Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28/04/2024, 11:15
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-28_8f89149d58279d9997df3433da58a010_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-04-28_8f89149d58279d9997df3433da58a010_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-04-28_8f89149d58279d9997df3433da58a010_mafia.exe
-
Size
486KB
-
MD5
8f89149d58279d9997df3433da58a010
-
SHA1
d25cba70d5321a6b8ea637d82b64bb96087fa6c3
-
SHA256
797144dfe592b2a15bddc73d36b8ae73c9a288b9577599e6eac33b5dbc419ac0
-
SHA512
0ae28f18387b4df301e16dbb3bffaefc96379d1d6c60321d6bc78a159c86334df1fe7260579f8e5d83acf12ac6dd002796519d2beaf5e3a07d272ed34cd915f4
-
SSDEEP
12288:UU5rCOTeiDhrttOjXfJ5bgCsS1qx+laN4qj3NZ:UUQOJDhnIfIZwdlm42N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3252 399E.tmp 4000 39FC.tmp 2568 3A79.tmp 2448 3AD6.tmp 4420 3B34.tmp 4228 3BA1.tmp 2116 3BFF.tmp 2276 3C4D.tmp 4920 3CBB.tmp 3916 3D18.tmp 2392 3D86.tmp 1444 3DF3.tmp 1088 3E61.tmp 1396 3EBE.tmp 4660 3F1C.tmp 4464 3F6A.tmp 2980 3FC8.tmp 3464 4016.tmp 936 4083.tmp 4108 40E1.tmp 4284 412F.tmp 3980 418D.tmp 1760 41DB.tmp 1792 4239.tmp 412 42B6.tmp 868 4304.tmp 692 4352.tmp 3964 43B0.tmp 3848 441D.tmp 4844 448B.tmp 4752 44E8.tmp 4520 4556.tmp 1440 45C3.tmp 4248 4621.tmp 1112 467F.tmp 4468 46CD.tmp 2628 471B.tmp 1200 4769.tmp 4140 47B7.tmp 1308 4815.tmp 4476 4892.tmp 2820 48FF.tmp 4744 495D.tmp 2760 49AB.tmp 2872 49F9.tmp 1912 4A47.tmp 4428 4AA5.tmp 2568 4AF3.tmp 3952 4B51.tmp 2516 4B9F.tmp 636 4BED.tmp 216 4C3B.tmp 2448 4C99.tmp 4664 4CE7.tmp 1704 4D35.tmp 1588 4D84.tmp 2116 4DE1.tmp 5036 4E2F.tmp 2276 4E7E.tmp 3052 4ECC.tmp 1772 4F29.tmp 3916 4F78.tmp 2768 4FC6.tmp 5032 5023.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 632 wrote to memory of 3252 632 2024-04-28_8f89149d58279d9997df3433da58a010_mafia.exe 82 PID 632 wrote to memory of 3252 632 2024-04-28_8f89149d58279d9997df3433da58a010_mafia.exe 82 PID 632 wrote to memory of 3252 632 2024-04-28_8f89149d58279d9997df3433da58a010_mafia.exe 82 PID 3252 wrote to memory of 4000 3252 399E.tmp 84 PID 3252 wrote to memory of 4000 3252 399E.tmp 84 PID 3252 wrote to memory of 4000 3252 399E.tmp 84 PID 4000 wrote to memory of 2568 4000 39FC.tmp 87 PID 4000 wrote to memory of 2568 4000 39FC.tmp 87 PID 4000 wrote to memory of 2568 4000 39FC.tmp 87 PID 2568 wrote to memory of 2448 2568 3A79.tmp 88 PID 2568 wrote to memory of 2448 2568 3A79.tmp 88 PID 2568 wrote to memory of 2448 2568 3A79.tmp 88 PID 2448 wrote to memory of 4420 2448 3AD6.tmp 89 PID 2448 wrote to memory of 4420 2448 3AD6.tmp 89 PID 2448 wrote to memory of 4420 2448 3AD6.tmp 89 PID 4420 wrote to memory of 4228 4420 3B34.tmp 90 PID 4420 wrote to memory of 4228 4420 3B34.tmp 90 PID 4420 wrote to memory of 4228 4420 3B34.tmp 90 PID 4228 wrote to memory of 2116 4228 3BA1.tmp 91 PID 4228 wrote to memory of 2116 4228 3BA1.tmp 91 PID 4228 wrote to memory of 2116 4228 3BA1.tmp 91 PID 2116 wrote to memory of 2276 2116 3BFF.tmp 92 PID 2116 wrote to memory of 2276 2116 3BFF.tmp 92 PID 2116 wrote to memory of 2276 2116 3BFF.tmp 92 PID 2276 wrote to memory of 4920 2276 3C4D.tmp 93 PID 2276 wrote to memory of 4920 2276 3C4D.tmp 93 PID 2276 wrote to memory of 4920 2276 3C4D.tmp 93 PID 4920 wrote to memory of 3916 4920 3CBB.tmp 94 PID 4920 wrote to memory of 3916 4920 3CBB.tmp 94 PID 4920 wrote to memory of 3916 4920 3CBB.tmp 94 PID 3916 wrote to memory of 2392 3916 3D18.tmp 95 PID 3916 wrote to memory of 2392 3916 3D18.tmp 95 PID 3916 wrote to memory of 2392 3916 3D18.tmp 95 PID 2392 wrote to memory of 1444 2392 3D86.tmp 96 PID 2392 wrote to memory of 1444 2392 3D86.tmp 96 PID 2392 wrote to memory of 1444 2392 3D86.tmp 96 PID 1444 wrote to memory of 1088 1444 3DF3.tmp 97 PID 1444 wrote to memory of 1088 1444 3DF3.tmp 97 PID 1444 wrote to memory of 1088 1444 3DF3.tmp 97 PID 1088 wrote to memory of 1396 1088 3E61.tmp 98 PID 1088 wrote to memory of 1396 1088 3E61.tmp 98 PID 1088 wrote to memory of 1396 1088 3E61.tmp 98 PID 1396 wrote to memory of 4660 1396 3EBE.tmp 99 PID 1396 wrote to memory of 4660 1396 3EBE.tmp 99 PID 1396 wrote to memory of 4660 1396 3EBE.tmp 99 PID 4660 wrote to memory of 4464 4660 3F1C.tmp 101 PID 4660 wrote to memory of 4464 4660 3F1C.tmp 101 PID 4660 wrote to memory of 4464 4660 3F1C.tmp 101 PID 4464 wrote to memory of 2980 4464 3F6A.tmp 102 PID 4464 wrote to memory of 2980 4464 3F6A.tmp 102 PID 4464 wrote to memory of 2980 4464 3F6A.tmp 102 PID 2980 wrote to memory of 3464 2980 3FC8.tmp 103 PID 2980 wrote to memory of 3464 2980 3FC8.tmp 103 PID 2980 wrote to memory of 3464 2980 3FC8.tmp 103 PID 3464 wrote to memory of 936 3464 4016.tmp 104 PID 3464 wrote to memory of 936 3464 4016.tmp 104 PID 3464 wrote to memory of 936 3464 4016.tmp 104 PID 936 wrote to memory of 4108 936 4083.tmp 105 PID 936 wrote to memory of 4108 936 4083.tmp 105 PID 936 wrote to memory of 4108 936 4083.tmp 105 PID 4108 wrote to memory of 4284 4108 40E1.tmp 106 PID 4108 wrote to memory of 4284 4108 40E1.tmp 106 PID 4108 wrote to memory of 4284 4108 40E1.tmp 106 PID 4284 wrote to memory of 3980 4284 412F.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_8f89149d58279d9997df3433da58a010_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_8f89149d58279d9997df3433da58a010_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\399E.tmp"C:\Users\Admin\AppData\Local\Temp\399E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\39FC.tmp"C:\Users\Admin\AppData\Local\Temp\39FC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\3A79.tmp"C:\Users\Admin\AppData\Local\Temp\3A79.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\3B34.tmp"C:\Users\Admin\AppData\Local\Temp\3B34.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\3D18.tmp"C:\Users\Admin\AppData\Local\Temp\3D18.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\3D86.tmp"C:\Users\Admin\AppData\Local\Temp\3D86.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\3E61.tmp"C:\Users\Admin\AppData\Local\Temp\3E61.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\4016.tmp"C:\Users\Admin\AppData\Local\Temp\4016.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\4083.tmp"C:\Users\Admin\AppData\Local\Temp\4083.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\40E1.tmp"C:\Users\Admin\AppData\Local\Temp\40E1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\412F.tmp"C:\Users\Admin\AppData\Local\Temp\412F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\418D.tmp"C:\Users\Admin\AppData\Local\Temp\418D.tmp"23⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\41DB.tmp"C:\Users\Admin\AppData\Local\Temp\41DB.tmp"24⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"25⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\42B6.tmp"C:\Users\Admin\AppData\Local\Temp\42B6.tmp"26⤵
