Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 19:47
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-27_0ed2153cc8d00ddb2af6817a1ff23d3c_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-27_0ed2153cc8d00ddb2af6817a1ff23d3c_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-27_0ed2153cc8d00ddb2af6817a1ff23d3c_mafia.exe
-
Size
712KB
-
MD5
0ed2153cc8d00ddb2af6817a1ff23d3c
-
SHA1
d30906c36a4658dab55ae749e7f70979ef9b8817
-
SHA256
baa4e3de4f7d254cb9a9cb763929534444c92cc953161b4e93391c3280a855de
-
SHA512
a1f03198c5a9d37b1844b0638581dd85b8360d64a1ed136e8deec2f96b770a10e3e460284b8593f874618c3ff570ce808cb9052c10564b0c7dd22e838eb47557
-
SSDEEP
12288:FU5rCOTeiD1YNqBb9O4xjdRkl7ozJKLbgNZdCvq5TJLCvY90D8/LVBlVk736Y79m:FUQOJDiNubhxjHklU9osNnCvq5TJLCvc
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4368 49F9.tmp 4376 4A96.tmp 3640 4B03.tmp 1604 4BBE.tmp 1380 4C6A.tmp 2300 4D07.tmp 3296 4D84.tmp 3552 4E01.tmp 3900 4E7E.tmp 4736 4EEB.tmp 3644 4F68.tmp 4612 4FC6.tmp 2716 5033.tmp 1260 50A0.tmp 1984 511D.tmp 3956 51AA.tmp 948 5217.tmp 3576 52A4.tmp 1720 52F2.tmp 2964 536F.tmp 3508 53EC.tmp 1988 5469.tmp 1960 54C7.tmp 2892 5544.tmp 4424 55C1.tmp 4764 562E.tmp 612 56AB.tmp 216 5728.tmp 2972 5796.tmp 3272 5832.tmp 5108 58BF.tmp 3840 595B.tmp 3640 59C8.tmp 4824 5A16.tmp 2016 5A74.tmp 900 5AD2.tmp 3500 5B20.tmp 2624 5B6E.tmp 4008 5BBC.tmp 996 5C0A.tmp 2320 5C58.tmp 3900 5CA7.tmp 4736 5CF5.tmp 1556 5D52.tmp 3612 5DB0.tmp 4384 5E0E.tmp 5004 5E6C.tmp 3372 5EBA.tmp 3572 5F08.tmp 556 5F56.tmp 3068 5FB4.tmp 1704 6012.tmp 948 606F.tmp 1648 60CD.tmp 2516 612B.tmp 4872 6189.tmp 1568 61E6.tmp 4620 6244.tmp 3980 62A2.tmp 4120 6300.tmp 60 635D.tmp 5116 63BB.tmp 3976 6419.tmp 2236 6477.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4332 wrote to memory of 4368 4332 2024-05-27_0ed2153cc8d00ddb2af6817a1ff23d3c_mafia.exe 84 PID 4332 wrote to memory of 4368 4332 2024-05-27_0ed2153cc8d00ddb2af6817a1ff23d3c_mafia.exe 84 PID 4332 wrote to memory of 4368 4332 2024-05-27_0ed2153cc8d00ddb2af6817a1ff23d3c_mafia.exe 84 PID 4368 wrote to memory of 4376 4368 49F9.tmp 85 PID 4368 wrote to memory of 4376 4368 49F9.tmp 85 PID 4368 wrote to memory of 4376 4368 49F9.tmp 85 PID 4376 wrote to memory of 3640 4376 4A96.tmp 86 PID 4376 wrote to memory of 3640 4376 4A96.tmp 86 PID 4376 wrote to memory of 3640 4376 4A96.tmp 86 PID 3640 wrote to memory of 1604 3640 4B03.tmp 88 PID 3640 wrote to memory of 1604 3640 4B03.tmp 88 PID 3640 wrote to memory of 1604 3640 4B03.tmp 88 PID 1604 wrote to memory of 1380 1604 4BBE.tmp 89 PID 1604 wrote to memory of 1380 1604 4BBE.tmp 89 PID 1604 wrote to memory of 1380 1604 4BBE.tmp 89 PID 1380 wrote to memory of 2300 1380 4C6A.tmp 91 PID 1380 wrote to memory of 2300 1380 4C6A.tmp 91 PID 1380 wrote to memory of 2300 1380 4C6A.tmp 91 PID 2300 wrote to memory of 3296 2300 4D07.tmp 92 PID 2300 wrote to memory of 3296 2300 4D07.tmp 92 PID 2300 wrote to memory of 3296 2300 4D07.tmp 92 PID 3296 wrote to memory of 3552 3296 4D84.tmp 93 PID 3296 wrote to memory of 3552 3296 4D84.tmp 93 PID 3296 wrote to memory of 3552 3296 4D84.tmp 93 PID 3552 wrote to memory of 3900 3552 4E01.tmp 94 PID 3552 wrote to memory of 3900 3552 4E01.tmp 94 PID 3552 wrote to memory of 3900 3552 4E01.tmp 94 PID 3900 wrote to memory of 4736 3900 4E7E.tmp 95 PID 3900 wrote to memory of 4736 3900 4E7E.tmp 95 PID 3900 wrote to memory of 4736 3900 4E7E.tmp 95 PID 4736 wrote to memory of 3644 4736 4EEB.tmp 96 PID 4736 wrote to memory of 3644 4736 4EEB.tmp 96 PID 4736 wrote to memory of 3644 4736 4EEB.tmp 96 PID 3644 wrote to memory of 4612 3644 4F68.tmp 97 PID 3644 wrote to memory of 4612 3644 4F68.tmp 97 PID 3644 wrote to memory of 4612 3644 4F68.tmp 97 PID 4612 wrote to memory of 2716 4612 4FC6.tmp 98 PID 4612 wrote to memory of 2716 4612 4FC6.tmp 98 PID 4612 wrote to memory of 2716 4612 4FC6.tmp 98 PID 2716 wrote to memory of 1260 2716 5033.tmp 99 PID 2716 wrote to memory of 1260 2716 5033.tmp 99 PID 2716 wrote to memory of 1260 2716 5033.tmp 99 PID 1260 wrote to memory of 1984 1260 50A0.tmp 100 PID 1260 wrote to memory of 1984 1260 50A0.tmp 100 PID 1260 wrote to memory of 1984 1260 50A0.tmp 100 PID 1984 wrote to memory of 3956 1984 511D.tmp 101 PID 1984 wrote to memory of 3956 1984 511D.tmp 101 PID 1984 wrote to memory of 3956 1984 511D.tmp 101 PID 3956 wrote to memory of 948 3956 51AA.tmp 104 PID 3956 wrote to memory of 948 3956 51AA.tmp 104 PID 3956 wrote to memory of 948 3956 51AA.tmp 104 PID 948 wrote to memory of 3576 948 5217.tmp 105 PID 948 wrote to memory of 3576 948 5217.tmp 105 PID 948 wrote to memory of 3576 948 5217.tmp 105 PID 3576 wrote to memory of 1720 3576 52A4.tmp 106 PID 3576 wrote to memory of 1720 3576 52A4.tmp 106 PID 3576 wrote to memory of 1720 3576 52A4.tmp 106 PID 1720 wrote to memory of 2964 1720 52F2.tmp 107 PID 1720 wrote to memory of 2964 1720 52F2.tmp 107 PID 1720 wrote to memory of 2964 1720 52F2.tmp 107 PID 2964 wrote to memory of 3508 2964 536F.tmp 108 PID 2964 wrote to memory of 3508 2964 536F.tmp 108 PID 2964 wrote to memory of 3508 2964 536F.tmp 108 PID 3508 wrote to memory of 1988 3508 53EC.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_0ed2153cc8d00ddb2af6817a1ff23d3c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_0ed2153cc8d00ddb2af6817a1ff23d3c_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"23⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"24⤵
- Executes dropped EXE
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"25⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"26⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"27⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"28⤵
- Executes dropped EXE
PID:612 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"29⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"30⤵
- Executes dropped EXE
