Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 15:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-14_0893584a3bfc10491db4ceca4111d650_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-14_0893584a3bfc10491db4ceca4111d650_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-05-14_0893584a3bfc10491db4ceca4111d650_mafia.exe
-
Size
486KB
-
MD5
0893584a3bfc10491db4ceca4111d650
-
SHA1
eabb682626597828051bb4939bbdaef31206c00d
-
SHA256
f22a47f9ae690d1e32e2c741a511ba8a734302dd4fdbac69016fd5675ba9882c
-
SHA512
274db1085024909b9b589caf5a3c09258633dcf854579241353f73ad5763166bf039cd215ce409ef0f9b12d273994d9f5eccf99ba13dc3ad505f6b729c2fe319
-
SSDEEP
12288:UU5rCOTeiDIOvl0XrAgaYnWo9ImT2F4hnpNZ:UUQOJDo7AgaYamO4hnpN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4996 1F5A.tmp 2056 21BC.tmp 3948 2277.tmp 3568 23FE.tmp 1856 24D9.tmp 1952 2601.tmp 4320 26CD.tmp 972 2798.tmp 4548 298C.tmp 5612 2A66.tmp 5392 2B22.tmp 5424 2BDD.tmp 5768 2CD7.tmp 5364 2DD1.tmp 5368 2F0A.tmp 1448 3004.tmp 3272 310E.tmp 3384 31D9.tmp 644 32D3.tmp 5948 33EC.tmp 5900 34A7.tmp 5892 3563.tmp 5972 362E.tmp 6016 36EA.tmp 5484 3786.tmp 3308 3870.tmp 4988 390C.tmp 5544 39E7.tmp 3468 3AD2.tmp 1380 3C29.tmp 1016 3CF4.tmp 5764 3DDF.tmp 5820 3EAA.tmp 5812 3F27.tmp 2440 3FB4.tmp 5840 407F.tmp 4520 414A.tmp 3784 41B7.tmp 2164 4253.tmp 4868 432E.tmp 3084 4419.tmp 6024 44A5.tmp 4816 45CE.tmp 3792 465B.tmp 1852 46D8.tmp 3564 4745.tmp 4008 47D2.tmp 4276 486E.tmp 3900 490A.tmp 5184 4987.tmp 5088 4A14.tmp 3872 4AB0.tmp 2328 4B6C.tmp 5176 4BE9.tmp 2588 4C56.tmp 496 4CE3.tmp 4824 4D6F.tmp 2932 4E0B.tmp 1652 4E98.tmp 3416 4F15.tmp 3532 4FA2.tmp 2884 502E.tmp 6048 50BB.tmp 1436 5128.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2620 wrote to memory of 4996 2620 2024-05-14_0893584a3bfc10491db4ceca4111d650_mafia.exe 91 PID 2620 wrote to memory of 4996 2620 2024-05-14_0893584a3bfc10491db4ceca4111d650_mafia.exe 91 PID 2620 wrote to memory of 4996 2620 2024-05-14_0893584a3bfc10491db4ceca4111d650_mafia.exe 91 PID 4996 wrote to memory of 2056 4996 1F5A.tmp 92 PID 4996 wrote to memory of 2056 4996 1F5A.tmp 92 PID 4996 wrote to memory of 2056 4996 1F5A.tmp 92 PID 2056 wrote to memory of 3948 2056 21BC.tmp 93 PID 2056 wrote to memory of 3948 2056 21BC.tmp 93 PID 2056 wrote to memory of 3948 2056 21BC.tmp 93 PID 3948 wrote to memory of 3568 3948 2277.tmp 94 PID 3948 wrote to memory of 3568 3948 2277.tmp 94 PID 3948 wrote to memory of 3568 3948 2277.tmp 94 PID 3568 wrote to memory of 1856 3568 23FE.tmp 95 PID 3568 wrote to memory of 1856 3568 23FE.tmp 95 PID 3568 wrote to memory of 1856 3568 23FE.tmp 95 PID 1856 wrote to memory of 1952 1856 24D9.tmp 96 PID 1856 wrote to memory of 1952 1856 24D9.tmp 96 PID 1856 wrote to memory of 1952 1856 24D9.tmp 96 PID 1952 wrote to memory of 4320 1952 2601.tmp 97 PID 1952 wrote to memory of 4320 1952 2601.tmp 97 PID 1952 wrote to memory of 4320 1952 2601.tmp 97 PID 4320 wrote to memory of 972 4320 26CD.tmp 98 PID 4320 wrote to memory of 972 4320 26CD.tmp 98 PID 4320 wrote to memory of 972 4320 26CD.tmp 98 PID 972 wrote to memory of 4548 972 2798.tmp 99 PID 972 wrote to memory of 4548 972 2798.tmp 99 PID 972 wrote to memory of 4548 972 2798.tmp 99 PID 4548 wrote to memory of 5612 4548 298C.tmp 100 PID 4548 wrote to memory of 5612 4548 298C.tmp 100 PID 4548 wrote to memory of 5612 4548 298C.tmp 100 PID 5612 wrote to memory of 5392 5612 2A66.tmp 101 PID 5612 wrote to memory of 5392 5612 2A66.tmp 101 PID 5612 wrote to memory of 5392 5612 2A66.tmp 101 PID 5392 wrote to memory of 5424 5392 2B22.tmp 102 PID 5392 wrote to memory of 5424 5392 2B22.tmp 102 PID 5392 wrote to memory of 5424 5392 2B22.tmp 102 