Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 12:24
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-27_22de33a51e8326ba75668f35e8e2442c_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-27_22de33a51e8326ba75668f35e8e2442c_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-27_22de33a51e8326ba75668f35e8e2442c_mafia.exe
-
Size
541KB
-
MD5
22de33a51e8326ba75668f35e8e2442c
-
SHA1
f577c1d36dbd6840d49012c6d9fa8ae9f6228a37
-
SHA256
c3c1a40b3254bb8cf733a1d922c0c1cca0daf6176c8953db07eb48d90bad9bf7
-
SHA512
bf98001dcabf8d7fc2c62caa6fc68286d19f2c3ede528a8ad18c6887c45d5bd0104bdb0a990b04502e43cda306fdbd35d6d9e45aa19aea5aa7f5e62277917fb4
-
SSDEEP
12288:UU5rCOTeifJrQud79d+5qxF4GdIZKrZa73ctO:UUQOJfV1p9dvGKrU73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1112 48E0.tmp 4144 496D.tmp 5064 4A09.tmp 3448 4AA5.tmp 1044 4B13.tmp 3272 4B80.tmp 3140 4BED.tmp 4556 4C4B.tmp 2532 4CB8.tmp 5048 4D26.tmp 5060 4D74.tmp 1040 4DE1.tmp 2408 4E6E.tmp 1892 4EDB.tmp 3988 4F39.tmp 2280 4F97.tmp 2924 5014.tmp 1036 5091.tmp 4052 50FE.tmp 5092 514C.tmp 2148 51C9.tmp 3444 5237.tmp 4580 52A4.tmp 560 5302.tmp 4616 5360.tmp 1212 53DD.tmp 5096 543A.tmp 2220 5488.tmp 3536 54E6.tmp 4708 5544.tmp 3552 55A2.tmp 1612 560F.tmp 1784 565D.tmp 1676 56BB.tmp 2944 5709.tmp 684 5757.tmp 4704 57C5.tmp 3724 5822.tmp 220 5870.tmp 2440 58BF.tmp 1344 590D.tmp 1832 595B.tmp 4916 59A9.tmp 1820 59F7.tmp 1592 5A55.tmp 1848 5AB3.tmp 3692 5B01.tmp 4524 5B5E.tmp 2208 5BBC.tmp 3756 5C0A.tmp 4912 5C68.tmp 3388 5CB6.tmp 4512 5D04.tmp 1360 5D52.tmp 2352 5DB0.tmp 1112 5E0E.tmp 3208 5E6C.tmp 2420 5EBA.tmp 1072 5F18.tmp 4892 5F66.tmp 2640 5FC3.tmp 4420 6012.tmp 1044 606F.tmp 2512 60BD.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2352 wrote to memory of 1112 2352 2024-05-27_22de33a51e8326ba75668f35e8e2442c_mafia.exe 82 PID 2352 wrote to memory of 1112 2352 2024-05-27_22de33a51e8326ba75668f35e8e2442c_mafia.exe 82 PID 2352 wrote to memory of 1112 2352 2024-05-27_22de33a51e8326ba75668f35e8e2442c_mafia.exe 82 PID 1112 wrote to memory of 4144 1112 48E0.tmp 83 PID 1112 wrote to memory of 4144 1112 48E0.tmp 83 PID 1112 wrote to memory of 4144 1112 48E0.tmp 83 PID 4144 wrote to memory of 5064 4144 496D.tmp 84 PID 4144 wrote to memory of 5064 4144 496D.tmp 84 PID 4144 wrote to memory of 5064 4144 496D.tmp 84 PID 5064 wrote to memory of 3448 5064 4A09.tmp 85 PID 5064 wrote to memory of 3448 5064 4A09.tmp 85 PID 5064 wrote to memory of 3448 5064 4A09.tmp 85 PID 3448 wrote to memory of 1044 3448 4AA5.tmp 86 PID 3448 wrote to memory of 1044 3448 4AA5.tmp 86 PID 3448 wrote to memory of 1044 3448 4AA5.tmp 86 PID 1044 wrote to memory of 3272 1044 4B13.tmp 87 PID 1044 wrote to memory of 3272 1044 4B13.tmp 87 PID 1044 wrote to memory of 3272 1044 4B13.tmp 87 PID 3272 wrote to memory of 3140 3272 4B80.tmp 88 PID 3272 wrote to memory of 3140 3272 4B80.tmp 88 PID 3272 wrote to memory of 3140 3272 4B80.tmp 88 PID 3140 wrote to memory of 4556 3140 4BED.tmp 89 PID 3140 wrote to memory of 4556 3140 4BED.tmp 89 PID 3140 wrote to memory of 4556 3140 4BED.tmp 89 PID 4556 wrote to memory of 2532 4556 4C4B.tmp 90 PID 4556 wrote to memory of 2532 4556 4C4B.tmp 90 PID 4556 wrote to memory of 2532 4556 4C4B.tmp 90 PID 2532 wrote to memory of 5048 2532 4CB8.tmp 91 PID 2532 wrote to memory of 5048 2532 4CB8.tmp 91 PID 2532 wrote to memory of 5048 2532 4CB8.tmp 91 PID 5048 wrote to memory of 5060 5048 4D26.tmp 92 PID 5048 wrote to memory of 5060 5048 4D26.tmp 92 PID 5048 wrote to memory of 5060 5048 4D26.tmp 92 PID 5060 wrote to memory of 1040 5060 4D74.tmp 93 PID 5060 wrote to memory of 1040 5060 4D74.tmp 93 PID 5060 wrote to memory of 1040 5060 4D74.tmp 93 PID 1040 wrote to memory of 2408 1040 4DE1.tmp 94 PID 1040 wrote to memory of 2408 1040 4DE1.tmp 94 PID 1040 wrote to memory of 2408 1040 4DE1.tmp 94 PID 2408 wrote to memory of 1892 2408 4E6E.tmp 95 PID 2408 wrote to memory of 1892 2408 4E6E.tmp 95 PID 2408 wrote to memory of 1892 2408 4E6E.tmp 95 PID 1892 wrote to memory of 3988 1892 4EDB.tmp 96 PID 1892 wrote to memory of 3988 1892 4EDB.tmp 96 PID 1892 wrote to memory of 3988 1892 4EDB.tmp 96 PID 3988 wrote to memory of 2280 3988 4F39.tmp 97 PID 3988 wrote to memory of 2280 3988 4F39.tmp 97 PID 3988 wrote to memory of 2280 3988 4F39.tmp 97 PID 2280 wrote to memory of 2924 2280 4F97.tmp 98 PID 2280 wrote to memory of 2924 2280 4F97.tmp 98 PID 2280 wrote to memory of 2924 2280 4F97.tmp 98 PID 2924 wrote to memory of 1036 2924 5014.tmp 99 PID 2924 wrote to memory of 1036 2924 5014.tmp 99 PID 2924 wrote to memory of 1036 2924 5014.tmp 99 PID 1036 wrote to memory of 4052 1036 5091.tmp 100 PID 1036 wrote to memory of 4052 1036 5091.tmp 100 PID 1036 wrote to memory of 4052 1036 5091.tmp 100 PID 4052 wrote to memory of 5092 4052 50FE.tmp 101 PID 4052 wrote to memory of 5092 4052 50FE.tmp 101 PID 4052 wrote to memory of 5092 4052 50FE.tmp 101 PID 5092 wrote to memory of 2148 5092 514C.tmp 102 PID 5092 wrote to memory of 2148 5092 514C.tmp 102 PID 5092 wrote to memory of 2148 5092 514C.tmp 102 PID 2148 wrote to memory of 3444 2148 51C9.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_22de33a51e8326ba75668f35e8e2442c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_22de33a51e8326ba75668f35e8e2442c_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"23⤵
- Executes dropped EXE
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"24⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"25⤵
- Executes dropped EXE
PID:560 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"26⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"27⤵
- Executes dropped EXE
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"28⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"29⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"30⤵
