Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18/04/2024, 00:26
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-18_6b3c7c00787f69822afccadb6487432e_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-04-18_6b3c7c00787f69822afccadb6487432e_mafia.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-18_6b3c7c00787f69822afccadb6487432e_mafia.exe
-
Size
487KB
-
MD5
6b3c7c00787f69822afccadb6487432e
-
SHA1
3d890c9ce410453b419278c978f2b2401e68e045
-
SHA256
a4223ee17799a8d30bf8ab148b52fd60fe3657838a74753676158cefef9cdc19
-
SHA512
8a7afcd22aab7575b8c82df0819d37be90e4d970d59a476311ae9e05d65e2b62ffa2a03da9c02e57b9feb9e30ca8ca0cd2945f5b8726ebcc4280bb479975c7f8
-
SSDEEP
6144:zorf3lPvovsgZnqG2C7mOTeiLxDxsrY1PJSvIfTyJRGHcc4nyw85drWuwYljbt0H:yU5rCOTeiNK6PJlO6LrDwYl/ekMIebZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2692 53BD.tmp 956 543A.tmp 1548 54B7.tmp 2980 5544.tmp 1544 55D1.tmp 4936 565D.tmp 4980 56F9.tmp 3356 5776.tmp 3372 5813.tmp 4024 5870.tmp 4500 58FD.tmp 2368 596A.tmp 4496 59C8.tmp 4304 5A26.tmp 232 5AC2.tmp 3960 5B4F.tmp 3696 5BAD.tmp 1908 5C58.tmp 2504 5CC6.tmp 4544 5D52.tmp 2868 5DCF.tmp 4516 5E2D.tmp 368 5EBA.tmp 3436 5F37.tmp 4932 5FC3.tmp 3896 6031.tmp 4976 60AE.tmp 2528 611B.tmp 1980 6189.tmp 3984 6206.tmp 2864 6273.tmp 4388 6300.tmp 1876 636D.tmp 4632 63BB.tmp 5092 6419.tmp 1684 6467.tmp 1008 64B5.tmp 380 6513.tmp 4840 6561.tmp 2972 65DE.tmp 1544 663C.tmp 1596 6699.tmp 1844 66E8.tmp 3772 6745.tmp 4676 67A3.tmp 548 67F1.tmp 4760 684F.tmp 3372 689D.tmp 3260 68EB.tmp 4492 6939.tmp 2848 6997.tmp 2796 69E5.tmp 3080 6A43.tmp 940 6AA1.tmp 4304 6AEF.tmp 232 6B5C.tmp 4964 6BBA.tmp 3548 6C18.tmp 3696 6C66.tmp 3700 6CC4.tmp 492 6D12.tmp 5020 6D6F.tmp 3344 6DCD.tmp 2104 6E2B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2700 wrote to memory of 2692 2700 2024-04-18_6b3c7c00787f69822afccadb6487432e_mafia.exe 84 PID 2700 wrote to memory of 2692 2700 2024-04-18_6b3c7c00787f69822afccadb6487432e_mafia.exe 84 PID 2700 wrote to memory of 2692 2700 2024-04-18_6b3c7c00787f69822afccadb6487432e_mafia.exe 84 PID 2692 wrote to memory of 956 2692 53BD.tmp 85 PID 2692 wrote to memory of 956 2692 53BD.tmp 85 PID 2692 wrote to memory of 956 2692 53BD.tmp 85 PID 956 wrote to memory of 1548 956 543A.tmp 86 PID 956 wrote to memory of 1548 956 543A.tmp 86 PID 956 wrote to memory of 1548 956 543A.tmp 86 PID 1548 wrote to memory of 2980 1548 54B7.tmp 87 PID 1548 wrote to memory of 2980 1548 54B7.tmp 87 PID 1548 wrote to memory of 2980 1548 54B7.tmp 87 PID 2980 wrote to memory of 1544 2980 5544.tmp 89 PID 2980 wrote to memory of 1544 2980 5544.tmp 89 PID 2980 wrote to memory of 1544 2980 5544.tmp 89 PID 1544 wrote to memory of 4936 1544 55D1.tmp 91 PID 1544 wrote to memory of 4936 1544 55D1.tmp 91 PID 1544 wrote to memory of 4936 1544 55D1.tmp 91 PID 4936 wrote to memory of 4980 4936 565D.tmp 92 PID 4936 wrote to memory of 4980 4936 565D.tmp 92 PID 4936 wrote to memory of 4980 4936 565D.tmp 92 PID 4980 wrote to memory of 3356 4980 56F9.tmp 94 PID 4980 wrote to memory of 3356 4980 56F9.tmp 94 PID 4980 wrote to memory of 3356 4980 56F9.tmp 94 PID 3356 wrote to memory of 3372 3356 5776.tmp 95 PID 3356 wrote to memory of 3372 3356 5776.tmp 95 PID 3356 wrote to memory of 3372 3356 5776.tmp 95 PID 3372 wrote to memory of 4024 3372 5813.tmp 96 PID 3372 wrote to memory of 4024 3372 5813.tmp 96 PID 3372 wrote to memory of 4024 3372 5813.tmp 96 PID 4024 wrote to memory of 4500 4024 5870.tmp 97 PID 4024 wrote to memory of 4500 4024 5870.tmp 97 PID 4024 wrote to memory of 4500 4024 5870.tmp 97 PID 4500 wrote to memory of 2368 4500 58FD.tmp 98 PID 4500 wrote to memory of 2368 4500 58FD.tmp 98 PID 4500 wrote to memory of 2368 4500 58FD.tmp 98 PID 2368 wrote to memory of 4496 2368 596A.tmp 99 PID 2368 wrote to memory of 4496 2368 596A.tmp 99 PID 2368 wrote to memory of 4496 2368 596A.tmp 99 PID 4496 wrote to memory of 4304 4496 59C8.tmp 100 PID 4496 wrote to memory of 4304 4496 59C8.tmp 100 PID 4496 wrote to memory of 4304 4496 59C8.tmp 100 PID 4304 wrote to memory of 232 4304 5A26.tmp 101 PID 4304 wrote to memory of 232 4304 5A26.tmp 101 PID 4304 wrote to memory of 232 4304 5A26.tmp 101 PID 232 wrote to memory of 3960 232 5AC2.tmp 102 PID 232 wrote to memory of 3960 232 5AC2.tmp 102 PID 232 wrote to memory of 3960 232 5AC2.tmp 102 PID 3960 wrote to memory of 3696 3960 5B4F.tmp 103 PID 3960 wrote to memory of 3696 3960 5B4F.tmp 103 PID 3960 wrote to memory of 3696 3960 5B4F.tmp 103 PID 3696 wrote to memory of 1908 3696 5BAD.tmp 104 PID 3696 wrote to memory of 1908 3696 5BAD.tmp 104 PID 3696 wrote to memory of 1908 3696 5BAD.tmp 104 PID 1908 wrote to memory of 2504 1908 5C58.tmp 105 PID 1908 wrote to memory of 2504 1908 5C58.tmp 105 PID 1908 wrote to memory of 2504 1908 5C58.tmp 105 PID 2504 wrote to memory of 4544 2504 5CC6.tmp 106 PID 2504 wrote to memory of 4544 2504 5CC6.tmp 106 PID 2504 wrote to memory of 4544 2504 5CC6.tmp 106 PID 4544 wrote to memory of 2868 4544 5D52.tmp 108 PID 4544 wrote to memory of 2868 4544 5D52.tmp 108 PID 4544 wrote to memory of 2868 4544 5D52.tmp 108 PID 2868 wrote to memory of 4516 2868 5DCF.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-18_6b3c7c00787f69822afccadb6487432e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-18_6b3c7c00787f69822afccadb6487432e_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"23⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"24⤵
- Executes dropped EXE
PID:368 -
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"25⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"26⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"27⤵
- Executes dropped EXE
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"28⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"29⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"30⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"31⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"32⤵
- Executes dropped EXE
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"33⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"34⤵
- Executes dropped EXE
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"35⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"36⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"37⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"38⤵
