Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 20:32
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-27_8026f7616083c3a549aba37e1c859d84_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-27_8026f7616083c3a549aba37e1c859d84_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-27_8026f7616083c3a549aba37e1c859d84_mafia.exe
-
Size
536KB
-
MD5
8026f7616083c3a549aba37e1c859d84
-
SHA1
bfdf42ff977c96f1077ed15e79534d03e6104ed6
-
SHA256
d005e32e30f6defc7d6bfa4d90bca90a5717c40e7bb47b7f284d882a28de0854
-
SHA512
fb806df42875c06f53f19011311064f0de0c6533b9465c9120c103fb53538fcb56f18d64270dfe3bb829f265831053af82d5917721e3e3ea35e99b8ed3b48b6f
-
SSDEEP
12288:wU5rCOTeiUHfkZObvZH4qXKrKS35+ozOH0IZxVJ0ZT9:wUQOJUsObBHOKa5o0IRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 380 46EC.tmp 3188 4798.tmp 1632 4825.tmp 1732 48E0.tmp 2736 497C.tmp 2244 4A28.tmp 4048 4AE4.tmp 3376 4B41.tmp 4016 4BED.tmp 2744 4CB8.tmp 900 4D64.tmp 1448 4E20.tmp 1336 4EDB.tmp 4376 4F68.tmp 1928 4FF5.tmp 1668 50B0.tmp 1004 516C.tmp 1200 5208.tmp 4616 52A4.tmp 2932 5340.tmp 2672 53EC.tmp 3396 54A8.tmp 4600 5534.tmp 4120 55E0.tmp 4400 567C.tmp 3196 5709.tmp 264 5786.tmp 1564 5803.tmp 4396 58AF.tmp 3668 591C.tmp 4784 59C8.tmp 4484 5A84.tmp 4076 5B3F.tmp 692 5BCC.tmp 1692 5C49.tmp 3420 5CB6.tmp 4608 5D43.tmp 4620 5DB0.tmp 3292 5E0E.tmp 5112 5E8B.tmp 968 5EF8.tmp 4900 5F56.tmp 4376 5FE3.tmp 1912 6060.tmp 4116 60CD.tmp 884 612B.tmp 684 61B7.tmp 3308 6225.tmp 1348 6292.tmp 1948 62F0.tmp 3580 634E.tmp 864 63AB.tmp 3556 6409.tmp 1880 6477.tmp 2796 64E4.tmp 3916 6542.tmp 2592 65AF.tmp 4400 661C.tmp 4888 666B.tmp 4532 66C8.tmp 4404 6716.tmp 3636 6765.tmp 2160 67B3.tmp 2372 6820.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3456 wrote to memory of 380 3456 2024-05-27_8026f7616083c3a549aba37e1c859d84_mafia.exe 83 PID 3456 wrote to memory of 380 3456 2024-05-27_8026f7616083c3a549aba37e1c859d84_mafia.exe 83 PID 3456 wrote to memory of 380 3456 2024-05-27_8026f7616083c3a549aba37e1c859d84_mafia.exe 83 PID 380 wrote to memory of 3188 380 46EC.tmp 84 PID 380 wrote to memory of 3188 380 46EC.tmp 84 PID 380 wrote to memory of 3188 380 46EC.tmp 84 PID 3188 wrote to memory of 1632 3188 4798.tmp 85 PID 3188 wrote to memory of 1632 3188 4798.tmp 85 PID 3188 wrote to memory of 1632 3188 4798.tmp 85 PID 1632 wrote to memory of 1732 1632 4825.tmp 86 PID 1632 wrote to memory of 1732 1632 4825.tmp 86 PID 1632 wrote to memory of 1732 1632 4825.tmp 86 PID 1732 wrote to memory of 2736 1732 48E0.tmp 88 PID 1732 wrote to memory of 2736 1732 48E0.tmp 88 PID 1732 wrote to memory of 2736 1732 48E0.tmp 88 PID 2736 wrote to memory of 2244 2736 497C.tmp 91 PID 2736 wrote to memory of 2244 2736 497C.tmp 91 PID 2736 wrote to memory of 2244 2736 497C.tmp 91 PID 2244 wrote to memory of 4048 2244 4A28.tmp 92 PID 2244 wrote to memory of 4048 2244 4A28.tmp 92 PID 2244 wrote to memory of 4048 2244 4A28.tmp 92 PID 4048 wrote to memory of 3376 4048 4AE4.tmp 93 PID 4048 wrote to memory of 3376 4048 4AE4.tmp 93 PID 4048 wrote to memory of 3376 4048 4AE4.tmp 93 PID 3376 wrote to memory of 4016 3376 4B41.tmp 94 PID 3376 wrote to memory of 4016 3376 4B41.tmp 94 PID 3376 wrote to memory of 4016 3376 4B41.tmp 94 PID 4016 wrote to memory of 2744 4016 4BED.tmp 95 PID 4016 wrote to memory of 2744 4016 4BED.tmp 95 PID 4016 wrote to memory of 2744 4016 4BED.tmp 95 PID 2744 wrote to memory of 900 2744 4CB8.tmp 96 PID 2744 wrote to memory of 900 2744 4CB8.tmp 96 PID 2744 wrote to memory of 900 2744 4CB8.tmp 96 PID 900 wrote to memory of 1448 900 4D64.tmp 97 PID 900 wrote to memory of 1448 900 4D64.tmp 97 PID 900 wrote to memory of 1448 900 4D64.tmp 97 PID 1448 wrote to memory of 1336 1448 4E20.tmp 98 PID 1448 wrote to memory of 1336 1448 4E20.tmp 98 PID 1448 wrote to memory of 1336 1448 4E20.tmp 98 PID 1336 wrote to memory of 4376 1336 4EDB.tmp 99 PID 1336 wrote to memory of 4376 1336 4EDB.tmp 99 PID 1336 wrote to memory of 4376 1336 4EDB.tmp 99 PID 4376 wrote to memory of 1928 4376 4F68.tmp 100 PID 4376 wrote to memory of 1928 4376 4F68.tmp 100 PID 4376 wrote to memory of 1928 4376 4F68.tmp 100 PID 1928 wrote to memory of 1668 1928 4FF5.tmp 101 PID 1928 wrote to memory of 1668 1928 4FF5.tmp 101 PID 1928 wrote to memory of 1668 1928 4FF5.tmp 101 PID 1668 wrote to memory of 1004 1668 50B0.tmp 102 PID 1668 wrote to memory of 1004 1668 50B0.tmp 102 PID 1668 wrote to memory of 1004 1668 50B0.tmp 102 PID 1004 wrote to memory of 1200 1004 516C.tmp 103 PID 1004 wrote to memory of 1200 1004 516C.tmp 103 PID 1004 wrote to memory of 1200 1004 516C.tmp 103 PID 1200 wrote to memory of 4616 1200 5208.tmp 104 PID 1200 wrote to memory of 4616 1200 5208.tmp 104 PID 1200 wrote to memory of 4616 1200 5208.tmp 104 PID 4616 wrote to memory of 2932 4616 52A4.tmp 105 PID 4616 wrote to memory of 2932 4616 52A4.tmp 105 PID 4616 wrote to memory of 2932 4616 52A4.tmp 105 PID 2932 wrote to memory of 2672 2932 5340.tmp 106 PID 2932 wrote to memory of 2672 2932 5340.tmp 106 PID 2932 wrote to memory of 2672 2932 5340.tmp 106 PID 2672 wrote to memory of 3396 2672 53EC.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_8026f7616083c3a549aba37e1c859d84_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_8026f7616083c3a549aba37e1c859d84_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\46EC.tmp"C:\Users\Admin\AppData\Local\Temp\46EC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"23⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"24⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"25⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"26⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"27⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"28⤵
- Executes dropped EXE
PID:264 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"29⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"30⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"31⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"32⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"33⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"34⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"35⤵
