Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 21:53
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-30_fa99599cd5dc30569237ad750d6ccf8a_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-05-30_fa99599cd5dc30569237ad750d6ccf8a_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-30_fa99599cd5dc30569237ad750d6ccf8a_mafia.exe
-
Size
520KB
-
MD5
fa99599cd5dc30569237ad750d6ccf8a
-
SHA1
7ca4696058764cb1ffd930a81bbf8bfaaa8d02d9
-
SHA256
1f6277a74e4c5e2efa771b6b1fe7fa24ebb390b20e0dbec97336688e5dfe2c78
-
SHA512
45cf4fd0aef7cb8f193be0674ce50a3a43f24609731a083950e3bf6885cd4ae516ddf2b8088a1a19a0cfe3a71b92aeca316405cac9df4fa3bc833c91dd75921d
-
SSDEEP
12288:roRXOQjmOyNJWNvvv4u0Uz8Js6rI22isXWUuNZ:rogQ9y7WNvvg9Y8JnrI22isXWHN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2412 6C08.tmp 536 6C95.tmp 3920 6D12.tmp 1484 6D9E.tmp 4228 6E3B.tmp 3064 6E98.tmp 1676 6EF6.tmp 4688 6F54.tmp 1988 6FC1.tmp 1280 703E.tmp 4880 708C.tmp 1824 70DA.tmp 2176 7138.tmp 4352 7196.tmp 2356 71E4.tmp 1092 7242.tmp 368 72AF.tmp 1296 732C.tmp 4968 738A.tmp 4960 73D8.tmp 1372 7455.tmp 628 74C2.tmp 2628 754F.tmp 3180 75BC.tmp 4504 7639.tmp 4756 7688.tmp 1940 76D6.tmp 2316 7762.tmp 4064 77C0.tmp 3636 781E.tmp 916 787C.tmp 3148 78E9.tmp 5064 7937.tmp 1444 7985.tmp 3940 79D3.tmp 4120 7A21.tmp 2796 7A70.tmp 4844 7ADD.tmp 764 7B2B.tmp 1816 7B98.tmp 1528 7BF6.tmp 4232 7C54.tmp 4364 7CB2.tmp 3516 7D2F.tmp 3920 7D8C.tmp 3112 7DEA.tmp 3668 7E58.tmp 4604 7EB5.tmp 2252 7F23.tmp 3212 7F71.tmp 464 7FBF.tmp 4016 802C.tmp 3244 809A.tmp 3068 80F7.tmp 5108 8155.tmp 1684 81B3.tmp 2228 8211.tmp 3216 826E.tmp 4136 82CC.tmp 2608 832A.tmp 4980 8388.tmp 3336 83E5.tmp 1184 8453.tmp 2536 84B1.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3444 wrote to memory of 2412 3444 2024-05-30_fa99599cd5dc30569237ad750d6ccf8a_mafia.exe 84 PID 3444 wrote to memory of 2412 3444 2024-05-30_fa99599cd5dc30569237ad750d6ccf8a_mafia.exe 84 PID 3444 wrote to memory of 2412 3444 2024-05-30_fa99599cd5dc30569237ad750d6ccf8a_mafia.exe 84 PID 2412 wrote to memory of 536 2412 6C08.tmp 85 PID 2412 wrote to memory of 536 2412 6C08.tmp 85 PID 2412 wrote to memory of 536 2412 6C08.tmp 85 PID 536 wrote to memory of 3920 536 6C95.tmp 87 PID 536 wrote to memory of 3920 536 6C95.tmp 87 PID 536 wrote to memory of 3920 536 6C95.tmp 87 PID 3920 wrote to memory of 1484 3920 6D12.tmp 89 PID 3920 wrote to memory of 1484 3920 6D12.tmp 89 PID 3920 wrote to memory of 1484 3920 6D12.tmp 89 PID 1484 wrote to memory of 4228 1484 6D9E.tmp 91 PID 1484 wrote to memory of 4228 1484 6D9E.tmp 91 PID 1484 wrote to memory of 4228 1484 6D9E.tmp 91 PID 4228 wrote to memory of 3064 4228 6E3B.tmp 92 PID 4228 wrote to memory of 3064 4228 6E3B.tmp 92 PID 4228 wrote to memory of 3064 4228 6E3B.tmp 92 PID 3064 wrote to memory of 1676 3064 6E98.tmp 93 PID 3064 wrote to memory of 1676 3064 6E98.tmp 93 PID 3064 wrote to memory of 1676 3064 6E98.tmp 93 PID 1676 wrote to memory of 4688 1676 6EF6.tmp 94 PID 1676 wrote to memory of 4688 1676 6EF6.tmp 94 PID 1676 wrote to memory of 4688 1676 6EF6.tmp 94 PID 4688 wrote to memory of 1988 4688 6F54.tmp 95 PID 4688 wrote to memory of 1988 4688 6F54.tmp 95 PID 4688 wrote to memory of 1988 4688 6F54.tmp 95 PID 1988 wrote to memory of 1280 1988 6FC1.tmp 96 PID 1988 wrote to memory of 1280 1988 6FC1.tmp 96 PID 1988 wrote to memory of 1280 1988 6FC1.tmp 96 PID 1280 wrote to memory of 4880 1280 703E.tmp 97 PID 1280 wrote to memory of 4880 1280 703E.tmp 97 PID 1280 wrote to memory of 4880 1280 703E.tmp 97 PID 4880 wrote to memory of 1824 4880 708C.tmp 98 PID 4880 wrote to memory of 1824 4880 708C.tmp 98 PID 4880 wrote to memory of 1824 4880 708C.tmp 98 PID 1824 wrote to memory of 2176 1824 70DA.tmp 99 PID 1824 wrote to memory of 2176 1824 70DA.tmp 99 PID 1824 wrote to memory of 2176 1824 70DA.tmp 99 PID 2176 wrote to memory of 4352 2176 7138.tmp 100 PID 2176 wrote to memory of 4352 2176 7138.tmp 100 PID 2176 wrote to memory of 4352 2176 7138.tmp 100 PID 4352 wrote to memory of 2356 4352 7196.tmp 101 PID 4352 wrote to memory of 2356 4352 7196.tmp 101 PID 4352 wrote to memory of 2356 4352 7196.tmp 101 PID 2356 wrote to memory of 1092 2356 71E4.tmp 102 PID 2356 wrote to memory of 1092 2356 71E4.tmp 102 PID 2356 wrote to memory of 1092 2356 71E4.tmp 102 PID 1092 wrote to memory of 368 1092 7242.tmp 103 PID 1092 wrote to memory of 368 1092 7242.tmp 103 PID 1092 wrote to memory of 368 1092 7242.tmp 103 PID 368 wrote to memory of 1296 368 72AF.tmp 104 PID 368 wrote to memory of 1296 368 72AF.tmp 104 PID 368 wrote to memory of 1296 368 72AF.tmp 104 PID 1296 wrote to memory of 4968 1296 732C.tmp 105 PID 1296 wrote to memory of 4968 1296 732C.tmp 105 PID 1296 wrote to memory of 4968 1296 732C.tmp 105 PID 4968 wrote to memory of 4960 4968 738A.tmp 106 PID 4968 wrote to memory of 4960 4968 738A.tmp 106 PID 4968 wrote to memory of 4960 4968 738A.tmp 106 PID 4960 wrote to memory of 1372 4960 73D8.tmp 107 PID 4960 wrote to memory of 1372 4960 73D8.tmp 107 PID 4960 wrote to memory of 1372 4960 73D8.tmp 107 PID 1372 wrote to memory of 628 1372 7455.