Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 12:54
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-28_29c967e8f49a897ebefa8d98bf4bff98_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-28_29c967e8f49a897ebefa8d98bf4bff98_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-28_29c967e8f49a897ebefa8d98bf4bff98_mafia.exe
-
Size
520KB
-
MD5
29c967e8f49a897ebefa8d98bf4bff98
-
SHA1
e8d8d287d1b619ee54edbf3956d79acb3457b4b2
-
SHA256
30a025ae990e51fa008bec7ecbe307fd819e08eb38f214cdabd7d69f03f8a99d
-
SHA512
8edb54022990a2d32f2072fabcb15a723759202d492495dd2ab5a4ed813e6f403bed564917f3c54d0b136ba55e4baa4819f8c943d7b41af3510535b229818213
-
SSDEEP
12288:roRXOQjmOySUcULtboD7Ink8ylCG5w8qwvrjNZ:rogQ9yRcF7IkmiXN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3092 43A0.tmp 764 445C.tmp 1364 44E8.tmp 1216 4565.tmp 2748 45E2.tmp 1984 468E.tmp 3512 470B.tmp 1656 47B7.tmp 2644 4815.tmp 1040 4882.tmp 4604 492E.tmp 4904 499C.tmp 3208 4A19.tmp 4984 4A96.tmp 4868 4AF3.tmp 2492 4B51.tmp 4760 4BAF.tmp 1584 4C0D.tmp 824 4C8A.tmp 4128 4D16.tmp 1056 4DA3.tmp 996 4E20.tmp 3988 4EBC.tmp 1916 4F29.tmp 5088 4F97.tmp 1228 5033.tmp 2240 50A0.tmp 3692 510E.tmp 3880 517B.tmp 2380 51E9.tmp 1992 5275.tmp 4452 52F2.tmp 4360 5360.tmp 4388 53CD.tmp 2788 542B.tmp 216 5479.tmp 4976 54D7.tmp 2736 5534.tmp 3232 5592.tmp 3264 55FF.tmp 4356 564E.tmp 2748 569C.tmp 3604 56F9.tmp 3720 5748.tmp 1984 57A5.tmp 1668 5813.tmp 452 5861.tmp 916 58AF.tmp 1224 590D.tmp 1844 595B.tmp 4332 59B9.tmp 1360 5A16.tmp 3124 5A84.tmp 3960 5AE1.tmp 4896 5B30.tmp 2552 5B8D.tmp 776 5BEB.tmp 1016 5C39.tmp 4740 5C97.tmp 996 5CF5.tmp 4292 5D52.tmp 372 5DB0.tmp 2168 5E0E.tmp 508 5E6C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1872 wrote to memory of 3092 1872 2024-05-28_29c967e8f49a897ebefa8d98bf4bff98_mafia.exe 83 PID 1872 wrote to memory of 3092 1872 2024-05-28_29c967e8f49a897ebefa8d98bf4bff98_mafia.exe 83 PID 1872 wrote to memory of 3092 1872 2024-05-28_29c967e8f49a897ebefa8d98bf4bff98_mafia.exe 83 PID 3092 wrote to memory of 764 3092 43A0.tmp 84 PID 3092 wrote to memory of 764 3092 43A0.tmp 84 PID 3092 wrote to memory of 764 3092 43A0.tmp 84 PID 764 wrote to memory of 1364 764 445C.tmp 85 PID 764 wrote to memory of 1364 764 445C.tmp 85 PID 764 wrote to memory of 1364 764 445C.tmp 85 PID 1364 wrote to memory of 1216 1364 44E8.tmp 87 PID 1364 wrote to memory of 1216 1364 44E8.tmp 87 PID 1364 wrote to memory of 1216 1364 44E8.tmp 87 PID 1216 wrote to memory of 2748 1216 4565.tmp 88 PID 1216 wrote to memory of 2748 1216 4565.tmp 88 PID 1216 wrote to memory of 2748 1216 4565.tmp 88 PID 2748 wrote to memory of 1984 2748 45E2.tmp 90 PID 2748 wrote to memory of 1984 2748 45E2.tmp 90 PID 2748 wrote to memory of 1984 2748 45E2.tmp 90 PID 1984 wrote to memory of 3512 1984 468E.tmp 91 PID 1984 wrote to memory of 3512 1984 468E.tmp 91 PID 1984 wrote to memory of 3512 1984 468E.tmp 91 PID 3512 wrote to memory of 1656 3512 470B.tmp 93 PID 3512 wrote to memory of 1656 3512 470B.tmp 93 PID 3512 wrote to memory of 1656 3512 470B.tmp 93 PID 1656 wrote to memory of 2644 1656 47B7.tmp 94 PID 1656 wrote to memory of 2644 1656 47B7.tmp 94 PID 1656 wrote to memory of 2644 1656 47B7.tmp 94 PID 2644 wrote to memory of 1040 2644 4815.tmp 95 PID 2644 wrote to memory of 1040 2644 4815.tmp 95 PID 2644 wrote to memory of 1040 2644 4815.tmp 95 PID 1040 wrote to memory of 4604 1040 4882.tmp 96 PID 1040 wrote to memory of 4604 1040 4882.tmp 96 PID 1040 wrote to memory of 4604 1040 4882.tmp 96 PID 4604 wrote to memory of 4904 4604 492E.tmp 97 PID 4604 wrote to memory of 4904 4604 492E.tmp 97 PID 4604 wrote to memory of 4904 4604 492E.tmp 97 PID 4904 wrote to memory of 3208 4904 499C.tmp 98 PID 4904 wrote to memory of 3208 4904 499C.tmp 98 PID 4904 wrote to memory of 3208 4904 499C.tmp 98 PID 3208 wrote to memory of 4984 3208 4A19.tmp 99 PID 3208 wrote to memory of 4984 3208 4A19.tmp 99 PID 3208 wrote to memory of 4984 3208 4A19.tmp 99 PID 4984 wrote to memory of 4868 4984 4A96.tmp 100 PID 4984 wrote to memory of 4868 4984 4A96.tmp 100 PID 4984 wrote to memory of 4868 4984 4A96.tmp 100 PID 4868 wrote to memory of 2492 4868 4AF3.tmp 101 PID 4868 wrote to memory of 2492 4868 4AF3.tmp 101 PID 4868 wrote to memory of 2492 4868 4AF3.tmp 101 PID 2492 wrote to memory of 4760 2492 4B51.tmp 102 PID 2492 wrote to memory of 4760 2492 4B51.tmp 102 PID 2492 wrote to memory of 4760 2492 4B51.tmp 102 PID 4760 wrote to memory of 1584 4760 4BAF.tmp 103 PID 4760 wrote to memory of 1584 4760 4BAF.tmp 103 PID 4760 wrote to memory of 1584 4760 4BAF.tmp 103 PID 1584 wrote to memory of 824 1584 4C0D.tmp 104 PID 1584 wrote to memory of 824 1584 4C0D.tmp 104 PID 1584 wrote to memory of 824 1584 4C0D.tmp 104 PID 824 wrote to memory of 4128 824 4C8A.tmp 105 PID 824 wrote to memory of 4128 824 4C8A.tmp 105 PID 824 wrote to memory of 4128 824 4C8A.tmp 105 PID 4128 wrote to memory of 1056 4128 4D16.tmp 106 PID 4128 wrote to memory of 1056 4128 4D16.tmp 106 PID 4128 wrote to memory of 1056 4128 4D16.tmp 106 PID 1056 wrote to memory of 996 1056 4DA3.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-28_29c967e8f49a897ebefa8d98bf4bff98_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-28_29c967e8f49a897ebefa8d98bf4bff98_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\4565.tmp"C:\Users\Admin\AppData\Local\Temp\4565.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\4A19.tmp"C:\Users\Admin\AppData\Local\Temp\4A19.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"23⤵
- Executes dropped EXE
PID:996 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"24⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"25⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"26⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"27⤵
- Executes dropped EXE
