Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 19:30
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-27_b62cb44098c46f21e731f128169381ce_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-27_b62cb44098c46f21e731f128169381ce_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-27_b62cb44098c46f21e731f128169381ce_mafia.exe
-
Size
541KB
-
MD5
b62cb44098c46f21e731f128169381ce
-
SHA1
54de98098fe8ceb2c1dacce3438a3b925b6e7996
-
SHA256
aa59b5db0ef595a76337baf6e714fdfcd713d28e15cab723bf5ea6c7c40b6ad1
-
SHA512
5077b3fb4459b3422df3abfd63985424d864d68a7510cb9c872e495d457c242c564183509c4e52ae8a7c9d1c85664eb58a3cf4fffa8e20b4559bf9b8679409b9
-
SSDEEP
12288:UU5rCOTeifVUobwzZv9KZpYpp0WHgEO19Xl8brZa73ctO:UUQOJfVUEKLKZpLl8brU73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 748 4508.tmp 4548 45A4.tmp 4296 4602.tmp 1288 466F.tmp 4240 46CD.tmp 3780 473A.tmp 4292 4798.tmp 3116 4815.tmp 2500 4873.tmp 408 48FF.tmp 2460 496D.tmp 2984 49BB.tmp 4768 4A19.tmp 4236 4A76.tmp 2028 4AC4.tmp 4456 4B22.tmp 3200 4B80.tmp 3176 4BCE.tmp 1348 4C4B.tmp 3012 4C99.tmp 3980 4CE7.tmp 1880 4D55.tmp 4144 4DF1.tmp 2020 4E6E.tmp 4124 4EBC.tmp 1556 4F0A.tmp 1512 4F97.tmp 5032 4FF5.tmp 3336 5043.tmp 5076 50A0.tmp 4912 510E.tmp 1956 516C.tmp 4424 5217.tmp 3128 5266.tmp 540 5311.tmp 4296 5360.tmp 3060 53AE.tmp 1320 540B.tmp 3680 545A.tmp 1196 54A8.tmp 4804 5505.tmp 712 5554.tmp 3780 55A2.tmp 4512 55F0.tmp 3764 564E.tmp 4688 569C.tmp 1820 56F9.tmp 2720 5748.tmp 2676 57B5.tmp 1432 5803.tmp 3632 5861.tmp 3912 58AF.tmp 1696 58FD.tmp 4768 594B.tmp 2880 59A9.tmp 1116 59F7.tmp 448 5A55.tmp 1908 5AB3.tmp 4744 5B10.tmp 736 5B5E.tmp 3428 5BBC.tmp 1348 5C0A.tmp 1388 5C68.tmp 1012 5CB6.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 452 wrote to memory of 748 452 2024-05-27_b62cb44098c46f21e731f128169381ce_mafia.exe 83 PID 452 wrote to memory of 748 452 2024-05-27_b62cb44098c46f21e731f128169381ce_mafia.exe 83 PID 452 wrote to memory of 748 452 2024-05-27_b62cb44098c46f21e731f128169381ce_mafia.exe 83 PID 748 wrote to memory of 4548 748 4508.tmp 84 PID 748 wrote to memory of 4548 748 4508.tmp 84 PID 748 wrote to memory of 4548 748 4508.tmp 84 PID 4548 wrote to memory of 4296 4548 45A4.tmp 85 PID 4548 wrote to memory of 4296 4548 45A4.tmp 85 PID 4548 wrote to memory of 4296 4548 45A4.tmp 85 PID 4296 wrote to memory of 1288 4296 4602.tmp 87 PID 4296 wrote to memory of 1288 4296 4602.tmp 87 PID 4296 wrote to memory of 1288 4296 4602.tmp 87 PID 1288 wrote to memory of 4240 1288 466F.tmp 88 PID 1288 wrote to memory of 4240 1288 466F.tmp 88 PID 1288 wrote to memory of 4240 1288 466F.tmp 88 PID 4240 wrote to memory of 3780 4240 46CD.tmp 90 PID 4240 wrote to memory of 3780 4240 46CD.tmp 90 PID 4240 wrote to memory of 3780 4240 46CD.tmp 90 PID 3780 wrote to memory of 4292 3780 473A.tmp 91 PID 3780 wrote to memory of 4292 3780 473A.tmp 91 PID 3780 wrote to memory of 4292 3780 473A.tmp 91 PID 4292 wrote to memory of 3116 4292 4798.tmp 93 PID 4292 wrote to memory of 3116 4292 4798.tmp 93 PID 4292 wrote to memory of 3116 4292 4798.tmp 93 PID 3116 wrote to memory of 2500 3116 4815.tmp 94 PID 3116 wrote to memory of 2500 3116 4815.tmp 94 PID 3116 wrote to memory of 2500 3116 4815.tmp 94 PID 2500 wrote to memory of 408 2500 4873.tmp 95 PID 2500 wrote to memory of 408 2500 4873.tmp 95 PID 2500 wrote to memory of 408 2500 4873.tmp 95 PID 408 wrote to memory of 2460 408 48FF.tmp 96 PID 408 wrote to memory of 2460 408 48FF.tmp 96 PID 408 wrote to memory of 2460 408 48FF.tmp 96 PID 2460 wrote to memory of 2984 2460 496D.tmp 97 PID 2460 wrote to memory of 2984 2460 496D.tmp 97 PID 2460 wrote to memory of 2984 2460 496D.tmp 97 PID 2984 wrote to memory of 4768 2984 49BB.tmp 98 PID 2984 wrote to memory of 4768 2984 49BB.tmp 98 PID 2984 wrote to memory of 4768 2984 49BB.tmp 98 PID 4768 wrote to memory of 4236 4768 4A19.tmp 99 PID 4768 wrote to memory of 4236 4768 4A19.tmp 99 PID 4768 wrote to memory of 4236 4768 4A19.tmp 99 PID 4236 wrote to memory of 2028 4236 4A76.tmp 100 PID 4236 wrote to memory of 2028 4236 4A76.tmp 100 PID 4236 wrote to memory of 2028 4236 4A76.tmp 100 PID 2028 wrote to memory of 4456 2028 4AC4.tmp 101 PID 2028 wrote to memory of 4456 2028 4AC4.tmp 101 PID 2028 wrote to memory of 4456 2028 4AC4.tmp 101 PID 4456 wrote to memory of 3200 4456 4B22.tmp 102 PID 4456 wrote to memory of 3200 4456 4B22.tmp 102 PID 4456 wrote to memory of 3200 4456 4B22.tmp 102 PID 3200 wrote to memory of 3176 3200 4B80.tmp 103 PID 3200 wrote to memory of 3176 3200 4B80.tmp 103 PID 3200 wrote to memory of 3176 3200 4B80.tmp 103 PID 3176 wrote to memory of 1348 3176 4BCE.tmp 104 PID 3176 wrote to memory of 1348 3176 4BCE.tmp 104 PID 3176 wrote to memory of 1348 3176 4BCE.tmp 104 PID 1348 wrote to memory of 3012 1348 4C4B.tmp 105 PID 1348 wrote to memory of 3012 1348 4C4B.tmp 105 PID 1348 wrote to memory of 3012 1348 4C4B.tmp 105 PID 3012 wrote to memory of 3980 3012 4C99.tmp 106 PID 3012 wrote to memory of 3980 3012 4C99.tmp 106 PID 3012 wrote to memory of 3980 3012 4C99.tmp 106 PID 3980 wrote to memory of 1880 3980 4CE7.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_b62cb44098c46f21e731f128169381ce_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_b62cb44098c46f21e731f128169381ce_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\4602.tmp"C:\Users\Admin\AppData\Local\Temp\4602.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\4A19.tmp"C:\Users\Admin\AppData\Local\Temp\4A19.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"23⤵
- Executes dropped EXE
