Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2024, 17:38
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-04_cf1bc93275c71232641a890328232175_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-04_cf1bc93275c71232641a890328232175_mafia.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-05-04_cf1bc93275c71232641a890328232175_mafia.exe
-
Size
530KB
-
MD5
cf1bc93275c71232641a890328232175
-
SHA1
e94779a2b8c0d4ff51fafdb2c9604577ed40bcd3
-
SHA256
74948f0491fe863b1cf00631614193c67e33f45bca594e071888229f57cb094e
-
SHA512
dabd14cae9a29a2c98162841838a93dd9e053acf78737efbf38d7be499e99c544cce1510fc0abb2ddf06d4d88e51ed151fc1db547e6e3c2dd1405c7b19100cdf
-
SSDEEP
12288:AU5rCOTeioWCLWLlck46GLJqPEZochdIVNZulFVg0M1:AUQOJoWCAlcJbdTZoIdsNclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 772 3D95.tmp 3048 3E32.tmp 2128 3E9F.tmp 2740 3F2C.tmp 2092 3F89.tmp 3264 3FF7.tmp 1304 4055.tmp 1464 40D2.tmp 1100 415E.tmp 4576 41EB.tmp 2640 4258.tmp 2480 42D5.tmp 2636 4343.tmp 4224 4391.tmp 3872 440E.tmp 2796 447B.tmp 4412 44C9.tmp 4220 4546.tmp 3844 45A4.tmp 1784 4602.tmp 3172 467F.tmp 3308 46DC.tmp 884 473A.tmp 3068 4798.tmp 3460 4815.tmp 1840 4873.tmp 1168 48E0.tmp 4920 494D.tmp 1080 49AB.tmp 4664 4A28.tmp 764 4A76.tmp 5024 4B03.tmp 5000 4B70.tmp 2476 4BCE.tmp 4676 4C3B.tmp 4644 4C8A.tmp 2096 4CE7.tmp 4360 4D45.tmp 848 4D93.tmp 2632 4DF1.tmp 4936 4E4F.tmp 772 4E9D.tmp 1656 4EEB.tmp 684 4F39.tmp 4660 4F87.tmp 3368 4FD5.tmp 4136 5033.tmp 1792 5081.tmp 3948 50CF.tmp 3336 511D.tmp 1060 517B.tmp 1068 51C9.tmp 1464 5217.tmp 4784 5275.tmp 4752 52C3.tmp 2640 5321.tmp 4656 536F.tmp 3232 53CD.tmp 4412 541B.tmp 4084 5479.tmp 4200 54D7.tmp 3972 5534.tmp 3064 5592.tmp 3648 55F0.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4912 wrote to memory of 772 4912 2024-05-04_cf1bc93275c71232641a890328232175_mafia.exe 86 PID 4912 wrote to memory of 772 4912 2024-05-04_cf1bc93275c71232641a890328232175_mafia.exe 86 PID 4912 wrote to memory of 772 4912 2024-05-04_cf1bc93275c71232641a890328232175_mafia.exe 86 PID 772 wrote to memory of 3048 772 3D95.tmp 87 PID 772 wrote to memory of 3048 772 3D95.tmp 87 PID 772 wrote to memory of 3048 772 3D95.tmp 87 PID 3048 wrote to memory of 2128 3048 3E32.tmp 89 PID 3048 wrote to memory of 2128 3048 3E32.tmp 89 PID 3048 wrote to memory of 2128 3048 3E32.tmp 89 PID 2128 wrote to memory of 2740 2128 3E9F.tmp 91 PID 2128 wrote to memory of 2740 2128 3E9F.tmp 91 PID 2128 wrote to memory of 2740 2128 3E9F.tmp 91 PID 2740 wrote to memory of 2092 2740 3F2C.tmp 93 PID 2740 wrote to memory of 2092 2740 3F2C.tmp 93 PID 2740 wrote to memory of 2092 2740 3F2C.tmp 93 PID 2092 wrote to memory of 3264 2092 3F89.tmp 94 PID 2092 wrote to memory of 3264 2092 3F89.tmp 94 PID 2092 wrote to memory of 3264 2092 3F89.tmp 94 PID 3264 wrote to memory of 1304 3264 3FF7.tmp 95 PID 3264 wrote to memory of 1304 3264 3FF7.tmp 95 PID 3264 wrote to memory of 1304 3264 3FF7.tmp 95 PID 1304 wrote to memory of 1464 1304 4055.tmp 96 PID 1304 wrote to memory of 1464 1304 4055.tmp 96 PID 1304 wrote to memory of 1464 1304 4055.tmp 96 PID 1464 wrote to memory of 1100 1464 40D2.tmp 97 PID 1464 wrote to memory of 1100 1464 40D2.tmp 97 PID 1464 wrote to memory of 1100 1464 40D2.tmp 97 PID 1100 wrote to memory of 4576 1100 415E.tmp 98 PID 1100 wrote to memory of 4576 1100 415E.tmp 98 PID 1100 wrote to memory of 4576 1100 415E.tmp 98 PID 4576 wrote to memory of 2640 4576 41EB.tmp 99 PID 4576 wrote to memory of 2640 4576 41EB.tmp 99 PID 4576 wrote to memory of 2640 4576 41EB.tmp 99 PID 2640 wrote to memory of 2480 2640 4258.tmp 100 PID 2640 wrote to memory of 2480 2640 4258.tmp 100 PID 2640 wrote to memory of 2480 2640 4258.tmp 100 PID 2480 wrote to memory of 2636 2480 42D5.tmp 101 PID 2480 wrote to memory of 2636 2480 42D5.tmp 101 PID 2480 wrote to memory of 2636 2480 42D5.tmp 101 PID 2636 wrote to memory of 4224 2636 4343.tmp 102 PID 2636 wrote to memory of 4224 2636 4343.tmp 102 PID 2636 wrote to memory of 4224 2636 4343.tmp 102 PID 4224 wrote to memory of 3872 4224 4391.tmp 103 PID 4224 wrote to memory of 3872 4224 4391.tmp 103 PID 4224 wrote to memory of 3872 4224 4391.tmp 103 PID 3872 wrote to memory of 2796 3872 440E.tmp 104 PID 3872 wrote to memory of 2796 3872 440E.tmp 104 PID 3872 wrote to memory of 2796 3872 440E.tmp 104 PID 2796 wrote to memory of 4412 2796 447B.tmp 105 PID 2796 wrote to memory of 4412 2796 447B.tmp 105 PID 2796 wrote to memory of 4412 2796 447B.tmp 105 PID 4412 wrote to memory of 4220 4412 44C9.tmp 106 PID 4412 wrote to memory of 4220 4412 44C9.tmp 106 PID 4412 wrote to memory of 4220 4412 44C9.tmp 106 PID 4220 wrote to memory of 3844 4220 4546.tmp 107 PID 4220 wrote to memory of 3844 4220 4546.tmp 107 PID 4220 wrote to memory of 3844 4220 4546.tmp 107 PID 3844 wrote to memory of 1784 3844 45A4.tmp 108 PID 3844 wrote to memory of 1784 3844 45A4.tmp 108 PID 3844 wrote to memory of 1784 3844 45A4.tmp 108 PID 1784 wrote to memory of 3172 1784 4602.tmp 109 PID 1784 wrote to memory of 3172 1784 4602.tmp 109 PID 1784 wrote to memory of 3172 1784 4602.tmp 109 PID 3172 wrote to memory of 3308 3172 467F.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-04_cf1bc93275c71232641a890328232175_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-04_cf1bc93275c71232641a890328232175_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\3D95.tmp"C:\Users\Admin\AppData\Local\Temp\3D95.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\3E32.tmp"C:\Users\Admin\AppData\Local\Temp\3E32.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\3F89.tmp"C:\Users\Admin\AppData\Local\Temp\3F89.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\4055.tmp"C:\Users\Admin\AppData\Local\Temp\4055.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\40D2.tmp"C:\Users\Admin\AppData\Local\Temp\40D2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\415E.tmp"C:\Users\Admin\AppData\Local\Temp\415E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\41EB.tmp"C:\Users\Admin\AppData\Local\Temp\41EB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\4258.tmp"C:\Users\Admin\AppData\Local\Temp\4258.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\447B.tmp"C:\Users\Admin\AppData\Local\Temp\447B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\4602.tmp"C:\Users\Admin\AppData\Local\Temp\4602.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"23⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"24⤵
