Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2024, 12:51
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-20_de0982f5d366aff7d0042c3ed68a7252_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-20_de0982f5d366aff7d0042c3ed68a7252_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-20_de0982f5d366aff7d0042c3ed68a7252_mafia.exe
-
Size
536KB
-
MD5
de0982f5d366aff7d0042c3ed68a7252
-
SHA1
2d200576d42da9137765650852b67d5fa780e014
-
SHA256
d59973b2377435d84267fe133bad353f68c0bb15c2a473cd767967efd4ef2316
-
SHA512
e1ef24abf06458fc5a38838867b451d0f6cdb2e9dce12fd3ea4f1aa3e55550c49e6b4a633e002d218a391d55c5cc6a3409fb82a72ace8bae539162e8f5360869
-
SSDEEP
12288:wU5rCOTeiU9E62NW1KtpxdgfXuGIZxVJ0ZT9:wUQOJUSs1gdgfXlIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2388 41BC.tmp 216 4277.tmp 1248 4323.tmp 5080 43CF.tmp 4468 446B.tmp 3064 4517.tmp 1672 45B4.tmp 2412 467F.tmp 696 471B.tmp 3448 47D6.tmp 2468 4873.tmp 4776 490F.tmp 3936 49BB.tmp 1796 4A67.tmp 3200 4AE4.tmp 2332 4B70.tmp 2524 4C3B.tmp 3100 4CF7.tmp 1364 4DD2.tmp 2800 4E6E.tmp 4460 4EEB.tmp 4840 4F87.tmp 5116 5004.tmp 4828 5091.tmp 4048 514C.tmp 1960 5208.tmp 3480 5285.tmp 2384 5331.tmp 3424 53EC.tmp 2724 5498.tmp 3464 5515.tmp 4536 55B1.tmp 4476 565D.tmp 4396 56DA.tmp 2804 5738.tmp 4756 57A5.tmp 432 5832.tmp 4572 589F.tmp 4484 591C.tmp 4316 59A9.tmp 1264 5A26.tmp 1940 5A93.tmp 4636 5AF1.tmp 4368 5B8D.tmp 1848 5C0A.tmp 316 5C87.tmp 1016 5CF5.tmp 4668 5D72.tmp 2140 5DDF.tmp 4180 5E2D.tmp 5088 5E7B.tmp 5060 5ED9.tmp 4620 5F27.tmp 1244 5F85.tmp 4608 5FD3.tmp 5032 6021.tmp 1276 606F.tmp 2160 60CD.tmp 3180 611B.tmp 2484 6169.tmp 1796 61B7.tmp 5068 6206.tmp 776 6254.tmp 4732 62A2.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 756 wrote to memory of 2388 756 2024-05-20_de0982f5d366aff7d0042c3ed68a7252_mafia.exe 82 PID 756 wrote to memory of 2388 756 2024-05-20_de0982f5d366aff7d0042c3ed68a7252_mafia.exe 82 PID 756 wrote to memory of 2388 756 2024-05-20_de0982f5d366aff7d0042c3ed68a7252_mafia.exe 82 PID 2388 wrote to memory of 216 2388 41BC.tmp 83 PID 2388 wrote to memory of 216 2388 41BC.tmp 83 PID 2388 wrote to memory of 216 2388 41BC.tmp 83 PID 216 wrote to memory of 1248 216 4277.tmp 84 PID 216 wrote to memory of 1248 216 4277.tmp 84 PID 216 wrote to memory of 1248 216 4277.tmp 84 PID 1248 wrote to memory of 5080 1248 4323.tmp 85 PID 1248 wrote to memory of 5080 1248 4323.tmp 85 PID 1248 wrote to memory of 5080 1248 4323.tmp 85 PID 5080 wrote to memory of 4468 5080 43CF.tmp 86 PID 5080 wrote to memory of 4468 5080 43CF.tmp 86 PID 5080 wrote to memory of 4468 5080 43CF.tmp 86 PID 4468 wrote to memory of 3064 4468 446B.tmp 87 PID 4468 wrote to memory of 3064 4468 446B.tmp 87 PID 4468 wrote to memory of 3064 4468 446B.tmp 87 PID 3064 wrote to memory of 1672 3064 4517.tmp 88 PID 3064 wrote to memory of 1672 3064 4517.tmp 88 PID 3064 wrote to memory of 1672 3064 4517.tmp 88 PID 1672 wrote to memory of 2412 1672 45B4.tmp 89 PID 1672 wrote to memory of 2412 1672 45B4.tmp 89 PID 1672 wrote to memory of 2412 1672 45B4.tmp 89 PID 2412 wrote to memory of 696 2412 467F.tmp 90 PID 2412 wrote to memory of 696 2412 467F.tmp 90 PID 2412 wrote to memory of 696 2412 467F.tmp 90 PID 696 wrote to memory of 3448 696 471B.tmp 91 PID 696 wrote to memory of 3448 696 471B.tmp 91 PID 696 wrote to memory of 3448 696 471B.tmp 91 PID 3448 wrote to memory of 2468 3448 47D6.tmp 92 PID 3448 wrote to memory of 2468 3448 47D6.tmp 92 PID 3448 wrote to memory of 2468 3448 47D6.tmp 92 PID 2468 wrote to memory of 4776 2468 4873.tmp 93 PID 2468 wrote to memory of 4776 2468 4873.tmp 93 PID 2468 wrote to memory of 4776 2468 4873.tmp 93 PID 4776 wrote to memory of 3936 4776 490F.tmp 94 PID 4776 wrote to memory of 3936 4776 490F.tmp 94 PID 4776 wrote to memory of 3936 4776 490F.tmp 94 PID 3936 wrote to memory of 1796 3936 49BB.tmp 95 PID 3936 wrote to memory of 1796 3936 49BB.tmp 95 PID 3936 wrote to memory of 1796 3936 49BB.tmp 95 PID 1796 wrote to memory of 3200 1796 4A67.tmp 96 PID 1796 wrote to memory of 3200 1796 4A67.tmp 96 PID 1796 wrote to memory of 3200 1796 4A67.tmp 96 PID 3200 wrote to memory of 2332 3200 4AE4.tmp 97 PID 3200 wrote to memory of 2332 3200 4AE4.tmp 97 PID 3200 wrote to memory of 2332 3200 4AE4.tmp 97 PID 2332 wrote to memory of 2524 2332 4B70.tmp 98 PID 2332 wrote to memory of 2524 2332 4B70.tmp 98 PID 2332 wrote to memory of 2524 2332 4B70.tmp 98 PID 2524 wrote to memory of 3100 2524 4C3B.tmp 99 PID 2524 wrote to memory of 3100 2524 4C3B.tmp 99 PID 2524 wrote to memory of 3100 2524 4C3B.tmp 99 PID 3100 wrote to memory of 1364 3100 4CF7.tmp 100 PID 3100 wrote to memory of 1364 3100 4CF7.tmp 100 PID 3100 wrote to memory of 1364 3100 4CF7.tmp 100 PID 1364 wrote to memory of 2800 1364 4DD2.tmp 101 PID 1364 wrote to memory of 2800 1364 4DD2.tmp 101 PID 1364 wrote to memory of 2800 1364 4DD2.tmp 101 PID 2800 wrote to memory of 4460 2800 4E6E.tmp 102 PID 2800 wrote to memory of 4460 2800 4E6E.tmp 102 PID 2800 wrote to memory of 4460 2800 4E6E.tmp 102 PID 4460 wrote to memory of 4840 4460 4EEB.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_de0982f5d366aff7d0042c3ed68a7252_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_de0982f5d366aff7d0042c3ed68a7252_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\41BC.tmp"C:\Users\Admin\AppData\Local\Temp\41BC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\4277.tmp"C:\Users\Admin\AppData\Local\Temp\4277.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\43CF.tmp"C:\Users\Admin\AppData\Local\Temp\43CF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"23⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"24⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"25⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"26⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"27⤵
- Executes dropped EXE
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"28⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"29⤵
