Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
29/04/2024, 16:22
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-29_ff9a8338cd631ef25bc859be037836d5_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-04-29_ff9a8338cd631ef25bc859be037836d5_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-04-29_ff9a8338cd631ef25bc859be037836d5_mafia.exe
-
Size
536KB
-
MD5
ff9a8338cd631ef25bc859be037836d5
-
SHA1
3d2e620d9ae9c4adea46b1a8a5c78becc821eb09
-
SHA256
6efb2d5a4bdbed4708233656d3560f4775807a13e3dde08cef78ea2257cf87f6
-
SHA512
5e8ba192a812394b2444375fb51d00e39da25f1f4bf817f572daf5af9eeedd804726b27b65a4c3875cad0f23af5ffa4c01eed6705db7603d42846d1dffff333e
-
SSDEEP
12288:wU5rCOTeiUDr7lsEKBfRSnONoVPIZxVJ0ZT9:wUQOJUDr7OEK332PIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2896 399E.tmp 1228 3A4A.tmp 2760 3AC7.tmp 3620 3B44.tmp 2308 3BE0.tmp 3468 3C6D.tmp 2176 3CEA.tmp 1944 3D76.tmp 2076 3E03.tmp 5096 3E70.tmp 2936 3EFD.tmp 1272 3F99.tmp 900 4035.tmp 3556 4093.tmp 4228 4110.tmp 4952 418D.tmp 4728 41DB.tmp 1308 4229.tmp 2940 4287.tmp 3880 4304.tmp 2528 4391.tmp 1000 440E.tmp 3524 449A.tmp 2260 4508.tmp 3272 4594.tmp 3964 45F2.tmp 2980 467F.tmp 4072 46FC.tmp 4116 4769.tmp 2428 47F6.tmp 4752 4882.tmp 4104 491F.tmp 4520 499C.tmp 676 49EA.tmp 4448 4A57.tmp 5012 4AA5.tmp 3676 4B13.tmp 4436 4B70.tmp 4488 4BED.tmp 1152 4C5B.tmp 4892 4CC8.tmp 3320 4D16.tmp 2760 4D74.tmp 3316 4DE1.tmp 4140 4E2F.tmp 1084 4E7E.tmp 1628 4ECC.tmp 1880 4F39.tmp 3232 4FA6.tmp 2588 4FE5.tmp 3820 5043.tmp 728 5091.tmp 5096 50DF.tmp 4732 512D.tmp 4164 517B.tmp 4524 51C9.tmp 1572 5217.tmp 1680 5275.tmp 2496 52C3.tmp 4320 5311.tmp 4360 5360.tmp 4440 53BD.tmp 756 540B.tmp 4608 545A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1684 wrote to memory of 2896 1684 2024-04-29_ff9a8338cd631ef25bc859be037836d5_mafia.exe 81 PID 1684 wrote to memory of 2896 1684 2024-04-29_ff9a8338cd631ef25bc859be037836d5_mafia.exe 81 PID 1684 wrote to memory of 2896 1684 2024-04-29_ff9a8338cd631ef25bc859be037836d5_mafia.exe 81 PID 2896 wrote to memory of 1228 2896 399E.tmp 82 PID 2896 wrote to memory of 1228 2896 399E.tmp 82 PID 2896 wrote to memory of 1228 2896 399E.tmp 82 PID 1228 wrote to memory of 2760 1228 3A4A.tmp 85 PID 1228 wrote to memory of 2760 1228 3A4A.tmp 85 PID 1228 wrote to memory of 2760 1228 3A4A.tmp 85 PID 2760 wrote to memory of 3620 2760 3AC7.tmp 86 PID 2760 wrote to memory of 3620 2760 3AC7.tmp 86 PID 2760 wrote to memory of 3620 2760 3AC7.tmp 86 PID 3620 wrote to memory of 2308 3620 3B44.tmp 88 PID 3620 wrote to memory of 2308 3620 3B44.tmp 88 PID 3620 wrote to memory of 2308 3620 3B44.tmp 88 PID 2308 wrote to memory of 3468 2308 3BE0.tmp 89 PID 2308 wrote to memory of 3468 2308 3BE0.tmp 89 PID 2308 wrote to memory of 3468 2308 3BE0.tmp 89 PID 3468 wrote to memory of 2176 3468 3C6D.tmp 90 PID 3468 wrote to memory of 2176 3468 3C6D.tmp 90 PID 3468 wrote to memory of 2176 3468 3C6D.tmp 90 PID 2176 wrote to memory of 1944 2176 3CEA.tmp 91 PID 2176 wrote to memory of 1944 2176 3CEA.tmp 91 PID 2176 wrote to memory of 1944 2176 3CEA.tmp 91 PID 1944 wrote to memory of 2076 1944 3D76.tmp 92 PID 1944 wrote to memory of 2076 1944 3D76.tmp 92 PID 1944 wrote to memory of 2076 1944 3D76.tmp 92 PID 2076 wrote to memory of 5096 2076 3E03.tmp 93 PID 2076 wrote to memory of 5096 2076 3E03.tmp 93 PID 2076 wrote to memory of 5096 2076 3E03.tmp 93 PID 5096 wrote to memory of 2936 5096 3E70.tmp 94 PID 5096 wrote to memory of 2936 5096 3E70.tmp 94 PID 5096 wrote to memory of 2936 5096 3E70.tmp 94 PID 2936 wrote to memory of 1272 2936 3EFD.tmp 95 PID 2936 wrote to memory of 1272 2936 3EFD.tmp 95 PID 2936 wrote to memory of 1272 2936 3EFD.tmp 95 PID 1272 wrote to memory of 900 1272 3F99.tmp 96 PID 1272 wrote to memory of 900 1272 3F99.tmp 96 PID 1272 wrote to memory of 900 1272 3F99.tmp 96 PID 900 wrote to memory of 3556 900 4035.tmp 97 PID 900 wrote to memory of 3556 900 4035.tmp 97 PID 900 wrote to memory of 3556 900 4035.tmp 97 PID 3556 wrote to memory of 4228 3556 4093.tmp 98 PID 3556 wrote to memory of 4228 3556 4093.tmp 98 PID 3556 wrote to memory of 4228 3556 4093.tmp 98 PID 4228 wrote to memory of 4952 4228 4110.tmp 99 PID 4228 wrote to memory of 4952 4228 4110.tmp 99 PID 4228 wrote to memory of 4952 4228 4110.tmp 99 PID 4952 wrote to memory of 4728 4952 418D.tmp 100 PID 4952 wrote to memory of 4728 4952 418D.tmp 100 PID 4952 wrote to memory of 4728 4952 418D.tmp 100 PID 4728 wrote to memory of 1308 4728 41DB.tmp 101 PID 4728 wrote to memory of 1308 4728 41DB.tmp 101 PID 4728 wrote to memory of 1308 4728 41DB.tmp 101 PID 1308 wrote to memory of 2940 1308 4229.tmp 102 PID 1308 wrote to memory of 2940 1308 4229.tmp 102 PID 1308 wrote to memory of 2940 1308 4229.tmp 102 PID 2940 wrote to memory of 3880 2940 4287.tmp 103 PID 2940 wrote to memory of 3880 2940 4287.tmp 103 PID 2940 wrote to memory of 3880 2940 4287.tmp 103 PID 3880 wrote to memory of 2528 3880 4304.tmp 104 PID 3880 wrote to memory of 2528 3880 4304.tmp 104 PID 3880 wrote to memory of 2528 3880 4304.tmp 104 PID 2528 wrote to memory of 1000 2528 4391.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-29_ff9a8338cd631ef25bc859be037836d5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-29_ff9a8338cd631ef25bc859be037836d5_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\399E.tmp"C:\Users\Admin\AppData\Local\Temp\399E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\3B44.tmp"C:\Users\Admin\AppData\Local\Temp\3B44.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\3C6D.tmp"C:\Users\Admin\AppData\Local\Temp\3C6D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\3D76.tmp"C:\Users\Admin\AppData\Local\Temp\3D76.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\3E03.tmp"C:\Users\Admin\AppData\Local\Temp\3E03.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\3E70.tmp"C:\Users\Admin\AppData\Local\Temp\3E70.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\3F99.tmp"C:\Users\Admin\AppData\Local\Temp\3F99.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\4035.tmp"C:\Users\Admin\AppData\Local\Temp\4035.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\4093.tmp"C:\Users\Admin\AppData\Local\Temp\4093.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\4110.tmp"C:\Users\Admin\AppData\Local\Temp\4110.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\418D.tmp"C:\Users\Admin\AppData\Local\Temp\418D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\41DB.tmp"C:\Users\Admin\AppData\Local\Temp\41DB.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\4229.tmp"C:\Users\Admin\AppData\Local\Temp\4229.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\4287.tmp"C:\Users\Admin\AppData\Local\Temp\4287.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\4304.tmp"C:\Users\Admin\AppData\Local\Temp\4304.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"23⤵
