Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/06/2024, 01:53
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-11_2ffbc20f800f1c8c5f8cea92aeb9fe03_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-11_2ffbc20f800f1c8c5f8cea92aeb9fe03_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-11_2ffbc20f800f1c8c5f8cea92aeb9fe03_mafia.exe
-
Size
529KB
-
MD5
2ffbc20f800f1c8c5f8cea92aeb9fe03
-
SHA1
d8a519b8740f28b49b655a96ce8aa0518626e2df
-
SHA256
7fd4b80f69600293e8ca876c48d547eda5c81a1abc73018b58b44a550bc5f914
-
SHA512
c7e740e1c0a76b704e5c7e8eb4e9183dce4424ff67a28606820203696a5e2a169e28dfe6e7922df80bb119a2f102b833697a8e87d6e570d5c94ef41ba7a4aac6
-
SSDEEP
12288:NU5rCOTeij6PrvcQ2u1DHXiOErnvWuTZwlH4Hp:NUQOJjyvcQ2sbSDrVTSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3644 468E.tmp 1692 46FC.tmp 4560 4769.tmp 1636 47F6.tmp 1400 4873.tmp 3144 48C1.tmp 2932 494D.tmp 1412 49AB.tmp 2852 4A38.tmp 1360 4AA5.tmp 2484 4AF3.tmp 1728 4B61.tmp 1892 4BDE.tmp 4912 4C2C.tmp 3920 4C8A.tmp 5104 4CF7.tmp 4396 4D55.tmp 3744 4DD2.tmp 3420 4E4F.tmp 2100 4EDB.tmp 3160 4F49.tmp 1040 4FA6.tmp 1212 4FF5.tmp 860 5062.tmp 432 50DF.tmp 3572 515C.tmp 4756 51D9.tmp 4804 5246.tmp 4148 52D3.tmp 3380 5331.tmp 2468 539E.tmp 5108 541B.tmp 2180 5479.tmp 636 54C7.tmp 4696 5525.tmp 4016 5592.tmp 4108 55F0.tmp 2004 563E.tmp 4072 568C.tmp 1876 56DA.tmp 1180 5728.tmp 2752 5786.tmp 3732 57E4.tmp 464 5842.tmp 880 5890.tmp 1036 58ED.tmp 916 593C.tmp 4328 598A.tmp 1008 59E7.tmp 4260 5A36.tmp 1084 5A93.tmp 4740 5AF1.tmp 1196 5B8D.tmp 940 5BEB.tmp 2988 5C39.tmp 3028 5C97.tmp 760 5CE5.tmp 3436 5D33.tmp 4332 5D91.tmp 4784 5DEF.tmp 4364 5E3D.tmp 1092 5E8B.tmp 4484 5EE9.tmp 1536 5F46.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2156 wrote to memory of 3644 2156 2024-06-11_2ffbc20f800f1c8c5f8cea92aeb9fe03_mafia.exe 81 PID 2156 wrote to memory of 3644 2156 2024-06-11_2ffbc20f800f1c8c5f8cea92aeb9fe03_mafia.exe 81 PID 2156 wrote to memory of 3644 2156 2024-06-11_2ffbc20f800f1c8c5f8cea92aeb9fe03_mafia.exe 81 PID 3644 wrote to memory of 1692 3644 468E.tmp 83 PID 3644 wrote to memory of 1692 3644 468E.tmp 83 PID 3644 wrote to memory of 1692 3644 468E.tmp 83 PID 1692 wrote to memory of 4560 1692 46FC.tmp 84 PID 1692 wrote to memory of 4560 1692 46FC.tmp 84 PID 1692 wrote to memory of 4560 1692 46FC.tmp 84 PID 4560 wrote to memory of 1636 4560 4769.tmp 86 PID 4560 wrote to memory of 1636 4560 4769.tmp 86 PID 4560 wrote to memory of 1636 4560 4769.tmp 86 PID 1636 wrote to memory of 1400 1636 47F6.tmp 88 PID 1636 wrote to memory of 1400 1636 47F6.tmp 88 PID 1636 wrote to memory of 1400 1636 47F6.tmp 88 PID 1400 wrote to memory of 3144 1400 4873.tmp 89 PID 1400 wrote to memory of 3144 1400 4873.tmp 89 PID 1400 wrote to memory of 3144 1400 4873.tmp 89 PID 3144 wrote to memory of 2932 3144 48C1.tmp 90 PID 3144 wrote to memory of 2932 3144 48C1.tmp 90 PID 3144 wrote to memory of 2932 3144 48C1.tmp 90 PID 2932 wrote to memory of 1412 2932 494D.tmp 91 PID 2932 wrote to memory of 1412 2932 494D.tmp 91 PID 2932 wrote to memory of 1412 2932 494D.tmp 91 PID 1412 wrote to memory of 2852 1412 49AB.tmp 92 PID 1412 wrote to memory of 2852 1412 49AB.tmp 92 PID 1412 wrote to memory of 2852 1412 49AB.tmp 92 PID 2852 wrote to memory of 1360 2852 4A38.tmp 93 PID 2852 wrote to memory of 1360 2852 4A38.tmp 93 PID 2852 wrote to memory of 1360 2852 4A38.tmp 93 PID 1360 wrote to memory of 2484 1360 4AA5.tmp 94 PID 1360 wrote to memory of 2484 1360 4AA5.tmp 94 PID 1360 wrote to memory of 2484 1360 4AA5.tmp 94 PID 2484 wrote to memory of 1728 2484 4AF3.tmp 95 PID 2484 wrote to memory of 1728 2484 4AF3.tmp 95 PID 2484 wrote to memory of 1728 2484 4AF3.tmp 95 PID 1728 wrote to memory of 1892 1728 4B61.tmp 96 PID 1728 wrote to memory of 1892 1728 4B61.tmp 96 PID 1728 wrote to memory of 1892 1728 4B61.tmp 96 PID 1892 wrote to memory of 4912 1892 4BDE.tmp 97 PID 1892 wrote to memory of 4912 1892 4BDE.tmp 97 PID 1892 wrote to memory of 4912 1892 4BDE.tmp 97 PID 4912 wrote to memory of 3920 4912 4C2C.tmp 98 PID 4912 wrote to memory of 3920 4912 4C2C.tmp 98 PID 4912 wrote to memory of 3920 4912 4C2C.tmp 98 PID 3920 wrote to memory of 5104 3920 4C8A.tmp 99 PID 3920 wrote to memory of 5104 3920 4C8A.tmp 99 PID 3920 wrote to memory of 5104 3920 4C8A.tmp 99 PID 5104 wrote to memory of 4396 5104 4CF7.tmp 100 PID 5104 wrote to memory of 4396 5104 4CF7.tmp 100 PID 5104 wrote to memory of 4396 5104 4CF7.tmp 100 PID 4396 wrote to memory of 3744 4396 4D55.tmp 101 PID 4396 wrote to memory of 3744 4396 4D55.tmp 101 PID 4396 wrote to memory of 3744 4396 4D55.tmp 101 PID 3744 wrote to memory of 3420 3744 4DD2.tmp 102 PID 3744 wrote to memory of 3420 3744 4DD2.tmp 102 PID 3744 wrote to memory of 3420 3744 4DD2.tmp 102 PID 3420 wrote to memory of 2100 3420 4E4F.tmp 103 PID 3420 wrote to memory of 2100 3420 4E4F.tmp 103 PID 3420 wrote to memory of 2100 3420 4E4F.tmp 103 PID 2100 wrote to memory of 3160 2100 4EDB.tmp 105 PID 2100 wrote to memory of 3160 2100 4EDB.tmp 105 PID 2100 wrote to memory of 3160 2100 4EDB.tmp 105 PID 3160 wrote to memory of 1040 3160 4F49.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_2ffbc20f800f1c8c5f8cea92aeb9fe03_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_2ffbc20f800f1c8c5f8cea92aeb9fe03_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"23⤵
- Executes dropped EXE
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"24⤵
- Executes dropped EXE
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"25⤵
- Executes dropped EXE
PID:860 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"26⤵
- Executes dropped EXE
PID:432 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"27⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"28⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"29⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"30⤵
