Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2024, 16:01
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-08_05e99ef472f62baf524dbc601b29e22d_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-07-08_05e99ef472f62baf524dbc601b29e22d_mafia.exe
Resource
win10v2004-20240704-en
General
-
Target
2024-07-08_05e99ef472f62baf524dbc601b29e22d_mafia.exe
-
Size
529KB
-
MD5
05e99ef472f62baf524dbc601b29e22d
-
SHA1
42b291b9db0bb57bab4b8cff09e8af18884c5f67
-
SHA256
411d3580372fad275d6ce336610816213d8338d1418e0e2f79ecea9c1fd584c8
-
SHA512
580f1a06c766f74e961e9c7a770022968908c92e9258169d89c7e5d4d7cc235413531cb3734b12db64e51e3931a100783d1ae75c2fc139d2bc2b86bfe1d7814d
-
SSDEEP
12288:NU5rCOTeijukT/YadtnrZT+BJmfNwfchTZwlH4Hp:NUQOJjVZTdT+bmfDTSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1208 412B.tmp 2084 41B7.tmp 4932 4225.tmp 468 42C1.tmp 4640 437C.tmp 4448 4409.tmp 1548 44B5.tmp 2996 4532.tmp 1568 45AF.tmp 1924 461C.tmp 4740 4716.tmp 3608 47A3.tmp 3740 483F.tmp 1056 48EB.tmp 912 4968.tmp 312 4A14.tmp 4480 4AB0.tmp 5056 4B5C.tmp 1096 4BBA.tmp 2288 4C27.tmp 4928 4CE3.tmp 1456 4D60.tmp 2740 4DBD.tmp 5024 4E3A.tmp 4332 4EA8.tmp 4520 4F25.tmp 2516 4FD1.tmp 376 505D.tmp 1608 50CB.tmp 4112 5186.tmp 1720 51E4.tmp 1784 5251.tmp 1504 52BF.tmp 2192 531C.tmp 2684 537A.tmp 2244 53D8.tmp 1176 5445.tmp 4640 54A3.tmp 760 54F1.tmp 2716 554F.tmp 4832 559D.tmp 2996 55FB.tmp 736 5658.tmp 3644 56B6.tmp 1924 5714.tmp 3276 5781.tmp 3300 57EF.tmp 3616 585C.tmp 4724 58BA.tmp 2108 5927.tmp 1476 5995.tmp 4120 59F2.tmp 3448 5A40.tmp 3412 5ABD.tmp 1036 5B2B.tmp 4068 5B98.tmp 4836 5C06.tmp 220 5C54.tmp 2288 5CB1.tmp 2124 5D0F.tmp 4324 5D6D.tmp 1724 5DDA.tmp 2740 5E38.tmp 3348 5EA5.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3576 wrote to memory of 1208 3576 2024-07-08_05e99ef472f62baf524dbc601b29e22d_mafia.exe 90 PID 3576 wrote to memory of 1208 3576 2024-07-08_05e99ef472f62baf524dbc601b29e22d_mafia.exe 90 PID 3576 wrote to memory of 1208 3576 2024-07-08_05e99ef472f62baf524dbc601b29e22d_mafia.exe 90 PID 1208 wrote to memory of 2084 1208 412B.tmp 91 PID 1208 wrote to memory of 2084 1208 412B.tmp 91 PID 1208 wrote to memory of 2084 1208 412B.tmp 91 PID 2084 wrote to memory of 4932 2084 41B7.tmp 93 PID 2084 wrote to memory of 4932 2084 41B7.tmp 93 PID 2084 wrote to memory of 4932 2084 41B7.tmp 93 PID 4932 wrote to memory of 468 4932 4225.tmp 94 PID 4932 wrote to memory of 468 4932 4225.tmp 94 PID 4932 wrote to memory of 468 4932 4225.tmp 94 PID 468 wrote to memory of 4640 468 42C1.tmp 96 PID 468 wrote to memory of 4640 468 42C1.tmp 96 PID 468 wrote to memory of 4640 468 42C1.tmp 96 PID 4640 wrote to memory of 4448 4640 437C.tmp 97 PID 4640 wrote to memory of 4448 4640 437C.tmp 97 PID 4640 wrote to memory of 4448 4640 437C.tmp 97 PID 4448 wrote to memory of 1548 4448 4409.tmp 98 PID 4448 wrote to memory of 1548 4448 4409.tmp 98 PID 4448 wrote to memory of 1548 4448 4409.tmp 98 PID 1548 wrote to memory of 2996 1548 44B5.tmp 99 PID 1548 wrote to memory of 2996 1548 44B5.tmp 99 PID 1548 wrote to memory of 2996 1548 44B5.tmp 99 PID 2996 wrote to memory of 1568 2996 4532.tmp 100 PID 2996 wrote to memory of 1568 2996 4532.tmp 100 PID 2996 wrote to memory of 1568 2996 4532.tmp 100 PID 1568 wrote to memory of 1924 1568 45AF.tmp 101 PID 1568 wrote to memory of 1924 1568 45AF.tmp 101 PID 1568 wrote to memory of 1924 1568 45AF.tmp 101 PID 1924 wrote to memory of 4740 1924 461C.tmp 102 PID 1924 wrote to memory of 4740 1924 461C.tmp 102 PID 1924 wrote to memory of 4740 1924 461C.tmp 102 PID 4740 wrote to memory of 3608 4740 4716.tmp 103 PID 4740 wrote to memory of 3608 4740 4716.tmp 103 PID 4740 wrote to memory of 3608 4740 4716.tmp 103 PID 3608 wrote to memory of 3740 3608 