Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
14/06/2024, 15:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-14_25db6331f7c3779c2e3aaa3e575b5e2e_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-06-14_25db6331f7c3779c2e3aaa3e575b5e2e_mafia.exe
Resource
win10v2004-20240611-en
General
-
Target
2024-06-14_25db6331f7c3779c2e3aaa3e575b5e2e_mafia.exe
-
Size
487KB
-
MD5
25db6331f7c3779c2e3aaa3e575b5e2e
-
SHA1
e880ff2806f389f7e43258b42d0f16af88472aa9
-
SHA256
db9d35150eefc321ed55552399911b7cb1d9959e20a63aa869f3f3b4de1d387c
-
SHA512
561d9d63b6dd3c0b197fb89f8786e2998624dde140b305e42d63b43f3341be8362e3792d0788c6d6d187a63f897fec4e0b05cdd01489d25eaa35b47946a3ab67
-
SSDEEP
12288:HU5rCOTeiJPbsyPq3HJqhS4pCAvIA9ukbgZNZ:HUQOJJPH8pqhnp9vViN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4740 3AF6.tmp 816 3B63.tmp 1388 3BC1.tmp 1008 3C5D.tmp 3548 3CCA.tmp 2804 3D28.tmp 4888 3DB5.tmp 4776 3E03.tmp 4028 3E61.tmp 4400 3EBE.tmp 4720 3F2C.tmp 1268 3F99.tmp 3992 3FE7.tmp 4756 4064.tmp 868 40B2.tmp 3788 4120.tmp 3920 418D.tmp 1204 41DB.tmp 3044 4229.tmp 3332 4277.tmp 4468 42E5.tmp 2796 4343.tmp 1396 4391.tmp 2524 43EE.tmp 984 445C.tmp 3380 44D9.tmp 1124 4546.tmp 1724 45B4.tmp 3960 4602.tmp 2712 466F.tmp 1912 46DC.tmp 2176 473A.tmp 4080 4788.tmp 3244 47E6.tmp 4620 4844.tmp 3200 48A2.tmp 4440 48F0.tmp 4696 495D.tmp 812 49BB.tmp 2300 4A19.tmp 3080 4A67.tmp 4648 4AB5.tmp 4668 4B13.tmp 3436 4B61.tmp 4264 4BAF.tmp 1928 4C4B.tmp 516 4CA9.tmp 5080 4D07.tmp 3908 4D55.tmp 1560 4DA3.tmp 3400 4E01.tmp 1812 4E6E.tmp 3276 4EBC.tmp 4528 4F1A.tmp 3036 4F68.tmp 1008 4FB6.tmp 2868 5014.tmp 3416 5062.tmp 2804 50B0.tmp 1712 50FE.tmp 4508 515C.tmp 1584 51AA.tmp 3792 51F8.tmp 4592 5246.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3020 wrote to memory of 4740 3020 2024-06-14_25db6331f7c3779c2e3aaa3e575b5e2e_mafia.exe 82 PID 3020 wrote to memory of 4740 3020 2024-06-14_25db6331f7c3779c2e3aaa3e575b5e2e_mafia.exe 82 PID 3020 wrote to memory of 4740 3020 2024-06-14_25db6331f7c3779c2e3aaa3e575b5e2e_mafia.exe 82 PID 4740 wrote to memory of 816 4740 3AF6.tmp 84 PID 4740 wrote to memory of 816 4740 3AF6.tmp 84 PID 4740 wrote to memory of 816 4740 3AF6.tmp 84 PID 816 wrote to memory of 1388 816 3B63.tmp 86 PID 816 wrote to memory of 1388 816 3B63.tmp 86 PID 816 wrote to memory of 1388 816 3B63.tmp 86 PID 1388 wrote to memory of 1008 1388 3BC1.tmp 87 PID 1388 wrote to memory of 1008 1388 3BC1.tmp 87 PID 1388 wrote to memory of 1008 1388 3BC1.tmp 87 PID 1008 wrote to memory of 3548 1008 3C5D.tmp 89 PID 1008 wrote to memory of 3548 1008 3C5D.tmp 89 PID 1008 wrote to memory of 3548 1008 3C5D.tmp 89 PID 3548 wrote to memory of 2804 3548 3CCA.tmp 90 PID 3548 wrote to memory of 2804 3548 3CCA.tmp 90 PID 3548 wrote to memory of 2804 3548 3CCA.tmp 90 PID 2804 wrote to memory of 4888 2804 3D28.tmp 91 PID 2804 wrote to memory of 4888 2804 3D28.tmp 91 PID 2804 wrote to memory of 4888 2804 3D28.tmp 91 PID 4888 wrote to memory of 4776 4888 3DB5.tmp 92 PID 4888 wrote to memory of 4776 4888 3DB5.tmp 92 PID 4888 wrote to memory of 4776 4888 3DB5.tmp 92 PID 4776 wrote to memory of 4028 4776 3E03.tmp 93 PID 4776 wrote to memory of 4028 4776 3E03.tmp 93 PID 4776 wrote to memory of 4028 4776 3E03.tmp 93 PID 4028 wrote to memory of 4400 4028 3E61.tmp 94 PID 4028 wrote to memory of 4400 4028 3E61.tmp 94 PID 4028 wrote to memory of 4400 4028 3E61.tmp 94 PID 4400 wrote to memory of 4720 4400 3EBE.tmp 95 PID 4400 wrote to memory of 4720 4400 3EBE.tmp 95 PID 4400 wrote to memory of 4720 4400 3EBE.tmp 95 PID 4720 wrote to memory of 1268 4720 3F2C.tmp 96 PID 4720 wrote to memory of 1268 4720 3F2C.tmp 96 PID 4720 wrote to memory of 1268 4720 3F2C.tmp 96 PID 1268 wrote to memory of 3992 1268 3F99.tmp 97 PID 1268 wrote to memory of 3992 1268 3F99.tmp 97 PID 1268 wrote to memory of 3992 1268 3F99.tmp 97 PID 3992 wrote to memory of 4756 3992 3FE7.tmp 98 PID 3992 wrote to memory of 4756 3992 3FE7.tmp 98 PID 3992 wrote to memory of 4756 3992 3FE7.tmp 98 PID 4756 wrote to memory of 868 4756 4064.tmp 99 PID 4756 wrote to memory of 868 4756 4064.tmp 99 PID 4756 wrote to memory of 868 4756 4064.tmp 99 PID 868 wrote to memory of 3788 868 40B2.tmp 100 PID 868 wrote to memory of 3788 868 40B2.tmp 100 PID 868 wrote to memory of 3788 868 40B2.tmp 100 PID 3788 wrote to memory of 3920 3788 4120.tmp 101 PID 3788 wrote to memory of 3920 3788 4120.tmp 101 PID 3788 wrote to memory of 3920 3788 4120.tmp 101 PID 3920 wrote to memory of 1204 3920 418D.tmp 102 PID 3920 wrote to memory of 1204 3920 418D.tmp 102 PID 3920 wrote to memory of 1204 3920 418D.tmp 102 PID 1204 wrote to memory of 3044 1204 41DB.tmp 103 PID 1204 wrote to memory of 3044 1204 41DB.tmp 103 PID 1204 wrote to memory of 3044 1204 41DB.tmp 103 PID 3044 wrote to memory of 3332 3044 4229.tmp 104 PID 3044 wrote to memory of 3332 3044 4229.tmp 104 PID 3044 wrote to memory of 3332 3044 4229.tmp 104 PID 3332 wrote to memory of 4468 3332 4277.tmp 105 PID 3332 wrote to memory of 4468 3332 4277.tmp 105 PID 3332 wrote to memory of 4468 3332 4277.tmp 105 PID 4468 wrote to memory of 2796 4468 42E5.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-14_25db6331f7c3779c2e3aaa3e575b5e2e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-14_25db6331f7c3779c2e3aaa3e575b5e2e_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\3B63.tmp"C:\Users\Admin\AppData\Local\Temp\3B63.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\3D28.tmp"C:\Users\Admin\AppData\Local\Temp\3D28.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\3E03.tmp"C:\Users\Admin\AppData\Local\Temp\3E03.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\3E61.tmp"C:\Users\Admin\AppData\Local\Temp\3E61.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\3F99.tmp"C:\Users\Admin\AppData\Local\Temp\3F99.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\4064.tmp"C:\Users\Admin\AppData\Local\Temp\4064.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Users\Admin\AppData\Local\Temp\4120.tmp"C:\Users\Admin\AppData\Local\Temp\4120.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\418D.tmp"C:\Users\Admin\AppData\Local\Temp\418D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\41DB.tmp"C:\Users\Admin\AppData\Local\Temp\41DB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\4229.tmp"C:\Users\Admin\AppData\Local\Temp\4229.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\4277.tmp"C:\Users\Admin\AppData\Local\Temp\4277.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"23⤵
