Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
01/07/2024, 14:02
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-01_1a639308058adc921bb0911034da1418_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-07-01_1a639308058adc921bb0911034da1418_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-07-01_1a639308058adc921bb0911034da1418_mafia.exe
-
Size
529KB
-
MD5
1a639308058adc921bb0911034da1418
-
SHA1
6e3e4f3d2b083d2386dd5904dfb84822654d1330
-
SHA256
bc6df3d2a7ec9aa7bb78bb2eca87a099d7510becd164e67a15ef111b6f7fefd6
-
SHA512
985b1cea96e4eba16967149be2dab18da7d3ffc2d2df4ba3ebe0bdfeef8a8f34435843c082f9b926b54028a9731b63f694c723bf51f511a4c84ffb3400759e78
-
SSDEEP
12288:NU5rCOTeijjSjaBCiah1Ka/ghneL5sadKIhTZwlH4Hp:NUQOJjcXz1V/gheLGU9TSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4572 1102.tmp 3836 1577.tmp 2876 16A0.tmp 4348 173C.tmp 1176 17AA.tmp 3232 1855.tmp 4896 1901.tmp 1676 19EC.tmp 864 1A78.tmp 4828 1B24.tmp 1344 1BE0.tmp 1444 1CCA.tmp 2052 1EBE.tmp 1680 1F2B.tmp 736 1FB8.tmp 2288 2035.tmp 2644 20E1.tmp 3696 217D.tmp 1872 2248.tmp 1820 22E5.tmp 2164 2381.tmp 3672 241D.tmp 4320 24D9.tmp 3080 2556.tmp 1924 25F2.tmp 3752 268E.tmp 4608 270B.tmp 4928 2798.tmp 1768 2815.tmp 972 28B1.tmp 496 293E.tmp 3916 29CA.tmp 4516 2A95.tmp 1860 2B22.tmp 4104 2B9F.tmp 4804 2C0C.tmp 3304 2CA9.tmp 4292 2D26.tmp 4300 2D93.tmp 3292 2E10.tmp 3156 2E7D.tmp 540 2F0A.tmp 4836 3023.tmp 4688 30B0.tmp 1616 317B.tmp 576 3208.tmp 1176 3275.tmp 2408 32E2.tmp 384 3350.tmp 4436 33BD.tmp 1708 342A.tmp 1256 34A7.tmp 4132 3515.tmp 944 3582.tmp 1412 35F0.tmp 4472 366D.tmp 4056 36DA.tmp 1132 3747.tmp 2984 37B5.tmp 3588 3B10.tmp 4372 3B7D.tmp 2272 3BEB.tmp 1628 3C58.tmp 2604 3CD5.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 228 wrote to memory of 4572 228 2024-07-01_1a639308058adc921bb0911034da1418_mafia.exe 90 PID 228 wrote to memory of 4572 228 2024-07-01_1a639308058adc921bb0911034da1418_mafia.exe 90 PID 228 wrote to memory of 4572 228 2024-07-01_1a639308058adc921bb0911034da1418_mafia.exe 90 PID 4572 wrote to memory of 3836 4572 1102.tmp 91 PID 4572 wrote to memory of 3836 4572 1102.tmp 91 PID 4572 wrote to memory of 3836 4572 1102.tmp 91 PID 3836 wrote to memory of 2876 3836 1577.tmp 92 PID 3836 wrote to memory of 2876 3836 1577.tmp 92 PID 3836 wrote to memory of 2876 3836 1577.tmp 92 PID 2876 wrote to memory of 4348 2876 16A0.tmp 185 PID 2876 wrote to memory of 4348 2876 16A0.tmp 185 PID 2876 wrote to memory of 4348 2876 16A0.tmp 185 PID 4348 wrote to memory of 1176 4348 173C.tmp 227 PID 4348 wrote to memory of 1176 4348 173C.tmp 227 PID 4348 wrote to memory of 1176 4348 173C.tmp 227 PID 1176 wrote to memory of 3232 1176 17AA.tmp 95 PID 1176 wrote to memory of 3232 1176 17AA.tmp 95 PID 1176 wrote to memory of 3232 1176 17AA.tmp 95 PID 3232 wrote to memory of 4896 3232 1855.tmp 190 PID 3232 wrote to memory of 4896 3232 1855.tmp 190 PID 3232 wrote to memory of 4896 3232 1855.tmp 190 PID 4896 wrote to memory of 1676 4896 1901.tmp 232 PID 4896 wrote to memory of 1676 4896 1901.tmp 232 PID 4896 wrote to memory of 1676 4896 1901.tmp 232 PID 1676 wrote to memory of 864 1676 19EC.tmp 98 PID 1676 wrote to memory of 864 1676 19EC.tmp 98 PID 1676 wrote to memory of 864 1676 19EC.tmp 98 PID 864 wrote to memory of 4828 864 1A78.tmp 233 PID 864 wrote to memory of 4828 864 1A78.tmp 233 PID 864 wrote to memory of 4828 864 1A78.tmp 233 PID 4828 wrote to memory of 1344 4828 1B24.tmp 193 PID 4828 wrote to memory of 1344 4828 1B24.tmp 193 PID 4828 wrote to memory of 1344 4828 1B24.tmp 193 PID 1344 wrote to memory of 1444 1344 1BE0.tmp 101 PID 1344 wrote to memory of 1444 1344 1BE0.tmp 101 PID 1344 wrote to