Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 18:01
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-14_849bc10b7f21a92b0ecf41f8b4152cca_mafia.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2024-05-14_849bc10b7f21a92b0ecf41f8b4152cca_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-14_849bc10b7f21a92b0ecf41f8b4152cca_mafia.exe
-
Size
530KB
-
MD5
849bc10b7f21a92b0ecf41f8b4152cca
-
SHA1
54254997bb898812bce26f15dcebb11dd882f5be
-
SHA256
ec3d41fe3fdc2c219c772e6088c4693865bd901322219d591b86892971411742
-
SHA512
066eaa62fda5115ee88b68f2e56e608cdb2bc4f3f2f265bcdb25d0ee0b0c5e2568114e2eee5a59f9f9634076eda99a1bff4d5500f4c7e803af9a4eead96e3dfc
-
SSDEEP
12288:AU5rCOTeiopsLrVY0E9drob2GAgNzxXNZulFVg0M1:AUQOJoOrN+rn/QNclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5064 4EFB.tmp 856 4F58.tmp 3084 4FD5.tmp 4908 5043.tmp 1904 50B0.tmp 456 512D.tmp 2612 51AA.tmp 3052 5237.tmp 1436 5294.tmp 1744 5311.tmp 464 536F.tmp 1560 53DD.tmp 688 544A.tmp 3240 54B7.tmp 1568 5534.tmp 3248 55A2.tmp 1576 55FF.tmp 2856 566D.tmp 4964 56EA.tmp 2344 5757.tmp 2360 57B5.tmp 1392 5813.tmp 1724 5890.tmp 4632 58DE.tmp 4680 593C.tmp 2208 59B9.tmp 4528 5A36.tmp 3724 5AA3.tmp 1152 5B01.tmp 3840 5B5E.tmp 2688 5BCC.tmp 4956 5C39.tmp 3964 5CB6.tmp 4752 5D14.tmp 2624 5D62.tmp 672 5DCF.tmp 2672 5E1E.tmp 2876 5E7B.tmp 3844 5ED9.tmp 3524 5F27.tmp 3300 5F75.tmp 3436 5FC3.tmp 4352 6021.tmp 3068 607F.tmp 4772 60DD.tmp 4976 613A.tmp 884 6198.tmp 2744 61E6.tmp 1044 6244.tmp 2528 62A2.tmp 4360 6300.tmp 2676 635D.tmp 4436 63AB.tmp 4668 63FA.tmp 5032 6448.tmp 3412 6496.tmp 4992 64E4.tmp 1812 6532.tmp 3124 6590.tmp 372 65DE.tmp 3432 663C.tmp 3084 668A.tmp 5016 66D8.tmp 3900 6726.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4460 wrote to memory of 5064 4460 2024-05-14_849bc10b7f21a92b0ecf41f8b4152cca_mafia.exe 81 PID 4460 wrote to memory of 5064 4460 2024-05-14_849bc10b7f21a92b0ecf41f8b4152cca_mafia.exe 81 PID 4460 wrote to memory of 5064 4460 2024-05-14_849bc10b7f21a92b0ecf41f8b4152cca_mafia.exe 81 PID 5064 wrote to memory of 856 5064 4EFB.tmp 83 PID 5064 wrote to memory of 856 5064 4EFB.tmp 83 PID 5064 wrote to memory of 856 5064 4EFB.tmp 83 PID 856 wrote to memory of 3084 856 4F58.tmp 85 PID 856 wrote to memory of 3084 856 4F58.tmp 85 PID 856 wrote to memory of 3084 856 4F58.tmp 85 PID 3084 wrote to memory of 4908 3084 4FD5.tmp 86 PID 3084 wrote to memory of 4908 3084 4FD5.tmp 86 PID 3084 wrote to memory of 4908 3084 4FD5.tmp 86 PID 4908 wrote to memory of 1904 4908 5043.tmp 88 PID 4908 wrote to memory of 1904 4908 5043.tmp 88 PID 4908 wrote to memory of 1904 4908 5043.tmp 88 PID 1904 wrote to memory of 456 1904 50B0.tmp 89 PID 1904 wrote to memory of 456 1904 50B0.tmp 89 PID 1904 wrote to memory of 456 1904 50B0.tmp 89 PID 456 wrote to memory of 2612 456 512D.tmp 90 PID 456 wrote to memory of 2612 456 512D.tmp 90 PID 456 wrote to memory of 2612 456 512D.tmp 90 PID 2612 wrote to memory of 3052 2612 51AA.tmp 91 PID 2612 wrote to memory of 3052 2612 51AA.tmp 91 PID 2612 wrote to memory of 3052 2612 51AA.tmp 91 PID 3052 wrote to memory of 1436 3052 5237.tmp 92 PID 3052 wrote to memory of 1436 3052 5237.tmp 92 PID 3052 wrote to memory of 1436 3052 5237.tmp 92 PID 1436 wrote to memory of 1744 1436 5294.tmp 93 PID 1436 wrote to memory of 1744 1436 5294.tmp 93 PID 1436 wrote to memory of 1744 1436 5294.tmp 93 PID 1744 wrote to memory of 464 1744 5311.tmp 94 PID 1744 wrote to memory of 464 1744 5311.tmp 94 PID 1744 wrote to memory of 464 1744 5311.tmp 94 PID 464 wrote to memory of 1560 464 536F.tmp 95 PID 464 wrote to memory of 1560 464 536F.tmp 95 PID 464 wrote to memory of 1560 464 536F.tmp 95 PID 1560 wrote to memory of 688 1560 53DD.tmp 96 PID 1560 wrote to memory of 688 1560 53DD.tmp 96 PID 1560 wrote to memory of 688 1560 53DD.tmp 96 PID 688 wrote to memory of 3240 688 544A.tmp 97 PID 688 wrote to memory of 3240 688 544A.tmp 97 PID 688 wrote to memory of 3240 688 544A.tmp 97 PID 3240 wrote to memory of 1568 3240 54B7.tmp 98 PID 3240 wrote to memory of 1568 3240 54B7.tmp 98 PID 3240 wrote to memory of 1568 3240 54B7.tmp 98 PID 1568 wrote to memory of 3248 1568 5534.tmp 99 PID 1568 wrote to memory of 3248 1568 5534.tmp 99 PID 1568 wrote to memory of 3248 1568 5534.tmp 99 PID 3248 wrote to memory of 1576 3248 55A2.tmp 100 PID 3248 wrote to memory of 1576 3248 55A2.tmp 100 PID 3248 wrote to memory of 1576 3248 55A2.tmp 100 PID 1576 wrote to memory of 2856 1576 55FF.tmp 101 PID 1576 wrote to memory of 2856 1576 55FF.tmp 101 PID 1576 wrote to memory of 2856 1576 55FF.tmp 101 PID 2856 wrote to memory of 4964 2856 566D.tmp 102 PID 2856 wrote to memory of 4964 2856 566D.tmp 102 PID 2856 wrote to memory of 4964 2856 566D.tmp 102 PID 4964 wrote to memory of 2344 4964 56EA.tmp 103 PID 4964 wrote to memory of 2344 4964 56EA.tmp 103 PID 4964 wrote to memory of 2344 4964 56EA.tmp 103 PID 2344 wrote to memory of 2360 2344 5757.tmp 104 PID 2344 wrote to memory of 2360 2344 5757.tmp 104 PID 2344 wrote to memory of 2360 2344 5757.tmp 104 PID 2360 wrote to memory of 1392 2360 57B5.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-14_849bc10b7f21a92b0ecf41f8b4152cca_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-14_849bc10b7f21a92b0ecf41f8b4152cca_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"23⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"24⤵
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"25⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"26⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"27⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"28⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"29⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"30⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"31⤵
- Executes dropped EXE
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"32⤵
- Executes dropped EXE
