Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2024, 13:40
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-17_ffd4999822baee52c4613a7a9101cb22_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-17_ffd4999822baee52c4613a7a9101cb22_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-17_ffd4999822baee52c4613a7a9101cb22_mafia.exe
-
Size
765KB
-
MD5
ffd4999822baee52c4613a7a9101cb22
-
SHA1
31d80d85b0f2420cc3ff8dfaab47b70bdfc4cad2
-
SHA256
fb0a443de38b926852e4d041cec63d8cf898498106bbb3c5980e97ba1ecdba8d
-
SHA512
2901da3d6d4fb41c569b8909123dff03cf01495393bdf163673c59f771dc60e12a3d3e35a7a6e577524160251c377efade13ca1cde84ccc6d00fde7dcbd5efdd
-
SSDEEP
12288:ZU5rCOTeiDKF6JauvvcBLvvIbRT09N3j5YFx3ZF5rn5rLOa54U5w5A:ZUQOJDD5vUdnwayb3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 368 3D09.tmp 2052 3D95.tmp 2676 3DE4.tmp 4788 3E70.tmp 1640 3ECE.tmp 60 3F2C.tmp 2344 3F89.tmp 3240 3FD8.tmp 1660 4035.tmp 2248 40B2.tmp 3420 4110.tmp 5036 419D.tmp 4980 421A.tmp 4476 4287.tmp 1764 42E5.tmp 2284 4391.tmp 3656 43EE.tmp 3504 444C.tmp 4488 44AA.tmp 1068 4508.tmp 732 4575.tmp 2356 4602.tmp 3636 4650.tmp 2684 46CD.tmp 3932 4769.tmp 2096 47E6.tmp 3008 4844.tmp 2244 48B1.tmp 1828 491F.tmp 1492 498C.tmp 2908 4A19.tmp 4384 4A86.tmp 4616 4B13.tmp 4564 4B61.tmp 880 4BAF.tmp 3812 4C0D.tmp 4340 4C6A.tmp 4312 4CC8.tmp 1464 4D16.tmp 380 4D64.tmp 4764 4DB2.tmp 4804 4E01.tmp 2564 4E5E.tmp 1476 4ECC.tmp 3172 4F1A.tmp 3772 4F78.tmp 3052 4FD5.tmp 4512 5023.tmp 3132 5081.tmp 2248 50DF.tmp 4880 513D.tmp 3948 519A.tmp 2172 51E9.tmp 1368 5246.tmp 4860 52B4.tmp 1888 5311.tmp 4476 536F.tmp 1384 53CD.tmp 2860 541B.tmp 5080 5479.tmp 3664 54C7.tmp 3648 5515.tmp 4160 5573.tmp 2376 55C1.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4736 wrote to memory of 368 4736 2024-05-17_ffd4999822baee52c4613a7a9101cb22_mafia.exe 83 PID 4736 wrote to memory of 368 4736 2024-05-17_ffd4999822baee52c4613a7a9101cb22_mafia.exe 83 PID 4736 wrote to memory of 368 4736 2024-05-17_ffd4999822baee52c4613a7a9101cb22_mafia.exe 83 PID 368 wrote to memory of 2052 368 3D09.tmp 84 PID 368 wrote to memory of 2052 368 3D09.tmp 84 PID 368 wrote to memory of 2052 368 3D09.tmp 84 PID 2052 wrote to memory of 2676 2052 3D95.tmp 85 PID 2052 wrote to memory of 2676 2052 3D95.tmp 85 PID 2052 wrote to memory of 2676 2052 3D95.tmp 85 PID 2676 wrote to memory of 4788 2676 3DE4.tmp 86 PID 2676 wrote to memory of 4788 2676 3DE4.tmp 86 PID 2676 wrote to memory of 4788 2676 3DE4.tmp 86 PID 4788 wrote to memory of 1640 4788 3E70.tmp 88 PID 4788 wrote to memory of 1640 4788 3E70.tmp 88 PID 4788 wrote to memory of 1640 4788 3E70.tmp 88 PID 1640 wrote to memory of 60 1640 3ECE.tmp 89 PID 1640 wrote to memory of 60 1640 3ECE.tmp 89 PID 1640 wrote to memory of 60 1640 3ECE.tmp 89 PID 60 wrote to memory of 2344 60 3F2C.tmp 91 PID 60 wrote to memory of 2344 60 3F2C.tmp 91 PID 60 wrote to memory of 2344 60 3F2C.tmp 91 PID 2344 wrote to memory of 3240 2344 3F89.tmp 93 PID 2344 wrote to memory of 3240 2344 3F89.tmp 93 PID 2344 wrote to memory of 3240 2344 3F89.tmp 93 PID 3240 wrote to memory of 1660 3240 3FD8.tmp 94 PID 3240 wrote to memory of 1660 3240 3FD8.tmp 94 PID 3240 wrote to memory of 1660 3240 3FD8.tmp 94 PID 1660 wrote to memory of 2248 1660 4035.tmp 95 PID 1660 wrote to memory of 2248 1660 4035.tmp 95 PID 1660 wrote to memory of 2248 1660 4035.tmp 95 PID 2248 wrote to memory of 3420 2248 40B2.tmp 97 PID 2248 wrote to memory of 3420 2248 40B2.tmp 97 PID 2248 wrote to memory of 3420 2248 40B2.tmp 97 PID 3420 wrote to memory of 5036 3420 4110.tmp 98 PID 3420 wrote to memory of 5036 3420 4110.tmp 98 PID 3420 wrote to memory of 5036 3420 4110.tmp 98 PID 5036 wrote to memory of 4980 5036 419D.tmp 99 PID 5036 wrote to memory of 4980 5036 419D.tmp 99 PID 5036 wrote to memory of 4980 5036 419D.tmp 99 PID 4980 wrote to memory of 4476 4980 421A.tmp 100 PID 4980 wrote to memory of 4476 4980 421A.tmp 100 PID 4980 wrote to memory of 4476 4980 421A.tmp 100 PID 4476 wrote to memory of 1764 4476 4287.tmp 101 PID 4476 wrote to memory of 1764 4476 4287.tmp 101 PID 4476 wrote to memory of 1764 4476 4287.tmp 101 PID 1764 wrote to memory of 2284 1764 42E5.tmp 102 PID 1764 wrote to memory of 2284 1764 42E5.tmp 102 PID 1764 wrote to memory of 2284 1764 42E5.tmp 102 PID 2284 wrote to memory of 3656 2284 4391.tmp 103 PID 2284 wrote to memory of 3656 2284 4391.tmp 103 PID 2284 wrote to memory of 3656 2284 4391.tmp 103 PID 3656 wrote to memory of 3504 3656 43EE.tmp 104 PID 3656 wrote to memory of 3504 3656 43EE.tmp 104 PID 3656 wrote to memory of 3504 3656 43EE.tmp 104 PID 3504 wrote to memory of 4488 3504 444C.tmp 105 PID 3504 wrote to memory of 4488 3504 444C.tmp 105 PID 3504 wrote to memory of 4488 3504 444C.tmp 105 PID 4488 wrote to memory of 1068 4488 44AA.tmp 106 PID 4488 wrote to memory of 1068 4488 44AA.tmp 106 PID 4488 wrote to memory of 1068 4488 44AA.tmp 106 PID 1068 wrote to memory of 732 1068 4508.tmp 107 PID 1068 wrote to memory of 732 1068 4508.tmp 107 PID 1068 wrote to memory of 732 1068 4508.tmp 107 PID 732 wrote to memory of 2356 732 4575.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-17_ffd4999822baee52c4613a7a9101cb22_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-17_ffd4999822baee52c4613a7a9101cb22_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\3D09.tmp"C:\Users\Admin\AppData\Local\Temp\3D09.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\3D95.tmp"C:\Users\Admin\AppData\Local\Temp\3D95.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\3E70.tmp"C:\Users\Admin\AppData\Local\Temp\3E70.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\3F89.tmp"C:\Users\Admin\AppData\Local\Temp\3F89.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\4035.tmp"C:\Users\Admin\AppData\Local\Temp\4035.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\4110.tmp"C:\Users\Admin\AppData\Local\Temp\4110.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\419D.tmp"C:\Users\Admin\AppData\Local\Temp\419D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\421A.tmp"C:\Users\Admin\AppData\Local\Temp\421A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\4287.tmp"C:\Users\Admin\AppData\Local\Temp\4287.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\44AA.tmp"C:\Users\Admin\AppData\Local\Temp\44AA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Users\Admin\AppData\Local\Temp\4602.tmp"C:\Users\Admin\AppData\Local\Temp\4602.tmp"23⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"24⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"25⤵
