Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
26/04/2024, 09:48
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-26_97af8e395671051025e5729c0df8c515_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-26_97af8e395671051025e5729c0df8c515_mafia.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-26_97af8e395671051025e5729c0df8c515_mafia.exe
-
Size
486KB
-
MD5
97af8e395671051025e5729c0df8c515
-
SHA1
9280c1919ac32ebe81356f0874162557c0feff71
-
SHA256
1d229edc986d55e9d2e8e538e721512fb80d10ed653e70d3fa85fcbc095b2681
-
SHA512
ea8af4c43111eeb2f5079d0e43bb0cd6c417be8f4cc78589a4ec37656bbc335bc7a4d7c434136e58a553011bba4ddf896dfa82d3c6db12f66ca93b159d366f4d
-
SSDEEP
12288:/U5rCOTeiDTIVYbuXnz/TUQ6RQSgyNRD49NZ:/UQOJDvo30hJwN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2076 5822.tmp 2632 58AF.tmp 3292 594B.tmp 972 59F7.tmp 616 5A93.tmp 3252 5B10.tmp 2292 5B9D.tmp 5064 5C1A.tmp 4780 5CA7.tmp 3340 5D04.tmp 1820 5D62.tmp 3608 5DDF.tmp 3216 5E4C.tmp 1660 5EE9.tmp 1028 5F66.tmp 3872 6002.tmp 1052 608F.tmp 4264 60EC.tmp 680 614A.tmp 3316 61D7.tmp 1176 6234.tmp 840 62C1.tmp 1468 633E.tmp 3400 63CB.tmp 3844 6428.tmp 2768 6496.tmp 4124 6503.tmp 4260 659F.tmp 4100 662C.tmp 4800 668A.tmp 2660 6726.tmp 4644 6784.tmp 4128 6820.tmp 1596 687E.tmp 3904 68CC.tmp 3536 692A.tmp 2696 6997.tmp 3368 69E5.tmp 4748 6A33.tmp 2704 6A81.tmp 3596 6AD0.tmp 3116 6B1E.tmp 1576 6B7B.tmp 3496 6BCA.tmp 1624 6C27.tmp 1520 6C75.tmp 3996 6CC4.tmp 452 6D12.tmp 3604 6D60.tmp 2948 6DBE.tmp 2764 6E1B.tmp 3396 6E69.tmp 1108 6EC7.tmp 1176 6F25.tmp 4480 6F73.tmp 2304 6FC1.tmp 1956 700F.tmp 4528 706D.tmp 4520 70DA.tmp 3956 7148.tmp 3248 71A6.tmp 4868 71F4.tmp 4800 7242.tmp 2760 72A0.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3048 wrote to memory of 2076 3048 2024-04-26_97af8e395671051025e5729c0df8c515_mafia.exe 84 PID 3048 wrote to memory of 2076 3048 2024-04-26_97af8e395671051025e5729c0df8c515_mafia.exe 84 PID 3048 wrote to memory of 2076 3048 2024-04-26_97af8e395671051025e5729c0df8c515_mafia.exe 84 PID 2076 wrote to memory of 2632 2076 5822.tmp 85 PID 2076 wrote to memory of 2632 2076 5822.tmp 85 PID 2076 wrote to memory of 2632 2076 5822.tmp 85 PID 2632 wrote to memory of 3292 2632 58AF.tmp 86 PID 2632 wrote to memory of 3292 2632 58AF.tmp 86 PID 2632 wrote to memory of 3292 2632 58AF.tmp 86 PID 3292 wrote to memory of 972 3292 594B.tmp 89 PID 3292 wrote to memory of 972 3292 594B.tmp 89 PID 3292 wrote to memory of 972 3292 594B.tmp 89 PID 972 wrote to memory of 616 972 59F7.tmp 90 PID 972 wrote to memory of 616 972 59F7.tmp 90 PID 972 wrote to memory of 616 972 59F7.tmp 90 PID 616 wrote to memory of 3252 616 5A93.tmp 92 PID 616 wrote to memory of 3252 616 5A93.tmp 92 PID 616 wrote to memory of 3252 616 5A93.tmp 92 PID 3252 wrote to memory of 2292 3252 5B10.tmp 93 PID 3252 wrote to memory of 2292 3252 5B10.tmp 93 PID 3252 wrote to memory of 2292 3252 5B10.tmp 93 PID 2292 wrote to memory of 5064 2292 5B9D.tmp 94 PID 2292 wrote to memory of 5064 2292 5B9D.tmp 94 PID 2292 wrote to memory of 5064 2292 5B9D.tmp 94 PID 5064 wrote to memory of 4780 5064 5C1A.tmp 95 PID 5064 wrote to memory of 4780 5064 5C1A.tmp 95 PID 5064 wrote to memory of 4780 5064 5C1A.tmp 95 PID 4780 wrote to memory of 3340 4780 5CA7.tmp 96 PID 4780 wrote to memory of 3340 4780 5CA7.tmp 96 PID 4780 wrote to memory of 3340 4780 5CA7.tmp 96 PID 3340 wrote to memory of 1820 3340 5D04.tmp 97 PID 3340 wrote to memory of 1820 3340 5D04.tmp 97 PID 3340 wrote to memory of 1820 3340 5D04.tmp 97 PID 1820 wrote to memory of 3608 1820 5D62.tmp 98 PID 1820 wrote to memory of 3608 1820 5D62.tmp 98 PID 1820 wrote to memory of 3608 1820 5D62.tmp 98 PID 3608 wrote to memory of 3216 3608 5DDF.tmp 99 PID 3608 wrote to memory of 3216 3608 5DDF.tmp 99 PID 3608 wrote to memory of 3216 3608 5DDF.tmp 99 PID 3216 wrote to memory of 1660 3216 5E4C.tmp 100 PID 3216 wrote to memory of 1660 3216 5E4C.tmp 100 PID 3216 wrote to memory of 1660 3216 5E4C.tmp 100 PID 1660 wrote to memory of 1028 1660 5EE9.tmp 101 PID 1660 wrote to memory of 1028 1660 5EE9.tmp 101 PID 1660 wrote to memory of 1028 1660 5EE9.tmp 101 PID 1028 wrote to memory of 3872 1028 5F66.tmp 102 PID 1028 wrote to memory of 3872 1028 5F66.tmp 102 PID 1028 wrote to memory of 3872 1028 5F66.tmp 102 PID 3872 wrote to memory of 1052 