PID 5424 wrote to memory of 5768 5424 2BDD.tmp 103 PID 5424 wrote to memory of 5768 5424 2BDD.tmp 103 PID 5424 wrote to memory of 5768 5424 2BDD.tmp 103 PID 5768 wrote to memory of 5364 5768 2CD7.tmp 104 PID 5768 wrote to memory of 5364 5768 2CD7.tmp 104 PID 5768 wrote to memory of 5364 5768 2CD7.tmp 104 PID 5364 wrote to memory of 5368 5364 2DD1.tmp 105 PID 5364 wrote to memory of 5368 5364 2DD1.tmp 105 PID 5364 wrote to memory of 5368 5364 2DD1.tmp 105 PID 5368 wrote to memory of 1448 5368 2F0A.tmp 106 PID 5368 wrote to memory of 1448 5368 2F0A.tmp 106 PID 5368 wrote to memory of 1448 5368 2F0A.tmp 106 PID 1448 wrote to memory of 3272 1448 3004.tmp 107 PID 1448 wrote to memory of 3272 1448 3004.tmp 107 PID 1448 wrote to memory of 3272 1448 3004.tmp 107 PID 3272 wrote to memory of 3384 3272 310E.tmp 108 PID 3272 wrote to memory of 3384 3272 310E.tmp 108 PID 3272 wrote to memory of 3384 3272 310E.tmp 108 PID 3384 wrote to memory of 644 3384 31D9.tmp 109 PID 3384 wrote to memory of 644 3384 31D9.tmp 109 PID 3384 wrote to memory of 644 3384 31D9.tmp 109 PID 644 wrote to memory of 5948 644 32D3.tmp 110 PID 644 wrote to memory of 5948 644 32D3.tmp 110 PID 644 wrote to memory of 5948 644 32D3.tmp 110 PID 5948 wrote to memory of 5900 5948 33EC.tmp 111 PID 5948 wrote to memory of 5900 5948 33EC.tmp 111 PID 5948 wrote to memory of 5900 5948 33EC.tmp 111 PID 5900 wrote to memory of 5892 5900 34A7.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-14_0893584a3bfc10491db4ceca4111d650_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-14_0893584a3bfc10491db4ceca4111d650_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\1F5A.tmp"C:\Users\Admin\AppData\Local\Temp\1F5A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\21BC.tmp"C:\Users\Admin\AppData\Local\Temp\21BC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\2277.tmp"C:\Users\Admin\AppData\Local\Temp\2277.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\23FE.tmp"C:\Users\Admin\AppData\Local\Temp\23FE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\24D9.tmp"C:\Users\Admin\AppData\Local\Temp\24D9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\2601.tmp"C:\Users\Admin\AppData\Local\Temp\2601.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\26CD.tmp"C:\Users\Admin\AppData\Local\Temp\26CD.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\2798.tmp"C:\Users\Admin\AppData\Local\Temp\2798.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\298C.tmp"C:\Users\Admin\AppData\Local\Temp\298C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\2A66.tmp"C:\Users\Admin\AppData\Local\Temp\2A66.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Users\Admin\AppData\Local\Temp\2B22.tmp"C:\Users\Admin\AppData\Local\Temp\2B22.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Users\Admin\AppData\Local\Temp\2CD7.tmp"C:\Users\Admin\AppData\Local\Temp\2CD7.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Users\Admin\AppData\Local\Temp\2DD1.tmp"C:\Users\Admin\AppData\Local\Temp\2DD1.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Users\Admin\AppData\Local\Temp\2F0A.tmp"C:\Users\Admin\AppData\Local\Temp\2F0A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Users\Admin\AppData\Local\Temp\3004.tmp"C:\Users\Admin\AppData\Local\Temp\3004.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\310E.tmp"C:\Users\Admin\AppData\Local\Temp\310E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\31D9.tmp"C:\Users\Admin\AppData\Local\Temp\31D9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\32D3.tmp"C:\Users\Admin\AppData\Local\Temp\32D3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Users\Admin\AppData\Local\Temp\3563.tmp"C:\Users\Admin\AppData\Local\Temp\3563.tmp"23⤵