- Executes dropped EXE
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"26⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"27⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"28⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\48B1.tmp"C:\Users\Admin\AppData\Local\Temp\48B1.tmp"29⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"30⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"31⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\4A19.tmp"C:\Users\Admin\AppData\Local\Temp\4A19.tmp"32⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"33⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"34⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"35⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"36⤵
- Executes dropped EXE
PID:880 -
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"37⤵
- Executes dropped EXE
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"38⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"39⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"40⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"41⤵
- Executes dropped EXE
PID:380 -
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"42⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"43⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"44⤵
- Executes dropped EXE
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"45⤵
- Executes dropped EXE
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"46⤵
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"47⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"48⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"49⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"50⤵
- Executes dropped EXE
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"51⤵
- Executes dropped EXE
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"52⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"53⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"54⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"55⤵
- Executes dropped EXE
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"56⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"57⤵
- Executes dropped EXE
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"58⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"59⤵
- Executes dropped EXE
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"60⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"61⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"62⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"63⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"64⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"65⤵
- Executes dropped EXE
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"66⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"67⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"68⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"69⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"70⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"71⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"72⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"73⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"74⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"75⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"76⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"77⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"78⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"79⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"80⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"81⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"82⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"83⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"84⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"85⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"86⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"87⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"88⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"89⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"90⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"91⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"92⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"93⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"94⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"95⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"96⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"97⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"98⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"99⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"100⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"101⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"102⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"103⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"104⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"105⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"106⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"107⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"108⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"109⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"110⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"111⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"112⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"113⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"114⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"115⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"116⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"117⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"118⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"119⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"120⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"121⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"122⤵PID:1576
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-