Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2024, 01:04
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-29_89dba48782b4a009a6c24fbb227cb22c_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-29_89dba48782b4a009a6c24fbb227cb22c_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-29_89dba48782b4a009a6c24fbb227cb22c_mafia.exe
-
Size
520KB
-
MD5
89dba48782b4a009a6c24fbb227cb22c
-
SHA1
7f727e89b0da6a6cb24a7fbf910d27107eb15922
-
SHA256
5e845b35271b2f8d541f50f44d654f451e170ffdb05c25705a082b34fd24636d
-
SHA512
cf3b340ed53f55c25ce287d4dcf872d2446a5e5c2113f89bbd745c1e4ee106abbe87a3f5cbfe49cdae7097a480b4d361601d30f7f9953b51ea2231e6f440b9c7
-
SSDEEP
12288:roRXOQjmOy7chz8KKCFLOJk9Wx9NSag6brj1vdPh8qNZ:rogQ9yGd3XQx9vbf1vdP+qN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5024 4391.tmp 5188 442D.tmp 4204 44D9.tmp 3380 4556.tmp 936 4611.tmp 6040 467F.tmp 1216 4873.tmp 5000 491F.tmp 4368 49AB.tmp 4852 4A28.tmp 5220 4AC4.tmp 5216 4B41.tmp 3624 4BBE.tmp 4260 4C1C.tmp 5032 4CA9.tmp 3620 4D16.tmp 5488 4D93.tmp 3884 4E3F.tmp 5092 4EDB.tmp 2516 4F58.tmp 5672 4FC6.tmp 4544 5023.tmp 4248 50B0.tmp 460 515C.tmp 1096 51F8.tmp 5124 5285.tmp 5904 52F2.tmp 2684 5350.tmp 4912 53EC.tmp 1684 5488.tmp 5520 54D7.tmp 5268 5534.tmp 5636 55B1.tmp 4076 560F.tmp 2740 566D.tmp 2164 56BB.tmp 4148 5719.tmp 5492 5776.tmp 5676 57D4.tmp 5608 5822.tmp 3376 5880.tmp 3176 58CE.tmp 1384 592C.tmp 2004 597A.tmp 3348 59D8.tmp 4704 5A36.tmp 3812 5A84.tmp 1596 5AE1.tmp 5568 5B30.tmp 4456 5B7E.tmp 6112 5BDB.tmp 1916 5C39.tmp 4836 5C87.tmp 6124 5CE5.tmp 1336 5D43.tmp 1592 5DA1.tmp 1860 5DFE.tmp 5188 5E4C.tmp 1804 5EBA.tmp 888 5F18.tmp 1988 5F66.tmp 3380 5FC3.tmp 3096 6031.tmp 1128 608F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4712 wrote to memory of 5024 4712 2024-05-29_89dba48782b4a009a6c24fbb227cb22c_mafia.exe 83 PID 4712 wrote to memory of 5024 4712 2024-05-29_89dba48782b4a009a6c24fbb227cb22c_mafia.exe 83 PID 4712 wrote to memory of 5024 4712 2024-05-29_89dba48782b4a009a6c24fbb227cb22c_mafia.exe 83 PID 5024 wrote to memory of 5188 5024 4391.tmp 85 PID 5024 wrote to memory of 5188 5024 4391.tmp 85 PID 5024 wrote to memory of 5188 5024 4391.tmp 85 PID 5188 wrote to memory of 4204 5188 442D.tmp 86 PID 5188 wrote to memory of 4204 5188 442D.tmp 86 PID 5188 wrote to memory of 4204 5188 442D.tmp 86 PID 4204 wrote to memory of 3380 4204 44D9.tmp 87 PID 4204 wrote to memory of 3380 4204 44D9.tmp 87 PID 4204 wrote to memory of 3380 4204 44D9.tmp 87 PID 3380 wrote to memory of 936 3380 4556.tmp 89 PID 3380 wrote to memory of 936 3380 4556.tmp 89 PID 3380 wrote to memory of 936 3380 4556.tmp 89 PID 936 wrote to memory of 6040 936 4611.tmp 90 PID 936 wrote to memory of 6040 936 4611.tmp 90 PID 936 wrote to memory of 6040 936 4611.tmp 90 PID 6040 wrote to memory of 1216 6040 467F.tmp 91 PID 6040 wrote to memory of 1216 6040 467F.tmp 91 PID 6040 wrote to memory of 1216 6040 467F.tmp 91 PID 1216 wrote to memory of 5000 1216 4873.tmp 93 PID 1216 wrote to memory of 5000 1216 4873.tmp 93 PID 1216 wrote to memory of 5000 1216 4873.tmp 93 PID 5000 wrote to memory of 4368 5000 491F.tmp 95 PID 5000 wrote to memory of 4368 5000 491F.tmp 95 PID 5000 wrote to memory of 4368 5000 491F.tmp 95 PID 4368 wrote to memory of 4852 4368 49AB.tmp 96 PID 4368 wrote to memory of 4852 4368 49AB.tmp 96 PID 4368 wrote to memory of 4852 4368 49AB.tmp 96 PID 4852 wrote to memory of 5220 4852 4A28.tmp 97 PID 4852 wrote to memory of 5220 4852 4A28.tmp 97 PID 4852 wrote to memory of 5220 4852 4A28.tmp 97 PID 5220 wrote to memory of 5216 5220 4AC4.tmp 98 PID 5220 wrote to memory of 5216 5220 4AC4.tmp 98 PID 5220 wrote to memory of 5216 5220 4AC4.tmp 98 PID 5216 wrote to memory of 3624 5216 4B41.tmp 99 PID 5216 wrote to memory of 3624 5216 4B41.tmp 99 PID 5216 wrote to memory of 3624 5216 4B41.tmp 99 PID 3624 wrote to memory of 4260 3624 4BBE.tmp 100 PID 3624 wrote to memory of 4260 3624 4BBE.tmp 100 PID 3624 wrote to memory of 4260 3624 4BBE.tmp 100 PID 4260 wrote to memory of 5032 4260 4C1C.tmp 101 PID 4260 wrote to memory of 5032 4260 4C1C.tmp 101 PID 4260 wrote to memory of 5032 4260 4C1C.tmp 101 PID 5032 wrote to memory of 3620 5032 4CA9.tmp 102 PID 5032 wrote to memory of 3620 5032 4CA9.tmp 102 PID 5032 wrote to memory of 3620 5032 4CA9.tmp 102 PID 3620 wrote to memory of 5488 3620 4D16.tmp 103 PID 3620 wrote to memory of 5488 3620 4D16.tmp 103 PID 3620 wrote to memory of 5488 3620 4D16.tmp 103 PID 5488 wrote to memory of 3884 5488 4D93.tmp 104 PID 5488 wrote to memory of 3884 5488 4D93.tmp 104 PID 5488 wrote to memory of 3884 5488 4D93.tmp 104 PID 3884 wrote to memory of 5092 3884 4E3F.tmp 105 PID 3884 wrote to memory of 5092 3884 4E3F.tmp 105 PID 3884 wrote to memory of 5092 3884 4E3F.tmp 105 PID 5092 wrote to memory of 2516 5092 4EDB.tmp 106 PID 5092 wrote to memory of 2516 5092 4EDB.tmp 106 PID 5092 wrote to memory of 2516 5092 4EDB.tmp 106 PID 2516 wrote to memory of 5672 2516 4F58.tmp 107 PID 2516 wrote to memory of 5672 2516 4F58.tmp 107 PID 2516 wrote to memory of 5672 2516 4F58.tmp 107 PID 5672 wrote to memory of 4544 5672 4FC6.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-29_89dba48782b4a009a6c24fbb227cb22c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-29_89dba48782b4a009a6c24fbb227cb22c_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5188 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"23⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"24⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"25⤵
- Executes dropped EXE
PID:460 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"26⤵
- Executes dropped EXE
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"27⤵
- Executes dropped EXE
PID:5124 -
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"28⤵
- Executes dropped EXE
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"29⤵
- Executes dropped EXE
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"30⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"31⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"32⤵
