Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
54s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
01/05/2024, 12:49
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-01_b4c64e68c7c98b1ee9ca8410a457735e_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-05-01_b4c64e68c7c98b1ee9ca8410a457735e_mafia.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-05-01_b4c64e68c7c98b1ee9ca8410a457735e_mafia.exe
-
Size
765KB
-
MD5
b4c64e68c7c98b1ee9ca8410a457735e
-
SHA1
5e9fc3573a70eb661d03a80d8e4aff54f5b7af16
-
SHA256
8c9e264416d3e83971ac82347d7533436ac769f281f55d9232778715f273d882
-
SHA512
6b2b71704690372b035eafa93100c21281f189663aff322f5ca1275d917e25aa28908c3fdfefc183b173ca16984d12ddab99049406bd4b03c95da2556576f0b1
-
SSDEEP
12288:ZU5rCOTeiDZFlfLsL11ZXp5t3ZF5rn5rLOa54U5w5A:ZUQOJDZLILN/t3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 708 3393.tmp 3600 3410.tmp 4364 347D.tmp 2812 350A.tmp 3364 3597.tmp 3660 3633.tmp 5064 36A0.tmp 3952 373C.tmp 1612 37D9.tmp 776 3856.tmp 1620 38D3.tmp 2456 395F.tmp 1468 39DC.tmp 2632 3A3A.tmp 2992 3AC7.tmp 3872 3B44.tmp 1440 3BD0.tmp 4888 3C4D.tmp 3436 3CEA.tmp 2832 3D76.tmp 1496 3E03.tmp 1028 3E61.tmp 4172 3ECE.tmp 2180 3F3B.tmp 2460 3FB8.tmp 4632 4035.tmp 4672 40D2.tmp 960 413F.tmp 3572 418D.tmp 5108 41EB.tmp 400 4249.tmp 1508 42E5.tmp 2424 4371.tmp 3820 43CF.tmp 3540 441D.tmp 3320 446B.tmp 3244 44BA.tmp 2320 4508.tmp 2268 4556.tmp 3604 45A4.tmp 4384 45F2.tmp 5048 4650.tmp 396 469E.tmp 3980 46FC.tmp 3616 474A.tmp 2012 47A8.tmp 4484 47F6.tmp 3376 4853.tmp 1220 48A2.tmp 4280 48FF.tmp 4308 494D.tmp 1172 49AB.tmp 3088 4A09.tmp 712 4A57.tmp 4744 4AB5.tmp 4364 4B13.tmp 2064 4B61.tmp 2344 4BAF.tmp 5096 4BFD.tmp 2812 4C4B.tmp 3276 4C99.tmp 872 4CE7.tmp 3172 4D45.tmp 4140 4D93.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1172 wrote to memory of 708 1172 2024-05-01_b4c64e68c7c98b1ee9ca8410a457735e_mafia.exe 83 PID 1172 wrote to memory of 708 1172 2024-05-01_b4c64e68c7c98b1ee9ca8410a457735e_mafia.exe 83 PID 1172 wrote to memory of 708 1172 2024-05-01_b4c64e68c7c98b1ee9ca8410a457735e_mafia.exe 83 PID 708 wrote to memory of 3600 708 3393.tmp 84 PID 708 wrote to memory of 3600 708 3393.tmp 84 PID 708 wrote to memory of 3600 708 3393.tmp 84 PID 3600 wrote to memory of 4364 3600 3410.tmp 86 PID 3600 wrote to memory of 4364 3600 3410.tmp 86 PID 3600 wrote to memory of 4364 3600 3410.tmp 86 PID 4364 wrote to memory of 2812 4364 347D.tmp 88 PID 4364 wrote to memory of 2812 4364 347D.tmp 88 PID 4364 wrote to memory of 2812 4364 347D.tmp 88 PID 2812 wrote to memory of 3364 2812 350A.tmp 89 PID 2812 wrote to memory of 3364 2812 350A.tmp 89 PID 2812 wrote to memory of 3364 2812 350A.tmp 89 PID 3364 wrote to memory of 3660 3364 3597.tmp 91 PID 3364 wrote to memory of 3660 3364 3597.tmp 91 PID 3364 wrote to memory of 3660 3364 3597.tmp 91 PID 3660 wrote to memory of 5064 3660 3633.tmp 92 PID 3660 wrote to memory of 5064 3660 3633.tmp 92 PID 3660 wrote to memory of 5064 3660 3633.tmp 92 PID 5064 wrote to memory of 3952 5064 36A0.tmp 93 PID 5064 wrote to memory of 3952 5064 36A0.tmp 93 PID 5064 wrote to memory of 3952 5064 36A0.tmp 93 PID 3952 wrote to memory of 1612 3952 373C.tmp 94 PID 3952 wrote to memory of 1612 3952 373C.tmp 94 PID 3952 wrote to memory of 1612 3952 373C.tmp 94 PID 1612 wrote to memory of 776 1612 37D9.tmp 95 PID 1612 wrote to memory of 776 1612 37D9.tmp 95 PID 1612 wrote to memory of 776 1612 37D9.tmp 95 PID 776 wrote to memory of 1620 776 3856.tmp 96 PID 776 wrote to memory of 1620 776 3856.tmp 96 PID 776 wrote to memory of 1620 776 3856.tmp 96 PID 1620 wrote to memory of 2456 1620 38D3.tmp 97 PID 1620 wrote to memory of 2456 1620 38D3.tmp 97 PID 1620 wrote to memory of 2456 1620 38D3.tmp 97 PID 2456 wrote to memory of 1468 2456 395F.tmp 98 PID 2456 wrote to memory of 1468 2456 395F.tmp 98 PID 2456 wrote to memory of 1468 2456 395F.tmp 98 PID 1468 wrote to memory of 2632 1468 39DC.tmp 99 PID 1468 wrote to memory of 2632 1468 39DC.tmp 99 PID 1468 wrote to memory of 2632 1468 39DC.tmp 99 PID 2632 wrote to memory of 2992 2632 3A3A.tmp 100 PID 2632 wrote to memory of 2992 2632 3A3A.tmp 100 PID 2632 wrote to memory of 2992 2632 3A3A.tmp 100 PID 2992 wrote to memory of 3872 2992 3AC7.tmp 101 PID 2992 wrote to memory of 3872 2992 3AC7.tmp 101 PID 2992 wrote to memory of 3872 2992 3AC7.tmp 101 PID 3872 wrote to memory of 1440 3872 3B44.tmp 102 PID 3872 wrote to memory of 1440 3872 3B44.tmp 102 PID 3872 wrote to memory of 1440 3872 3B44.tmp 102 PID 1440 wrote to memory of 4888 1440 3BD0.tmp 103 PID 1440 wrote to memory of 4888 1440 3BD0.tmp 103 PID 1440 wrote to memory of 4888 1440 3BD0.tmp 103 PID 4888 wrote to memory of 3436 4888 3C4D.tmp 104 PID 4888 wrote to memory of 3436 4888 3C4D.tmp 104 PID 4888 wrote to memory of 3436 4888 3C4D.tmp 104 PID 3436 wrote to memory of 2832 3436 3CEA.tmp 105 PID 3436 wrote to memory of 2832 3436 3CEA.tmp 105 PID 3436 wrote to memory of 2832 3436 3CEA.tmp 105 PID 2832 wrote to memory of 1496 2832 3D76.tmp 106 PID 2832 wrote to memory of 1496 2832 3D76.tmp 106 PID 2832 wrote to memory of 1496 2832 3D76.tmp 106 PID 1496 wrote to memory of 1028 1496 3E03.