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-30_fa99599cd5dc30569237ad750d6ccf8a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-30_fa99599cd5dc30569237ad750d6ccf8a_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\70DA.tmp"C:\Users\Admin\AppData\Local\Temp\70DA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\74C2.tmp"C:\Users\Admin\AppData\Local\Temp\74C2.tmp"23⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\754F.tmp"C:\Users\Admin\AppData\Local\Temp\754F.tmp"24⤵
- Executes dropped EXE
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"25⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"26⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"27⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"28⤵
- Executes dropped EXE
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\7762.tmp"C:\Users\Admin\AppData\Local\Temp\7762.tmp"29⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"30⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"31⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"32⤵
- Executes dropped EXE
PID:916 -
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"33⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\7937.tmp"C:\Users\Admin\AppData\Local\Temp\7937.tmp"34⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"35⤵
- Executes dropped EXE
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\79D3.tmp"C:\Users\Admin\AppData\Local\Temp\79D3.tmp"36⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\7A21.tmp"C:\Users\Admin\AppData\Local\Temp\7A21.tmp"37⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\7A70.tmp"C:\Users\Admin\AppData\Local\Temp\7A70.tmp"38⤵
- Executes dropped EXE
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"39⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"40⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\7B98.tmp"C:\Users\Admin\AppData\Local\Temp\7B98.tmp"41⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"42⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\7C54.tmp"C:\Users\Admin\AppData\Local\Temp\7C54.tmp"43⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"44⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"45⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"46⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"47⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"48⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"49⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\7F23.tmp"C:\Users\Admin\AppData\Local\Temp\7F23.tmp"50⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\7F71.tmp"C:\Users\Admin\AppData\Local\Temp\7F71.tmp"51⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"52⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\802C.tmp"C:\Users\Admin\AppData\Local\Temp\802C.tmp"53⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\809A.tmp"C:\Users\Admin\AppData\Local\Temp\809A.tmp"54⤵
- Executes dropped EXE
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\80F7.tmp"C:\Users\Admin\AppData\Local\Temp\80F7.tmp"55⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\8155.tmp"C:\Users\Admin\AppData\Local\Temp\8155.tmp"56⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\81B3.tmp"C:\Users\Admin\AppData\Local\Temp\81B3.tmp"57⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"58⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"59⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"60⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"61⤵
- Executes dropped EXE
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\8388.tmp"C:\Users\Admin\AppData\Local\Temp\8388.tmp"62⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\83E5.tmp"C:\Users\Admin\AppData\Local\Temp\83E5.tmp"63⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\8453.tmp"C:\Users\Admin\AppData\Local\Temp\8453.tmp"64⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\84B1.tmp"C:\Users\Admin\AppData\Local\Temp\84B1.tmp"65⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\850E.tmp"C:\Users\Admin\AppData\Local\Temp\850E.tmp"66⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\856C.tmp"C:\Users\Admin\AppData\Local\Temp\856C.tmp"67⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\85CA.tmp"C:\Users\Admin\AppData\Local\Temp\85CA.tmp"68⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