tmp"C:\Users\Admin\AppData\Local\Temp\B769.tmp"102⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"103⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\B863.tmp"C:\Users\Admin\AppData\Local\Temp\B863.tmp"104⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"105⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\B95D.tmp"C:\Users\Admin\AppData\Local\Temp\B95D.tmp"106⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"107⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\BA57.tmp"C:\Users\Admin\AppData\Local\Temp\BA57.tmp"108⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"109⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"110⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"111⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"112⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"113⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\BD83.tmp"C:\Users\Admin\AppData\Local\Temp\BD83.tmp"114⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\BE10.tmp"C:\Users\Admin\AppData\Local\Temp\BE10.tmp"115⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"116⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"117⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\BF87.tmp"C:\Users\Admin\AppData\Local\Temp\BF87.tmp"118⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\C004.tmp"C:\Users\Admin\AppData\Local\Temp\C004.tmp"119⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\C071.tmp"C:\Users\Admin\AppData\Local\Temp\C071.tmp"120⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"121⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\C18B.tmp"C:\Users\Admin\AppData\Local\Temp\C18B.tmp"122⤵PID:3604
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-