Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
53s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
01/05/2024, 04:30
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-01_21c929ce4e7480039bc7b01ac1f1d4aa_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-01_21c929ce4e7480039bc7b01ac1f1d4aa_mafia.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-05-01_21c929ce4e7480039bc7b01ac1f1d4aa_mafia.exe
-
Size
527KB
-
MD5
21c929ce4e7480039bc7b01ac1f1d4aa
-
SHA1
2c0e132b415c4b1d7587564949f3159408cac674
-
SHA256
4c5130d878a38a6d58e37c855cf52cb36ff372b4e6b29afc9e3547d48682de43
-
SHA512
371240ee6c6879b1f14e09710296674b33f1b2f0a2df4e1dfc6d6320f7710fbe95d20ffdb23db2c1f268447172096bc040a6b294be20bf98c3ec4b6d7432ceab
-
SSDEEP
12288:fU5rCOTeid/zxAYivXjAH58B8EnlEP1foMrDmDZu:fUQOJd/qYivzAH5836P1fFrDmDo
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1296 3856.tmp 1284 38C3.tmp 60 3930.tmp 3108 39DC.tmp 956 3A69.tmp 836 3AF6.tmp 2172 3B92.tmp 2504 3BE0.tmp 4992 3C7C.tmp 3044 3CDA.tmp 5096 3D57.tmp 4928 3DD4.tmp 1040 3E22.tmp 4368 3E80.tmp 3592 3EFD.tmp 2992 3F7A.tmp 4024 3FE7.tmp 2488 4074.tmp 2576 40C2.tmp 4460 4110.tmp 4548 418D.tmp 1064 420A.tmp 1584 4268.tmp 744 42D5.tmp 1300 4323.tmp 4744 4391.tmp 2788 43EE.tmp 2104 444C.tmp 2076 449A.tmp 2604 4508.tmp 4952 4556.tmp 5044 45B4.tmp 3280 4621.tmp 4956 467F.tmp 3832 46CD.tmp 2160 471B.tmp 4912 4769.tmp 3800 47C7.tmp 3992 4825.tmp 3884 4873.tmp 4108 48D0.tmp 2984 492E.tmp 4856 497C.tmp 4040 49CA.tmp 1676 4A28.tmp 1572 4A76.tmp 4412 4AC4.tmp 4068 4B13.tmp 4352 4B61.tmp 1968 4BBE.tmp 3172 4C1C.tmp 3780 4C7A.tmp 2496 4CE7.tmp 3180 4D35.tmp 4828 4D93.tmp 428 4DE1.tmp 3652 4E2F.tmp 2796 4E8D.tmp 612 4EEB.tmp 3108 4F49.tmp 1320 4F97.tmp 3340 4FF5.tmp 2316 5043.tmp 5060 5081.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4960 wrote to memory of 1296 4960 2024-05-01_21c929ce4e7480039bc7b01ac1f1d4aa_mafia.exe 84 PID 4960 wrote to memory of 1296 4960 2024-05-01_21c929ce4e7480039bc7b01ac1f1d4aa_mafia.exe 84 PID 4960 wrote to memory of 1296 4960 2024-05-01_21c929ce4e7480039bc7b01ac1f1d4aa_mafia.exe 84 PID 1296 wrote to memory of 1284 1296 3856.tmp 85 PID 1296 wrote to memory of 1284 1296 3856.tmp 85 PID 1296 wrote to memory of 1284 1296 3856.tmp 85 PID 1284 wrote to memory of 60 1284 38C3.tmp 87 PID 1284 wrote to memory of 60 1284 38C3.tmp 87 PID 1284 wrote to memory of 60 1284 38C3.tmp 87 PID 60 wrote to memory of 3108 60 3930.tmp 89 PID 60 wrote to memory of 3108 60 3930.tmp 89 PID 60 wrote to memory of 3108 60 3930.tmp 89 PID 3108 wrote to memory of 956 3108 39DC.tmp 90 PID 3108 wrote to memory of 956 3108 39DC.tmp 90 PID 3108 wrote to memory of 956 3108 39DC.tmp 90 PID 956 wrote to memory of 836 956 3A69.tmp 92 PID 956 wrote to memory of 836 956 3A69.tmp 92 PID 956 wrote to memory of 836 956 3A69.tmp 92 PID 836 wrote to memory of 2172 836 3AF6.tmp 93 PID 836 wrote to memory of 2172 836 3AF6.tmp 93 PID 836 wrote to memory of 2172 836 3AF6.tmp 93 PID 2172 wrote to memory of 2504 2172 3B92.tmp 94 PID 2172 wrote to memory of 2504 2172 3B92.tmp 94 PID 2172 wrote to memory of 2504 2172 3B92.tmp 94 PID 2504 wrote to memory of 4992 2504 3BE0.tmp 95 PID 2504 wrote to memory of 4992 2504 3BE0.tmp 95 PID 2504 wrote to memory of 4992 2504 3BE0.tmp 95 PID 4992 wrote to memory of 3044 4992 3C7C.tmp 96 PID 4992 wrote to memory of 3044 4992 3C7C.tmp 96 PID 4992 wrote to memory of 3044 4992 3C7C.tmp 96 PID 3044 wrote to memory of 5096 3044 3CDA.tmp 97 PID 3044 wrote to memory of 5096 3044 3CDA.tmp 97 PID 3044 wrote to memory of 5096 3044 3CDA.tmp 97 PID 5096 wrote to memory of 4928 5096 3D57.tmp 98 PID 5096 wrote to memory of 4928 5096 3D57.tmp 98 PID 5096 wrote to memory of 4928 5096 3D57.tmp 98 PID 4928 wrote to memory of 1040 4928 3DD4.tmp 99 PID 4928 wrote to memory of 1040 4928 3DD4.tmp 99 PID 4928 wrote to memory of 1040 4928 3DD4.tmp 99 PID 1040 wrote to memory of 4368 1040 3E22.tmp 100 PID 1040 wrote to memory of 4368 1040 3E22.tmp 100 PID 1040 wrote to memory of 4368 1040 3E22.tmp 100 PID 4368 wrote to memory of 3592 4368 3E80.tmp 101 PID 4368 wrote to memory of 3592 4368 3E80.tmp 101 PID 4368 wrote to memory of 3592 4368 3E80.tmp 101 PID 3592 wrote to memory of 2992 3592 3EFD.tmp 102 PID 3592 wrote to memory of 2992 3592 3EFD.tmp 102 PID 3592 wrote to memory of 2992 3592 3EFD.tmp 102 PID 2992 wrote to memory of 4024 2992 3F7A.tmp 103 PID 2992 wrote to memory of 4024 2992 3F7A.tmp 103 PID 2992 wrote to memory of 4024 2992 3F7A.tmp 103 PID 4024 wrote to memory of 2488 4024 3FE7.tmp 104 PID 4024 wrote to memory of 2488 4024 3FE7.tmp 104 PID 4024 wrote to memory of 2488 4024 3FE7.tmp 104 PID 2488 wrote to memory of 2576 2488 4074.tmp 105 PID 2488 wrote to memory of 2576 2488 4074.tmp 105 PID 2488 wrote to memory of 2576 2488 4074.tmp 105 PID 2576 wrote to memory of 4460 2576 40C2.tmp 106 PID 2576 wrote to memory of 4460 2576 40C2.tmp 106 PID 2576 wrote to memory of 4460 2576 40C2.tmp 106 PID 4460 wrote to memory of 4548 4460 4110.tmp 107 PID 4460 wrote to memory of 4548 4460 4110.tmp 107 PID 4460 wrote to memory of 4548 4460 4110.tmp 107 PID 4548 wrote to memory of 1064 4548 418D.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-01_21c929ce4e7480039bc7b01ac1f1d4aa_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-01_21c929ce4e7480039bc7b01ac1f1d4aa_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\3856.tmp"C:\Users\Admin\AppData\Local\Temp\3856.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\38C3.tmp"C:\Users\Admin\AppData\Local\Temp\38C3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\3930.tmp"C:\Users\Admin\AppData\Local\Temp\3930.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\39DC.tmp"C:\Users\Admin\AppData\Local\Temp\39DC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\3A69.tmp"C:\Users\Admin\AppData\Local\Temp\3A69.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\3B92.tmp"C:\Users\Admin\AppData\Local\Temp\3B92.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\3D57.tmp"C:\Users\Admin\AppData\Local\Temp\3D57.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\3E22.tmp"C:\Users\Admin\AppData\Local\Temp\3E22.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\3E80.tmp"C:\Users\Admin\AppData\Local\Temp\3E80.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\4074.tmp"C:\Users\Admin\AppData\Local\Temp\4074.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\40C2.tmp"C:\Users\Admin\AppData\Local\Temp\40C2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\4110.tmp"C:\Users\Admin\AppData\Local\Temp\4110.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\418D.tmp"C:\Users\Admin\AppData\Local\Temp\418D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\420A.tmp"C:\Users\Admin\AppData\Local\Temp\420A.tmp"23⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\4268.tmp"C:\Users\Admin\AppData\Local\Temp\4268.tmp"24⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"25⤵
