Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23/05/2024, 14:24
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-23_010ed7977527bd3d1d6b2b13fc6ae9c5_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-23_010ed7977527bd3d1d6b2b13fc6ae9c5_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-23_010ed7977527bd3d1d6b2b13fc6ae9c5_mafia.exe
-
Size
765KB
-
MD5
010ed7977527bd3d1d6b2b13fc6ae9c5
-
SHA1
990c785556d4d980cb2dc23bd40dd2764533d062
-
SHA256
0f6d1918b6981f61829310fab70c9fdecc184ca02b784a6984df6bb8f5b02dc1
-
SHA512
3e476e750e27a648130160793e899510b8fe12be128fb77e2a70fb705c9519c48ba47cee6275f9f67459812a9e3c1b564c9ade5cfb45c8e35765f8a1f552b5f2
-
SSDEEP
12288:ZU5rCOTeiDaTKkM+2d5ZP8C8mfTDnZQaA/wWFi293ZF5rn5rLOa54U5w5A:ZUQOJDMM+yP8C8o0/wY3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3584 3D57.tmp 1124 3DD4.tmp 1372 3E61.tmp 208 3F4B.tmp 2260 3FB8.tmp 968 4026.tmp 4376 40C2.tmp 2372 414F.tmp 2444 41BC.tmp 5080 4229.tmp 4184 4297.tmp 3984 4333.tmp 3064 43A0.tmp 1884 442D.tmp 1764 449A.tmp 2696 44F8.tmp 2364 4565.tmp 1732 45C3.tmp 2764 4640.tmp 556 46BD.tmp 616 472B.tmp 3456 4779.tmp 1212 47F6.tmp 3496 4873.tmp 1072 48E0.tmp 2312 495D.tmp 3420 49CA.tmp 2180 4A57.tmp 1796 4AB5.tmp 1944 4B32.tmp 4004 4BAF.tmp 344 4C2C.tmp 1784 4CB8.tmp 1500 4D16.tmp 2692 4D64.tmp 760 4DB2.tmp 1856 4E10.tmp 3220 4E6E.tmp 3956 4EBC.tmp 4940 4F0A.tmp 3936 4F58.tmp 1264 4FA6.tmp 2936 4FF5.tmp 4708 5072.tmp 4912 50C0.tmp 3672 510E.tmp 1016 515C.tmp 2260 51BA.tmp 836 5208.tmp 4260 5266.tmp 2940 52B4.tmp 2820 5311.tmp 412 536F.tmp 3732 53CD.tmp 2236 541B.tmp 2084 5479.tmp 4956 54C7.tmp 3984 5515.tmp 3268 5573.tmp 4404 55C1.tmp 2604 561F.tmp 64 566D.tmp 5040 56BB.tmp 3104 5709.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1808 wrote to memory of 3584 1808 2024-05-23_010ed7977527bd3d1d6b2b13fc6ae9c5_mafia.exe 83 PID 1808 wrote to memory of 3584 1808 2024-05-23_010ed7977527bd3d1d6b2b13fc6ae9c5_mafia.exe 83 PID 1808 wrote to memory of 3584 1808 2024-05-23_010ed7977527bd3d1d6b2b13fc6ae9c5_mafia.exe 83 PID 3584 wrote to memory of 1124 3584 3D57.tmp 84 PID 3584 wrote to memory of 1124 3584 3D57.tmp 84 PID 3584 wrote to memory of 1124 3584 3D57.tmp 84 PID 1124 wrote to memory of 1372 1124 3DD4.tmp 85 PID 1124 wrote to memory of 1372 1124 3DD4.tmp 85 PID 1124 wrote to memory of 1372 1124 3DD4.tmp 85 PID 1372 wrote to memory of 208 1372 3E61.tmp 87 PID 1372 wrote to memory of 208 1372 3E61.tmp 87 PID 1372 wrote to memory of 208 1372 3E61.tmp 87 PID 208 wrote to memory of 2260 208 3F4B.tmp 88 PID 208 wrote to memory of 2260 208 3F4B.tmp 88 PID 208 wrote to memory of 2260 208 3F4B.tmp 88 PID 2260 wrote to memory of 968 2260 3FB8.tmp 89 PID 2260 wrote to memory of 968 2260 3FB8.tmp 89 PID 2260 wrote to memory of 968 2260 3FB8.tmp 89 PID 968 wrote to memory of 4376 968 4026.tmp 91 PID 968 wrote to memory of 4376 968 4026.tmp 91 PID 968 wrote to memory of 4376 968 4026.tmp 91 PID 4376 wrote to memory of 2372 4376 40C2.tmp 92 PID 4376 wrote to memory of 2372 4376 40C2.tmp 92 PID 4376 wrote to memory of 2372 4376 40C2.tmp 92 PID 2372 wrote to memory of 2444 2372 414F.tmp 93 PID 2372 wrote to memory of 2444 2372 414F.tmp 93 PID 2372 wrote to memory of 2444 2372 414F.tmp 93 PID 2444 wrote to memory of 5080 2444 41BC.tmp 94 PID 2444 wrote to memory of 5080 2444 41BC.tmp 94 PID 2444 wrote to memory of 5080 2444 41BC.tmp 94 PID 5080 wrote to memory of 4184 5080 4229.tmp 95 PID 5080 wrote to memory of 4184 5080 4229.tmp 95 PID 5080 wrote to memory of 4184 5080 4229.tmp 95 PID 4184 wrote to memory of 3984 4184 4297.tmp 96 PID 4184 wrote to memory of 3984 4184 4297.tmp 96 PID 4184 wrote to memory of 3984 4184 4297.tmp 96 PID 3984 wrote to memory of 3064 3984 4333.tmp 97 PID 3984 wrote to memory of 3064 3984 4333.tmp 97 PID 3984 wrote to memory of 3064 3984 4333.tmp 97 PID 3064 wrote to memory of 1884 3064 43A0.tmp 98 PID 3064 wrote to memory of 1884 3064 43A0.tmp 98 PID 3064 wrote to memory of 1884 3064 43A0.tmp 98 PID 1884 wrote to memory of 1764 1884 442D.tmp 99 PID 1884 wrote to memory of 1764 1884 442D.tmp 99 PID 1884 wrote to memory of 1764 1884 442D.tmp 99 PID 1764 wrote to memory of 2696 1764 449A.tmp 100 PID 1764 wrote to memory of 2696 1764 449A.tmp 100 PID 1764 wrote to memory of 2696 1764 449A.tmp 100 PID 2696 wrote to memory of 2364 2696 44F8.tmp 101 PID 2696 wrote to memory of 2364 2696 44F8.tmp 101 PID 2696 wrote to memory of 2364 2696 44F8.tmp 101 PID 2364 wrote to memory of 1732 2364 4565.tmp 102 PID 2364 wrote to memory of 1732 2364 4565.tmp 102 PID 2364 wrote to memory of 1732 2364 4565.tmp 102 PID 1732 wrote to memory of 2764 1732 45C3.tmp 103 PID 1732 wrote to memory of 2764 1732 45C3.tmp 103 PID 1732 wrote to memory of 2764 1732 45C3.tmp 103 PID 2764 wrote to memory of 556 2764 4640.tmp 104 PID 2764 wrote to memory of 556 2764 4640.tmp 104 PID 2764 wrote to memory of 556 2764 4640.tmp 104 PID 556 wrote to memory of 616 556 46BD.tmp 105 PID 556 wrote to memory of 616 556 46BD.tmp 105 PID 556 wrote to memory of 616 556 46BD.tmp 105 PID 616 wrote to memory of 3456 616 472B.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_010ed7977527bd3d1d6b2b13fc6ae9c5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_010ed7977527bd3d1d6b2b13fc6ae9c5_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\3D57.tmp"C:\Users\Admin\AppData\Local\Temp\3D57.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\3E61.tmp"C:\Users\Admin\AppData\Local\Temp\3E61.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\4026.tmp"C:\Users\Admin\AppData\Local\Temp\4026.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\40C2.tmp"C:\Users\Admin\AppData\Local\Temp\40C2.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\414F.tmp"C:\Users\Admin\AppData\Local\Temp\414F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\41BC.tmp"C:\Users\Admin\AppData\Local\Temp\41BC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\4229.tmp"C:\Users\Admin\AppData\Local\Temp\4229.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\4565.tmp"C:\Users\Admin\AppData\Local\Temp\4565.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"23⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"24⤵
