Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/03/2024, 06:39
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-12_f253584d51b38378e381fee0fe44e62c_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-12_f253584d51b38378e381fee0fe44e62c_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-03-12_f253584d51b38378e381fee0fe44e62c_mafia.exe
-
Size
487KB
-
MD5
f253584d51b38378e381fee0fe44e62c
-
SHA1
f117ed31367113dbcfb814ee8ebd731b6734ccfc
-
SHA256
0396b99af1720e54aa1f716f38c240a8f3282db0a15ec730a4e22f970a8fb35c
-
SHA512
4aff9b218037161b5d26507ee3abf2e6355345c8407d6285a13e02235eb4efc4a9655bdae14613bc67a7f6a21fc3d1831790e37b0ad16437ea3d40d57911a3f4
-
SSDEEP
12288:HU5rCOTeiJ+QqviIIaxZUL79zkhG0p1k0XvBr0VrPNZ:HUQOJJ+QMx89zkk81k0OPN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4276 4A38.tmp 488 4AA5.tmp 3812 4B22.tmp 1840 4B80.tmp 3264 4BCE.tmp 1108 4C2C.tmp 4372 4C8A.tmp 2036 4CD8.tmp 1744 4D26.tmp 1692 4D84.tmp 2516 4DE1.tmp 2356 4E3F.tmp 4124 4E9D.tmp 1328 4EEB.tmp 2344 4F58.tmp 5048 4FA6.tmp 4388 5004.tmp 3248 5052.tmp 2464 50B0.tmp 3496 510E.tmp 3208 515C.tmp 880 51BA.tmp 4492 5227.tmp 4888 5285.tmp 4708 52D3.tmp 1380 5331.tmp 2944 539E.tmp 436 53EC.tmp 4024 544A.tmp 4820 5498.tmp 2100 54E6.tmp 1516 5544.tmp 1928 55A2.tmp 3584 55F0.tmp 3840 563E.tmp 4952 568C.tmp 656 56DA.tmp 4460 5738.tmp 1324 5813.tmp 4588 58ED.tmp 3776 594B.tmp 2888 59C8.tmp 1592 5A26.tmp 3184 5A84.tmp 4680 5AD2.tmp 2188 5B7E.tmp 2480 5BCC.tmp 4276 5C2A.tmp 5112 5C78.tmp 2180 5CC6.tmp 3904 5D14.tmp 936 5D81.tmp 4064 5DCF.tmp 1616 5E1E.tmp 1620 5E7B.tmp 4112 5ED9.tmp 2028 5F27.tmp 4372 5F85.tmp 3748 5FD3.tmp 2220 6021.tmp 2256 607F.tmp 384 60CD.tmp 2496 611B.tmp 1868 6169.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4556 wrote to memory of 4276 4556 2024-03-12_f253584d51b38378e381fee0fe44e62c_mafia.exe 86 PID 4556 wrote to memory of 4276 4556 2024-03-12_f253584d51b38378e381fee0fe44e62c_mafia.exe 86 PID 4556 wrote to memory of 4276 4556 2024-03-12_f253584d51b38378e381fee0fe44e62c_mafia.exe 86 PID 4276 wrote to memory of 488 4276 4A38.tmp 87 PID 4276 wrote to memory of 488 4276 4A38.tmp 87 PID 4276 wrote to memory of 488 4276 4A38.tmp 87 PID 488 wrote to memory of 3812 488 4AA5.tmp 88 PID 488 wrote to memory of 3812 488 4AA5.tmp 88 PID 488 wrote to memory of 3812 488 4AA5.tmp 88 PID 3812 wrote to memory of 1840 3812 4B22.tmp 89 PID 3812 wrote to memory of 1840 3812 4B22.tmp 89 PID 3812 wrote to memory of 1840 3812 4B22.tmp 89 PID 1840 wrote to memory of 3264 1840 4B80.tmp 90 PID 1840 wrote to memory of 3264 1840 4B80.tmp 90 PID 1840 wrote to memory of 3264 1840 4B80.tmp 90 PID 3264 wrote to memory of 1108 3264 4BCE.tmp 91 PID 3264 wrote to memory of 1108 3264 4BCE.tmp 91 PID 3264 wrote to memory of 1108 3264 4BCE.tmp 91 PID 1108 wrote to memory of 4372 1108 4C2C.tmp 92 PID 1108 wrote to memory of 4372 1108 4C2C.tmp 92 PID 1108 wrote to memory of 4372 1108 4C2C.tmp 92 PID 4372 wrote to memory of 2036 4372 4C8A.tmp 93 PID 4372 wrote to memory of 2036 4372 4C8A.tmp 93 PID 4372 wrote to memory of 2036 4372 4C8A.tmp 93 PID 2036 wrote to memory of 1744 2036 4CD8.tmp 94 PID 2036 wrote to memory of 1744 2036 4CD8.tmp 94 PID 2036 wrote to memory of 1744 2036 4CD8.tmp 94 PID 1744 wrote to memory of 1692 1744 4D26.tmp 95 PID 1744 wrote to memory of 1692 1744 4D26.tmp 95 PID 1744 wrote to memory of 1692 1744 4D26.tmp 95 PID 1692 wrote to memory of 2516 1692 4D84.tmp 96 PID 1692 wrote to memory of 2516 1692 4D84.tmp 96 PID 1692 wrote to memory of 2516 1692 4D84.tmp 96 PID 2516 wrote to memory of 2356 2516 4DE1.tmp 97 PID 2516 wrote to memory of 2356 2516 4DE1.tmp 97 PID 2516 wrote to memory of 2356 2516 4DE1.tmp 97 PID 2356 wrote to memory of 4124 2356 4E3F.tmp 98 PID 2356 wrote to memory of 4124 2356 4E3F.tmp 98 PID 2356 wrote to memory of 4124 2356 4E3F.tmp 98 PID 4124 wrote to memory of 1328 4124 4E9D.tmp 99 PID 4124 wrote to memory of 1328 4124 4E9D.tmp 99 PID 4124 wrote to memory of 1328 4124 4E9D.tmp 99 PID 1328 wrote to memory of 2344 1328 4EEB.tmp 100 PID 1328 wrote to memory of 2344 1328 4EEB.tmp 100 PID 1328 wrote to memory of 2344 1328 4EEB.tmp 100 PID 2344 wrote to memory of 5048 2344 4F58.tmp 101 PID 2344 wrote to memory of 5048 2344 4F58.tmp 101 PID 2344 wrote to memory of 5048 2344 4F58.tmp 101 PID 5048 wrote to memory of 4388 5048 4FA6.tmp 102 PID 5048 wrote to memory of 4388 5048 4FA6.tmp 102 PID 5048 wrote to memory of 4388 5048 4FA6.tmp 102 PID 4388 wrote to memory of 3248 4388 5004.tmp 103 PID 4388 wrote to memory of 3248 4388 5004.tmp 103 PID 4388 wrote to memory of 3248 4388 5004.tmp 103 PID 3248 wrote to memory of 2464 3248 5052.tmp 104 PID 3248 wrote to memory of 2464 3248 5052.tmp 104 PID 3248 wrote to memory of 2464 3248 5052.tmp 104 PID 2464 wrote to memory of 3496 2464 50B0.tmp 105 PID 2464 wrote to memory of 3496 2464 50B0.tmp 105 PID 2464 wrote to memory of 3496 2464 50B0.tmp 105 PID 3496 wrote to memory of 3208 3496 510E.tmp 106 PID 3496 wrote to memory of 3208 3496 510E.tmp 106 PID 3496 wrote to memory of 3208 3496 510E.tmp 106 PID 3208 wrote to memory of 880 3208 515C.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-12_f253584d51b38378e381fee0fe44e62c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-12_f253584d51b38378e381fee0fe44e62c_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:488 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"23⤵
- Executes dropped EXE
PID:880 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"24⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"25⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"26⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"27⤵
- Executes dropped EXE
