Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/05/2024, 00:54
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-25_f612b9b7e02478a30a7409336d41e5f5_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-25_f612b9b7e02478a30a7409336d41e5f5_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-25_f612b9b7e02478a30a7409336d41e5f5_mafia.exe
-
Size
536KB
-
MD5
f612b9b7e02478a30a7409336d41e5f5
-
SHA1
dfd337c6abb3b6eb0e186f3502bbd9ffa046df9b
-
SHA256
faf410a4c6f9f81ca7ae86c7ed6ca1936d29508e03738a3221cd1f33da5a5ebf
-
SHA512
3a831c700470747f96787a22d5c3d9bfed6a1220af404def087368dc9107245811a88cbff42b47139dadd5f2aaf44fc30f1d113d26a6d75b1bae1b17a515db41
-
SSDEEP
12288:wU5rCOTeiUg7avJGwG9QWmpHGA+WapHgU5ZIZxVJ0ZT9:wUQOJUqMGl9QWmpHfQZIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4148 4517.tmp 956 4602.tmp 2448 46AE.tmp 4324 4759.tmp 3292 4825.tmp 3720 48F0.tmp 1540 49CA.tmp 1484 4A67.tmp 4964 4B13.tmp 2012 4BBE.tmp 852 4C5B.tmp 4476 4CF7.tmp 2844 4DA3.tmp 940 4E4F.tmp 1104 4EAC.tmp 948 4F49.tmp 1464 4FD5.tmp 4548 5091.tmp 4600 512D.tmp 3996 5208.tmp 2488 52B4.tmp 4464 5360.tmp 1196 53DD.tmp 3284 5469.tmp 944 5525.tmp 1248 55C1.tmp 4104 568C.tmp 4244 5748.tmp 4424 57F3.tmp 1440 5890.tmp 5088 594B.tmp 3056 59E7.tmp 4084 5A93.tmp 3720 5B10.tmp 4044 5B7E.tmp 3716 5BDB.tmp 1964 5C2A.tmp 1592 5C87.tmp 2760 5D04.tmp 1872 5D72.tmp 4616 5DFE.tmp 2932 5E6C.tmp 716 5EF8.tmp 3688 5F46.tmp 388 5FC3.tmp 4632 6021.tmp 2280 607F.tmp 740 610C.tmp 4888 6198.tmp 1652 61E6.tmp 2368 6244.tmp 4552 6292.tmp 4524 62E0.tmp 4412 632E.tmp 4020 638C.tmp 4744 63EA.tmp 2836 6448.tmp 2784 6496.tmp 3036 64F4.tmp 4104 6542.tmp 4500 6590.tmp 5080 65EE.tmp 2176 663C.tmp 3288 668A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4764 wrote to memory of 4148 4764 2024-05-25_f612b9b7e02478a30a7409336d41e5f5_mafia.exe 83 PID 4764 wrote to memory of 4148 4764 2024-05-25_f612b9b7e02478a30a7409336d41e5f5_mafia.exe 83 PID 4764 wrote to memory of 4148 4764 2024-05-25_f612b9b7e02478a30a7409336d41e5f5_mafia.exe 83 PID 4148 wrote to memory of 956 4148 4517.tmp 84 PID 4148 wrote to memory of 956 4148 4517.tmp 84 PID 4148 wrote to memory of 956 4148 4517.tmp 84 PID 956 wrote to memory of 2448 956 4602.tmp 85 PID 956 wrote to memory of 2448 956 4602.tmp 85 PID 956 wrote to memory of 2448 956 4602.tmp 85 PID 2448 wrote to memory of 4324 2448 46AE.tmp 87 PID 2448 wrote to memory of 4324 2448 46AE.tmp 87 PID 2448 wrote to memory of 4324 2448 46AE.tmp 87 PID 4324 wrote to memory of 3292 4324 4759.tmp 89 PID 4324 wrote to memory of 3292 4324 4759.tmp 89 PID 4324 wrote to memory of 3292 4324 4759.tmp 89 PID 3292 wrote to memory of 3720 3292 4825.tmp 90 PID 3292 wrote to memory of 3720 3292 4825.tmp 90 PID 3292 wrote to memory of 3720 3292 4825.tmp 90 PID 3720 wrote to memory of 1540 3720 48F0.tmp 92 PID 3720 wrote to memory of 1540 3720 48F0.tmp 92 PID 3720 wrote to memory of 1540 3720 48F0.tmp 92 PID 1540 wrote to memory of 1484 1540 49CA.tmp 93 PID 1540 wrote to memory of 1484 1540 49CA.tmp 93 PID 1540 wrote to memory of 1484 1540 49CA.tmp 93 PID 1484 wrote to memory of 4964 1484 4A67.tmp 94 PID 1484 wrote to memory of 4964 1484 4A67.tmp 94 PID 1484 wrote to memory of 4964 1484 4A67.tmp 94 PID 4964 wrote to memory of 2012 4964 4B13.tmp 95 PID 4964 wrote to memory of 2012 4964 4B13.tmp 95 PID 4964 wrote to memory of 2012 4964 4B13.tmp 95 PID 2012 wrote to memory of 852 2012 4BBE.tmp 96 PID 2012 wrote to memory of 852 2012 4BBE.tmp 96 PID 2012 wrote to memory of 852 2012 4BBE.tmp 96 PID 852 wrote to memory of 4476 852 4C5B.tmp 97 PID 852 wrote to memory of 4476 852 4C5B.tmp 97 PID 852 wrote to memory of 4476 852 4C5B.tmp 97 PID 4476 wrote to memory of 2844 4476 4CF7.tmp 98 PID 4476 wrote to memory of 2844 4476 4CF7.tmp 98 PID 4476 wrote to memory of 2844 4476 4CF7.tmp 98 PID 2844 wrote to memory of 940 2844 4DA3.tmp 99 PID 2844 wrote to memory of 940 2844 4DA3.tmp 99 PID 2844 wrote to memory of 940 2844 4DA3.tmp 99 PID 940 wrote to memory of 1104 940 4E4F.tmp 100 PID 940 wrote to memory of 1104 940 4E4F.tmp 100 PID 940 wrote to memory of 1104 940 4E4F.tmp 100 PID 1104 wrote to memory of 948 1104 4EAC.tmp 101 PID 1104 wrote to memory of 948 1104 4EAC.tmp 101 PID 1104 wrote to memory of 948 1104 4EAC.tmp 101 PID 948 wrote to memory of 1464 948 4F49.tmp 102 PID 948 wrote to memory of 1464 948 4F49.tmp 102 PID 948 wrote to memory of 1464 948 4F49.tmp 102 PID 1464 wrote to memory of 4548 1464 4FD5.tmp 103 PID 1464 wrote to memory of 4548 1464 4FD5.tmp 103 PID 1464 wrote to memory of 4548 1464 4FD5.tmp 103 PID 4548 wrote to memory of 4600 4548 5091.tmp 104 PID 4548 wrote to memory of 4600 4548 5091.tmp 104 PID 4548 wrote to memory of 4600 4548 5091.tmp 104 PID 4600 wrote to memory of 3996 4600 512D.tmp 105 PID 4600 wrote to memory of 3996 4600 512D.tmp 105 PID 4600 wrote to memory of 3996 4600 512D.tmp 105 PID 3996 wrote to memory of 2488 3996 5208.tmp 106 PID 3996 wrote to memory of 2488 3996 5208.tmp 106 PID 3996 wrote to memory of 2488 3996 5208.tmp 106 PID 2488 wrote to memory of 4464 2488 52B4.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f612b9b7e02478a30a7409336d41e5f5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-25_f612b9b7e02478a30a7409336d41e5f5_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\4602.tmp"C:\Users\Admin\AppData\Local\Temp\4602.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"23⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"24⤵
- Executes dropped EXE
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"25⤵
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"26⤵
- Executes dropped EXE
PID:944 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"27⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"28⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"29⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"30⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"31⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"32⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"33⤵
