Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23/05/2024, 19:08
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-23_605339b504863ea2eefc11beaae37a77_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-23_605339b504863ea2eefc11beaae37a77_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-23_605339b504863ea2eefc11beaae37a77_mafia.exe
-
Size
520KB
-
MD5
605339b504863ea2eefc11beaae37a77
-
SHA1
95a5c1c47df84cb03411a061eb8298cdb0aeb45f
-
SHA256
7182801e9916d714e174e26f682a14ba73d70f4d05280235bcf07d05d140f852
-
SHA512
fa9c169b3fe5715de74189e09c6828bdd3595f0d49f03caba9d5732ddc6e77a38c9d73ca48e457cd38f3fbadc351717315d794980154bdafb0dfb058520c68f4
-
SSDEEP
12288:roRXOQjmOyrYyagn6e2eM22ETqUPgCfNZ:rogQ9yhnlLMrEGUYCfN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1100 4C8A.tmp 3164 4D45.tmp 4876 4DD2.tmp 3436 4E5E.tmp 2408 4ECC.tmp 808 4F68.tmp 2188 4FC6.tmp 3116 5043.tmp 1932 50CF.tmp 4608 514C.tmp 1664 51BA.tmp 60 5217.tmp 5068 5275.tmp 4016 52F2.tmp 4388 5350.tmp 1540 539E.tmp 4732 53FC.tmp 5096 544A.tmp 4468 54B7.tmp 2724 5525.tmp 2968 5573.tmp 3752 560F.tmp 3016 569C.tmp 3064 5719.tmp 4284 57A5.tmp 4952 57F3.tmp 1224 5851.tmp 4380 58DE.tmp 3352 594B.tmp 5104 59B9.tmp 5116 5A55.tmp 1008 5AF1.tmp 4220 5B4F.tmp 3924 5BAD.tmp 428 5BFB.tmp 2576 5C49.tmp 2288 5CF5.tmp 1516 5D43.tmp 4140 5DA1.tmp 3436 5DFE.tmp 2416 5E6C.tmp 2912 5EC9.tmp 3116 5F27.tmp 4492 5F85.tmp 1932 5FE3.tmp 4608 6040.tmp 1512 609E.tmp 5032 60FC.tmp 2708 614A.tmp 3540 61A8.tmp 512 61F6.tmp 4840 6254.tmp 4388 62C1.tmp 3272 632E.tmp 3288 638C.tmp 3976 63EA.tmp 3892 6448.tmp 988 64A5.tmp 448 64F4.tmp 4844 6551.tmp 2256 65AF.tmp 1012 660D.tmp 4680 666B.tmp 1032 66C8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2192 wrote to memory of 1100 2192 2024-05-23_605339b504863ea2eefc11beaae37a77_mafia.exe 84 PID 2192 wrote to memory of 1100 2192 2024-05-23_605339b504863ea2eefc11beaae37a77_mafia.exe 84 PID 2192 wrote to memory of 1100 2192 2024-05-23_605339b504863ea2eefc11beaae37a77_mafia.exe 84 PID 1100 wrote to memory of 3164 1100 4C8A.tmp 85 PID 1100 wrote to memory of 3164 1100 4C8A.tmp 85 PID 1100 wrote to memory of 3164 1100 4C8A.tmp 85 PID 3164 wrote to memory of 4876 3164 4D45.tmp 86 PID 3164 wrote to memory of 4876 3164 4D45.tmp 86 PID 3164 wrote to memory of 4876 3164 4D45.tmp 86 PID 4876 wrote to memory of 3436 4876 4DD2.tmp 87 PID 4876 wrote to memory of 3436 4876 4DD2.tmp 87 PID 4876 wrote to memory of 3436 4876 4DD2.tmp 87 PID 3436 wrote to memory of 2408 3436 4E5E.tmp 89 PID 3436 wrote to memory of 2408 3436 4E5E.tmp 89 PID 3436 wrote to memory of 2408 3436 4E5E.tmp 89 PID 2408 wrote to memory of 808 2408 4ECC.tmp 90 PID 2408 wrote to memory of 808 2408 4ECC.tmp 90 PID 2408 wrote to memory of 808 2408 4ECC.tmp 90 PID 808 wrote to memory of 2188 808 4F68.tmp 91 PID 808 wrote to memory of 2188 808 4F68.tmp 91 PID 808 wrote to memory of 2188 808 4F68.tmp 91 PID 2188 wrote to memory of 3116 2188 4FC6.tmp 93 PID 2188 wrote to memory of 3116 2188 4FC6.tmp 93 PID 2188 wrote to memory of 3116 2188 4FC6.tmp 93 PID 3116 wrote to memory of 1932 3116 5043.tmp 94 PID 3116 wrote to memory of 1932 3116 5043.tmp 94 PID 3116 wrote to memory of 1932 3116 5043.tmp 94 PID 1932 wrote to memory of 4608 1932 50CF.tmp 95 PID 1932 wrote to memory of 4608 1932 50CF.tmp 95 PID 1932 wrote to memory of 4608 1932 50CF.tmp 95 PID 4608 wrote to memory of 1664 4608 514C.tmp 96 PID 4608 wrote to memory of 1664 4608 514C.tmp 96 PID 4608 wrote to memory of 1664 4608 514C.tmp 96 PID 1664 wrote to memory of 60 1664 51BA.tmp 97 PID 1664 wrote to memory of 60 1664 51BA.tmp 97 PID 1664 wrote to memory of 60 1664 51BA.tmp 97 PID 60 wrote to memory of 5068 60 5217.tmp 98 PID 60 wrote to memory of 5068 60 5217.tmp 98 PID 60 wrote to memory of 5068 60 5217.tmp 98 PID 5068 wrote to memory of 4016 5068 5275.tmp 99 PID 5068 wrote to memory of 4016 5068 5275.tmp 99 PID 5068 wrote to memory of 4016 5068 5275.tmp 99 PID 4016 wrote to memory of 4388 4016 52F2.tmp 100 PID 4016 wrote to memory of 4388 4016 52F2.tmp 100 PID 4016 wrote to memory of 4388 4016 52F2.tmp 100 PID 4388 wrote to memory of 1540 4388 5350.tmp 101 PID 4388 wrote to memory of 1540 4388 5350.tmp 101 PID 4388 wrote to memory of 1540 4388 5350.tmp 101 PID 1540 wrote to memory of 4732 1540 539E.tmp 102 PID 1540 wrote to memory of 4732 1540 539E.tmp 102 PID 1540 wrote to memory of 4732 1540 539E.tmp 102 PID 4732 wrote to memory of 5096 4732 53FC.tmp 103 PID 4732 wrote to memory of 5096 4732 53FC.tmp 103 PID 4732 wrote to memory of 5096 4732 53FC.tmp 103 PID 5096 wrote to memory of 4468 5096 544A.tmp 104 PID 5096 wrote to memory of 4468 5096 544A.tmp 104 PID 5096 wrote to memory of 4468 5096 544A.tmp 104 PID 4468 wrote to memory of 2724 4468 54B7.tmp 105 PID 4468 wrote to memory of 2724 4468 54B7.tmp 105 PID 4468 wrote to memory of 2724 4468 54B7.tmp 105 PID 2724 wrote to memory of 2968 2724 5525.tmp 106 PID 2724 wrote to memory of 2968 2724 5525.tmp 106 PID 2724 wrote to memory of 2968 2724 5525.tmp 106 PID 2968 wrote to memory of 3752 2968 5573.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_605339b504863ea2eefc11beaae37a77_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_605339b504863ea2eefc11beaae37a77_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"23⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"24⤵
- Executes dropped EXE
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"25⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"26⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"27⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"28⤵
- Executes dropped EXE
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"29⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"30⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"31⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"32⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"33⤵