- Executes dropped EXE
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"31⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"32⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"33⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"34⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"35⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"36⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"37⤵
- Executes dropped EXE
PID:684 -
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"38⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"39⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"40⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"41⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"42⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"43⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"44⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"45⤵
- Executes dropped EXE
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"46⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"47⤵
- Executes dropped EXE
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"48⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"49⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"50⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"51⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"52⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"53⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"54⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"55⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"56⤵
- Executes dropped EXE
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"57⤵
- Executes dropped EXE
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"58⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"59⤵
- Executes dropped EXE
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"60⤵
- Executes dropped EXE
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"61⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"62⤵
- Executes dropped EXE
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"63⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"64⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"65⤵
- Executes dropped EXE
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"66⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"67⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"68⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"69⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"70⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"71⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"72⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"73⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"74⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"75⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"76⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"77⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"78⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"79⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"80⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"81⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"82⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"83⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"84⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"85⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"86⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"87⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"88⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"89⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"90⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"91⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"92⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"93⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"94⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"95⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"96⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"97⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"98⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"99⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"100⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"101⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"102⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"103⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"104⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"105⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"106⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"107⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"108⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"109⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"110⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"111⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"112⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\7148.tmp"C:\Users\Admin\AppData\Local\Temp\7148.tmp"113⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"114⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"115⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"116⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"117⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"118⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"119⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"120⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"121⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"122⤵PID:4200
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-