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"33⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"34⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"35⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"36⤵
- Executes dropped EXE
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"37⤵
- Executes dropped EXE
PID:672 -
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"38⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"39⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"40⤵
- Executes dropped EXE
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"41⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"42⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"43⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"44⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"45⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"46⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"47⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"48⤵
- Executes dropped EXE
PID:884 -
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"49⤵
- Executes dropped EXE
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"50⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"51⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"52⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"53⤵
- Executes dropped EXE
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"54⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"55⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"56⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"57⤵
- Executes dropped EXE
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"58⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"59⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"60⤵
- Executes dropped EXE
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"61⤵
- Executes dropped EXE
PID:372 -
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"62⤵
- Executes dropped EXE
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"63⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"64⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"65⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"66⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"67⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"68⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"69⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"70⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"71⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"72⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"73⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"74⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"75⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"76⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"77⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"78⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"79⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"80⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"81⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"82⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"83⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"84⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"85⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"86⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"87⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"88⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"89⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"90⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"91⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"92⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"93⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"94⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"95⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"96⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"97⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\71B5.tmp"C:\Users\Admin\AppData\Local\Temp\71B5.tmp"98⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"99⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"100⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\72A0.tmp"C:\Users\Admin\AppData\Local\Temp\72A0.tmp"101⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"102⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"103⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"104⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\73E8.tmp"C:\Users\Admin\AppData\Local\Temp\73E8.tmp"105⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"106⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"107⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"108⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"109⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"110⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"111⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"112⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"113⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"114⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\7724.tmp"C:\Users\Admin\AppData\Local\Temp\7724.tmp"115⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"116⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\77DF.tmp"C:\Users\Admin\AppData\Local\Temp\77DF.tmp"117⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\782D.tmp"C:\Users\Admin\AppData\Local\Temp\782D.tmp"118⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"119⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"120⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\7918.tmp"C:\Users\Admin\AppData\Local\Temp\7918.tmp"121⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\7966.tmp"C:\Users\Admin\AppData\Local\Temp\7966.tmp"122⤵PID:4384
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-