Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12/03/2024, 04:48
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-12_910ed35fc185c91ecb41070ab775831f_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-12_910ed35fc185c91ecb41070ab775831f_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-12_910ed35fc185c91ecb41070ab775831f_mafia.exe
-
Size
765KB
-
MD5
910ed35fc185c91ecb41070ab775831f
-
SHA1
0e5301a4067825a696060464901e561695121af2
-
SHA256
4178649565495cf2136b273c65c97c28c9dafddebf7deeb499bd9be340145872
-
SHA512
9d4c78248150fe8edd2dc7948e791a4c0e227f830d2b046ee2bdae09429acd67d600d00d700c8271ad0b344a2fa65bade6d6c866aa5af5912ec02107334cce26
-
SSDEEP
12288:ZU5rCOTeiDKV1TFDX4tV5V3ZF5rn5rLOa54U5w5A:ZUQOJDAstV/3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1948 3DE4.tmp 2808 3E51.tmp 4508 3ECE.tmp 684 3F5B.tmp 3704 3FC8.tmp 2668 4026.tmp 932 4093.tmp 4976 40F1.tmp 1968 413F.tmp 4060 418D.tmp 5012 41FA.tmp 1772 4249.tmp 1012 42A6.tmp 4112 4304.tmp 3952 4362.tmp 4696 43EE.tmp 2568 444C.tmp 4944 44BA.tmp 2064 4508.tmp 3168 4565.tmp 5000 4602.tmp 2740 468E.tmp 3284 472B.tmp 1220 4798.tmp 3216 4805.tmp 4324 4882.tmp 2028 491F.tmp 5076 49AB.tmp 2076 4A19.tmp 5040 4AC4.tmp 2764 4B32.tmp 1916 4BDE.tmp 2408 4C8A.tmp 2736 4CD8.tmp 4508 4D26.tmp 1808 4D93.tmp 3252 4DE1.tmp 3520 4E3F.tmp 1300 4E9D.tmp 4536 4EFB.tmp 2668 4F58.tmp 932 4FB6.tmp 3036 5004.tmp 4532 5072.tmp 2844 50C0.tmp 1312 511D.tmp 1028 516C.tmp 1168 51C9.tmp 1772 5217.tmp 4020 5266.tmp 3204 52B4.tmp 4144 5302.tmp 4068 5360.tmp 3236 53AE.tmp 3136 540B.tmp 2912 5479.tmp 4304 54D7.tmp 4944 5534.tmp 1008 5592.tmp 5092 55F0.tmp 824 563E.tmp 1728 569C.tmp 436 56EA.tmp 3708 5757.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4432 wrote to memory of 1948 4432 2024-03-12_910ed35fc185c91ecb41070ab775831f_mafia.exe 89 PID 4432 wrote to memory of 1948 4432 2024-03-12_910ed35fc185c91ecb41070ab775831f_mafia.exe 89 PID 4432 wrote to memory of 1948 4432 2024-03-12_910ed35fc185c91ecb41070ab775831f_mafia.exe 89 PID 1948 wrote to memory of 2808 1948 3DE4.tmp 90 PID 1948 wrote to memory of 2808 1948 3DE4.tmp 90 PID 1948 wrote to memory of 2808 1948 3DE4.tmp 90 PID 2808 wrote to memory of 4508 2808 3E51.tmp 92 PID 2808 wrote to memory of 4508 2808 3E51.tmp 92 PID 2808 wrote to memory of 4508 2808 3E51.tmp 92 PID 4508 wrote to memory of 684 4508 3ECE.tmp 94 PID 4508 wrote to memory of 684 4508 3ECE.tmp 94 PID 4508 wrote to memory of 684 4508 3ECE.tmp 94 PID 684 wrote to memory of 3704 684 3F5B.tmp 96 PID 684 wrote to memory of 3704 684 3F5B.tmp 96 PID 684 wrote to memory of 3704 684 3F5B.tmp 96 PID 3704 wrote to memory of 2668 3704 3FC8.tmp 97 PID 3704 wrote to memory of 2668 3704 3FC8.tmp 97 PID 3704 wrote to memory of 2668 3704 3FC8.tmp 97 PID 2668 wrote to memory of 932 2668 4026.tmp 98 PID 2668 wrote to memory of 932 2668 4026.tmp 98 PID 2668 wrote to memory of 932 2668 4026.tmp 98 PID 932 wrote to memory of 4976 932 4093.tmp 99 PID 932 wrote to memory of 4976 932 4093.tmp 99 PID 932 wrote to memory of 4976 932 4093.tmp 99 PID 4976 wrote to memory of 1968 4976 40F1.tmp 100 PID 4976 wrote to memory of 1968 4976 40F1.tmp 100 PID 4976 wrote to memory of 1968 4976 40F1.tmp 100 PID 1968 wrote to memory of 4060 1968 413F.tmp 101 PID 1968 wrote to memory of 4060 1968 413F.tmp 101 PID 1968 wrote to memory of 4060 1968 413F.tmp 101 PID 4060 wrote to memory of 5012 4060 418D.tmp 102 PID 4060 wrote to memory of 5012 4060 418D.tmp 102 PID 4060 wrote to memory of 5012 4060 418D.tmp 102 PID 5012 wrote to memory of 1772 5012 41FA.tmp 103 PID 5012 wrote to memory of 1772 5012 41FA.tmp 103 PID 5012 wrote to memory of 1772 5012 41FA.tmp 103 PID 1772 wrote to memory of 1012 1772 4249.tmp 104 PID 1772 wrote to memory of 1012 1772 4249.tmp 104 PID 1772 wrote to memory of 1012 1772 4249.tmp 104 PID 1012 wrote to memory of 4112 1012 42A6.tmp 105 PID 1012 wrote to memory of 4112 1012 42A6.tmp 105 PID 1012 wrote to memory of 4112 1012 42A6.tmp 105 PID 4112 wrote to memory of 3952 4112 4304.tmp 106 PID 4112 wrote to memory of 3952 4112 4304.tmp 106 PID 4112 wrote to memory of 3952 4112 4304.tmp 106 PID 3952 wrote to memory of 4696 3952 4362.tmp 108 PID 3952 wrote to memory of 4696 3952 4362.tmp 108 PID 3952 wrote to memory of 4696 3952 4362.tmp 108 PID 4696 wrote to memory of 2568 4696 43EE.tmp 109 PID 4696 wrote to memory of 2568 4696 43EE.tmp 109 PID 4696 wrote to memory of 2568 4696 43EE.tmp 109 PID 2568 wrote to memory of 4944 2568 444C.tmp 110 PID 2568 wrote to memory of 4944 2568 444C.tmp 110 PID 2568 wrote to memory of 4944 2568 444C.tmp 110 PID 4944 wrote to memory of 2064 4944 44BA.tmp 111 PID 4944 wrote to memory of 2064 4944 44BA.tmp 111 PID 4944 wrote to memory of 2064 4944 44BA.tmp 111 PID 2064 wrote to memory of 3168 2064 4508.tmp 112 PID 2064 wrote to memory of 3168 2064 4508.tmp 112 PID 2064 wrote to memory of 3168 2064 4508.tmp 112 PID 3168 wrote to memory of 5000 3168 4565.tmp 113 PID 3168 wrote to memory of 5000 3168 4565.tmp 113 PID 3168 wrote to memory of 5000 3168 4565.tmp 113 PID 5000 wrote to memory of 2740 5000 4602.tmp 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-12_910ed35fc185c91ecb41070ab775831f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-12_910ed35fc185c91ecb41070ab775831f_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\3E51.tmp"C:\Users\Admin\AppData\Local\Temp\3E51.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\4026.tmp"C:\Users\Admin\AppData\Local\Temp\4026.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\4093.tmp"C:\Users\Admin\AppData\Local\Temp\4093.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\40F1.tmp"C:\Users\Admin\AppData\Local\Temp\40F1.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\413F.tmp"C:\Users\Admin\AppData\Local\Temp\413F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\418D.tmp"C:\Users\Admin\AppData\Local\Temp\418D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\42A6.tmp"C:\Users\Admin\AppData\Local\Temp\42A6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\4304.tmp"C:\Users\Admin\AppData\Local\Temp\4304.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\4362.tmp"C:\Users\Admin\AppData\Local\Temp\4362.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\4565.tmp"C:\Users\Admin\AppData\Local\Temp\4565.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\4602.tmp"C:\Users\Admin\AppData\Local\Temp\4602.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"23⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"24⤵
