Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 19:00
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-16_9cdc4afb83cf47d44f18c65ff6168579_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-16_9cdc4afb83cf47d44f18c65ff6168579_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-16_9cdc4afb83cf47d44f18c65ff6168579_mafia.exe
-
Size
486KB
-
MD5
9cdc4afb83cf47d44f18c65ff6168579
-
SHA1
d07cef4c453ea6e52ce70125c52f51f6fbe38036
-
SHA256
4f47868976913ceeb3bbbe0c13bd2557838934c1e962334ff51f49c9e6675ac2
-
SHA512
fe2f979f3917735992f9aef0985095a5fa51f3c413994807988ee27e78a7de41ca427ab25240ef353560ae5fa4cc799a81d6aaee7841e7cf40bf2f5324141dcf
-
SSDEEP
12288:/U5rCOTeiDKlK+BxHGyaxJi79Uv7BsNWNZ:/UQOJDK4+BRgJi7Svts0N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4720 41BC.tmp 4808 4239.tmp 1484 42C6.tmp 4420 4323.tmp 3124 43A0.tmp 1532 43FE.tmp 3520 445C.tmp 2712 44C9.tmp 3284 4546.tmp 4276 45A4.tmp 1168 4602.tmp 4692 466F.tmp 2276 46DC.tmp 3620 474A.tmp 1488 47C7.tmp 4360 4834.tmp 4940 48C1.tmp 2708 491F.tmp 5092 497C.tmp 3400 49DA.tmp 1628 4A38.tmp 5008 4AA5.tmp 3252 4B22.tmp 4968 4B90.tmp 3048 4BDE.tmp 2588 4C3B.tmp 4880 4CA9.tmp 4336 4CF7.tmp 4032 4D64.tmp 884 4DD2.tmp 1468 4E3F.tmp 4556 4E8D.tmp 4440 4EFB.tmp 4432 4F58.tmp 1228 4FB6.tmp 2572 5033.tmp 2176 50A0.tmp 4028 50FE.tmp 1028 515C.tmp 4176 51BA.tmp 1204 5246.tmp 1124 52A4.tmp 2880 52F2.tmp 2100 5350.tmp 3556 53AE.tmp 3000 53FC.tmp 4444 545A.tmp 4940 54A8.tmp 2708 5515.tmp 4712 5573.tmp 4936 55D1.tmp 2920 562E.tmp 3352 568C.tmp 1084 56EA.tmp 3796 5748.tmp 5088 5796.tmp 5008 57F3.tmp 4748 5861.tmp 3252 58BF.tmp 3512 592C.tmp 1964 598A.tmp 1992 59E7.tmp 4868 5A55.tmp 3404 5AB3.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2624 wrote to memory of 4720 2624 2024-05-16_9cdc4afb83cf47d44f18c65ff6168579_mafia.exe 82 PID 2624 wrote to memory of 4720 2624 2024-05-16_9cdc4afb83cf47d44f18c65ff6168579_mafia.exe 82 PID 2624 wrote to memory of 4720 2624 2024-05-16_9cdc4afb83cf47d44f18c65ff6168579_mafia.exe 82 PID 4720 wrote to memory of 4808 4720 41BC.tmp 83 PID 4720 wrote to memory of 4808 4720 41BC.tmp 83 PID 4720 wrote to memory of 4808 4720 41BC.tmp 83 PID 4808 wrote to memory of 1484 4808 4239.tmp 85 PID 4808 wrote to memory of 1484 4808 4239.tmp 85 PID 4808 wrote to memory of 1484 4808 4239.tmp 85 PID 1484 wrote to memory of 4420 1484 42C6.tmp 86 PID 1484 wrote to memory of 4420 1484 42C6.tmp 86 PID 1484 wrote to memory of 4420 1484 42C6.tmp 86 PID 4420 wrote to memory of 3124 4420 4323.tmp 88 PID 4420 wrote to memory of 3124 4420 4323.tmp 88 PID 4420 wrote to memory of 3124 4420 4323.tmp 88 PID 3124 wrote to memory of 1532 3124 43A0.tmp 89 PID 3124 wrote to memory of 1532 3124 43A0.tmp 89 PID 3124 wrote to memory of 1532 3124 43A0.tmp 89 PID 1532 wrote to memory of 3520 1532 43FE.tmp 91 PID 1532 wrote to memory of 3520 1532 43FE.tmp 91 PID 1532 wrote to memory of 3520 1532 43FE.tmp 91 PID 3520 wrote to memory of 2712 3520 445C.tmp 92 PID 3520 wrote to memory of 2712 3520 445C.tmp 92 PID 3520 wrote to memory of 2712 3520 445C.tmp 92 PID 2712 wrote to memory of 3284 2712 44C9.tmp 93 PID 2712 wrote to memory of 3284 2712 44C9.tmp 93 PID 2712 wrote to memory of 3284 2712 44C9.tmp 93 PID 3284 wrote to memory of 4276 3284 4546.tmp 94 PID 3284 wrote to memory of 4276 3284 4546.tmp 94 PID 3284 wrote to memory of 4276 3284 4546.tmp 94 PID 4276 wrote to memory of 1168 4276 45A4.tmp 95 PID 4276 wrote to memory of 1168 4276 45A4.tmp 95 PID 4276 wrote to memory of 1168 4276 45A4.tmp 95 PID 1168 wrote to memory of 4692 1168 4602.tmp 96 PID 1168 wrote to memory of 4692 1168 4602.tmp 96 PID 1168 wrote to memory of 4692 1168 4602.tmp 96 PID 4692 wrote to memory of 2276 4692 466F.tmp 97 PID 4692 wrote to memory of 2276 4692 466F.tmp 97 PID 4692 wrote to memory of 2276 4692 466F.tmp 97 PID 2276 wrote to memory of 3620 2276 46DC.tmp 98 PID 2276 wrote to memory of 3620 2276 46DC.tmp 98 PID 2276 wrote to memory of 3620 2276 46DC.tmp 98 PID 3620 wrote to memory of 1488 3620 474A.tmp 99 PID 3620 wrote to memory of 1488 3620 474A.tmp 99 PID 3620 wrote to memory of 1488 3620 474A.tmp 99 PID 1488 wrote to memory of 4360 1488 47C7.tmp 100 PID 1488 wrote to memory of 4360 1488 47C7.tmp 100 PID 1488 wrote to memory of 4360 1488 47C7.tmp 100 PID 4360 wrote to memory of 4940 4360 4834.tmp 102 PID 4360 wrote to memory of 4940 4360 4834.tmp 102 PID 4360 wrote to memory of 4940 4360 4834.tmp 102 PID 4940 wrote to memory of 2708 4940 48C1.tmp 103 PID 4940 wrote to memory of 2708 4940 48C1.tmp 103 PID 4940 wrote to memory of 2708 4940 48C1.tmp 103 PID 2708 wrote to memory of 5092 2708 491F.tmp 104 PID 2708 wrote to memory of 5092 2708 491F.tmp 104 PID 2708 wrote to memory of 5092 2708 491F.tmp 104 PID 5092 wrote to memory of 3400 5092 497C.tmp 105 PID 5092 wrote to memory of 3400 5092 497C.tmp 105 PID 5092 wrote to memory of 3400 5092 497C.tmp 105 PID 3400 wrote to memory of 1628 3400 49DA.tmp 106 PID 3400 wrote to memory of 1628 3400 49DA.tmp 106 PID 3400 wrote to memory of 1628 3400 49DA.tmp 106 PID 1628 wrote to memory of 5008 1628 4A38.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_9cdc4afb83cf47d44f18c65ff6168579_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-16_9cdc4afb83cf47d44f18c65ff6168579_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\41BC.tmp"C:\Users\Admin\AppData\Local\Temp\41BC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\42C6.tmp"C:\Users\Admin\AppData\Local\Temp\42C6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\43FE.tmp"C:\Users\Admin\AppData\Local\Temp\43FE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\4602.tmp"C:\Users\Admin\AppData\Local\Temp\4602.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"23⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"24⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"25⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"26⤵
