Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 17:52
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-16_2a09cd260adaf0da805a67c56d06d255_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-05-16_2a09cd260adaf0da805a67c56d06d255_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-16_2a09cd260adaf0da805a67c56d06d255_mafia.exe
-
Size
536KB
-
MD5
2a09cd260adaf0da805a67c56d06d255
-
SHA1
83a3d13a5584009965b6030605ccbc460057af3c
-
SHA256
c46d3b5c12e9d404dcfe956d289a84911c2b762aaa37210e3b07c8cf30140864
-
SHA512
0d36ae2a97afa4d595b3498209ed15319ffb4991e36715367cc031b7efcd1cc5d97d6fd68509d1370839545648c4795a3f040b667192d0803fe2d46f10dbe1ff
-
SSDEEP
12288:wU5rCOTeiUDqIEYPKES5bOd4i6UnM5i4kCYtUIZxVJ0ZT9:wUQOJUDqGO+60M5i4kRtUIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5080 45D3.tmp 3172 46DC.tmp 2728 47B7.tmp 2652 4863.tmp 764 494D.tmp 940 49DA.tmp 4652 4AB5.tmp 3260 4B61.tmp 4692 4C2C.tmp 1008 4CF7.tmp 2800 4DA3.tmp 4372 4E6E.tmp 3144 4F68.tmp 2944 5033.tmp 1364 50C0.tmp 4600 517B.tmp 3716 51F8.tmp 4128 5285.tmp 1168 5331.tmp 4108 53CD.tmp 1584 54A8.tmp 704 5544.tmp 4404 55E0.tmp 4424 567C.tmp 2528 5767.tmp 1516 5832.tmp 5060 58CE.tmp 4036 59A9.tmp 2624 5A55.tmp 400 5AE1.tmp 1588 5BAD.tmp 2368 5C78.tmp 3444 5D33.tmp 2444 5DA1.tmp 4640 5E2D.tmp 2524 5ED9.tmp 1600 5F75.tmp 3300 5FE3.tmp 940 606F.tmp 4268 610C.tmp 1396 6169.tmp 4536 61F6.tmp 2696 6273.tmp 4868 62F0.tmp 1008 636D.tmp 2732 6409.tmp 2680 6496.tmp 4372 6532.tmp 1676 65AF.tmp 2900 662C.tmp 3700 668A.tmp 2176 66F7.tmp 2032 6755.tmp 2748 67B3.tmp 3156 6810.tmp 2068 687E.tmp 3276 68DC.tmp 4596 6949.tmp 3068 69A7.tmp 1328 6A04.tmp 5112 6A53.tmp 4384 6AA1.tmp 4948 6AFE.tmp 1844 6B5C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4276 wrote to memory of 5080 4276 2024-05-16_2a09cd260adaf0da805a67c56d06d255_mafia.exe 83 PID 4276 wrote to memory of 5080 4276 2024-05-16_2a09cd260adaf0da805a67c56d06d255_mafia.exe 83 PID 4276 wrote to memory of 5080 4276 2024-05-16_2a09cd260adaf0da805a67c56d06d255_mafia.exe 83 PID 5080 wrote to memory of 3172 5080 45D3.tmp 84 PID 5080 wrote to memory of 3172 5080 45D3.tmp 84 PID 5080 wrote to memory of 3172 5080 45D3.tmp 84 PID 3172 wrote to memory of 2728 3172 46DC.tmp 85 PID 3172 wrote to memory of 2728 3172 46DC.tmp 85 PID 3172 wrote to memory of 2728 3172 46DC.tmp 85 PID 2728 wrote to memory of 2652 2728 47B7.tmp 87 PID 2728 wrote to memory of 2652 2728 47B7.tmp 87 PID 2728 wrote to memory of 2652 2728 47B7.tmp 87 PID 2652 wrote to memory of 764 2652 4863.tmp 88 PID 2652 wrote to memory of 764 2652 4863.tmp 88 PID 2652 wrote to memory of 764 2652 4863.tmp 88 PID 764 wrote to memory of 940 764 494D.tmp 90 PID 764 wrote to memory of 940 764 494D.tmp 90 PID 764 wrote to memory of 940 764 494D.tmp 90 PID 940 wrote to memory of 4652 940 49DA.tmp 91 PID 940 wrote to memory of 4652 940 49DA.tmp 91 PID 940 wrote to memory of 4652 940 49DA.tmp 91 PID 4652 wrote to memory of 3260 4652 4AB5.tmp 93 PID 4652 wrote to memory of 3260 4652 4AB5.tmp 93 PID 4652 wrote to memory of 3260 4652 4AB5.tmp 93 PID 3260 wrote to memory of 4692 3260 4B61.tmp 94 PID 3260 wrote to memory of 4692 3260 4B61.tmp 94 PID 3260 wrote to memory of 4692 3260 4B61.tmp 94 PID 4692 wrote to memory of 1008 4692 4C2C.tmp 95 PID 4692 wrote to memory of 1008 4692 4C2C.tmp 95 PID 4692 wrote to memory of 1008 4692 4C2C.tmp 95 PID 1008 wrote to memory of 2800 1008 4CF7.tmp 96 PID 1008 wrote to memory of 2800 1008 4CF7.tmp 96 PID 1008 wrote to memory of 2800 1008 4CF7.tmp 96 PID 2800 wrote to memory of 4372 2800 4DA3.tmp 97 PID 2800 wrote to memory of 4372 2800 4DA3.tmp 97 PID 2800 wrote to memory of 4372 2800 4DA3.tmp 97 PID 4372 wrote to memory of 3144 4372 4E6E.tmp 98 PID 4372 wrote to memory of 3144 4372 4E6E.tmp 98 PID 4372 wrote to memory of 3144 4372 4E6E.tmp 98 PID 3144 wrote to memory of 2944 3144 4F68.tmp 99 PID 3144 wrote to memory of 2944 3144 4F68.tmp 99 PID 3144 wrote to memory of 2944 3144 4F68.tmp 99 PID 2944 wrote to memory of 1364 2944 5033.tmp 100 PID 2944 wrote to memory of 1364 2944 5033.tmp 100 PID 2944 wrote to memory of 1364 2944 5033.tmp 100 PID 1364 wrote to memory of 4600 1364 50C0.tmp 101 PID 1364 wrote to memory of 4600 1364 50C0.tmp 101 PID 1364 wrote to memory of 4600 1364 50C0.tmp 101 PID 4600 wrote to memory of 3716 4600 517B.tmp 102 PID 4600 wrote to memory of 3716 4600 517B.tmp 102 PID 4600 wrote to memory of 3716 4600 517B.tmp 102 PID 3716 wrote to memory of 4128 3716 51F8.tmp 103 PID 3716 wrote to memory of 4128 3716 51F8.tmp 103 PID 3716 wrote to memory of 4128 3716 51F8.tmp 103 PID 4128 wrote to memory of 1168 4128 5285.tmp 104 PID 4128 wrote to memory of 1168 4128 5285.tmp 104 PID 4128 wrote to memory of 1168 4128 5285.tmp 104 PID 1168 wrote to memory of 4108 1168 5331.tmp 105 PID 1168 wrote to memory of 4108 1168 5331.tmp 105 PID 1168 wrote to memory of 4108 1168 5331.tmp 105 PID 4108 wrote to memory of 1584 4108 53CD.tmp 106 PID 4108 wrote to memory of 1584 4108 53CD.tmp 106 PID 4108 wrote to memory of 1584 4108 53CD.tmp 106 PID 1584 wrote to memory of 704 1584 54A8.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_2a09cd260adaf0da805a67c56d06d255_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-16_2a09cd260adaf0da805a67c56d06d255_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\45D3.tmp"C:\Users\Admin\AppData\Local\Temp\45D3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"23⤵
- Executes dropped EXE
PID:704 -
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"24⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"25⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"26⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"27⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"28⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"29⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"30⤵
- Executes dropped EXE
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"31⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"32⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"33⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"34⤵
