Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2024, 04:55
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-04_89df5974f2ff73f7c8417cd4a9f0856e_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-05-04_89df5974f2ff73f7c8417cd4a9f0856e_mafia.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-05-04_89df5974f2ff73f7c8417cd4a9f0856e_mafia.exe
-
Size
520KB
-
MD5
89df5974f2ff73f7c8417cd4a9f0856e
-
SHA1
7a50e52619a8226cfdc16d5cce7de77494d4fc5c
-
SHA256
966caf4bc70cda5602f0dbb42ea545c968c6c16b6dd431bb153e2c8e4dc960b4
-
SHA512
2ecf22eafe99fa48f6c1cb14d90cf3255a4fed4cfafc5ee52247a4e1b324037d2f74987ba25c81c04aed5bf66dfc4bc1e67e6baeb93c408d3e495277ac1f5a72
-
SSDEEP
12288:gj8fuxR21t5i8ffrLEyQ5Po9eEfY0ugoWYNZ:gj8fuK1GYfr4yQSJf15uN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3676 441D.tmp 3496 44BA.tmp 4548 4537.tmp 4544 45C3.tmp 2888 4631.tmp 3220 468E.tmp 1560 470B.tmp 1512 4769.tmp 4516 47D6.tmp 3228 4834.tmp 4716 48A2.tmp 4988 490F.tmp 4296 497C.tmp 4100 49CA.tmp 3300 4A28.tmp 3316 4AB5.tmp 5088 4B32.tmp 4572 4B80.tmp 3760 4BCE.tmp 4724 4C2C.tmp 884 4C8A.tmp 4452 4CD8.tmp 1940 4D26.tmp 2580 4DB2.tmp 3384 4E10.tmp 4140 4E6E.tmp 4652 4EDB.tmp 2416 4F39.tmp 4776 4FB6.tmp 2120 5004.tmp 1288 5062.tmp 2584 50DF.tmp 3296 514C.tmp 544 519A.tmp 4496 51E9.tmp 2932 5237.tmp 712 5294.tmp 4780 52E3.tmp 3592 5331.tmp 516 537F.tmp 4144 53CD.tmp 1660 541B.tmp 3108 5469.tmp 3948 54B7.tmp 4832 5515.tmp 2072 5563.tmp 2348 55B1.tmp 2408 560F.tmp 5000 565D.tmp 4352 56AB.tmp 3120 5709.tmp 2676 5767.tmp 4108 57B5.tmp 4068 5803.tmp 4008 5861.tmp 2872 58CE.tmp 5028 592C.tmp 2628 597A.tmp 3464 59C8.tmp 728 5A26.tmp 2224 5A84.tmp 4452 5AE1.tmp 3716 5B30.tmp 4224 5B8D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2932 wrote to memory of 3676 2932 2024-05-04_89df5974f2ff73f7c8417cd4a9f0856e_mafia.exe 84 PID 2932 wrote to memory of 3676 2932 2024-05-04_89df5974f2ff73f7c8417cd4a9f0856e_mafia.exe 84 PID 2932 wrote to memory of 3676 2932 2024-05-04_89df5974f2ff73f7c8417cd4a9f0856e_mafia.exe 84 PID 3676 wrote to memory of 3496 3676 441D.tmp 85 PID 3676 wrote to memory of 3496 3676 441D.tmp 85 PID 3676 wrote to memory of 3496 3676 441D.tmp 85 PID 3496 wrote to memory of 4548 3496 44BA.tmp 87 PID 3496 wrote to memory of 4548 3496 44BA.tmp 87 PID 3496 wrote to memory of 4548 3496 44BA.tmp 87 PID 4548 wrote to memory of 4544 4548 4537.tmp 88 PID 4548 wrote to memory of 4544 4548 4537.tmp 88 PID 4548 wrote to memory of 4544 4548 4537.tmp 88 PID 4544 wrote to memory of 2888 4544 45C3.tmp 90 PID 4544 wrote to memory of 2888 4544 45C3.tmp 90 PID 4544 wrote to memory of 2888 4544 45C3.tmp 90 PID 2888 wrote to memory of 3220 2888 4631.tmp 91 PID 2888 wrote to memory of 3220 2888 4631.tmp 91 PID 2888 wrote to memory of 3220 2888 4631.tmp 91 PID 3220 wrote to memory of 1560 3220 468E.tmp 93 PID 3220 wrote to memory of 1560 3220 468E.tmp 93 PID 3220 wrote to memory of 1560 3220 468E.tmp 93 PID 1560 wrote to memory of 1512 1560 470B.tmp 94 PID 1560 wrote to memory of 1512 1560 470B.tmp 94 PID 1560 wrote to memory of 1512 1560 470B.tmp 94 PID 1512 wrote to memory of 4516 1512 4769.tmp 95 PID 1512 wrote to memory of 4516 1512 4769.tmp 95 PID 1512 wrote to memory of 4516 1512 4769.tmp 95 PID 4516 wrote to memory of 3228 4516 47D6.tmp 96 PID 4516 wrote to memory of 3228 4516 47D6.tmp 96 PID 4516 wrote to memory of 3228 4516 47D6.tmp 96 PID 3228 wrote to memory of 4716 3228 4834.tmp 97 PID 3228 wrote to memory of 4716 3228 4834.tmp 97 PID 3228 wrote to memory of 4716 3228 4834.tmp 97 PID 4716 wrote to memory of 4988 4716 48A2.tmp 98 PID 4716 wrote to memory of 4988 4716 48A2.tmp 98 PID 4716 wrote to memory of 4988 4716 48A2.tmp 98 PID 4988 wrote to memory of 4296 4988 490F.tmp 99 PID 4988 wrote to memory of 4296 4988 490F.tmp 99 PID 4988 wrote to memory of 4296 4988 490F.tmp 99 PID 4296 wrote to memory of 4100 4296 497C.tmp 100 PID 4296 wrote to memory of 4100 4296 497C.tmp 100 PID 4296 wrote to memory of 4100 4296 497C.tmp 100 PID 4100 wrote to memory of 3300 4100 49CA.tmp 101 PID 4100 wrote to memory of 3300 4100 49CA.tmp 101 PID 4100 wrote to memory of 3300 4100 49CA.tmp 101 PID 3300 wrote to memory of 3316 3300 4A28.tmp 102 PID 3300 wrote to memory of 3316 3300 4A28.tmp 102 PID 3300 wrote to memory of 3316 3300 4A28.tmp 102 PID 3316 wrote to memory of 5088 3316 4AB5.tmp 103 PID 3316 wrote to memory of 5088 3316 4AB5.tmp 103 PID 3316 wrote to memory of 5088 3316 4AB5.tmp 103 PID 5088 wrote to memory of 4572 5088 4B32.tmp 104 PID 5088 wrote to memory of 4572 5088 4B32.tmp 104 PID 5088 wrote to memory of 4572 5088 4B32.tmp 104 PID 4572 wrote to memory of 3760 4572 4B80.tmp 105 PID 4572 wrote to memory of 3760 4572 4B80.tmp 105 PID 4572 wrote to memory of 3760 4572 4B80.tmp 105 PID 3760 wrote to memory of 4724 3760 4BCE.tmp 106 PID 3760 wrote to memory of 4724 3760 4BCE.tmp 106 PID 3760 wrote to memory of 4724 3760 4BCE.tmp 106 PID 4724 wrote to memory of 884 4724 4C2C.tmp 107 PID 4724 wrote to memory of 884 4724 4C2C.tmp 107 PID 4724 wrote to memory of 884 4724 4C2C.tmp 107 PID 884 wrote to memory of 4452 884 4C8A.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-04_89df5974f2ff73f7c8417cd4a9f0856e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-04_89df5974f2ff73f7c8417cd4a9f0856e_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\441D.tmp"C:\Users\Admin\AppData\Local\Temp\441D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"23⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"24⤵
- Executes dropped EXE
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"25⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"26⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"27⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"28⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"29⤵