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"28⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"29⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"30⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"31⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"32⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"33⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"34⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"35⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"36⤵
- Executes dropped EXE
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"37⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"38⤵
- Executes dropped EXE
PID:656 -
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"39⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"40⤵
- Executes dropped EXE
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"41⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"42⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"43⤵
- Executes dropped EXE
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"44⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"45⤵
- Executes dropped EXE
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"46⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"47⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"48⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"49⤵
- Executes dropped EXE
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"50⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"51⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"52⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"53⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"54⤵
- Executes dropped EXE
PID:936 -
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"55⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"56⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"57⤵
- Executes dropped EXE
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"58⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"59⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"60⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"61⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"62⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"63⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"64⤵
- Executes dropped EXE
PID:384 -
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"65⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"66⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"67⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"68⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"69⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"70⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"71⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"72⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"73⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"74⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"75⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"76⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"77⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"78⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"79⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"80⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"81⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"82⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"83⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"84⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"85⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"86⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"87⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"88⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"89⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"90⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"91⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"92⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"93⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"94⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"95⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"96⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"97⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"98⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"99⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"100⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"101⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"102⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"103⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"104⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"105⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"106⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"107⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"108⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"109⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"110⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"111⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"112⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"113⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"114⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"115⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"116⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"117⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\7290.tmp"C:\Users\Admin\AppData\Local\Temp\7290.tmp"118⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"119⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"120⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"121⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"122⤵PID:1944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-