Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2024, 20:50
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-04_f6d57aa9245f70ead74a7e41aded56f0_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-07-04_f6d57aa9245f70ead74a7e41aded56f0_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-07-04_f6d57aa9245f70ead74a7e41aded56f0_mafia.exe
-
Size
486KB
-
MD5
f6d57aa9245f70ead74a7e41aded56f0
-
SHA1
b518423cd21adcdbc2efc7b994e30eb883939bc3
-
SHA256
c98cf94a072ebfca032af89c5b178dcd1bbe081552fd436e5391ec92cf36e678
-
SHA512
0964b35d0a24ecd2addc0c965c325ba491c9bda0bd684eda6163f7a436e440a959324e16714b9502547d0b25d5f35b11778dc55858056cb05fa8514ca2b3a52b
-
SSDEEP
12288:UU5rCOTeiDMjjTNNh4A7Rh+0Cd8Qqn5zS4NZ:UUQOJDMXTfaURh+Jdon5u4N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1736 4565.tmp 896 45E2.tmp 4796 465F.tmp 1976 46CD.tmp 760 474A.tmp 492 47C7.tmp 2796 4844.tmp 992 4892.tmp 624 48F0.tmp 756 493E.tmp 2812 49AB.tmp 2132 4A38.tmp 1820 4AA5.tmp 1800 4B03.tmp 4296 4B80.tmp 4168 4BDE.tmp 2956 4C4B.tmp 1244 4CC8.tmp 3272 4D45.tmp 4488 4DA3.tmp 3168 4E20.tmp 4180 4E7E.tmp 5016 4ECC.tmp 968 4F49.tmp 2992 4F97.tmp 4992 5014.tmp 3236 5072.tmp 1812 50CF.tmp 3508 512D.tmp 2948 51AA.tmp 2412 51F8.tmp 1444 5266.tmp 4032 52D3.tmp 444 5331.tmp 4896 537F.tmp 3532 53DD.tmp 2676 542B.tmp 220 5488.tmp 964 54E6.tmp 2252 5544.tmp 1832 5592.tmp 4892 55E0.tmp 1580 563E.tmp 4848 569C.tmp 4332 56F9.tmp 4500 5757.tmp 3468 57B5.tmp 2040 5813.tmp 1540 5870.tmp 4372 58CE.tmp 3736 592C.tmp 3728 598A.tmp 4480 59D8.tmp 3232 5A26.tmp 4612 5A74.tmp 3800 5AC2.tmp 4396 5B10.tmp 2160 5B5E.tmp 2084 5BAD.tmp 3568 5BFB.tmp 2924 5C49.tmp 2884 5C97.tmp 432 5CF5.tmp 4356 5D52.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1016 wrote to memory of 1736 1016 2024-07-04_f6d57aa9245f70ead74a7e41aded56f0_mafia.exe 80 PID 1016 wrote to memory of 1736 1016 2024-07-04_f6d57aa9245f70ead74a7e41aded56f0_mafia.exe 80 PID 1016 wrote to memory of 1736 1016 2024-07-04_f6d57aa9245f70ead74a7e41aded56f0_mafia.exe 80 PID 1736 wrote to memory of 896 1736 4565.tmp 81 PID 1736 wrote to memory of 896 1736 4565.tmp 81 PID 1736 wrote to memory of 896 1736 4565.tmp 81 PID 896 wrote to memory of 4796 896 45E2.tmp 82 PID 896 wrote to memory of 4796 896 45E2.tmp 82 PID 896 wrote to memory of 4796 896 45E2.tmp 82 PID 4796 wrote to memory of 1976 4796 465F.tmp 83 PID 4796 wrote to memory of 1976 4796 465F.tmp 83 PID 4796 wrote to memory of 1976 4796 465F.tmp 83 PID 1976 wrote to memory of 760 1976 46CD.tmp 84 PID 1976 wrote to memory of 760 1976 46CD.tmp 84 PID 1976 wrote to memory of 760 1976 46CD.tmp 84 PID 760 wrote to memory of 492 760 474A.tmp 85 PID 760 wrote to memory of 492 760 474A.tmp 85 PID 760 wrote to memory of 492 760 474A.tmp 85 PID 492 wrote to memory of 2796 492 47C7.tmp 86 PID 492 wrote to memory of 2796 492 47C7.tmp 86 PID 492 wrote to memory of 2796 492 47C7.tmp 86 PID 2796 wrote to memory of 992 2796 4844.tmp 87 PID 2796 wrote to memory of 992 2796 4844.tmp 87 PID 2796 wrote to memory of 992 2796 4844.tmp 87 PID 992 wrote to memory of 624 992 4892.tmp 88 PID 992 wrote to memory of 624 992 4892.tmp 88 PID 992 wrote to memory of 624 992 4892.tmp 88 PID 624 wrote to memory of 756 624 48F0.tmp 89 PID 624 wrote to memory of 756 624 48F0.tmp 89 PID 624 wrote to memory of 756 624 48F0.tmp 89 PID 756 wrote to memory of 2812 756 493E.tmp 90 PID 756 wrote to memory of 2812 756 493E.tmp 90 PID 756 wrote to memory of 2812 756 493E.tmp 90 PID 2812 wrote to memory of 2132 2812 49AB.tmp 91 PID 2812 wrote to memory of 2132 2812 49AB.tmp 91 PID 2812 wrote to memory of 2132 2812 49AB.tmp 91 PID 2132 wrote to memory of 1820 2132 4A38.tmp 92 PID 2132 wrote to memory of 1820 2132 4A38.tmp 92 PID 2132 wrote to memory of 1820 2132 4A38.tmp 92 PID 1820 wrote to memory of 1800 1820 4AA5.tmp 93 PID 1820 wrote to memory of 1800 1820 4AA5.tmp 93 PID 1820 wrote to memory of 1800 1820 4AA5.tmp 93 PID 1800 wrote to memory of 4296 1800 4B03.tmp 94 PID 1800 wrote to memory of 4296 1800 4B03.tmp 94 PID 1800 wrote to memory of 4296 1800 4B03.tmp 94 PID 4296 wrote to memory of 4168 4296 4B80.tmp 95 PID 4296 wrote to memory of 4168 4296 4B80.tmp 95 PID 4296 wrote to memory of 4168 4296 4B80.tmp 95 PID 4168 wrote to memory of 2956 4168 4BDE.tmp 96 PID 4168 wrote to memory of 2956 4168 4BDE.tmp 96 PID 4168 wrote to memory of 2956 4168 4BDE.tmp 96 PID 2956 wrote to memory of 1244 2956 4C4B.tmp 97 PID 2956 wrote to memory of 1244 2956 4C4B.tmp 97 PID 2956 wrote to memory of 1244 2956 4C4B.tmp 97 PID 1244 wrote to memory of 3272 1244 4CC8.tmp 98 PID 1244 wrote to memory of 3272 1244 4CC8.tmp 98 PID 1244 wrote to memory of 3272 1244 4CC8.tmp 98 PID 3272 wrote to memory of 4488 3272 4D45.tmp 99 PID 3272 wrote to memory of 4488 3272 4D45.tmp 99 PID 3272 wrote to memory of 4488 3272 4D45.tmp 99 PID 4488 wrote to memory of 3168 4488 4DA3.tmp 100 PID 4488 wrote to memory of 3168 4488 4DA3.tmp 100 PID 4488 wrote to memory of 3168 4488 4DA3.tmp 100 PID 3168 wrote to memory of 4180 3168 4E20.tmp 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-04_f6d57aa9245f70ead74a7e41aded56f0_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-04_f6d57aa9245f70ead74a7e41aded56f0_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\4565.tmp"C:\Users\Admin\AppData\Local\Temp\4565.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:492 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"23⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"24⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"25⤵
- Executes dropped EXE
