Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 10:02
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-25_91f8e1efde1fd8a5a846b69b86f4ecf6_mafia.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2024-06-25_91f8e1efde1fd8a5a846b69b86f4ecf6_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-25_91f8e1efde1fd8a5a846b69b86f4ecf6_mafia.exe
-
Size
520KB
-
MD5
91f8e1efde1fd8a5a846b69b86f4ecf6
-
SHA1
207e993844e4734c225d9c03f0856841a90f71b3
-
SHA256
0fce2e7321578e46c615e59616321ce7c3f629fc0f67679b7704440b8876c84b
-
SHA512
1cdbacf90ff84f8901365ed033ce34c7cb92d0a8b8f7b2b901d8d9c04303691262c5a3ac7fc09b51fca1fbcffcda76621b09c64c7f329cb42a9a271378bf5cfd
-
SSDEEP
12288:gj8fuxR21t5i8fGgK/qTEIVAGiQra/bSQTGNZ:gj8fuK1GYH3YXL/bSQTGN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4196 3EFD.tmp 2572 3F6A.tmp 1088 3FF7.tmp 2472 4093.tmp 4304 4120.tmp 3616 41AC.tmp 2840 420A.tmp 1980 4297.tmp 1408 42F4.tmp 1484 4352.tmp 904 43C0.tmp 4772 442D.tmp 3860 44BA.tmp 2556 4527.tmp 5080 4575.tmp 2984 45E2.tmp 5060 466F.tmp 4224 46EC.tmp 468 4759.tmp 60 47C7.tmp 700 4834.tmp 1832 48A2.tmp 2968 490F.tmp 4760 498C.tmp 2272 4A09.tmp 1968 4A57.tmp 2724 4AC4.tmp 3972 4B41.tmp 5008 4BAF.tmp 2288 4C1C.tmp 3348 4C7A.tmp 2792 4CD8.tmp 1660 4D35.tmp 1280 4D93.tmp 4868 4DE1.tmp 3916 4E2F.tmp 4344 4E8D.tmp 3276 4EEB.tmp 4992 4F49.tmp 4152 4F97.tmp 1804 4FF5.tmp 5088 5043.tmp 1356 5091.tmp 4844 50EF.tmp 2404 513D.tmp 2788 519A.tmp 2944 51F8.tmp 4912 5266.tmp 224 52C3.tmp 4392 5321.tmp 3388 536F.tmp 4380 53BD.tmp 1960 541B.tmp 2264 5479.tmp 892 54C7.tmp 3052 5515.tmp 664 5563.tmp 2256 55B1.tmp 1088 560F.tmp 4740 565D.tmp 4556 56AB.tmp 5068 5709.tmp 3440 5757.tmp 3616 57A5.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4988 wrote to memory of 4196 4988 2024-06-25_91f8e1efde1fd8a5a846b69b86f4ecf6_mafia.exe 82 PID 4988 wrote to memory of 4196 4988 2024-06-25_91f8e1efde1fd8a5a846b69b86f4ecf6_mafia.exe 82 PID 4988 wrote to memory of 4196 4988 2024-06-25_91f8e1efde1fd8a5a846b69b86f4ecf6_mafia.exe 82 PID 4196 wrote to memory of 2572 4196 3EFD.tmp 83 PID 4196 wrote to memory of 2572 4196 3EFD.tmp 83 PID 4196 wrote to memory of 2572 4196 3EFD.tmp 83 PID 2572 wrote to memory of 1088 2572 3F6A.tmp 84 PID 2572 wrote to memory of 1088 2572 3F6A.tmp 84 PID 2572 wrote to memory of 1088 2572 3F6A.tmp 84 PID 1088 wrote to memory of 2472 1088 3FF7.tmp 85 PID 1088 wrote to memory of 2472 1088 3FF7.tmp 85 PID 1088 wrote to memory of 2472 1088 3FF7.tmp 85 PID 2472 wrote to memory of 4304 2472 4093.tmp 86 PID 2472 wrote to memory of 4304 2472 4093.tmp 86 PID 2472 wrote to memory of 4304 2472 4093.tmp 86 PID 4304 wrote to memory of 3616 4304 4120.tmp 87 PID 4304 wrote to memory of 3616 4304 4120.tmp 87 PID 4304 wrote to memory of 3616 4304 4120.tmp 87 PID 3616 wrote to memory of 2840 3616 41AC.tmp 88 PID 3616 wrote to memory of 2840 3616 41AC.tmp 88 PID 3616 wrote to memory of 2840 3616 41AC.tmp 88 PID 2840 wrote to memory of 1980 2840 420A.tmp 89 PID 2840 wrote to memory of 1980 2840 420A.tmp 89 PID 2840 wrote to memory of 1980 2840 420A.tmp 89 PID 1980 wrote to memory of 1408 1980 4297.tmp 90 PID 1980 wrote to memory of 1408 1980 4297.tmp 90 PID 1980 wrote to memory of 1408 1980 4297.tmp 90 PID 1408 wrote to memory of 1484 1408 42F4.tmp 91 PID 1408 wrote to memory of 1484 1408 42F4.tmp 91 PID 1408 wrote to memory of 1484 1408 42F4.tmp 91 PID 1484 wrote to memory of 904 1484 4352.tmp 92 PID 1484 wrote to memory of 904 1484 4352.tmp 92 PID 1484 wrote to memory of 904 1484 4352.tmp 92 PID 904 wrote to memory of 4772 904 43C0.tmp 93 PID 904 wrote to memory of 4772 904 43C0.tmp 93 PID 904 wrote to memory of 4772 904 43C0.tmp 93 PID 4772 wrote to memory of 3860 4772 442D.tmp 94 PID 4772 wrote to memory of 3860 4772 442D.tmp 94 PID 4772 wrote to memory of 3860 4772 442D.tmp 94 PID 3860 wrote to memory of 2556 3860 44BA.tmp 95 PID 3860 wrote to memory of 2556 3860 44BA.tmp 95 PID 3860 wrote to memory of 2556 3860 44BA.tmp 95 PID 2556 wrote to memory of 5080 2556 4527.tmp 96 PID 2556 wrote to memory of 5080 2556 4527.tmp 96 PID 2556 wrote to memory of 5080 2556 4527.tmp 96 PID 5080 wrote to memory of 2984 5080 4575.tmp 97 PID 5080 wrote to memory of 2984 5080 4575.tmp 97 PID 5080 wrote to memory of 2984 5080 4575.tmp 97 PID 2984 wrote to memory of 5060 2984 45E2.tmp 98 PID 2984 wrote to memory of 5060 2984 45E2.tmp 98 PID 2984 wrote to memory of 5060 2984 45E2.tmp 98 PID 5060 wrote to memory of 4224 5060 466F.tmp 99 PID 5060 wrote to memory of 4224 5060 466F.tmp 99 PID 5060 wrote to memory of 4224 5060 466F.tmp 99 PID 4224 wrote to memory of 468 4224 46EC.tmp 100 PID 4224 wrote to memory of 468 4224 46EC.tmp 100 PID 4224 wrote to memory of 468 4224 46EC.tmp 100 PID 468 wrote to memory of 60 468 4759.tmp 101 PID 468 wrote to memory of 60 468 4759.tmp 101 PID 468 wrote to memory of 60 468 4759.tmp 101 PID 60 wrote to memory of 700 60 47C7.tmp 102 PID 60 wrote to memory of 700 60 47C7.tmp 102 PID 60 wrote to memory of 700 60 47C7.tmp 102 PID 700 wrote to memory of 1832 700 4834.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-25_91f8e1efde1fd8a5a846b69b86f4ecf6_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-25_91f8e1efde1fd8a5a846b69b86f4ecf6_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\4093.tmp"C:\Users\Admin\AppData\Local\Temp\4093.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\4120.tmp"C:\Users\Admin\AppData\Local\Temp\4120.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\41AC.tmp"C:\Users\Admin\AppData\Local\Temp\41AC.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\420A.tmp"C:\Users\Admin\AppData\Local\Temp\420A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\42F4.tmp"C:\Users\Admin\AppData\Local\Temp\42F4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\4352.tmp"C:\Users\Admin\AppData\Local\Temp\4352.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\43C0.tmp"C:\Users\Admin\AppData\Local\Temp\43C0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\46EC.tmp"C:\Users\Admin\AppData\Local\Temp\46EC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"23⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"24⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"25⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"26⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"27⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"28⤵
