Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/07/2024, 07:57
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-03_98d5f3cf3555011fb047bb308ee94ad9_mafia.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2024-07-03_98d5f3cf3555011fb047bb308ee94ad9_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-07-03_98d5f3cf3555011fb047bb308ee94ad9_mafia.exe
-
Size
520KB
-
MD5
98d5f3cf3555011fb047bb308ee94ad9
-
SHA1
174ed6a4ed493813155442b2d740fe37217da0b8
-
SHA256
a80652e13341342841a3a67ace307bb0a422d42cf19816ed68b617ae531df4c1
-
SHA512
493b748e246a6a6df737b0bc59351542d92d2672353aee01cc53a2dad5b5f14452e3cf6ea7ce4e5af1a8b707d01b542e814e7c26502569c522503a7dc44fc6ee
-
SSDEEP
12288:gj8fuxR21t5i8fcWW4TTBnzOaiQ9tTbLhCD8LQxCXNZ:gj8fuK1GYcWFTTBzOaiAC8LQxCXN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3528 4006.tmp 2052 40A3.tmp 456 412F.tmp 4360 41BC.tmp 4312 420A.tmp 2792 4258.tmp 556 42D5.tmp 2996 4333.tmp 1836 4391.tmp 4684 43FE.tmp 3356 446B.tmp 452 44D9.tmp 3560 4527.tmp 3716 4585.tmp 4596 45D3.tmp 2432 4621.tmp 2480 467F.tmp 2708 46DC.tmp 3164 474A.tmp 1480 4798.tmp 4140 4805.tmp 3764 4863.tmp 1596 48D0.tmp 5104 491F.tmp 1756 49BB.tmp 1968 4A57.tmp 4908 4AC4.tmp 4372 4B13.tmp 848 4B80.tmp 1072 4BED.tmp 4616 4C3B.tmp 3600 4CB8.tmp 4696 4D35.tmp 1864 4D84.tmp 2828 4DE1.tmp 4208 4E3F.tmp 1528 4E8D.tmp 4556 4EDB.tmp 2704 4F29.tmp 1096 4F78.tmp 5080 4FD5.tmp 1344 5033.tmp 2000 5091.tmp 4452 50DF.tmp 1744 512D.tmp 2384 517B.tmp 2028 51C9.tmp 2192 5217.tmp 3972 5275.tmp 4496 52C3.tmp 3676 5311.tmp 4156 536F.tmp 644 53CD.tmp 4588 542B.tmp 620 5479.tmp 1784 54D7.tmp 3256 5534.tmp 3456 5582.tmp 4388 55D1.tmp 1588 561F.tmp 1944 566D.tmp 4632 56BB.tmp 4528 5767.tmp 5044 57C5.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4972 wrote to memory of 3528 4972 2024-07-03_98d5f3cf3555011fb047bb308ee94ad9_mafia.exe 81 PID 4972 wrote to memory of 3528 4972 2024-07-03_98d5f3cf3555011fb047bb308ee94ad9_mafia.exe 81 PID 4972 wrote to memory of 3528 4972 2024-07-03_98d5f3cf3555011fb047bb308ee94ad9_mafia.exe 81 PID 3528 wrote to memory of 2052 3528 4006.tmp 82 PID 3528 wrote to memory of 2052 3528 4006.tmp 82 PID 3528 wrote to memory of 2052 3528 4006.tmp 82 PID 2052 wrote to memory of 456 2052 40A3.tmp 83 PID 2052 wrote to memory of 456 2052 40A3.tmp 83 PID 2052 wrote to memory of 456 2052 40A3.tmp 83 PID 456 wrote to memory of 4360 456 412F.tmp 84 PID 456 wrote to memory of 4360 456 412F.tmp 84 PID 456 wrote to memory of 4360 456 412F.tmp 84 PID 4360 wrote to memory of 4312 4360 41BC.tmp 85 PID 4360 wrote to memory of 4312 4360 41BC.tmp 85 PID 4360 wrote to memory of 4312 4360 41BC.tmp 85 PID 4312 wrote to memory of 2792 4312 420A.tmp 86 PID 4312 wrote to memory of 2792 4312 420A.tmp 86 PID 4312 wrote to memory of 2792 4312 420A.tmp 86 PID 2792 wrote to memory of 556 2792 4258.tmp 87 PID 2792 wrote to memory of 556 2792 4258.tmp 87 PID 2792 wrote to memory of 556 2792 4258.tmp 87 PID 556 wrote to memory of 2996 556 42D5.tmp 88 PID 556 wrote to memory of 2996 556 42D5.tmp 88 PID 556 wrote to memory of 2996 556 42D5.tmp 88 PID 2996 wrote to memory of 1836 2996 4333.tmp 89 PID 2996 wrote to memory of 1836 2996 4333.tmp 89 PID 2996 wrote to memory of 1836 2996 4333.tmp 89 PID 1836 wrote to memory of 4684 1836 4391.tmp 90 PID 1836 wrote to memory of 4684 1836 4391.tmp 90 PID 1836 wrote to memory of 4684 1836 4391.tmp 90 PID 4684 wrote to memory of 3356 4684 43FE.tmp 91 PID 4684 wrote to memory of 3356 4684 43FE.tmp 91 PID 4684 wrote to memory of 3356 4684 43FE.tmp 91 PID 3356 wrote to memory of 452 3356 446B.tmp 92 PID 3356 wrote to memory of 452 3356 446B.tmp 92 PID 3356 wrote to memory of 452 3356 446B.tmp 92 PID 452 wrote to memory of 3560 452 44D9.tmp 93 PID 452 wrote to memory of 3560 452 44D9.tmp 93 PID 452 wrote to memory of 3560 452 44D9.tmp 93 PID 3560 wrote to memory of 3716 3560 4527.tmp 94 PID 3560 wrote to memory of 3716 3560 4527.tmp 94 PID 3560 wrote to memory of 3716 3560 4527.tmp 94 PID 3716 wrote to memory of 4596 3716 4585.tmp 95 PID 3716 wrote to memory of 4596 3716 4585.tmp 95 PID 3716 wrote to memory of 4596 3716 4585.tmp 95 PID 4596 wrote to memory of 2432 4596 45D3.tmp 96 PID 4596 wrote to memory of 2432 4596 45D3.tmp 96 PID 4596 wrote to memory of 2432 4596 45D3.tmp 96 PID 2432 wrote to memory of 2480 2432 4621.tmp 97 PID 2432 wrote to memory of 2480 2432 4621.tmp 97 PID 2432 wrote to memory of 2480 2432 4621.tmp 97 PID 2480 wrote to memory of 2708 2480 467F.tmp 98 PID 2480 wrote to memory of 2708 2480 467F.tmp 98 PID 2480 wrote to memory of 2708 2480 467F.tmp 98 PID 2708 wrote to memory of 3164 2708 46DC.tmp 99 PID 2708 wrote to memory of 3164 2708 46DC.tmp 99 PID 2708 wrote to memory of 3164 2708 46DC.tmp 99 PID 3164 wrote to memory of 1480 3164 474A.tmp 100 PID 3164 wrote to memory of 1480 3164 474A.tmp 100 PID 3164 wrote to memory of 1480 3164 474A.tmp 100 PID 1480 wrote to memory of 4140 1480 4798.tmp 101 PID 1480 wrote to memory of 4140 1480 4798.tmp 101 PID 1480 wrote to memory of 4140 1480 4798.tmp 101 PID 4140 wrote to memory of 3764 4140 4805.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-03_98d5f3cf3555011fb047bb308ee94ad9_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-03_98d5f3cf3555011fb047bb308ee94ad9_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\4006.tmp"C:\Users\Admin\AppData\Local\Temp\4006.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\40A3.tmp"C:\Users\Admin\AppData\Local\Temp\40A3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\412F.tmp"C:\Users\Admin\AppData\Local\Temp\412F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\41BC.tmp"C:\Users\Admin\AppData\Local\Temp\41BC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\420A.tmp"C:\Users\Admin\AppData\Local\Temp\420A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\4258.tmp"C:\Users\Admin\AppData\Local\Temp\4258.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\43FE.tmp"C:\Users\Admin\AppData\Local\Temp\43FE.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\45D3.tmp"C:\Users\Admin\AppData\Local\Temp\45D3.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"23⤵
