Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
20/02/2024, 07:30
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-20_5f430ccacc73a134baaf707f477bb20f_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-20_5f430ccacc73a134baaf707f477bb20f_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-20_5f430ccacc73a134baaf707f477bb20f_mafia.exe
-
Size
487KB
-
MD5
5f430ccacc73a134baaf707f477bb20f
-
SHA1
5a84d6e7bf0b7bcfc4f158473d94780ca05a0e4f
-
SHA256
a7ee425ac9c0c5f7c5c14ecdae090e875eb694744dd5bae8322ee15a5a682c9e
-
SHA512
a2dedb2de5483e8f5cfa8258c65c7cb2b268664255c66e95c1d271b17dd0d4d0cb4b2b0214a80444acb50b1e3d0d9fbda99168e90de13d8a1d2c92483bc250de
-
SSDEEP
6144:zorf3lPvovsgZnqG2C7mOTeiLxDxkvXYGu6gweC/x5xDgClK4CC/cQ5b1h3g4Zsz:yU5rCOTeiNsXYBoV9lK4J/BhnsmmbZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2100 43FE.tmp 1364 448B.tmp 3004 4517.tmp 884 45C3.tmp 2212 4640.tmp 532 46DC.tmp 208 474A.tmp 3056 47E6.tmp 4184 4873.tmp 404 48F0.tmp 3156 496D.tmp 3452 49F9.tmp 60 4A86.tmp 4036 4AE4.tmp 3428 4B70.tmp 4220 4BED.tmp 632 4C7A.tmp 464 4CF7.tmp 4176 4D64.tmp 4080 4DF1.tmp 4044 4E7E.tmp 4800 4F1A.tmp 1572 4FA6.tmp 5064 5014.tmp 3644 5091.tmp 4196 512D.tmp 4380 519A.tmp 1152 5217.tmp 1168 5275.tmp 2936 5311.tmp 3636 53AE.tmp 940 541B.tmp 3332 54A8.tmp 4952 5505.tmp 3680 5554.tmp 4696 55B1.tmp 1780 560F.tmp 2404 565D.tmp 1412 56BB.tmp 3164 5728.tmp 2868 5786.tmp 2604 57F3.tmp 4756 5842.tmp 2088 5890.tmp 4764 58DE.tmp 1120 592C.tmp 5000 597A.tmp 400 59D8.tmp 2284 5A26.tmp 4572 5A84.tmp 3052 5AD2.tmp 4436 5B30.tmp 3088 5B7E.tmp 528 5BCC.tmp 1456 5C2A.tmp 2100 5C78.tmp 3524 5CE5.tmp 2164 5D43.tmp 5116 5D91.tmp 2512 5DDF.tmp 3056 5E2D.tmp 4732 5E9B.tmp 3068 5EF8.tmp 3040 5F46.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3596 wrote to memory of 2100 3596 2024-02-20_5f430ccacc73a134baaf707f477bb20f_mafia.exe 85 PID 3596 wrote to memory of 2100 3596 2024-02-20_5f430ccacc73a134baaf707f477bb20f_mafia.exe 85 PID 3596 wrote to memory of 2100 3596 2024-02-20_5f430ccacc73a134baaf707f477bb20f_mafia.exe 85 PID 2100 wrote to memory of 1364 2100 43FE.tmp 86 PID 2100 wrote to memory of 1364 2100 43FE.tmp 86 PID 2100 wrote to memory of 1364 2100 43FE.tmp 86 PID 1364 wrote to memory of 3004 1364 448B.tmp 87 PID 1364 wrote to memory of 3004 1364 448B.tmp 87 PID 1364 wrote to memory of 3004 1364 448B.tmp 87 PID 3004 wrote to memory of 884 3004 4517.tmp 88 PID 3004 wrote to memory of 884 3004 4517.tmp 88 PID 3004 wrote to memory of 884 3004 4517.tmp 88 PID 884 wrote to memory of 2212 884 45C3.tmp 89 PID 884 wrote to memory of 2212 884 45C3.tmp 89 PID 884 wrote to memory of 2212 884 45C3.tmp 89 PID 2212 wrote to memory of 532 2212 4640.tmp 90 PID 2212 wrote to memory of 532 2212 4640.tmp 90 PID 2212 wrote to memory of 532 2212 4640.tmp 90 PID 532 wrote to memory of 208 532 46DC.tmp 91 PID 532 wrote to memory of 208 532 46DC.tmp 91 PID 532 wrote to memory of 208 532 46DC.tmp 91 PID 208 wrote to memory of 3056 208 474A.tmp 92 PID 208 wrote to memory of 3056 208 474A.tmp 92 PID 208 wrote to memory of 3056 208 474A.tmp 92 PID 3056 wrote to memory of 4184 3056 47E6.tmp 93 PID 3056 wrote to memory of 4184 3056 47E6.tmp 93 PID 3056 wrote to memory of 4184 3056 47E6.tmp 93 PID 4184 wrote to memory of 404 4184 4873.tmp 94 PID 4184 wrote to memory of 404 4184 4873.tmp 94 PID 4184 wrote to memory of 404 4184 4873.tmp 94 PID 404 wrote to memory of 3156 404 48F0.tmp 95 PID 404 wrote to memory of 3156 404 48F0.tmp 95 PID 404 wrote to memory of 3156 404 48F0.tmp 95 PID 3156 wrote to memory of 3452 3156 496D.tmp 96 PID 3156 wrote to memory of 3452 3156 496D.tmp 96 PID 3156 wrote to memory of 3452 3156 496D.tmp 96 PID 3452 wrote to memory of 60 3452 49F9.tmp 97 PID 3452 wrote to memory of 60 3452 49F9.tmp 97 PID 3452 wrote to memory of 60 3452 49F9.tmp 97 PID 60 wrote to memory of 4036 60 4A86.tmp 98 PID 60 wrote to memory of 4036 60 4A86.tmp 98 PID 60 wrote to memory of 4036 60 4A86.tmp 98 PID 4036 wrote to memory of 3428 4036 4AE4.tmp 99 PID 4036 wrote to memory of 3428 4036 4AE4.tmp 99 PID 4036 wrote to memory of 3428 4036 4AE4.tmp 99 PID 3428 wrote to memory of 4220 3428 4B70.tmp 100 PID 3428 wrote to memory of 4220 3428 4B70.tmp 100 PID 3428 wrote to memory of 4220 3428 4B70.tmp 100 PID 4220 wrote to memory of 632 4220 4BED.tmp 101 PID 4220 wrote to memory of 632 4220 4BED.tmp 101 PID 4220 wrote to memory of 632 4220 4BED.tmp 101 PID 632 wrote to memory of 464 632 4C7A.tmp 102 PID 632 wrote to memory of 464 632 4C7A.tmp 102 PID 632 wrote to memory of 464 632 4C7A.tmp 102 PID 464 wrote to memory of 4176 464 4CF7.tmp 103 PID 464 wrote to memory of 4176 464 4CF7.tmp 103 PID 464 wrote to memory of 4176 464 4CF7.tmp 103 PID 4176 wrote to memory of 4080 4176 4D64.tmp 104 PID 4176 wrote to memory of 4080 4176 4D64.tmp 104 PID 4176 wrote to memory of 4080 4176 4D64.tmp 104 PID 4080 wrote to memory of 4044 4080 4DF1.tmp 105 PID 4080 wrote to memory of 4044 4080 4DF1.tmp 105 PID 4080 wrote to memory of 4044 4080 4DF1.tmp 105 PID 4044 wrote to memory of 4800 4044 4E7E.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-20_5f430ccacc73a134baaf707f477bb20f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-20_5f430ccacc73a134baaf707f477bb20f_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\43FE.tmp"C:\Users\Admin\AppData\Local\Temp\43FE.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\448B.tmp"C:\Users\Admin\AppData\Local\Temp\448B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"23⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"24⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"25⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"26⤵
- Executes dropped EXE
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"27⤵
- Executes dropped EXE