- Executes dropped EXE
PID:5892 -
C:\Users\Admin\AppData\Local\Temp\362E.tmp"C:\Users\Admin\AppData\Local\Temp\362E.tmp"24⤵
- Executes dropped EXE
PID:5972 -
C:\Users\Admin\AppData\Local\Temp\36EA.tmp"C:\Users\Admin\AppData\Local\Temp\36EA.tmp"25⤵
- Executes dropped EXE
PID:6016 -
C:\Users\Admin\AppData\Local\Temp\3786.tmp"C:\Users\Admin\AppData\Local\Temp\3786.tmp"26⤵
- Executes dropped EXE
PID:5484 -
C:\Users\Admin\AppData\Local\Temp\3870.tmp"C:\Users\Admin\AppData\Local\Temp\3870.tmp"27⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\390C.tmp"C:\Users\Admin\AppData\Local\Temp\390C.tmp"28⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\39E7.tmp"C:\Users\Admin\AppData\Local\Temp\39E7.tmp"29⤵
- Executes dropped EXE
PID:5544 -
C:\Users\Admin\AppData\Local\Temp\3AD2.tmp"C:\Users\Admin\AppData\Local\Temp\3AD2.tmp"30⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\3C29.tmp"C:\Users\Admin\AppData\Local\Temp\3C29.tmp"31⤵
- Executes dropped EXE
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\3CF4.tmp"C:\Users\Admin\AppData\Local\Temp\3CF4.tmp"32⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\3DDF.tmp"C:\Users\Admin\AppData\Local\Temp\3DDF.tmp"33⤵
- Executes dropped EXE
PID:5764 -
C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"34⤵
- Executes dropped EXE
PID:5820 -
C:\Users\Admin\AppData\Local\Temp\3F27.tmp"C:\Users\Admin\AppData\Local\Temp\3F27.tmp"35⤵
- Executes dropped EXE
PID:5812 -
C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"36⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\407F.tmp"C:\Users\Admin\AppData\Local\Temp\407F.tmp"37⤵
- Executes dropped EXE
PID:5840 -
C:\Users\Admin\AppData\Local\Temp\414A.tmp"C:\Users\Admin\AppData\Local\Temp\414A.tmp"38⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\41B7.tmp"C:\Users\Admin\AppData\Local\Temp\41B7.tmp"39⤵
- Executes dropped EXE
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\4253.tmp"C:\Users\Admin\AppData\Local\Temp\4253.tmp"40⤵
- Executes dropped EXE
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\432E.tmp"C:\Users\Admin\AppData\Local\Temp\432E.tmp"41⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\4419.tmp"C:\Users\Admin\AppData\Local\Temp\4419.tmp"42⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\44A5.tmp"C:\Users\Admin\AppData\Local\Temp\44A5.tmp"43⤵
- Executes dropped EXE
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\45CE.tmp"C:\Users\Admin\AppData\Local\Temp\45CE.tmp"44⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\465B.tmp"C:\Users\Admin\AppData\Local\Temp\465B.tmp"45⤵
- Executes dropped EXE
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\46D8.tmp"C:\Users\Admin\AppData\Local\Temp\46D8.tmp"46⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\4745.tmp"C:\Users\Admin\AppData\Local\Temp\4745.tmp"47⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\47D2.tmp"C:\Users\Admin\AppData\Local\Temp\47D2.tmp"48⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\486E.tmp"C:\Users\Admin\AppData\Local\Temp\486E.tmp"49⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\490A.tmp"C:\Users\Admin\AppData\Local\Temp\490A.tmp"50⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\4987.tmp"C:\Users\Admin\AppData\Local\Temp\4987.tmp"51⤵
- Executes dropped EXE
PID:5184 -
C:\Users\Admin\AppData\Local\Temp\4A14.tmp"C:\Users\Admin\AppData\Local\Temp\4A14.tmp"52⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"53⤵
- Executes dropped EXE
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\4B6C.tmp"C:\Users\Admin\AppData\Local\Temp\4B6C.tmp"54⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\4BE9.tmp"C:\Users\Admin\AppData\Local\Temp\4BE9.tmp"55⤵
