Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/07/2024, 17:56
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-01_3a0c47563b13918fdbd805cd8d96bf17_mafia.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2024-07-01_3a0c47563b13918fdbd805cd8d96bf17_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-07-01_3a0c47563b13918fdbd805cd8d96bf17_mafia.exe
-
Size
527KB
-
MD5
3a0c47563b13918fdbd805cd8d96bf17
-
SHA1
8fd0cad9f7c0bea7648a550510f322b1506b618b
-
SHA256
37d0a54e37ded1cc99ddf7aa71a6630786840016064b3b24469317af81f005f7
-
SHA512
1f8f0ec2262ba352a56221213fcc170095d7cd7ffbae3f84be710c1a55cec06d12b932a053c1e304faab17ab82ad3112434a62de313c4bdae904a478cc7b8ae5
-
SSDEEP
12288:fU5rCOTeid4T4Gd3ENo9ccn3PMzozLpKbEu7DZu:fUQOJdxG8o9Z3Pqoz9zkDo
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3124 598A.tmp 620 59F7.tmp 1792 5A55.tmp 1296 5AF1.tmp 312 5B5E.tmp 3060 5BDB.tmp 2960 5C49.tmp 2948 5CC6.tmp 2156 5D43.tmp 3464 5DB0.tmp 3112 5E0E.tmp 3652 5E6C.tmp 4540 5EE9.tmp 756 5F56.tmp 1032 5FC3.tmp 1968 6040.tmp 2196 60AE.tmp 2712 610C.tmp 4488 6189.tmp 768 61F6.tmp 3504 6244.tmp 2272 62C1.tmp 4892 630F.tmp 1332 637D.tmp 4436 63EA.tmp 1240 6438.tmp 3580 64A5.tmp 3284 6522.tmp 1760 6580.tmp 2292 65DE.tmp 1816 662C.tmp 3808 6699.tmp 4940 6726.tmp 4600 6774.tmp 2776 67D2.tmp 1892 6830.tmp 884 687E.tmp 4408 68DC.tmp 4124 692A.tmp 1148 6987.tmp 1624 69D6.tmp 3964 6A24.tmp 2056 6A72.tmp 4020 6AD0.tmp 4508 6B1E.tmp 1232 6B7B.tmp 4032 6BD9.tmp 3392 6C37.tmp 3804 6C85.tmp 4460 6CE3.tmp 3080 6D31.tmp 4088 6D7F.tmp 3760 6DCD.tmp 1304 6E2B.tmp 4764 6E79.tmp 4944 6EC7.tmp 4844 6F25.tmp 4480 6F73.tmp 2684 6FC1.tmp 3136 700F.tmp 4364 705D.tmp 4336 70AC.tmp 2716 7109.tmp 3132 7157.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2716 wrote to memory of 3124 2716 2024-07-01_3a0c47563b13918fdbd805cd8d96bf17_mafia.exe 81 PID 2716 wrote to memory of 3124 2716 2024-07-01_3a0c47563b13918fdbd805cd8d96bf17_mafia.exe 81 PID 2716 wrote to memory of 3124 2716 2024-07-01_3a0c47563b13918fdbd805cd8d96bf17_mafia.exe 81 PID 3124 wrote to memory of 620 3124 598A.tmp 82 PID 3124 wrote to memory of 620 3124 598A.tmp 82 PID 3124 wrote to memory of 620 3124 598A.tmp 82 PID 620 wrote to memory of 1792 620 59F7.tmp 83 PID 620 wrote to memory of 1792 620 59F7.tmp 83 PID 620 wrote to memory of 1792 620 59F7.tmp 83 PID 1792 wrote to memory of 1296 1792 5A55.tmp 84 PID 1792 wrote to memory of 1296 1792 5A55.tmp 84 PID 1792 wrote to memory of 1296 1792 5A55.tmp 84 PID 1296 wrote to memory of 312 1296 5AF1.tmp 85 PID 1296 wrote to memory of 312 1296 5AF1.tmp 85 PID 1296 wrote to memory of 312 1296 5AF1.tmp 85 PID 312 wrote to memory of 3060 312 5B5E.tmp 86 PID 312 wrote to memory of 3060 312 5B5E.tmp 86 PID 312 wrote to memory of 3060 312 5B5E.tmp 86 PID 3060 wrote to memory of 2960 3060 5BDB.tmp 87 PID 3060 wrote to memory of 2960 3060 5BDB.tmp 87 PID 3060 wrote to memory of 2960 3060 5BDB.tmp 87 PID 2960 wrote to memory of 2948 2960 5C49.tmp 88 PID 2960 wrote to memory of 2948 2960 5C49.tmp 88 PID 2960 wrote to memory of 2948 2960 5C49.tmp 88 PID 2948 wrote to memory of 2156 2948 5CC6.tmp 89 PID 2948 wrote to memory of 2156 2948 5CC6.tmp 89 PID 2948 wrote to memory of 2156 2948 5CC6.tmp 89 PID 2156 wrote to memory of 3464 2156 5D43.tmp 90 PID 2156 wrote to memory of 3464 2156 5D43.tmp 90 PID 2156 wrote to memory of 3464 2156 5D43.tmp 90 PID 3464 wrote to memory of 3112 3464 5DB0.tmp 91 PID 3464 wrote to memory of 3112 3464 5DB0.tmp 91 PID 3464 wrote to memory of 3112 3464 5DB0.tmp 91 PID 3112 wrote to memory of 3652 3112 5E0E.tmp 92 PID 3112 wrote to memory of 3652 3112 5E0E.tmp 92 PID 3112 wrote to memory of 3652 3112 5E0E.tmp 92 PID 3652 wrote to memory of 4540 3652 5E6C.tmp 93 PID 3652 wrote to memory of 4540 3652 5E6C.tmp 93 PID 3652 wrote to memory of 4540 3652 5E6C.tmp 93 PID 4540 wrote to memory of 756 4540 5EE9.tmp 94 PID 4540 wrote to memory of 756 4540 5EE9.tmp 94 PID 4540 wrote to memory of 756 4540 5EE9.tmp 94 PID 756 wrote to memory of 1032 756 5F56.tmp 95 PID 756 wrote to memory of 1032 756 5F56.tmp 95 PID 756 wrote to memory of 1032 756 5F56.tmp 95 PID 1032 wrote to memory of 1968 1032 5FC3.tmp 96 PID 1032 wrote to memory of 1968 1032 5FC3.tmp 96 PID 1032 wrote to memory of 1968 1032 5FC3.tmp 96 PID 1968 wrote to memory of 2196 1968 6040.tmp 97 PID 1968 wrote to memory of 2196 1968 6040.tmp 97 