- Executes dropped EXE
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"35⤵
- Executes dropped EXE
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"36⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"37⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"38⤵
- Executes dropped EXE
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"39⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"40⤵
- Executes dropped EXE
PID:940 -
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"41⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"42⤵
- Executes dropped EXE
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"43⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"44⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"45⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"46⤵
- Executes dropped EXE
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"47⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"48⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"49⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"50⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"51⤵
- Executes dropped EXE
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"52⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"53⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"54⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"55⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"56⤵
- Executes dropped EXE
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"57⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"58⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"59⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"60⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"61⤵
- Executes dropped EXE
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"62⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"63⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"64⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"65⤵
- Executes dropped EXE
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"66⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"67⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"68⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"69⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"70⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"71⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"72⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"73⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"74⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"75⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"76⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"77⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"78⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"79⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"80⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"81⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"82⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"83⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"84⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"85⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"86⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"87⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"88⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"89⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"90⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"91⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"92⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"93⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"94⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"95⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"96⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"97⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"98⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\7714.tmp"C:\Users\Admin\AppData\Local\Temp\7714.tmp"99⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\7772.tmp"C:\Users\Admin\AppData\Local\Temp\7772.tmp"100⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"101⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"102⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\786C.tmp"C:\Users\Admin\AppData\Local\Temp\786C.tmp"103⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\78D9.tmp"C:\Users\Admin\AppData\Local\Temp\78D9.tmp"104⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\7937.tmp"C:\Users\Admin\AppData\Local\Temp\7937.tmp"105⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"106⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"107⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\7A50.tmp"C:\Users\Admin\AppData\Local\Temp\7A50.tmp"108⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"109⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\7AED.tmp"C:\Users\Admin\AppData\Local\Temp\7AED.tmp"110⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"111⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"112⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"113⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\7C44.tmp"C:\Users\Admin\AppData\Local\Temp\7C44.tmp"114⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\7C92.tmp"C:\Users\Admin\AppData\Local\Temp\7C92.tmp"115⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"116⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"117⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"118⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"119⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"120⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\7E77.tmp"C:\Users\Admin\AppData\Local\Temp\7E77.tmp"121⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"122⤵PID:2852
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-