Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
21/02/2024, 01:09
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-21_aa0e8c4dd927c5e853578068af9a9575_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-02-21_aa0e8c4dd927c5e853578068af9a9575_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-21_aa0e8c4dd927c5e853578068af9a9575_mafia.exe
-
Size
530KB
-
MD5
aa0e8c4dd927c5e853578068af9a9575
-
SHA1
270b634323b4c398bf13803842b32af09f548e46
-
SHA256
05e6ccbc0ce8da742e259e318639bd6f4649aed7b93b44e542e0ddb3611444de
-
SHA512
0218b133abee68768a4e738fe77a42dc1e29e762d8df70aa3b2f9a9380d04409be484dba2914e66e50ec29bd082d627289fa57fd9578baf4b4b5b4d1caaafae0
-
SSDEEP
12288:AU5rCOTeioijZpdttrncU8P6FQV0tc0VFg/aFNNZulFVg0M1:AUQOJomvcPMBtc0VOaTNclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3932 468E.tmp 3144 46FC.tmp 4316 4769.tmp 3324 47E6.tmp 996 4834.tmp 628 48A2.tmp 4104 48FF.tmp 2348 496D.tmp 4548 49BB.tmp 3304 4A09.tmp 212 4A67.tmp 2620 4AB5.tmp 4052 4B22.tmp 3320 4B70.tmp 4972 4BCE.tmp 2600 4C4B.tmp 4756 4CA9.tmp 3080 4D26.tmp 3504 4D74.tmp 1756 4DE1.tmp 4956 4E5E.tmp 4832 4EAC.tmp 116 4F1A.tmp 4688 4F78.tmp 3180 4FC6.tmp 2788 5033.tmp 3408 50A0.tmp 3332 50EF.tmp 2428 515C.tmp 1608 51AA.tmp 1308 5208.tmp 396 5275.tmp 456 52D3.tmp 1636 5331.tmp 4496 538E.tmp 3732 53EC.tmp 3256 543A.tmp 4860 5488.tmp 5032 54D7.tmp 920 5534.tmp 3164 5582.tmp 652 55E0.tmp 2700 562E.tmp 5000 567C.tmp 868 56CB.tmp 4928 5719.tmp 5056 5767.tmp 3748 57B5.tmp 3960 5803.tmp 1156 5851.tmp 2992 589F.tmp 4556 58FD.tmp 2180 594B.tmp 2272 5999.tmp 3052 59E7.tmp 4356 5A36.tmp 4624 5A84.tmp 3380 5AD2.tmp 4984 5B20.tmp 2276 5B6E.tmp 3584 5BCC.tmp 3324 5C1A.tmp 3680 5C68.tmp 2652 5CB6.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2224 wrote to memory of 3932 2224 2024-02-21_aa0e8c4dd927c5e853578068af9a9575_mafia.exe 85 PID 2224 wrote to memory of 3932 2224 2024-02-21_aa0e8c4dd927c5e853578068af9a9575_mafia.exe 85 PID 2224 wrote to memory of 3932 2224 2024-02-21_aa0e8c4dd927c5e853578068af9a9575_mafia.exe 85 PID 3932 wrote to memory of 3144 3932 468E.tmp 86 PID 3932 wrote to memory of 3144 3932 468E.tmp 86 PID 3932 wrote to memory of 3144 3932 468E.tmp 86 PID 3144 wrote to memory of 4316 3144 46FC.tmp 87 PID 3144 wrote to memory of 4316 3144 46FC.tmp 87 PID 3144 wrote to memory of 4316 3144 46FC.tmp 87 PID 4316 wrote to memory of 3324 4316 4769.tmp 88 PID 4316 wrote to memory of 3324 4316 4769.tmp 88 PID 4316 wrote to memory of 3324 4316 4769.tmp 88 PID 3324 wrote to memory of 996 3324 47E6.tmp 89 PID 3324 wrote to memory of 996 3324 47E6.tmp 89 PID 3324 wrote to memory of 996 3324 47E6.tmp 89 PID 996 wrote to memory of 628 996 4834.tmp 90 PID 996 wrote to memory of 628 996 4834.tmp 90 PID 996 wrote to memory of 628 996 4834.tmp 90 PID 628 wrote to memory of 4104 628 48A2.tmp 91 PID 628 wrote to memory of 4104 628 48A2.tmp 91 PID 628 wrote to memory of 4104 628 48A2.tmp 91 PID 4104 wrote to memory of 2348 4104 48FF.tmp 92 PID 4104 wrote to memory of 2348 4104 48FF.tmp 92 PID 4104 wrote to memory of 2348 4104 48FF.tmp 92 PID 2348 wrote to memory of 4548 2348 496D.tmp 93 PID 2348 wrote to memory of 4548 2348 496D.tmp 93 PID 2348 wrote to memory of 4548 2348 496D.tmp 93 PID 4548 wrote to memory of 3304 4548 49BB.tmp 94 PID 4548 wrote to memory of 3304 4548 49BB.tmp 94 PID 4548 wrote to memory of 3304 4548 49BB.tmp 94 PID 3304 wrote to memory of 212 3304 4A09.tmp 95 PID 3304 wrote to memory of 212 3304 4A09.tmp 95 PID 3304 wrote to memory of 212 3304 4A09.tmp 95 PID 212 wrote to memory of 2620 212 4A67.tmp 96 PID 212 wrote to memory of 2620 212 4A67.tmp 96 PID 212 wrote to memory of 2620 212 4A67.tmp 96 PID 2620 wrote to memory of 4052 2620 4AB5.tmp 97 PID 2620 wrote to memory of 4052 2620 4AB5.tmp 97 PID 2620 wrote to memory of 4052 2620 4AB5.tmp 97 PID 4052 wrote to memory of 3320 4052 4B22.tmp 98 PID 4052 wrote to memory of 3320 4052 4B22.tmp 98 PID 4052 wrote to memory of 3320 4052 4B22.tmp 98 PID 3320 wrote to memory of 4972 3320 4B70.tmp 99 PID 3320 wrote to memory of 4972 3320 4B70.tmp 99 PID 3320 wrote to memory of 4972 3320 4B70.tmp 99 PID 4972 wrote to memory of 2600 4972 4BCE.tmp 100 PID 4972 wrote to memory of 2600 4972 4BCE.tmp 100 PID 4972 wrote to memory of 2600 4972 4BCE.tmp 100 PID 2600 wrote to memory of 4756 2600 4C4B.tmp 101 PID 2600 wrote to memory of 4756 2600 4C4B.tmp 101 PID 2600 wrote to memory of 4756 2600 4C4B.tmp 101 PID 4756 wrote to memory of 3080 4756 4CA9.tmp 102 PID 4756 wrote to memory of 3080 4756 4CA9.tmp 102 PID 4756 wrote to memory of 3080 4756 4CA9.tmp 102 PID 3080 wrote to memory of 3504 3080 4D26.tmp 103 PID 3080 wrote to memory of 3504 3080 4D26.tmp 103 PID 3080 wrote to memory of 3504 3080 4D26.tmp 103 PID 3504 wrote to memory of 1756 3504 4D74.tmp 104 PID 3504 wrote to memory of 1756 3504 4D74.tmp 104 PID 3504 wrote to memory of 1756 3504 4D74.tmp 104 PID 1756 wrote to memory of 4956 1756 4DE1.tmp 105 PID 1756 wrote to memory of 4956 1756 4DE1.tmp 105 PID 1756 wrote to memory of 4956 1756 4DE1.tmp 105 PID 4956 wrote to memory of 4832 4956 4E5E.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-21_aa0e8c4dd927c5e853578068af9a9575_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-21_aa0e8c4dd927c5e853578068af9a9575_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"23⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"24⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"25⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"26⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"27⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"28⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"29⤵
- Executes dropped EXE