47A3.tmp 104 PID 3608 wrote to memory of 3740 3608 47A3.tmp 104 PID 3608 wrote to memory of 3740 3608 47A3.tmp 104 PID 3740 wrote to memory of 1056 3740 483F.tmp 105 PID 3740 wrote to memory of 1056 3740 483F.tmp 105 PID 3740 wrote to memory of 1056 3740 483F.tmp 105 PID 1056 wrote to memory of 912 1056 48EB.tmp 106 PID 1056 wrote to memory of 912 1056 48EB.tmp 106 PID 1056 wrote to memory of 912 1056 48EB.tmp 106 PID 912 wrote to memory of 312 912 4968.tmp 107 PID 912 wrote to memory of 312 912 4968.tmp 107 PID 912 wrote to memory of 312 912 4968.tmp 107 PID 312 wrote to memory of 4480 312 4A14.tmp 108 PID 312 wrote to memory of 4480 312 4A14.tmp 108 PID 312 wrote to memory of 4480 312 4A14.tmp 108 PID 4480 wrote to memory of 5056 4480 4AB0.tmp 109 PID 4480 wrote to memory of 5056 4480 4AB0.tmp 109 PID 4480 wrote to memory of 5056 4480 4AB0.tmp 109 PID 5056 wrote to memory of 1096 5056 4B5C.tmp 110 PID 5056 wrote to memory of 1096 5056 4B5C.tmp 110 PID 5056 wrote to memory of 1096 5056 4B5C.tmp 110 PID 1096 wrote to memory of 2288 1096 4BBA.tmp 111 PID 1096 wrote to memory of 2288 1096 4BBA.tmp 111 PID 1096 wrote to memory of 2288 1096 4BBA.tmp 111 PID 2288 wrote to memory of 4928 2288 4C27.tmp 112 PID 2288 wrote to memory of 4928 2288 4C27.tmp 112 PID 2288 wrote to memory of 4928 2288 4C27.tmp 112 PID 4928 wrote to memory of 1456 4928 4CE3.tmp 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-08_05e99ef472f62baf524dbc601b29e22d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-08_05e99ef472f62baf524dbc601b29e22d_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\412B.tmp"C:\Users\Admin\AppData\Local\Temp\412B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\41B7.tmp"C:\Users\Admin\AppData\Local\Temp\41B7.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\4225.tmp"C:\Users\Admin\AppData\Local\Temp\4225.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\42C1.tmp"C:\Users\Admin\AppData\Local\Temp\42C1.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\437C.tmp"C:\Users\Admin\AppData\Local\Temp\437C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\4409.tmp"C:\Users\Admin\AppData\Local\Temp\4409.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\44B5.tmp"C:\Users\Admin\AppData\Local\Temp\44B5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\4532.tmp"C:\Users\Admin\AppData\Local\Temp\4532.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\45AF.tmp"C:\Users\Admin\AppData\Local\Temp\45AF.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\461C.tmp"C:\Users\Admin\AppData\Local\Temp\461C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\4716.tmp"C:\Users\Admin\AppData\Local\Temp\4716.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\47A3.tmp"C:\Users\Admin\AppData\Local\Temp\47A3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\483F.tmp"C:\Users\Admin\AppData\Local\Temp\483F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\48EB.tmp"C:\Users\Admin\AppData\Local\Temp\48EB.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\4968.tmp"C:\Users\Admin\AppData\Local\Temp\4968.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\4A14.tmp"C:\Users\Admin\AppData\Local\Temp\4A14.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312 -
