Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 04:05
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-14_9569274dfc26436c72e9c8545a9d055e_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-14_9569274dfc26436c72e9c8545a9d055e_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-14_9569274dfc26436c72e9c8545a9d055e_mafia.exe
-
Size
486KB
-
MD5
9569274dfc26436c72e9c8545a9d055e
-
SHA1
0e7cc6cf26fb045ead6a8d56e1655bc4af7e653b
-
SHA256
475746de728d56e0b9cc8c4bc222dacd922b02039ba7bc60cfcc4a752e142bea
-
SHA512
db3ccbe0c9795c4fb3033d371c895a65ec725fa26a8ba5ae7a4f5946faec5867e15c8c24f6d2b472fce089490b7edb80ba64c92151d5e75050fd9a4a9a386c85
-
SSDEEP
6144:Forf3lPvovsgZnqG2C7mOTeiLfD7VyuRJQ641hRyV9X+4TNdqTZZi2BVY2Vfu2a:UU5rCOTeiDfRY1T+O4C62Q2tu21NZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1316 4E7E.tmp 3184 4F39.tmp 3436 4FE5.tmp 880 50A0.tmp 3192 510E.tmp 3916 51AA.tmp 2068 5237.tmp 2464 5294.tmp 3520 5321.tmp 1844 53BD.tmp 1300 544A.tmp 2908 54A8.tmp 2660 5534.tmp 3732 5592.tmp 1592 561F.tmp 2392 566D.tmp 4744 56BB.tmp 5108 5728.tmp 4712 5796.tmp 1352 5832.tmp 884 58AF.tmp 440 593C.tmp 4400 598A.tmp 1480 5A26.tmp 2792 5AD2.tmp 4052 5B5E.tmp 4912 5BBC.tmp 664 5C2A.tmp 5000 5CC6.tmp 3544 5D14.tmp 972 5D91.tmp 3556 5E0E.tmp 2444 5E8B.tmp 4348 5EE9.tmp 5052 5F46.tmp 2352 5F95.tmp 3044 5FE3.tmp 1492 6031.tmp 2308 608F.tmp 560 60DD.tmp 4272 613A.tmp 2760 6189.tmp 2884 61E6.tmp 4988 6244.tmp 1316 62A2.tmp 2756 6300.tmp 2636 634E.tmp 1612 63AB.tmp 1252 6409.tmp 1168 6467.tmp 4940 64C5.tmp 2876 6513.tmp 2732 6580.tmp 4984 65DE.tmp 3064 662C.tmp 4968 667A.tmp 3860 66D8.tmp 2900 6736.tmp 1296 67A3.tmp 3684 6810.tmp 60 686E.tmp 3152 68BC.tmp 3228 692A.tmp 4320 6987.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 520 wrote to memory of 1316 520 2024-05-14_9569274dfc26436c72e9c8545a9d055e_mafia.exe 82 PID 520 wrote to memory of 1316 520 2024-05-14_9569274dfc26436c72e9c8545a9d055e_mafia.exe 82 PID 520 wrote to memory of 1316 520 2024-05-14_9569274dfc26436c72e9c8545a9d055e_mafia.exe 82 PID 1316 wrote to memory of 3184 1316 4E7E.tmp 84 PID 1316 wrote to memory of 3184 1316 4E7E.tmp 84 PID 1316 wrote to memory of 3184 1316 4E7E.tmp 84 PID 3184 wrote to memory of 3436 3184 4F39.tmp 86 PID 3184 wrote to memory of 3436 3184 4F39.tmp 86 PID 3184 wrote to memory of 3436 3184 4F39.tmp 86 PID 3436 wrote to memory of 880 3436 4FE5.tmp 87 PID 3436 wrote to memory of 880 3436 4FE5.tmp 87 PID 3436 wrote to memory of 880 3436 4FE5.tmp 87 PID 880 wrote to memory of 3192 880 50A0.tmp 89 PID 880 wrote to memory of 3192 880 50A0.tmp 89 PID 880 wrote to memory of 3192 880 50A0.tmp 89 PID 3192 wrote to memory of 3916 3192 510E.tmp 90 PID 3192 wrote to memory of 3916 3192 510E.tmp 90 PID 3192 wrote to memory of 3916 3192 510E.tmp 90 PID 3916 wrote to memory of 2068 3916 51AA.tmp 91 PID 3916 wrote to memory of 2068 3916 51AA.tmp 91 PID 3916 wrote to memory of 2068 3916 51AA.tmp 91 PID 2068 wrote to memory of 2464 2068 5237.tmp 92 PID 2068 wrote to memory of 2464 2068 5237.tmp 92 PID 2068 wrote to memory of 2464 2068 5237.tmp 92 PID 2464 wrote to memory of 3520 2464 5294.tmp 93 PID 2464 wrote to memory of 3520 2464 5294.tmp 93 PID 2464 wrote to memory of 3520 2464 5294.tmp 93 PID 3520 wrote to memory of 1844 3520 5321.tmp 94 PID 3520 wrote to memory of 1844 3520 5321.tmp 94 PID 3520 wrote to memory of 1844 3520 5321.tmp 94 PID 1844 wrote to memory of 1300 1844 53BD.tmp 95 PID 1844 wrote to memory of 1300 1844 53BD.tmp 95 PID 1844 wrote to memory of 1300 1844 53BD.tmp 95 PID 1300 wrote to memory of 2908 1300 544A.tmp 96 PID 1300 wrote to memory of 2908 1300 544A.tmp 96 PID 1300 wrote to memory of 2908 1300 544A.tmp 96 PID 2908 wrote to memory of 2660 2908 54A8.tmp 97 PID 2908 wrote to memory of 2660 2908 54A8.tmp 97 PID 2908 wrote to memory of 2660 2908 54A8.tmp 97 PID 2660 wrote to memory of 3732 2660 5534.tmp 98 PID 2660 wrote to memory of 3732 2660 5534.tmp 98 PID 2660 wrote to memory of 3732 2660 5534.tmp 98 PID 3732 wrote to memory of 1592 3732 5592.tmp 100 PID 3732 wrote to memory of 1592 3732 5592.tmp 100 PID 3732 wrote to memory of 1592 3732 5592.tmp 100 PID 1592 wrote to memory of 2392 1592 561F.tmp 101 PID 1592 wrote to memory of 2392 1592 561F.tmp 101 PID 1592 wrote to memory of 2392 1592 561F.tmp 101 PID 2392 wrote to memory of 4744 2392 566D.tmp 102 PID 2392 wrote to memory of 4744 2392 566D.tmp 102 PID 2392 wrote to memory of 4744 2392 566D.tmp 102 PID 4744 wrote to memory of 5108 4744 56BB.tmp 103 PID 4744 wrote to memory of 5108 4744 56BB.tmp 103 PID 4744 wrote to memory of 5108 4744 56BB.tmp 103 PID 5108 wrote to memory of 4712 5108 5728.tmp 104 PID 5108 wrote to memory of 4712 5108 5728.tmp 104 PID 5108 wrote to memory of 4712 5108 5728.tmp 104 PID 4712 wrote to memory of 1352 4712 5796.tmp 105 PID 4712 wrote to memory of 1352 4712 5796.tmp 105 PID 4712 wrote to memory of 1352 4712 5796.tmp 105 PID 1352 wrote to memory of 884 1352 5832.tmp 106 PID 1352 wrote to memory of 884 1352 5832.tmp 106 PID 1352 wrote to memory of 884 1352 5832.tmp 106 PID 884 wrote to memory of 440 884 58AF.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-14_9569274dfc26436c72e9c8545a9d055e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-14_9569274dfc26436c72e9c8545a9d055e_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"23⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"24⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"25⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"26⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"27⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"28⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"29⤵
- Executes dropped EXE
PID:664 -
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"30⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"31⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"32⤵
- Executes dropped EXE
PID:972 -
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"33⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"34⤵