- Executes dropped EXE
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"24⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"25⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"26⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\45F2.tmp"C:\Users\Admin\AppData\Local\Temp\45F2.tmp"27⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"28⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"29⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"30⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"31⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"32⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"33⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"34⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"35⤵
- Executes dropped EXE
PID:676 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"36⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"37⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"38⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"39⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"40⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"41⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"42⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"43⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"44⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"45⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"46⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"47⤵
- Executes dropped EXE
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"48⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"49⤵
- Executes dropped EXE
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"50⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"51⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"52⤵
- Executes dropped EXE
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"53⤵
- Executes dropped EXE
PID:728 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"54⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"55⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"56⤵
- Executes dropped EXE
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"57⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"58⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"59⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"60⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"61⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"62⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"63⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"64⤵
- Executes dropped EXE
PID:756 -
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"65⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"66⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"67⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"68⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"69⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"70⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"71⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"72⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"73⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"74⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"75⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"76⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"77⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"78⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"79⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"80⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"81⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"82⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"83⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"84⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"85⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"86⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"87⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"88⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"89⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"90⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"91⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"92⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"93⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"94⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"95⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"96⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"97⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"98⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"99⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"100⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"101⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"102⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"103⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"104⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"105⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"106⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"107⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"108⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"109⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"110⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"111⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"112⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"113⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"114⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"115⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"116⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"117⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"118⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"119⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"120⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"121⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"122⤵PID:2168
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-