Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13/06/2024, 06:03
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-13_f984516ec48de085a4e6b2123ca33203_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-06-13_f984516ec48de085a4e6b2123ca33203_mafia.exe
Resource
win10v2004-20240611-en
General
-
Target
2024-06-13_f984516ec48de085a4e6b2123ca33203_mafia.exe
-
Size
527KB
-
MD5
f984516ec48de085a4e6b2123ca33203
-
SHA1
5139de52b2b4aea790dcfe138ddfd242f3913c33
-
SHA256
05f6f5f6abb78296f0fd29134af0bd4f13d0fa32a58a72ac33f9d29fdd17d4dd
-
SHA512
5501bd893448023466dd5215f8f31f4efc0b23a25ebbf9eaebc3685fa18ceb342375dce35eb0bf22b26d1878a99e432eec1719249993840f30a122caa52e9e99
-
SSDEEP
12288:fU5rCOTeidpFs9X5MHrnCnY2j9yokBnDZu:fUQOJd0miRjzgnDo
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 528 39AD.tmp 1128 3A0B.tmp 3100 3A79.tmp 3664 3B15.tmp 412 3B92.tmp 1868 3C1E.tmp 3828 3C7C.tmp 880 3D09.tmp 4904 3D57.tmp 4084 3DA5.tmp 376 3E12.tmp 772 3E61.tmp 4620 3EFD.tmp 4496 3F5B.tmp 4336 3FD8.tmp 3864 4055.tmp 4232 40B2.tmp 3484 4100.tmp 2692 417D.tmp 556 41CC.tmp 2740 4239.tmp 5032 4287.tmp 760 42E5.tmp 916 4362.tmp 5084 43DF.tmp 4956 442D.tmp 684 44BA.tmp 3768 4517.tmp 3212 4565.tmp 1828 45D3.tmp 3084 4640.tmp 968 469E.tmp 2112 472B.tmp 2696 4798.tmp 2520 47F6.tmp 4980 4853.tmp 3928 48B1.tmp 724 490F.tmp 1684 496D.tmp 4568 49CA.tmp 404 4A28.tmp 4664 4A86.tmp 3632 4AE4.tmp 4540 4B41.tmp 4368 4B90.tmp 2184 4BED.tmp 4708 4C3B.tmp 2628 4CA9.tmp 1160 4CF7.tmp 5080 4D45.tmp 3652 4DA3.tmp 1400 4E01.tmp 4056 4E4F.tmp 2584 4E9D.tmp 1348 4EEB.tmp 1584 4F49.tmp 3764 4F97.tmp 4312 4FE5.tmp 1656 5052.tmp 3144 50B0.tmp 3032 510E.tmp 2092 516C.tmp 3668 51D9.tmp 3520 5227.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3400 wrote to memory of 528 3400 2024-06-13_f984516ec48de085a4e6b2123ca33203_mafia.exe 81 PID 3400 wrote to memory of 528 3400 2024-06-13_f984516ec48de085a4e6b2123ca33203_mafia.exe 81 PID 3400 wrote to memory of 528 3400 2024-06-13_f984516ec48de085a4e6b2123ca33203_mafia.exe 81 PID 528 wrote to memory of 1128 528 39AD.tmp 82 PID 528 wrote to memory of 1128 528 39AD.tmp 82 PID 528 wrote to memory of 1128 528 39AD.tmp 82 PID 1128 wrote to memory of 3100 1128 3A0B.tmp 84 PID 1128 wrote to memory of 3100 1128 3A0B.tmp 84 PID 1128 wrote to memory of 3100 1128 3A0B.tmp 84 PID 3100 wrote to memory of 3664 3100 3A79.tmp 86 PID 3100 wrote to memory of 3664 3100 3A79.tmp 86 PID 3100 wrote to memory of 3664 3100 3A79.tmp 86 PID 3664 wrote to memory of 412 3664 3B15.tmp 88 PID 3664 wrote to memory of 412 3664 3B15.tmp 88 PID 3664 wrote to memory of 412 3664 3B15.tmp 88 PID 412 wrote to memory of 1868 412 3B92.tmp 89 PID 412 wrote to memory of 1868 412 3B92.tmp 89 PID 412 wrote to memory of 1868 412 3B92.tmp 89 PID 1868 wrote to memory of 3828 1868 3C1E.tmp 91 PID 1868 wrote to memory of 3828 1868 3C1E.tmp 91 PID 1868 wrote to memory of 3828 1868 3C1E.tmp 91 PID 3828 wrote to memory of 880 3828 3C7C.tmp 92 PID 3828 wrote to memory of 880 3828 3C7C.tmp 92 PID 3828 wrote to memory of 880 3828 3C7C.tmp 92 PID 880 wrote to memory of 4904 880 3D09.tmp 93 PID 880 wrote to memory of 4904 880 3D09.tmp 93 PID 880 wrote to memory of 4904 880 3D09.tmp 93 PID 4904 wrote to memory of 4084 4904 3D57.tmp 94 PID 4904 wrote to memory of 4084 4904 3D57.tmp 94 PID 4904 wrote to memory of 4084 4904 3D57.tmp 94 PID 4084 wrote to memory of 376 4084 3DA5.tmp 95 PID 4084 wrote to memory of 376 4084 3DA5.tmp 95 PID 4084 wrote to memory of 376 4084 3DA5.tmp 95 PID 376 wrote to memory of 772 376 3E12.tmp 96 PID 376 wrote to memory of 772 376 3E12.tmp 96 PID 376 wrote to memory of 772 376 3E12.tmp 96 PID 772 wrote to memory of 4620 772 3E61.tmp 97 PID 772 wrote to memory of 4620 772 3E61.tmp 97 PID 772 wrote to memory of 4620 772 3E61.tmp 97 PID 4620 wrote to memory of 4496 4620 3EFD.tmp 98 PID 4620 wrote to memory of 4496 4620 3EFD.tmp 98 PID 4620 wrote to memory of 4496 4620 3EFD.tmp 98 PID 4496 wrote to memory of 4336 4496 3F5B.tmp 99 PID 4496 wrote to memory of 4336 4496 3F5B.tmp 99 PID 4496 wrote to memory of 4336 4496 3F5B.tmp 99 PID 4336 wrote to memory of 3864 4336 3FD8.tmp 100 PID 4336 wrote to memory of 3864 4336 3FD8.tmp 100 PID 4336 wrote to memory of 3864 4336 3FD8.tmp 100 PID 3864 wrote to memory of 4232 3864 4055.tmp 101 PID 3864 wrote to memory of 4232 3864 4055.tmp 101 PID 3864 wrote to memory of 4232 3864 4055.tmp 101 PID 4232 wrote to memory of 3484 4232 40B2.tmp 102 PID 4232 wrote to memory of 3484 4232 40B2.tmp 102 PID 4232 wrote to memory of 3484 4232 40B2.tmp 102 PID 3484 wrote to memory of 2692 3484 4100.tmp 103 PID 3484 wrote to memory of 2692 3484 4100.tmp 103 PID 3484 wrote to memory of 2692 3484 4100.tmp 103 PID 2692 wrote to memory of 556 2692 417D.tmp 104 PID 2692 wrote to memory of 556 2692 417D.tmp 104 PID 2692 wrote to memory of 556 2692 417D.tmp 104 PID 556 wrote to memory of 2740 556 41CC.tmp 105 PID 556 wrote to memory of 2740 556 41CC.tmp 105 PID 556 wrote to memory of 2740 556 41CC.tmp 105 PID 2740 wrote to memory of 5032 2740 4239.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-13_f984516ec48de085a4e6b2123ca33203_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-13_f984516ec48de085a4e6b2123ca33203_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\39AD.tmp"C:\Users\Admin\AppData\Local\Temp\39AD.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\3A79.tmp"C:\Users\Admin\AppData\Local\Temp\3A79.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\3B15.tmp"C:\Users\Admin\AppData\Local\Temp\3B15.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\3B92.tmp"C:\Users\Admin\AppData\Local\Temp\3B92.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\3D09.tmp"C:\Users\Admin\AppData\Local\Temp\3D09.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\3D57.tmp"C:\Users\Admin\AppData\Local\Temp\3D57.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\3DA5.tmp"C:\Users\Admin\AppData\Local\Temp\3DA5.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\3E12.tmp"C:\Users\Admin\AppData\Local\Temp\3E12.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Users\Admin\AppData\Local\Temp\3E61.tmp"C:\Users\Admin\AppData\Local\Temp\3E61.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\4055.tmp"C:\Users\Admin\AppData\Local\Temp\4055.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\4100.tmp"C:\Users\Admin\AppData\Local\Temp\4100.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\4287.tmp"C:\Users\Admin\AppData\Local\Temp\4287.tmp"23⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"24⤵