- Executes dropped EXE
PID:884 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"25⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"26⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"27⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"28⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"29⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"30⤵
- Executes dropped EXE
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"31⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"32⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"33⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"34⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"35⤵
- Executes dropped EXE
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"36⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"37⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"38⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"39⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"40⤵
- Executes dropped EXE
PID:848 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"41⤵
- Executes dropped EXE
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"42⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"43⤵
- Executes dropped EXE
PID:772 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"44⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"45⤵
- Executes dropped EXE
PID:684 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"46⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"47⤵
- Executes dropped EXE
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"48⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"49⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"50⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"51⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"52⤵
- Executes dropped EXE
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"53⤵
- Executes dropped EXE
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"54⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"55⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"56⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"57⤵
- Executes dropped EXE
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"58⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"59⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"60⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"61⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"62⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"63⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"64⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"65⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"66⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"67⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"68⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"69⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"70⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"71⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"72⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"73⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"74⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"75⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"76⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"77⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"78⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"79⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"80⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"81⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"82⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"83⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"84⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"85⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"86⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"87⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"88⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"89⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"90⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"91⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"92⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"93⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"94⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"95⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"96⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"97⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"98⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"99⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"100⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"101⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"102⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"103⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"104⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"105⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"106⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"107⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"108⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"109⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"110⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"111⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"112⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"113⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"114⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"115⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"116⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"117⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"118⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"119⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"120⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"121⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"122⤵PID:1628
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-