memory of 1444 1344 1BE0.tmp 101 PID 1444 wrote to memory of 2052 1444 1CCA.tmp 280 PID 1444 wrote to memory of 2052 1444 1CCA.tmp 280 PID 1444 wrote to memory of 2052 1444 1CCA.tmp 280 PID 2052 wrote to memory of 1680 2052 1EBE.tmp 103 PID 2052 wrote to memory of 1680 2052 1EBE.tmp 103 PID 2052 wrote to memory of 1680 2052 1EBE.tmp 103 PID 1680 wrote to memory of 736 1680 1F2B.tmp 104 PID 1680 wrote to memory of 736 1680 1F2B.tmp 104 PID 1680 wrote to memory of 736 1680 1F2B.tmp 104 PID 736 wrote to memory of 2288 736 1FB8.tmp 105 PID 736 wrote to memory of 2288 736 1FB8.tmp 105 PID 736 wrote to memory of 2288 736 1FB8.tmp 105 PID 2288 wrote to memory of 2644 2288 2035.tmp 106 PID 2288 wrote to memory of 2644 2288 2035.tmp 106 PID 2288 wrote to memory of 2644 2288 2035.tmp 106 PID 2644 wrote to memory of 3696 2644 20E1.tmp 200 PID 2644 wrote to memory of 3696 2644 20E1.tmp 200 PID 2644 wrote to memory of 3696 2644 20E1.tmp 200 PID 3696 wrote to memory of 1872 3696 217D.tmp 108 PID 3696 wrote to memory of 1872 3696 217D.tmp 108 PID 3696 wrote to memory of 1872 3696 217D.tmp 108 PID 1872 wrote to memory of 1820 1872 2248.tmp 109 PID 1872 wrote to memory of 1820 1872 2248.tmp 109 PID 1872 wrote to memory of 1820 1872 2248.tmp 109 PID 1820 wrote to memory of 2164 1820 22E5.tmp 110 PID 1820 wrote to memory of 2164 1820 22E5.tmp 110 PID 1820 wrote to memory of 2164 1820 22E5.tmp 110 PID 2164 wrote to memory of 3672 2164 2381.tmp 277
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-01_1a639308058adc921bb0911034da1418_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-01_1a639308058adc921bb0911034da1418_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\1102.tmp"C:\Users\Admin\AppData\Local\Temp\1102.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\1577.tmp"C:\Users\Admin\AppData\Local\Temp\1577.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\16A0.tmp"C:\Users\Admin\AppData\Local\Temp\16A0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\173C.tmp"C:\Users\Admin\AppData\Local\Temp\173C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\17AA.tmp"C:\Users\Admin\AppData\Local\Temp\17AA.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\1855.tmp"C:\Users\Admin\AppData\Local\Temp\1855.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\1901.tmp"C:\Users\Admin\AppData\Local\Temp\1901.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\19EC.tmp"C:\Users\Admin\AppData\Local\Temp\19EC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\1A78.tmp"C:\Users\Admin\AppData\Local\Temp\1A78.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\1B24.tmp"C:\Users\Admin\AppData\Local\Temp\1B24.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\1EBE.tmp"C:\Users\Admin\AppData\Local\Temp\1EBE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\1F2B.tmp"C:\Users\Admin\AppData\Local\Temp\1F2B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\1FB8.tmp"C:\Users\Admin\AppData\Local\Temp\1FB8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Users\Admin\AppData\Local\Temp\2035.tmp"C:\Users\Admin\AppData\Local\Temp\2035.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\20E1.tmp"C:\Users\Admin\AppData\Local\Temp\20E1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\217D.tmp"C:\Users\Admin\AppData\Local\Temp\217D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\2248.tmp"C:\Users\Admin\AppData\Local\Temp\2248.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\22E5.tmp"C:\Users\Admin\AppData\Local\Temp\22E5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\2381.tmp"C:\Users\Admin\AppData\Local\Temp\2381.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\241D.tmp"C:\Users\Admin\AppData\Local\Temp\241D.tmp"23⤵
