Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240708-en -
resource tags
arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2024, 13:07
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-09_c112efd771a3cee3491f4f9829313013_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-07-09_c112efd771a3cee3491f4f9829313013_mafia.exe
Resource
win10v2004-20240708-en
General
-
Target
2024-07-09_c112efd771a3cee3491f4f9829313013_mafia.exe
-
Size
541KB
-
MD5
c112efd771a3cee3491f4f9829313013
-
SHA1
754e226a7b3fb97e3d128c228590084ee6ea4390
-
SHA256
db3423f08411bc982e321ad1bcdca5f97a70d3c680527cbfd8ad017d5229ab8a
-
SHA512
0ff2de5a66202e85440d7f9db3d84645eec0777fec0f3739a742084d0bfa78735ce41c982b5245c087f9dc51b731c711186ce80228596afe9f673353e3515ddc
-
SSDEEP
12288:UU5rCOTeifsb0zaoPXHgVXvBonErZa73ctO:UUQOJf+0hHIfrU73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 856 3B3F.tmp 4936 3BBC.tmp 4836 3C58.tmp 2560 3CE5.tmp 1676 3D43.tmp 4116 3DCF.tmp 1760 3E4C.tmp 2464 3EAA.tmp 3076 3F08.tmp 1988 3F75.tmp 3904 4002.tmp 4572 406F.tmp 5032 40DC.tmp 4984 413A.tmp 3280 41A8.tmp 2556 4234.tmp 2960 4282.tmp 2176 42FF.tmp 2608 437C.tmp 1960 43F9.tmp 1908 4476.tmp 324 44F3.tmp 3288 4551.tmp 2416 45DE.tmp 1520 464B.tmp 3016 46B8.tmp 3468 4735.tmp 1312 47B2.tmp 3700 4810.tmp 4768 48AC.tmp 3344 491A.tmp 4848 4997.tmp 4624 49F5.tmp 4732 4A52.tmp 4276 4AA0.tmp 4252 4AEF.tmp 2760 4B4C.tmp 3992 4B9A.tmp 5080 4BE9.tmp 400 4C37.tmp 3232 4C94.tmp 3140 4CF2.tmp 4988 4D50.tmp 2092 4DAE.tmp 2020 4DFC.tmp 1828 4E5A.tmp 3316 4EA8.tmp 2180 4F05.tmp 2260 4F63.tmp 1072 4FC1.tmp 2788 501F.tmp 3740 507C.tmp 4456 50DA.tmp 4372 5128.tmp 3308 5186.tmp 4928 51E4.tmp 2320 5242.tmp 4100 5290.tmp 2004 52FD.tmp 3068 534B.tmp 4552 53A9.tmp 740 5407.tmp 2052 5455.tmp 3184 54B3.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2320 wrote to memory of 856 2320 2024-07-09_c112efd771a3cee3491f4f9829313013_mafia.exe 84 PID 2320 wrote to memory of 856 2320 2024-07-09_c112efd771a3cee3491f4f9829313013_mafia.exe 84 PID 2320 wrote to memory of 856 2320 2024-07-09_c112efd771a3cee3491f4f9829313013_mafia.exe 84 PID 856 wrote to memory of 4936 856 3B3F.tmp 86 PID 856 wrote to memory of 4936 856 3B3F.tmp 86 PID 856 wrote to memory of 4936 856 3B3F.tmp 86 PID 4936 wrote to memory of 4836 4936 3BBC.tmp 87 PID 4936 wrote to memory of 4836 4936 3BBC.tmp 87 PID 4936 wrote to memory of 4836 4936 3BBC.tmp 87 PID 4836 wrote to memory of 2560 4836 3C58.tmp 88 PID 4836 wrote to memory of 2560 4836 3C58.tmp 88 PID 4836 wrote to memory of 2560 4836 3C58.tmp 88 PID 2560 wrote to memory of 1676 2560 3CE5.tmp 89 PID 2560 wrote to memory of 1676 2560 3CE5.tmp 89 PID 2560 wrote to memory of 1676 2560 3CE5.tmp 89 PID 1676 wrote to memory of 4116 1676 3D43.tmp 90 PID 1676 wrote to memory of 4116 1676 3D43.tmp 90 PID 1676 wrote to memory of 4116 1676 3D43.tmp 90 PID 4116 wrote to memory of 1760 4116 3DCF.tmp 91 PID 4116 wrote to memory of 1760 4116 3DCF.tmp 91 PID 4116 wrote to memory of 1760 4116 3DCF.tmp 91 PID 1760 wrote to memory of 2464 1760 3E4C.tmp 92 PID 1760 wrote to memory of 2464 1760 3E4C.tmp 92 PID 1760 wrote to memory of 2464 1760 3E4C.tmp 92 PID 2464 wrote to memory of 3076 2464 3EAA.tmp 93 PID 2464 wrote to memory of 3076 2464 3EAA.tmp 93 PID 2464 wrote to memory of 3076 2464 3EAA.tmp 93 PID 3076 wrote to memory of 1988 3076 3F08.tmp 94 PID 3076 wrote to memory of 1988 3076 3F08.tmp 94 PID 3076 wrote to memory of 1988 3076 3F08.tmp 94 PID 1988 wrote to memory of 3904 1988 3F75.tmp 95 PID 1988 wrote to memory of 3904 1988 3F75.tmp 95 PID 1988 wrote to memory of 3904 1988 3F75.tmp 95 PID 3904 wrote to memory of 4572 3904 4002.tmp 96 PID 3904 wrote to memory of 4572 3904 4002.tmp 96 