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"25⤵
- Executes dropped EXE
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"26⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"27⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"28⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"29⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\4A19.tmp"C:\Users\Admin\AppData\Local\Temp\4A19.tmp"30⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"31⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"32⤵
- Executes dropped EXE
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"33⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"34⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"35⤵
- Executes dropped EXE
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"36⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"37⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"38⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"39⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"40⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"41⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"42⤵
- Executes dropped EXE
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"43⤵
- Executes dropped EXE
PID:932 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"44⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"45⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"46⤵
- Executes dropped EXE
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"47⤵
- Executes dropped EXE
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"48⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"49⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"50⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"51⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"52⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"53⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"54⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"55⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"56⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"57⤵
- Executes dropped EXE
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"58⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"59⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"60⤵
- Executes dropped EXE
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"61⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"62⤵
- Executes dropped EXE
PID:824 -
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"63⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"64⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"65⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"66⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"67⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"68⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"69⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"70⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"71⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"72⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"73⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"74⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"75⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"76⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"77⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"78⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"79⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"80⤵PID:492
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"81⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"82⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"83⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"84⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"85⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"86⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"87⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"88⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"89⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"90⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"91⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"92⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"93⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"94⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"95⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"96⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"97⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"98⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"99⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"100⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"101⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"102⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"103⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"104⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"105⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"106⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"107⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"108⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"109⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"110⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\6745.tmp"C:\Users\Admin\AppData\Local\Temp\6745.tmp"111⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"112⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"113⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"114⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"115⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"116⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"117⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"118⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"119⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"120⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"121⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"122⤵PID:4660
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-