- Executes dropped EXE
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\24D9.tmp"C:\Users\Admin\AppData\Local\Temp\24D9.tmp"24⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\2556.tmp"C:\Users\Admin\AppData\Local\Temp\2556.tmp"25⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\25F2.tmp"C:\Users\Admin\AppData\Local\Temp\25F2.tmp"26⤵
- Executes dropped EXE
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\268E.tmp"C:\Users\Admin\AppData\Local\Temp\268E.tmp"27⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\270B.tmp"C:\Users\Admin\AppData\Local\Temp\270B.tmp"28⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\2798.tmp"C:\Users\Admin\AppData\Local\Temp\2798.tmp"29⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\2815.tmp"C:\Users\Admin\AppData\Local\Temp\2815.tmp"30⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\28B1.tmp"C:\Users\Admin\AppData\Local\Temp\28B1.tmp"31⤵
- Executes dropped EXE
PID:972 -
C:\Users\Admin\AppData\Local\Temp\293E.tmp"C:\Users\Admin\AppData\Local\Temp\293E.tmp"32⤵
- Executes dropped EXE
PID:496 -
C:\Users\Admin\AppData\Local\Temp\29CA.tmp"C:\Users\Admin\AppData\Local\Temp\29CA.tmp"33⤵
- Executes dropped EXE
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\2A95.tmp"C:\Users\Admin\AppData\Local\Temp\2A95.tmp"34⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\2B22.tmp"C:\Users\Admin\AppData\Local\Temp\2B22.tmp"35⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\2B9F.tmp"C:\Users\Admin\AppData\Local\Temp\2B9F.tmp"36⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\2C0C.tmp"C:\Users\Admin\AppData\Local\Temp\2C0C.tmp"37⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\2CA9.tmp"C:\Users\Admin\AppData\Local\Temp\2CA9.tmp"38⤵
- Executes dropped EXE
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\2D26.tmp"C:\Users\Admin\AppData\Local\Temp\2D26.tmp"39⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\2D93.tmp"C:\Users\Admin\AppData\Local\Temp\2D93.tmp"40⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\2E10.tmp"C:\Users\Admin\AppData\Local\Temp\2E10.tmp"41⤵
- Executes dropped EXE
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\2E7D.tmp"C:\Users\Admin\AppData\Local\Temp\2E7D.tmp"42⤵
- Executes dropped EXE
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\2F0A.tmp"C:\Users\Admin\AppData\Local\Temp\2F0A.tmp"43⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\3023.tmp"C:\Users\Admin\AppData\Local\Temp\3023.tmp"44⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\30B0.tmp"C:\Users\Admin\AppData\Local\Temp\30B0.tmp"45⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\317B.tmp"C:\Users\Admin\AppData\Local\Temp\317B.tmp"46⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"47⤵
- Executes dropped EXE
PID:576 -
C:\Users\Admin\AppData\Local\Temp\3275.tmp"C:\Users\Admin\AppData\Local\Temp\3275.tmp"48⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\32E2.tmp"C:\Users\Admin\AppData\Local\Temp\32E2.tmp"49⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"50⤵
- Executes dropped EXE
PID:384 -
C:\Users\Admin\AppData\Local\Temp\33BD.tmp"C:\Users\Admin\AppData\Local\Temp\33BD.tmp"51⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\342A.tmp"C:\Users\Admin\AppData\Local\Temp\342A.tmp"52⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"53⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\3515.tmp"C:\Users\Admin\AppData\Local\Temp\3515.tmp"54⤵
- Executes dropped EXE
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"55⤵
- Executes dropped EXE
PID:944 -
C:\Users\Admin\AppData\Local\Temp\35F0.tmp"C:\Users\Admin\AppData\Local\Temp\35F0.tmp"56⤵