3872 6002.tmp 103 PID 3872 wrote to memory of 1052 3872 6002.tmp 103 PID 3872 wrote to memory of 1052 3872 6002.tmp 103 PID 1052 wrote to memory of 4264 1052 608F.tmp 104 PID 1052 wrote to memory of 4264 1052 608F.tmp 104 PID 1052 wrote to memory of 4264 1052 608F.tmp 104 PID 4264 wrote to memory of 680 4264 60EC.tmp 105 PID 4264 wrote to memory of 680 4264 60EC.tmp 105 PID 4264 wrote to memory of 680 4264 60EC.tmp 105 PID 680 wrote to memory of 3316 680 614A.tmp 106 PID 680 wrote to memory of 3316 680 614A.tmp 106 PID 680 wrote to memory of 3316 680 614A.tmp 106 PID 3316 wrote to memory of 1176 3316 61D7.tmp 107 PID 3316 wrote to memory of 1176 3316 61D7.tmp 107 PID 3316 wrote to memory of 1176 3316 61D7.tmp 107 PID 1176 wrote to memory of 840 1176 6234.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-26_97af8e395671051025e5729c0df8c515_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-26_97af8e395671051025e5729c0df8c515_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"23⤵
- Executes dropped EXE
PID:840 -
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"24⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"25⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"26⤵
- Executes dropped EXE
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"27⤵
- Executes dropped EXE
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"28⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"29⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"30⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"31⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"32⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"33⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"34⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"35⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"36⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"37⤵
- Executes dropped EXE
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"38⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"39⤵
- Executes dropped EXE
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"40⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"41⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"42⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"43⤵
- Executes dropped EXE
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"44⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"45⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"46⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"47⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"48⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"49⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"50⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"51⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"52⤵
- Executes dropped EXE
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"53⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"54⤵
- Executes dropped EXE
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"55⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"56⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"57⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"58⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"59⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\70DA.tmp"C:\Users\Admin\AppData\Local\Temp\70DA.tmp"60⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\7148.tmp"C:\Users\Admin\AppData\Local\Temp\7148.tmp"61⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"62⤵
- Executes dropped EXE
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"63⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"64⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\72A0.tmp"C:\Users\Admin\AppData\Local\Temp\72A0.tmp"65⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"66⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"67⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"68⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"69⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"70⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\74C2.tmp"C:\Users\Admin\AppData\Local\Temp\74C2.tmp"71⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"72⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"73⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"74⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"75⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"76⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\7705.tmp"C:\Users\Admin\AppData\Local\Temp\7705.tmp"77⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\7762.tmp"C:\Users\Admin\AppData\Local\Temp\7762.tmp"78⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"79⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\780E.tmp"C:\Users\Admin\AppData\Local\Temp\780E.tmp"80⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\786C.tmp"C:\Users\Admin\AppData\Local\Temp\786C.tmp"81⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"82⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\7937.tmp"C:\Users\Admin\AppData\Local\Temp\7937.tmp"83⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"84⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"85⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"86⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"87⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"88⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"89⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\7B98.tmp"C:\Users\Admin\AppData\Local\Temp\7B98.tmp"90⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\7C06.tmp"C:\Users\Admin\AppData\Local\Temp\7C06.tmp"91⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\7C64.tmp"C:\Users\Admin\AppData\Local\Temp\7C64.tmp"92⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"93⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"94⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"95⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"96⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"97⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"98⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"99⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\7F52.tmp"C:\Users\Admin\AppData\Local\Temp\7F52.tmp"100⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"101⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"102⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\804C.tmp"C:\Users\Admin\AppData\Local\Temp\804C.tmp"103⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\80A9.tmp"C:\Users\Admin\AppData\Local\Temp\80A9.tmp"104⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\8107.tmp"C:\Users\Admin\AppData\Local\Temp\8107.tmp"105⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\8165.tmp"C:\Users\Admin\AppData\Local\Temp\8165.tmp"106⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\81C3.tmp"C:\Users\Admin\AppData\Local\Temp\81C3.tmp"107⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"108⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\827E.tmp"C:\Users\Admin\AppData\Local\Temp\827E.tmp"109⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\82DC.tmp"C:\Users\Admin\AppData\Local\Temp\82DC.tmp"110⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\833A.tmp"C:\Users\Admin\AppData\Local\Temp\833A.tmp"111⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"112⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\8405.tmp"C:\Users\Admin\AppData\Local\Temp\8405.tmp"113⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\8462.tmp"C:\Users\Admin\AppData\Local\Temp\8462.tmp"114⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\84C0.tmp"C:\Users\Admin\AppData\Local\Temp\84C0.tmp"115⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\851E.tmp"C:\Users\Admin\AppData\Local\Temp\851E.tmp"116⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\857C.tmp"C:\Users\Admin\AppData\Local\Temp\857C.tmp"117⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\85CA.tmp"C:\Users\Admin\AppData\Local\Temp\85CA.tmp"118⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\8628.tmp"C:\Users\Admin\AppData\Local\Temp\8628.tmp"119⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\8685.tmp"C:\Users\Admin\AppData\Local\Temp\8685.tmp"120⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\86E3.tmp"C:\Users\Admin\AppData\Local\Temp\86E3.tmp"121⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\8741.tmp"C:\Users\Admin\AppData\Local\Temp\8741.tmp"122⤵PID:1112
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-