Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10/06/2024, 20:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-10_4549ae7e89f1d69c147e79b1d104abc5_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-06-10_4549ae7e89f1d69c147e79b1d104abc5_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-06-10_4549ae7e89f1d69c147e79b1d104abc5_mafia.exe
-
Size
487KB
-
MD5
4549ae7e89f1d69c147e79b1d104abc5
-
SHA1
17079108641abf89eb10bbf912fae36cb7ffaa7e
-
SHA256
92c334d45e93ec8faaebf57d89ff3e62ee35bc5825184178b63ed76830222d2e
-
SHA512
be7478b3a5317d4cb4dac1afc8a2d5872746ddc2335ae2656abd64fdc46568f6707aa7cf4e2b07cc4e81e3e6c6a0f5f73ea48c09e091487b2d9fe1dea2fa60a2
-
SSDEEP
12288:HU5rCOTeiJ1wD1+kTEEJfP7sqE9oBFtNZ:HUQOJJ1s1ZT5srohN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 944 4110.tmp 2756 417D.tmp 2884 41FA.tmp 3328 4287.tmp 2684 4304.tmp 1168 4371.tmp 2340 43C0.tmp 3684 440E.tmp 3388 446B.tmp 4460 44C9.tmp 2300 4527.tmp 4600 45A4.tmp 368 4621.tmp 1904 469E.tmp 4604 470B.tmp 548 4769.tmp 2792 47D6.tmp 1592 4844.tmp 5016 4892.tmp 4652 48E0.tmp 1532 492E.tmp 1328 497C.tmp 1832 4A09.tmp 3840 4A67.tmp 3472 4AC4.tmp 4352 4B22.tmp 3404 4B80.tmp 1156 4BDE.tmp 1776 4C3B.tmp 4700 4C8A.tmp 4452 4CE7.tmp 4032 4D64.tmp 208 4DB2.tmp 4716 4E01.tmp 1376 4E4F.tmp 728 4ECC.tmp 2836 4F29.tmp 4672 4F87.tmp 1420 4FD5.tmp 3496 5033.tmp 4952 5091.tmp 3916 50DF.tmp 2444 513D.tmp 4292 519A.tmp 896 51E9.tmp 1200 5237.tmp 1052 5285.tmp 2448 52E3.tmp 4968 5331.tmp 1956 538E.tmp 4820 53DD.tmp 3352 543A.tmp 3176 5488.tmp 312 54E6.tmp 2072 5534.tmp 4480 5582.tmp 2308 55D1.tmp 4836 562E.tmp 2856 568C.tmp 4816 56DA.tmp 2536 5728.tmp 2884 5776.tmp 2572 57D4.tmp 1728 5832.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3636 wrote to memory of 944 3636 2024-06-10_4549ae7e89f1d69c147e79b1d104abc5_mafia.exe 80 PID 3636 wrote to memory of 944 3636 2024-06-10_4549ae7e89f1d69c147e79b1d104abc5_mafia.exe 80 PID 3636 wrote to memory of 944 3636 2024-06-10_4549ae7e89f1d69c147e79b1d104abc5_mafia.exe 80 PID 944 wrote to memory of 2756 944 4110.tmp 81 PID 944 wrote to memory of 2756 944 4110.tmp 81 PID 944 wrote to memory of 2756 944 4110.tmp 81 PID 2756 wrote to memory of 2884 2756 417D.tmp 82 PID 2756 wrote to memory of 2884 2756 417D.tmp 82 PID 2756 wrote to memory of 2884 2756 417D.tmp 82 PID 2884 wrote to memory of 3328 2884 41FA.tmp 83 PID 2884 wrote to memory of 3328 2884 41FA.tmp 83 PID 2884 wrote to memory of 3328 2884 41FA.tmp 83 PID 3328 wrote to memory of 2684 3328 4287.tmp 84 PID 3328 wrote to memory of 2684 3328 4287.tmp 84 PID 3328 wrote to memory of 2684 3328 4287.tmp 84 PID 2684 wrote to memory of 1168 2684 4304.tmp 85 PID 2684 wrote to memory of 1168 2684 4304.tmp 85 PID 2684 wrote to memory of 1168 2684 4304.tmp 85 PID 1168 wrote to memory of 2340 1168 4371.tmp 86 PID 1168 wrote to memory of 2340 1168 4371.tmp 86 PID 1168 wrote to memory of 2340 1168 4371.tmp 86 PID 2340 wrote to memory of 3684 2340 43C0.tmp 87 PID 2340 wrote to memory of 3684 2340 43C0.tmp 87 PID 2340 wrote to memory of 3684 2340 43C0.tmp 87 PID 3684 wrote to memory of 3388 3684 440E.tmp 88 PID 3684 wrote to memory of 3388 3684 440E.tmp 88 PID 3684 wrote to memory of 3388 3684 440E.tmp 88 PID 3388 wrote to memory of 4460 3388 446B.tmp 89 PID 3388 wrote to memory of 4460 3388 446B.tmp 89 PID 3388 wrote to memory of 4460 3388 446B.tmp 89 PID 4460 wrote to memory of 2300 4460 44C9.tmp 90 PID 4460 wrote to memory of 2300 4460 44C9.tmp 90 PID 4460 wrote to memory of 2300 4460 44C9.tmp 90 PID 2300 wrote to memory of 4600 2300 4527.tmp 91 PID 2300 wrote to memory of 4600 2300 4527.tmp 91 PID 2300 wrote to memory of 4600 2300 4527.tmp 91 PID 4600 wrote to memory of 368 4600 45A4.tmp 92 PID 4600 wrote to memory of 368 4600 45A4.tmp 92 PID 4600 wrote to memory of 368 4600 45A4.tmp 92 PID 368 wrote to memory of 1904 368 4621.tmp 93 PID 368 wrote to memory of 1904 368 4621.tmp 93 PID 368 wrote to memory of 1904 368 4621.tmp 93 PID 1904 wrote to memory of 4604 1904 469E.tmp 94 PID 1904 wrote to memory of 4604 1904 469E.tmp 94 PID 1904 wrote to memory of 4604 1904 469E.tmp 94 PID 4604 wrote to memory of 548 4604 470B.tmp 95 PID 4604 wrote to memory of 548 4604 470B.tmp 95 PID 4604 wrote to memory of 548 4604 470B.tmp 95 PID 548 wrote to memory of 2792 548 4769.tmp 96 PID 548 wrote to memory of 2792 548 4769.tmp 96 PID 548 wrote to memory of 2792 548 4769.tmp 96 PID 2792 wrote to memory of 1592 2792 47D6.tmp 97 PID 2792 wrote to memory of 1592 2792 47D6.tmp 97 PID 2792 wrote to memory of 1592 2792 47D6.tmp 97 PID 1592 wrote to memory of 5016 1592 4844.tmp 98 PID 1592 wrote to memory of 5016 1592 4844.tmp 98 PID 1592 wrote to memory of 5016 1592 4844.tmp 98 PID 5016 wrote to memory of 4652 5016 4892.tmp 99 PID 5016 wrote to memory of 4652 5016 4892.tmp 99 PID 5016 wrote to memory of 4652 5016 4892.tmp 99 PID 4652 wrote to memory of 1532 4652 48E0.tmp 100 PID 4652 wrote to memory of 1532 4652 48E0.tmp 100 PID 4652 wrote to memory of 1532 4652 48E0.tmp 100 PID 1532 wrote to memory of 1328 1532 492E.tmp 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-10_4549ae7e89f1d69c147e79b1d104abc5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-10_4549ae7e89f1d69c147e79b1d104abc5_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\4110.tmp"C:\Users\Admin\AppData\Local\Temp\4110.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\4287.tmp"C:\Users\Admin\AppData\Local\Temp\4287.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\4304.tmp"C:\Users\Admin\AppData\Local\Temp\4304.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\4371.tmp"C:\Users\Admin\AppData\Local\Temp\4371.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\43C0.tmp"C:\Users\Admin\AppData\Local\Temp\43C0.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"23⤵
- Executes dropped EXE
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"24⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"25⤵