- Executes dropped EXE
PID:760 -
C:\Users\Admin\AppData\Local\Temp\4362.tmp"C:\Users\Admin\AppData\Local\Temp\4362.tmp"25⤵
- Executes dropped EXE
PID:916 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"26⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"27⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"28⤵
- Executes dropped EXE
PID:684 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"29⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\4565.tmp"C:\Users\Admin\AppData\Local\Temp\4565.tmp"30⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\45D3.tmp"C:\Users\Admin\AppData\Local\Temp\45D3.tmp"31⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"32⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"33⤵
- Executes dropped EXE
PID:968 -
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"34⤵
- Executes dropped EXE
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"35⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"36⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"37⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\48B1.tmp"C:\Users\Admin\AppData\Local\Temp\48B1.tmp"38⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"39⤵
- Executes dropped EXE
PID:724 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"40⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"41⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"42⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"43⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"44⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"45⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"46⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"47⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"48⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"49⤵
- Executes dropped EXE
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"50⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"51⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"52⤵
- Executes dropped EXE
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"53⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"54⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"55⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"56⤵
- Executes dropped EXE
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"57⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"58⤵
- Executes dropped EXE
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"59⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"60⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"61⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"62⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"63⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"64⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"65⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"66⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"67⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"68⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"69⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"70⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"71⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"72⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"73⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"74⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"75⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"76⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"77⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"78⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"79⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"80⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"81⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"82⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"83⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"84⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"85⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"86⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"87⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"88⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"89⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"90⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"91⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"92⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"93⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"94⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"95⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"96⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"97⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"98⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"99⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"100⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"101⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"102⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"103⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"104⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"105⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"106⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"107⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"108⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"109⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"110⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"111⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"112⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"113⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"114⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"115⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"116⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"117⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"118⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"119⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"120⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"121⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"122⤵PID:804
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-