Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
29/04/2024, 06:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-29_e4a0e3ee7735e6d7870ba5d22c4cef6b_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-04-29_e4a0e3ee7735e6d7870ba5d22c4cef6b_mafia.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-04-29_e4a0e3ee7735e6d7870ba5d22c4cef6b_mafia.exe
-
Size
486KB
-
MD5
e4a0e3ee7735e6d7870ba5d22c4cef6b
-
SHA1
f701e60c22c43a4b444d2c528709bfeb611128ef
-
SHA256
3d2b3bb97436be9c68213e6e895efb405aac0a4d918bdd35558f0156485d91e8
-
SHA512
74267752acd108eb0f4ae0e076f23d4fc588fd3b4215b1039a60a9dafd2958b5b78b6e2fc85b2cf4e4d1eaf8aa9b45f1920eae49034d3bf187af219b1e554db0
-
SSDEEP
12288:/U5rCOTeiDyg8UhGxdzBcaIf4rgprNp1BgNZ:/UQOJDyg8/xdzS4kVfgN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 116 4249.tmp 1896 42D5.tmp 3756 4343.tmp 1112 43FE.tmp 3380 447B.tmp 2988 4508.tmp 2424 4585.tmp 624 45D3.tmp 1736 4640.tmp 1204 46AE.tmp 2268 46FC.tmp 5096 4759.tmp 2628 47D6.tmp 2220 4834.tmp 1676 4882.tmp 2928 48E0.tmp 592 495D.tmp 3964 49DA.tmp 4680 4A47.tmp 2368 4A96.tmp 4608 4B22.tmp 4580 4B80.tmp 2116 4C0D.tmp 1636 4C99.tmp 3752 4CF7.tmp 2608 4D74.tmp 1580 4E01.tmp 5028 4E7E.tmp 796 4EFB.tmp 3288 4F87.tmp 4868 4FE5.tmp 4716 5043.tmp 4040 50C0.tmp 2916 510E.tmp 2332 516C.tmp 4960 51BA.tmp 3384 5217.tmp 5064 5275.tmp 4412 52C3.tmp 3940 5311.tmp 3724 5360.tmp 1164 53AE.tmp 3672 53FC.tmp 2944 545A.tmp 1996 54A8.tmp 5076 54F6.tmp 4520 5544.tmp 3292 5592.tmp 4540 55E0.tmp 3216 562E.tmp 3664 567C.tmp 1748 56CB.tmp 2676 5719.tmp 4244 57B5.tmp 3536 5803.tmp 548 5851.tmp 1212 58AF.tmp 1060 590D.tmp 4176 596A.tmp 4032 59B9.tmp 464 5A07.tmp 2192 5A45.tmp 1756 5A93.tmp 2624 5AF1.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 440 wrote to memory of 116 440 2024-04-29_e4a0e3ee7735e6d7870ba5d22c4cef6b_mafia.exe 83 PID 440 wrote to memory of 116 440 2024-04-29_e4a0e3ee7735e6d7870ba5d22c4cef6b_mafia.exe 83 PID 440 wrote to memory of 116 440 2024-04-29_e4a0e3ee7735e6d7870ba5d22c4cef6b_mafia.exe 83 PID 116 wrote to memory of 1896 116 4249.tmp 84 PID 116 wrote to memory of 1896 116 4249.tmp 84 PID 116 wrote to memory of 1896 116 4249.tmp 84 PID 1896 wrote to memory of 3756 1896 42D5.tmp 85 PID 1896 wrote to memory of 3756 1896 42D5.tmp 85 PID 1896 wrote to memory of 3756 1896 42D5.tmp 85 PID 3756 wrote to memory of 1112 3756 4343.tmp 88 PID 3756 wrote to memory of 1112 3756 4343.tmp 88 PID 3756 wrote to memory of 1112 3756 4343.tmp 88 PID 1112 wrote to memory of 3380 1112 43FE.tmp 90 PID 1112 wrote to memory of 3380 1112 43FE.tmp 90 PID 1112 wrote to memory of 3380 1112 43FE.tmp 90 PID 3380 wrote to memory of 2988 3380 447B.tmp 91 PID 3380 wrote to memory of 2988 3380 447B.tmp 91 PID 3380 wrote to memory of 2988 3380 447B.tmp 91 PID 2988 wrote to memory of 2424 2988 4508.tmp 92 PID 2988 wrote to memory of 2424 2988 4508.tmp 92 PID 2988 wrote to memory of 2424 2988 4508.tmp 92 PID 2424 wrote to memory of 624 2424 4585.tmp 93 PID 2424 wrote to memory of 624 2424 4585.tmp 93 PID 2424 wrote to memory of 624 2424 4585.tmp 93 PID 624 wrote to memory of 1736 624 45D3.tmp 94 PID 624 wrote to memory of 1736 624 45D3.tmp 94 PID 624 wrote to memory of 1736 624 45D3.tmp 94 PID 1736 wrote to memory of 1204 1736 4640.tmp 95 PID 1736 wrote to memory of 1204 1736 4640.tmp 95 PID 1736 wrote to memory of 1204 1736 4640.tmp 95 PID 1204 wrote to memory of 2268 1204 46AE.tmp 96 PID 1204 wrote to memory of 2268 1204 46AE.tmp 96 PID 1204 wrote to memory of 2268 1204 46AE.tmp 96 PID 2268 wrote to memory of 5096 2268 46FC.tmp 97 PID 2268 wrote to memory of 5096 2268 46FC.tmp 97 PID 2268 wrote to memory of 5096 2268 46FC.tmp 97 PID 5096 wrote to memory of 2628 5096 4759.tmp 98 PID 5096 wrote to memory of 2628 5096 4759.tmp 98 PID 5096 wrote to memory of 2628 5096 4759.tmp 98 PID 2628 wrote to memory of 2220 2628 47D6.tmp 99 PID 2628 wrote to memory of 2220 2628 47D6.tmp 99 PID 2628 wrote to memory of 2220 2628 47D6.tmp 99 PID 2220 wrote to memory of 1676 2220 4834.tmp 100 PID 2220 wrote to memory of 1676 2220 4834.tmp 100 PID 2220 wrote to memory of 1676 2220 4834.tmp 100 PID 1676 wrote to memory of 2928 1676 4882.tmp 101 PID 1676 wrote to memory of 2928 1676 4882.tmp 101 PID 1676 wrote to memory of 2928 1676 4882.tmp 101 PID 2928 wrote to memory of 592 2928 48E0.tmp 102 PID 2928 wrote to memory of 592 2928 48E0.tmp 102 PID 2928 wrote to memory of 592 2928 48E0.tmp 102 PID 592 wrote to memory of 3964 592 495D.tmp 103 PID 592 wrote to memory of 3964 592 495D.tmp 103 PID 592 wrote to memory of 3964 592 495D.tmp 103 PID 3964 wrote to memory of 4680 3964 49DA.tmp 104 PID 3964 wrote to memory of 4680 3964 49DA.tmp 104 PID 3964 wrote to memory of 4680 3964 49DA.tmp 104 PID 4680 wrote to memory of 2368 4680 4A47.tmp 105 PID 4680 wrote to memory of 2368 4680 4A47.tmp 105 PID 4680 wrote to memory of 2368 4680 4A47.tmp 105 PID 2368 wrote to memory of 4608 2368 4A96.tmp 106 PID 2368 wrote to memory of 4608 2368 4A96.tmp 106 PID 2368 wrote to memory of 4608 2368 4A96.tmp 106 PID 4608 wrote to memory of 4580 4608 4B22.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-29_e4a0e3ee7735e6d7870ba5d22c4cef6b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-29_e4a0e3ee7735e6d7870ba5d22c4cef6b_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\43FE.tmp"C:\Users\Admin\AppData\Local\Temp\43FE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\447B.tmp"C:\Users\Admin\AppData\Local\Temp\447B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\45D3.tmp"C:\Users\Admin\AppData\Local\Temp\45D3.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"23⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"24⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"25⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"26⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"27⤵
- Executes dropped EXE
