Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2024, 11:42
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-23_308f479f38813fb8ded9319ce9d83518_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-23_308f479f38813fb8ded9319ce9d83518_mafia.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-23_308f479f38813fb8ded9319ce9d83518_mafia.exe
-
Size
487KB
-
MD5
308f479f38813fb8ded9319ce9d83518
-
SHA1
e33806ea36c643b954cdd5aa392ab6bb32ef2261
-
SHA256
4138030a6bbd12ab53e88a1cfb85d1365d648998105b1b8c6b5ad5434bf3f918
-
SHA512
917c60aa9765bc9102840491ab51bdafb3ceb68f919d046c173e1711a46f7b674ed575953561b1bd0cb467fc8f9a742423843be735ead0b3fa547a024ec31e5b
-
SSDEEP
6144:zorf3lPvovsgZnqG2C7mOTeiLxDxpqewW9wPg6AguTHQis+T4EeBJ/EhDSK0FsHt:yU5rCOTeiNTqenwh9W0PKFTbZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1580 4769.tmp 2012 47D6.tmp 4964 4853.tmp 536 48F0.tmp 2144 498C.tmp 880 49F9.tmp 848 4A67.tmp 1444 4AF3.tmp 3476 4B61.tmp 4856 4BED.tmp 4820 4C5B.tmp 4100 4CE7.tmp 4360 4D74.tmp 2476 4DF1.tmp 3828 4E6E.tmp 1768 4EDB.tmp 1956 4F49.tmp 3936 4FA6.tmp 1616 5014.tmp 4696 5081.tmp 4084 512D.tmp 5052 51AA.tmp 1696 5227.tmp 2256 52A4.tmp 3700 5331.tmp 2952 53BD.tmp 3120 543A.tmp 3028 54C7.tmp 4912 5525.tmp 2768 55B1.tmp 3632 563E.tmp 1032 56CB.tmp 4300 5748.tmp 4296 5796.tmp 2144 57E4.tmp 880 5832.tmp 516 5890.tmp 2304 58DE.tmp 2824 593C.tmp 3360 598A.tmp 2120 59E7.tmp 4796 5A36.tmp 3684 5A84.tmp 4660 5AD2.tmp 1368 5B30.tmp 4876 5B7E.tmp 1684 5BCC.tmp 5096 5C1A.tmp 1964 5C87.tmp 2728 5CE5.tmp 1488 5D43.tmp 2792 5DB0.tmp 5100 5E0E.tmp 2948 5E7B.tmp 1636 5EE9.tmp 3544 5F56.tmp 2952 5FC3.tmp 1592 6031.tmp 2616 608F.tmp 2680 60FC.tmp 1580 615A.tmp 4844 61B7.tmp 628 6215.tmp 784 6273.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2856 wrote to memory of 1580 2856 2024-04-23_308f479f38813fb8ded9319ce9d83518_mafia.exe 86 PID 2856 wrote to memory of 1580 2856 2024-04-23_308f479f38813fb8ded9319ce9d83518_mafia.exe 86 PID 2856 wrote to memory of 1580 2856 2024-04-23_308f479f38813fb8ded9319ce9d83518_mafia.exe 86 PID 1580 wrote to memory of 2012 1580 4769.tmp 88 PID 1580 wrote to memory of 2012 1580 4769.tmp 88 PID 1580 wrote to memory of 2012 1580 4769.tmp 88 PID 2012 wrote to memory of 4964 2012 47D6.tmp 89 PID 2012 wrote to memory of 4964 2012 47D6.tmp 89 PID 2012 wrote to memory of 4964 2012 47D6.tmp 89 PID 4964 wrote to memory of 536 4964 4853.tmp 91 PID 4964 wrote to memory of 536 4964 4853.tmp 91 PID 4964 wrote to memory of 536 4964 4853.tmp 91 PID 536 wrote to memory of 2144 536 48F0.tmp 92 PID 536 wrote to memory of 2144 536 48F0.tmp 92 PID 536 wrote to memory of 2144 536 48F0.tmp 92 PID 2144 wrote to memory of 880 2144 498C.tmp 94 PID 2144 wrote to memory of 880 2144 498C.tmp 94 PID 2144 wrote to memory of 880 2144 498C.tmp 94 PID 880 wrote to memory of 848 880 49F9.tmp 95 PID 880 wrote to memory of 848 880 49F9.tmp 95 PID 880 wrote to memory of 848 880 49F9.tmp 95 PID 848 wrote to memory of 1444 848 4A67.tmp 96 PID 848 wrote to memory of 1444 848 4A67.tmp 96 PID 848 wrote to memory of 1444 848 4A67.tmp 96 PID 1444 wrote to memory of 3476 1444 4AF3.tmp 97 PID 1444 wrote to memory of 3476 1444 4AF3.tmp 97 PID 1444 wrote to memory of 3476 1444 4AF3.tmp 97 PID 3476 wrote to memory of 4856 3476 4B61.tmp 98 PID 3476 wrote to memory of 4856 3476 4B61.tmp 98 PID 3476 wrote to memory of 4856 3476 4B61.tmp 98 PID 4856 wrote to memory of 4820 4856 4BED.tmp 99 PID 4856 wrote to memory of 4820 4856 4BED.tmp 99 PID 4856 wrote to memory of 4820 4856 4BED.tmp 99 PID 4820 wrote to memory of 4100 4820 4C5B.tmp 101 PID 4820 wrote to memory of 4100 4820 4C5B.tmp 101 PID 4820 wrote to memory of 4100 4820 4C5B.tmp 101 PID 4100 wrote to memory of 4360 4100 4CE7.tmp 102 PID 4100 wrote to memory of 4360 4100 4CE7.tmp 102 PID 4100 wrote to memory of 4360 4100 4CE7.tmp 102 PID 4360 wrote to memory of 2476 4360 4D74.tmp 103 PID 4360 wrote to memory of 2476 4360 4D74.tmp 103 PID 4360 wrote to memory of 2476 4360 4D74.tmp 103 PID 2476 wrote to memory of 3828 2476 4DF1.tmp 104 PID 2476 wrote to memory of 3828 2476 4DF1.tmp 104 PID 2476 wrote to memory of 3828 2476 4DF1.tmp 104 PID 3828 wrote to memory of 1768 3828 4E6E.tmp 105 PID 3828 wrote to memory of 1768 3828 4E6E.tmp 105 PID 3828 wrote to memory of 1768 3828 4E6E.tmp 105 PID 1768 wrote to memory of 1956 1768 4EDB.tmp 106 PID 1768 wrote to memory of 1956 1768 4EDB.tmp 106 PID 1768 wrote to memory of 1956 1768 4EDB.tmp 106 PID 1956 wrote to memory of 3936 1956 4F49.tmp 107 PID 1956 wrote to memory of 3936 1956 4F49.tmp 107 PID 1956 wrote to memory of 3936 1956 4F49.tmp 107 PID 3936 wrote to memory of 1616 3936 4FA6.tmp 108 PID 3936 wrote to memory of 1616 3936 4FA6.tmp 108 PID 3936 wrote to memory of 1616 3936 4FA6.tmp 108 PID 1616 wrote to memory of 4696 1616 5014.tmp 109 PID 1616 wrote to memory of 4696 1616 5014.tmp 109 PID 1616 wrote to memory of 4696 1616 5014.tmp 109 PID 4696 wrote to memory of 4084 4696 5081.tmp 110 PID 4696 wrote to memory of 4084 4696 5081.tmp 110 PID 4696 wrote to memory of 4084 4696 5081.tmp 110 PID 4084 wrote to memory of 5052 4084 512D.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-23_308f479f38813fb8ded9319ce9d83518_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-23_308f479f38813fb8ded9319ce9d83518_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"23⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"24⤵
- Executes dropped EXE
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"25⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"26⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"27⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"28⤵
- Executes dropped EXE
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"29⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"30⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"31⤵