- Executes dropped EXE
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"34⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"35⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"36⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"37⤵
- Executes dropped EXE
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"38⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"39⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"40⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"41⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"42⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"43⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"44⤵
- Executes dropped EXE
PID:716 -
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"45⤵
- Executes dropped EXE
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"46⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"47⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"48⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"49⤵
- Executes dropped EXE
PID:740 -
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"50⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"51⤵
- Executes dropped EXE
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"52⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"53⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"54⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"55⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"56⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"57⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"58⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"59⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"60⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"61⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"62⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"63⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"64⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"65⤵
- Executes dropped EXE
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"66⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"67⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"68⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"69⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"70⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"71⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"72⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"73⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"74⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"75⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"76⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"77⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"78⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"79⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"80⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"81⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"82⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"83⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"84⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"85⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"86⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"87⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"88⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"89⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"90⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"91⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"92⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"93⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"94⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"95⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"96⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"97⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"98⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\7157.tmp"C:\Users\Admin\AppData\Local\Temp\7157.tmp"99⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"100⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"101⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"102⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\7290.tmp"C:\Users\Admin\AppData\Local\Temp\7290.tmp"103⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"104⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"105⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"106⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"107⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"108⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"109⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\74F1.tmp"C:\Users\Admin\AppData\Local\Temp\74F1.tmp"110⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"111⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"112⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"113⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"114⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"115⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"116⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\7724.tmp"C:\Users\Admin\AppData\Local\Temp\7724.tmp"117⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"118⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\77DF.tmp"C:\Users\Admin\AppData\Local\Temp\77DF.tmp"119⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\783D.tmp"C:\Users\Admin\AppData\Local\Temp\783D.tmp"120⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\788B.tmp"C:\Users\Admin\AppData\Local\Temp\788B.tmp"121⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\78D9.tmp"C:\Users\Admin\AppData\Local\Temp\78D9.tmp"122⤵PID:1872
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-