Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
31/05/2024, 14:42
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-31_08f119ad64bff92a3a8adcfc54bbbb14_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-31_08f119ad64bff92a3a8adcfc54bbbb14_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-31_08f119ad64bff92a3a8adcfc54bbbb14_mafia.exe
-
Size
520KB
-
MD5
08f119ad64bff92a3a8adcfc54bbbb14
-
SHA1
e0ca02b115e6646f394db5fb53bbc3b9d3ff3f5d
-
SHA256
5803b7adee439af0731cc3db0112a6ada765542ecabfbb6550674920bf999400
-
SHA512
4ad4fcbe65e9eff3783dce656288956023a1ea26dd5bfe48c71bf1e4b32d3b337fd6af5d0ed245c074403d3af39699dcf16d7bffdab4416b23c73981c6b298ed
-
SSDEEP
6144:lLvd/XzCjUIF1UuXLyQjmOH+JjLH1tP6yWcg8RAt67bfu6i2ZnrdqGjXksH3dZ:roRXOQjmOyXj6y/RAt677dvBNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4936 4F49.tmp 4080 4FC6.tmp 4952 5033.tmp 4580 50B0.tmp 3368 510E.tmp 4320 515C.tmp 4992 51C9.tmp 4844 5227.tmp 428 5285.tmp 5104 52E3.tmp 1368 5340.tmp 3608 53AE.tmp 436 541B.tmp 3232 5469.tmp 3776 54D7.tmp 3240 5544.tmp 1996 55C1.tmp 4632 564E.tmp 4356 56AB.tmp 1016 5719.tmp 924 5796.tmp 764 5813.tmp 2648 5880.tmp 4304 58ED.tmp 4152 595B.tmp 4108 59B9.tmp 1892 5A45.tmp 4100 5AA3.tmp 1956 5B01.tmp 316 5B6E.tmp 1080 5BEB.tmp 2496 5C58.tmp 1576 5CD5.tmp 3244 5D24.tmp 2000 5D81.tmp 4416 5DDF.tmp 4148 5E2D.tmp 1420 5E8B.tmp 4204 5ED9.tmp 3708 5F27.tmp 3340 5F85.tmp 5064 5FD3.tmp 4712 6031.tmp 2312 608F.tmp 2720 60EC.tmp 892 614A.tmp 2588 6198.tmp 4564 6206.tmp 1088 6254.tmp 5080 62A2.tmp 1012 62F0.tmp 1996 633E.tmp 1644 638C.tmp 4572 63DA.tmp 1592 6428.tmp 1016 6477.tmp 4636 64C5.tmp 2056 6522.tmp 4500 6571.tmp 4172 65CE.tmp 3980 662C.tmp 4644 667A.tmp 1988 66D8.tmp 1240 6736.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 940 wrote to memory of 4936 940 2024-05-31_08f119ad64bff92a3a8adcfc54bbbb14_mafia.exe 85 PID 940 wrote to memory of 4936 940 2024-05-31_08f119ad64bff92a3a8adcfc54bbbb14_mafia.exe 85 PID 940 wrote to memory of 4936 940 2024-05-31_08f119ad64bff92a3a8adcfc54bbbb14_mafia.exe 85 PID 4936 wrote to memory of 4080 4936 4F49.tmp 86 PID 4936 wrote to memory of 4080 4936 4F49.tmp 86 PID 4936 wrote to memory of 4080 4936 4F49.tmp 86 PID 4080 wrote to memory of 4952 4080 4FC6.tmp 87 PID 4080 wrote to memory of 4952 4080 4FC6.tmp 87 PID 4080 wrote to memory of 4952 4080 4FC6.tmp 87 PID 4952 wrote to memory of 4580 4952 5033.tmp 88 PID 4952 wrote to memory of 4580 4952 5033.tmp 88 PID 4952 wrote to memory of 4580 4952 5033.tmp 88 PID 4580 wrote to memory of 3368 4580 50B0.tmp 89 PID 4580 wrote to memory of 3368 4580 50B0.tmp 89 PID 4580 wrote to memory of 3368 4580 50B0.tmp 89 PID 3368 wrote to memory of 4320 3368 510E.tmp 90 PID 3368 wrote to memory of 4320 3368 510E.tmp 90 PID 3368 wrote to memory of 4320 3368 510E.tmp 90 PID 4320 wrote to memory of 4992 4320 515C.tmp 91 PID 4320 wrote to memory of 4992 4320 515C.tmp 91 PID 4320 wrote to memory of 4992 4320 515C.tmp 91 PID 4992 wrote to memory of 4844 4992 51C9.tmp 93 PID 4992 wrote to memory of 4844 4992 51C9.tmp 93 PID 4992 wrote to memory of 4844 4992 51C9.tmp 93 PID 4844 wrote to memory of 428 4844 5227.tmp 95 PID 4844 wrote to memory of 428 4844 5227.tmp 95 PID 4844 wrote to memory of 428 4844 5227.tmp 95 PID 428 wrote to memory of 5104 428 5285.tmp 96 PID 428 wrote to memory of 5104 428 5285.tmp 96 PID 428 wrote to memory of 5104 428 5285.tmp 96 PID 5104 wrote to memory of 1368 5104 52E3.tmp 97 PID 5104 wrote to memory of 1368 5104 52E3.tmp 97 PID 5104 wrote to memory of 1368 5104 52E3.tmp 97 PID 1368 wrote to memory of 3608 1368 5340.tmp 99 PID 1368 wrote to memory of 3608 1368 5340.tmp 99 PID 1368 wrote to memory of 3608 1368 5340.tmp 99 PID 3608 wrote to memory of 436 3608 53AE.tmp 100 PID 3608 wrote to memory of 436 3608 53AE.tmp 100 PID 3608 wrote to memory of 436 3608 53AE.tmp 100 PID 436 wrote to memory of 3232 436 541B.tmp 101 PID 436 wrote to memory of 3232 436 541B.tmp 101 PID 436 wrote to memory of 3232 436 541B.tmp 101 PID 3232 wrote to memory of 3776 3232 5469.tmp 102 PID 3232 wrote to memory of 3776 3232 5469.tmp 102 PID 3232 wrote to memory of 3776 3232 5469.tmp 102 PID 3776 wrote to memory of 3240 3776 54D7.tmp 103 PID 3776 wrote to memory of 3240 3776 54D7.tmp 103 PID 3776 wrote to memory of 3240 3776 54D7.tmp 103 PID 3240 wrote to memory of 1996 3240 5544.tmp 104 PID 3240 wrote to memory of 1996 3240 5544.tmp 104 PID 3240 wrote to memory of 1996 3240 5544.tmp 104 PID 1996 wrote to memory of 4632 1996 55C1.tmp 105 PID 1996 wrote to memory of 4632 1996 55C1.tmp 105 PID 1996 wrote to memory of 4632 1996 55C1.tmp 105 PID 4632 wrote to memory of 4356 4632 564E.tmp 106 PID 4632 wrote to memory of 4356 4632 564E.tmp 106 PID 4632 wrote to memory of 4356 4632 564E.tmp 106 PID 4356 wrote to memory of 1016 4356 56AB.tmp 107 PID 4356 wrote to memory of 1016 4356 56AB.tmp 107 PID 4356 wrote to memory of 1016 4356 56AB.tmp 107 PID 1016 wrote to memory of 924 1016 5719.tmp 108 PID 1016 wrote to memory of 924 1016 5719.tmp 108 PID 1016 wrote to memory of 924 1016 5719.tmp 108 PID 924 wrote to memory of 764 924 5796.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-31_08f119ad64bff92a3a8adcfc54bbbb14_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-31_08f119ad64bff92a3a8adcfc54bbbb14_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"23⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"24⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"25⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"26⤵
- Executes dropped EXE
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"27⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"28⤵
- Executes dropped EXE
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"29⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"30⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"31⤵