- Executes dropped EXE
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"31⤵
- Executes dropped EXE
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"32⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"33⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"34⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"35⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"36⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"37⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"38⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"39⤵
- Executes dropped EXE
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"40⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"41⤵
- Executes dropped EXE
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"42⤵
- Executes dropped EXE
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"43⤵
- Executes dropped EXE
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"44⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"45⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"46⤵
- Executes dropped EXE
PID:880 -
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"47⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"48⤵
- Executes dropped EXE
PID:916 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"49⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"50⤵
- Executes dropped EXE
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"51⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"52⤵
- Executes dropped EXE
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"53⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"54⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"55⤵
- Executes dropped EXE
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"56⤵
- Executes dropped EXE
PID:940 -
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"57⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"58⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"59⤵
- Executes dropped EXE
PID:760 -
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"60⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"61⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"62⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"63⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"64⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"65⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"66⤵
- Executes dropped EXE
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"67⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"68⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"69⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"70⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"71⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"72⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"73⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"74⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"75⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"76⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"77⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"78⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"79⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"80⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"81⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"82⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"83⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"84⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"85⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"86⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"87⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"88⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"89⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"90⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"91⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"92⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"93⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"94⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"95⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"96⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"97⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"98⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"99⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"100⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"101⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"102⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"103⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"104⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"105⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"106⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"107⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"108⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"109⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"110⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"111⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"112⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"113⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"114⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"115⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"116⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"117⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"118⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"119⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"120⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"121⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\7177.tmp"C:\Users\Admin\AppData\Local\Temp\7177.tmp"122⤵PID:3212
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-