Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 03:59
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-10_78fb37e7318c103fb2e8b01def90bda6_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-10_78fb37e7318c103fb2e8b01def90bda6_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-10_78fb37e7318c103fb2e8b01def90bda6_mafia.exe
-
Size
486KB
-
MD5
78fb37e7318c103fb2e8b01def90bda6
-
SHA1
dbee285b44777e3913e1b16eb1ef0ebcacb72ae4
-
SHA256
177c59c1593c3d5c22f89658d5611cbff900625530ba6defb0b391e0bc7e1458
-
SHA512
c51712b944b137ded29a5b5ea7839e3ac942ee3cc0d97ea36859ec29546188875a9493b5ffa36139c8ea021c587f807f7851f50a160c7fac9f61bcd4e9b09923
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7W3gGy79ZVHef++1DuvHcfCBFBBvy46Dj7Sap:/U5rCOTeiDWUV+20DuvHTLHlMNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3968 4508.tmp 3588 4575.tmp 4412 4602.tmp 1836 467F.tmp 3160 46DC.tmp 1676 4759.tmp 4380 47D6.tmp 3220 4825.tmp 2760 4873.tmp 2032 48F0.tmp 4532 494D.tmp 5020 49CA.tmp 4848 4A19.tmp 4348 4A76.tmp 4388 4AF3.tmp 3772 4B61.tmp 2848 4BDE.tmp 3000 4C3B.tmp 4032 4CA9.tmp 4944 4D16.tmp 4856 4D64.tmp 1708 4DE1.tmp 2380 4E4F.tmp 3644 4E9D.tmp 2104 4F29.tmp 4820 4F78.tmp 1280 4FC6.tmp 2024 5033.tmp 4884 50A0.tmp 1704 50EF.tmp 1360 514C.tmp 3680 51C9.tmp 3684 5237.tmp 2628 5285.tmp 5040 52D3.tmp 2624 5321.tmp 4904 537F.tmp 1844 53CD.tmp 3204 541B.tmp 4508 5479.tmp 2612 54C7.tmp 4644 5515.tmp 4332 5573.tmp 2488 55C1.tmp 4472 560F.tmp 3048 565D.tmp 5076 56AB.tmp 1696 5709.tmp 4968 5757.tmp 5064 57A5.tmp 4828 5803.tmp 4576 5870.tmp 3632 58BF.tmp 2296 590D.tmp 4076 595B.tmp 2484 59B9.tmp 4636 5A07.tmp 3212 5A55.tmp 2696 5AA3.tmp 1900 5B4F.tmp 2800 5B9D.tmp 3968 5BEB.tmp 828 5C39.tmp 3672 5C87.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 744 wrote to memory of 3968 744 2024-05-10_78fb37e7318c103fb2e8b01def90bda6_mafia.exe 82 PID 744 wrote to memory of 3968 744 2024-05-10_78fb37e7318c103fb2e8b01def90bda6_mafia.exe 82 PID 744 wrote to memory of 3968 744 2024-05-10_78fb37e7318c103fb2e8b01def90bda6_mafia.exe 82 PID 3968 wrote to memory of 3588 3968 4508.tmp 84 PID 3968 wrote to memory of 3588 3968 4508.tmp 84 PID 3968 wrote to memory of 3588 3968 4508.tmp 84 PID 3588 wrote to memory of 4412 3588 4575.tmp 85 PID 3588 wrote to memory of 4412 3588 4575.tmp 85 PID 3588 wrote to memory of 4412 3588 4575.tmp 85 PID 4412 wrote to memory of 1836 4412 4602.tmp 87 PID 4412 wrote to memory of 1836 4412 4602.tmp 87 PID 4412 wrote to memory of 1836 4412 4602.tmp 87 PID 1836 wrote to memory of 3160 1836 467F.tmp 88 PID 1836 wrote to memory of 3160 1836 467F.tmp 88 PID 1836 wrote to memory of 3160 1836 467F.tmp 88 PID 3160 wrote to memory of 1676 3160 46DC.tmp 89 PID 3160 wrote to memory of 1676 3160 46DC.tmp 89 PID 3160 wrote to memory of 1676 3160 46DC.tmp 89 PID 1676 wrote to memory of 4380 1676 4759.tmp 90 PID 1676 wrote to memory of 4380 1676 4759.tmp 90 PID 1676 wrote to memory of 4380 1676 4759.tmp 90 PID 4380 wrote to memory of 3220 4380 47D6.tmp 91 PID 4380 wrote to memory of 3220 4380 47D6.tmp 91 PID 4380 wrote to memory of 3220 4380 47D6.tmp 91 PID 3220 wrote to memory of 2760 3220 4825.tmp 92 PID 3220 wrote to memory of 2760 3220 4825.tmp 92 PID 3220 wrote to memory of 2760 3220 4825.tmp 92 PID 2760 wrote to memory of 2032 2760 4873.tmp 93 PID 2760 wrote to memory of 2032 2760 4873.tmp 93 PID 2760 wrote to memory of 2032 2760 4873.tmp 93 PID 2032 wrote to memory of 4532 2032 48F0.tmp 94 PID 2032 wrote to memory of 4532 2032 48F0.tmp 94 PID 2032 wrote to memory of 4532 2032 48F0.tmp 94 PID 4532 wrote to memory of 5020 4532 494D.tmp 95 PID 4532 wrote to memory of 5020 4532 494D.tmp 95 PID 4532 wrote to memory of 5020 4532 494D.tmp 95 PID 5020 wrote to memory of 4848 5020 49CA.tmp 96 PID 5020 wrote to memory of 4848 5020 49CA.tmp 96 PID 5020 wrote to memory of 4848 5020 49CA.tmp 96 PID 4848 wrote to memory of 4348 4848 4A19.tmp 97 PID 4848 wrote to memory of 4348 4848 4A19.tmp 97 PID 4848 wrote to memory of 4348 4848 4A19.tmp 97 PID 4348 wrote to memory of 4388 4348 4A76.tmp 98 PID 4348 wrote to memory of 4388 4348 4A76.tmp 98 PID 4348 wrote to memory of 4388 4348 4A76.tmp 98 PID 4388 wrote to memory of 3772 4388 4AF3.tmp 99 PID 4388 wrote to memory of 3772 4388 4AF3.tmp 99 PID 4388 wrote to memory of 3772 4388 4AF3.tmp 99 PID 3772 wrote to memory of 2848 3772 4B61.tmp 100 PID 3772 wrote to memory of 2848 3772 4B61.tmp 100 PID 3772 wrote to memory of 2848 3772 4B61.tmp 100 PID 2848 wrote to memory of 3000 2848 4BDE.tmp 101 PID 2848 wrote to memory of 3000 2848 4BDE.tmp 101 PID 2848 wrote to memory of 3000 2848 4BDE.tmp 101 PID 3000 wrote to memory of 4032 3000 4C3B.tmp 102 PID 3000 wrote to memory of 4032 3000 4C3B.tmp 102 PID 3000 wrote to memory of 4032 3000 4C3B.tmp 102 PID 4032 wrote to memory of 4944 4032 4CA9.tmp 103 PID 4032 wrote to memory of 4944 4032 4CA9.tmp 103 PID 4032 wrote to memory of 4944 4032 4CA9.tmp 103 PID 4944 wrote to memory of 4856 4944 4D16.tmp 104 PID 4944 wrote to memory of 4856 4944 4D16.tmp 104 PID 4944 wrote to memory of 4856 4944 4D16.tmp 104 PID 4856 wrote to memory of 1708 4856 4D64.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_78fb37e7318c103fb2e8b01def90bda6_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-10_78fb37e7318c103fb2e8b01def90bda6_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\4602.tmp"C:\Users\Admin\AppData\Local\Temp\4602.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\4A19.tmp"C:\Users\Admin\AppData\Local\Temp\4A19.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"23⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"24⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"25⤵
- Executes dropped EXE
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"26⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"27⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"28⤵
