Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
20/06/2024, 01:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-20_2c21d0cc8d219861ccb235a58e8a212a_mafia.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2024-06-20_2c21d0cc8d219861ccb235a58e8a212a_mafia.exe
Resource
win10v2004-20240611-en
General
-
Target
2024-06-20_2c21d0cc8d219861ccb235a58e8a212a_mafia.exe
-
Size
529KB
-
MD5
2c21d0cc8d219861ccb235a58e8a212a
-
SHA1
fba80ada8f385b628ca446287f6f75e02724a28f
-
SHA256
bae9a8c9aef67adf775c09cb500971dd2e9fd545fc4c63c3ae7b77a6d174d3f5
-
SHA512
d242d37feac66b2c6374335c73d5531e1785b65c0d2bcae37f937020f70a5ce76f233e993d7cff253c8053901d9b430ab1b438db563300920091ce263d6381f0
-
SSDEEP
12288:NU5rCOTeijbvsAJUG1nb4MVXk2TZwlH4Hp:NUQOJjbvsu1blVU2TSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2940 FEA3.tmp 2012 FF40.tmp 3664 FFAD.tmp 2692 1A.tmp 2652 88.tmp 1688 F5.tmp 2568 153.tmp 1056 1B1.tmp 1604 23D.tmp 2040 29B.tmp 2284 4DD.tmp 1588 52B.tmp 1960 5C7.tmp 952 625.tmp 1392 693.tmp 1468 700.tmp 1560 74E.tmp 4140 7AC.tmp 2800 80A.tmp 1048 858.tmp 2828 8A6.tmp 4112 8F4.tmp 3800 952.tmp 3388 9A0.tmp 704 9FE.tmp 3332 A4C.tmp 4588 AB9.tmp 1524 B36.tmp 4760 B94.tmp 2644 C11.tmp 1412 C6F.tmp 4488 CBD.tmp 2892 D0B.tmp 4764 D69.tmp 4564 DC6.tmp 3012 E14.tmp 2572 E63.tmp 2692 EC0.tmp 640 F1E.tmp 3692 F6C.tmp 4168 FBA.tmp 1688 1018.tmp 816 1076.tmp 4592 10D4.tmp 1100 1131.tmp 4288 118F.tmp 228 11DD.tmp 4020 122B.tmp 848 1279.tmp 1768 12C8.tmp 1560 1316.tmp 3868 1373.tmp 2912 13C2.tmp 1348 141F.tmp 4956 146D.tmp 396 14BC.tmp 2788 150A.tmp 1148 1567.tmp 2452 15C5.tmp 4948 1613.tmp 1680 1661.tmp 1484 16FE.tmp 1488 174C.tmp 2660 17AA.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 212 wrote to memory of 2940 212 2024-06-20_2c21d0cc8d219861ccb235a58e8a212a_mafia.exe 88 PID 212 wrote to memory of 2940 212 2024-06-20_2c21d0cc8d219861ccb235a58e8a212a_mafia.exe 88 PID 212 wrote to memory of 2940 212 2024-06-20_2c21d0cc8d219861ccb235a58e8a212a_mafia.exe 88 PID 2940 wrote to memory of 2012 2940 FEA3.tmp 89 PID 2940 wrote to memory of 2012 2940 FEA3.tmp 89 PID 2940 wrote to memory of 2012 2940 FEA3.tmp 89 PID 2012 wrote to memory of 3664 2012 FF40.tmp 90 PID 2012 wrote to memory of 3664 2012 FF40.tmp 90 PID 2012 wrote to memory of 3664 2012 FF40.tmp 90 PID 3664 wrote to memory of 2692 3664 FFAD.tmp 91 PID 3664 wrote to memory of 2692 3664 FFAD.tmp 91 PID 3664 wrote to memory of 2692 3664 FFAD.tmp 91 PID 2692 wrote to memory of 2652 2692 1A.tmp 92 PID 2692 wrote to memory of 2652 2692 1A.tmp 92 PID 2692 wrote to memory of 2652 2692 1A.tmp 92 PID 2652 wrote to memory of 1688 2652 88.tmp 93 PID 2652 wrote to memory of 1688 2652 88.tmp 93 PID 2652 wrote to memory of 1688 2652 88.tmp 93 PID 1688 wrote to memory of 2568 1688 F5.tmp 94 PID 1688 wrote to memory of 2568 1688 F5.tmp 94 PID 1688 wrote to memory of 2568 1688 F5.tmp 94 PID 2568 wrote to memory of 1056 2568 153.tmp 95 PID 2568 wrote to memory of 1056 2568 153.tmp 95 PID 2568 wrote to memory of 1056 2568 153.tmp 95 PID 1056 wrote to memory of 1604 1056 1B1.tmp 96 PID 1056 wrote to memory of 1604 1056 1B1.tmp 96 PID 1056 wrote to memory of 1604 1056 1B1.tmp 96 PID 1604 wrote to memory of 2040 1604 23D.tmp 98 PID 1604 wrote to memory of 2040 1604 23D.tmp 98 PID 1604 wrote to memory of 2040 1604 23D.tmp 98 PID 2040 wrote to memory of 2284 2040 29B.tmp 99 PID 2040 wrote to memory of 2284 2040 29B.tmp 99 PID 2040 wrote to memory of 2284 2040 29B.tmp 99 PID 2284 wrote to memory of 1588 2284 4DD.tmp 101 PID 2284 wrote to memory of 1588 2284 4DD.tmp 101 PID 2284 wrote to memory of 1588 2284 4DD.tmp 101 PID 1588 wrote to memory of 1960 1588 52B.tmp 102 PID 1588 wrote to memory of 1960 1588 52B.tmp 102 PID 1588 wrote to memory of 1960 1588 52B.tmp 102 PID 1960 wrote to memory of 952 1960 5C7.tmp 103 PID 1960 wrote to memory of 952 1960 5C7.tmp 103 PID 1960 wrote to memory of 952 1960 5C7.tmp 103 PID 952 wrote to memory of 1392 952 625.tmp 104 PID 952 wrote to memory of 1392 952 625.tmp 104 PID 952 wrote to memory of 1392 952 625.tmp 104 PID 1392 wrote to memory of 1468 1392 693.tmp 105 PID 1392 wrote to memory of 1468 1392 693.tmp 105 PID 1392 wrote to memory of 1468 1392 693.tmp 105 PID 1468 wrote to memory of 1560 1468 700.tmp 106 PID 1468 wrote to memory of 1560 1468 700.tmp 106 PID 1468 wrote to memory of 1560 1468 700.tmp 106 PID 1560 wrote to memory of 4140 1560 74E.tmp 107 PID 1560 wrote to memory of 4140 1560 74E.tmp 107 PID 1560 wrote to memory of 4140 1560 74E.tmp 107 PID 4140 wrote to memory of 2800 4140 7AC.tmp 108 PID 4140 wrote to memory of 2800 4140 7AC.tmp 108 PID 4140 wrote to memory of 2800 4140 7AC.tmp 108 PID 2800 wrote to memory of 1048 2800 80A.tmp 109 PID 2800 wrote to memory of 1048 2800 80A.tmp 109 PID 2800 wrote to memory of 1048 2800 80A.tmp 109 PID 1048 wrote to memory of 2828 1048 858.tmp 110 PID 1048 wrote to memory of 2828 1048 858.tmp 110 PID 1048 wrote to memory of 2828 1048 858.tmp 110 PID 2828 wrote to memory of 4112 2828 8A6.