Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
16/03/2024, 06:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-16_d9fdc96ff531edfd1ed45146e079b719_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-16_d9fdc96ff531edfd1ed45146e079b719_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-03-16_d9fdc96ff531edfd1ed45146e079b719_mafia.exe
-
Size
486KB
-
MD5
d9fdc96ff531edfd1ed45146e079b719
-
SHA1
c8b5954f8f0839674e0926101701337632fedf36
-
SHA256
ff6ba739ccf5feabc7a4c007b8ff8577f2b8d02c4aba425e57eb1f4ed37caef7
-
SHA512
c5980192f55ec43bc9b9166775ea9cdeb698d826148d12cf2a756c201b61d26b9b9ba91bdd6fe6bfcda40335f45ea895c0786ca9bbff650f9c826d22147a6507
-
SSDEEP
12288:UU5rCOTeiDtvFVVBYOotLCzWNYbK3GafUONZ:UUQOJDFFVDYOohYWWbK3/sON
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2736 4BCE.tmp 1620 4C2C.tmp 5004 4CA9.tmp 636 4D26.tmp 3332 4D84.tmp 864 4E01.tmp 652 4E4F.tmp 692 4EBC.tmp 3444 4F0A.tmp 212 4F87.tmp 3956 4FF5.tmp 3472 5062.tmp 1292 50B0.tmp 1372 511D.tmp 2508 517B.tmp 3784 51D9.tmp 4256 5227.tmp 4288 5294.tmp 4456 52E3.tmp 4728 5331.tmp 4168 537F.tmp 3208 53DD.tmp 736 543A.tmp 2220 54B7.tmp 3996 5505.tmp 456 5573.tmp 5016 55D1.tmp 2656 563E.tmp 4760 56AB.tmp 1432 5719.tmp 3496 5796.tmp 3312 57F3.tmp 1832 5861.tmp 3300 58AF.tmp 4948 58FD.tmp 1616 594B.tmp 5024 5999.tmp 4360 59E7.tmp 3488 5A36.tmp 4272 5A93.tmp 708 5AE1.tmp 2260 5B3F.tmp 4512 5B9D.tmp 4348 5BFB.tmp 4968 5C49.tmp 2740 5CA7.tmp 1280 5D04.tmp 3648 5D52.tmp 1896 5DB0.tmp 2264 5DFE.tmp 2888 5E4C.tmp 4196 5E9B.tmp 3480 5EE9.tmp 2988 5F46.tmp 436 5F95.tmp 1656 5FE3.tmp 3216 6031.tmp 4320 608F.tmp 1020 60DD.tmp 2692 612B.tmp 1204 6179.tmp 1208 61C7.tmp 5004 6215.tmp 3656 6263.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4408 wrote to memory of 2736 4408 2024-03-16_d9fdc96ff531edfd1ed45146e079b719_mafia.exe 85 PID 4408 wrote to memory of 2736 4408 2024-03-16_d9fdc96ff531edfd1ed45146e079b719_mafia.exe 85 PID 4408 wrote to memory of 2736 4408 2024-03-16_d9fdc96ff531edfd1ed45146e079b719_mafia.exe 85 PID 2736 wrote to memory of 1620 2736 4BCE.tmp 86 PID 2736 wrote to memory of 1620 2736 4BCE.tmp 86 PID 2736 wrote to memory of 1620 2736 4BCE.tmp 86 PID 1620 wrote to memory of 5004 1620 4C2C.tmp 87 PID 1620 wrote to memory of 5004 1620 4C2C.tmp 87 PID 1620 wrote to memory of 5004 1620 4C2C.tmp 87 PID 5004 wrote to memory of 636 5004 4CA9.tmp 88 PID 5004 wrote to memory of 636 5004 4CA9.tmp 88 PID 5004 wrote to memory of 636 5004 4CA9.tmp 88 PID 636 wrote to memory of 3332 636 4D26.tmp 89 PID 636 wrote to memory of 3332 636 4D26.tmp 89 PID 636 wrote to memory of 3332 636 4D26.tmp 89 PID 3332 wrote to memory of 864 3332 4D84.tmp 90 PID 3332 wrote to memory of 864 3332 4D84.tmp 90 PID 3332 wrote to memory of 864 3332 4D84.tmp 90 PID 864 wrote to memory of 652 864 4E01.tmp 91 PID 864 wrote to memory of 652 864 4E01.tmp 91 PID 864 wrote to memory of 652 864 4E01.tmp 91 PID 652 wrote to memory of 692 652 4E4F.tmp 92 PID 652 wrote to memory of 692 652 4E4F.tmp 92 PID 652 wrote to memory of 692 652 4E4F.tmp 92 PID 692 wrote to memory of 3444 692 4EBC.tmp 93 PID 692 wrote to memory of 3444 692 4EBC.tmp 93 PID 692 wrote to memory of 3444 692 4EBC.tmp 93 PID 3444 wrote to memory of 212 3444 4F0A.tmp 94 PID 3444 wrote to memory of 212 3444 4F0A.tmp 94 PID 3444 wrote to memory of 212 3444 4F0A.tmp 94 PID 212 wrote to memory of 3956 212 4F87.tmp 95 PID 212 wrote to memory of 3956 212 4F87.tmp 95 PID 212 wrote to memory of 3956 212 4F87.tmp 95 PID 3956 wrote to memory of 3472 3956 4FF5.tmp 96 PID 3956 wrote to memory of 3472 3956 4FF5.tmp 96 PID 3956 wrote to memory of 3472 3956 4FF5.tmp 96 PID 3472 wrote to memory of 1292 3472 5062.tmp 97 PID 3472 wrote to memory of 1292 3472 5062.tmp 97 PID 3472 wrote to memory of 1292 3472 5062.tmp 97 PID 1292 wrote to memory of 1372 1292 50B0.tmp 98 PID 1292 wrote to memory of 1372 1292 50B0.tmp 98 PID 1292 wrote to memory of 1372 1292 50B0.tmp 98 PID 1372 wrote to memory of 2508 1372 511D.tmp 99 PID 1372 wrote to memory of 2508 1372 511D.tmp 99 PID 1372 wrote to memory of 2508 1372 511D.tmp 99 PID 2508 wrote to memory of 3784 2508 517B.tmp 100 PID 2508 wrote to memory of 3784 2508 517B.tmp 100 PID 2508 wrote to memory of 3784 2508 517B.tmp 100 PID 3784 wrote to memory of 4256 3784 51D9.tmp 101 PID 3784 wrote to memory of 4256 3784 51D9.tmp 101 PID 3784 wrote to memory of 4256 3784 51D9.tmp 101 PID 4256 wrote to memory of 4288 4256 5227.tmp 102 PID 4256 wrote to memory of 4288 4256 5227.tmp 102 PID 4256 wrote to memory of 4288 4256 5227.tmp 102 PID 4288 wrote to memory of 4456 4288 5294.tmp 103 PID 4288 wrote to memory of 4456 4288 5294.tmp 103 PID 4288 wrote to memory of 4456 4288 5294.tmp 103 PID 4456 wrote to memory of 4728 4456 52E3.tmp 104 PID 4456 wrote to memory of 4728 4456 52E3.tmp 104 PID 4456 wrote to memory of 4728 4456 52E3.tmp 104 PID 4728 wrote to memory of 4168 4728 5331.tmp 105 PID 4728 wrote to memory of 4168 4728 5331.tmp 105 PID 4728 wrote to memory of 4168 4728 5331.tmp 105 PID 4168 wrote to memory of 3208 4168 537F.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-16_d9fdc96ff531edfd1ed45146e079b719_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-16_d9fdc96ff531edfd1ed45146e079b719_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"23⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"24⤵
- Executes dropped EXE
PID:736 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"25⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"26⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"27⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"28⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"29⤵
- Executes dropped EXE
