Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29/02/2024, 04:47
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-29_de4c81872566ee040216b424d00f6cc8_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-02-29_de4c81872566ee040216b424d00f6cc8_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-02-29_de4c81872566ee040216b424d00f6cc8_mafia.exe
-
Size
527KB
-
MD5
de4c81872566ee040216b424d00f6cc8
-
SHA1
998552bb3330c70b2105ed29dc7640a53e4e0973
-
SHA256
dfd588d7b91c2bde09847516674469c90da966cfca7cc7ee8d9ba411d63b06eb
-
SHA512
648bdaaab233e15a124fc8f65070212807fd2e91012fcdc3347268ddf88f2f26ba0d0316b71ee6d3ccd4b82e6f8f5c34b3c544ef39525ebda372e39c5600b490
-
SSDEEP
6144:yorf3lPvovsgZnqG2C7mOTeiLRDYgX3m2dlEx1KPob8KQ0aWA/kd7Gx8WrQE7ltN:fU5rCOTeid9X22dGx1mTHSWJqJioDZu
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2112 5237.tmp 1312 52D3.tmp 4920 537F.tmp 4500 542B.tmp 4012 54B7.tmp 2656 5554.tmp 4772 55E0.tmp 2324 565D.tmp 1876 56DA.tmp 3348 5767.tmp 4712 5803.tmp 3376 5890.tmp 2292 592C.tmp 640 59B9.tmp 4036 5A55.tmp 2888 5AE1.tmp 1696 5B7E.tmp 1812 5BFB.tmp 2192 5CA7.tmp 4000 5D14.tmp 3704 5DB0.tmp 1188 5E4C.tmp 2380 5EE9.tmp 2808 5F75.tmp 2208 5FD3.tmp 3496 6040.tmp 3656 60CD.tmp 4736 615A.tmp 4504 61C7.tmp 1196 6234.tmp 1660 62A2.tmp 3888 633E.tmp 1552 63DA.tmp 4364 6448.tmp 4824 64B5.tmp 3696 6503.tmp 4020 6561.tmp 4400 65BF.tmp 1312 661C.tmp 2852 667A.tmp 4656 66D8.tmp 3276 6726.tmp 2348 6784.tmp 4488 67D2.tmp 3432 683F.tmp 3112 689D.tmp 3036 68FB.tmp 5096 6959.tmp 3828 69B6.tmp 2756 6A14.tmp 2156 6A81.tmp 452 6AD0.tmp 2692 6B2D.tmp 4424 6B8B.tmp 4932 6BE9.tmp 1264 6C56.tmp 4560 6CB4.tmp 5060 6D12.tmp 1760 6D6F.tmp 2396 6DCD.tmp 2148 6E1B.tmp 1332 6E69.tmp 2532 6EC7.tmp 4520 6F25.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4468 wrote to memory of 2112 4468 2024-02-29_de4c81872566ee040216b424d00f6cc8_mafia.exe 87 PID 4468 wrote to memory of 2112 4468 2024-02-29_de4c81872566ee040216b424d00f6cc8_mafia.exe 87 PID 4468 wrote to memory of 2112 4468 2024-02-29_de4c81872566ee040216b424d00f6cc8_mafia.exe 87 PID 2112 wrote to memory of 1312 2112 5237.tmp 89 PID 2112 wrote to memory of 1312 2112 5237.tmp 89 PID 2112 wrote to memory of 1312 2112 5237.tmp 89 PID 1312 wrote to memory of 4920 1312 52D3.tmp 91 PID 1312 wrote to memory of 4920 1312 52D3.tmp 91 PID 1312 wrote to memory of 4920 1312 52D3.tmp 91 PID 4920 wrote to memory of 4500 4920 537F.tmp 93 PID 4920 wrote to memory of 4500 4920 537F.tmp 93 PID 4920 wrote to memory of 4500 4920 537F.tmp 93 PID 4500 wrote to memory of 4012 4500 542B.tmp 94 PID 4500 wrote to memory of 4012 4500 542B.tmp 94 PID 4500 wrote to memory of 4012 4500 542B.tmp 94 PID 4012 wrote to memory of 2656 4012 54B7.tmp 95 PID 4012 wrote to memory of 2656 4012 54B7.tmp 95 PID 4012 wrote to memory of 2656 4012 54B7.tmp 95 PID 2656 wrote to memory of 4772 2656 5554.tmp 96 PID 2656 wrote to memory of 4772 2656 5554.tmp 96 PID 2656 wrote to memory of 4772 2656 5554.tmp 96 PID 4772 wrote to memory of 2324 4772 55E0.tmp 97 PID 4772 wrote to memory of 2324 4772 55E0.tmp 97 PID 4772 wrote to memory of 2324 4772 55E0.tmp 97 PID 2324 wrote to memory of 1876 2324 565D.tmp 98 PID 2324 wrote to memory of 1876 2324 565D.tmp 98 PID 2324 wrote to memory of 1876 2324 565D.tmp 98 PID 1876 wrote to memory of 3348 1876 56DA.tmp 99 PID 1876 wrote to memory of 3348 1876 56DA.tmp 99 PID 1876 wrote to memory of 3348 1876 56DA.tmp 99 PID 3348 wrote to memory of 4712 3348 5767.tmp 100 PID 3348 wrote to memory of 4712 3348 5767.tmp 100 PID 3348 wrote to memory of 4712 3348 5767.tmp 100 PID 4712 wrote to memory of 3376 4712 5803.tmp 101 PID 4712 wrote to memory of 3376 4712 5803.tmp 101 PID 4712 wrote to memory of 3376 4712 5803.tmp 101 PID 3376 wrote to memory of 2292 3376 5890.tmp 102 PID 3376 wrote to memory of 2292 3376 5890.tmp 102 PID 3376 wrote to memory of 2292 3376 5890.tmp 102 PID 2292 wrote to memory of 640 2292 592C.tmp 103 PID 2292 wrote to memory of 640 2292 592C.tmp 103 PID 2292 wrote to memory of 640 2292 592C.tmp 103 PID 640 wrote to memory of 4036 640 59B9.tmp 104 PID 640 wrote to memory of 4036 640 59B9.tmp 104 PID 640 wrote to memory of 4036 640 59B9.tmp 104 PID 4036 wrote to memory of 2888 4036 5A55.tmp 105 PID 4036 wrote to memory of 2888 4036 