PID 3904 wrote to memory of 4572 3904 4002.tmp 96 PID 4572 wrote to memory of 5032 4572 406F.tmp 97 PID 4572 wrote to memory of 5032 4572 406F.tmp 97 PID 4572 wrote to memory of 5032 4572 406F.tmp 97 PID 5032 wrote to memory of 4984 5032 40DC.tmp 98 PID 5032 wrote to memory of 4984 5032 40DC.tmp 98 PID 5032 wrote to memory of 4984 5032 40DC.tmp 98 PID 4984 wrote to memory of 3280 4984 413A.tmp 99 PID 4984 wrote to memory of 3280 4984 413A.tmp 99 PID 4984 wrote to memory of 3280 4984 413A.tmp 99 PID 3280 wrote to memory of 2556 3280 41A8.tmp 100 PID 3280 wrote to memory of 2556 3280 41A8.tmp 100 PID 3280 wrote to memory of 2556 3280 41A8.tmp 100 PID 2556 wrote to memory of 2960 2556 4234.tmp 101 PID 2556 wrote to memory of 2960 2556 4234.tmp 101 PID 2556 wrote to memory of 2960 2556 4234.tmp 101 PID 2960 wrote to memory of 2176 2960 4282.tmp 102 PID 2960 wrote to memory of 2176 2960 4282.tmp 102 PID 2960 wrote to memory of 2176 2960 4282.tmp 102 PID 2176 wrote to memory of 2608 2176 42FF.tmp 103 PID 2176 wrote to memory of 2608 2176 42FF.tmp 103 PID 2176 wrote to memory of 2608 2176 42FF.tmp 103 PID 2608 wrote to memory of 1960 2608 437C.tmp 104 PID 2608 wrote to memory of 1960 2608 437C.tmp 104 PID 2608 wrote to memory of 1960 2608 437C.tmp 104 PID 1960 wrote to memory of 1908 1960 43F9.tmp 105 PID 1960 wrote to memory of 1908 1960 43F9.tmp 105 PID 1960 wrote to memory of 1908 1960 43F9.tmp 105 PID 1908 wrote to memory of 324 1908 4476.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-09_c112efd771a3cee3491f4f9829313013_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-09_c112efd771a3cee3491f4f9829313013_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\3BBC.tmp"C:\Users\Admin\AppData\Local\Temp\3BBC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\3C58.tmp"C:\Users\Admin\AppData\Local\Temp\3C58.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\3CE5.tmp"C:\Users\Admin\AppData\Local\Temp\3CE5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\3D43.tmp"C:\Users\Admin\AppData\Local\Temp\3D43.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\3DCF.tmp"C:\Users\Admin\AppData\Local\Temp\3DCF.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\3E4C.tmp"C:\Users\Admin\AppData\Local\Temp\3E4C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\3F08.tmp"C:\Users\Admin\AppData\Local\Temp\3F08.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\3F75.tmp"C:\Users\Admin\AppData\Local\Temp\3F75.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\4002.tmp"C:\Users\Admin\AppData\Local\Temp\4002.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\406F.tmp"C:\Users\Admin\AppData\Local\Temp\406F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\40DC.tmp"C:\Users\Admin\AppData\Local\Temp\40DC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\413A.tmp"C:\Users\Admin\AppData\Local\Temp\413A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\41A8.tmp"C:\Users\Admin\AppData\Local\Temp\41A8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\4234.tmp"C:\Users\Admin\AppData\Local\Temp\4234.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\4282.tmp"C:\Users\Admin\AppData\Local\Temp\4282.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\42FF.tmp"C:\Users\Admin\AppData\Local\Temp\42FF.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\437C.tmp"C:\Users\Admin\AppData\Local\Temp\437C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\43F9.tmp"C:\Users\Admin\AppData\Local\Temp\43F9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\4476.tmp"C:\Users\Admin\AppData\Local\Temp\4476.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\44F3.tmp"C:\Users\Admin\AppData\Local\Temp\44F3.tmp"23⤵