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-20_2c21d0cc8d219861ccb235a58e8a212a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-20_2c21d0cc8d219861ccb235a58e8a212a_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\FF40.tmp"C:\Users\Admin\AppData\Local\Temp\FF40.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\1A.tmp"C:\Users\Admin\AppData\Local\Temp\1A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\88.tmp"C:\Users\Admin\AppData\Local\Temp\88.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\F5.tmp"C:\Users\Admin\AppData\Local\Temp\F5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\153.tmp"C:\Users\Admin\AppData\Local\Temp\153.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\1B1.tmp"C:\Users\Admin\AppData\Local\Temp\1B1.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\23D.tmp"C:\Users\Admin\AppData\Local\Temp\23D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\29B.tmp"C:\Users\Admin\AppData\Local\Temp\29B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\4DD.tmp"C:\Users\Admin\AppData\Local\Temp\4DD.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\52B.tmp"C:\Users\Admin\AppData\Local\Temp\52B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\5C7.tmp"C:\Users\Admin\AppData\Local\Temp\5C7.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\625.tmp"C:\Users\Admin\AppData\Local\Temp\625.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Temp\693.tmp"C:\Users\Admin\AppData\Local\Temp\693.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\700.tmp"C:\Users\Admin\AppData\Local\Temp\700.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\74E.tmp"C:\Users\Admin\AppData\Local\Temp\74E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\7AC.tmp"C:\Users\Admin\AppData\Local\Temp\7AC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\80A.tmp"C:\Users\Admin\AppData\Local\Temp\80A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\858.tmp"C:\Users\Admin\AppData\Local\Temp\858.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\8A6.tmp"C:\Users\Admin\AppData\Local\Temp\8A6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\8F4.tmp"C:\Users\Admin\AppData\Local\Temp\8F4.tmp"23⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\952.tmp"C:\Users\Admin\AppData\Local\Temp\952.tmp"24⤵
- Executes dropped EXE
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\9A0.tmp"C:\Users\Admin\AppData\Local\Temp\9A0.tmp"25⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\9FE.tmp"C:\Users\Admin\AppData\Local\Temp\9FE.tmp"26⤵
- Executes dropped EXE
PID:704 -
C:\Users\Admin\AppData\Local\Temp\A4C.tmp"C:\Users\Admin\AppData\Local\Temp\A4C.tmp"27⤵
- Executes dropped EXE
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\AB9.tmp"C:\Users\Admin\AppData\Local\Temp\AB9.tmp"28⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\B36.tmp"C:\Users\Admin\AppData\Local\Temp\B36.tmp"29⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\B94.tmp"C:\Users\Admin\AppData\Local\Temp\B94.tmp"30⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\C11.tmp"C:\Users\Admin\AppData\Local\Temp\C11.tmp"31⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"32⤵
- Executes dropped EXE
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\CBD.tmp"C:\Users\Admin\AppData\Local\Temp\CBD.tmp"33⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\D0B.tmp"C:\Users\Admin\AppData\Local\Temp\D0B.tmp"34⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\D69.tmp"C:\Users\Admin\AppData\Local\Temp\D69.tmp"35⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\DC6.tmp"C:\Users\Admin\AppData\Local\Temp\DC6.tmp"36⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\E14.tmp"C:\Users\Admin\AppData\Local\Temp\E14.tmp"37⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\E63.tmp"C:\Users\Admin\AppData\Local\Temp\E63.tmp"38⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\EC0.tmp"C:\Users\Admin\AppData\Local\Temp\EC0.tmp"39⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"40⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"41⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"42⤵
