Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/04/2024, 04:03
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-06_969f9031c79848c22479fbe4fefd9fd5_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-04-06_969f9031c79848c22479fbe4fefd9fd5_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-06_969f9031c79848c22479fbe4fefd9fd5_mafia.exe
-
Size
488KB
-
MD5
969f9031c79848c22479fbe4fefd9fd5
-
SHA1
46cb43e8729f7cff222124fc1a25312368d9aa6b
-
SHA256
be257854203242015900e49fa115a811061681196e7f149db0473e92aa8e5528
-
SHA512
5678b86226689d02d22927e1d9e19372636a87da331f8c83f858e6beb0fcf5d324200fe3f73ad40715a81e073dfe62b20ef9af4f8b19b765944b2ef7ef028c51
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7uCYez3hrLCd0v5f55LGmUDAvqpoz9DNtb64F:/U5rCOTeiDuCYe1/nhHLvwoxRteXwNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3220 5266.tmp 956 52F2.tmp 4332 539E.tmp 4076 543A.tmp 4540 54B7.tmp 768 5534.tmp 3232 55C1.tmp 3080 566D.tmp 3248 56EA.tmp 3484 5757.tmp 1344 57C5.tmp 1272 5851.tmp 2700 58CE.tmp 4804 595B.tmp 1264 59D8.tmp 3320 5A26.tmp 2988 5A93.tmp 4188 5B10.tmp 1416 5BAD.tmp 2184 5C1A.tmp 3588 5C78.tmp 1148 5CF5.tmp 3748 5D52.tmp 2232 5DDF.tmp 1136 5E7B.tmp 4368 5F08.tmp 3324 5F66.tmp 4620 5FD3.tmp 3600 6060.tmp 4488 60DD.tmp 3492 6169.tmp 3632 6206.tmp 1920 62A2.tmp 1372 630F.tmp 3132 637D.tmp 3760 63DA.tmp 4268 6438.tmp 3252 64B5.tmp 5100 6513.tmp 4296 6580.tmp 2764 65EE.tmp 5084 665B.tmp 2696 66C8.tmp 2408 6736.tmp 3708 67A3.tmp 4044 6801.tmp 1052 686E.tmp 2068 68CC.tmp 4972 6939.tmp 1452 6997.tmp 428 69F5.tmp 1224 6A62.tmp 4956 6AC0.tmp 3412 6B2D.tmp 4792 6B8B.tmp 4304 6BE9.tmp 3620 6C56.tmp 4544 6CB4.tmp 1008 6D12.tmp 2468 6D6F.tmp 548 6DDD.tmp 1688 6E3B.tmp 4568 6E98.tmp 5076 6F06.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4704 wrote to memory of 3220 4704 2024-04-06_969f9031c79848c22479fbe4fefd9fd5_mafia.exe 86 PID 4704 wrote to memory of 3220 4704 2024-04-06_969f9031c79848c22479fbe4fefd9fd5_mafia.exe 86 PID 4704 wrote to memory of 3220 4704 2024-04-06_969f9031c79848c22479fbe4fefd9fd5_mafia.exe 86 PID 3220 wrote to memory of 956 3220 5266.tmp 88 PID 3220 wrote to memory of 956 3220 5266.tmp 88 PID 3220 wrote to memory of 956 3220 5266.tmp 88 PID 956 wrote to memory of 4332 956 52F2.tmp 90 PID 956 wrote to memory of 4332 956 52F2.tmp 90 PID 956 wrote to memory of 4332 956 52F2.tmp 90 PID 4332 wrote to memory of 4076 4332 539E.tmp 91 PID 4332 wrote to memory of 4076 4332 539E.tmp 91 PID 4332 wrote to memory of 4076 4332 539E.tmp 91 PID 4076 wrote to memory of 4540 4076 543A.tmp 92 PID 4076 wrote to memory of 4540 4076 543A.tmp 92 PID 4076 wrote to memory of 4540 4076 543A.tmp 92 PID 4540 wrote to memory of 768 4540 54B7.tmp 93 PID 4540 wrote to memory of 768 4540 54B7.tmp 93 PID 4540 wrote to memory of 768 4540 54B7.tmp 93 PID 768 wrote to memory of 3232 768 5534.tmp 94 PID 768 wrote to memory of 3232 768 5534.tmp 94 PID 768 wrote to memory of 3232 768 5534.tmp 94 PID 3232 wrote to memory of 3080 3232 55C1.tmp 95 PID 3232 wrote to memory of 3080 3232 55C1.tmp 95 PID 3232 wrote to memory of 3080 3232 55C1.tmp 95 PID 3080 wrote to memory of 3248 3080 566D.tmp 96 PID 3080 wrote to memory of 3248 3080 566D.tmp 96 PID 3080 wrote to memory of 3248 3080 566D.tmp 96 PID 3248 wrote to memory of 3484 3248 56EA.tmp 97 PID 3248 wrote to memory of 3484 3248 56EA.tmp 97 PID 3248 wrote to memory of 3484 3248 56EA.tmp 97 PID 3484 wrote to memory of 1344 3484 5757.tmp 98 PID 3484 wrote to memory of 1344 3484 5757.tmp 98 PID 3484 wrote to memory of 1344 3484 5757.tmp 98 PID 1344 wrote to memory of 1272 1344 57C5.tmp 99 PID 1344 wrote to memory of 1272 1344 57C5.tmp 99 PID 1344 wrote to memory of 1272 1344 57C5.tmp 99 PID 1272 wrote to memory of 2700 1272 5851.tmp 100 PID 1272 wrote to memory of 2700 1272 5851.tmp 100 PID 1272 wrote to memory of 2700 1272 5851.tmp 100 PID 2700 wrote to memory of 4804 2700 58CE.tmp 101 PID 2700 wrote to memory of 4804 2700 58CE.tmp 101 PID 2700 wrote to memory of 4804 2700 58CE.tmp 101 PID 4804 wrote to memory of 1264 4804 595B.tmp 102 PID 4804 wrote to memory of 1264 4804 595B.tmp 102 PID 4804 wrote to memory of 1264 4804 595B.tmp 102 PID 1264 wrote to memory of 3320 1264 59D8.tmp 103 PID 1264 wrote to memory of 3320 1264 59D8.tmp 103 PID 1264 wrote to memory of 3320 1264 59D8.tmp 103 PID 3320 wrote to memory of 2988 3320 5A26.tmp 104 PID 3320 wrote to memory of 2988 3320 5A26.tmp 104 PID 3320 wrote to memory of 2988 3320 5A26.tmp 104 PID 2988 wrote to memory of 4188 2988 5A93.tmp 105 PID 2988 wrote to memory of 4188 2988 5A93.tmp 105 PID 2988 wrote to memory of 4188 2988 5A93.tmp 105 PID 4188 wrote to memory of 1416 4188 5B10.tmp 107 PID 4188 wrote to memory of 1416 4188 5B10.tmp 107 PID 4188 wrote to memory of 1416 4188 5B10.tmp 107 PID 1416 wrote to memory of 2184 1416 5BAD.tmp 109 PID 1416 wrote to memory of 2184 1416 5BAD.tmp 109 PID 1416 wrote to memory of 2184 1416 5BAD.tmp 109 PID 2184 wrote to memory of 3588 2184 5C1A.tmp 110 PID 2184 wrote to memory of 3588 2184 5C1A.tmp 110 PID 2184 wrote to memory of 3588 2184 5C1A.tmp 110 PID 3588 wrote to memory of 1148 3588 5C78.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-06_969f9031c79848c22479fbe4fefd9fd5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-06_969f9031c79848c22479fbe4fefd9fd5_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"23⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"24⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"25⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"26⤵
- Executes dropped EXE
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"27⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"28⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"29⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"30⤵
- Executes dropped EXE
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"31⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"32⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"33⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"34⤵
- Executes dropped EXE
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"35⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"36⤵
- Executes dropped EXE
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"37⤵
- Executes dropped EXE
