Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 18:38
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-08_e61c4c8b8873f6e422341f1c6ac77684_mafia.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2024-05-08_e61c4c8b8873f6e422341f1c6ac77684_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-08_e61c4c8b8873f6e422341f1c6ac77684_mafia.exe
-
Size
486KB
-
MD5
e61c4c8b8873f6e422341f1c6ac77684
-
SHA1
e6a8d9824ec0c989a71427741caec5e58e08cdf1
-
SHA256
3a2aff17a7a1b65d12ac0fd5dd46c32415e87b8b4848c4a7a0ad6776e6db0769
-
SHA512
e18f4518b5deb7d8119e965df1a67891e5d3556427a50d0dc1e8dd765f755f9cfc1780b40d3e5df6c816d1e2a52a273a8cc5bd7219af5a000f172334c2862af9
-
SSDEEP
12288:/U5rCOTeiDtuM2tL/pvHYrs2ljLDU1Bp:/UQOJDtuDtLRvT2JDUx
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 8 6939.tmp 2984 6997.tmp 3772 69E5.tmp 940 6A43.tmp 392 6AA1.tmp 3572 6AFE.tmp 5080 6B4D.tmp 1672 6BAA.tmp 3052 6BF8.tmp 4656 6D50.tmp 3720 6DBE.tmp 4140 6E1B.tmp 2360 6E79.tmp 2964 6ED7.tmp 4780 6F35.tmp 1916 6F92.tmp 2548 7000.tmp 1836 705D.tmp 2080 70BB.tmp 1912 7129.tmp 2852 71A6.tmp 3696 7203.tmp 1860 7261.tmp 3716 72CE.tmp 2148 733C.tmp 1904 737A.tmp 4348 73C8.tmp 2956 7445.tmp 3744 74B3.tmp 3800 7501.tmp 2788 756E.tmp 364 75DC.tmp 1688 762A.tmp 4636 7688.tmp 4788 76E5.tmp 3796 7733.tmp 4796 7782.tmp 4452 77D0.tmp 4292 781E.tmp 392 787C.tmp 4416 78CA.tmp 932 7918.tmp 4964 7966.tmp 4716 79C4.tmp 4748 7A12.tmp 460 7A70.tmp 3052 7ACD.tmp 1992 7B2B.tmp 1120 7B79.tmp 4732 7BC7.tmp 3460 7C25.tmp 3208 7C83.tmp 3616 7CE1.tmp 232 7D2F.tmp 216 7D8C.tmp 3912 7DDB.tmp 1312 7E38.tmp 2548 7E86.tmp 2516 7EE4.tmp 4388 7F42.tmp 4592 7F90.tmp 3176 7FEE.tmp 3328 803C.tmp 1532 809A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3892 wrote to memory of 8 3892 2024-05-08_e61c4c8b8873f6e422341f1c6ac77684_mafia.exe 85 PID 3892 wrote to memory of 8 3892 2024-05-08_e61c4c8b8873f6e422341f1c6ac77684_mafia.exe 85 PID 3892 wrote to memory of 8 3892 2024-05-08_e61c4c8b8873f6e422341f1c6ac77684_mafia.exe 85 PID 8 wrote to memory of 2984 8 6939.tmp 86 PID 8 wrote to memory of 2984 8 6939.tmp 86 PID 8 wrote to memory of 2984 8 6939.tmp 86 PID 2984 wrote to memory of 3772 2984 6997.tmp 87 PID 2984 wrote to memory of 3772 2984 6997.tmp 87 PID 2984 wrote to memory of 3772 2984 6997.tmp 87 PID 3772 wrote to memory of 940 3772 69E5.tmp 89 PID 3772 wrote to memory of 940 3772 69E5.tmp 89 PID 3772 wrote to memory of 940 3772 69E5.tmp 89 PID 940 wrote to memory of 392 940 6A43.tmp 90 PID 940 wrote to memory of 392 940 6A43.tmp 90 PID 940 wrote to memory of 392 940 6A43.tmp 90 PID 392 wrote to memory of 3572 392 6AA1.tmp 92 PID 392 wrote to memory of 3572 392 6AA1.tmp 92 PID 392 wrote to memory of 3572 392 6AA1.tmp 92 PID 3572 wrote to memory of 5080 3572 6AFE.tmp 94 PID 3572 wrote to memory of 5080 3572 6AFE.tmp 94 PID 3572 wrote to memory of 5080 3572 6AFE.tmp 94 PID 5080 wrote to memory of 1672 5080 6B4D.tmp 95 PID 5080 wrote to memory of 1672 5080 6B4D.tmp 95 PID 5080 wrote to memory of 1672 5080 6B4D.tmp 95 PID 1672 wrote to memory of 3052 1672 6BAA.tmp 96 PID 1672 wrote to memory of 3052 1672 6BAA.tmp 96 PID 1672 wrote to memory of 3052 1672 6BAA.tmp 96 PID 3052 wrote to memory of 4656 3052 6BF8.tmp 97 PID 3052 wrote to memory of 4656 3052 6BF8.tmp 97 PID 3052 wrote to memory of 4656 3052 6BF8.tmp 97 PID 4656 wrote to memory of 3720 4656 6D50.tmp 98 PID 4656 wrote to memory of 3720 4656 6D50.tmp 98 PID 4656 wrote to memory of 3720 4656 6D50.tmp 98 PID 3720 wrote to memory of 4140 3720 6DBE.tmp 99 PID 3720 wrote to memory of 4140 3720 6DBE.tmp 99 PID 3720 wrote to memory of 4140 3720 6DBE.tmp 99 PID 4140 wrote to memory of 2360 4140 6E1B.tmp 100 PID 4140 wrote to memory of 2360 4140 6E1B.tmp 100 PID 4140 wrote to memory of 2360 4140 6E1B.tmp 100 PID 2360 wrote to memory of 2964 2360 6E79.tmp 101 PID 2360 wrote to memory of 2964 2360 6E79.tmp 101 PID 2360 wrote to memory of 2964 2360 6E79.tmp 101 PID 2964 wrote to memory of 4780 2964 6ED7.tmp 102 PID 2964 wrote to memory of 4780 2964 6ED7.tmp 102 PID 2964 wrote to memory of 4780 2964 6ED7.tmp 102 PID 4780 wrote to memory of 1916 4780 6F35.tmp 103 PID 4780 wrote to memory of 1916 4780 6F35.tmp 103 PID 4780 wrote to memory of 1916 4780 6F35.tmp 103 PID 1916 wrote to memory of 2548 1916 6F92.tmp 104 PID 1916 wrote to memory of 2548 1916 6F92.tmp 104 PID 1916 wrote to memory of 2548 1916 6F92.tmp 104 PID 2548 wrote to memory of 1836 2548 7000.tmp 105 PID 2548 wrote to memory of 1836 2548 7000.tmp 105 PID 2548 wrote to memory of 1836 2548 7000.tmp 105 PID 1836 wrote to memory of 2080 1836 705D.tmp 106 PID 1836 wrote to memory of 2080 1836 705D.tmp 106 PID 1836 wrote to memory of 2080 1836 705D.tmp 106 PID 2080 wrote to memory of 1912 2080 70BB.tmp 107 PID 2080 wrote to memory of 1912 2080 70BB.tmp 107 PID 2080 wrote to memory of 1912 2080 70BB.tmp 107 PID 1912 wrote to memory of 2852 1912 7129.tmp 108 PID 1912 wrote to memory of 2852 1912 7129.tmp 108 PID 1912 wrote to memory of 2852 1912 7129.tmp 108 PID 2852 wrote to memory of 3696 2852 71A6.