Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/04/2024, 12:33
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-08_616356b85ac89da9bd2d990ad5654810_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-08_616356b85ac89da9bd2d990ad5654810_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-08_616356b85ac89da9bd2d990ad5654810_mafia.exe
-
Size
487KB
-
MD5
616356b85ac89da9bd2d990ad5654810
-
SHA1
386c817902be84fffdd5e01535e7505553e08d17
-
SHA256
b8e1615b8aed50f6d1916befa8212c3d3792cb7c053dd7e3994adb02a25f5b24
-
SHA512
b7962827d3467f4d7e6d2cff4a771a4b0d328663a18ccf101deb54bc7594c1b6dd802cd6b357b48dfff3b446171d9aba1a284900d49e1b62d2dbf3b6b7d39664
-
SSDEEP
6144:zorf3lPvovsgZnqG2C7mOTeiLxDxmT0aGulRGExXLwZwW2d1EBCWBKopl82qmbsN:yU5rCOTeiNsT0aG5Exbw2dCjgbZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4568 5515.tmp 3176 560F.tmp 336 56AB.tmp 2332 5767.tmp 4784 5803.tmp 2608 5890.tmp 2340 591C.tmp 4956 59E7.tmp 3568 5A84.tmp 3760 5B30.tmp 3148 5BAD.tmp 3144 5CB6.tmp 4932 5D52.tmp 4852 5E1E.tmp 3648 5EAA.tmp 5080 5F46.tmp 2640 5FE3.tmp 2748 607F.tmp 3440 613A.tmp 1944 61E6.tmp 2092 6283.tmp 4652 637D.tmp 2228 6428.tmp 2764 64A5.tmp 4128 6532.tmp 2804 65CE.tmp 4908 665B.tmp 5060 6726.tmp 1652 67E2.tmp 416 68CC.tmp 4764 6997.tmp 1812 6A43.tmp 3996 6ADF.tmp 1996 6B6C.tmp 1708 6C27.tmp 4020 6CD3.tmp 4480 6D41.tmp 3000 6DEC.tmp 5032 6E89.tmp 3580 6F15.tmp 4960 6FA2.tmp 3584 702F.tmp 2800 70BB.tmp 2820 7167.tmp 1112 71D4.tmp 4928 7261.tmp 2316 72FD.tmp 1592 73A9.tmp 2340 7445.tmp 3172 74E2.tmp 2564 754F.tmp 4508 75EB.tmp 4912 7678.tmp 3412 7705.tmp 1460 77DF.tmp 1424 787C.tmp 680 7908.tmp 1480 7985.tmp 4528 7A02.tmp 772 7A8F.tmp 1580 7B2B.tmp 4384 7BB8.tmp 868 7C25.tmp 392 7CB2.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1792 wrote to memory of 4568 1792 2024-04-08_616356b85ac89da9bd2d990ad5654810_mafia.exe 88 PID 1792 wrote to memory of 4568 1792 2024-04-08_616356b85ac89da9bd2d990ad5654810_mafia.exe 88 PID 1792 wrote to memory of 4568 1792 2024-04-08_616356b85ac89da9bd2d990ad5654810_mafia.exe 88 PID 4568 wrote to memory of 3176 4568 5515.tmp 90 PID 4568 wrote to memory of 3176 4568 5515.tmp 90 PID 4568 wrote to memory of 3176 4568 5515.tmp 90 PID 3176 wrote to memory of 336 3176 560F.tmp 91 PID 3176 wrote to memory of 336 3176 560F.tmp 91 PID 3176 wrote to memory of 336 3176 560F.tmp 91 PID 336 wrote to memory of 2332 336 56AB.tmp 92 PID 336 wrote to memory of 2332 336 56AB.tmp 92 PID 336 wrote to memory of 2332 336 56AB.tmp 92 PID 2332 wrote to memory of 4784 2332 5767.tmp 93 PID 2332 wrote to memory of 4784 2332 5767.tmp 93 PID 2332 wrote to memory of 4784 2332 5767.tmp 93 PID 4784 wrote to memory of 2608 4784 5803.tmp 94 PID 4784 wrote to memory of 2608 4784 5803.tmp 94 PID 4784 wrote to memory of 2608 4784 5803.tmp 94 PID 2608 wrote to memory of 2340 2608 5890.tmp 95 PID 2608 wrote to memory of 2340 2608 5890.tmp 95 PID 2608 wrote to memory of 2340 2608 5890.tmp 95 PID 2340 wrote to memory of 4956 2340 591C.tmp 96 PID 2340 wrote to memory of 4956 2340 591C.tmp 96 PID 2340 wrote to memory of 4956 2340 591C.tmp 96 PID 4956 wrote to memory of 3568 4956 59E7.tmp 97 PID 4956 wrote to memory of 3568 4956 59E7.tmp 97 PID 4956 wrote to memory of 3568 4956 59E7.tmp 97 PID 3568 wrote to memory of 3760 3568 5A84.tmp 98 PID 3568 wrote to memory of 3760 3568 5A84.tmp 98 PID 3568 wrote to memory of 3760 3568 5A84.tmp 98 PID 3760 wrote to memory of 3148 3760 5B30.tmp 99 PID 3760 wrote to memory of 3148 3760 5B30.tmp 99 PID 3760 wrote to memory of 3148 3760 5B30.tmp 99 PID 3148 wrote to memory of 3144 3148 5BAD.tmp 100 PID 3148 wrote to memory of 3144 3148 5BAD.tmp 100 PID 3148 wrote to memory of 3144 3148 5BAD.tmp 100 PID 3144 wrote to memory of 4932 3144 5CB6.tmp 101 PID 3144 wrote to memory of 4932 3144 5CB6.tmp 101 PID 3144 wrote to memory of 4932 3144 5CB6.tmp 101 PID 4932 wrote to memory of 4852 4932 5D52.tmp 102 PID 4932 wrote to memory of 4852 4932 5D52.tmp 102 PID 4932 wrote to memory of 4852 4932 5D52.tmp 102 PID 4852 wrote to memory of 3648 4852 5E1E.tmp 103 PID 4852 wrote to memory of 3648 4852 5E1E.tmp 103 PID 4852 wrote to memory of 3648 4852 5E1E.tmp 103 PID 3648 wrote to memory of 5080 3648 5EAA.tmp 106 PID 3648 wrote to memory of 5080 3648 5EAA.tmp 106 PID 3648 wrote to memory of 5080 3648 5EAA.tmp 106 PID 5080 wrote to memory of 2640 5080 5F46.tmp 107 PID 5080 wrote to memory of 2640 5080 5F46.tmp 107 PID 5080 wrote to memory of 2640 5080 5F46.tmp 107 PID 2640 wrote to memory of 2748 2640 5FE3.tmp 108 PID 2640 wrote to memory of 2748 2640 5FE3.tmp 108 PID 2640 wrote to memory of 2748 2640 5FE3.tmp 108 PID 2748 wrote to memory of 3440 2748 607F.tmp 109 PID 2748 wrote to memory of 3440 2748 607F.tmp 109 PID 2748 wrote to memory of 3440 2748 607F.tmp 109 PID 3440 wrote to memory of 1944 3440 613A.tmp 110 PID 3440 wrote to memory of 1944 3440 613A.tmp 110 PID 3440 wrote to memory of 1944 3440 613A.tmp 110 PID 1944 wrote to memory of 2092 1944 61E6.tmp 111 PID 1944 wrote to memory of 2092 1944 61E6.tmp 111 PID 1944 wrote to memory of 2092 1944 61E6.tmp 111 PID 2092 wrote to memory of 4652 2092 6283.