Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
22/02/2024, 10:47
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-22_d1dbabca102bcdb0edf6eddbf5f646b6_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-02-22_d1dbabca102bcdb0edf6eddbf5f646b6_mafia.exe
Resource
win10v2004-20240221-en
General
-
Target
2024-02-22_d1dbabca102bcdb0edf6eddbf5f646b6_mafia.exe
-
Size
486KB
-
MD5
d1dbabca102bcdb0edf6eddbf5f646b6
-
SHA1
a5b36dd77f1f58349ad6422b8db3a03f79dbebdb
-
SHA256
264250eb6415eb3b2394b20a81f4482158733a955ed4e3a5799ce80a773a34af
-
SHA512
08d800e1a01dfffa6ef959c9d8afc6e2d8b3f5c9cb92edd6809804e99f4f460aca60cf9803b3d43f0560edc84ea72f6e20032d4b1a5aef51788a6116646cbd49
-
SSDEEP
12288:/U5rCOTeiDK3EnOsUJJ1fuU7Tk3WP7isSmzEeNZ:/UQOJDSgbuF7Tk3KesSBeN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3796 3E70.tmp 1228 3F1C.tmp 2896 3FA9.tmp 2464 4055.tmp 4100 40D2.tmp 1236 413F.tmp 4372 41BC.tmp 4256 421A.tmp 4724 42B6.tmp 3572 4333.tmp 1808 43A0.tmp 2344 441D.tmp 2284 44C9.tmp 4344 4546.tmp 1648 45A4.tmp 2396 4611.tmp 2408 469E.tmp 3780 472B.tmp 1220 47A8.tmp 5060 4805.tmp 4716 48A2.tmp 1500 492E.tmp 4804 498C.tmp 4652 49F9.tmp 2428 4A67.tmp 4280 4AD4.tmp 4460 4B80.tmp 4704 4C1C.tmp 2600 4CC8.tmp 2908 4D26.tmp 1616 4D93.tmp 3344 4DF1.tmp 5024 4E4F.tmp 4964 4EBC.tmp 3328 4F1A.tmp 4124 4F78.tmp 4028 4FD5.tmp 3628 5043.tmp 1656 5091.tmp 4960 50FE.tmp 2728 515C.tmp 3136 51AA.tmp 4472 5208.tmp 3604 52B4.tmp 2044 5311.tmp 2852 5360.tmp 4624 53AE.tmp 5012 53FC.tmp 2464 544A.tmp 1476 54A8.tmp 2328 54F6.tmp 1236 5554.tmp 1864 55B1.tmp 456 55FF.tmp 432 565D.tmp 1104 56AB.tmp 2884 5709.tmp 8 5776.tmp 1808 57D4.tmp 4464 5832.tmp 4440 5890.tmp 4272 58ED.tmp 1896 593C.tmp 1928 5999.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4552 wrote to memory of 3796 4552 2024-02-22_d1dbabca102bcdb0edf6eddbf5f646b6_mafia.exe 86 PID 4552 wrote to memory of 3796 4552 2024-02-22_d1dbabca102bcdb0edf6eddbf5f646b6_mafia.exe 86 PID 4552 wrote to memory of 3796 4552 2024-02-22_d1dbabca102bcdb0edf6eddbf5f646b6_mafia.exe 86 PID 3796 wrote to memory of 1228 3796 3E70.tmp 87 PID 3796 wrote to memory of 1228 3796 3E70.tmp 87 PID 3796 wrote to memory of 1228 3796 3E70.tmp 87 PID 1228 wrote to memory of 2896 1228 3F1C.tmp 89 PID 1228 wrote to memory of 2896 1228 3F1C.tmp 89 PID 1228 wrote to memory of 2896 1228 3F1C.tmp 89 PID 2896 wrote to memory of 2464 2896 3FA9.tmp 91 PID 2896 wrote to memory of 2464 2896 3FA9.tmp 91 PID 2896 wrote to memory of 2464 2896 3FA9.tmp 91 PID 2464 wrote to memory of 4100 2464 4055.tmp 93 PID 2464 wrote to memory of 4100 2464 4055.tmp 93 PID 2464 wrote to memory of 4100 2464 4055.tmp 93 PID 4100 wrote to memory of 1236 4100 40D2.tmp 94 PID 4100 wrote to memory of 1236 4100 40D2.tmp 94 PID 4100 wrote to memory of 1236 4100 40D2.tmp 94 PID 1236 wrote to memory of 4372 1236 413F.tmp 95 PID 1236 wrote to memory of 4372 1236 413F.tmp 95 PID 1236 wrote to memory of 4372 1236 413F.tmp 95 PID 4372 wrote to memory of 4256 4372 41BC.tmp 96 PID 4372 wrote to memory of 4256 4372 41BC.tmp 96 PID 4372 wrote to memory of 4256 4372 41BC.tmp 96 PID 4256 wrote to memory of 4724 4256 421A.tmp 97 PID 4256 wrote to memory of 4724 4256 421A.tmp 97 PID 4256 wrote to memory of 4724 4256 421A.tmp 97 PID 4724 wrote to memory of 3572 4724 42B6.tmp 98 PID 4724 wrote to memory of 3572 4724 42B6.tmp 98 PID 4724 wrote to memory of 3572 4724 42B6.tmp 98 PID 3572 wrote to memory of 1808 3572 4333.tmp 99 PID 3572 wrote to memory of 1808 3572 4333.tmp 99 PID 3572 wrote to memory of 1808 3572 4333.tmp 99 PID 1808 wrote to memory of 2344 1808 43A0.tmp 100 PID 1808 wrote to memory of 2344 1808 43A0.tmp 100 PID 1808 wrote to memory of 2344 1808 43A0.tmp 100 PID 2344 wrote to memory of 2284 2344 441D.tmp 101 PID 2344 wrote to memory of 2284 2344 441D.tmp 101 PID 2344 wrote to memory of 2284 2344 441D.tmp 101 PID 2284 wrote to memory of 4344 2284 44C9.tmp 102 PID 2284 wrote to memory of 4344 2284 44C9.tmp 102 PID 2284 wrote to memory of 4344 2284 44C9.tmp 102 PID 4344 wrote to memory of 1648 4344 4546.tmp 103 PID 4344 wrote to memory of 1648 4344 4546.tmp 103 PID 4344 wrote to memory of 1648 4344 4546.tmp 103 PID 1648 wrote to memory of 2396 1648 45A4.tmp 104 PID 1648 wrote to memory of 2396 1648 45A4.tmp 104 PID 1648 wrote to memory of 2396 1648 45A4.tmp 104 PID 2396 wrote to memory of 2408 2396 4611.tmp 105 PID 2396 wrote to memory of 2408 2396 4611.tmp 105 PID 2396 wrote to memory of 2408 2396 4611.tmp 105 PID 2408 wrote to memory of 3780 2408 469E.tmp 106 PID 2408 wrote to memory of 3780 2408 469E.tmp 106 PID 2408 wrote to memory of 3780 2408 469E.tmp 106 PID 3780 wrote to memory of 1220 3780 472B.tmp 107 PID 3780 wrote to memory of 1220 3780 472B.tmp 107 PID 3780 wrote to memory of 1220 3780 472B.tmp 107 PID 1220 wrote to memory of 5060 1220 47A8.tmp 108 PID 1220 wrote to memory of 5060 1220 47A8.tmp 108 PID 1220 wrote to memory of 5060 1220 47A8.tmp 108 PID 5060 wrote to memory of 4716 5060 4805.tmp 109 PID 5060 wrote to memory of 4716 5060 4805.tmp 109 PID 5060 wrote to memory of 4716 5060 4805.tmp 109 PID 4716 wrote to memory of 1500 4716 48A2.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-22_d1dbabca102bcdb0edf6eddbf5f646b6_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-22_d1dbabca102bcdb0edf6eddbf5f646b6_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\3E70.tmp"C:\Users\Admin\AppData\Local\Temp\3E70.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\4055.tmp"C:\Users\Admin\AppData\Local\Temp\4055.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\40D2.tmp"C:\Users\Admin\AppData\Local\Temp\40D2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\413F.tmp"C:\Users\Admin\AppData\Local\Temp\413F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\41BC.tmp"C:\Users\Admin\AppData\Local\Temp\41BC.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\421A.tmp"C:\Users\Admin\AppData\Local\Temp\421A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\42B6.tmp"C:\Users\Admin\AppData\Local\Temp\42B6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\441D.tmp"C:\Users\Admin\AppData\Local\Temp\441D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"23⤵