- Executes dropped EXE
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"27⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"28⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"29⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"30⤵
- Executes dropped EXE
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"31⤵
- Executes dropped EXE
PID:884 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"32⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"33⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"34⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"35⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"36⤵
- Executes dropped EXE
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"37⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"38⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"39⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"40⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"41⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"42⤵
- Executes dropped EXE
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"43⤵
- Executes dropped EXE
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"44⤵
- Executes dropped EXE
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"45⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"46⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"47⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"48⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"49⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"50⤵
- Executes dropped EXE
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"51⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"52⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"53⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"54⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"55⤵
- Executes dropped EXE
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"56⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"57⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"58⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"59⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"60⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"61⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"62⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"63⤵
- Executes dropped EXE
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"64⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"65⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"66⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"67⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"68⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"69⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"70⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"71⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"72⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"73⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"74⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"75⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"76⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"77⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"78⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"79⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"80⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"81⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"82⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"83⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"84⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"85⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"86⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"87⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"88⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"89⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"90⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"91⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"92⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"93⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"94⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"95⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"96⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"97⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"98⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"99⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"100⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"101⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"102⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"103⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"104⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"105⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"106⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"107⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"108⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"109⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"110⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"111⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"112⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"113⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\6C56.tmp"C:\Users\Admin\AppData\Local\Temp\6C56.tmp"114⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"115⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"116⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"117⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"118⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"119⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"120⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"121⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"122⤵PID:4428
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-