PID:968 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"26⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"27⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"28⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"29⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"30⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"31⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"32⤵
- Executes dropped EXE
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"33⤵
- Executes dropped EXE
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"34⤵
- Executes dropped EXE
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"35⤵
- Executes dropped EXE
PID:444 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"36⤵
- Executes dropped EXE
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"37⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"38⤵
- Executes dropped EXE
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"39⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"40⤵
- Executes dropped EXE
PID:964 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"41⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"42⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"43⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"44⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"45⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"46⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"47⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"48⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"49⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"50⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"51⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"52⤵
- Executes dropped EXE
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"53⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"54⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"55⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"56⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"57⤵
- Executes dropped EXE
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"58⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"59⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"60⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"61⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"62⤵
- Executes dropped EXE
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"63⤵
- Executes dropped EXE
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"64⤵
- Executes dropped EXE
PID:432 -
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"65⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"66⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"67⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"68⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"69⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"70⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"71⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"72⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"73⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"74⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"75⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"76⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"77⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"78⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"79⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"80⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"81⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"82⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"83⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"84⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"85⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"86⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"87⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"88⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"89⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"90⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"91⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"92⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"93⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"94⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"95⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"96⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"97⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"98⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"99⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"100⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"101⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"102⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"103⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"104⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"105⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"106⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"107⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"108⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"109⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"110⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"111⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"112⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"113⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"114⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"115⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"116⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"117⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"118⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"119⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"120⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"121⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"122⤵PID:2156
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-