- Executes dropped EXE
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"26⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"27⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"28⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"29⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"30⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"31⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"32⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"33⤵
- Executes dropped EXE
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"34⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"35⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"36⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"37⤵
- Executes dropped EXE
PID:728 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"38⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"39⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"40⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"41⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"42⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"43⤵
- Executes dropped EXE
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"44⤵
- Executes dropped EXE
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"45⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"46⤵
- Executes dropped EXE
PID:896 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"47⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"48⤵
- Executes dropped EXE
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"49⤵
- Executes dropped EXE
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"50⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"51⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"52⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"53⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"54⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"55⤵
- Executes dropped EXE
PID:312 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"56⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"57⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"58⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"59⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"60⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"61⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"62⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"63⤵
- Executes dropped EXE
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"64⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"65⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"66⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"67⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"68⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"69⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"70⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"71⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"72⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"73⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"74⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"75⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"76⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"77⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"78⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"79⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"80⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"81⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"82⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"83⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"84⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"85⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"86⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"87⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"88⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"89⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"90⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"91⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"92⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"93⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"94⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"95⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"96⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"97⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"98⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"99⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"100⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"101⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"102⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"103⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"104⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"105⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"106⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"107⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"108⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"109⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"110⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"111⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"112⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"113⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"114⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"115⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"116⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"117⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"118⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"119⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"120⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"121⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"122⤵PID:1020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-