- Executes dropped EXE
PID:5520 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"33⤵
- Executes dropped EXE
PID:5268 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"34⤵
- Executes dropped EXE
PID:5636 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"35⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"36⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"37⤵
- Executes dropped EXE
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"38⤵
- Executes dropped EXE
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"39⤵
- Executes dropped EXE
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"40⤵
- Executes dropped EXE
PID:5676 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"41⤵
- Executes dropped EXE
PID:5608 -
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"42⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"43⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"44⤵
- Executes dropped EXE
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"45⤵
- Executes dropped EXE
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"46⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"47⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"48⤵
- Executes dropped EXE
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"49⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"50⤵
- Executes dropped EXE
PID:5568 -
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"51⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"52⤵
- Executes dropped EXE
PID:6112 -
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"53⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"54⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"55⤵
- Executes dropped EXE
PID:6124 -
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"56⤵
- Executes dropped EXE
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"57⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"58⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"59⤵
- Executes dropped EXE
PID:5188 -
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"60⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"61⤵
- Executes dropped EXE
PID:888 -
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"62⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"63⤵
- Executes dropped EXE
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"64⤵
- Executes dropped EXE
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"65⤵
- Executes dropped EXE
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"66⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"67⤵PID:5920
-
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"68⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"69⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"70⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"71⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"72⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"73⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"74⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"75⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"76⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"77⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"78⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"79⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"80⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"81⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"82⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"83⤵PID:5328
-
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"84⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"85⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"86⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"87⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"88⤵PID:5684
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"89⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"90⤵PID:5672
-
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"91⤵PID:5436
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"92⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"93⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"94⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"95⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"96⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"97⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"98⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"99⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"100⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"101⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"102⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"103⤵PID:5520
-
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"104⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"105⤵PID:5560
-
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"106⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"107⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"108⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"109⤵PID:6072
-
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"110⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"111⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"112⤵PID:5292
-
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"113⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"114⤵PID:5468
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"115⤵PID:5608
-
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"116⤵PID:5316
-
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"117⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"118⤵PID:5572
-
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"119⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"120⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"121⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"122⤵PID:3812
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-