Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 19:03
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-26_6df63b4ff90fdbe7dc266bd0d3aee5dc_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-26_6df63b4ff90fdbe7dc266bd0d3aee5dc_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-26_6df63b4ff90fdbe7dc266bd0d3aee5dc_mafia.exe
-
Size
487KB
-
MD5
6df63b4ff90fdbe7dc266bd0d3aee5dc
-
SHA1
635d8f3a66f28df16c463c4c69791296da84b000
-
SHA256
6b9e9d25f74b9e66c9ed9c22b0b58f5ff23508837c4d02febece316fcd7504b6
-
SHA512
8d6a1677239f93d356ab586ca7934f6548ca833d525f13599c96cebc784ab1c930049892ab1853c417f0a2c07d741bb312913a1d7bd868dda244328a19fdc552
-
SSDEEP
12288:yU5rCOTeiNRUdMm4plXl4vYUDaX8oBIm5Bl4bZ:yUQOJNRUN24tDaFZl4b
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1828 4F49.tmp 3116 4FC6.tmp 4548 5052.tmp 3588 50DF.tmp 3756 513D.tmp 3248 519A.tmp 1276 5208.tmp 2520 5285.tmp 3216 5302.tmp 3604 538E.tmp 2208 53EC.tmp 4376 5469.tmp 4816 54C7.tmp 5080 5525.tmp 3240 5592.tmp 5116 55F0.tmp 4632 564E.tmp 4356 56AB.tmp 3724 56F9.tmp 3824 5767.tmp 5020 57D4.tmp 1396 5851.tmp 3476 58CE.tmp 3728 591C.tmp 4644 598A.tmp 3084 5A07.tmp 1892 5A55.tmp 2548 5AC2.tmp 1188 5B3F.tmp 3944 5B9D.tmp 2992 5BFB.tmp 4704 5C49.tmp 3012 5CA7.tmp 4472 5D04.tmp 1148 5D52.tmp 3244 5DC0.tmp 2020 5E1E.tmp 1168 5E6C.tmp 2076 5EC9.tmp 4416 5F27.tmp 1280 5F85.tmp 1072 5FD3.tmp 3116 6021.tmp 4360 606F.tmp 1460 60BD.tmp 3320 611B.tmp 3588 6169.tmp 2952 61B7.tmp 4204 6206.tmp 3964 6254.tmp 3328 62A2.tmp 536 62F0.tmp 4720 633E.tmp 436 638C.tmp 3172 63DA.tmp 4364 6428.tmp 1984 6486.tmp 2916 64E4.tmp 1968 6542.tmp 4632 659F.tmp 1592 65EE.tmp 840 663C.tmp 4728 6699.tmp 2648 66F7.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3308 wrote to memory of 1828 3308 2024-05-26_6df63b4ff90fdbe7dc266bd0d3aee5dc_mafia.exe 83 PID 3308 wrote to memory of 1828 3308 2024-05-26_6df63b4ff90fdbe7dc266bd0d3aee5dc_mafia.exe 83 PID 3308 wrote to memory of 1828 3308 2024-05-26_6df63b4ff90fdbe7dc266bd0d3aee5dc_mafia.exe 83 PID 1828 wrote to memory of 3116 1828 4F49.tmp 84 PID 1828 wrote to memory of 3116 1828 4F49.tmp 84 PID 1828 wrote to memory of 3116 1828 4F49.tmp 84 PID 3116 wrote to memory of 4548 3116 4FC6.tmp 85 PID 3116 wrote to memory of 4548 3116 4FC6.tmp 85 PID 3116 wrote to memory of 4548 3116 4FC6.tmp 85 PID 4548 wrote to memory of 3588 4548 5052.tmp 87 PID 4548 wrote to memory of 3588 4548 5052.tmp 87 PID 4548 wrote to memory of 3588 4548 5052.tmp 87 PID 3588 wrote to memory of 3756 3588 50DF.tmp 89 PID 3588 wrote to memory of 3756 3588 50DF.tmp 89 PID 3588 wrote to memory of 3756 3588 50DF.tmp 89 PID 3756 wrote to memory of 3248 3756 513D.tmp 90 PID 3756 wrote to memory of 3248 3756 513D.tmp 90 PID 3756 wrote to memory of 3248 3756 513D.tmp 90 PID 3248 wrote to memory of 1276 3248 519A.tmp 92 PID 3248 wrote to memory of 1276 3248 519A.tmp 92 PID 3248 wrote to memory of 1276 3248 519A.tmp 92 PID 1276 wrote to memory of 2520 1276 5208.tmp 93 PID 1276 wrote to memory of 2520 1276 5208.tmp 93 PID 1276 wrote to memory of 2520 1276 5208.tmp 93 PID 2520 wrote to memory of 3216 2520 5285.tmp 94 PID 2520 wrote to memory of 3216 2520 5285.tmp 94 PID 2520 wrote to memory of 3216 2520 5285.tmp 94 PID 3216 wrote to memory of 3604 3216 5302.tmp 95 PID 3216 wrote to memory of 3604 3216 5302.tmp 95 PID 3216 wrote to memory of 3604 3216 5302.tmp 95 PID 3604 wrote to memory of 2208 3604 538E.tmp 96 PID 3604 wrote to memory of 2208 3604 538E.tmp 96 PID 3604 wrote to memory of 2208 3604 538E.tmp 96 PID 2208 wrote to memory of 4376 2208 53EC.tmp 97 PID 2208 wrote to memory of 4376 2208 53EC.tmp 97 PID 2208 wrote to memory of 4376 2208 53EC.tmp 97 PID 4376 wrote to memory of 4816 4376 5469.tmp 98 PID 4376 wrote to memory of 4816 4376 5469.tmp 98 PID 4376 wrote to memory of 4816 4376 5469.tmp 98 PID 4816 wrote to memory of 5080 4816 54C7.tmp 99 PID 4816 wrote to memory of 5080 4816 54C7.tmp 99 PID 4816 wrote to memory of 5080 4816 54C7.tmp 99 PID 5080 wrote to memory of 3240 5080 5525.tmp 100 PID 5080 wrote to memory of 3240 5080 5525.tmp 100 PID 5080 wrote to memory of 3240 5080 5525.tmp 100 PID 3240 wrote to memory of 5116 3240 5592.tmp 101 PID 3240 wrote to memory of 5116 3240 5592.tmp 101 PID 3240 wrote to memory of 5116 3240 5592.tmp 101 PID 5116 wrote to memory of 4632 5116 55F0.tmp 102 PID 5116 wrote to memory of 4632 5116 55F0.tmp 102 PID 5116 wrote to memory of 4632 5116 55F0.tmp 102 PID 4632 wrote to memory of 4356 4632 564E.tmp 103 PID 4632 wrote to memory of 4356 4632 564E.tmp 103 PID 4632 wrote to memory of 4356 4632 564E.tmp 103 PID 4356 wrote to memory of 3724 4356 56AB.tmp 104 PID 4356 wrote to memory of 3724 4356 56AB.tmp 104 PID 4356 wrote to memory of 3724 4356 56AB.tmp 104 PID 3724 wrote to memory of 3824 3724 56F9.tmp 105 PID 3724 wrote to memory of 3824 3724 56F9.tmp 105 PID 3724 wrote to memory of 3824 3724 56F9.tmp 105 PID 3824 wrote to memory of 5020 3824 5767.tmp 106 PID 3824 wrote to memory of 5020 3824 5767.tmp 106 PID 3824 wrote to memory of 5020 3824 5767.tmp 106 PID 5020 wrote to memory of 1396 5020 57D4.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_6df63b4ff90fdbe7dc266bd0d3aee5dc_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-26_6df63b4ff90fdbe7dc266bd0d3aee5dc_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"23⤵
- Executes dropped EXE
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"24⤵
- Executes dropped EXE
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"25⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"26⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"27⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"28⤵
- Executes dropped EXE
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"29⤵
- Executes dropped EXE
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"30⤵
- Executes dropped EXE