5A55.tmp 105 PID 4036 wrote to memory of 2888 4036 5A55.tmp 105 PID 2888 wrote to memory of 1696 2888 5AE1.tmp 106 PID 2888 wrote to memory of 1696 2888 5AE1.tmp 106 PID 2888 wrote to memory of 1696 2888 5AE1.tmp 106 PID 1696 wrote to memory of 1812 1696 5B7E.tmp 107 PID 1696 wrote to memory of 1812 1696 5B7E.tmp 107 PID 1696 wrote to memory of 1812 1696 5B7E.tmp 107 PID 1812 wrote to memory of 2192 1812 5BFB.tmp 108 PID 1812 wrote to memory of 2192 1812 5BFB.tmp 108 PID 1812 wrote to memory of 2192 1812 5BFB.tmp 108 PID 2192 wrote to memory of 4000 2192 5CA7.tmp 109 PID 2192 wrote to memory of 4000 2192 5CA7.tmp 109 PID 2192 wrote to memory of 4000 2192 5CA7.tmp 109 PID 4000 wrote to memory of 3704 4000 5D14.tmp 110 PID 4000 wrote to memory of 3704 4000 5D14.tmp 110 PID 4000 wrote to memory of 3704 4000 5D14.tmp 110 PID 3704 wrote to memory of 1188 3704 5DB0.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-29_de4c81872566ee040216b424d00f6cc8_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-29_de4c81872566ee040216b424d00f6cc8_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"23⤵
- Executes dropped EXE
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"24⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"25⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"26⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"27⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"28⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"29⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"30⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"31⤵
- Executes dropped EXE
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"32⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"33⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"34⤵
- Executes dropped EXE
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"35⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"36⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"37⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"38⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"39⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"40⤵
- Executes dropped EXE
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"41⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"42⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"43⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"44⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"45⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"46⤵
- Executes dropped EXE
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"47⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"48⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"49⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"50⤵
- Executes dropped EXE
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"51⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"52⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"53⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"54⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"55⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"56⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\6C56.tmp"C:\Users\Admin\AppData\Local\Temp\6C56.tmp"57⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"58⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"59⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"60⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"61⤵
- Executes dropped EXE
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"62⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"63⤵
- Executes dropped EXE
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"64⤵
- Executes dropped EXE
