Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2024, 21:04
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-23_ec21b77794fdff31b8507d7e84f72c66_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-23_ec21b77794fdff31b8507d7e84f72c66_mafia.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-23_ec21b77794fdff31b8507d7e84f72c66_mafia.exe
-
Size
536KB
-
MD5
ec21b77794fdff31b8507d7e84f72c66
-
SHA1
39366b05bacc18951bd264279d11976886e572ce
-
SHA256
bad702e239f4733c7c65d0e139ff449f4accdafefbab4f71c638790483a93ed1
-
SHA512
5cee3fa2e5d9bf74fc88995df25f02bc4bbd1e8c8178e95074518b88c89c5f57f6aef050c75018e41b7658c48cca68377d26539d5e3ce3d16a9a3ad3c6c6d152
-
SSDEEP
12288:wU5rCOTeiUb6mxFqFW9zVzpBksNPAIZxVJ0ZT9:wUQOJUpUFW9zVzpSM4IRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4564 29A0.tmp 432 2A3C.tmp 4956 2AD9.tmp 1456 2B56.tmp 4108 2C11.tmp 3644 2C6F.tmp 4024 2CDC.tmp 4900 2D69.tmp 5096 2DF5.tmp 1804 2E82.tmp 3936 2F0F.tmp 3016 2FAB.tmp 4192 3180.tmp 3880 320C.tmp 4588 3289.tmp 2416 32F7.tmp 536 3374.tmp 3204 33C2.tmp 4116 343F.tmp 1344 34AC.tmp 916 3529.tmp 4552 3597.tmp 1516 35F4.tmp 4560 3671.tmp 3020 370E.tmp 4324 379A.tmp 4512 3865.tmp 4164 38F2.tmp 1912 397F.tmp 1520 39EC.tmp 1916 3A69.tmp 1832 3AE6.tmp 1952 3B53.tmp 4372 3BA1.tmp 1048 3BF0.tmp 3016 3C3E.tmp 4100 3C8C.tmp 3712 3CF9.tmp 3220 3D57.tmp 1836 3DA5.tmp 64 3E03.tmp 4220 3E61.tmp 4888 3EBE.tmp 1432 3F0C.tmp 3080 3F5B.tmp 3196 3FA9.tmp 2996 3FF7.tmp 1516 4045.tmp 4560 4093.tmp 2160 40E1.tmp 3604 413F.tmp 404 419D.tmp 4232 41EB.tmp 4644 4258.tmp 4164 42B6.tmp 4956 4304.tmp 4940 4352.tmp 3972 43A0.tmp 1932 43FE.tmp 3312 444C.tmp 3684 449A.tmp 5096 44E8.tmp 4420 4537.tmp 3016 4585.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4296 wrote to memory of 4564 4296 2024-04-23_ec21b77794fdff31b8507d7e84f72c66_mafia.exe 84 PID 4296 wrote to memory of 4564 4296 2024-04-23_ec21b77794fdff31b8507d7e84f72c66_mafia.exe 84 PID 4296 wrote to memory of 4564 4296 2024-04-23_ec21b77794fdff31b8507d7e84f72c66_mafia.exe 84 PID 4564 wrote to memory of 432 4564 29A0.tmp 85 PID 4564 wrote to memory of 432 4564 29A0.tmp 85 PID 4564 wrote to memory of 432 4564 29A0.tmp 85 PID 432 wrote to memory of 4956 432 2A3C.tmp 87 PID 432 wrote to memory of 4956 432 2A3C.tmp 87 PID 432 wrote to memory of 4956 432 2A3C.tmp 87 PID 4956 wrote to memory of 1456 4956 2AD9.tmp 89 PID 4956 wrote to memory of 1456 4956 2AD9.tmp 89 PID 4956 wrote to memory of 1456 4956 2AD9.tmp 89 PID 1456 wrote to memory of 4108 1456 2B56.tmp 91 PID 1456 wrote to memory of 4108 1456 2B56.tmp 91 PID 1456 wrote to memory of 4108 1456 2B56.tmp 91 PID 4108 wrote to memory of 3644 4108 2C11.tmp 92 PID 4108 wrote to memory of 3644 4108 2C11.tmp 92 PID 4108 wrote to memory of 3644 4108 2C11.tmp 92 PID 3644 wrote to memory of 4024 3644 2C6F.tmp 93 PID 3644 wrote to memory of 4024 3644 2C6F.tmp 93 PID 3644 wrote to memory of 4024 3644 2C6F.tmp 93 PID 4024 wrote to memory of 4900 4024 2CDC.tmp 94 PID 4024 wrote to memory of 4900 4024 2CDC.tmp 94 PID 4024 wrote to memory of 4900 4024 2CDC.tmp 94 PID 4900 wrote to memory of 5096 4900 2D69.tmp 95 PID 4900 wrote to memory of 5096 4900 2D69.tmp 95 PID 4900 wrote to memory of 5096 4900 2D69.tmp 95 PID 5096 wrote to memory of 1804 5096 2DF5.tmp 96 PID 5096 wrote to memory of 1804 5096 2DF5.tmp 96 PID 5096 wrote to memory of 1804 5096 2DF5.tmp 96 PID 1804 wrote to memory of 3936 1804 2E82.tmp 98 PID 1804 wrote to memory of 3936 1804 2E82.tmp 98 PID 1804 wrote to memory of 3936 1804 2E82.tmp 98 PID 3936 wrote to memory of 3016 3936 2F0F.tmp 99 PID 3936 wrote to memory of 3016 3936 2F0F.tmp 99 PID 3936 wrote to memory of 3016 3936 2F0F.tmp 99 PID 3016 wrote to memory of 4192 3016 2FAB.tmp 100 PID 3016 wrote to memory of 4192 3016 2FAB.tmp 100 PID 3016 wrote to memory of 4192 3016 2FAB.tmp 100 PID 4192 wrote to memory of 3880 4192 3180.tmp 101 PID 4192 wrote to memory of 3880 4192 3180.tmp 101 PID 4192 wrote to memory of 3880 4192 3180.tmp 101 PID 3880 wrote to memory of 4588 3880 320C.tmp 102 PID 3880 wrote to memory of 4588 3880 320C.tmp 102 PID 3880 wrote to memory of 4588 3880 320C.tmp 102 PID 4588 wrote to memory of 2416 4588 3289.tmp 103 PID 4588 wrote to memory of 2416 4588 3289.tmp 103 PID 4588 wrote to memory of 2416 4588 3289.tmp 103 PID 2416 wrote to memory of 536 2416 32F7.tmp 104 PID 2416 wrote to memory of 536 2416 32F7.tmp 104 PID 2416 wrote to memory of 536 2416 32F7.tmp 104 PID 536 wrote to memory of 3204 536 3374.tmp 105 PID 536 wrote to memory of 3204 536 3374.tmp 105 PID 536 wrote to memory of 3204 536 3374.tmp 105 PID 3204 wrote to memory of 4116 3204 33C2.tmp 106 PID 3204 wrote to memory of 4116 3204 33C2.tmp 106 PID 3204 wrote to memory of 4116 3204 33C2.tmp 106 PID 4116 wrote to memory of 1344 4116 343F.tmp 107 PID 4116 wrote to memory of 1344 4116 343F.tmp 107 PID 4116 wrote to memory of 1344 4116 343F.tmp 107 PID 1344 wrote to memory of 916 1344 34AC.tmp 108 PID 1344 wrote to memory of 916 1344 34AC.tmp 108 PID 1344 wrote to memory of 916 1344 34AC.tmp 108 PID 916 wrote to memory of 4552 916 3529.