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"31⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"32⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"33⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"34⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"35⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"36⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"37⤵
- Executes dropped EXE
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"38⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"39⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"40⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"41⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"42⤵
- Executes dropped EXE
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"43⤵
- Executes dropped EXE
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"44⤵
- Executes dropped EXE
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"45⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"46⤵
- Executes dropped EXE
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"47⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"48⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"49⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"50⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"51⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"52⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"53⤵
- Executes dropped EXE
PID:536 -
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"54⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"55⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"56⤵
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"57⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"58⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"59⤵
- Executes dropped EXE
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"60⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"61⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"62⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"63⤵
- Executes dropped EXE
PID:840 -
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"64⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"65⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"66⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"67⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"68⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"69⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"70⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"71⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"72⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"73⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"74⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"75⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"76⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"77⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"78⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"79⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"80⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"81⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"82⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"83⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"84⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"85⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"86⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"87⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"88⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"89⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"90⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"91⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"92⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"93⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"94⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"95⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"96⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"97⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"98⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"99⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"100⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"101⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\73E8.tmp"C:\Users\Admin\AppData\Local\Temp\73E8.tmp"102⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"103⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"104⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\74F1.tmp"C:\Users\Admin\AppData\Local\Temp\74F1.tmp"105⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"106⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"107⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"108⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"109⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"110⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"111⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"112⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\7791.tmp"C:\Users\Admin\AppData\Local\Temp\7791.tmp"113⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\77DF.tmp"C:\Users\Admin\AppData\Local\Temp\77DF.tmp"114⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\782D.tmp"C:\Users\Admin\AppData\Local\Temp\782D.tmp"115⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"116⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"117⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\7918.tmp"C:\Users\Admin\AppData\Local\Temp\7918.tmp"118⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\7976.tmp"C:\Users\Admin\AppData\Local\Temp\7976.tmp"119⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\79D3.tmp"C:\Users\Admin\AppData\Local\Temp\79D3.tmp"120⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\7A21.tmp"C:\Users\Admin\AppData\Local\Temp\7A21.tmp"121⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"122⤵PID:4152
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-