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"28⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"29⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"30⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"31⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"32⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"33⤵
- Executes dropped EXE
PID:940 -
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"34⤵
- Executes dropped EXE
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"35⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"36⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"37⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"38⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"39⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"40⤵
- Executes dropped EXE
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"41⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"42⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"43⤵
- Executes dropped EXE
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"44⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"45⤵
- Executes dropped EXE
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"46⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"47⤵
- Executes dropped EXE
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"48⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"49⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"50⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"51⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"52⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"53⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"54⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"55⤵
- Executes dropped EXE
PID:528 -
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"56⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"57⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"58⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"59⤵
- Executes dropped EXE
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"60⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"61⤵
- Executes dropped EXE
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"62⤵
- Executes dropped EXE
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"63⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"64⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"65⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"66⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"67⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"68⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"69⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"70⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"71⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"72⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"73⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"74⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"75⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"76⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"77⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"78⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"79⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"80⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"81⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"82⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"83⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"84⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"85⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"86⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"87⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"88⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"89⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"90⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"91⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"92⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"93⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"94⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"95⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"96⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"97⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"98⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"99⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"100⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"101⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"102⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"103⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"104⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"105⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"106⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"107⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"108⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"109⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"110⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"111⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"112⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"113⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"114⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"115⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"116⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"117⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\7177.tmp"C:\Users\Admin\AppData\Local\Temp\7177.tmp"118⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"119⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\7232.tmp"C:\Users\Admin\AppData\Local\Temp\7232.tmp"120⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"121⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"122⤵PID:3156
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-