Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
49s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
27/04/2024, 17:57
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-27_fed9f2f0012ef4a9302189bcd5e15cb7_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-27_fed9f2f0012ef4a9302189bcd5e15cb7_mafia.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-04-27_fed9f2f0012ef4a9302189bcd5e15cb7_mafia.exe
-
Size
486KB
-
MD5
fed9f2f0012ef4a9302189bcd5e15cb7
-
SHA1
272690b47ad21851e7bea49c3f43822b14296026
-
SHA256
11291f540a9cd8f9000bb283eb831faeaadbfcd615349d7a3a5aa1ed6323897a
-
SHA512
61669908889f2afd9373ef10f608772805a21b937216603f7fd266bb11757e3c271063efadb7f02499530cfd660f56528bcbcc8d2968f37c1f4e03b467c4d2b3
-
SSDEEP
12288:UU5rCOTeiD1ANls0FVCyRES7eGIYZt0/LJjasNZ:UUQOJD1EfzyxGIAgLJjasN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1792 4A67.tmp 2092 4AC4.tmp 3592 4B32.tmp 1516 4B9F.tmp 1664 4C1C.tmp 4700 4C99.tmp 3276 4CF7.tmp 2168 4D45.tmp 4028 4D93.tmp 2636 4DE1.tmp 3800 4E3F.tmp 3200 4E8D.tmp 4836 4EEB.tmp 4896 4F49.tmp 740 4FA6.tmp 3572 5023.tmp 2016 5081.tmp 2136 50EF.tmp 2272 514C.tmp 1820 51BA.tmp 4448 5227.tmp 2884 5275.tmp 4380 52E3.tmp 2756 5331.tmp 1708 538E.tmp 4044 53DD.tmp 4712 545A.tmp 4464 54B7.tmp 2320 5515.tmp 2408 5573.tmp 2772 55C1.tmp 4780 561F.tmp 4388 567C.tmp 836 56CB.tmp 4908 5719.tmp 3780 5767.tmp 5076 57B5.tmp 4384 5803.tmp 1148 5861.tmp 3728 58BF.tmp 4856 590D.tmp 1968 595B.tmp 3568 59A9.tmp 4408 5A07.tmp 1332 5A55.tmp 1924 5AA3.tmp 4704 5AF1.tmp 2616 5B9D.tmp 1736 5BFB.tmp 2224 5C49.tmp 4188 5C97.tmp 4312 5CE5.tmp 4772 5D33.tmp 2880 5D81.tmp 2440 5DCF.tmp 2332 5E2D.tmp 2492 5E7B.tmp 628 5EC9.tmp 556 5F18.tmp 60 5F66.tmp 3964 5FB4.tmp 4468 6012.tmp 3236 6060.tmp 4440 60AE.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3480 wrote to memory of 1792 3480 2024-04-27_fed9f2f0012ef4a9302189bcd5e15cb7_mafia.exe 85 PID 3480 wrote to memory of 1792 3480 2024-04-27_fed9f2f0012ef4a9302189bcd5e15cb7_mafia.exe 85 PID 3480 wrote to memory of 1792 3480 2024-04-27_fed9f2f0012ef4a9302189bcd5e15cb7_mafia.exe 85 PID 1792 wrote to memory of 2092 1792 4A67.tmp 86 PID 1792 wrote to memory of 2092 1792 4A67.tmp 86 PID 1792 wrote to memory of 2092 1792 4A67.tmp 86 PID 2092 wrote to memory of 3592 2092 4AC4.tmp 87 PID 2092 wrote to memory of 3592 2092 4AC4.tmp 87 PID 2092 wrote to memory of 3592 2092 4AC4.tmp 87 PID 3592 wrote to memory of 1516 3592 4B32.tmp 89 PID 3592 wrote to memory of 1516 3592 4B32.tmp 89 PID 3592 wrote to memory of 1516 3592 4B32.tmp 89 PID 1516 wrote to memory of 1664 1516 4B9F.tmp 90 PID 1516 wrote to memory of 1664 1516 4B9F.tmp 90 PID 1516 wrote to memory of 1664 1516 4B9F.tmp 90 PID 1664 wrote to memory of 4700 1664 4C1C.tmp 92 PID 1664 wrote to memory of 4700 1664 4C1C.tmp 92 PID 1664 wrote to memory of 4700 1664 4C1C.tmp 92 PID 4700 wrote to memory of 3276 4700 4C99.tmp 94 PID 4700 wrote to memory of 3276 4700 4C99.tmp 94 PID 4700 wrote to memory of 3276 4700 4C99.tmp 94 PID 3276 wrote to memory of 2168 3276 4CF7.tmp 95 PID 3276 wrote to memory of 2168 3276 4CF7.tmp 95 PID 3276 wrote to memory of 2168 3276 4CF7.tmp 95 PID 2168 wrote to memory of 4028 2168 4D45.tmp 96 PID 2168 wrote to memory of 4028 2168 4D45.tmp 96 PID 2168 wrote to memory of 4028 2168 4D45.tmp 96 PID 4028 wrote to memory of 2636 4028 4D93.tmp 97 PID 4028 wrote to memory of 2636 4028 4D93.tmp 97 PID 4028 wrote to memory of 2636 4028 4D93.tmp 97 PID 2636 wrote to memory of 3800 2636 4DE1.tmp 98 PID 2636 wrote to memory of 3800 2636 4DE1.tmp 98 PID 2636 wrote to memory of 3800 2636 4DE1.tmp 98 PID 3800 wrote to memory of 3200 3800 4E3F.tmp 99 PID 3800 wrote to memory of 3200 3800 4E3F.tmp 99 PID 3800 wrote to memory of 3200 3800 4E3F.tmp 99 PID 3200 wrote to memory of 4836 3200 4E8D.tmp 100 PID 3200 wrote to memory of 4836 3200 4E8D.tmp 100 PID 3200 wrote to memory of 4836 3200 4E8D.tmp 100 PID 4836 wrote to memory of 4896 4836 4EEB.tmp 101 PID 4836 wrote to memory of 4896 4836 4EEB.tmp 101 PID 4836 wrote to memory of 4896 4836 4EEB.tmp 101 PID 4896 wrote to memory of 740 4896 4F49.tmp 102 PID 4896 wrote to memory of 740 4896 4F49.tmp 102 PID 4896 wrote to memory of 740 4896 4F49.tmp 102 PID 740 wrote to memory of 3572 740 4FA6.tmp 103 PID 740 wrote to memory of 3572 740 4FA6.tmp 103 PID 740 wrote to memory of 3572 740 4FA6.tmp 103 PID 3572 wrote to memory of 2016 3572 5023.tmp 104 PID 3572 wrote to memory of 2016 3572 5023.tmp 104 PID 3572 wrote to memory of 2016 3572 5023.tmp 104 PID 2016 wrote to memory of 2136 2016 5081.tmp 105 PID 2016 wrote to memory of 2136 2016 5081.tmp 105 PID 2016 wrote to memory of 2136 2016 5081.tmp 105 PID 2136 wrote to memory of 2272 2136 50EF.tmp 106 PID 2136 wrote to memory of 2272 2136 50EF.tmp 106 PID 2136 wrote to memory of 2272 2136 50EF.tmp 106 PID 2272 wrote to memory of 1820 2272 514C.tmp 107 PID 2272 wrote to memory of 1820 2272 514C.tmp 107 PID 2272 wrote to memory of 1820 2272 514C.tmp 107 PID 1820 wrote to memory of 4448 1820 51BA.tmp 108 PID 1820 wrote to memory of 4448 1820 51BA.tmp 108 PID 1820 wrote to memory of 4448 1820 51BA.tmp 108 PID 4448 wrote to memory of 2884 4448 5227.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-27_fed9f2f0012ef4a9302189bcd5e15cb7_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-27_fed9f2f0012ef4a9302189bcd5e15cb7_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"23⤵
- Executes dropped EXE
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"24⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"25⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"26⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"27⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"28⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"29⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"30⤵
- Executes dropped EXE
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"31⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"32⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"33⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"34⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"35⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"36⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"37⤵
- Executes dropped EXE
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"38⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"39⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"40⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"41⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"42⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"43⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"44⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"45⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"46⤵
- Executes dropped EXE
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"47⤵
- Executes dropped EXE
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"48⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"49⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"50⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"51⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"52⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"53⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"54⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"55⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"56⤵
- Executes dropped EXE
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"57⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"58⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"59⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"60⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"61⤵
- Executes dropped EXE
PID:556 -
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"62⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"63⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"64⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"65⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"66⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"67⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"68⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"69⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"70⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"71⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"72⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"73⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"74⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"75⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"76⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"77⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"78⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"79⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"80⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"81⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"82⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"83⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"84⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"85⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"86⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"87⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"88⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"89⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"90⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"91⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"92⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"93⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"94⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"95⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"96⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"97⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"98⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"99⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"100⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"101⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"102⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"103⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"104⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"105⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"106⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"107⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"108⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"109⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"110⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"111⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"112⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"113⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"114⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"115⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"116⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"117⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"118⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"119⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"120⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"121⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"122⤵PID:4936
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-