Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04/06/2024, 19:07
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-04_c464ba43cdf44ac5546c464ea7760f06_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-04_c464ba43cdf44ac5546c464ea7760f06_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-04_c464ba43cdf44ac5546c464ea7760f06_mafia.exe
-
Size
520KB
-
MD5
c464ba43cdf44ac5546c464ea7760f06
-
SHA1
b996aa1aea694fdbbe790273f51a57cfa1002bbf
-
SHA256
ca0df65fe15ea5272620d2c147beab19aa0b96a894aa86c92f30ea898e8c4ccd
-
SHA512
a35692c6651af44afff20cc28e404d20ca05b16ff487b2c478c7fffec659c146b272e7bd1eb04d630dc12b88697d014d9a421a964d25e477138209fb18b94fac
-
SSDEEP
12288:roRXOQjmOyoeLSDbYLhDRsU+rNqEa3RWrnfNZ:rogQ9yoeeDbYNlspoX3MrnfN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1800 3A59.tmp 2692 3AD6.tmp 2212 3B44.tmp 3868 3BC1.tmp 216 3C3E.tmp 2888 3CCA.tmp 384 3D57.tmp 2924 3DE4.tmp 1736 3E51.tmp 5000 3EBE.tmp 2532 3F4B.tmp 2356 3FB8.tmp 1568 4016.tmp 5056 4074.tmp 4052 40E1.tmp 5064 413F.tmp 3432 41BC.tmp 4468 4229.tmp 4316 4297.tmp 3596 42E5.tmp 4956 4343.tmp 736 43A0.tmp 4872 43FE.tmp 980 445C.tmp 1424 44C9.tmp 632 4546.tmp 372 45B4.tmp 2512 4631.tmp 3384 468E.tmp 1220 46FC.tmp 4948 4759.tmp 4844 47D6.tmp 1336 4844.tmp 2780 4892.tmp 1112 48E0.tmp 3636 493E.tmp 2992 498C.tmp 1328 49DA.tmp 4576 4A38.tmp 220 4A96.tmp 4372 4AF3.tmp 3204 4B51.tmp 3340 4BAF.tmp 4364 4C0D.tmp 1732 4C6A.tmp 4004 4CC8.tmp 4936 4D16.tmp 904 4D74.tmp 1852 4DD2.tmp 5020 4E2F.tmp 4044 4E8D.tmp 3868 4EEB.tmp 3416 4F58.tmp 2132 4FC6.tmp 4164 5033.tmp 548 5091.tmp 2928 50EF.tmp 4488 513D.tmp 3188 519A.tmp 3864 51F8.tmp 4988 5256.tmp 1324 52B4.tmp 2612 5321.tmp 5104 537F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1956 wrote to memory of 1800 1956 2024-06-04_c464ba43cdf44ac5546c464ea7760f06_mafia.exe 82 PID 1956 wrote to memory of 1800 1956 2024-06-04_c464ba43cdf44ac5546c464ea7760f06_mafia.exe 82 PID 1956 wrote to memory of 1800 1956 2024-06-04_c464ba43cdf44ac5546c464ea7760f06_mafia.exe 82 PID 1800 wrote to memory of 2692 1800 3A59.tmp 84 PID 1800 wrote to memory of 2692 1800 3A59.tmp 84 PID 1800 wrote to memory of 2692 1800 3A59.tmp 84 PID 2692 wrote to memory of 2212 2692 3AD6.tmp 86 PID 2692 wrote to memory of 2212 2692 3AD6.tmp 86 PID 2692 wrote to memory of 2212 2692 3AD6.tmp 86 PID 2212 wrote to memory of 3868 2212 3B44.tmp 87 PID 2212 wrote to memory of 3868 2212 3B44.tmp 87 PID 2212 wrote to memory of 3868 2212 3B44.tmp 87 PID 3868 wrote to memory of 216 3868 3BC1.tmp 89 PID 3868 wrote to memory of 216 3868 3BC1.tmp 89 PID 3868 wrote to memory of 216 3868 3BC1.tmp 89 PID 216 wrote to memory of 2888 216 3C3E.tmp 90 PID 216 wrote to memory of 2888 216 3C3E.tmp 90 PID 216 wrote to memory of 2888 216 3C3E.tmp 90 PID 2888 wrote to memory of 384 2888 3CCA.tmp 91 PID 2888 wrote to memory of 384 2888 3CCA.tmp 91 PID 2888 wrote to memory of 384 2888 3CCA.tmp 91 PID 384 wrote to memory of 2924 384 3D57.tmp 92 PID 384 wrote to memory of 2924 384 3D57.tmp 92 PID 384 wrote to memory of 2924 384 3D57.tmp 92 PID 2924 wrote to memory of 1736 2924 3DE4.tmp 93 PID 2924 wrote to memory of 1736 2924 3DE4.tmp 93 PID 2924 wrote to memory of 1736 2924 3DE4.tmp 93 PID 1736 wrote to memory of 5000 1736 3E51.tmp 94 PID 1736 wrote to memory of 5000 1736 3E51.tmp 94 PID 1736 wrote to memory of 5000 1736 3E51.tmp 94 PID 5000 wrote to memory of 2532 5000 3EBE.tmp 95 PID 5000 wrote to memory of 2532 5000 3EBE.tmp 95 PID 5000 wrote to memory of 2532 5000 3EBE.tmp 95 PID 2532 wrote to memory of 2356 2532 3F4B.tmp 96 PID 2532 wrote to memory of 2356 2532 3F4B.tmp 96 PID 2532 wrote to memory of 2356 2532 3F4B.tmp 96 PID 2356 wrote to memory of 1568 2356 3FB8.tmp 97 PID 2356 wrote to memory of 1568 2356 3FB8.tmp 97 PID 2356 wrote to memory of 1568 2356 3FB8.tmp 97 PID 1568 wrote to memory of 5056 1568 4016.tmp 98 PID 1568 wrote to memory of 5056 1568 4016.tmp 98 PID 1568 wrote to memory of 5056 1568 4016.tmp 98 PID 5056 wrote to memory of 4052 5056 4074.tmp 99 PID 5056 wrote to memory of 4052 5056 4074.tmp 99 PID 5056 wrote to memory of 4052 5056 4074.tmp 99 PID 4052 wrote to memory of 5064 4052 40E1.tmp 100 PID 4052 wrote to memory of 5064 4052 40E1.tmp 100 PID 4052 wrote to memory of 5064 4052 40E1.tmp 100 PID 5064 wrote to memory of 3432 5064 413F.tmp 101 PID 5064 wrote to memory of 3432 5064 413F.tmp 101 PID 5064 wrote to memory of 3432 5064 413F.tmp 101 PID 3432 wrote to memory of 4468 3432 41BC.tmp 102 PID 3432 wrote to memory of 4468 3432 41BC.tmp 102 PID 3432 wrote to memory of 4468 3432 41BC.tmp 102 PID 4468 wrote to memory of 4316 4468 4229.tmp 103 PID 4468 wrote to memory of 4316 4468 4229.tmp 103 PID 4468 wrote to memory of 4316 4468 4229.tmp 103 PID 4316 wrote to memory of 3596 4316 4297.tmp 104 PID 4316 wrote to memory of 3596 4316 4297.tmp 104 PID 4316 wrote to memory of 3596 4316 4297.tmp 104 PID 3596 wrote to memory of 4956 3596 42E5.tmp 107 PID 3596 wrote to memory of 4956 3596 42E5.tmp 107 PID 3596 wrote to memory of 4956 3596 42E5.tmp 107 PID 4956 wrote to memory of 736 4956 4343.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-04_c464ba43cdf44ac5546c464ea7760f06_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-04_c464ba43cdf44ac5546c464ea7760f06_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\3A59.tmp"C:\Users\Admin\AppData\Local\Temp\3A59.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\3B44.tmp"C:\Users\Admin\AppData\Local\Temp\3B44.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\3C3E.tmp"C:\Users\Admin\AppData\Local\Temp\3C3E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\3D57.tmp"C:\Users\Admin\AppData\Local\Temp\3D57.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\3E51.tmp"C:\Users\Admin\AppData\Local\Temp\3E51.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\4016.tmp"C:\Users\Admin\AppData\Local\Temp\4016.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\4074.tmp"C:\Users\Admin\AppData\Local\Temp\4074.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\40E1.tmp"C:\Users\Admin\AppData\Local\Temp\40E1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\413F.tmp"C:\Users\Admin\AppData\Local\Temp\413F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\41BC.tmp"C:\Users\Admin\AppData\Local\Temp\41BC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\4229.tmp"C:\Users\Admin\AppData\Local\Temp\4229.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"23⤵