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-08_616356b85ac89da9bd2d990ad5654810_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-08_616356b85ac89da9bd2d990ad5654810_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"23⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"24⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"25⤵
- Executes dropped EXE
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"26⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"27⤵
- Executes dropped EXE
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"28⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"29⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"30⤵
- Executes dropped EXE
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"31⤵
- Executes dropped EXE
PID:416 -
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"32⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"33⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"34⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"35⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"36⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"37⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"38⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"39⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"40⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"41⤵
- Executes dropped EXE
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"42⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"43⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"44⤵
- Executes dropped EXE
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"45⤵
- Executes dropped EXE
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"46⤵
- Executes dropped EXE
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"47⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"48⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"49⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\7445.tmp"C:\Users\Admin\AppData\Local\Temp\7445.tmp"50⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"51⤵
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\754F.tmp"C:\Users\Admin\AppData\Local\Temp\754F.tmp"52⤵
- Executes dropped EXE
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"53⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"54⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\7705.tmp"C:\Users\Admin\AppData\Local\Temp\7705.tmp"55⤵
- Executes dropped EXE
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\77DF.tmp"C:\Users\Admin\AppData\Local\Temp\77DF.tmp"56⤵
- Executes dropped EXE
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"57⤵
- Executes dropped EXE
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\7908.tmp"C:\Users\Admin\AppData\Local\Temp\7908.tmp"58⤵
- Executes dropped EXE
PID:680 -
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"59⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\7A02.tmp"C:\Users\Admin\AppData\Local\Temp\7A02.tmp"60⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"61⤵
- Executes dropped EXE
PID:772 -
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"62⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"63⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"64⤵
- Executes dropped EXE
PID:868 -