- Executes dropped EXE
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"34⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"35⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"36⤵
- Executes dropped EXE
PID:428 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"37⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"38⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"39⤵
- Executes dropped EXE
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"40⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"41⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"42⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"43⤵
- Executes dropped EXE
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"44⤵
- Executes dropped EXE
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"45⤵
- Executes dropped EXE
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"46⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"47⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"48⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"49⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"50⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"51⤵
- Executes dropped EXE
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"52⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"53⤵
- Executes dropped EXE
PID:512 -
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"54⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"55⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"56⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"57⤵
- Executes dropped EXE
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"58⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"59⤵
- Executes dropped EXE
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"60⤵
- Executes dropped EXE
PID:988 -
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"61⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"62⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"63⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"64⤵
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"65⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"66⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"67⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"68⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"69⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"70⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"71⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"72⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"73⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"74⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"75⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"76⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"77⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"78⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"79⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"80⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"81⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"82⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"83⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"84⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"85⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"86⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"87⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"88⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"89⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"90⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"91⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"92⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"93⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"94⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"95⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"96⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"97⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"98⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"99⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"100⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"101⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"102⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"103⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"104⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"105⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"106⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"107⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\760B.tmp"C:\Users\Admin\AppData\Local\Temp\760B.tmp"108⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\7659.tmp"C:\Users\Admin\AppData\Local\Temp\7659.tmp"109⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"110⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\7705.tmp"C:\Users\Admin\AppData\Local\Temp\7705.tmp"111⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\7762.tmp"C:\Users\Admin\AppData\Local\Temp\7762.tmp"112⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"113⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"114⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"115⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\78D9.tmp"C:\Users\Admin\AppData\Local\Temp\78D9.tmp"116⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\7927.tmp"C:\Users\Admin\AppData\Local\Temp\7927.tmp"117⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"118⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"119⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"120⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"121⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\7AED.tmp"C:\Users\Admin\AppData\Local\Temp\7AED.tmp"122⤵PID:4452
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-