Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2024, 04:48
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-04_36b7ee860b8b3df2abf4fd90c63caf29_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-05-04_36b7ee860b8b3df2abf4fd90c63caf29_mafia.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-05-04_36b7ee860b8b3df2abf4fd90c63caf29_mafia.exe
-
Size
520KB
-
MD5
36b7ee860b8b3df2abf4fd90c63caf29
-
SHA1
32802f5d11451a9701cad7895caea91613263625
-
SHA256
7a973b7d8a5d62d52ceef3ab8724db040f9fa6facf25ab8247ba2d80fa026870
-
SHA512
3ea013fbf5a0d52b6c02c412a95dce751240162cc118d70955de44b7f1a12a17e63c28985bfda2ab0b9c0b9b3d0c1100f54157fc4a2370ed1e0e06a5d84f2d25
-
SSDEEP
12288:gj8fuxR21t5i8f5l4DbtMmZGc0qCu5aOktNZ:gj8fuK1GYfmZ5TCc4N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4680 396F.tmp 4136 39DC.tmp 3676 3A4A.tmp 1284 3AC7.tmp 4920 3B53.tmp 2208 3BC1.tmp 3908 3C1E.tmp 4788 3C9B.tmp 2904 3CEA.tmp 4628 3D47.tmp 2400 3DB5.tmp 4440 3E12.tmp 3440 3E80.tmp 1280 3ECE.tmp 844 3F1C.tmp 1924 3F7A.tmp 3456 3FE7.tmp 972 4035.tmp 1140 40C2.tmp 3136 4110.tmp 4540 418D.tmp 4072 41FA.tmp 3988 4249.tmp 1812 42A6.tmp 752 4314.tmp 4348 4362.tmp 2580 43DF.tmp 4512 443D.tmp 3980 449A.tmp 392 4527.tmp 4372 4585.tmp 5036 45E2.tmp 1516 4650.tmp 1580 469E.tmp 4136 46FC.tmp 2300 474A.tmp 1840 47A8.tmp 532 4815.tmp 1284 4873.tmp 2212 48C1.tmp 4108 490F.tmp 2904 495D.tmp 2772 49AB.tmp 3672 49F9.tmp 844 4A57.tmp 1176 4AB5.tmp 400 4B03.tmp 3936 4B51.tmp 1140 4B9F.tmp 4580 4BED.tmp 2356 4C3B.tmp 3136 4C99.tmp 5088 4CE7.tmp 4492 4D35.tmp 4708 4D93.tmp 2736 4DF1.tmp 5112 4E4F.tmp 4300 4EAC.tmp 2728 4F0A.tmp 1928 4F68.tmp 4180 4FC6.tmp 3148 5033.tmp 4588 5091.tmp 2648 50EF.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3660 wrote to memory of 4680 3660 2024-05-04_36b7ee860b8b3df2abf4fd90c63caf29_mafia.exe 84 PID 3660 wrote to memory of 4680 3660 2024-05-04_36b7ee860b8b3df2abf4fd90c63caf29_mafia.exe 84 PID 3660 wrote to memory of 4680 3660 2024-05-04_36b7ee860b8b3df2abf4fd90c63caf29_mafia.exe 84 PID 4680 wrote to memory of 4136 4680 396F.tmp 85 PID 4680 wrote to memory of 4136 4680 396F.tmp 85 PID 4680 wrote to memory of 4136 4680 396F.tmp 85 PID 4136 wrote to memory of 3676 4136 39DC.tmp 86 PID 4136 wrote to memory of 3676 4136 39DC.tmp 86 PID 4136 wrote to memory of 3676 4136 39DC.tmp 86 PID 3676 wrote to memory of 1284 3676 3A4A.tmp 88 PID 3676 wrote to memory of 1284 3676 3A4A.tmp 88 PID 3676 wrote to memory of 1284 3676 3A4A.tmp 88 PID 1284 wrote to memory of 4920 1284 3AC7.tmp 89 PID 1284 wrote to memory of 4920 1284 3AC7.tmp 89 PID 1284 wrote to memory of 4920 1284 3AC7.tmp 89 PID 4920 wrote to memory of 2208 4920 3B53.tmp 91 PID 4920 wrote to memory of 2208 4920 3B53.tmp 91 PID 4920 wrote to memory of 2208 4920 3B53.tmp 91 PID 2208 wrote to memory of 3908 2208 3BC1.tmp 93 PID 2208 wrote to memory of 3908 2208 3BC1.tmp 93 PID 2208 wrote to memory of 3908 2208 3BC1.tmp 93 PID 3908 wrote to memory of 4788 3908 3C1E.tmp 94 PID 3908 wrote to memory of 4788 3908 3C1E.tmp 94 PID 3908 wrote to memory of 4788 3908 3C1E.tmp 94 PID 4788 wrote to memory of 2904 4788 3C9B.tmp 95 PID 4788 wrote to memory of 2904 4788 3C9B.tmp 95 PID 4788 wrote to memory of 2904 4788 3C9B.tmp 95 PID 2904 wrote to memory of 4628 2904 3CEA.tmp 96 PID 2904 wrote to memory of 4628 2904 3CEA.tmp 96 PID 2904 wrote to memory of 4628 2904 3CEA.tmp 96 PID 4628 wrote to memory of 2400 4628 3D47.tmp 97 PID 4628 wrote to memory of 2400 4628 3D47.tmp 97 PID 4628 wrote to memory of 2400 4628 3D47.tmp 97 PID 2400 wrote to memory of 4440 2400 3DB5.tmp 98 PID 2400 wrote to memory of 4440 2400 3DB5.tmp 98 PID 2400 wrote to memory of 4440 2400 3DB5.tmp 98 PID 4440 wrote to memory of 3440 4440 3E12.tmp 99 PID 4440 wrote to memory of 3440 4440 3E12.tmp 99 PID 4440 wrote to memory of 3440 4440 3E12.tmp 99 PID 3440 wrote to memory of 1280 3440 3E80.tmp 100 PID 3440 wrote to memory of 1280 3440 3E80.tmp 100 PID 3440 wrote to memory of 1280 3440 3E80.tmp 100 PID 1280 wrote to memory of 844 1280 3ECE.tmp 101 PID 1280 wrote to memory of 844 1280 3ECE.tmp 101 PID 1280 wrote to memory of 844 1280 3ECE.tmp 101 PID 844 wrote to memory of 1924 844 3F1C.tmp 102 PID 844 wrote to memory of 1924 844 3F1C.tmp 102 PID 844 wrote to memory of 1924 844 3F1C.tmp 102 PID 1924 wrote to memory of 3456 1924 3F7A.tmp 103 PID 1924 wrote to memory of 3456 1924 3F7A.tmp 103 PID 1924 wrote to memory of 3456 1924 3F7A.tmp 103 PID 3456 wrote to memory of 972 3456 3FE7.tmp 104 PID 3456 wrote to memory of 972 3456 3FE7.tmp 104 PID 3456 wrote to memory of 972 3456 3FE7.tmp 104 PID 972 wrote to memory of 1140 972 4035.tmp 106 PID 972 wrote to memory of 1140 972 4035.tmp 106 PID 972 wrote to memory of 1140 972 4035.tmp 106 PID 1140 wrote to memory of 3136 1140 40C2.tmp 107 PID 1140 wrote to memory of 3136 1140 40C2.tmp 107 PID 1140 wrote to memory of 3136 1140 40C2.tmp 107 PID 3136 wrote to memory of 4540 3136 4110.tmp 108 PID 3136 wrote to memory of 4540 3136 4110.tmp 108 PID 3136 wrote to memory of 4540 3136 4110.tmp 108 PID 4540 wrote to memory of 4072 4540 418D.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-04_36b7ee860b8b3df2abf4fd90c63caf29_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-04_36b7ee860b8b3df2abf4fd90c63caf29_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\396F.tmp"C:\Users\Admin\AppData\Local\Temp\396F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\39DC.tmp"C:\Users\Admin\AppData\Local\Temp\39DC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\3B53.tmp"C:\Users\Admin\AppData\Local\Temp\3B53.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\3D47.tmp"C:\Users\Admin\AppData\Local\Temp\3D47.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\3E12.tmp"C:\Users\Admin\AppData\Local\Temp\3E12.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\3E80.tmp"C:\Users\Admin\AppData\Local\Temp\3E80.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\4035.tmp"C:\Users\Admin\AppData\Local\Temp\4035.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\40C2.tmp"C:\Users\Admin\AppData\Local\Temp\40C2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\4110.tmp"C:\Users\Admin\AppData\Local\Temp\4110.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\418D.tmp"C:\Users\Admin\AppData\Local\Temp\418D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"23⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"24⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\42A6.tmp"C:\Users\Admin\AppData\Local\Temp\42A6.tmp"25⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\4314.tmp"C:\Users\Admin\AppData\Local\Temp\4314.tmp"26⤵