PID 1968 wrote to memory of 2196 1968 6040.tmp 97 PID 2196 wrote to memory of 2712 2196 60AE.tmp 98 PID 2196 wrote to memory of 2712 2196 60AE.tmp 98 PID 2196 wrote to memory of 2712 2196 60AE.tmp 98 PID 2712 wrote to memory of 4488 2712 610C.tmp 99 PID 2712 wrote to memory of 4488 2712 610C.tmp 99 PID 2712 wrote to memory of 4488 2712 610C.tmp 99 PID 4488 wrote to memory of 768 4488 6189.tmp 100 PID 4488 wrote to memory of 768 4488 6189.tmp 100 PID 4488 wrote to memory of 768 4488 6189.tmp 100 PID 768 wrote to memory of 3504 768 61F6.tmp 101 PID 768 wrote to memory of 3504 768 61F6.tmp 101 PID 768 wrote to memory of 3504 768 61F6.tmp 101 PID 3504 wrote to memory of 2272 3504 6244.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-01_3a0c47563b13918fdbd805cd8d96bf17_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-01_3a0c47563b13918fdbd805cd8d96bf17_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312 -
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"23⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"24⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"25⤵
- Executes dropped EXE
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"26⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"27⤵
- Executes dropped EXE
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"28⤵
- Executes dropped EXE
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"29⤵
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"30⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"31⤵
- Executes dropped EXE
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"32⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"33⤵
- Executes dropped EXE
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"34⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"35⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"36⤵
- Executes dropped EXE
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"37⤵
- Executes dropped EXE
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"38⤵
- Executes dropped EXE
PID:884 -
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"39⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"40⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"41⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"42⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"43⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"44⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"45⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"46⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"47⤵
- Executes dropped EXE
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"48⤵
- Executes dropped EXE
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"49⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"50⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"51⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"52⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"53⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"54⤵
- Executes dropped EXE
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"55⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"56⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"57⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"58⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"59⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"60⤵
- Executes dropped EXE
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"61⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"62⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"63⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"64⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\7157.tmp"C:\Users\Admin\AppData\Local\Temp\7157.tmp"65⤵
- Executes dropped EXE