- Executes dropped EXE
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"29⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"30⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"31⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"32⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"33⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"34⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"35⤵
- Executes dropped EXE
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"36⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"37⤵
- Executes dropped EXE
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"38⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"39⤵
- Executes dropped EXE
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"40⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"41⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"42⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"43⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"44⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"45⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"46⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"47⤵
- Executes dropped EXE
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"48⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"49⤵
- Executes dropped EXE
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"50⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"51⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"52⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"53⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"54⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"55⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"56⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"57⤵
- Executes dropped EXE
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"58⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"59⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"60⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"61⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"62⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"63⤵
- Executes dropped EXE
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"64⤵
- Executes dropped EXE
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"65⤵
- Executes dropped EXE
PID:828 -
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"66⤵
- Executes dropped EXE
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"67⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"68⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"69⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"70⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"71⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"72⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"73⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"74⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"75⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"76⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"77⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"78⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"79⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"80⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"81⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"82⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"83⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"84⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"85⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"86⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"87⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"88⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"89⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"90⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"91⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"92⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"93⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"94⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"95⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"96⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"97⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"98⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"99⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"100⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"101⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"102⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"103⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"104⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"105⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"106⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"107⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"108⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"109⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"110⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"111⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"112⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"113⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"114⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"115⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"116⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"117⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"118⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"119⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"120⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"121⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"122⤵PID:2488
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-