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_e61c4c8b8873f6e422341f1c6ac77684_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-08_e61c4c8b8873f6e422341f1c6ac77684_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"23⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"24⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"25⤵
- Executes dropped EXE
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"26⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"27⤵
- Executes dropped EXE
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"28⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\7445.tmp"C:\Users\Admin\AppData\Local\Temp\7445.tmp"29⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"30⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"31⤵
- Executes dropped EXE
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"32⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"33⤵
- Executes dropped EXE
PID:364 -
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"34⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"35⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"36⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"37⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"38⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"39⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"40⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"41⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"42⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\7918.tmp"C:\Users\Admin\AppData\Local\Temp\7918.tmp"43⤵
- Executes dropped EXE
PID:932 -
C:\Users\Admin\AppData\Local\Temp\7966.tmp"C:\Users\Admin\AppData\Local\Temp\7966.tmp"44⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\79C4.tmp"C:\Users\Admin\AppData\Local\Temp\79C4.tmp"45⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\7A12.tmp"C:\Users\Admin\AppData\Local\Temp\7A12.tmp"46⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\7A70.tmp"C:\Users\Admin\AppData\Local\Temp\7A70.tmp"47⤵
- Executes dropped EXE
PID:460 -
C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"48⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"49⤵
- Executes dropped EXE
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\7B79.tmp"C:\Users\Admin\AppData\Local\Temp\7B79.tmp"50⤵
- Executes dropped EXE
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"51⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"52⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\7C83.tmp"C:\Users\Admin\AppData\Local\Temp\7C83.tmp"53⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"54⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"55⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"56⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"57⤵
- Executes dropped EXE
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\7E38.tmp"C:\Users\Admin\AppData\Local\Temp\7E38.tmp"58⤵
- Executes dropped EXE
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"59⤵
- Executes dropped EXE
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"60⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\7F42.tmp"C:\Users\Admin\AppData\Local\Temp\7F42.tmp"61⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\7F90.tmp"C:\Users\Admin\AppData\Local\Temp\7F90.tmp"62⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"63⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\803C.tmp"C:\Users\Admin\AppData\Local\Temp\803C.tmp"64⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\809A.tmp"C:\Users\Admin\AppData\Local\Temp\809A.tmp"65⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\80F7.tmp"C:\Users\Admin\AppData\Local\Temp\80F7.tmp"66⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\8146.tmp"C:\Users\Admin\AppData\Local\Temp\8146.tmp"67⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\81B3.tmp"C:\Users\Admin\AppData\Local\Temp\81B3.tmp"68⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"69⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"70⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