Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
03/07/2024, 13:26
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-03_c1b18d6e9e006409792fe47ae99ad989_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-07-03_c1b18d6e9e006409792fe47ae99ad989_mafia.exe
Resource
win10v2004-20240611-en
General
-
Target
2024-07-03_c1b18d6e9e006409792fe47ae99ad989_mafia.exe
-
Size
536KB
-
MD5
c1b18d6e9e006409792fe47ae99ad989
-
SHA1
2d18553a7b9c565f94d07a9b123c9b8eff4acf6f
-
SHA256
3d1ab361592ec8ac3b85938a54646c45df4826c60ed57f3938fed2ea285d9b7c
-
SHA512
3fc6c890a0a68830ec8fb4e6cd79cefbbbc13f94fdb80a130752befd0fb9fb875a3aa6b3b6c0addd4d1635456b1d85c7be61439b25db0ffdb8bb44f36b67f6ca
-
SSDEEP
12288:wU5rCOTeiUJ3WhdumnOOxw88hBuIZxVJ0ZT9:wUQOJUJ3WSbuIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4720 36EE.tmp 1860 377B.tmp 4252 3808.tmp 3396 3894.tmp 232 3950.tmp 4488 39EC.tmp 2244 3A69.tmp 100 3AF6.tmp 1976 3B82.tmp 4200 3BFF.tmp 5020 3C9B.tmp 4832 3CF9.tmp 1928 3DB5.tmp 4468 3E22.tmp 740 3E9F.tmp 3016 3F0C.tmp 748 3F99.tmp 3368 4026.tmp 316 40C2.tmp 1096 413F.tmp 3092 41CC.tmp 2112 4239.tmp 2584 42D5.tmp 2716 4371.tmp 2468 43EE.tmp 2844 446B.tmp 5116 44C9.tmp 2656 4556.tmp 4420 45C3.tmp 1188 4650.tmp 1620 46CD.tmp 5104 4769.tmp 3132 4805.tmp 2084 4863.tmp 2520 48C1.tmp 1744 491F.tmp 4836 497C.tmp 2040 49CA.tmp 4228 4A28.tmp 3288 4A86.tmp 860 4B03.tmp 664 4B51.tmp 5020 4BBE.tmp 1460 4C2C.tmp 1192 4CA9.tmp 4152 4CF7.tmp 1928 4D74.tmp 3504 4DD2.tmp 2700 4E20.tmp 4068 4E6E.tmp 2308 4EBC.tmp 4148 4F0A.tmp 928 4F58.tmp 5112 4FB6.tmp 1748 5004.tmp 3436 5052.tmp 4976 50B0.tmp 3092 50FE.tmp 652 514C.tmp 2584 519A.tmp 2180 51F8.tmp 3168 5246.tmp 1972 52A4.tmp 1516 52F2.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3932 wrote to memory of 4720 3932 2024-07-03_c1b18d6e9e006409792fe47ae99ad989_mafia.exe 82 PID 3932 wrote to memory of 4720 3932 2024-07-03_c1b18d6e9e006409792fe47ae99ad989_mafia.exe 82 PID 3932 wrote to memory of 4720 3932 2024-07-03_c1b18d6e9e006409792fe47ae99ad989_mafia.exe 82 PID 4720 wrote to memory of 1860 4720 36EE.tmp 83 PID 4720 wrote to memory of 1860 4720 36EE.tmp 83 PID 4720 wrote to memory of 1860 4720 36EE.tmp 83 PID 1860 wrote to memory of 4252 1860 377B.tmp 85 PID 1860 wrote to memory of 4252 1860 377B.tmp 85 PID 1860 wrote to memory of 4252 1860 377B.tmp 85 PID 4252 wrote to memory of 3396 4252 3808.tmp 86 PID 4252 wrote to memory of 3396 4252 3808.tmp 86 PID 4252 wrote to memory of 3396 4252 3808.tmp 86 PID 3396 wrote to memory of 232 3396 3894.tmp 88 PID 3396 wrote to memory of 232 3396 3894.tmp 88 PID 3396 wrote to memory of 232 3396 3894.tmp 88 PID 232 wrote to memory of 4488 232 3950.tmp 90 PID 232 wrote to memory of 4488 232 3950.tmp 90 PID 232 wrote to memory of 4488 232 3950.tmp 90 PID 4488 wrote to memory of 2244 4488 39EC.tmp 91 PID 4488 wrote to memory of 2244 4488 39EC.tmp 91 PID 4488 wrote to memory of 2244 4488 39EC.tmp 91 PID 2244 wrote to memory of 100 2244 3A69.tmp 92 PID 2244 wrote to memory of 100 2244 3A69.tmp 92 PID 2244 wrote to memory of 100 2244 3A69.tmp 92 PID 100 wrote to memory of 1976 100 3AF6.tmp 94 PID 100 wrote to memory of 1976 100 3AF6.tmp 94 PID 100 wrote to memory of 1976 100 3AF6.tmp 94 PID 1976 wrote to memory of 4200 1976 3B82.tmp 95 PID 1976 wrote to memory of 4200 1976 3B82.tmp 95 PID 1976 wrote to memory of 4200 1976 3B82.tmp 95 PID 4200 wrote to memory of 5020 4200 3BFF.tmp 96 PID 4200 wrote to memory of 5020 4200 3BFF.tmp 96 PID 4200 wrote to memory of 5020 4200 3BFF.tmp 96 PID 5020 wrote to memory of 4832 5020 3C9B.tmp 97 PID 5020 wrote to memory of 4832 5020 3C9B.tmp 97 PID 5020 wrote to memory of 4832 5020 3C9B.tmp 97 PID 4832 wrote to memory of 1928 4832 3CF9.tmp 98 PID 4832 wrote to memory of 1928 4832 3CF9.tmp 98 PID 4832 wrote to memory of 1928 4832 3CF9.tmp 98 PID 1928 wrote to memory of 4468 1928 3DB5.tmp 99 PID 1928 wrote to memory of 4468 1928 3DB5.tmp 99 PID 1928 wrote to memory of 4468 1928 3DB5.tmp 99 PID 4468 wrote to memory of 740 4468 3E22.tmp 100 PID 4468 wrote to memory of 740 4468 3E22.tmp 100 PID 4468 wrote to memory of 740 4468 3E22.tmp 100 PID 740 wrote to memory of 3016 740 3E9F.tmp 101 PID 740 wrote to memory of 3016 740 3E9F.tmp 101 PID 740 wrote to memory of 3016 740 3E9F.tmp 101 PID 3016 wrote to memory of 748 3016 3F0C.tmp 102 PID 3016 wrote to memory of 748 3016 3F0C.tmp 102 PID 3016 wrote to memory of 748 3016 3F0C.tmp 102 PID 748 wrote to memory of 3368 748 3F99.tmp 103 PID 748 wrote to memory of 3368 748 3F99.tmp 103 PID 748 wrote to memory of 3368 748 3F99.tmp 103 PID 3368 wrote to memory of 316 3368 4026.tmp 104 PID 3368 wrote to memory of 316 3368 4026.tmp 104 PID 3368 wrote to memory of 316 3368 4026.tmp 104 PID 316 wrote to memory of 1096 316 40C2.tmp 105 PID 316 wrote to memory of 1096 316 40C2.tmp 105 PID 316 wrote to memory of 1096 316 40C2.tmp 105 PID 1096 wrote to memory of 3092 1096 413F.tmp 106 PID 1096 wrote to memory of 3092 1096 413F.tmp 106 PID 1096 wrote to memory of 3092 1096 413F.tmp 106 PID 3092 wrote to memory of 2112 3092 41CC.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-03_c1b18d6e9e006409792fe47ae99ad989_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-03_c1b18d6e9e006409792fe47ae99ad989_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\36EE.tmp"C:\Users\Admin\AppData\Local\Temp\36EE.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\377B.tmp"C:\Users\Admin\AppData\Local\Temp\377B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\3808.tmp"C:\Users\Admin\AppData\Local\Temp\3808.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\3894.tmp"C:\Users\Admin\AppData\Local\Temp\3894.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\3950.tmp"C:\Users\Admin\AppData\Local\Temp\3950.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Users\Admin\AppData\Local\Temp\39EC.tmp"C:\Users\Admin\AppData\Local\Temp\39EC.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\3A69.tmp"C:\Users\Admin\AppData\Local\Temp\3A69.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100 -
C:\Users\Admin\AppData\Local\Temp\3B82.tmp"C:\Users\Admin\AppData\Local\Temp\3B82.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\3E22.tmp"C:\Users\Admin\AppData\Local\Temp\3E22.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\3F99.tmp"C:\Users\Admin\AppData\Local\Temp\3F99.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\4026.tmp"C:\Users\Admin\AppData\Local\Temp\4026.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\40C2.tmp"C:\Users\Admin\AppData\Local\Temp\40C2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Users\Admin\AppData\Local\Temp\413F.tmp"C:\Users\Admin\AppData\Local\Temp\413F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"23⤵