- Executes dropped EXE
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"25⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"26⤵
- Executes dropped EXE
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"27⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"28⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"29⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"30⤵
- Executes dropped EXE
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"31⤵
- Executes dropped EXE
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"32⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"33⤵
- Executes dropped EXE
PID:344 -
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"34⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"35⤵
- Executes dropped EXE
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"36⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"37⤵
- Executes dropped EXE
PID:760 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"38⤵
- Executes dropped EXE
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"39⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"40⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"41⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"42⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"43⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"44⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"45⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"46⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"47⤵
- Executes dropped EXE
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"48⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"49⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"50⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"51⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"52⤵
- Executes dropped EXE
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"53⤵
- Executes dropped EXE
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"54⤵
- Executes dropped EXE
PID:412 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"55⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"56⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"57⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"58⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"59⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"60⤵
- Executes dropped EXE
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"61⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"62⤵
- Executes dropped EXE
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"63⤵
- Executes dropped EXE
PID:64 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"64⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"65⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"66⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"67⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"68⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"69⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"70⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"71⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"72⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"73⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"74⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"75⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"76⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"77⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"78⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"79⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"80⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"81⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"82⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"83⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"84⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"85⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"86⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"87⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"88⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"89⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"90⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"91⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"92⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"93⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"94⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"95⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"96⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"97⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"98⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"99⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"100⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"101⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"102⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"103⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"104⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"105⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"106⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"107⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"108⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"109⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"110⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\6745.tmp"C:\Users\Admin\AppData\Local\Temp\6745.tmp"111⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"112⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"113⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"114⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"115⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"116⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"117⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"118⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"119⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"120⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"121⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"122⤵PID:1060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-