Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 21:47
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-30_172fa0995f9bffdac17c2ee5eab069f5_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-05-30_172fa0995f9bffdac17c2ee5eab069f5_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-30_172fa0995f9bffdac17c2ee5eab069f5_mafia.exe
-
Size
520KB
-
MD5
172fa0995f9bffdac17c2ee5eab069f5
-
SHA1
e27798d25c06ab0564e715702146bb0ddc455215
-
SHA256
883c22c7a7e49b51d3accc044e2877da2a798300b96720ee5e4f1c4de0912749
-
SHA512
28ac175cab786d7167a9276a43c150d151318c7047759f8e4ce1cc53904d7f09122576b1bae199f83925066c565a311935ddf8c5e08321826b5e73ea4c1889d2
-
SSDEEP
12288:roRXOQjmOyuMqWHhMzdSur/BRiep+jI0kIXNZ:rogQ9yuChKSs9pGNkIXN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4196 3D28.tmp 2772 3DF3.tmp 4656 3E70.tmp 2388 3F0C.tmp 3144 3F7A.tmp 964 3FF7.tmp 3684 4055.tmp 5080 40D2.tmp 2292 413F.tmp 2272 41AC.tmp 400 4249.tmp 4392 42F4.tmp 4388 4371.tmp 3620 43EE.tmp 2284 447B.tmp 4308 4508.tmp 4692 4565.tmp 4908 45C3.tmp 3252 4631.tmp 2220 46AE.tmp 3204 472B.tmp 4836 47B7.tmp 4796 4815.tmp 3232 4873.tmp 3748 48F0.tmp 2016 494D.tmp 1456 49F9.tmp 2612 4A67.tmp 4124 4AB5.tmp 5072 4B32.tmp 3832 4B80.tmp 3600 4BED.tmp 4864 4C4B.tmp 4420 4C99.tmp 4528 4CE7.tmp 3236 4D45.tmp 2532 4D93.tmp 1244 4DE1.tmp 4752 4E3F.tmp 2448 4E8D.tmp 4176 4EEB.tmp 3944 4F39.tmp 3908 4FD5.tmp 336 5033.tmp 4196 5081.tmp 2640 50CF.tmp 1240 512D.tmp 2408 518B.tmp 4080 51D9.tmp 1004 5237.tmp 2316 5285.tmp 4020 52E3.tmp 3572 5331.tmp 3332 537F.tmp 3172 53CD.tmp 1272 541B.tmp 732 5479.tmp 1580 54C7.tmp 5092 5525.tmp 2292 5573.tmp 4816 55D1.tmp 2928 561F.tmp 1028 566D.tmp 2200 56BB.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2948 wrote to memory of 4196 2948 2024-05-30_172fa0995f9bffdac17c2ee5eab069f5_mafia.exe 82 PID 2948 wrote to memory of 4196 2948 2024-05-30_172fa0995f9bffdac17c2ee5eab069f5_mafia.exe 82 PID 2948 wrote to memory of 4196 2948 2024-05-30_172fa0995f9bffdac17c2ee5eab069f5_mafia.exe 82 PID 4196 wrote to memory of 2772 4196 3D28.tmp 83 PID 4196 wrote to memory of 2772 4196 3D28.tmp 83 PID 4196 wrote to memory of 2772 4196 3D28.tmp 83 PID 2772 wrote to memory of 4656 2772 3DF3.tmp 85 PID 2772 wrote to memory of 4656 2772 3DF3.tmp 85 PID 2772 wrote to memory of 4656 2772 3DF3.tmp 85 PID 4656 wrote to memory of 2388 4656 3E70.tmp 86 PID 4656 wrote to memory of 2388 4656 3E70.tmp 86 PID 4656 wrote to memory of 2388 4656 3E70.tmp 86 PID 2388 wrote to memory of 3144 2388 3F0C.tmp 88 PID 2388 wrote to memory of 3144 2388 3F0C.tmp 88 PID 2388 wrote to memory of 3144 2388 3F0C.tmp 88 PID 3144 wrote to memory of 964 3144 3F7A.tmp 90 PID 3144 wrote to memory of 964 3144 3F7A.tmp 90 PID 3144 wrote to memory of 964 3144 3F7A.tmp 90 PID 964 wrote to memory of 3684 964 3FF7.tmp 91 PID 964 wrote to memory of 3684 964 3FF7.tmp 91 PID 964 wrote to memory of 3684 964 3FF7.tmp 91 PID 3684 wrote to memory of 5080 3684 4055.tmp 92 PID 3684 wrote to memory of 5080 3684 4055.tmp 92 PID 3684 wrote to memory of 5080 3684 4055.tmp 92 PID 5080 wrote to memory of 2292 5080 40D2.tmp 93 PID 5080 wrote to memory of 2292 5080 40D2.tmp 93 PID 5080 wrote to memory of 2292 5080 40D2.tmp 93 PID 2292 wrote to memory of 2272 2292 413F.tmp 94 PID 2292 wrote to memory of 2272 2292 413F.tmp 94 PID 2292 wrote to memory of 2272 2292 413F.tmp 94 PID 2272 wrote to memory of 400 2272 41AC.tmp 95 PID 2272 wrote to memory of 400 2272 41AC.tmp 95 PID 2272 wrote to memory of 400 2272 41AC.tmp 95 PID 400 wrote to memory of 4392 400 4249.tmp 96 PID 400 wrote to memory of 4392 400 4249.tmp 96 PID 400 wrote to memory of 4392 400 4249.tmp 96 PID 4392 wrote to memory of 4388 4392 42F4.tmp 97 PID 4392 wrote to memory of 4388 4392 42F4.tmp 97 PID 4392 wrote to memory of 4388 4392 42F4.tmp 97 PID 4388 wrote to memory of 3620 4388 4371.tmp 98 PID 4388 wrote to memory of 3620 4388 4371.tmp 98 PID 4388 wrote to memory of 3620 4388 4371.tmp 98 PID 3620 wrote to memory of 2284 3620 43EE.tmp 99 PID 3620 wrote to memory of 2284 3620 43EE.tmp 99 PID 3620 wrote to memory of 2284 3620 43EE.tmp 99 PID 2284 wrote to memory of 4308 2284 447B.tmp 100 PID 2284 wrote to memory of 4308 2284 447B.tmp 100 PID 2284 wrote to memory of 4308 2284 447B.tmp 100 PID 4308 wrote to memory of 4692 4308 4508.tmp 101 PID 4308 wrote to memory of 4692 4308 4508.tmp 101 PID 4308 wrote to memory of 4692 4308 4508.tmp 101 PID 4692 wrote to memory of 4908 4692 4565.tmp 102 PID 4692 wrote to memory of 4908 4692 4565.tmp 102 PID 4692 wrote to memory of 4908 4692 4565.tmp 102 PID 4908 wrote to memory of 3252 4908 45C3.tmp 103 PID 4908 wrote to memory of 3252 4908 45C3.tmp 103 PID 4908 wrote to memory of 3252 4908 45C3.tmp 103 PID 3252 wrote to memory of 2220 3252 4631.tmp 104 PID 3252 wrote to memory of 2220 3252 4631.tmp 104 PID 3252 wrote to memory of 2220 3252 4631.tmp 104 PID 2220 wrote to memory of 3204 2220 46AE.tmp 105 PID 2220 wrote to memory of 3204 2220 46AE.tmp 105 PID 2220 wrote to memory of 3204 2220 46AE.tmp 105 PID 3204 wrote to memory of 4836 3204 472B.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-30_172fa0995f9bffdac17c2ee5eab069f5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-30_172fa0995f9bffdac17c2ee5eab069f5_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\3D28.tmp"C:\Users\Admin\AppData\Local\Temp\3D28.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\3E70.tmp"C:\Users\Admin\AppData\Local\Temp\3E70.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\4055.tmp"C:\Users\Admin\AppData\Local\Temp\4055.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\40D2.tmp"C:\Users\Admin\AppData\Local\Temp\40D2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\413F.tmp"C:\Users\Admin\AppData\Local\Temp\413F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\41AC.tmp"C:\Users\Admin\AppData\Local\Temp\41AC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\42F4.tmp"C:\Users\Admin\AppData\Local\Temp\42F4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\4371.tmp"C:\Users\Admin\AppData\Local\Temp\4371.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\447B.tmp"C:\Users\Admin\AppData\Local\Temp\447B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\4565.tmp"C:\Users\Admin\AppData\Local\Temp\4565.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"23⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"24⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"25⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"26⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"27⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"28⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"29⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"30⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"31⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"32⤵