- Executes dropped EXE
PID:324 -
C:\Users\Admin\AppData\Local\Temp\4551.tmp"C:\Users\Admin\AppData\Local\Temp\4551.tmp"24⤵
- Executes dropped EXE
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\45DE.tmp"C:\Users\Admin\AppData\Local\Temp\45DE.tmp"25⤵
- Executes dropped EXE
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\464B.tmp"C:\Users\Admin\AppData\Local\Temp\464B.tmp"26⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\46B8.tmp"C:\Users\Admin\AppData\Local\Temp\46B8.tmp"27⤵
- Executes dropped EXE
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\4735.tmp"C:\Users\Admin\AppData\Local\Temp\4735.tmp"28⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\47B2.tmp"C:\Users\Admin\AppData\Local\Temp\47B2.tmp"29⤵
- Executes dropped EXE
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\4810.tmp"C:\Users\Admin\AppData\Local\Temp\4810.tmp"30⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\48AC.tmp"C:\Users\Admin\AppData\Local\Temp\48AC.tmp"31⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\491A.tmp"C:\Users\Admin\AppData\Local\Temp\491A.tmp"32⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\4997.tmp"C:\Users\Admin\AppData\Local\Temp\4997.tmp"33⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\49F5.tmp"C:\Users\Admin\AppData\Local\Temp\49F5.tmp"34⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\4A52.tmp"C:\Users\Admin\AppData\Local\Temp\4A52.tmp"35⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\4AA0.tmp"C:\Users\Admin\AppData\Local\Temp\4AA0.tmp"36⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\4AEF.tmp"C:\Users\Admin\AppData\Local\Temp\4AEF.tmp"37⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\4B4C.tmp"C:\Users\Admin\AppData\Local\Temp\4B4C.tmp"38⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\4B9A.tmp"C:\Users\Admin\AppData\Local\Temp\4B9A.tmp"39⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\4BE9.tmp"C:\Users\Admin\AppData\Local\Temp\4BE9.tmp"40⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\4C37.tmp"C:\Users\Admin\AppData\Local\Temp\4C37.tmp"41⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\4C94.tmp"C:\Users\Admin\AppData\Local\Temp\4C94.tmp"42⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\4CF2.tmp"C:\Users\Admin\AppData\Local\Temp\4CF2.tmp"43⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\4D50.tmp"C:\Users\Admin\AppData\Local\Temp\4D50.tmp"44⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\4DAE.tmp"C:\Users\Admin\AppData\Local\Temp\4DAE.tmp"45⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\4DFC.tmp"C:\Users\Admin\AppData\Local\Temp\4DFC.tmp"46⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\4E5A.tmp"C:\Users\Admin\AppData\Local\Temp\4E5A.tmp"47⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\4EA8.tmp"C:\Users\Admin\AppData\Local\Temp\4EA8.tmp"48⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\4F05.tmp"C:\Users\Admin\AppData\Local\Temp\4F05.tmp"49⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\4F63.tmp"C:\Users\Admin\AppData\Local\Temp\4F63.tmp"50⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\4FC1.tmp"C:\Users\Admin\AppData\Local\Temp\4FC1.tmp"51⤵
- Executes dropped EXE
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\501F.tmp"C:\Users\Admin\AppData\Local\Temp\501F.tmp"52⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\507C.tmp"C:\Users\Admin\AppData\Local\Temp\507C.tmp"53⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\50DA.tmp"C:\Users\Admin\AppData\Local\Temp\50DA.tmp"54⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\5128.tmp"C:\Users\Admin\AppData\Local\Temp\5128.tmp"55⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\5186.tmp"C:\Users\Admin\AppData\Local\Temp\5186.tmp"56⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\51E4.tmp"C:\Users\Admin\AppData\Local\Temp\51E4.tmp"57⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\5242.tmp"C:\Users\Admin\AppData\Local\Temp\5242.tmp"58⤵