- Executes dropped EXE
PID:5176 -
C:\Users\Admin\AppData\Local\Temp\4C56.tmp"C:\Users\Admin\AppData\Local\Temp\4C56.tmp"56⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\4CE3.tmp"C:\Users\Admin\AppData\Local\Temp\4CE3.tmp"57⤵
- Executes dropped EXE
PID:496 -
C:\Users\Admin\AppData\Local\Temp\4D6F.tmp"C:\Users\Admin\AppData\Local\Temp\4D6F.tmp"58⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\4E0B.tmp"C:\Users\Admin\AppData\Local\Temp\4E0B.tmp"59⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\4E98.tmp"C:\Users\Admin\AppData\Local\Temp\4E98.tmp"60⤵
- Executes dropped EXE
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\4F15.tmp"C:\Users\Admin\AppData\Local\Temp\4F15.tmp"61⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\4FA2.tmp"C:\Users\Admin\AppData\Local\Temp\4FA2.tmp"62⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\502E.tmp"C:\Users\Admin\AppData\Local\Temp\502E.tmp"63⤵
- Executes dropped EXE
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\50BB.tmp"C:\Users\Admin\AppData\Local\Temp\50BB.tmp"64⤵
- Executes dropped EXE
PID:6048 -
C:\Users\Admin\AppData\Local\Temp\5128.tmp"C:\Users\Admin\AppData\Local\Temp\5128.tmp"65⤵
- Executes dropped EXE
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\51A5.tmp"C:\Users\Admin\AppData\Local\Temp\51A5.tmp"66⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\5213.tmp"C:\Users\Admin\AppData\Local\Temp\5213.tmp"67⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\52BF.tmp"C:\Users\Admin\AppData\Local\Temp\52BF.tmp"68⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\533C.tmp"C:\Users\Admin\AppData\Local\Temp\533C.tmp"69⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\53C8.tmp"C:\Users\Admin\AppData\Local\Temp\53C8.tmp"70⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\5474.tmp"C:\Users\Admin\AppData\Local\Temp\5474.tmp"71⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\5501.tmp"C:\Users\Admin\AppData\Local\Temp\5501.tmp"72⤵PID:6004
-
C:\Users\Admin\AppData\Local\Temp\558D.tmp"C:\Users\Admin\AppData\Local\Temp\558D.tmp"73⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\55FB.tmp"C:\Users\Admin\AppData\Local\Temp\55FB.tmp"74⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\5752.tmp"C:\Users\Admin\AppData\Local\Temp\5752.tmp"75⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\57CF.tmp"C:\Users\Admin\AppData\Local\Temp\57CF.tmp"76⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\583D.tmp"C:\Users\Admin\AppData\Local\Temp\583D.tmp"77⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\5908.tmp"C:\Users\Admin\AppData\Local\Temp\5908.tmp"78⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\5975.tmp"C:\Users\Admin\AppData\Local\Temp\5975.tmp"79⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\59F2.tmp"C:\Users\Admin\AppData\Local\Temp\59F2.tmp"80⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"81⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"82⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\5B79.tmp"C:\Users\Admin\AppData\Local\Temp\5B79.tmp"83⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\5BF6.tmp"C:\Users\Admin\AppData\Local\Temp\5BF6.tmp"84⤵PID:5412
-
C:\Users\Admin\AppData\Local\Temp\5C63.tmp"C:\Users\Admin\AppData\Local\Temp\5C63.tmp"85⤵PID:5416
-
C:\Users\Admin\AppData\Local\Temp\5CD1.tmp"C:\Users\Admin\AppData\Local\Temp\5CD1.tmp"86⤵PID:5612
-
C:\Users\Admin\AppData\Local\Temp\5D6D.tmp"C:\Users\Admin\AppData\Local\Temp\5D6D.tmp"87⤵PID:5440
-
C:\Users\Admin\AppData\Local\Temp\5DDA.tmp"C:\Users\Admin\AppData\Local\Temp\5DDA.tmp"88⤵PID:5632