- Executes dropped EXE
PID:744 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"26⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"27⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"28⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"29⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"30⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"31⤵
- Executes dropped EXE
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"32⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"33⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"34⤵
- Executes dropped EXE
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"35⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"36⤵
- Executes dropped EXE
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"37⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"38⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"39⤵
- Executes dropped EXE
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"40⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"41⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"42⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"43⤵
- Executes dropped EXE
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"44⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"45⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"46⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"47⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"48⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"49⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"50⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"51⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"52⤵
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"53⤵
- Executes dropped EXE
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"54⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"55⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"56⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"57⤵
- Executes dropped EXE
PID:428 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"58⤵
- Executes dropped EXE
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"59⤵
- Executes dropped EXE
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"60⤵
- Executes dropped EXE
PID:612 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"61⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"62⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"63⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"64⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"65⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"66⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"67⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"68⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"69⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"70⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"71⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"72⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"73⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"74⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"75⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"76⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"77⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"78⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"79⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"80⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"81⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"82⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"83⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"84⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"85⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"86⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"87⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"88⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"89⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"90⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"91⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"92⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"93⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"94⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"95⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"96⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"97⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"98⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"99⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"100⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"101⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"102⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"103⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"104⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"105⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"106⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"107⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"108⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"109⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"110⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"111⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"112⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"113⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"114⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"115⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"116⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"117⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"118⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"119⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"120⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"121⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"122⤵PID:4864
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-