Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2024, 15:47
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-05_2fb6ff29e64a2c74e23e2faabbd6c640_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-05_2fb6ff29e64a2c74e23e2faabbd6c640_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-05_2fb6ff29e64a2c74e23e2faabbd6c640_mafia.exe
-
Size
529KB
-
MD5
2fb6ff29e64a2c74e23e2faabbd6c640
-
SHA1
5a9bef3b5512762c3ed6fe869330632973d1b50f
-
SHA256
dff21502787ccb11fe4f87044f28590966e82d64c16c607ffdfb09cc060de7a7
-
SHA512
e914012f6f04cd81fa710303cf45cfe2b02d7d81be28b8cfa0f61a2a6e7cf3d8442d1d3be4242a0f8051e17c6fe168759166d553257946c0924540d52e920e35
-
SSDEEP
12288:NU5rCOTeijgV4zU5Zp6qkJ5UYSy41aFVJvNQEPTZwlH4Hp:NUQOJjgVR6Iy41GVYEPTSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2548 3F6A.tmp 544 3FD8.tmp 2716 4055.tmp 3148 40C2.tmp 5080 4120.tmp 2984 418D.tmp 3388 41FA.tmp 4772 4277.tmp 396 42D5.tmp 4368 4343.tmp 1300 43B0.tmp 428 43FE.tmp 4508 445C.tmp 440 44BA.tmp 1680 4537.tmp 2632 4585.tmp 3948 45E2.tmp 4908 4640.tmp 3712 469E.tmp 2840 46FC.tmp 3216 4769.tmp 4628 47C7.tmp 3692 4825.tmp 4484 4873.tmp 4956 48D0.tmp 2328 493E.tmp 4340 499C.tmp 2276 49EA.tmp 4580 4A47.tmp 4180 4A96.tmp 1932 4AF3.tmp 4828 4B41.tmp 2868 4B9F.tmp 2196 4BED.tmp 4316 4C3B.tmp 2168 4C8A.tmp 2148 4CC8.tmp 1420 4D16.tmp 1096 4D93.tmp 3552 4DE1.tmp 2740 4E3F.tmp 3884 4E8D.tmp 4904 4EDB.tmp 4384 4F29.tmp 216 4F87.tmp 3060 4FD5.tmp 836 5023.tmp 3616 5072.tmp 2176 50C0.tmp 1940 511D.tmp 3096 517B.tmp 3248 51C9.tmp 4928 5227.tmp 1536 5275.tmp 1108 52C3.tmp 1516 5311.tmp 8 5360.tmp 1676 53AE.tmp 2332 53FC.tmp 1480 545A.tmp 4388 54B7.tmp 4628 5505.tmp 1436 5563.tmp 1688 55B1.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1164 wrote to memory of 2548 1164 2024-05-05_2fb6ff29e64a2c74e23e2faabbd6c640_mafia.exe 83 PID 1164 wrote to memory of 2548 1164 2024-05-05_2fb6ff29e64a2c74e23e2faabbd6c640_mafia.exe 83 PID 1164 wrote to memory of 2548 1164 2024-05-05_2fb6ff29e64a2c74e23e2faabbd6c640_mafia.exe 83 PID 2548 wrote to memory of 544 2548 3F6A.tmp 84 PID 2548 wrote to memory of 544 2548 3F6A.tmp 84 PID 2548 wrote to memory of 544 2548 3F6A.tmp 84 PID 544 wrote to memory of 2716 544 3FD8.tmp 85 PID 544 wrote to memory of 2716 544 3FD8.tmp 85 PID 544 wrote to memory of 2716 544 3FD8.tmp 85 PID 2716 wrote to memory of 3148 2716 4055.tmp 87 PID 2716 wrote to memory of 3148 2716 4055.tmp 87 PID 2716 wrote to memory of 3148 2716 4055.tmp 87 PID 3148 wrote to memory of 5080 3148 40C2.tmp 88 PID 3148 wrote to memory of 5080 3148 40C2.tmp 88 PID 3148 wrote to memory of 5080 3148 40C2.tmp 88 PID 5080 wrote to memory of 2984 5080 4120.tmp 90 PID 5080 wrote to memory of 2984 5080 4120.tmp 90 PID 5080 wrote to memory of 2984 5080 4120.tmp 90 PID 2984 wrote to memory of 3388 2984 418D.tmp 91 PID 2984 wrote to memory of 3388 2984 418D.tmp 91 PID 2984 wrote to memory of 3388 2984 418D.tmp 91 PID 3388 wrote to memory of 4772 3388 41FA.tmp 92 PID 3388 wrote to memory of 4772 3388 41FA.tmp 92 PID 3388 wrote to memory of 4772 3388 41FA.tmp 92 PID 4772 wrote to memory of 396 4772 4277.tmp 93 PID 4772 wrote to memory of 396 4772 4277.tmp 93 PID 4772 wrote to memory of 396 4772 4277.tmp 93 PID 396 wrote to memory of 4368 396 42D5.tmp 94 PID 396 wrote to memory of 4368 396 42D5.tmp 94 PID 396 wrote to memory of 4368 396 42D5.tmp 94 PID 4368 wrote to memory of 1300 4368 4343.tmp 95 PID 4368 wrote to memory of 1300 4368 4343.tmp 95 PID 4368 wrote to memory of 1300 4368 4343.tmp 95 PID 1300 wrote to memory of 428 1300 43B0.tmp 96 PID 1300 wrote to memory of 428 1300 43B0.tmp 96 PID 1300 wrote to memory of 428 1300 43B0.tmp 96 PID 428 wrote to memory of 4508 428 43FE.tmp 97 PID 428 wrote to memory of 4508 428 43FE.tmp 97 PID 428 wrote to memory of 4508 428 43FE.tmp 97 PID 4508 wrote to memory of 440 4508 445C.tmp 98 PID 4508 wrote to memory of 440 4508 445C.tmp 98 PID 4508 wrote to memory of 440 4508 445C.tmp 98 PID 440 wrote to memory of 1680 440 44BA.tmp 99 PID 440 wrote to memory of 1680 440 44BA.tmp 99 PID 440 wrote to memory of 1680 440 44BA.tmp 99 PID 1680 wrote to memory of 2632 1680 4537.tmp 100 PID 1680 wrote to memory of 2632 1680 4537.tmp 100 PID 1680 wrote to memory of 2632 1680 4537.tmp 100 PID 2632 wrote to memory of 3948 2632 4585.tmp 101 PID 2632 wrote to memory of 3948 2632 4585.tmp 101 PID 2632 wrote to memory of 3948 2632 4585.tmp 101 PID 3948 wrote to memory of 4908 3948 45E2.tmp 102 PID 3948 wrote to memory of 4908 3948 45E2.tmp 102 PID 3948 wrote to memory of 4908 3948 45E2.tmp 102 PID 4908 wrote to memory of 3712 4908 4640.tmp 103 PID 4908 wrote to memory of 3712 4908 4640.tmp 103 PID 4908 wrote to memory of 3712 4908 4640.tmp 103 PID 3712 wrote to memory of 2840 3712 469E.tmp 104 PID 3712 wrote to memory of 2840 3712 469E.tmp 104 PID 3712 wrote to memory of 2840 3712 469E.tmp 104 PID 2840 wrote to memory of 3216 2840 46FC.tmp 105 PID 2840 wrote to memory of 3216 2840 46FC.tmp 105 PID 2840 wrote to memory of 3216 2840 46FC.tmp 105 PID 3216 wrote to memory of 4628 3216 4769.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-05_2fb6ff29e64a2c74e23e2faabbd6c640_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-05_2fb6ff29e64a2c74e23e2faabbd6c640_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Users\Admin\AppData\Local\Temp\4055.tmp"C:\Users\Admin\AppData\Local\Temp\4055.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\40C2.tmp"C:\Users\Admin\AppData\Local\Temp\40C2.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\4120.tmp"C:\Users\Admin\AppData\Local\Temp\4120.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\418D.tmp"C:\Users\Admin\AppData\Local\Temp\418D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\4277.tmp"C:\Users\Admin\AppData\Local\Temp\4277.