Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/02/2024, 21:24
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-28_1a63534eb863cf1c12df1b9dea72d407_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-02-28_1a63534eb863cf1c12df1b9dea72d407_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-02-28_1a63534eb863cf1c12df1b9dea72d407_mafia.exe
-
Size
487KB
-
MD5
1a63534eb863cf1c12df1b9dea72d407
-
SHA1
ee6e6226987403f1f9d63305e90ce36edce966f4
-
SHA256
3de57932afc49897c82dfad4fa960680142734a03620777832515e81d4c5be83
-
SHA512
6822750971ec141a9cd339dc56008d13168677dd455c179eedf81dfb4ebd10277409db70ba79f92da94e81c8fe845da34fd4907fe5b11511bcae99aac1a3fc0e
-
SSDEEP
12288:HU5rCOTeiJKNh65f+S9D9ADZwLTlDvNZ:HUQOJJKNhurJANkTJN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3288 40C2.tmp 4620 4120.tmp 1416 417D.tmp 1120 41FA.tmp 2852 4258.tmp 2952 42A6.tmp 2148 42F4.tmp 440 4352.tmp 3984 43B0.tmp 5008 43FE.tmp 1540 444C.tmp 3624 449A.tmp 4216 4508.tmp 3160 4556.tmp 4600 45B4.tmp 4076 4621.tmp 1876 468E.tmp 2348 46EC.tmp 4212 473A.tmp 3924 4798.tmp 980 4805.tmp 4004 4873.tmp 516 48C1.tmp 4040 491F.tmp 3008 499C.tmp 2976 49F9.tmp 4664 4A47.tmp 4084 4A96.tmp 4444 4B13.tmp 32 4B80.tmp 948 4BCE.tmp 4804 4C1C.tmp 4068 4C6A.tmp 3148 4CC8.tmp 3768 4D16.tmp 2508 4D74.tmp 2476 4DC2.tmp 4428 4E20.tmp 3772 4E6E.tmp 3112 4EBC.tmp 2164 4F0A.tmp 2316 4F58.tmp 3752 4FA6.tmp 1120 4FF5.tmp 2752 5043.tmp 644 5091.tmp 472 50DF.tmp 988 512D.tmp 1140 518B.tmp 3984 51D9.tmp 4644 5237.tmp 4196 5285.tmp 456 52D3.tmp 844 5331.tmp 4660 537F.tmp 1056 53CD.tmp 4080 541B.tmp 392 5469.tmp 3516 54B7.tmp 1624 5505.tmp 2348 5554.tmp 3272 55A2.tmp 400 55FF.tmp 3920 564E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3036 wrote to memory of 3288 3036 2024-02-28_1a63534eb863cf1c12df1b9dea72d407_mafia.exe 88 PID 3036 wrote to memory of 3288 3036 2024-02-28_1a63534eb863cf1c12df1b9dea72d407_mafia.exe 88 PID 3036 wrote to memory of 3288 3036 2024-02-28_1a63534eb863cf1c12df1b9dea72d407_mafia.exe 88 PID 3288 wrote to memory of 4620 3288 40C2.tmp 90 PID 3288 wrote to memory of 4620 3288 40C2.tmp 90 PID 3288 wrote to memory of 4620 3288 40C2.tmp 90 PID 4620 wrote to memory of 1416 4620 4120.tmp 92 PID 4620 wrote to memory of 1416 4620 4120.tmp 92 PID 4620 wrote to memory of 1416 4620 4120.tmp 92 PID 1416 wrote to memory of 1120 1416 417D.tmp 94 PID 1416 wrote to memory of 1120 1416 417D.tmp 94 PID 1416 wrote to memory of 1120 1416 417D.tmp 94 PID 1120 wrote to memory of 2852 1120 41FA.tmp 95 PID 1120 wrote to memory of 2852 1120 41FA.tmp 95 PID 1120 wrote to memory of 2852 1120 41FA.tmp 95 PID 2852 wrote to memory of 2952 2852 4258.tmp 96 PID 2852 wrote to memory of 2952 2852 4258.tmp 96 PID 2852 wrote to memory of 2952 2852 4258.tmp 96 PID 2952 wrote to memory of 2148 2952 42A6.tmp 97 PID 2952 wrote to memory of 2148 2952 42A6.tmp 97 PID 2952 wrote to memory of 2148 2952 42A6.tmp 97 PID 2148 wrote to memory of 440 2148 42F4.tmp 98 PID 2148 wrote to memory of 440 2148 42F4.tmp 98 PID 2148 wrote to memory of 440 2148 42F4.tmp 98 PID 440 wrote to memory of 3984 440 4352.tmp 99 PID 440 wrote to memory of 3984 440 4352.tmp 99 PID 440 wrote to memory of 3984 440 4352.tmp 99 PID 3984 wrote to memory of 5008 3984 43B0.tmp 100 PID 3984 wrote to memory of 5008 3984 43B0.tmp 100 PID 3984 wrote to memory of 5008 3984 43B0.tmp 100 PID 5008 wrote to memory of 1540 5008 43FE.tmp 101 PID 5008 wrote to memory of 1540 5008 43FE.tmp 101 PID 5008 wrote to memory of 1540 5008 43FE.tmp 101 PID 1540 wrote to memory of 3624 1540 444C.tmp 102 PID 1540 wrote to memory of 3624 1540 444C.tmp 102 PID 1540 wrote to memory of 3624 1540 444C.tmp 102 PID 3624 wrote to memory of 4216 3624 449A.tmp 103 PID 3624 wrote to memory of 4216 3624 449A.tmp 103 PID 3624 wrote to memory of 4216 3624 449A.tmp 103 PID 4216 wrote to memory of 3160 4216 4508.tmp 104 PID 4216 wrote to memory of 3160 4216 4508.tmp 104 PID 4216 wrote to memory of 3160 4216 4508.tmp 104 PID 3160 wrote to memory of 4600 3160 4556.tmp 105 PID 3160 wrote to memory of 4600 3160 4556.tmp 105 PID 3160 wrote to memory of 4600 3160 4556.tmp 105 PID 4600 wrote to memory of 4076 4600 45B4.tmp 106 PID 4600 wrote to memory of 4076 4600 45B4.tmp 106 PID 4600 wrote to memory of 4076 4600 45B4.tmp 106 PID 4076 wrote to memory of 1876 4076 4621.tmp 107 PID 4076 wrote to memory of 1876 4076 4621.tmp 107 PID 4076 wrote to memory of 1876 4076 4621.tmp 107 PID 1876 wrote to memory of 2348 1876 468E.tmp 108 PID 1876 wrote to memory of 2348 1876 468E.tmp 108 PID 1876 wrote to memory of 2348 1876 468E.tmp 108 PID 2348 wrote to memory of 4212 2348 46EC.tmp 109 PID 2348 wrote to memory of 4212 2348 46EC.tmp 109 PID 2348 wrote to memory of 4212 2348 46EC.tmp 109 PID 4212 wrote to memory of 3924 4212 473A.tmp 110 PID 4212 wrote to memory of 3924 4212 473A.tmp 110 PID 4212 wrote to memory of 3924 4212 473A.tmp 110 PID 3924 wrote to memory of 980 3924 4798.tmp 111 PID 3924 wrote to memory of 980 3924 4798.tmp 111 PID 3924 wrote to memory of 980 3924 4798.tmp 111 PID 980 wrote to memory of 4004 980 4805.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-28_1a63534eb863cf1c12df1b9dea72d407_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-28_1a63534eb863cf1c12df1b9dea72d407_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\40C2.tmp"C:\Users\Admin\AppData\Local\Temp\40C2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\4120.tmp"C:\Users\Admin\AppData\Local\Temp\4120.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\4258.tmp"C:\Users\Admin\AppData\Local\Temp\4258.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\42A6.tmp"C:\Users\Admin\AppData\Local\Temp\42A6.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\42F4.tmp"C:\Users\Admin\AppData\Local\Temp\42F4.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\4352.tmp"C:\Users\Admin\AppData\Local\Temp\4352.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\43B0.tmp"C:\Users\Admin\AppData\Local\Temp\43B0.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\43FE.tmp"C:\Users\Admin\AppData\Local\Temp\43FE.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\46EC.tmp"C:\Users\Admin\AppData\Local\Temp\46EC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"23⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"24⤵