- Executes dropped EXE
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"29⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"30⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"31⤵
- Executes dropped EXE
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"32⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"33⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"34⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"35⤵
- Executes dropped EXE
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"36⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"37⤵
- Executes dropped EXE
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"38⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"39⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"40⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"41⤵
- Executes dropped EXE
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"42⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"43⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"44⤵
- Executes dropped EXE
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"45⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"46⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"47⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"48⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"49⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"50⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"51⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"52⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"53⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"54⤵
- Executes dropped EXE
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"55⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"56⤵
- Executes dropped EXE
PID:892 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"57⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"58⤵
- Executes dropped EXE
PID:664 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"59⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"60⤵
- Executes dropped EXE
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"61⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"62⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"63⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"64⤵
- Executes dropped EXE
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"65⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"66⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"67⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"68⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"69⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"70⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"71⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"72⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"73⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"74⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"75⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"76⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"77⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"78⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"79⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"80⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"81⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"82⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"83⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"84⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"85⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"86⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"87⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"88⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"89⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"90⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"91⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"92⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"93⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"94⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"95⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"96⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"97⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"98⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"99⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"100⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"101⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"102⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"103⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"104⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"105⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"106⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"107⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"108⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"109⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"110⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"111⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"112⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"113⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"114⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"115⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"116⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"117⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"118⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"119⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"120⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"121⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"122⤵PID:4808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-