- Executes dropped EXE
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\5290.tmp"C:\Users\Admin\AppData\Local\Temp\5290.tmp"59⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\52FD.tmp"C:\Users\Admin\AppData\Local\Temp\52FD.tmp"60⤵
- Executes dropped EXE
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\534B.tmp"C:\Users\Admin\AppData\Local\Temp\534B.tmp"61⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\53A9.tmp"C:\Users\Admin\AppData\Local\Temp\53A9.tmp"62⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\5407.tmp"C:\Users\Admin\AppData\Local\Temp\5407.tmp"63⤵
- Executes dropped EXE
PID:740 -
C:\Users\Admin\AppData\Local\Temp\5455.tmp"C:\Users\Admin\AppData\Local\Temp\5455.tmp"64⤵
- Executes dropped EXE
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\54B3.tmp"C:\Users\Admin\AppData\Local\Temp\54B3.tmp"65⤵
- Executes dropped EXE
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\5510.tmp"C:\Users\Admin\AppData\Local\Temp\5510.tmp"66⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\556E.tmp"C:\Users\Admin\AppData\Local\Temp\556E.tmp"67⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\55CC.tmp"C:\Users\Admin\AppData\Local\Temp\55CC.tmp"68⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\562A.tmp"C:\Users\Admin\AppData\Local\Temp\562A.tmp"69⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\5687.tmp"C:\Users\Admin\AppData\Local\Temp\5687.tmp"70⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\56D5.tmp"C:\Users\Admin\AppData\Local\Temp\56D5.tmp"71⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\5724.tmp"C:\Users\Admin\AppData\Local\Temp\5724.tmp"72⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\5772.tmp"C:\Users\Admin\AppData\Local\Temp\5772.tmp"73⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\57C0.tmp"C:\Users\Admin\AppData\Local\Temp\57C0.tmp"74⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\580E.tmp"C:\Users\Admin\AppData\Local\Temp\580E.tmp"75⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\585C.tmp"C:\Users\Admin\AppData\Local\Temp\585C.tmp"76⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\58AA.tmp"C:\Users\Admin\AppData\Local\Temp\58AA.tmp"77⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\58F8.tmp"C:\Users\Admin\AppData\Local\Temp\58F8.tmp"78⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\5946.tmp"C:\Users\Admin\AppData\Local\Temp\5946.tmp"79⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\5995.tmp"C:\Users\Admin\AppData\Local\Temp\5995.tmp"80⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\59E3.tmp"C:\Users\Admin\AppData\Local\Temp\59E3.tmp"81⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\5A31.tmp"C:\Users\Admin\AppData\Local\Temp\5A31.tmp"82⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\5ACD.tmp"C:\Users\Admin\AppData\Local\Temp\5ACD.tmp"83⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\5B69.tmp"C:\Users\Admin\AppData\Local\Temp\5B69.tmp"84⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\5BD7.tmp"C:\Users\Admin\AppData\Local\Temp\5BD7.tmp"85⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\5C83.tmp"C:\Users\Admin\AppData\Local\Temp\5C83.tmp"86⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\5CE0.tmp"C:\Users\Admin\AppData\Local\Temp\5CE0.tmp"87⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\5D2E.tmp"C:\Users\Admin\AppData\Local\Temp\5D2E.tmp"88⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