"71⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"72⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\8388.tmp"C:\Users\Admin\AppData\Local\Temp\8388.tmp"73⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\83E5.tmp"C:\Users\Admin\AppData\Local\Temp\83E5.tmp"74⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\8434.tmp"C:\Users\Admin\AppData\Local\Temp\8434.tmp"75⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\8491.tmp"C:\Users\Admin\AppData\Local\Temp\8491.tmp"76⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\84EF.tmp"C:\Users\Admin\AppData\Local\Temp\84EF.tmp"77⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\854D.tmp"C:\Users\Admin\AppData\Local\Temp\854D.tmp"78⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\859B.tmp"C:\Users\Admin\AppData\Local\Temp\859B.tmp"79⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"80⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\8637.tmp"C:\Users\Admin\AppData\Local\Temp\8637.tmp"81⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\8685.tmp"C:\Users\Admin\AppData\Local\Temp\8685.tmp"82⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\86E3.tmp"C:\Users\Admin\AppData\Local\Temp\86E3.tmp"83⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\8731.tmp"C:\Users\Admin\AppData\Local\Temp\8731.tmp"84⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\878F.tmp"C:\Users\Admin\AppData\Local\Temp\878F.tmp"85⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\87DD.tmp"C:\Users\Admin\AppData\Local\Temp\87DD.tmp"86⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\883B.tmp"C:\Users\Admin\AppData\Local\Temp\883B.tmp"87⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\8899.tmp"C:\Users\Admin\AppData\Local\Temp\8899.tmp"88⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\88E7.tmp"C:\Users\Admin\AppData\Local\Temp\88E7.tmp"89⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"90⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\8993.tmp"C:\Users\Admin\AppData\Local\Temp\8993.tmp"91⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\89E1.tmp"C:\Users\Admin\AppData\Local\Temp\89E1.tmp"92⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"93⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"94⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"95⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\8B38.tmp"C:\Users\Admin\AppData\Local\Temp\8B38.tmp"96⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\8B87.tmp"C:\Users\Admin\AppData\Local\Temp\8B87.tmp"97⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"98⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\8C42.tmp"C:\Users\Admin\AppData\Local\Temp\8C42.tmp"99⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"100⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"101⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"102⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"103⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"104⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\8E17.tmp"C:\Users\Admin\AppData\Local\Temp\8E17.tmp"105⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"106⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"107⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\8F01.tmp"C:\Users\Admin\AppData\Local\Temp\8F01.tmp"108⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"109⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"110⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"111⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\9049.tmp"C:\Users\Admin\AppData\Local\Temp\9049.tmp"112⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\9097.tmp"C:\Users\Admin\AppData\Local\Temp\9097.tmp"113⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"114⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\9143.tmp"C:\Users\Admin\AppData\Local\Temp\9143.tmp"115⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"116⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"117⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"118⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\92AB.tmp"C:\Users\Admin\AppData\Local\Temp\92AB.tmp"119⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\92F9.tmp"C:\Users\Admin\AppData\Local\Temp\92F9.tmp"120⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"121⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\93A5.tmp"C:\Users\Admin\AppData\Local\Temp\93A5.tmp"122⤵PID:3800
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-