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"38⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"39⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"40⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"41⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"42⤵
- Executes dropped EXE
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"43⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"44⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"45⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"46⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"47⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"48⤵
- Executes dropped EXE
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"49⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"50⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"51⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"52⤵
- Executes dropped EXE
PID:428 -
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"53⤵
- Executes dropped EXE
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"54⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"55⤵
- Executes dropped EXE
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"56⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"57⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\6C56.tmp"C:\Users\Admin\AppData\Local\Temp\6C56.tmp"58⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"59⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"60⤵
- Executes dropped EXE
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"61⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"62⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"63⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"64⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"65⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\6F63.tmp"C:\Users\Admin\AppData\Local\Temp\6F63.tmp"66⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"67⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"68⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"69⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"70⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\7157.tmp"C:\Users\Admin\AppData\Local\Temp\7157.tmp"71⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"72⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"73⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"74⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\72BF.tmp"C:\Users\Admin\AppData\Local\Temp\72BF.tmp"75⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"76⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"77⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"78⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"79⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"80⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"81⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"82⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"83⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"84⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"85⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\7705.tmp"C:\Users\Admin\AppData\Local\Temp\7705.tmp"86⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\7753.tmp"C:\Users\Admin\AppData\Local\Temp\7753.tmp"87⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"88⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"89⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\786C.tmp"C:\Users\Admin\AppData\Local\Temp\786C.tmp"90⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\78BA.tmp"C:\Users\Admin\AppData\Local\Temp\78BA.tmp"91⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\7908.tmp"C:\Users\Admin\AppData\Local\Temp\7908.tmp"92⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\7976.tmp"C:\Users\Admin\AppData\Local\Temp\7976.tmp"93⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"94⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"95⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"96⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"97⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"98⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\7B89.tmp"C:\Users\Admin\AppData\Local\Temp\7B89.tmp"99⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"100⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\7C44.tmp"C:\Users\Admin\AppData\Local\Temp\7C44.tmp"101⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"102⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\7D00.tmp"C:\Users\Admin\AppData\Local\Temp\7D00.tmp"103⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"104⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"105⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"106⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\7E77.tmp"C:\Users\Admin\AppData\Local\Temp\7E77.tmp"107⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"108⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\7F13.tmp"C:\Users\Admin\AppData\Local\Temp\7F13.tmp"109⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\7F71.tmp"C:\Users\Admin\AppData\Local\Temp\7F71.tmp"110⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"111⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\801D.tmp"C:\Users\Admin\AppData\Local\Temp\801D.tmp"112⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\807A.tmp"C:\Users\Admin\AppData\Local\Temp\807A.tmp"113⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\80D8.tmp"C:\Users\Admin\AppData\Local\Temp\80D8.tmp"114⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\8136.tmp"C:\Users\Admin\AppData\Local\Temp\8136.tmp"115⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\8184.tmp"C:\Users\Admin\AppData\Local\Temp\8184.tmp"116⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\81D2.tmp"C:\Users\Admin\AppData\Local\Temp\81D2.tmp"117⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\8220.tmp"C:\Users\Admin\AppData\Local\Temp\8220.tmp"118⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"119⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\82BD.tmp"C:\Users\Admin\AppData\Local\Temp\82BD.tmp"120⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"121⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\8368.tmp"C:\Users\Admin\AppData\Local\Temp\8368.tmp"122⤵PID:2120
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-