C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\4B5C.tmp"C:\Users\Admin\AppData\Local\Temp\4B5C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\4BBA.tmp"C:\Users\Admin\AppData\Local\Temp\4BBA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\4C27.tmp"C:\Users\Admin\AppData\Local\Temp\4C27.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\4CE3.tmp"C:\Users\Admin\AppData\Local\Temp\4CE3.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\4D60.tmp"C:\Users\Admin\AppData\Local\Temp\4D60.tmp"23⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\4DBD.tmp"C:\Users\Admin\AppData\Local\Temp\4DBD.tmp"24⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\4E3A.tmp"C:\Users\Admin\AppData\Local\Temp\4E3A.tmp"25⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\4EA8.tmp"C:\Users\Admin\AppData\Local\Temp\4EA8.tmp"26⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\4F25.tmp"C:\Users\Admin\AppData\Local\Temp\4F25.tmp"27⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\4FD1.tmp"C:\Users\Admin\AppData\Local\Temp\4FD1.tmp"28⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\505D.tmp"C:\Users\Admin\AppData\Local\Temp\505D.tmp"29⤵
- Executes dropped EXE
PID:376 -
C:\Users\Admin\AppData\Local\Temp\50CB.tmp"C:\Users\Admin\AppData\Local\Temp\50CB.tmp"30⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\5128.tmp"C:\Users\Admin\AppData\Local\Temp\5128.tmp"31⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\5186.tmp"C:\Users\Admin\AppData\Local\Temp\5186.tmp"32⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\51E4.tmp"C:\Users\Admin\AppData\Local\Temp\51E4.tmp"33⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\5251.tmp"C:\Users\Admin\AppData\Local\Temp\5251.tmp"34⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\52BF.tmp"C:\Users\Admin\AppData\Local\Temp\52BF.tmp"35⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\531C.tmp"C:\Users\Admin\AppData\Local\Temp\531C.tmp"36⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\537A.tmp"C:\Users\Admin\AppData\Local\Temp\537A.tmp"37⤵
- Executes dropped EXE
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\53D8.tmp"C:\Users\Admin\AppData\Local\Temp\53D8.tmp"38⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\5445.tmp"C:\Users\Admin\AppData\Local\Temp\5445.tmp"39⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\54A3.tmp"C:\Users\Admin\AppData\Local\Temp\54A3.tmp"40⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\54F1.tmp"C:\Users\Admin\AppData\Local\Temp\54F1.tmp"41⤵
- Executes dropped EXE
PID:760 -
C:\Users\Admin\AppData\Local\Temp\554F.tmp"C:\Users\Admin\AppData\Local\Temp\554F.tmp"42⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\559D.tmp"C:\Users\Admin\AppData\Local\Temp\559D.tmp"43⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\55FB.tmp"C:\Users\Admin\AppData\Local\Temp\55FB.tmp"44⤵
- Executes dropped EXE
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\5658.tmp"C:\Users\Admin\AppData\Local\Temp\5658.tmp"45⤵
- Executes dropped EXE
PID:736 -
C:\Users\Admin\AppData\Local\Temp\56B6.tmp"C:\Users\Admin\AppData\Local\Temp\56B6.tmp"46⤵
- Executes dropped EXE
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\5714.tmp"C:\Users\Admin\AppData\Local\Temp\5714.tmp"47⤵
- Executes dropped EXE
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\5781.tmp"C:\Users\Admin\AppData\Local\Temp\5781.tmp"48⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\57EF.tmp"C:\Users\Admin\AppData\Local\Temp\57EF.tmp"49⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\585C.tmp"C:\Users\Admin\AppData\Local\Temp\585C.tmp"50⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\58BA.tmp"C:\Users\Admin\AppData\Local\Temp\58BA.tmp"51⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\5927.tmp"C:\Users\Admin\AppData\Local\Temp\5927.tmp"52⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\5995.tmp"C:\Users\Admin\AppData\Local\Temp\5995.tmp"53⤵
- Executes dropped EXE
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\59F2.tmp"C:\Users\Admin\AppData\Local\Temp\59F2.tmp"54⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\5A40.tmp"C:\Users\Admin\AppData\Local\Temp\5A40.tmp"55⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\5ABD.tmp"C:\Users\Admin\AppData\Local\Temp\5ABD.tmp"56⤵
