Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2024, 03:48
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-04_5b59519ac292f81ae411bc3951639ef2_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-04_5b59519ac292f81ae411bc3951639ef2_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-04_5b59519ac292f81ae411bc3951639ef2_mafia.exe
-
Size
487KB
-
MD5
5b59519ac292f81ae411bc3951639ef2
-
SHA1
a0e24b7575cd44396eeb80455a175e9b74660909
-
SHA256
8dda4c4d1f1917db9492682ff6945a7a920dbc96d2784211d8ffec487f84497e
-
SHA512
05756d6341f5b6b3d367a21d916036880663995c06c5c70ecafa42a4550b01e82b76b9673dfd1394392b6addf895a115cf1654e4b069b8dff1c0f0e3ea722975
-
SSDEEP
12288:HU5rCOTeiJZxrXNBR3kPDHH9G39g4BNZ:HUQOJJZjkPDnglN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 976 39DC.tmp 3804 3A4A.tmp 1948 3AC7.tmp 2880 3B34.tmp 3172 3B82.tmp 3104 3BE0.tmp 4180 3C5D.tmp 632 3CAB.tmp 5024 3D09.tmp 1536 3D76.tmp 5088 3DC4.tmp 4124 3E12.tmp 4260 3E61.tmp 4852 3EBE.tmp 2272 3F2C.tmp 4868 3F89.tmp 4372 3FD8.tmp 3272 4045.tmp 840 4093.tmp 404 4100.tmp 3484 416E.tmp 3328 41DB.tmp 748 4249.tmp 4324 42A6.tmp 3424 42F4.tmp 3284 4362.tmp 2208 43B0.tmp 3308 440E.tmp 3396 447B.tmp 4668 44D9.tmp 4928 4527.tmp 3320 4575.tmp 4676 45C3.tmp 3028 4611.tmp 944 466F.tmp 3180 46CD.tmp 4228 471B.tmp 3720 4779.tmp 728 47C7.tmp 4348 4825.tmp 4644 4882.tmp 1920 48F0.tmp 3316 494D.tmp 3116 49AB.tmp 4816 49F9.tmp 4008 4A57.tmp 1036 4AB5.tmp 3068 4B03.tmp 8 4B61.tmp 3340 4BBE.tmp 232 4C0D.tmp 2844 4C6A.tmp 3172 4CB8.tmp 5016 4D07.tmp 2004 4D64.tmp 5080 4DC2.tmp 632 4E10.tmp 4172 4E5E.tmp 1544 4EAC.tmp 316 4EFB.tmp 1932 4F49.tmp 1484 4F97.tmp 4308 4FF5.tmp 3188 5043.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1368 wrote to memory of 976 1368 2024-05-04_5b59519ac292f81ae411bc3951639ef2_mafia.exe 83 PID 1368 wrote to memory of 976 1368 2024-05-04_5b59519ac292f81ae411bc3951639ef2_mafia.exe 83 PID 1368 wrote to memory of 976 1368 2024-05-04_5b59519ac292f81ae411bc3951639ef2_mafia.exe 83 PID 976 wrote to memory of 3804 976 39DC.tmp 84 PID 976 wrote to memory of 3804 976 39DC.tmp 84 PID 976 wrote to memory of 3804 976 39DC.tmp 84 PID 3804 wrote to memory of 1948 3804 3A4A.tmp 86 PID 3804 wrote to memory of 1948 3804 3A4A.tmp 86 PID 3804 wrote to memory of 1948 3804 3A4A.tmp 86 PID 1948 wrote to memory of 2880 1948 3AC7.tmp 87 PID 1948 wrote to memory of 2880 1948 3AC7.tmp 87 PID 1948 wrote to memory of 2880 1948 3AC7.tmp 87 PID 2880 wrote to memory of 3172 2880 3B34.tmp 88 PID 2880 wrote to memory of 3172 2880 3B34.tmp 88 PID 2880 wrote to memory of 3172 2880 3B34.tmp 88 PID 3172 wrote to memory of 3104 3172 3B82.tmp 90 PID 3172 wrote to memory of 3104 3172 3B82.tmp 90 PID 3172 wrote to memory of 3104 3172 3B82.tmp 90 PID 3104 wrote to memory of 4180 3104 3BE0.tmp 91 PID 3104 wrote to memory of 4180 3104 3BE0.tmp 91 PID 3104 wrote to memory of 4180 3104 3BE0.tmp 91 PID 4180 wrote to memory of 632 4180 3C5D.tmp 92 PID 4180 wrote to memory of 632 4180 3C5D.tmp 92 PID 4180 wrote to memory of 632 4180 3C5D.tmp 92 PID 632 wrote to memory of 5024 632 3CAB.tmp 93 PID 632 wrote to memory of 5024 632 3CAB.tmp 93 PID 632 wrote to memory of 5024 632 3CAB.tmp 93 PID 5024 wrote to memory of 1536 5024 3D09.tmp 94 PID 5024 wrote to memory of 1536 5024 3D09.tmp 94 PID 5024 wrote to memory of 1536 5024 3D09.tmp 94 PID 1536 wrote to memory of 5088 1536 3D76.tmp 95 PID 1536 wrote to memory of 5088 1536 3D76.tmp 95 PID 1536 wrote to memory of 5088 1536 3D76.tmp 95 PID 5088 wrote to memory of 4124 5088 3DC4.tmp 96 PID 5088 wrote to memory of 4124 5088 3DC4.tmp 96 PID 5088 wrote to memory of 4124 5088 3DC4.tmp 96 PID 4124 wrote to memory of 4260 4124 3E12.tmp 97 PID 4124 wrote to memory of 4260 4124 3E12.tmp 97 PID 4124 wrote to memory of 4260 4124 3E12.tmp 97 PID 4260 wrote to memory of 4852 4260 3E61.tmp 98 PID 4260 wrote to memory of 4852 4260 3E61.tmp 98 PID 4260 wrote to memory of 4852 4260 3E61.tmp 98 PID 4852 wrote to memory of 2272 4852 3EBE.tmp 99 PID 4852 wrote to memory of 2272 4852 3EBE.tmp 99 PID 4852 wrote to memory of 2272 4852 3EBE.tmp 99 PID 2272 wrote to memory of 4868 2272 3F2C.tmp 100 PID 2272 wrote to memory of 4868 2272 3F2C.tmp 100 PID 2272 wrote to memory of 4868 2272 3F2C.tmp 100 PID 4868 wrote to memory of 4372 4868 3F89.tmp 101 PID 4868 wrote to memory of 4372 4868 3F89.tmp 101 PID 4868 wrote to memory of 4372 4868 3F89.tmp 101 PID 4372 wrote to memory of 3272 4372 3FD8.tmp 102 PID 4372 wrote to memory of 3272 4372 3FD8.tmp 102 PID 4372 wrote to memory of 3272 4372 3FD8.tmp 102 PID 3272 wrote to memory of 840 3272 4045.tmp 103 PID 3272 wrote to memory of 840 3272 4045.tmp 103 PID 3272 wrote to memory of 840 3272 4045.tmp 103 PID 840 wrote to memory of 404 840 4093.tmp 104 PID 840 wrote to memory of 404 840 4093.tmp 104 PID 840 wrote to memory of 404 840 4093.tmp 104 PID 404 wrote to memory of 3484 404 4100.tmp 105 PID 404 wrote to memory of 3484 404 4100.tmp 105 PID 404 wrote to memory of 3484 404 4100.tmp 105 PID 3484 wrote to memory of 3328 3484 416E.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-04_5b59519ac292f81ae411bc3951639ef2_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-04_5b59519ac292f81ae411bc3951639ef2_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\39DC.tmp"C:\Users\Admin\AppData\Local\Temp\39DC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\3B34.tmp"C:\Users\Admin\AppData\Local\Temp\3B34.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\3B82.tmp"C:\Users\Admin\AppData\Local\Temp\3B82.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\3CAB.tmp"C:\Users\Admin\AppData\Local\Temp\3CAB.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\3D09.tmp"C:\Users\Admin\AppData\Local\Temp\3D09.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\3D76.tmp"C:\Users\Admin\AppData\Local\Temp\3D76.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\3E12.tmp"C:\Users\Admin\AppData\Local\Temp\3E12.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\3E61.tmp"C:\Users\Admin\AppData\Local\Temp\3E61.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\3F89.tmp"C:\Users\Admin\AppData\Local\Temp\3F89.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\4045.tmp"C:\Users\Admin\AppData\Local\Temp\4045.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\4093.tmp"C:\Users\Admin\AppData\Local\Temp\4093.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\4100.tmp"C:\Users\Admin\AppData\Local\Temp\4100.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\416E.tmp"C:\Users\Admin\AppData\Local\Temp\416E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\41DB.tmp"C:\Users\Admin\AppData\Local\Temp\41DB.tmp"23⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"24⤵