- Executes dropped EXE
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"30⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"31⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"32⤵
- Executes dropped EXE
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"33⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"34⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"35⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"36⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"37⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"38⤵
- Executes dropped EXE
PID:712 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"39⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"40⤵
- Executes dropped EXE
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"41⤵
- Executes dropped EXE
PID:516 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"42⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"43⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"44⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"45⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"46⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"47⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"48⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"49⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"50⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"51⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"52⤵
- Executes dropped EXE
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"53⤵
- Executes dropped EXE
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"54⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"55⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"56⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"57⤵
- Executes dropped EXE
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"58⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"59⤵
- Executes dropped EXE
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"60⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"61⤵
- Executes dropped EXE
PID:728 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"62⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"63⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"64⤵
- Executes dropped EXE
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"65⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"66⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"67⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"68⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"69⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"70⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"71⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"72⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"73⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"74⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"75⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"76⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"77⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"78⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"79⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"80⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"81⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"82⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"83⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"84⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"85⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"86⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"87⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"88⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"89⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"90⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"91⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"92⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"93⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"94⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"95⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"96⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"97⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"98⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"99⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"100⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"101⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"102⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"103⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"104⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"105⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"106⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"107⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"108⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"109⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"110⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"111⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\6C56.tmp"C:\Users\Admin\AppData\Local\Temp\6C56.tmp"112⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"113⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"114⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"115⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"116⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"117⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"118⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"119⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"120⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"121⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"122⤵PID:2584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-