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"30⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"31⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"32⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"33⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"34⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"35⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"36⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"37⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"38⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"39⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"40⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"41⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"42⤵
- Executes dropped EXE
PID:708 -
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"43⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"44⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"45⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"46⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"47⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"48⤵
- Executes dropped EXE
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"49⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"50⤵
- Executes dropped EXE
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"51⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"52⤵
- Executes dropped EXE
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"53⤵
- Executes dropped EXE
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"54⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"55⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"56⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"57⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"58⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"59⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"60⤵
- Executes dropped EXE
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"61⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"62⤵
- Executes dropped EXE
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"63⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"64⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"65⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"66⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"67⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"68⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"69⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"70⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"71⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"72⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"73⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"74⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"75⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"76⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"77⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"78⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"79⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"80⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"81⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"82⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"83⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"84⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"85⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"86⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"87⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"88⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"89⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"90⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"91⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"92⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"93⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"94⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"95⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"96⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"97⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"98⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"99⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"100⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"101⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"102⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"103⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"104⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"105⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"106⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"107⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"108⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"109⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"110⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\7177.tmp"C:\Users\Admin\AppData\Local\Temp\7177.tmp"111⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"112⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\7213.tmp"C:\Users\Admin\AppData\Local\Temp\7213.tmp"113⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"114⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\72BF.tmp"C:\Users\Admin\AppData\Local\Temp\72BF.tmp"115⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"116⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"117⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"118⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"119⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"120⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\74C2.tmp"C:\Users\Admin\AppData\Local\Temp\74C2.tmp"121⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"122⤵PID:4852
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-