-
C:\Users\Admin\AppData\Local\Temp\5E48.tmp"C:\Users\Admin\AppData\Local\Temp\5E48.tmp"89⤵PID:5628
-
C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"90⤵PID:5336
-
C:\Users\Admin\AppData\Local\Temp\5F51.tmp"C:\Users\Admin\AppData\Local\Temp\5F51.tmp"91⤵PID:5356
-
C:\Users\Admin\AppData\Local\Temp\600D.tmp"C:\Users\Admin\AppData\Local\Temp\600D.tmp"92⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\607A.tmp"C:\Users\Admin\AppData\Local\Temp\607A.tmp"93⤵PID:5396
-
C:\Users\Admin\AppData\Local\Temp\60E8.tmp"C:\Users\Admin\AppData\Local\Temp\60E8.tmp"94⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\6184.tmp"C:\Users\Admin\AppData\Local\Temp\6184.tmp"95⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\6220.tmp"C:\Users\Admin\AppData\Local\Temp\6220.tmp"96⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\62AD.tmp"C:\Users\Admin\AppData\Local\Temp\62AD.tmp"97⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\6339.tmp"C:\Users\Admin\AppData\Local\Temp\6339.tmp"98⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\63A7.tmp"C:\Users\Admin\AppData\Local\Temp\63A7.tmp"99⤵PID:5912
-
C:\Users\Admin\AppData\Local\Temp\6424.tmp"C:\Users\Admin\AppData\Local\Temp\6424.tmp"100⤵PID:5964
-
C:\Users\Admin\AppData\Local\Temp\64A1.tmp"C:\Users\Admin\AppData\Local\Temp\64A1.tmp"101⤵PID:5916
-
C:\Users\Admin\AppData\Local\Temp\652D.tmp"C:\Users\Admin\AppData\Local\Temp\652D.tmp"102⤵PID:5984
-
C:\Users\Admin\AppData\Local\Temp\65BA.tmp"C:\Users\Admin\AppData\Local\Temp\65BA.tmp"103⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\6637.tmp"C:\Users\Admin\AppData\Local\Temp\6637.tmp"104⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\66A4.tmp"C:\Users\Admin\AppData\Local\Temp\66A4.tmp"105⤵PID:5488
-
C:\Users\Admin\AppData\Local\Temp\6750.tmp"C:\Users\Admin\AppData\Local\Temp\6750.tmp"106⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\67DD.tmp"C:\Users\Admin\AppData\Local\Temp\67DD.tmp"107⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\6869.tmp"C:\Users\Admin\AppData\Local\Temp\6869.tmp"108⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\68F6.tmp"C:\Users\Admin\AppData\Local\Temp\68F6.tmp"109⤵PID:5480
-
C:\Users\Admin\AppData\Local\Temp\6983.tmp"C:\Users\Admin\AppData\Local\Temp\6983.tmp"110⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\6A00.tmp"C:\Users\Admin\AppData\Local\Temp\6A00.tmp"111⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\6A6D.tmp"C:\Users\Admin\AppData\Local\Temp\6A6D.tmp"112⤵PID:5544
-
C:\Users\Admin\AppData\Local\Temp\6B09.tmp"C:\Users\Admin\AppData\Local\Temp\6B09.tmp"113⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\6BB5.tmp"C:\Users\Admin\AppData\Local\Temp\6BB5.tmp"114⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\6C32.tmp"C:\Users\Admin\AppData\Local\Temp\6C32.tmp"115⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\6CCE.tmp"C:\Users\Admin\AppData\Local\Temp\6CCE.tmp"116⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\6D4B.tmp"C:\Users\Admin\AppData\Local\Temp\6D4B.tmp"117⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\6DE8.tmp"C:\Users\Admin\AppData\Local\Temp\6DE8.tmp"118⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\6E55.tmp"C:\Users\Admin\AppData\Local\Temp\6E55.tmp"119⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\6EF1.tmp"C:\Users\Admin\AppData\Local\Temp\6EF1.tmp"120⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\6F7E.tmp"C:\Users\Admin\AppData\Local\Temp\6F7E.tmp"121⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\6FEB.tmp"C:\Users\Admin\AppData\Local\Temp\6FEB.tmp"122⤵PID:216
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-