- Executes dropped EXE
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"24⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"25⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"26⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"27⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"28⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"29⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"30⤵
- Executes dropped EXE
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"31⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"32⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"33⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"34⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"35⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"36⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"37⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"38⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"39⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"40⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"41⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"42⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"43⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"44⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"45⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"46⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"47⤵
- Executes dropped EXE
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"48⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"49⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"50⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"51⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"52⤵
- Executes dropped EXE
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"53⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"54⤵
- Executes dropped EXE
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"55⤵
- Executes dropped EXE
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"56⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"57⤵
- Executes dropped EXE
PID:432 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"58⤵
- Executes dropped EXE
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"59⤵
- Executes dropped EXE
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"60⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"61⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"62⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"63⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"64⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"65⤵
- Executes dropped EXE
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"66⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"67⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"68⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"69⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"70⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"71⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"72⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"73⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"74⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"75⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"76⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"77⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"78⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"79⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"80⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"81⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"82⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"83⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"84⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"85⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"86⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"87⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"88⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"89⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"90⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"91⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"92⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"93⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"94⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"95⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"96⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"97⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"98⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"99⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"100⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"101⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"102⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"103⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"104⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"105⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"106⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"107⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"108⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"109⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"110⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"111⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"112⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"113⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"114⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"115⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"116⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"117⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"118⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"119⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"120⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"121⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"122⤵PID:468
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-