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"31⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"32⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"33⤵
- Executes dropped EXE
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"34⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"35⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"36⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"37⤵
- Executes dropped EXE
PID:900 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"38⤵
- Executes dropped EXE
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"39⤵
- Executes dropped EXE
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"40⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"41⤵
- Executes dropped EXE
PID:996 -
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"42⤵
- Executes dropped EXE
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"43⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"44⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"45⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"46⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"47⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"48⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"49⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"50⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"51⤵
- Executes dropped EXE
PID:556 -
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"52⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"53⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"54⤵
- Executes dropped EXE
PID:948 -
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"55⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"56⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"57⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"58⤵
- Executes dropped EXE
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"59⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"60⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"61⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"62⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"63⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"64⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"65⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"66⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"67⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"68⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"69⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"70⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"71⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"72⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"73⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"74⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"75⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"76⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"77⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"78⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"79⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"80⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"81⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"82⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"83⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"84⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"85⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"86⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"87⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"88⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"89⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"90⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"91⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"92⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"93⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"94⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"95⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"96⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"97⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"98⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"99⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"100⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"101⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\7177.tmp"C:\Users\Admin\AppData\Local\Temp\7177.tmp"102⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"103⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"104⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"105⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\72BF.tmp"C:\Users\Admin\AppData\Local\Temp\72BF.tmp"106⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"107⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"108⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"109⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"110⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"111⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"112⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"113⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"114⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"115⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"116⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"117⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\76F5.tmp"C:\Users\Admin\AppData\Local\Temp\76F5.tmp"118⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\7753.tmp"C:\Users\Admin\AppData\Local\Temp\7753.tmp"119⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\77A1.tmp"C:\Users\Admin\AppData\Local\Temp\77A1.tmp"120⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\77EF.tmp"C:\Users\Admin\AppData\Local\Temp\77EF.tmp"121⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"122⤵PID:1168
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-