- Executes dropped EXE
PID:748 -
C:\Users\Admin\AppData\Local\Temp\42A6.tmp"C:\Users\Admin\AppData\Local\Temp\42A6.tmp"25⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\42F4.tmp"C:\Users\Admin\AppData\Local\Temp\42F4.tmp"26⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\4362.tmp"C:\Users\Admin\AppData\Local\Temp\4362.tmp"27⤵
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\43B0.tmp"C:\Users\Admin\AppData\Local\Temp\43B0.tmp"28⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"29⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\447B.tmp"C:\Users\Admin\AppData\Local\Temp\447B.tmp"30⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"31⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"32⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"33⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"34⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"35⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"36⤵
- Executes dropped EXE
PID:944 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"37⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"38⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"39⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"40⤵
- Executes dropped EXE
PID:728 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"41⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"42⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"43⤵
- Executes dropped EXE
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"44⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"45⤵
- Executes dropped EXE
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"46⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"47⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"48⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"49⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"50⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"51⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"52⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"53⤵
- Executes dropped EXE
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"54⤵
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"55⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"56⤵
- Executes dropped EXE
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"57⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"58⤵
- Executes dropped EXE
PID:632 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"59⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"60⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"61⤵
- Executes dropped EXE
PID:316 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"62⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"63⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"64⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"65⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"66⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"67⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"68⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"69⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"70⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"71⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"72⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"73⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"74⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"75⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"76⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"77⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"78⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"79⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"80⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"81⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"82⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"83⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"84⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"85⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"86⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"87⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"88⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"89⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"90⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"91⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"92⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"93⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"94⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"95⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"96⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"97⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"98⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"99⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"100⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"101⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"102⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"103⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"104⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"105⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"106⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"107⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"108⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"109⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"110⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"111⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"112⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"113⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"114⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"115⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"116⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"117⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"118⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"119⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"120⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"121⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"122⤵PID:4616
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-