Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29/03/2024, 12:36
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-29_65c836395ecd13d5d7d00b8b1ba8098f_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-29_65c836395ecd13d5d7d00b8b1ba8098f_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-29_65c836395ecd13d5d7d00b8b1ba8098f_mafia.exe
-
Size
486KB
-
MD5
65c836395ecd13d5d7d00b8b1ba8098f
-
SHA1
be8e3123ca5e653330520b01a4f54f04b0ecead3
-
SHA256
2f7e3ed47c65660c49a38e26a138a4fb5db761e90e47672fb314dfa298ac9d34
-
SHA512
90ca856d26619144bba4915f9473a2ebe72d3a74379c259b9dd063a35ffede2dc3e95e495477844827c0d6d5ae5c4543f8cf3b459748ea8625a1f2adfdb2b536
-
SSDEEP
12288:/U5rCOTeiD6OZzjEeiA7bFFXFrPy88NZ:/UQOJD6OvEvA7LVON
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5060 3DE4.tmp 2216 3E61.tmp 2024 3EBE.tmp 4440 3F2C.tmp 2108 3F89.tmp 3364 3FD8.tmp 3716 4045.tmp 2664 4093.tmp 4944 40E1.tmp 4980 414F.tmp 2240 41AC.tmp 4232 41FA.tmp 3816 4249.tmp 4120 42A6.tmp 2220 4323.tmp 4304 4381.tmp 3320 43CF.tmp 4596 441D.tmp 1268 446B.tmp 2976 44BA.tmp 4212 4527.tmp 3964 4594.tmp 4236 4602.tmp 3396 4650.tmp 4812 46AE.tmp 3064 470B.tmp 4580 4779.tmp 3680 47E6.tmp 2440 4834.tmp 4216 48A2.tmp 3540 48F0.tmp 4388 495D.tmp 1772 49BB.tmp 1076 4A09.tmp 4252 4A57.tmp 1160 4AB5.tmp 4348 4B03.tmp 4964 4B61.tmp 2216 4BAF.tmp 4436 4BFD.tmp 4520 4C5B.tmp 5000 4CB8.tmp 4412 4D07.tmp 2576 4D55.tmp 4784 4DB2.tmp 5044 4E01.tmp 2840 4E4F.tmp 2180 4E9D.tmp 1764 4EFB.tmp 4944 4F49.tmp 2572 4FA6.tmp 772 4FF5.tmp 4856 5052.tmp 4232 50B0.tmp 3448 50FE.tmp 1524 514C.tmp 3252 51AA.tmp 3832 5208.tmp 844 5256.tmp 4636 52A4.tmp 4844 5302.tmp 4104 5360.tmp 3740 53AE.tmp 1892 540B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 516 wrote to memory of 5060 516 2024-03-29_65c836395ecd13d5d7d00b8b1ba8098f_mafia.exe 85 PID 516 wrote to memory of 5060 516 2024-03-29_65c836395ecd13d5d7d00b8b1ba8098f_mafia.exe 85 PID 516 wrote to memory of 5060 516 2024-03-29_65c836395ecd13d5d7d00b8b1ba8098f_mafia.exe 85 PID 5060 wrote to memory of 2216 5060 3DE4.tmp 87 PID 5060 wrote to memory of 2216 5060 3DE4.tmp 87 PID 5060 wrote to memory of 2216 5060 3DE4.tmp 87 PID 2216 wrote to memory of 2024 2216 3E61.tmp 89 PID 2216 wrote to memory of 2024 2216 3E61.tmp 89 PID 2216 wrote to memory of 2024 2216 3E61.tmp 89 PID 2024 wrote to memory of 4440 2024 3EBE.tmp 91 PID 2024 wrote to memory of 4440 2024 3EBE.tmp 91 PID 2024 wrote to memory of 4440 2024 3EBE.tmp 91 PID 4440 wrote to memory of 2108 4440 3F2C.tmp 92 PID 4440 wrote to memory of 2108 4440 3F2C.tmp 92 PID 4440 wrote to memory of 2108 4440 3F2C.tmp 92 PID 2108 wrote to memory of 3364 2108 3F89.tmp 93 PID 2108 wrote to memory of 3364 2108 3F89.tmp 93 PID 2108 wrote to memory of 3364 2108 3F89.tmp 93 PID 3364 wrote to memory of 3716 3364 3FD8.tmp 94 PID 3364 wrote to memory of 3716 3364 3FD8.tmp 94 PID 3364 wrote to memory of 3716 3364 3FD8.tmp 94 PID 3716 wrote to memory of 2664 3716 4045.tmp 95 PID 3716 wrote to memory of 2664 3716 4045.tmp 95 PID 3716 wrote to memory of 2664 3716 4045.tmp 95 PID 2664 wrote to memory of 4944 2664 4093.tmp 96 PID 2664 wrote to memory of 4944 2664 4093.tmp 96 PID 2664 wrote to memory of 4944 2664 4093.tmp 96 PID 4944 wrote to memory of 4980 4944 40E1.tmp 97 PID 4944 wrote to memory of 4980 4944 40E1.tmp 97 PID 4944 wrote to memory of 4980 4944 40E1.tmp 97 PID 4980 wrote to memory of 2240 4980 414F.tmp 98 PID 4980 wrote to memory of 2240 4980 414F.tmp 98 PID 4980 wrote to memory of 2240 4980 414F.tmp 98 PID 2240 wrote to memory of 4232 2240 41AC.tmp 99 PID 2240 wrote to memory of 4232 2240 41AC.tmp 99 PID 2240 wrote to memory of 4232 2240 41AC.tmp 99 PID 4232 wrote to memory of 3816 4232 41FA.tmp 100 PID 4232 wrote to memory of 3816 4232 41FA.tmp 100 PID 4232 wrote to memory of 3816 4232 41FA.tmp 100 PID 3816 wrote to memory of 4120 3816 4249.tmp 102 PID 3816 wrote to memory of 4120 3816 4249.tmp 102 PID 3816 wrote to memory of 4120 3816 4249.tmp 102 PID 4120 wrote to memory of 2220 4120 42A6.tmp 103 PID 4120 wrote to memory of 2220 4120 42A6.tmp 103 PID 4120 wrote to memory of 2220 4120 42A6.tmp 103 PID 2220 wrote to memory of 4304 2220 4323.tmp 104 PID 2220 wrote to memory of 4304 2220 4323.tmp 104 PID 2220 wrote to memory of 4304 2220 4323.tmp 104 PID 4304 wrote to memory of 3320 4304 4381.tmp 105 PID 4304 wrote to memory of 3320 4304 4381.tmp 105 PID 4304 wrote to memory of 3320 4304 4381.tmp 105 PID 3320 wrote to memory of 4596 3320 43CF.tmp 106 PID 3320 wrote to memory of 4596 3320 43CF.tmp 106 PID 3320 wrote to memory of 4596 3320 43CF.tmp 106 PID 4596 wrote to memory of 1268 4596 441D.tmp 107 PID 4596 wrote to memory of 1268 4596 441D.tmp 107 PID 4596 wrote to memory of 1268 4596 441D.tmp 107 PID 1268 wrote to memory of 2976 1268 446B.tmp 108 PID 1268 wrote to memory of 2976 1268 446B.tmp 108 PID 1268 wrote to memory of 2976 1268 446B.tmp 108 PID 2976 wrote to memory of 4212 2976 44BA.tmp 109 PID 2976 wrote to memory of 4212 2976 44BA.tmp 109 PID 2976 wrote to memory of 4212 2976 44BA.tmp 109 PID 4212 wrote to memory of 3964 4212 4527.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-29_65c836395ecd13d5d7d00b8b1ba8098f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-29_65c836395ecd13d5d7d00b8b1ba8098f_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\3E61.tmp"C:\Users\Admin\AppData\Local\Temp\3E61.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\3F89.tmp"C:\Users\Admin\AppData\Local\Temp\3F89.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\4045.tmp"C:\Users\Admin\AppData\Local\Temp\4045.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\4093.tmp"C:\Users\Admin\AppData\Local\Temp\4093.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\40E1.tmp"C:\Users\Admin\AppData\Local\Temp\40E1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\414F.tmp"C:\Users\Admin\AppData\Local\Temp\414F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\41AC.tmp"C:\Users\Admin\AppData\Local\Temp\41AC.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\42A6.tmp"C:\Users\Admin\AppData\Local\Temp\42A6.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\43CF.tmp"C:\Users\Admin\AppData\Local\Temp\43CF.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\441D.tmp"C:\Users\Admin\AppData\Local\Temp\441D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"23⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\4602.tmp"C:\Users\Admin\AppData\Local\Temp\4602.tmp"24⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"25⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"26⤵
- Executes dropped EXE
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"27⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"28⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"29⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"30⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"31⤵
- Executes dropped EXE
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"32⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"33⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"34⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"35⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"36⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"37⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"38⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"39⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"40⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"41⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"42⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"43⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"44⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"45⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"46⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"47⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"48⤵
- Executes dropped EXE
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"49⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"50⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"51⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"52⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"53⤵
- Executes dropped EXE
PID:772 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"54⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"55⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"56⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"57⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"58⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"59⤵
- Executes dropped EXE
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"60⤵
- Executes dropped EXE
PID:844 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"61⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"62⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"63⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"64⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"65⤵
- Executes dropped EXE
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"66⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"67⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"68⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"69⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"70⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"71⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"72⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"73⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"74⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"75⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"76⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"77⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"78⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"79⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"80⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"81⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"82⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"83⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"84⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"85⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"86⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"87⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"88⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"89⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"90⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"91⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"92⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"93⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"94⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"95⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"96⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"97⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"98⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"99⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"100⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"101⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"102⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"103⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"104⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"105⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"106⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"107⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"108⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"109⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"110⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"111⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"112⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"113⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"114⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"115⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"116⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"117⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"118⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"119⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"120⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"121⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"122⤵PID:4948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-