- Executes dropped EXE
PID:692 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"36⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"37⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"38⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"39⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"40⤵
- Executes dropped EXE
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"41⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"42⤵
- Executes dropped EXE
PID:968 -
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"43⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"44⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"45⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"46⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"47⤵
- Executes dropped EXE
PID:884 -
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"48⤵
- Executes dropped EXE
PID:684 -
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"49⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"50⤵
- Executes dropped EXE
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"51⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"52⤵
- Executes dropped EXE
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"53⤵
- Executes dropped EXE
PID:864 -
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"54⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"55⤵
- Executes dropped EXE
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"56⤵
- Executes dropped EXE
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"57⤵
- Executes dropped EXE
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"58⤵
- Executes dropped EXE
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"59⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"60⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"61⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"62⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"63⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"64⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"65⤵
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"66⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"67⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"68⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"69⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"70⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"71⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"72⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"73⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"74⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"75⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"76⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"77⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"78⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"79⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"80⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"81⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"82⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"83⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"84⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"85⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"86⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"87⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"88⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"89⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"90⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"91⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"92⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\7157.tmp"C:\Users\Admin\AppData\Local\Temp\7157.tmp"93⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"94⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"95⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"96⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\72A0.tmp"C:\Users\Admin\AppData\Local\Temp\72A0.tmp"97⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\72EE.tmp"C:\Users\Admin\AppData\Local\Temp\72EE.tmp"98⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"99⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"100⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"101⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"102⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"103⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"104⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"105⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"106⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"107⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\760B.tmp"C:\Users\Admin\AppData\Local\Temp\760B.tmp"108⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\7659.tmp"C:\Users\Admin\AppData\Local\Temp\7659.tmp"109⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"110⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\7705.tmp"C:\Users\Admin\AppData\Local\Temp\7705.tmp"111⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\7762.tmp"C:\Users\Admin\AppData\Local\Temp\7762.tmp"112⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\77B0.tmp"C:\Users\Admin\AppData\Local\Temp\77B0.tmp"113⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\77FF.tmp"C:\Users\Admin\AppData\Local\Temp\77FF.tmp"114⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"115⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\789B.tmp"C:\Users\Admin\AppData\Local\Temp\789B.tmp"116⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"117⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\7937.tmp"C:\Users\Admin\AppData\Local\Temp\7937.tmp"118⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"119⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\79D3.tmp"C:\Users\Admin\AppData\Local\Temp\79D3.tmp"120⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\7A21.tmp"C:\Users\Admin\AppData\Local\Temp\7A21.tmp"121⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\7A70.tmp"C:\Users\Admin\AppData\Local\Temp\7A70.tmp"122⤵PID:3208
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-