\5D8C.tmp"C:\Users\Admin\AppData\Local\Temp\5D8C.tmp"89⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\5DEA.tmp"C:\Users\Admin\AppData\Local\Temp\5DEA.tmp"90⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\5E38.tmp"C:\Users\Admin\AppData\Local\Temp\5E38.tmp"91⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\5E86.tmp"C:\Users\Admin\AppData\Local\Temp\5E86.tmp"92⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"93⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\5F32.tmp"C:\Users\Admin\AppData\Local\Temp\5F32.tmp"94⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\5F80.tmp"C:\Users\Admin\AppData\Local\Temp\5F80.tmp"95⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\5FDE.tmp"C:\Users\Admin\AppData\Local\Temp\5FDE.tmp"96⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\602C.tmp"C:\Users\Admin\AppData\Local\Temp\602C.tmp"97⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\608A.tmp"C:\Users\Admin\AppData\Local\Temp\608A.tmp"98⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\60D8.tmp"C:\Users\Admin\AppData\Local\Temp\60D8.tmp"99⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\6136.tmp"C:\Users\Admin\AppData\Local\Temp\6136.tmp"100⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\6184.tmp"C:\Users\Admin\AppData\Local\Temp\6184.tmp"101⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\61E2.tmp"C:\Users\Admin\AppData\Local\Temp\61E2.tmp"102⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\6230.tmp"C:\Users\Admin\AppData\Local\Temp\6230.tmp"103⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\628D.tmp"C:\Users\Admin\AppData\Local\Temp\628D.tmp"104⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\62EB.tmp"C:\Users\Admin\AppData\Local\Temp\62EB.tmp"105⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\6349.tmp"C:\Users\Admin\AppData\Local\Temp\6349.tmp"106⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\6397.tmp"C:\Users\Admin\AppData\Local\Temp\6397.tmp"107⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\63E5.tmp"C:\Users\Admin\AppData\Local\Temp\63E5.tmp"108⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\6462.tmp"C:\Users\Admin\AppData\Local\Temp\6462.tmp"109⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\64D0.tmp"C:\Users\Admin\AppData\Local\Temp\64D0.tmp"110⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\652D.tmp"C:\Users\Admin\AppData\Local\Temp\652D.tmp"111⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\657B.tmp"C:\Users\Admin\AppData\Local\Temp\657B.tmp"112⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\65D9.tmp"C:\Users\Admin\AppData\Local\Temp\65D9.tmp"113⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\6627.tmp"C:\Users\Admin\AppData\Local\Temp\6627.tmp"114⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\6685.tmp"C:\Users\Admin\AppData\Local\Temp\6685.tmp"115⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\66E3.tmp"C:\Users\Admin\AppData\Local\Temp\66E3.tmp"116⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\6741.tmp"C:\Users\Admin\AppData\Local\Temp\6741.tmp"117⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\679E.tmp"C:\Users\Admin\AppData\Local\Temp\679E.tmp"118⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\67FC.tmp"C:\Users\Admin\AppData\Local\Temp\67FC.tmp"119⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\684A.tmp"C:\Users\Admin\AppData\Local\Temp\684A.tmp"120⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\6898.tmp"C:\Users\Admin\AppData\Local\Temp\6898.tmp"121⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\68E6.tmp"C:\Users\Admin\AppData\Local\Temp\68E6.tmp"122⤵PID:4160
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-