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"65⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"66⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"67⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"68⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"69⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"70⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\7157.tmp"C:\Users\Admin\AppData\Local\Temp\7157.tmp"71⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\71B5.tmp"C:\Users\Admin\AppData\Local\Temp\71B5.tmp"72⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\7213.tmp"C:\Users\Admin\AppData\Local\Temp\7213.tmp"73⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"74⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"75⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"76⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"77⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"78⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"79⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"80⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\74C2.tmp"C:\Users\Admin\AppData\Local\Temp\74C2.tmp"81⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"82⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"83⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"84⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"85⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"86⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"87⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\7743.tmp"C:\Users\Admin\AppData\Local\Temp\7743.tmp"88⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\77A1.tmp"C:\Users\Admin\AppData\Local\Temp\77A1.tmp"89⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\77FF.tmp"C:\Users\Admin\AppData\Local\Temp\77FF.tmp"90⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\786C.tmp"C:\Users\Admin\AppData\Local\Temp\786C.tmp"91⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\78D9.tmp"C:\Users\Admin\AppData\Local\Temp\78D9.tmp"92⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\7937.tmp"C:\Users\Admin\AppData\Local\Temp\7937.tmp"93⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\7995.tmp"C:\Users\Admin\AppData\Local\Temp\7995.tmp"94⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"95⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\7A50.tmp"C:\Users\Admin\AppData\Local\Temp\7A50.tmp"96⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"97⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"98⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"99⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"100⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\7C06.tmp"C:\Users\Admin\AppData\Local\Temp\7C06.tmp"101⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\7C64.tmp"C:\Users\Admin\AppData\Local\Temp\7C64.tmp"102⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"103⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"104⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"105⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"106⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"107⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\7E77.tmp"C:\Users\Admin\AppData\Local\Temp\7E77.tmp"108⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"109⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\7F32.tmp"C:\Users\Admin\AppData\Local\Temp\7F32.tmp"110⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\7F90.tmp"C:\Users\Admin\AppData\Local\Temp\7F90.tmp"111⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"112⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\802C.tmp"C:\Users\Admin\AppData\Local\Temp\802C.tmp"113⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\808A.tmp"C:\Users\Admin\AppData\Local\Temp\808A.tmp"114⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\80E8.tmp"C:\Users\Admin\AppData\Local\Temp\80E8.tmp"115⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\8146.tmp"C:\Users\Admin\AppData\Local\Temp\8146.tmp"116⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\8194.tmp"C:\Users\Admin\AppData\Local\Temp\8194.tmp"117⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\81F1.tmp"C:\Users\Admin\AppData\Local\Temp\81F1.tmp"118⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\824F.tmp"C:\Users\Admin\AppData\Local\Temp\824F.tmp"119⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\82AD.tmp"C:\Users\Admin\AppData\Local\Temp\82AD.tmp"120⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\830B.tmp"C:\Users\Admin\AppData\Local\Temp\830B.tmp"121⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\8368.tmp"C:\Users\Admin\AppData\Local\Temp\8368.tmp"122⤵PID:2616
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-