- Executes dropped EXE
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"35⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"36⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"37⤵
- Executes dropped EXE
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"38⤵
- Executes dropped EXE
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"39⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"40⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"41⤵
- Executes dropped EXE
PID:560 -
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"42⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"43⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"44⤵
- Executes dropped EXE
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"45⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"46⤵
- Executes dropped EXE
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"47⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"48⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"49⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"50⤵
- Executes dropped EXE
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"51⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"52⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"53⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"54⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"55⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"56⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"57⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"58⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"59⤵
- Executes dropped EXE
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"60⤵
- Executes dropped EXE
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"61⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"62⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"63⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"64⤵
- Executes dropped EXE
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"65⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"66⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"67⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"68⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"69⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"70⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"71⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"72⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"73⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"74⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"75⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"76⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"77⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"78⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"79⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"80⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"81⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"82⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"83⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"84⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"85⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"86⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"87⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"88⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"89⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\72A0.tmp"C:\Users\Admin\AppData\Local\Temp\72A0.tmp"90⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"91⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"92⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"93⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"94⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"95⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"96⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"97⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"98⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"99⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"100⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"101⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"102⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\7743.tmp"C:\Users\Admin\AppData\Local\Temp\7743.tmp"103⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\7791.tmp"C:\Users\Admin\AppData\Local\Temp\7791.tmp"104⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\77EF.tmp"C:\Users\Admin\AppData\Local\Temp\77EF.tmp"105⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"106⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\789B.tmp"C:\Users\Admin\AppData\Local\Temp\789B.tmp"107⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\78F9.tmp"C:\Users\Admin\AppData\Local\Temp\78F9.tmp"108⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\7956.tmp"C:\Users\Admin\AppData\Local\Temp\7956.tmp"109⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\79C4.tmp"C:\Users\Admin\AppData\Local\Temp\79C4.tmp"110⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\7A21.tmp"C:\Users\Admin\AppData\Local\Temp\7A21.tmp"111⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"112⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"113⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"114⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\7B79.tmp"C:\Users\Admin\AppData\Local\Temp\7B79.tmp"115⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"116⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"117⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\7C83.tmp"C:\Users\Admin\AppData\Local\Temp\7C83.tmp"118⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"119⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"120⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"121⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\7E09.tmp"C:\Users\Admin\AppData\Local\Temp\7E09.tmp"122⤵PID:4880
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-