- Executes dropped EXE
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"33⤵
- Executes dropped EXE
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"34⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"35⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"36⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"37⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"38⤵
- Executes dropped EXE
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"39⤵
- Executes dropped EXE
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"40⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"41⤵
- Executes dropped EXE
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"42⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"43⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"44⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"45⤵
- Executes dropped EXE
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"46⤵
- Executes dropped EXE
PID:336 -
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"47⤵
- Executes dropped EXE
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"48⤵
- Executes dropped EXE
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"49⤵
- Executes dropped EXE
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"50⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"51⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"52⤵
- Executes dropped EXE
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"53⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"54⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"55⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"56⤵
- Executes dropped EXE
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"57⤵
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"58⤵
- Executes dropped EXE
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"59⤵
- Executes dropped EXE
PID:732 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"60⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"61⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"62⤵
- Executes dropped EXE
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"63⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"64⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"65⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"66⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"67⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"68⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"69⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"70⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"71⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"72⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"73⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"74⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"75⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"76⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"77⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"78⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"79⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"80⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"81⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"82⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"83⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"84⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"85⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"86⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"87⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"88⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"89⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"90⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"91⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"92⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"93⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"94⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"95⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"96⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"97⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"98⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"99⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"100⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"101⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"102⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"103⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"104⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"105⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"106⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"107⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"108⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"109⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"110⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"111⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"112⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"113⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"114⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"115⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"116⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"117⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"118⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"119⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"120⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"121⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"122⤵PID:696
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-