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-23_ec21b77794fdff31b8507d7e84f72c66_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-23_ec21b77794fdff31b8507d7e84f72c66_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\2AD9.tmp"C:\Users\Admin\AppData\Local\Temp\2AD9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\2B56.tmp"C:\Users\Admin\AppData\Local\Temp\2B56.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\2C11.tmp"C:\Users\Admin\AppData\Local\Temp\2C11.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\2C6F.tmp"C:\Users\Admin\AppData\Local\Temp\2C6F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\2CDC.tmp"C:\Users\Admin\AppData\Local\Temp\2CDC.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\2D69.tmp"C:\Users\Admin\AppData\Local\Temp\2D69.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\2DF5.tmp"C:\Users\Admin\AppData\Local\Temp\2DF5.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\2E82.tmp"C:\Users\Admin\AppData\Local\Temp\2E82.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\2F0F.tmp"C:\Users\Admin\AppData\Local\Temp\2F0F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\2FAB.tmp"C:\Users\Admin\AppData\Local\Temp\2FAB.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\3180.tmp"C:\Users\Admin\AppData\Local\Temp\3180.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\320C.tmp"C:\Users\Admin\AppData\Local\Temp\320C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\3289.tmp"C:\Users\Admin\AppData\Local\Temp\3289.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\32F7.tmp"C:\Users\Admin\AppData\Local\Temp\32F7.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\3374.tmp"C:\Users\Admin\AppData\Local\Temp\3374.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\33C2.tmp"C:\Users\Admin\AppData\Local\Temp\33C2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\343F.tmp"C:\Users\Admin\AppData\Local\Temp\343F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\34AC.tmp"C:\Users\Admin\AppData\Local\Temp\34AC.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\3529.tmp"C:\Users\Admin\AppData\Local\Temp\3529.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\3597.tmp"C:\Users\Admin\AppData\Local\Temp\3597.tmp"23⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\35F4.tmp"C:\Users\Admin\AppData\Local\Temp\35F4.tmp"24⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\3671.tmp"C:\Users\Admin\AppData\Local\Temp\3671.tmp"25⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\370E.tmp"C:\Users\Admin\AppData\Local\Temp\370E.tmp"26⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\379A.tmp"C:\Users\Admin\AppData\Local\Temp\379A.tmp"27⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\3865.tmp"C:\Users\Admin\AppData\Local\Temp\3865.tmp"28⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\38F2.tmp"C:\Users\Admin\AppData\Local\Temp\38F2.tmp"29⤵
- Executes dropped EXE
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\397F.tmp"C:\Users\Admin\AppData\Local\Temp\397F.tmp"30⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\39EC.tmp"C:\Users\Admin\AppData\Local\Temp\39EC.tmp"31⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\3A69.tmp"C:\Users\Admin\AppData\Local\Temp\3A69.tmp"32⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"33⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\3B53.tmp"C:\Users\Admin\AppData\Local\Temp\3B53.tmp"34⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"35⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"36⤵
- Executes dropped EXE
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\3C3E.tmp"C:\Users\Admin\AppData\Local\Temp\3C3E.tmp"37⤵
- Executes dropped EXE
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"38⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"39⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\3D57.tmp"C:\Users\Admin\AppData\Local\Temp\3D57.tmp"40⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\3DA5.tmp"C:\Users\Admin\AppData\Local\Temp\3DA5.tmp"41⤵
- Executes dropped EXE
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\3E03.tmp"C:\Users\Admin\AppData\Local\Temp\3E03.tmp"42⤵
- Executes dropped EXE
PID:64 -
C:\Users\Admin\AppData\Local\Temp\3E61.tmp"C:\Users\Admin\AppData\Local\Temp\3E61.tmp"43⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"44⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"45⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"46⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"47⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"48⤵
- Executes dropped EXE
