Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
11/04/2024, 11:07
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-11_8de72600f12f0c75e341732e9ac13156_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-11_8de72600f12f0c75e341732e9ac13156_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-04-11_8de72600f12f0c75e341732e9ac13156_mafia.exe
-
Size
488KB
-
MD5
8de72600f12f0c75e341732e9ac13156
-
SHA1
0983227eaca7c8e3baf905c3d556ce3f199636ea
-
SHA256
e81407c55850d6afdced98375e88ac01c8c34820e224704491b5973ced9668d3
-
SHA512
3072a6436718e91ba358df5468a9895b0a1ac5962f0c1a9152e968c827abe9a7e40067459da13a05d0ab27d7b00b73d32031722932295a64c2f55c2e9f4fcfdc
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7khbUqZ5KW4i8hZvUr0KJrfpnwfJDONyA0tuo:/U5rCOTeiDkCCUWIvhuBnAwNGtkwzNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4732 5302.tmp 1276 5360.tmp 3128 53BD.tmp 772 544A.tmp 4488 54B7.tmp 2808 5505.tmp 3688 5554.tmp 4032 55A2.tmp 2828 560F.tmp 4812 566D.tmp 1760 56DA.tmp 1236 5738.tmp 2936 5796.tmp 2708 57F3.tmp 2528 5842.tmp 3896 5890.tmp 3344 5A07.tmp 3312 5A55.tmp 1440 5AA3.tmp 1988 5B10.tmp 5036 5B5E.tmp 1312 5BBC.tmp 2020 5C2A.tmp 2728 5C78.tmp 1084 5CE5.tmp 2440 5D33.tmp 2128 5D81.tmp 1564 5DCF.tmp 3116 5E2D.tmp 3032 5E7B.tmp 3468 5EE9.tmp 4228 5F37.tmp 1004 5F85.tmp 3100 5FE3.tmp 964 6040.tmp 2416 608F.tmp 1876 60DD.tmp 1732 612B.tmp 3900 6179.tmp 3960 61C7.tmp 2912 6225.tmp 4056 6283.tmp 2836 62D1.tmp 1632 632E.tmp 1504 637D.tmp 3176 63CB.tmp 1040 6419.tmp 3620 6467.tmp 5112 64C5.tmp 2652 6513.tmp 1468 6561.tmp 3912 65AF.tmp 1600 65FD.tmp 2444 664B.tmp 4260 66A9.tmp 4368 66F7.tmp 4344 6745.tmp 4336 6793.tmp 5040 67E2.tmp 2712 683F.tmp 4468 689D.tmp 1276 68FB.tmp 1516 6949.tmp 116 6997.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3160 wrote to memory of 4732 3160 2024-04-11_8de72600f12f0c75e341732e9ac13156_mafia.exe 85 PID 3160 wrote to memory of 4732 3160 2024-04-11_8de72600f12f0c75e341732e9ac13156_mafia.exe 85 PID 3160 wrote to memory of 4732 3160 2024-04-11_8de72600f12f0c75e341732e9ac13156_mafia.exe 85 PID 4732 wrote to memory of 1276 4732 5302.tmp 86 PID 4732 wrote to memory of 1276 4732 5302.tmp 86 PID 4732 wrote to memory of 1276 4732 5302.tmp 86 PID 1276 wrote to memory of 3128 1276 5360.tmp 87 PID 1276 wrote to memory of 3128 1276 5360.tmp 87 PID 1276 wrote to memory of 3128 1276 5360.tmp 87 PID 3128 wrote to memory of 772 3128 53BD.tmp 88 PID 3128 wrote to memory of 772 3128 53BD.tmp 88 PID 3128 wrote to memory of 772 3128 53BD.tmp 88 PID 772 wrote to memory of 4488 772 544A.tmp 89 PID 772 wrote to memory of 4488 772 544A.tmp 89 PID 772 wrote to memory of 4488 772 544A.tmp 89 PID 4488 wrote to memory of 2808 4488 54B7.tmp 90 PID 4488 wrote to memory of 2808 4488 54B7.tmp 90 PID 4488 wrote to memory of 2808 4488 54B7.tmp 90 PID 2808 wrote to memory of 3688 2808 5505.tmp 91 PID 2808 wrote to memory of 3688 2808 5505.tmp 91 PID 2808 wrote to memory of 3688 2808 5505.tmp 91 PID 3688 wrote to memory of 4032 3688 5554.tmp 92 PID 3688 wrote to memory of 4032 3688 5554.tmp 92 PID 3688 wrote to memory of 4032 3688 5554.tmp 92 PID 4032 wrote to memory of 2828 4032 55A2.tmp 93 PID 4032 wrote to memory of 2828 4032 55A2.tmp 93 PID 4032 wrote to memory of 2828 4032 55A2.tmp 93 PID 2828 wrote to memory of 4812 2828 560F.tmp 94 PID 2828 wrote to memory of 4812 2828 560F.tmp 94 PID 2828 wrote to memory of 4812 2828 560F.tmp 94 PID 4812 wrote to memory of 1760 4812 566D.tmp 95 PID 4812 wrote to memory of 1760 4812 566D.tmp 95 PID 4812 wrote to memory of 1760 4812 566D.tmp 95 PID 1760 wrote to memory of 1236 1760 56DA.tmp 96 PID 1760 wrote to memory of 1236 1760 56DA.tmp 96 PID 1760 wrote to memory of 1236 1760 56DA.tmp 96 PID 1236 wrote to memory of 2936 1236 5738.tmp 97 PID 1236 wrote to memory of 2936 1236 5738.tmp 97 PID 1236 wrote to memory of 2936 1236 5738.tmp 97 PID 2936 wrote to memory of 2708 2936 5796.tmp 98 PID 2936 wrote to memory of 2708 2936 5796.tmp 98 PID 2936 wrote to memory of 2708 2936 5796.tmp 98 PID 2708 wrote to memory of 2528 2708 57F3.tmp 99 PID 2708 wrote to memory of 2528 2708 57F3.tmp 99 PID 2708 wrote to memory of 2528 2708 57F3.tmp 99 PID 2528 wrote to memory of 3896 2528 5842.tmp 100 PID 2528 wrote to memory of 3896 2528 5842.tmp 100 PID 2528 wrote to memory of 3896 2528 5842.tmp 100 PID 3896 wrote to memory of 3344 3896 5890.tmp 101 PID 3896 wrote to memory of 3344 3896 5890.tmp 101 PID 3896 wrote to memory of 3344 3896 5890.tmp 101 PID 3344 wrote to memory of 3312 3344 5A07.tmp 102 PID 3344 wrote to memory of 3312 3344 5A07.tmp 102 PID 3344 wrote to memory of 3312 3344 5A07.tmp 102 PID 3312 wrote to memory of 1440 3312 5A55.tmp 103 PID 3312 wrote to memory of 1440 3312 5A55.tmp 103 PID 3312 wrote to memory of 1440 3312 5A55.tmp 103 PID 1440 wrote to memory of 1988 1440 5AA3.tmp 104 PID 1440 wrote to memory of 1988 1440 5AA3.tmp 104 PID 1440 wrote to memory of 1988 1440 5AA3.tmp 104 PID 1988 wrote to memory of 5036 1988 5B10.tmp 105 PID 1988 wrote to memory of 5036 1988 5B10.tmp 105 PID 1988 wrote to memory of 5036 1988 5B10.tmp 105 PID 5036 wrote to memory of 1312 5036 5B5E.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-11_8de72600f12f0c75e341732e9ac13156_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-11_8de72600f12f0c75e341732e9ac13156_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"23⤵
- Executes dropped EXE
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"24⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"25⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"26⤵
- Executes dropped EXE
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"27⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"28⤵
- Executes dropped EXE
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"29⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"30⤵
- Executes dropped EXE
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"31⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"32⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"33⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"34⤵