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"24⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"25⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"26⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"27⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"28⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"29⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"30⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"31⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"32⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"33⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"34⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"35⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"36⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"37⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"38⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"39⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"40⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"41⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"42⤵
- Executes dropped EXE
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"43⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"44⤵
- Executes dropped EXE
PID:712 -
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"45⤵
- Executes dropped EXE
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"46⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"47⤵
- Executes dropped EXE
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"48⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"49⤵
- Executes dropped EXE
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"50⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"51⤵
- Executes dropped EXE
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"52⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"53⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"54⤵
- Executes dropped EXE
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"55⤵
- Executes dropped EXE
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"56⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"57⤵
- Executes dropped EXE
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"58⤵
- Executes dropped EXE
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"59⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"60⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"61⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"62⤵
- Executes dropped EXE
PID:736 -
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"63⤵
- Executes dropped EXE
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"64⤵
- Executes dropped EXE
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"65⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"66⤵
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"67⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"68⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"69⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"70⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"71⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"72⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"73⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"74⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"75⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"76⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"77⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"78⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"79⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"80⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"81⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"82⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"83⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"84⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"85⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"86⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"87⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"88⤵PID:524
-
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"89⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"90⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"91⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"92⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"93⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"94⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"95⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"96⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"97⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"98⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"99⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"100⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"101⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"102⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"103⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"104⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"105⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"106⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"107⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"108⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"109⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"110⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"111⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"112⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"113⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"114⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"115⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"116⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"117⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"118⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"119⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"120⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"121⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"122⤵PID:2384
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-