- Executes dropped EXE
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"24⤵
- Executes dropped EXE
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"25⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"26⤵
- Executes dropped EXE
PID:984 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"27⤵
- Executes dropped EXE
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"28⤵
- Executes dropped EXE
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"29⤵
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\4602.tmp"C:\Users\Admin\AppData\Local\Temp\4602.tmp"30⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"31⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"32⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"33⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"34⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"35⤵
- Executes dropped EXE
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"36⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"37⤵
- Executes dropped EXE
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"38⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"39⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"40⤵
- Executes dropped EXE
PID:812 -
C:\Users\Admin\AppData\Local\Temp\4A19.tmp"C:\Users\Admin\AppData\Local\Temp\4A19.tmp"41⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"42⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"43⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"44⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"45⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"46⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"47⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"48⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"49⤵
- Executes dropped EXE
PID:516 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"50⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"51⤵
- Executes dropped EXE
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"52⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"53⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"54⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"55⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"56⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"57⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"58⤵
- Executes dropped EXE
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"59⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"60⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"61⤵
- Executes dropped EXE
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"62⤵
- Executes dropped EXE
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"63⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"64⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"65⤵
- Executes dropped EXE
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"66⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"67⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"68⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"69⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"70⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"71⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"72⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"73⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"74⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"75⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"76⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"77⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"78⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"79⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"80⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"81⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"82⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"83⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"84⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"85⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"86⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"87⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"88⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"89⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"90⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"91⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"92⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"93⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"94⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"95⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"96⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"97⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"98⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"99⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"100⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"101⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"102⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"103⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"104⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"105⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"106⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"107⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"108⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"109⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"110⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"111⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"112⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"113⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"114⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"115⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"116⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"117⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"118⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"119⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"120⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"121⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"122⤵PID:4540
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-