- Executes dropped EXE
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\5B2B.tmp"C:\Users\Admin\AppData\Local\Temp\5B2B.tmp"57⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\5B98.tmp"C:\Users\Admin\AppData\Local\Temp\5B98.tmp"58⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\5C06.tmp"C:\Users\Admin\AppData\Local\Temp\5C06.tmp"59⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\5C54.tmp"C:\Users\Admin\AppData\Local\Temp\5C54.tmp"60⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\5CB1.tmp"C:\Users\Admin\AppData\Local\Temp\5CB1.tmp"61⤵
- Executes dropped EXE
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\5D0F.tmp"C:\Users\Admin\AppData\Local\Temp\5D0F.tmp"62⤵
- Executes dropped EXE
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\5D6D.tmp"C:\Users\Admin\AppData\Local\Temp\5D6D.tmp"63⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\5DDA.tmp"C:\Users\Admin\AppData\Local\Temp\5DDA.tmp"64⤵
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\5E38.tmp"C:\Users\Admin\AppData\Local\Temp\5E38.tmp"65⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\5EA5.tmp"C:\Users\Admin\AppData\Local\Temp\5EA5.tmp"66⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\5F13.tmp"C:\Users\Admin\AppData\Local\Temp\5F13.tmp"67⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\5F71.tmp"C:\Users\Admin\AppData\Local\Temp\5F71.tmp"68⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\5FCE.tmp"C:\Users\Admin\AppData\Local\Temp\5FCE.tmp"69⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\602C.tmp"C:\Users\Admin\AppData\Local\Temp\602C.tmp"70⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\608A.tmp"C:\Users\Admin\AppData\Local\Temp\608A.tmp"71⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\60E8.tmp"C:\Users\Admin\AppData\Local\Temp\60E8.tmp"72⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\6145.tmp"C:\Users\Admin\AppData\Local\Temp\6145.tmp"73⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\61B3.tmp"C:\Users\Admin\AppData\Local\Temp\61B3.tmp"74⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\6220.tmp"C:\Users\Admin\AppData\Local\Temp\6220.tmp"75⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\628D.tmp"C:\Users\Admin\AppData\Local\Temp\628D.tmp"76⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\62EB.tmp"C:\Users\Admin\AppData\Local\Temp\62EB.tmp"77⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\6359.tmp"C:\Users\Admin\AppData\Local\Temp\6359.tmp"78⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\63C6.tmp"C:\Users\Admin\AppData\Local\Temp\63C6.tmp"79⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\6424.tmp"C:\Users\Admin\AppData\Local\Temp\6424.tmp"80⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\6481.tmp"C:\Users\Admin\AppData\Local\Temp\6481.tmp"81⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\64EF.tmp"C:\Users\Admin\AppData\Local\Temp\64EF.tmp"82⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\653D.tmp"C:\Users\Admin\AppData\Local\Temp\653D.tmp"83⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\65AA.tmp"C:\Users\Admin\AppData\Local\Temp\65AA.tmp"84⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\6608.tmp"C:\Users\Admin\AppData\Local\Temp\6608.tmp"85⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\6666.tmp"C:\Users\Admin\AppData\Local\Temp\6666.tmp"86⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\66D3.tmp"C:\Users\Admin\AppData\Local\Temp\66D3.tmp"87⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\6731.tmp"C:\Users\Admin\AppData\Local\Temp\6731.tmp"88⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\678F.tmp"C:\Users\Admin