- Executes dropped EXE
PID:316 -
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"32⤵
- Executes dropped EXE
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"33⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"34⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"35⤵
- Executes dropped EXE
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"36⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"37⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"38⤵
- Executes dropped EXE
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"39⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"40⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"41⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"42⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"43⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"44⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"45⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"46⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"47⤵
- Executes dropped EXE
PID:892 -
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"48⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"49⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"50⤵
- Executes dropped EXE
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"51⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"52⤵
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"53⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"54⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"55⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"56⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"57⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"58⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"59⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"60⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"61⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"62⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"63⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"64⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"65⤵
- Executes dropped EXE
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"66⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"67⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"68⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"69⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"70⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"71⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"72⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"73⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"74⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"75⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"76⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"77⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"78⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"79⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"80⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"81⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"82⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"83⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"84⤵PID:660
-
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"85⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"86⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"87⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"88⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"89⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"90⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"91⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"92⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"93⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"94⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"95⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"96⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\72A0.tmp"C:\Users\Admin\AppData\Local\Temp\72A0.tmp"97⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"98⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"99⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"100⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\73F7.tmp"C:\Users\Admin\AppData\Local\Temp\73F7.tmp"101⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"102⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"103⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"104⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"105⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"106⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"107⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"108⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"109⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\7724.tmp"C:\Users\Admin\AppData\Local\Temp\7724.tmp"110⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"111⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"112⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\782D.tmp"C:\Users\Admin\AppData\Local\Temp\782D.tmp"113⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\788B.tmp"C:\Users\Admin\AppData\Local\Temp\788B.tmp"114⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"115⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"116⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\7995.tmp"C:\Users\Admin\AppData\Local\Temp\7995.tmp"117⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"118⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"119⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"120⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"121⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"122⤵PID:1576
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-