- Executes dropped EXE
PID:516 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"25⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"26⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"27⤵
- Executes dropped EXE
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"28⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"29⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"30⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"31⤵
- Executes dropped EXE
PID:32 -
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"32⤵
- Executes dropped EXE
PID:948 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"33⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"34⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"35⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"36⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"37⤵
- Executes dropped EXE
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"38⤵
- Executes dropped EXE
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"39⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"40⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"41⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"42⤵
- Executes dropped EXE
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"43⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"44⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"45⤵
- Executes dropped EXE
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"46⤵
- Executes dropped EXE
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"47⤵
- Executes dropped EXE
PID:644 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"48⤵
- Executes dropped EXE
PID:472 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"49⤵
- Executes dropped EXE
PID:988 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"50⤵
- Executes dropped EXE
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"51⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"52⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"53⤵
- Executes dropped EXE
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"54⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"55⤵
- Executes dropped EXE
PID:844 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"56⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"57⤵
- Executes dropped EXE
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"58⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"59⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"60⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"61⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"62⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"63⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"64⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"65⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"66⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"67⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"68⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"69⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"70⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"71⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"72⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"73⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"74⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"75⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"76⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"77⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"78⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"79⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"80⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"81⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"82⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"83⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"84⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"85⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"86⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"87⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"88⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"89⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"90⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"91⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"92⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"93⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"94⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"95⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"96⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"97⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"98⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"99⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"100⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"101⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"102⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"103⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"104⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"105⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"106⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"107⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"108⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"109⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"110⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"111⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"112⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"113⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"114⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"115⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"116⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"117⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"118⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"119⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"120⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"121⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"122⤵PID:4980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-