- Executes dropped EXE
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\1018.tmp"C:\Users\Admin\AppData\Local\Temp\1018.tmp"43⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\1076.tmp"C:\Users\Admin\AppData\Local\Temp\1076.tmp"44⤵
- Executes dropped EXE
PID:816 -
C:\Users\Admin\AppData\Local\Temp\10D4.tmp"C:\Users\Admin\AppData\Local\Temp\10D4.tmp"45⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\1131.tmp"C:\Users\Admin\AppData\Local\Temp\1131.tmp"46⤵
- Executes dropped EXE
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\118F.tmp"C:\Users\Admin\AppData\Local\Temp\118F.tmp"47⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\11DD.tmp"C:\Users\Admin\AppData\Local\Temp\11DD.tmp"48⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\122B.tmp"C:\Users\Admin\AppData\Local\Temp\122B.tmp"49⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\1279.tmp"C:\Users\Admin\AppData\Local\Temp\1279.tmp"50⤵
- Executes dropped EXE
PID:848 -
C:\Users\Admin\AppData\Local\Temp\12C8.tmp"C:\Users\Admin\AppData\Local\Temp\12C8.tmp"51⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\1316.tmp"C:\Users\Admin\AppData\Local\Temp\1316.tmp"52⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\1373.tmp"C:\Users\Admin\AppData\Local\Temp\1373.tmp"53⤵
- Executes dropped EXE
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\13C2.tmp"C:\Users\Admin\AppData\Local\Temp\13C2.tmp"54⤵
- Executes dropped EXE
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\141F.tmp"C:\Users\Admin\AppData\Local\Temp\141F.tmp"55⤵
- Executes dropped EXE
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\146D.tmp"C:\Users\Admin\AppData\Local\Temp\146D.tmp"56⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\14BC.tmp"C:\Users\Admin\AppData\Local\Temp\14BC.tmp"57⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\150A.tmp"C:\Users\Admin\AppData\Local\Temp\150A.tmp"58⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\1567.tmp"C:\Users\Admin\AppData\Local\Temp\1567.tmp"59⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\15C5.tmp"C:\Users\Admin\AppData\Local\Temp\15C5.tmp"60⤵
- Executes dropped EXE
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\1613.tmp"C:\Users\Admin\AppData\Local\Temp\1613.tmp"61⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\1661.tmp"C:\Users\Admin\AppData\Local\Temp\1661.tmp"62⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\16B0.tmp"C:\Users\Admin\AppData\Local\Temp\16B0.tmp"63⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\16FE.tmp"C:\Users\Admin\AppData\Local\Temp\16FE.tmp"64⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\174C.tmp"C:\Users\Admin\AppData\Local\Temp\174C.tmp"65⤵
- Executes dropped EXE
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\17AA.tmp"C:\Users\Admin\AppData\Local\Temp\17AA.tmp"66⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\1817.tmp"C:\Users\Admin\AppData\Local\Temp\1817.tmp"67⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\1865.tmp"C:\Users\Admin\AppData\Local\Temp\1865.tmp"68⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\18B3.tmp"C:\Users\Admin\AppData\Local\Temp\18B3.tmp"69⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\1911.tmp"C:\Users\Admin\AppData\Local\Temp\1911.tmp"70⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\196F.tmp"C:\Users\Admin\AppData\Local\Temp\196F.tmp"71⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\19CC.tmp"C:\Users\Admin\AppData\Local\Temp\19CC.tmp"72⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"73⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\1A69.tmp"C:\Users\Admin\AppData\Local\Temp\1A69.tmp"74⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"75⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\1B24.tmp"C:\Users\Admin\AppData\Local\Temp\1B24.tmp"76⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\1B82.tmp"C:\Users\Admin\AppData\Local\Temp\1B82.tmp"77⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"78⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\1C2E.tmp"C:\Users\Admin\AppData\Local\Temp\1C2E.tmp"79⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\1C8C.tmp"C:\Users\Admin\AppData\Local\Temp\1C8C.tmp"80⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\1CE9.tmp"C:\Users\Admin\AppData\Local\Temp\1CE9.tmp"81⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\1D37.tmp"C:\Users\Admin\AppData\Local\Temp\1D37.tmp"82⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\1D86.tmp"C:\Users\Admin\AppData\Local\Temp\1D86.tmp"83⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\1DE3.tmp"C:\Users\Admin\AppData\Local\Temp\1DE3.tmp"84⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\1E41.tmp"C:\Users\Admin\AppData\Local\Temp\1E41.tmp"85⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"86⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"87⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\1F5A.tmp"C:\Users\Admin\AppData\Local\Temp\1F5A.tmp"88⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\1FB8.tmp"C:\Users\Admin\AppData\Local\Temp\1FB8.tmp"89⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\2016.tmp"C:\Users\Admin\AppData\Local\Temp\2016.tmp"90⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\2074.tmp"C:\Users\Admin\AppData\Local\Temp\2074.tmp"91⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\20D1.tmp"C:\Users\Admin\AppData\Local\Temp\20D1.tmp"92⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\212F.tmp"C:\Users\Admin\AppData\Local\Temp\212F.tmp"93⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\218D.tmp"C:\Users\Admin\AppData\Local\Temp\218D.tmp"94⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\21EB.tmp"C:\Users\Admin\AppData\Local\Temp\21EB.tmp"95⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\2248.tmp"C:\Users\Admin\AppData\Local\Temp\2248.tmp"96⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\22A6.tmp"C:\Users\Admin\AppData\Local\Temp\22A6.tmp"97⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\2304.tmp"C:\Users\Admin\AppData\Local\Temp\2304.tmp"98⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\2362.tmp"C:\Users\Admin\AppData\Local\Temp\2362.tmp"99⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\23B0.tmp"C:\Users\Admin\AppData\Local\Temp\23B0.tmp"100⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\240D.tmp"C:\Users\Admin\AppData\Local\Temp\240D.tmp"101⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\246B.tmp"C:\Users\Admin\AppData\Local\Temp\246B.tmp"102⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\24C9.tmp"C:\Users\Admin\AppData\Local\Temp\24C9.tmp"103⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\2517.tmp"C:\Users\Admin\AppData\Local\Temp\2517.tmp"104⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\2565.tmp"C:\Users\Admin\AppData\Local\Temp\2565.tmp"105⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\25B3.tmp"C:\Users\Admin\AppData\Local\Temp\25B3.tmp"106⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\2601.tmp"C:\Users\Admin\AppData\Local\Temp\2601.tmp"107⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\2650.tmp"C:\Users\Admin\AppData\Local\Temp\2650.tmp"108⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\269E.tmp"C:\Users\Admin\AppData\Local\Temp\269E.tmp"109⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\26EC.tmp"C:\Users\Admin\AppData\Local\Temp\26EC.tmp"110⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\273A.tmp"C:\Users\Admin\AppData\Local\Temp\273A.tmp"111⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\2798.tmp"C:\Users\Admin\AppData\Local\Temp\2798.tmp"112⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\27F5.tmp"C:\Users\Admin\AppData\Local\Temp\27F5.tmp"113⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\2853.tmp"C:\Users\Admin\AppData\Local\Temp\2853.tmp"114⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\28A1.tmp"C:\Users\Admin\AppData\Local\Temp\28A1.tmp"115⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\28EF.tmp"C:\Users\Admin\AppData\Local\Temp\28EF.tmp"116⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\293E.tmp"C:\Users\Admin\AppData\Local\Temp\293E.tmp"117⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\298C.tmp"C:\Users\Admin\AppData\Local\Temp\298C.tmp"118⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\29DA.tmp"C:\Users\Admin\AppData\Local\Temp\29DA.tmp"119⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\2A28.tmp"C:\Users\Admin\AppData\Local\Temp\2A28.tmp"120⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\2A86.tmp"C:\Users\Admin\AppData\Local\Temp\2A86.tmp"121⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\2AD4.tmp"C:\Users\Admin\AppData\Local\Temp\2AD4.tmp"122⤵PID:1780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-