Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 04:35
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-16_63a9ee546a6706077ad4ae63653070b8_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-16_63a9ee546a6706077ad4ae63653070b8_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-16_63a9ee546a6706077ad4ae63653070b8_mafia.exe
-
Size
541KB
-
MD5
63a9ee546a6706077ad4ae63653070b8
-
SHA1
6799edb4bcbefa8c06da0c4ca86af51db3c22285
-
SHA256
4ea7a125c62246751ea7a9b8630c0eca71e2e54edf223564cc0f2cc1c03dc360
-
SHA512
2ba37c042aa478c998ad81dcd35ef4d097555a8ebc70270dda3c12b179edc8b8e79b0b581caa0ef6654c86f8fd80abbb4044e549524673446da069a48ee1f903
-
SSDEEP
12288:UU5rCOTeifb0QDjoMEmr7Cvf5yopTkZrZa73ctO:UUQOJfb0QfoMEm32jkZrU73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1052 6F15.tmp 3840 6F73.tmp 3540 6FF0.tmp 2360 708C.tmp 4544 70FA.tmp 1076 7167.tmp 1588 71C5.tmp 3248 7242.tmp 3340 72AF.tmp 1836 732C.tmp 2384 737A.tmp 2876 73E8.tmp 2764 7436.tmp 3304 74A3.tmp 4560 7501.tmp 3460 755F.tmp 3284 75BC.tmp 4836 762A.tmp 1780 7688.tmp 780 7705.tmp 856 7772.tmp 768 77DF.tmp 628 784D.tmp 4068 78AA.tmp 980 7927.tmp 764 7985.tmp 1680 79E3.tmp 1200 7A60.tmp 4676 7AAE.tmp 3620 7B0C.tmp 1128 7B79.tmp 4048 7C06.tmp 4952 7C54.tmp 3264 7CA2.tmp 4368 7CF0.tmp 3576 7D3E.tmp 2856 7D8C.tmp 2068 7DDB.tmp 4768 7E29.tmp 4380 7E77.tmp 4760 7EC5.tmp 4616 7F23.tmp 5008 7F80.tmp 840 7FCF.tmp 364 801D.tmp 1324 806B.tmp 4412 80B9.tmp 2720 8117.tmp 544 8165.tmp 3076 81B3.tmp 1784 8201.tmp 5020 824F.tmp 4488 82AD.tmp 4908 830B.tmp 1696 8359.tmp 1136 83B7.tmp 4116 8405.tmp 4340 8462.tmp 2612 84C0.tmp 4600 850E.tmp 5104 856C.tmp 2876 85BA.tmp 3164 8608.tmp 4972 8666.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1652 wrote to memory of 1052 1652 2024-05-16_63a9ee546a6706077ad4ae63653070b8_mafia.exe 82 PID 1652 wrote to memory of 1052 1652 2024-05-16_63a9ee546a6706077ad4ae63653070b8_mafia.exe 82 PID 1652 wrote to memory of 1052 1652 2024-05-16_63a9ee546a6706077ad4ae63653070b8_mafia.exe 82 PID 1052 wrote to memory of 3840 1052 6F15.tmp 84 PID 1052 wrote to memory of 3840 1052 6F15.tmp 84 PID 1052 wrote to memory of 3840 1052 6F15.tmp 84 PID 3840 wrote to memory of 3540 3840 6F73.tmp 86 PID 3840 wrote to memory of 3540 3840 6F73.tmp 86 PID 3840 wrote to memory of 3540 3840 6F73.tmp 86 PID 3540 wrote to memory of 2360 3540 6FF0.tmp 87 PID 3540 wrote to memory of 2360 3540 6FF0.tmp 87 PID 3540 wrote to memory of 2360 3540 6FF0.tmp 87 PID 2360 wrote to memory of 4544 2360 708C.tmp 89 PID 2360 wrote to memory of 4544 2360 708C.tmp 89 PID 2360 wrote to memory of 4544 2360 708C.tmp 89 PID 4544 wrote to memory of 1076 4544 70FA.tmp 90 PID 4544 wrote to memory of 1076 4544 70FA.tmp 90 PID 4544 wrote to memory of 1076 4544 70FA.tmp 90 PID 1076 wrote to memory of 1588 1076 7167.tmp 91 PID 1076 wrote to memory of 1588 1076 7167.tmp 91 PID 1076 wrote to memory of 1588 1076 7167.tmp 91 PID 1588 wrote to memory of 3248 1588 71C5.tmp 92 PID 1588 wrote to memory of 3248 1588 71C5.tmp 92 PID 1588 wrote to memory of 3248 1588 71C5.tmp 92 PID 3248 wrote to memory of 3340 3248 7242.tmp 93 PID 3248 wrote to memory of 3340 3248 7242.tmp 93 PID 3248 wrote to memory of 3340 3248 7242.tmp 93 PID 3340 wrote to memory of 1836 3340 72AF.tmp 94 PID 3340 wrote to memory of 1836 3340 72AF.tmp 94 PID 3340 wrote to memory of 1836 3340 72AF.tmp 94 PID 1836 wrote to memory of 2384 1836 732C.tmp 95 PID 1836 wrote to memory of 2384 1836 732C.tmp 95 PID 1836 wrote to memory of 2384 1836 732C.tmp 95 PID 2384 wrote to memory of 2876 2384 737A.tmp 96 PID 2384 wrote to memory of 2876 2384 737A.tmp 96 PID 2384 wrote to memory of 2876 2384 737A.tmp 96 PID 2876 wrote to memory of 2764 2876 73E8.tmp 97 PID 2876 wrote to memory of 2764 2876 73E8.tmp 97 PID 2876 wrote to memory of 2764 2876 73E8.tmp 97 PID 2764 wrote to memory of 3304 2764 7436.tmp 98 PID 2764 wrote to memory of 3304 2764 7436.tmp 98 PID 2764 wrote to memory of 3304 2764 7436.tmp 98 PID 3304 wrote to memory of 4560 3304 74A3.tmp 99 PID 3304 wrote to memory of 4560 3304 74A3.tmp 99 PID 3304 wrote to memory of 4560 3304 74A3.tmp 99 PID 4560 wrote to memory of 3460 4560 7501.tmp 100 PID 4560 wrote to memory of 3460 4560 7501.tmp 100 PID 4560 wrote to memory of 3460 4560 7501.tmp 100 PID 3460 wrote to memory of 3284 3460 755F.tmp 101 PID 3460 wrote to memory of 3284 3460 755F.tmp 101 PID 3460 wrote to memory of 3284 3460 755F.tmp 101 PID 3284 wrote to memory of 4836 3284 75BC.tmp 102 PID 3284 wrote to memory of 4836 3284 75BC.tmp 102 PID 3284 wrote to memory of 4836 3284 75BC.tmp 102 PID 4836 wrote to memory of 1780 4836 762A.tmp 103 PID 4836 wrote to memory of 1780 4836 762A.tmp 103 PID 4836 wrote to memory of 1780 4836 762A.tmp 103 PID 1780 wrote to memory of 780 1780 7688.tmp 104 PID 1780 wrote to memory of 780 1780 7688.tmp 104 PID 1780 wrote to memory of 780 1780 7688.tmp 104 PID 780 wrote to memory of 856 780 7705.tmp 105 PID 780 wrote to memory of 856 780 7705.tmp 105 PID 780 wrote to memory of 856 780 7705.tmp 105 PID 856 wrote to memory of 768 856 7772.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_63a9ee546a6706077ad4ae63653070b8_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-16_63a9ee546a6706077ad4ae63653070b8_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\73E8.tmp"C:\Users\Admin\AppData\Local\Temp\73E8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\7705.tmp"C:\Users\Admin\AppData\Local\Temp\7705.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Users\Admin\AppData\Local\Temp\7772.tmp"C:\Users\Admin\AppData\Local\Temp\7772.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\77DF.tmp"C:\Users\Admin\AppData\Local\Temp\77DF.tmp"23⤵