\AppData\Local\Temp\678F.tmp"89⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\67FC.tmp"C:\Users\Admin\AppData\Local\Temp\67FC.tmp"90⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\6879.tmp"C:\Users\Admin\AppData\Local\Temp\6879.tmp"91⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\68E6.tmp"C:\Users\Admin\AppData\Local\Temp\68E6.tmp"92⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\6954.tmp"C:\Users\Admin\AppData\Local\Temp\6954.tmp"93⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\69C1.tmp"C:\Users\Admin\AppData\Local\Temp\69C1.tmp"94⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\6A2F.tmp"C:\Users\Admin\AppData\Local\Temp\6A2F.tmp"95⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\6AAC.tmp"C:\Users\Admin\AppData\Local\Temp\6AAC.tmp"96⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\6B19.tmp"C:\Users\Admin\AppData\Local\Temp\6B19.tmp"97⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\6B86.tmp"C:\Users\Admin\AppData\Local\Temp\6B86.tmp"98⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\6BD4.tmp"C:\Users\Admin\AppData\Local\Temp\6BD4.tmp"99⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\6C23.tmp"C:\Users\Admin\AppData\Local\Temp\6C23.tmp"100⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\6C90.tmp"C:\Users\Admin\AppData\Local\Temp\6C90.tmp"101⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\6CEE.tmp"C:\Users\Admin\AppData\Local\Temp\6CEE.tmp"102⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\6D3C.tmp"C:\Users\Admin\AppData\Local\Temp\6D3C.tmp"103⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\6DA9.tmp"C:\Users\Admin\AppData\Local\Temp\6DA9.tmp"104⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\6E07.tmp"C:\Users\Admin\AppData\Local\Temp\6E07.tmp"105⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\6E74.tmp"C:\Users\Admin\AppData\Local\Temp\6E74.tmp"106⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\6EE2.tmp"C:\Users\Admin\AppData\Local\Temp\6EE2.tmp"107⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\6F4F.tmp"C:\Users\Admin\AppData\Local\Temp\6F4F.tmp"108⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\6FAD.tmp"C:\Users\Admin\AppData\Local\Temp\6FAD.tmp"109⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\700B.tmp"C:\Users\Admin\AppData\Local\Temp\700B.tmp"110⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\7078.tmp"C:\Users\Admin\AppData\Local\Temp\7078.tmp"111⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\70F5.tmp"C:\Users\Admin\AppData\Local\Temp\70F5.tmp"112⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\7162.tmp"C:\Users\Admin\AppData\Local\Temp\7162.tmp"113⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\71C0.tmp"C:\Users\Admin\AppData\Local\Temp\71C0.tmp"114⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\722D.tmp"C:\Users\Admin\AppData\Local\Temp\722D.tmp"115⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\728B.tmp"C:\Users\Admin\AppData\Local\Temp\728B.tmp"116⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\72E9.tmp"C:\Users\Admin\AppData\Local\Temp\72E9.tmp"117⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\7347.tmp"C:\Users\Admin\AppData\Local\Temp\7347.tmp"118⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\73C4.tmp"C:\Users\Admin\AppData\Local\Temp\73C4.tmp"119⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\7431.tmp"C:\Users\Admin\AppData\Local\Temp\7431.tmp"120⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\747F.tmp"C:\Users\Admin\AppData\Local\Temp\747F.tmp"121⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\74ED.tmp"C:\Users\Admin\AppData\Local\Temp\74ED.tmp"122⤵PID:396
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-