- Executes dropped EXE
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"39⤵
- Executes dropped EXE
PID:380 -
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"40⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"41⤵
- Executes dropped EXE
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"42⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"43⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"44⤵
- Executes dropped EXE
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\6745.tmp"C:\Users\Admin\AppData\Local\Temp\6745.tmp"45⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"46⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"47⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"48⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"49⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"50⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"51⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"52⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"53⤵
- Executes dropped EXE
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"54⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"55⤵
- Executes dropped EXE
PID:940 -
C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"56⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"57⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"58⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"59⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"60⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"61⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"62⤵
- Executes dropped EXE
PID:492 -
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"63⤵
- Executes dropped EXE
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"64⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"65⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"66⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"67⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"68⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"69⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"70⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"71⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"72⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"73⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\7148.tmp"C:\Users\Admin\AppData\Local\Temp\7148.tmp"74⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"75⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"76⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"77⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"78⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"79⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"80⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"81⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"82⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"83⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"84⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"85⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"86⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"87⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\7659.tmp"C:\Users\Admin\AppData\Local\Temp\7659.tmp"88⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"89⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\76F5.tmp"C:\Users\Admin\AppData\Local\Temp\76F5.tmp"90⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\7753.tmp"C:\Users\Admin\AppData\Local\Temp\7753.tmp"91⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\77B0.tmp"C:\Users\Admin\AppData\Local\Temp\77B0.tmp"92⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"93⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\788B.tmp"C:\Users\Admin\AppData\Local\Temp\788B.tmp"94⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"95⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"96⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\79B4.tmp"C:\Users\Admin\AppData\Local\Temp\79B4.tmp"97⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\7A02.tmp"C:\Users\Admin\AppData\Local\Temp\7A02.tmp"98⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\7A60.tmp"C:\Users\Admin\AppData\Local\Temp\7A60.tmp"99⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"100⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"101⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\7B89.tmp"C:\Users\Admin\AppData\Local\Temp\7B89.tmp"102⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"103⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\7C35.tmp"C:\Users\Admin\AppData\Local\Temp\7C35.tmp"104⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"105⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\7D00.tmp"C:\Users\Admin\AppData\Local\Temp\7D00.tmp"106⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"107⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"108⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\7E09.tmp"C:\Users\Admin\AppData\Local\Temp\7E09.tmp"109⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"110⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"111⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"112⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\7F42.tmp"C:\Users\Admin\AppData\Local\Temp\7F42.tmp"113⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\7F90.tmp"C:\Users\Admin\AppData\Local\Temp\7F90.tmp"114⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"115⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"116⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\80C9.tmp"C:\Users\Admin\AppData\Local\Temp\80C9.tmp"117⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\8117.tmp"C:\Users\Admin\AppData\Local\Temp\8117.tmp"118⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\8165.tmp"C:\Users\Admin\AppData\Local\Temp\8165.tmp"119⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\81C3.tmp"C:\Users\Admin\AppData\Local\Temp\81C3.tmp"120⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\825F.tmp"C:\Users\Admin\AppData\Local\Temp\825F.tmp"121⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\82AD.tmp"C:\Users\Admin\AppData\Local\Temp\82AD.tmp"122⤵PID:640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-