- Executes dropped EXE
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\366D.tmp"C:\Users\Admin\AppData\Local\Temp\366D.tmp"57⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\36DA.tmp"C:\Users\Admin\AppData\Local\Temp\36DA.tmp"58⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\3747.tmp"C:\Users\Admin\AppData\Local\Temp\3747.tmp"59⤵
- Executes dropped EXE
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\37B5.tmp"C:\Users\Admin\AppData\Local\Temp\37B5.tmp"60⤵
- Executes dropped EXE
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\3B10.tmp"C:\Users\Admin\AppData\Local\Temp\3B10.tmp"61⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\3B7D.tmp"C:\Users\Admin\AppData\Local\Temp\3B7D.tmp"62⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\3BEB.tmp"C:\Users\Admin\AppData\Local\Temp\3BEB.tmp"63⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\3C58.tmp"C:\Users\Admin\AppData\Local\Temp\3C58.tmp"64⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\3CD5.tmp"C:\Users\Admin\AppData\Local\Temp\3CD5.tmp"65⤵
- Executes dropped EXE
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\3D52.tmp"C:\Users\Admin\AppData\Local\Temp\3D52.tmp"66⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\3DCF.tmp"C:\Users\Admin\AppData\Local\Temp\3DCF.tmp"67⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\3E4C.tmp"C:\Users\Admin\AppData\Local\Temp\3E4C.tmp"68⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\3EC9.tmp"C:\Users\Admin\AppData\Local\Temp\3EC9.tmp"69⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\3F37.tmp"C:\Users\Admin\AppData\Local\Temp\3F37.tmp"70⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"71⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\4031.tmp"C:\Users\Admin\AppData\Local\Temp\4031.tmp"72⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\40AE.tmp"C:\Users\Admin\AppData\Local\Temp\40AE.tmp"73⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\411B.tmp"C:\Users\Admin\AppData\Local\Temp\411B.tmp"74⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\4188.tmp"C:\Users\Admin\AppData\Local\Temp\4188.tmp"75⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\4205.tmp"C:\Users\Admin\AppData\Local\Temp\4205.tmp"76⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\4282.tmp"C:\Users\Admin\AppData\Local\Temp\4282.tmp"77⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\434D.tmp"C:\Users\Admin\AppData\Local\Temp\434D.tmp"78⤵PID:496
-
C:\Users\Admin\AppData\Local\Temp\43CA.tmp"C:\Users\Admin\AppData\Local\Temp\43CA.tmp"79⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\4457.tmp"C:\Users\Admin\AppData\Local\Temp\4457.tmp"80⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\44D4.tmp"C:\Users\Admin\AppData\Local\Temp\44D4.tmp"81⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\4541.tmp"C:\Users\Admin\AppData\Local\Temp\4541.tmp"82⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\45BE.tmp"C:\Users\Admin\AppData\Local\Temp\45BE.tmp"83⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\4716.tmp"C:\Users\Admin\AppData\Local\Temp\4716.tmp"84⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\4784.tmp"C:\Users\Admin\AppData\Local\Temp\4784.tmp"85⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\4801.tmp"C:\Users\Admin\AppData\Local\Temp\4801.tmp"86⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\487E.tmp"C:\Users\Admin\AppData\Local\Temp\487E.tmp"87⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\48FB.tmp"C:\Users\Admin\AppData\Local\Temp\48FB.tmp"88⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\4987.tmp"C:\Users\Admin\AppData\Local\Temp\4987.tmp"89⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"90⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\4B1D.tmp"C:\Users\Admin\AppData\Local\Temp\4B1D.tmp"91⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\4B9A.tmp"C:\Users\Admin\AppData\Local\Temp\4B9A.tmp"92⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\4C85.tmp"C:\Users\Admin\AppData\Local\Temp\4C85.tmp"93⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\4D02.tmp"C:\Users\Admin\AppData\Local\Temp\4D02.tmp"94⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\4D7F.tmp"C:\Users\Admin\AppData\Local\Temp\4D7F.tmp"95⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\4E1B.tmp"C:\Users\Admin\AppData\Local\Temp\4E1B.tmp"96⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\4E98.tmp"C:\Users\Admin\AppData\Local\Temp\4E98.tmp"97⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\4F15.tmp"C:\Users\Admin\AppData\Local\Temp\4F15.tmp"98⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\4F92.tmp"C:\Users\Admin\AppData\Local\Temp\4F92.tmp"99⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\50BB.tmp"C:\Users\Admin\AppData\Local\Temp\50BB.tmp"100⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\5138.tmp"C:\Users\Admin\AppData\Local\Temp\5138.tmp"101⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\51D4.tmp"C:\Users\Admin\AppData\Local\Temp\51D4.tmp"102⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\5290.tmp"C:\Users\Admin\AppData\Local\Temp\5290.tmp"103⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\538A.tmp"C:\Users\Admin\AppData\Local\Temp\538A.tmp"104⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\5407.tmp"C:\Users\Admin\AppData\Local\Temp\5407.tmp"105⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\5484.tmp"C:\Users\Admin\AppData\Local\Temp\5484.tmp"106⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\54F1.tmp"C:\Users\Admin\AppData\Local\Temp\54F1.tmp"107⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\555E.tmp"C:\Users\Admin\AppData\Local\Temp\555E.tmp"108⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\55DB.tmp"C:\Users\Admin\AppData\Local\Temp\55DB.tmp"109⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\5658.tmp"C:\Users\Admin\AppData\Local\Temp\5658.tmp"110⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\56D5.tmp"C:\Users\Admin\AppData\Local\Temp\56D5.tmp"111⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\5752.tmp"C:\Users\Admin\AppData\Local\Temp\5752.tmp"112⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\57CF.tmp"C:\Users\Admin\AppData\Local\Temp\57CF.tmp"113⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\587B.tmp"C:\Users\Admin\AppData\Local\Temp\587B.tmp"114⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\58E9.tmp"C:\Users\Admin\AppData\Local\Temp\58E9.tmp"115⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\5956.tmp"C:\Users\Admin\AppData\Local\Temp\5956.tmp"116⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\59C3.tmp"C:\Users\Admin\AppData\Local\Temp\59C3.tmp"117⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\5B0C.tmp"C:\Users\Admin\AppData\Local\Temp\5B0C.tmp"118⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\5B79.tmp"C:\Users\Admin\AppData\Local\Temp\5B79.tmp"119⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\5BE6.tmp"C:\Users\Admin\AppData\Local\Temp\5BE6.tmp"120⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\5C63.tmp"C:\Users\Admin\AppData\Local\Temp\5C63.tmp"121⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\5DBB.tmp"C:\Users\Admin\AppData\Local\Temp\5DBB.tmp"122⤵PID:4256
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-