- Executes dropped EXE
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"30⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"31⤵
- Executes dropped EXE
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"32⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"33⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"34⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"35⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"36⤵
- Executes dropped EXE
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"37⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"38⤵
- Executes dropped EXE
PID:432 -
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"39⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"40⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"41⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"42⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"43⤵
- Executes dropped EXE
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"44⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"45⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"46⤵
- Executes dropped EXE
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"47⤵
- Executes dropped EXE
PID:316 -
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"48⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"49⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"50⤵
- Executes dropped EXE
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"51⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"52⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"53⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"54⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"55⤵
- Executes dropped EXE
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"56⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"57⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"58⤵
- Executes dropped EXE
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"59⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"60⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"61⤵
- Executes dropped EXE
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"62⤵
- Executes dropped EXE
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"63⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"64⤵
- Executes dropped EXE
PID:776 -
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"65⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"66⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"67⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"68⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"69⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"70⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"71⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"72⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"73⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"74⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"75⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"76⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"77⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"78⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"79⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"80⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"81⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"82⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"83⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"84⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"85⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"86⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"87⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"88⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"89⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"90⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"91⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"92⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"93⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"94⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"95⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"96⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"97⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"98⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"99⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"100⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"101⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"102⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"103⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"104⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"105⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"106⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"107⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"108⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"109⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"110⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\7177.tmp"C:\Users\Admin\AppData\Local\Temp\7177.tmp"111⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"112⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\7213.tmp"C:\Users\Admin\AppData\Local\Temp\7213.tmp"113⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"114⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\72BF.tmp"C:\Users\Admin\AppData\Local\Temp\72BF.tmp"115⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"116⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"117⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"118⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"119⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"120⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"121⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"122⤵PID:1720
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-