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"28⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"29⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"30⤵
- Executes dropped EXE
PID:796 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"31⤵
- Executes dropped EXE
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"32⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"33⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"34⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"35⤵
- Executes dropped EXE
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"36⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"37⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"38⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"39⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"40⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"41⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"42⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"43⤵
- Executes dropped EXE
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"44⤵
- Executes dropped EXE
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"45⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"46⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"47⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"48⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"49⤵
- Executes dropped EXE
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"50⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"51⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"52⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"53⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"54⤵
- Executes dropped EXE
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"55⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"56⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"57⤵
- Executes dropped EXE
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"58⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"59⤵
- Executes dropped EXE
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"60⤵
- Executes dropped EXE
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"61⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"62⤵
- Executes dropped EXE
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"63⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"64⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"65⤵
- Executes dropped EXE
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"66⤵
- Executes dropped EXE
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"67⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"68⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"69⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"70⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"71⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"72⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"73⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"74⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"75⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"76⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"77⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"78⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"79⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"80⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"81⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"82⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"83⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"84⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"85⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"86⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"87⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"88⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"89⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"90⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"91⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"92⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"93⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"94⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"95⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"96⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"97⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"98⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"99⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"100⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"101⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"102⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"103⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"104⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"105⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"106⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"107⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"108⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"109⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"110⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"111⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"112⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"113⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"114⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"115⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"116⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"117⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"118⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"119⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"120⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"121⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"122⤵PID:2936
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-