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\43B0.tmp"C:\Users\Admin\AppData\Local\Temp\43B0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\43FE.tmp"C:\Users\Admin\AppData\Local\Temp\43FE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"23⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"24⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"25⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"26⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"27⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"28⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"29⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"30⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"31⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"32⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"33⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"34⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"35⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"36⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"37⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"38⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"39⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"40⤵
- Executes dropped EXE
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"41⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"42⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"43⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"44⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"45⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"46⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"47⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"48⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"49⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"50⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"51⤵
- Executes dropped EXE
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"52⤵
- Executes dropped EXE
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"53⤵
- Executes dropped EXE
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"54⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"55⤵
- Executes dropped EXE
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"56⤵
- Executes dropped EXE
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"57⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"58⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"59⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"60⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"61⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"62⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"63⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"64⤵
- Executes dropped EXE
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"65⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"66⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"67⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"68⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"69⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"70⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"71⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"72⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"73⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"74⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"75⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"76⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"77⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"78⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"79⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"80⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"81⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"82⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"83⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"84⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"85⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"86⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"87⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"88⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"89⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"90⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"91⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"92⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"93⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"94⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"95⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"96⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"97⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"98⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"99⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"100⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"101⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"102⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"103⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"104⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"105⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"106⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"107⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"108⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"109⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"110⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"111⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"112⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"113⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"114⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"115⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"116⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"117⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"118⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"119⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"120⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"121⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"122⤵PID:3588
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-