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"66⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"67⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"68⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\7290.tmp"C:\Users\Admin\AppData\Local\Temp\7290.tmp"69⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"70⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"71⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"72⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\73E8.tmp"C:\Users\Admin\AppData\Local\Temp\73E8.tmp"73⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\7445.tmp"C:\Users\Admin\AppData\Local\Temp\7445.tmp"74⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"75⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\74F1.tmp"C:\Users\Admin\AppData\Local\Temp\74F1.tmp"76⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"77⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"78⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"79⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"80⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"81⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"82⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\7743.tmp"C:\Users\Admin\AppData\Local\Temp\7743.tmp"83⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\77A1.tmp"C:\Users\Admin\AppData\Local\Temp\77A1.tmp"84⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\77FF.tmp"C:\Users\Admin\AppData\Local\Temp\77FF.tmp"85⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\785C.tmp"C:\Users\Admin\AppData\Local\Temp\785C.tmp"86⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\78BA.tmp"C:\Users\Admin\AppData\Local\Temp\78BA.tmp"87⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\7908.tmp"C:\Users\Admin\AppData\Local\Temp\7908.tmp"88⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\7956.tmp"C:\Users\Admin\AppData\Local\Temp\7956.tmp"89⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\79A4.tmp"C:\Users\Admin\AppData\Local\Temp\79A4.tmp"90⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"91⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"92⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"93⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"94⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"95⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\7B89.tmp"C:\Users\Admin\AppData\Local\Temp\7B89.tmp"96⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"97⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\7C35.tmp"C:\Users\Admin\AppData\Local\Temp\7C35.tmp"98⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\7C92.tmp"C:\Users\Admin\AppData\Local\Temp\7C92.tmp"99⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"100⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"101⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"102⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"103⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\7E29.tmp"C:\Users\Admin\AppData\Local\Temp\7E29.tmp"104⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\7E77.tmp"C:\Users\Admin\AppData\Local\Temp\7E77.tmp"105⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"106⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\7F32.tmp"C:\Users\Admin\AppData\Local\Temp\7F32.tmp"107⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\7F90.tmp"C:\Users\Admin\AppData\Local\Temp\7F90.tmp"108⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"109⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\803C.tmp"C:\Users\Admin\AppData\Local\Temp\803C.tmp"110⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\808A.tmp"C:\Users\Admin\AppData\Local\Temp\808A.tmp"111⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\80D8.tmp"C:\Users\Admin\AppData\Local\Temp\80D8.tmp"112⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\8136.tmp"C:\Users\Admin\AppData\Local\Temp\8136.tmp"113⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\8184.tmp"C:\Users\Admin\AppData\Local\Temp\8184.tmp"114⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\81D2.tmp"C:\Users\Admin\AppData\Local\Temp\81D2.tmp"115⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\8220.tmp"C:\Users\Admin\AppData\Local\Temp\8220.tmp"116⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"117⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\82BD.tmp"C:\Users\Admin\AppData\Local\Temp\82BD.tmp"118⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\830B.tmp"C:\Users\Admin\AppData\Local\Temp\830B.tmp"119⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\8368.tmp"C:\Users\Admin\AppData\Local\Temp\8368.tmp"120⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\83B7.tmp"C:\Users\Admin\AppData\Local\Temp\83B7.tmp"121⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\8405.tmp"C:\Users\Admin\AppData\Local\Temp\8405.tmp"122⤵PID:1764
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-