- Executes dropped EXE
PID:768 -
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"24⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"25⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\7927.tmp"C:\Users\Admin\AppData\Local\Temp\7927.tmp"26⤵
- Executes dropped EXE
PID:980 -
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"27⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"28⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\7A60.tmp"C:\Users\Admin\AppData\Local\Temp\7A60.tmp"29⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"30⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"31⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\7B79.tmp"C:\Users\Admin\AppData\Local\Temp\7B79.tmp"32⤵
- Executes dropped EXE
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\7C06.tmp"C:\Users\Admin\AppData\Local\Temp\7C06.tmp"33⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\7C54.tmp"C:\Users\Admin\AppData\Local\Temp\7C54.tmp"34⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"35⤵
- Executes dropped EXE
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"36⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"37⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"38⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"39⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\7E29.tmp"C:\Users\Admin\AppData\Local\Temp\7E29.tmp"40⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\7E77.tmp"C:\Users\Admin\AppData\Local\Temp\7E77.tmp"41⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"42⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\7F23.tmp"C:\Users\Admin\AppData\Local\Temp\7F23.tmp"43⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\7F80.tmp"C:\Users\Admin\AppData\Local\Temp\7F80.tmp"44⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"45⤵
- Executes dropped EXE
PID:840 -
C:\Users\Admin\AppData\Local\Temp\801D.tmp"C:\Users\Admin\AppData\Local\Temp\801D.tmp"46⤵
- Executes dropped EXE
PID:364 -
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"47⤵
- Executes dropped EXE
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\80B9.tmp"C:\Users\Admin\AppData\Local\Temp\80B9.tmp"48⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\8117.tmp"C:\Users\Admin\AppData\Local\Temp\8117.tmp"49⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\8165.tmp"C:\Users\Admin\AppData\Local\Temp\8165.tmp"50⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\81B3.tmp"C:\Users\Admin\AppData\Local\Temp\81B3.tmp"51⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\8201.tmp"C:\Users\Admin\AppData\Local\Temp\8201.tmp"52⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\824F.tmp"C:\Users\Admin\AppData\Local\Temp\824F.tmp"53⤵
- Executes dropped EXE
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\82AD.tmp"C:\Users\Admin\AppData\Local\Temp\82AD.tmp"54⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\830B.tmp"C:\Users\Admin\AppData\Local\Temp\830B.tmp"55⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\8359.tmp"C:\Users\Admin\AppData\Local\Temp\8359.tmp"56⤵
- Executes dropped EXE
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\83B7.tmp"C:\Users\Admin\AppData\Local\Temp\83B7.tmp"57⤵
- Executes dropped EXE
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\8405.tmp"C:\Users\Admin\AppData\Local\Temp\8405.tmp"58⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\8462.tmp"C:\Users\Admin\AppData\Local\Temp\8462.tmp"59⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\84C0.tmp"C:\Users\Admin\AppData\Local\Temp\84C0.tmp"60⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\850E.tmp"C:\Users\Admin\AppData\Local\Temp\850E.tmp"61⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\856C.tmp"C:\Users\Admin\AppData\Local\Temp\856C.tmp"62⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\85BA.tmp"C:\Users\Admin\AppData\Local\Temp\85BA.tmp"63⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\8608.tmp"C:\Users\Admin\AppData\Local\Temp\8608.tmp"64⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\8666.tmp"C:\Users\Admin\AppData\Local\Temp\8666.tmp"65⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\86C4.tmp"C:\Users\Admin\AppData\Local\Temp\86C4.tmp"66⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\8722.tmp"C:\Users\Admin\AppData\Local\Temp\8722.tmp"67⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