- Executes dropped EXE
PID:752 -
C:\Users\Admin\AppData\Local\Temp\4362.tmp"C:\Users\Admin\AppData\Local\Temp\4362.tmp"27⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"28⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\443D.tmp"C:\Users\Admin\AppData\Local\Temp\443D.tmp"29⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"30⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"31⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"32⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"33⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"34⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"35⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"36⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"37⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"38⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"39⤵
- Executes dropped EXE
PID:532 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"40⤵
- Executes dropped EXE
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"41⤵
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"42⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"43⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"44⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"45⤵
- Executes dropped EXE
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"46⤵
- Executes dropped EXE
PID:844 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"47⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"48⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"49⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"50⤵
- Executes dropped EXE
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"51⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"52⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"53⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"54⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"55⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"56⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"57⤵
- Executes dropped EXE
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"58⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"59⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"60⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"61⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"62⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"63⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"64⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"65⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"66⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"67⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"68⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"69⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"70⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"71⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"72⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"73⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"74⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"75⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"76⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"77⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"78⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"79⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"80⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"81⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"82⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"83⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"84⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"85⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"86⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"87⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"88⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"89⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"90⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"91⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"92⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"93⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"94⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"95⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"96⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"97⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"98⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"99⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"100⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"101⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"102⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"103⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"104⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"105⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"106⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"107⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"108⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"109⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"110⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"111⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"112⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"113⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"114⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"115⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"116⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"117⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"118⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"119⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"120⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"121⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"122⤵PID:532
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-