Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
05/06/2024, 17:57
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-05_5e3a2db5e851bd9ad6f7771c70b36f99_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-05_5e3a2db5e851bd9ad6f7771c70b36f99_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-05_5e3a2db5e851bd9ad6f7771c70b36f99_mafia.exe
-
Size
487KB
-
MD5
5e3a2db5e851bd9ad6f7771c70b36f99
-
SHA1
b603860bca317a1ab8333d90294ec9d9d0f5a021
-
SHA256
da2e5c1642a394a220fdce940891686985d5d2ebeb38a7fbf53d82cababc7aab
-
SHA512
eb46ec477712cdfb36c5f0c5c847f31951ddb4794e5403b52c2004472d1fa7d12a8e267f8429ef89152c2a3b938bc8d1f3813bbaf6fb81b9eb26b31ab3ead822
-
SSDEEP
6144:qorf3lPvovsgZnqG2C7mOTeiL9DUJfWPn9cjL5dVKC6vsvosGS5LsXrb115U9hJk:HU5rCOTeiJAePn27VKtvstD+n1kdiNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3092 4D35.tmp 2012 4DB2.tmp 2140 4E3F.tmp 112 4EDB.tmp 1080 4F49.tmp 5048 4F97.tmp 4368 5004.tmp 4404 5081.tmp 3740 50CF.tmp 3524 514C.tmp 544 51D9.tmp 4356 5246.tmp 3800 52A4.tmp 4864 5302.tmp 4976 536F.tmp 3548 53DD.tmp 2680 543A.tmp 1484 54A8.tmp 5032 54F6.tmp 2740 5573.tmp 3152 55D1.tmp 1036 562E.tmp 3528 56BB.tmp 3280 5728.tmp 4472 5796.tmp 2448 5813.tmp 2172 5870.tmp 4040 58ED.tmp 368 595B.tmp 696 59D8.tmp 3212 5A55.tmp 3320 5AA3.tmp 3888 5B01.tmp 3508 5B4F.tmp 2800 5BAD.tmp 2300 5BFB.tmp 3060 5C49.tmp 2384 5C97.tmp 2136 5CE5.tmp 2948 5D43.tmp 4124 5DA1.tmp 2452 5DEF.tmp 4476 5E4C.tmp 1756 5EAA.tmp 3692 5EF8.tmp 2844 5F56.tmp 4796 5FB4.tmp 1976 6012.tmp 4880 6060.tmp 2020 60AE.tmp 1236 60FC.tmp 5108 615A.tmp 4340 61B7.tmp 4380 6215.tmp 4648 6273.tmp 4656 62C1.tmp 5012 631F.tmp 4308 637D.tmp 1112 63CB.tmp 620 6419.tmp 2140 6477.tmp 1776 64D4.tmp 4272 6522.tmp 1908 6580.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1808 wrote to memory of 3092 1808 2024-06-05_5e3a2db5e851bd9ad6f7771c70b36f99_mafia.exe 82 PID 1808 wrote to memory of 3092 1808 2024-06-05_5e3a2db5e851bd9ad6f7771c70b36f99_mafia.exe 82 PID 1808 wrote to memory of 3092 1808 2024-06-05_5e3a2db5e851bd9ad6f7771c70b36f99_mafia.exe 82 PID 3092 wrote to memory of 2012 3092 4D35.tmp 83 PID 3092 wrote to memory of 2012 3092 4D35.tmp 83 PID 3092 wrote to memory of 2012 3092 4D35.tmp 83 PID 2012 wrote to memory of 2140 2012 4DB2.tmp 84 PID 2012 wrote to memory of 2140 2012 4DB2.tmp 84 PID 2012 wrote to memory of 2140 2012 4DB2.tmp 84 PID 2140 wrote to memory of 112 2140 4E3F.tmp 85 PID 2140 wrote to memory of 112 2140 4E3F.tmp 85 PID 2140 wrote to memory of 112 2140 4E3F.tmp 85 PID 112 wrote to memory of 1080 112 4EDB.tmp 86 PID 112 wrote to memory of 1080 112 4EDB.tmp 86 PID 112 wrote to memory of 1080 112 4EDB.tmp 86 PID 1080 wrote to memory of 5048 1080 4F49.tmp 87 PID 1080 wrote to memory of 5048 1080 4F49.tmp 87 PID 1080 wrote to memory of 5048 1080 4F49.tmp 87 PID 5048 wrote to memory of 4368 5048 4F97.tmp 88 PID 5048 wrote to memory of 4368 5048 4F97.tmp 88 PID 5048 wrote to memory of 4368 5048 4F97.tmp 88 PID 4368 wrote to memory of 4404 4368 5004.tmp 89 PID 4368 wrote to memory of 4404 4368 5004.tmp 89 PID 4368 wrote to memory of 4404 4368 5004.tmp 89 PID 4404 wrote to memory of 3740 4404 5081.tmp 90 PID 4404 wrote to memory of 3740 4404 5081.tmp 90 PID 4404 wrote to memory of 3740 4404 5081.tmp 90 PID 3740 wrote to memory of 3524 3740 50CF.tmp 91 PID 3740 wrote to memory of 3524 3740 50CF.tmp 91 PID 3740 wrote to memory of 3524 3740 50CF.tmp 91 PID 3524 wrote to memory of 544 3524 514C.tmp 92 PID 3524 wrote to memory of 544 3524 514C.tmp 92 PID 3524 wrote to memory of 544 3524 514C.tmp 92 PID 544 wrote to memory of 4356 544 51D9.tmp 93 PID 544 wrote to memory of 4356 544 51D9.tmp 93 PID 544 wrote to memory of 4356 544 51D9.tmp 93 PID 4356 wrote to memory of 3800 4356 5246.tmp 94 PID 4356 wrote to memory of 3800 4356 5246.tmp 94 PID 4356 wrote to memory of 3800 4356 5246.tmp 94 PID 3800 wrote to memory of 4864 3800 52A4.tmp 95 PID 3800 wrote to memory of 4864 3800 52A4.tmp 95 PID 3800 wrote to memory of 4864 3800 52A4.tmp 95 PID 4864 wrote to memory of 4976 4864 5302.tmp 96 PID 4864 wrote to memory of 4976 4864 5302.tmp 96 PID 4864 wrote to memory of 4976 4864 5302.tmp 96 PID 4976 wrote to memory of 3548 4976 536F.tmp 97 PID 4976 wrote to memory of 3548 4976 536F.tmp 97 PID 4976 wrote to memory of 3548 4976 536F.tmp 97 PID 3548 wrote to memory of 2680 3548 53DD.tmp 98 PID 3548 wrote to memory of 2680 3548 53DD.tmp 98 PID 3548 wrote to memory of 2680 3548 53DD.tmp 98 PID 2680 wrote to memory of 1484 2680 543A.tmp 99 PID 2680 wrote to memory of 1484 2680 543A.tmp 99 PID 2680 wrote to memory of 1484 2680 543A.tmp 99 PID 1484 wrote to memory of 5032 1484 54A8.tmp 100 PID 1484 wrote to memory of 5032 1484 54A8.tmp 100 PID 1484 wrote to memory of 5032 1484 54A8.tmp 100 PID 5032 wrote to memory of 2740 5032 54F6.tmp 101 PID 5032 wrote to memory of 2740 5032 54F6.tmp 101 PID 5032 wrote to memory of 2740 5032 54F6.tmp 101 PID 2740 wrote to memory of 3152 2740 5573.tmp 102 PID 2740 wrote to memory of 3152 2740 5573.tmp 102 PID 2740 wrote to memory of 3152 2740 5573.tmp 102 PID 3152 wrote to memory of 1036 3152 55D1.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-05_5e3a2db5e851bd9ad6f7771c70b36f99_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-05_5e3a2db5e851bd9ad6f7771c70b36f99_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"23⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"24⤵
- Executes dropped EXE
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"25⤵
- Executes dropped EXE
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"26⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"27⤵
- Executes dropped EXE
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"28⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"29⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"30⤵
- Executes dropped EXE
PID:368 -
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"31⤵
- Executes dropped EXE