- Executes dropped EXE
PID:412 -
C:\Users\Admin\AppData\Local\Temp\4304.tmp"C:\Users\Admin\AppData\Local\Temp\4304.tmp"27⤵
- Executes dropped EXE
PID:868 -
C:\Users\Admin\AppData\Local\Temp\4352.tmp"C:\Users\Admin\AppData\Local\Temp\4352.tmp"28⤵
- Executes dropped EXE
PID:692 -
C:\Users\Admin\AppData\Local\Temp\43B0.tmp"C:\Users\Admin\AppData\Local\Temp\43B0.tmp"29⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\441D.tmp"C:\Users\Admin\AppData\Local\Temp\441D.tmp"30⤵
- Executes dropped EXE
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\448B.tmp"C:\Users\Admin\AppData\Local\Temp\448B.tmp"31⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"32⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"33⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"34⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"35⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"36⤵
- Executes dropped EXE
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"37⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"38⤵
- Executes dropped EXE
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"39⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"40⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"41⤵
- Executes dropped EXE
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"42⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"43⤵
- Executes dropped EXE
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"44⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"45⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"46⤵
- Executes dropped EXE
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"47⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"48⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"49⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"50⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"51⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"52⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"53⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"54⤵
- Executes dropped EXE
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"55⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"56⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"57⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"58⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"59⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"60⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"61⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"62⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"63⤵
- Executes dropped EXE
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"64⤵
- Executes dropped EXE
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"65⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"66⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"67⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"68⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"69⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"70⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"71⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"72⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"73⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"74⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"75⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"76⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"77⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"78⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"79⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"80⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"81⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"82⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"83⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"84⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"85⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"86⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"87⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"88⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"89⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"90⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"91⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"92⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"93⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"94⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"95⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"96⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"97⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"98⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"99⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"100⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"101⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"102⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"103⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"104⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"105⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"106⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"107⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"108⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"109⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"110⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"111⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"112⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"113⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"114⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"115⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"116⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"117⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"118⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"119⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"120⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"121⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"122⤵PID:4512
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-