- Executes dropped EXE
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"24⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\4371.tmp"C:\Users\Admin\AppData\Local\Temp\4371.tmp"25⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"26⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"27⤵
- Executes dropped EXE
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"28⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"29⤵
- Executes dropped EXE
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"30⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"31⤵
- Executes dropped EXE
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"32⤵
- Executes dropped EXE
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"33⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"34⤵
- Executes dropped EXE
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"35⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"36⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"37⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"38⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"39⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"40⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"41⤵
- Executes dropped EXE
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"42⤵
- Executes dropped EXE
PID:860 -
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"43⤵
- Executes dropped EXE
PID:664 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"44⤵
- Executes dropped EXE
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"45⤵
- Executes dropped EXE
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"46⤵
- Executes dropped EXE
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"47⤵
- Executes dropped EXE
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"48⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"49⤵
- Executes dropped EXE
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"50⤵
- Executes dropped EXE
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"51⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"52⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"53⤵
- Executes dropped EXE
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"54⤵
- Executes dropped EXE
PID:928 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"55⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"56⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"57⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"58⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"59⤵
- Executes dropped EXE
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"60⤵
- Executes dropped EXE
PID:652 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"61⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"62⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"63⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"64⤵
- Executes dropped EXE
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"65⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"66⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"67⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"68⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"69⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"70⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"71⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"72⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"73⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"74⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"75⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"76⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"77⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"78⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"79⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"80⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"81⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"82⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"83⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"84⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"85⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"86⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"87⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"88⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"89⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"90⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"91⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"92⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"93⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"94⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"95⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"96⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"97⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"98⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"99⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"100⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"101⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"102⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"103⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"104⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"105⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"106⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"107⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"108⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"109⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"110⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"111⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"112⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"113⤵PID:100
-
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"114⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"115⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"116⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"117⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"118⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"119⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"120⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"121⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"122⤵PID:4888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-