- Executes dropped EXE
PID:736 -
C:\Users\Admin\AppData\Local\Temp\43FE.tmp"C:\Users\Admin\AppData\Local\Temp\43FE.tmp"24⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"25⤵
- Executes dropped EXE
PID:980 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"26⤵
- Executes dropped EXE
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"27⤵
- Executes dropped EXE
PID:632 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"28⤵
- Executes dropped EXE
PID:372 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"29⤵
- Executes dropped EXE
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"30⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"31⤵
- Executes dropped EXE
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"32⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"33⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"34⤵
- Executes dropped EXE
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"35⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"36⤵
- Executes dropped EXE
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"37⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"38⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"39⤵
- Executes dropped EXE
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"40⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"41⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"42⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"43⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"44⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"45⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"46⤵
- Executes dropped EXE
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"47⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"48⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"49⤵
- Executes dropped EXE
PID:904 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"50⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"51⤵
- Executes dropped EXE
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"52⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"53⤵
- Executes dropped EXE
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"54⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"55⤵
- Executes dropped EXE
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"56⤵
- Executes dropped EXE
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"57⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"58⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"59⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"60⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"61⤵
- Executes dropped EXE
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"62⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"63⤵
- Executes dropped EXE
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"64⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"65⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"66⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"67⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"68⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"69⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"70⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"71⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"72⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"73⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"74⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"75⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"76⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"77⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"78⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"79⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"80⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"81⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"82⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"83⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"84⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"85⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"86⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"87⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"88⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"89⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"90⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"91⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"92⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"93⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"94⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"95⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"96⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"97⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"98⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"99⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"100⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"101⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"102⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"103⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"104⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"105⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"106⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"107⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"108⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"109⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"110⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"111⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"112⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"113⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"114⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"115⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"116⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"117⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"118⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"119⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"120⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"121⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"122⤵PID:1576
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-