- Executes dropped EXE
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"32⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"33⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"34⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"35⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"36⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"37⤵
- Executes dropped EXE
PID:880 -
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"38⤵
- Executes dropped EXE
PID:516 -
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"39⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"40⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"41⤵
- Executes dropped EXE
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"42⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"43⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"44⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"45⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"46⤵
- Executes dropped EXE
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"47⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"48⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"49⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"50⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"51⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"52⤵
- Executes dropped EXE
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"53⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"54⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"55⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"56⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"57⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"58⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"59⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"60⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"61⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"62⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"63⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"64⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"65⤵
- Executes dropped EXE
PID:784 -
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"66⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"67⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"68⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"69⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"70⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"71⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"72⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"73⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"74⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"75⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"76⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"77⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"78⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"79⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"80⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"81⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"82⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"83⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"84⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"85⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"86⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"87⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"88⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"89⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"90⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"91⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"92⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"93⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"94⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"95⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"96⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"97⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"98⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"99⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"100⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"101⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"102⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"103⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"104⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\7148.tmp"C:\Users\Admin\AppData\Local\Temp\7148.tmp"105⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"106⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\7213.tmp"C:\Users\Admin\AppData\Local\Temp\7213.tmp"107⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"108⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"109⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"110⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"111⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"112⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"113⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"114⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"115⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"116⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"117⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"118⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"119⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"120⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\76F5.tmp"C:\Users\Admin\AppData\Local\Temp\76F5.tmp"121⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\7753.tmp"C:\Users\Admin\AppData\Local\Temp\7753.tmp"122⤵PID:4836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-