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\4045.tmp"C:\Users\Admin\AppData\Local\Temp\4045.tmp"49⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\4093.tmp"C:\Users\Admin\AppData\Local\Temp\4093.tmp"50⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\40E1.tmp"C:\Users\Admin\AppData\Local\Temp\40E1.tmp"51⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\413F.tmp"C:\Users\Admin\AppData\Local\Temp\413F.tmp"52⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\419D.tmp"C:\Users\Admin\AppData\Local\Temp\419D.tmp"53⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\41EB.tmp"C:\Users\Admin\AppData\Local\Temp\41EB.tmp"54⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\4258.tmp"C:\Users\Admin\AppData\Local\Temp\4258.tmp"55⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\42B6.tmp"C:\Users\Admin\AppData\Local\Temp\42B6.tmp"56⤵
- Executes dropped EXE
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\4304.tmp"C:\Users\Admin\AppData\Local\Temp\4304.tmp"57⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\4352.tmp"C:\Users\Admin\AppData\Local\Temp\4352.tmp"58⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"59⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\43FE.tmp"C:\Users\Admin\AppData\Local\Temp\43FE.tmp"60⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"61⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"62⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"63⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"64⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"65⤵
- Executes dropped EXE
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\45D3.tmp"C:\Users\Admin\AppData\Local\Temp\45D3.tmp"66⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"67⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"68⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"69⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"70⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"71⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"72⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"73⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"74⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"75⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"76⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"77⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"78⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"79⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\4A19.tmp"C:\Users\Admin\AppData\Local\Temp\4A19.tmp"80⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"81⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"82⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"83⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"84⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"85⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"86⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"87⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"88⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"89⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"90⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"91⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"92⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"93⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"94⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"95⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"96⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"97⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"98⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"99⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"100⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"101⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"102⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"103⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"104⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"105⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"106⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"107⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"108⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"109⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"110⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"111⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"112⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"113⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"114⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"115⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"116⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"117⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"118⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"119⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"120⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"121⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"122⤵PID:4664
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-