\8618.tmp"C:\Users\Admin\AppData\Local\Temp\8618.tmp"69⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\8676.tmp"C:\Users\Admin\AppData\Local\Temp\8676.tmp"70⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\86D3.tmp"C:\Users\Admin\AppData\Local\Temp\86D3.tmp"71⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\8731.tmp"C:\Users\Admin\AppData\Local\Temp\8731.tmp"72⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\879F.tmp"C:\Users\Admin\AppData\Local\Temp\879F.tmp"73⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\87FC.tmp"C:\Users\Admin\AppData\Local\Temp\87FC.tmp"74⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\885A.tmp"C:\Users\Admin\AppData\Local\Temp\885A.tmp"75⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\88B8.tmp"C:\Users\Admin\AppData\Local\Temp\88B8.tmp"76⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\8906.tmp"C:\Users\Admin\AppData\Local\Temp\8906.tmp"77⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\8964.tmp"C:\Users\Admin\AppData\Local\Temp\8964.tmp"78⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\89C1.tmp"C:\Users\Admin\AppData\Local\Temp\89C1.tmp"79⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"80⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"81⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"82⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\8B48.tmp"C:\Users\Admin\AppData\Local\Temp\8B48.tmp"83⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"84⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"85⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\8C42.tmp"C:\Users\Admin\AppData\Local\Temp\8C42.tmp"86⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"87⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"88⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"89⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"90⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\8E17.tmp"C:\Users\Admin\AppData\Local\Temp\8E17.tmp"91⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"92⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"93⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"94⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"95⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"96⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\900B.tmp"C:\Users\Admin\AppData\Local\Temp\900B.tmp"97⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"98⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"99⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\9114.tmp"C:\Users\Admin\AppData\Local\Temp\9114.tmp"100⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp"101⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\91D0.tmp"C:\Users\Admin\AppData\Local\Temp\91D0.tmp"102⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\921E.tmp"C:\Users\Admin\AppData\Local\Temp\921E.tmp"103⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\926C.tmp"C:\Users\Admin\AppData\Local\Temp\926C.tmp"104⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"105⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"106⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\9366.tmp"C:\Users\Admin\AppData\Local\Temp\9366.tmp"107⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\93B4.tmp"C:\Users\Admin\AppData\Local\Temp\93B4.tmp"108⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\9402.tmp"C:\Users\Admin\AppData\Local\Temp\9402.tmp"109⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\9451.tmp"C:\Users\Admin\AppData\Local\Temp\9451.tmp"110⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"111⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\94ED.tmp"C:\Users\Admin\AppData\Local\Temp\94ED.tmp"112⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"113⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"114⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\95D7.tmp"C:\Users\Admin\AppData\Local\Temp\95D7.tmp"115⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\9625.tmp"C:\Users\Admin\AppData\Local\Temp\9625.tmp"116⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"117⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\96E1.tmp"C:\Users\Admin\AppData\Local\Temp\96E1.tmp"118⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"119⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"120⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\97FA.tmp"C:\Users\Admin\AppData\Local\Temp\97FA.tmp"121⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\9848.tmp"C:\Users\Admin\AppData\Local\Temp\9848.tmp"122⤵PID:4424
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-