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-01_b4c64e68c7c98b1ee9ca8410a457735e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-01_b4c64e68c7c98b1ee9ca8410a457735e_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\3393.tmp"C:\Users\Admin\AppData\Local\Temp\3393.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Users\Admin\AppData\Local\Temp\3410.tmp"C:\Users\Admin\AppData\Local\Temp\3410.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\347D.tmp"C:\Users\Admin\AppData\Local\Temp\347D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\350A.tmp"C:\Users\Admin\AppData\Local\Temp\350A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\3597.tmp"C:\Users\Admin\AppData\Local\Temp\3597.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\3633.tmp"C:\Users\Admin\AppData\Local\Temp\3633.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\36A0.tmp"C:\Users\Admin\AppData\Local\Temp\36A0.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\373C.tmp"C:\Users\Admin\AppData\Local\Temp\373C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\37D9.tmp"C:\Users\Admin\AppData\Local\Temp\37D9.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\3856.tmp"C:\Users\Admin\AppData\Local\Temp\3856.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Users\Admin\AppData\Local\Temp\38D3.tmp"C:\Users\Admin\AppData\Local\Temp\38D3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\395F.tmp"C:\Users\Admin\AppData\Local\Temp\395F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\39DC.tmp"C:\Users\Admin\AppData\Local\Temp\39DC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\3B44.tmp"C:\Users\Admin\AppData\Local\Temp\3B44.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\3BD0.tmp"C:\Users\Admin\AppData\Local\Temp\3BD0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\3D76.tmp"C:\Users\Admin\AppData\Local\Temp\3D76.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\3E03.tmp"C:\Users\Admin\AppData\Local\Temp\3E03.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\3E61.tmp"C:\Users\Admin\AppData\Local\Temp\3E61.tmp"23⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"24⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\3F3B.tmp"C:\Users\Admin\AppData\Local\Temp\3F3B.tmp"25⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"26⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\4035.tmp"C:\Users\Admin\AppData\Local\Temp\4035.tmp"27⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\40D2.tmp"C:\Users\Admin\AppData\Local\Temp\40D2.tmp"28⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\413F.tmp"C:\Users\Admin\AppData\Local\Temp\413F.tmp"29⤵
- Executes dropped EXE
PID:960 -
C:\Users\Admin\AppData\Local\Temp\418D.tmp"C:\Users\Admin\AppData\Local\Temp\418D.tmp"30⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\41EB.tmp"C:\Users\Admin\AppData\Local\Temp\41EB.tmp"31⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"32⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"33⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\4371.tmp"C:\Users\Admin\AppData\Local\Temp\4371.tmp"34⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\43CF.tmp"C:\Users\Admin\AppData\Local\Temp\43CF.tmp"35⤵
- Executes dropped EXE
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\441D.tmp"C:\Users\Admin\AppData\Local\Temp\441D.tmp"36⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"37⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"38⤵
- Executes dropped EXE
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"39⤵
- Executes dropped EXE
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"40⤵
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"41⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\45F2.tmp"C:\Users\Admin\AppData\Local\Temp\45F2.tmp"42⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"43⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"44⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"45⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"46⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"47⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"48⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"49⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"50⤵
- Executes dropped EXE
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"51⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"52⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"53⤵
- Executes dropped EXE
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"54⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"55⤵
- Executes dropped EXE
PID:712 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"56⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"57⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"58⤵
- Executes dropped EXE
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"59⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"60⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"61⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"62⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"63⤵
- Executes dropped EXE
PID:872 -
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"64⤵
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"65⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"66⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"67⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"68⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"69⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"70⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"71⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"72⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"73⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"74⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"75⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"76⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"77⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"78⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"79⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"80⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"81⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"82⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"83⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"84⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"85⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"86⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"87⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"88⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"89⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"90⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"91⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"92⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"93⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"94⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"95⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"96⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"97⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"98⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"99⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"100⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"101⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"102⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"103⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"104⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"105⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"106⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"107⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"108⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"109⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"110⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"111⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"112⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"113⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"114⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"115⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"116⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"117⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"118⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"119⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"120⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"121⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"122⤵PID:4892
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-