Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/07/2024, 16:54
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-01_3d46fc5c98cbb42eea7e4de7fba96540_mafia.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2024-07-01_3d46fc5c98cbb42eea7e4de7fba96540_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-07-01_3d46fc5c98cbb42eea7e4de7fba96540_mafia.exe
-
Size
527KB
-
MD5
3d46fc5c98cbb42eea7e4de7fba96540
-
SHA1
62f74cb7d13b681bf6cbec6ca2a4087d87a4efb5
-
SHA256
1aa410cea4da855610146e948e3e4a8c85955fac2a474d1694399b31df04bd24
-
SHA512
3412cf4746a3014ecd5b206d7c5c53eb3d224980cadbc4daebc23c1a139a700661eb153af7a0cb2d3bfbdcc30b539629fb76582a23d115ca08c534585845602d
-
SSDEEP
6144:yorf3lPvovsgZnqG2C7mOTeiLRDYSrHFjt4abYtQugZDC2q5cG6NNbsEBODZAmzT:fU5rCOTeidJpnfZ22AcG6ZUhpwxJDZu
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3008 4546.tmp 1184 45C3.tmp 4296 4650.tmp 2120 46FC.tmp 4700 4788.tmp 3960 4805.tmp 2544 4873.tmp 876 48D0.tmp 1888 493E.tmp 4528 49AB.tmp 4000 4A28.tmp 2500 4A96.tmp 884 4B03.tmp 1436 4B61.tmp 1048 4BCE.tmp 1720 4C3B.tmp 5080 4C8A.tmp 3492 4CF7.tmp 4036 4D74.tmp 3924 4DD2.tmp 2912 4E4F.tmp 1068 4E9D.tmp 924 4EFB.tmp 1748 4F58.tmp 4176 4FD5.tmp 3916 5052.tmp 2168 50CF.tmp 5072 514C.tmp 3096 51BA.tmp 4620 5227.tmp 396 5275.tmp 2424 5302.tmp 680 5350.tmp 1012 539E.tmp 4968 53EC.tmp 1980 544A.tmp 4656 5498.tmp 1064 54E6.tmp 2556 5534.tmp 1816 5592.tmp 1988 55E0.tmp 3612 562E.tmp 4468 568C.tmp 4816 56EA.tmp 2304 5748.tmp 2524 57A5.tmp 4388 57F3.tmp 3392 5851.tmp 4684 58AF.tmp 980 58FD.tmp 5004 595B.tmp 3496 59B9.tmp 2648 5A07.tmp 2340 5A55.tmp 3144 5AB3.tmp 2076 5B01.tmp 3880 5B4F.tmp 3688 5B9D.tmp 2748 5BEB.tmp 1328 5C39.tmp 4900 5C97.tmp 2800 5D43.tmp 3672 5D91.tmp 4552 5DDF.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4496 wrote to memory of 3008 4496 2024-07-01_3d46fc5c98cbb42eea7e4de7fba96540_mafia.exe 81 PID 4496 wrote to memory of 3008 4496 2024-07-01_3d46fc5c98cbb42eea7e4de7fba96540_mafia.exe 81 PID 4496 wrote to memory of 3008 4496 2024-07-01_3d46fc5c98cbb42eea7e4de7fba96540_mafia.exe 81 PID 3008 wrote to memory of 1184 3008 4546.tmp 82 PID 3008 wrote to memory of 1184 3008 4546.tmp 82 PID 3008 wrote to memory of 1184 3008 4546.tmp 82 PID 1184 wrote to memory of 4296 1184 45C3.tmp 83 PID 1184 wrote to memory of 4296 1184 45C3.tmp 83 PID 1184 wrote to memory of 4296 1184 45C3.tmp 83 PID 4296 wrote to memory of 2120 4296 4650.tmp 84 PID 4296 wrote to memory of 2120 4296 4650.tmp 84 PID 4296 wrote to memory of 2120 4296 4650.tmp 84 PID 2120 wrote to memory of 4700 2120 46FC.tmp 85 PID 2120 wrote to memory of 4700 2120 46FC.tmp 85 PID 2120 wrote to memory of 4700 2120 46FC.tmp 85 PID 4700 wrote to memory of 3960 4700 4788.tmp 86 PID 4700 wrote to memory of 3960 4700 4788.tmp 86 PID 4700 wrote to memory of 3960 4700 4788.tmp 86 PID 3960 wrote to memory of 2544 3960 4805.tmp 87 PID 3960 wrote to memory of 2544 3960 4805.tmp 87 PID 3960 wrote to memory of 2544 3960 4805.tmp 87 PID 2544 wrote to memory of 876 2544 4873.tmp 88 PID 2544 wrote to memory of 876 2544 4873.tmp 88 PID 2544 wrote to memory of 876 2544 4873.tmp 88 PID 876 wrote to memory of 1888 876 48D0.tmp 89 PID 876 wrote to memory of 1888 876 48D0.tmp 89 PID 876 wrote to memory of 1888 876 48D0.tmp 89 PID 1888 wrote to memory of 4528 1888 493E.tmp 90 PID 1888 wrote to memory of 4528 1888 493E.tmp 90 PID 1888 wrote to memory of 4528 1888 493E.tmp 90 PID 4528 wrote to memory of 4000 4528 49AB.tmp 91 PID 4528 wrote to memory of 4000 4528 49AB.tmp 91 PID 4528 wrote to memory of 4000 4528 49AB.tmp 91 PID 4000 wrote to memory of 2500 4000 4A28.tmp 92 PID 4000 wrote to memory of 2500 4000 4A28.tmp 92 PID 4000 wrote to memory of 2500 4000 4A28.tmp 92 PID 2500 wrote to memory of 884 2500 4A96.tmp 93 PID 2500 wrote to memory of 884 2500 4A96.tmp 93 PID 2500 wrote to memory of 884 2500 4A96.tmp 93 PID 884 wrote to memory of 1436 884 4B03.tmp 94 PID 884 wrote to memory of 1436 884 4B03.tmp 94 PID 884 wrote to memory of 1436 884 4B03.tmp 94 PID 1436 wrote to memory of 1048 1436 4B61.tmp 95 PID 1436 wrote to memory of 1048 1436 4B61.tmp 95 PID 1436 wrote to memory of 1048 1436 4B61.tmp 95 PID 1048 wrote to memory of 1720 1048 4BCE.tmp 96 PID 1048 wrote to memory of 1720 1048 4BCE.tmp 96 PID 1048 wrote to memory of 1720 1048 4BCE.tmp 96 PID 1720 wrote to memory of 5080 1720 4C3B.tmp 97 PID 1720 wrote to memory of 5080 1720 4C3B.tmp 97 PID 1720 wrote to memory of 5080 1720 4C3B.tmp 97 PID 5080 wrote to memory of 3492 5080 4C8A.tmp 98 PID 5080 wrote to memory of 3492 5080 4C8A.tmp 98 PID 5080 wrote to memory of 3492 5080 4C8A.tmp 98 PID 3492 wrote to memory of 4036 3492 4CF7.tmp 99 PID 3492 wrote to memory of 4036 3492 4CF7.tmp 99 PID 3492 wrote to memory of 4036 3492 4CF7.tmp 99 PID 4036 wrote to memory of 3924 4036 4D74.tmp 100 PID 4036 wrote to memory of 3924 4036 4D74.tmp 100 PID 4036 wrote to memory of 3924 4036 4D74.tmp 100 PID 3924 wrote to memory of 2912 3924 4DD2.tmp 101 PID 3924 wrote to memory of 2912 3924 4DD2.tmp 101 PID 3924 wrote to memory of 2912 3924 4DD2.tmp 101 PID 2912 wrote to memory of 1068 2912 4E4F.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-01_3d46fc5c98cbb42eea7e4de7fba96540_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-01_3d46fc5c98cbb42eea7e4de7fba96540_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"23⤵
- Executes dropped EXE
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"24⤵
- Executes dropped EXE
PID:924 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"25⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"26⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"27⤵
- Executes dropped EXE
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"28⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"29⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"30⤵
- Executes dropped EXE
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"31⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"32⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"33⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"34⤵
- Executes dropped EXE
PID:680 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"35⤵
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"36⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"37⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"38⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"39⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"40⤵
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"41⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"42⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"43⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"44⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"45⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"46⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"47⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"48⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"49⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"50⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"51⤵
- Executes dropped EXE
PID:980 -
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"52⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"53⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"54⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"55⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"56⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"57⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"58⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"59⤵
- Executes dropped EXE
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"60⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"61⤵
- Executes dropped EXE
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"62⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"63⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"64⤵
- Executes dropped EXE
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"65⤵
- Executes dropped EXE
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"66⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"67⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"68⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"69⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"70⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"71⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"72⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"73⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"74⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"75⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"76⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"77⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"78⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"79⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"80⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"81⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"82⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"83⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"84⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"85⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"86⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"87⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"88⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"89⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"90⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"91⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"92⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"93⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"94⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"95⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"96⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"97⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"98⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"99⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"100⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"101⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"102⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"103⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"104⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"105⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"106⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"107⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"108⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"109⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"110⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"111⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"112⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"113⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"114⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"115⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"116⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"117⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"118⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"119⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"120⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"121⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"122⤵PID:2648
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-