C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"65⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"66⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"67⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\7E09.tmp"C:\Users\Admin\AppData\Local\Temp\7E09.tmp"68⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\7E67.tmp"C:\Users\Admin\AppData\Local\Temp\7E67.tmp"69⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"70⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\7F80.tmp"C:\Users\Admin\AppData\Local\Temp\7F80.tmp"71⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"72⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\807A.tmp"C:\Users\Admin\AppData\Local\Temp\807A.tmp"73⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\80F7.tmp"C:\Users\Admin\AppData\Local\Temp\80F7.tmp"74⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\8174.tmp"C:\Users\Admin\AppData\Local\Temp\8174.tmp"75⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\8240.tmp"C:\Users\Admin\AppData\Local\Temp\8240.tmp"76⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\82EB.tmp"C:\Users\Admin\AppData\Local\Temp\82EB.tmp"77⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\8359.tmp"C:\Users\Admin\AppData\Local\Temp\8359.tmp"78⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\83A7.tmp"C:\Users\Admin\AppData\Local\Temp\83A7.tmp"79⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"80⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\84DF.tmp"C:\Users\Admin\AppData\Local\Temp\84DF.tmp"81⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\854D.tmp"C:\Users\Admin\AppData\Local\Temp\854D.tmp"82⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\85BA.tmp"C:\Users\Admin\AppData\Local\Temp\85BA.tmp"83⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\8618.tmp"C:\Users\Admin\AppData\Local\Temp\8618.tmp"84⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\86A5.tmp"C:\Users\Admin\AppData\Local\Temp\86A5.tmp"85⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\8731.tmp"C:\Users\Admin\AppData\Local\Temp\8731.tmp"86⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\879F.tmp"C:\Users\Admin\AppData\Local\Temp\879F.tmp"87⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\883B.tmp"C:\Users\Admin\AppData\Local\Temp\883B.tmp"88⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\8899.tmp"C:\Users\Admin\AppData\Local\Temp\8899.tmp"89⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\8906.tmp"C:\Users\Admin\AppData\Local\Temp\8906.tmp"90⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\8973.tmp"C:\Users\Admin\AppData\Local\Temp\8973.tmp"91⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\89F0.tmp"C:\Users\Admin\AppData\Local\Temp\89F0.tmp"92⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"93⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\8B19.tmp"C:\Users\Admin\AppData\Local\Temp\8B19.tmp"94⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"95⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\8C32.tmp"C:\Users\Admin\AppData\Local\Temp\8C32.tmp"96⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"97⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"98⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"99⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"100⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"101⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"102⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"103⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\9097.tmp"C:\Users\Admin\AppData\Local\Temp\9097.tmp"104⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"105⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"106⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\921E.tmp"C:\Users\Admin\AppData\Local\Temp\921E.tmp"107⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"108⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"109⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"110⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\9470.tmp"C:\Users\Admin\AppData\Local\Temp\9470.tmp"111⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\94ED.tmp"C:\Users\Admin\AppData\Local\Temp\94ED.tmp"112⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"113⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"114⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\9693.tmp"C:\Users\Admin\AppData\Local\Temp\9693.tmp"115⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"116⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\97BC.tmp"C:\Users\Admin\AppData\Local\Temp\97BC.tmp"117⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"118⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\98D5.tmp"C:\Users\Admin\AppData\Local\Temp\98D5.tmp"119⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\9942.tmp"C:\Users\Admin\AppData\Local\Temp\9942.tmp"120⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\99BF.tmp"C:\Users\Admin\AppData\Local\Temp\99BF.tmp"121⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"122⤵PID:4856
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-