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"28⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"29⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"30⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"31⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"32⤵
- Executes dropped EXE
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"33⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"34⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"35⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"36⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"37⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"38⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"39⤵
- Executes dropped EXE
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"40⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"41⤵
- Executes dropped EXE
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"42⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"43⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"44⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"45⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"46⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"47⤵
- Executes dropped EXE
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"48⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"49⤵
- Executes dropped EXE
PID:916 -
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"50⤵
- Executes dropped EXE
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"51⤵
- Executes dropped EXE
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"52⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"53⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"54⤵
- Executes dropped EXE
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"55⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"56⤵
- Executes dropped EXE
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"57⤵
- Executes dropped EXE
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"58⤵
- Executes dropped EXE
PID:776 -
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"59⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"60⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"61⤵
- Executes dropped EXE
PID:996 -
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"62⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"63⤵
- Executes dropped EXE
PID:372 -
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"64⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"65⤵
- Executes dropped EXE
PID:508 -
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"66⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"67⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"68⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"69⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"70⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"71⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"72⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"73⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"74⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"75⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"76⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"77⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"78⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"79⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"80⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"81⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"82⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"83⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"84⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"85⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"86⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"87⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"88⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"89⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"90⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"91⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"92⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"93⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"94⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"95⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"96⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"97⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"98⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"99⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"100⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"101⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"102⤵PID:660
-
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"103⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"104⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"105⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"106⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"107⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"108⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"109⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"110⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"111⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"112⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"113⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"114⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"115⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"116⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"117⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"118⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"119⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\72A0.tmp"C:\Users\Admin\AppData\Local\Temp\72A0.tmp"120⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"121⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"122⤵PID:3148
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-