\877F.tmp"C:\Users\Admin\AppData\Local\Temp\877F.tmp"68⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\87DD.tmp"C:\Users\Admin\AppData\Local\Temp\87DD.tmp"69⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\883B.tmp"C:\Users\Admin\AppData\Local\Temp\883B.tmp"70⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\8899.tmp"C:\Users\Admin\AppData\Local\Temp\8899.tmp"71⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\88E7.tmp"C:\Users\Admin\AppData\Local\Temp\88E7.tmp"72⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\8935.tmp"C:\Users\Admin\AppData\Local\Temp\8935.tmp"73⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\8993.tmp"C:\Users\Admin\AppData\Local\Temp\8993.tmp"74⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\89E1.tmp"C:\Users\Admin\AppData\Local\Temp\89E1.tmp"75⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"76⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"77⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"78⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\8B29.tmp"C:\Users\Admin\AppData\Local\Temp\8B29.tmp"79⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\8B87.tmp"C:\Users\Admin\AppData\Local\Temp\8B87.tmp"80⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"81⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\8C42.tmp"C:\Users\Admin\AppData\Local\Temp\8C42.tmp"82⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"83⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"84⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"85⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"86⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\8E17.tmp"C:\Users\Admin\AppData\Local\Temp\8E17.tmp"87⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\8E75.tmp"C:\Users\Admin\AppData\Local\Temp\8E75.tmp"88⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"89⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\8F30.tmp"C:\Users\Admin\AppData\Local\Temp\8F30.tmp"90⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"91⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"92⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\903A.tmp"C:\Users\Admin\AppData\Local\Temp\903A.tmp"93⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"94⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\90E6.tmp"C:\Users\Admin\AppData\Local\Temp\90E6.tmp"95⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\9143.tmp"C:\Users\Admin\AppData\Local\Temp\9143.tmp"96⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"97⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"98⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"99⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\92AB.tmp"C:\Users\Admin\AppData\Local\Temp\92AB.tmp"100⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\9308.tmp"C:\Users\Admin\AppData\Local\Temp\9308.tmp"101⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"102⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\93B4.tmp"C:\Users\Admin\AppData\Local\Temp\93B4.tmp"103⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\9402.tmp"C:\Users\Admin\AppData\Local\Temp\9402.tmp"104⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\9451.tmp"C:\Users\Admin\AppData\Local\Temp\9451.tmp"105⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\94AE.tmp"C:\Users\Admin\AppData\Local\Temp\94AE.tmp"106⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\950C.tmp"C:\Users\Admin\AppData\Local\Temp\950C.tmp"107⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\956A.tmp"C:\Users\Admin\AppData\Local\Temp\956A.tmp"108⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\95C8.tmp"C:\Users\Admin\AppData\Local\Temp\95C8.tmp"109⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\9625.tmp"C:\Users\Admin\AppData\Local\Temp\9625.tmp"110⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"111⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\96D1.tmp"C:\Users\Admin\AppData\Local\Temp\96D1.tmp"112⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"113⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\976D.tmp"C:\Users\Admin\AppData\Local\Temp\976D.tmp"114⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\97BC.tmp"C:\Users\Admin\AppData\Local\Temp\97BC.tmp"115⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"116⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\9867.tmp"C:\Users\Admin\AppData\Local\Temp\9867.tmp"117⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\98B6.tmp"C:\Users\Admin\AppData\Local\Temp\98B6.tmp"118⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\9904.tmp"C:\Users\Admin\AppData\Local\Temp\9904.tmp"119⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\9952.tmp"C:\Users\Admin\AppData\Local\Temp\9952.tmp"120⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\99A0.tmp"C:\Users\Admin\AppData\Local\Temp\99A0.tmp"121⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"122⤵PID:4948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-