PID:696 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"32⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"33⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"34⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"35⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"36⤵
- Executes dropped EXE
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"37⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"38⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"39⤵
- Executes dropped EXE
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"40⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"41⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"42⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"43⤵
- Executes dropped EXE
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"44⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"45⤵
- Executes dropped EXE
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"46⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"47⤵
- Executes dropped EXE
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"48⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"49⤵
- Executes dropped EXE
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"50⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"51⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"52⤵
- Executes dropped EXE
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"53⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"54⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"55⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"56⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"57⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"58⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"59⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"60⤵
- Executes dropped EXE
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"61⤵
- Executes dropped EXE
PID:620 -
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"62⤵
- Executes dropped EXE
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"63⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"64⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"65⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"66⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"67⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"68⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"69⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"70⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"71⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"72⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"73⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"74⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"75⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"76⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"77⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"78⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"79⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"80⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"81⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"82⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"83⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"84⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"85⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"86⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"87⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"88⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"89⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"90⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"91⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"92⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"93⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"94⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"95⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"96⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"97⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\70DA.tmp"C:\Users\Admin\AppData\Local\Temp\70DA.tmp"98⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"99⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"100⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"101⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"102⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\72A0.tmp"C:\Users\Admin\AppData\Local\Temp\72A0.tmp"103⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\72EE.tmp"C:\Users\Admin\AppData\Local\Temp\72EE.tmp"104⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"105⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"106⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\73E8.tmp"C:\Users\Admin\AppData\Local\Temp\73E8.tmp"107⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\7445.tmp"C:\Users\Admin\AppData\Local\Temp\7445.tmp"108⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"109⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\74F1.tmp"C:\Users\Admin\AppData\Local\Temp\74F1.tmp"110⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"111⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"112⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"113⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"114⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"115⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"116⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\7724.tmp"C:\Users\Admin\AppData\Local\Temp\7724.tmp"117⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"118⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"119⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"120⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\786C.tmp"C:\Users\Admin\AppData\Local\Temp\786C.tmp"121⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\78BA.tmp"C:\Users\Admin\AppData\Local\Temp\78BA.tmp"122⤵PID:3052
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-