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"30⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"31⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"32⤵
- Executes dropped EXE
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"33⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"34⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"35⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"36⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"37⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"38⤵
- Executes dropped EXE
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"39⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"40⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"41⤵
- Executes dropped EXE
PID:920 -
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"42⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"43⤵
- Executes dropped EXE
PID:652 -
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"44⤵
- Executes dropped EXE
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"45⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"46⤵
- Executes dropped EXE
PID:868 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"47⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"48⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"49⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"50⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"51⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"52⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"53⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"54⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"55⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"56⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"57⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"58⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"59⤵
- Executes dropped EXE
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"60⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"61⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"62⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"63⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"64⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"65⤵
- Executes dropped EXE
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"66⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"67⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"68⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"69⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"70⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"71⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"72⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"73⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"74⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"75⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"76⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"77⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"78⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"79⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"80⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"81⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"82⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"83⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"84⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"85⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"86⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"87⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"88⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"89⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"90⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"91⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"92⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"93⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"94⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"95⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"96⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"97⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\6745.tmp"C:\Users\Admin\AppData\Local\Temp\6745.tmp"98⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"99⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"100⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"101⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"102⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"103⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"104⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"105⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"106⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"107⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"108⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"109⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"110⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"111⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"112⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"113⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"114⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"115⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"116⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"117⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"118⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"119⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"120⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"121⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"122⤵PID:3584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-