- Executes dropped EXE
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"24⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"25⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"26⤵
- Executes dropped EXE
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"27⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"28⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"29⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"30⤵
- Executes dropped EXE
PID:848 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"31⤵
- Executes dropped EXE
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"32⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"33⤵
- Executes dropped EXE
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"34⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"35⤵
- Executes dropped EXE
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"36⤵
- Executes dropped EXE
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"37⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"38⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"39⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"40⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"41⤵
- Executes dropped EXE
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"42⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"43⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"44⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"45⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"46⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"47⤵
- Executes dropped EXE
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"48⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"49⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"50⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"51⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"52⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"53⤵
- Executes dropped EXE
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"54⤵
- Executes dropped EXE
PID:644 -
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"55⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"56⤵
- Executes dropped EXE
PID:620 -
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"57⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"58⤵
- Executes dropped EXE
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"59⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"60⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"61⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"62⤵
- Executes dropped EXE
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"63⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"64⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"65⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"66⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"67⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"68⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"69⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"70⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"71⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"72⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"73⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"74⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"75⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"76⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"77⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"78⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"79⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"80⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"81⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"82⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"83⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"84⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"85⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"86⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"87⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"88⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"89⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"90⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"91⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"92⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"93⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"94⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"95⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"96⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"97⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"98⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"99⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"100⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"101⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"102⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"103⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"104⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"105⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"106⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"107⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"108⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"109⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"110⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"111⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"112⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"113⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"114⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"115⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"116⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"117⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"118⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"119⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"120⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"121⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"122⤵PID:2224
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-