- Executes dropped EXE
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"35⤵
- Executes dropped EXE
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"36⤵
- Executes dropped EXE
PID:964 -
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"37⤵
- Executes dropped EXE
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"38⤵
- Executes dropped EXE
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"39⤵
- Executes dropped EXE
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"40⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"41⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"42⤵
- Executes dropped EXE
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"43⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"44⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"45⤵
- Executes dropped EXE
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"46⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"47⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"48⤵
- Executes dropped EXE
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"49⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"50⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"51⤵
- Executes dropped EXE
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"52⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"53⤵
- Executes dropped EXE
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"54⤵
- Executes dropped EXE
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"55⤵
- Executes dropped EXE
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"56⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"57⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\6745.tmp"C:\Users\Admin\AppData\Local\Temp\6745.tmp"58⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"59⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"60⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"61⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"62⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"63⤵
- Executes dropped EXE
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"64⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"65⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"66⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"67⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"68⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"69⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"70⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"71⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"72⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"73⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"74⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"75⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"76⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"77⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"78⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"79⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"80⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"81⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"82⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"83⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"84⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"85⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"86⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"87⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"88⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"89⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"90⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"91⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"92⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"93⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\72BF.tmp"C:\Users\Admin\AppData\Local\Temp\72BF.tmp"94⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"95⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"96⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"97⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"98⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"99⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"100⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\74F1.tmp"C:\Users\Admin\AppData\Local\Temp\74F1.tmp"101⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"102⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"103⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"104⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"105⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"106⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"107⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"108⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\7791.tmp"C:\Users\Admin\AppData\Local\Temp\7791.tmp"109⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\77EF.tmp"C:\Users\Admin\AppData\Local\Temp\77EF.tmp"110⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\783D.tmp"C:\Users\Admin\AppData\Local\Temp\783D.tmp"111⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\788B.tmp"C:\Users\Admin\AppData\Local\Temp\788B.tmp"112⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\78D9.tmp"C:\Users\Admin\AppData\Local\Temp\78D9.tmp"113⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\7937.tmp"C:\Users\Admin\AppData\Local\Temp\7937.tmp"114⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\7995.tmp"C:\Users\Admin\AppData\Local\Temp\7995.tmp"115⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"116⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"117⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"118⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"119⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"120⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"121⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"122⤵PID:4336
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-