Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
31/05/2024, 20:07
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-31_3f840108a0cdffa6fda3f6f837ddbd4e_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-05-31_3f840108a0cdffa6fda3f6f837ddbd4e_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-31_3f840108a0cdffa6fda3f6f837ddbd4e_mafia.exe
-
Size
520KB
-
MD5
3f840108a0cdffa6fda3f6f837ddbd4e
-
SHA1
96e9c5c9f8ce0c2357833af9b66bdbc9bc6f5284
-
SHA256
0984f7ca5cfbc771f693361e1c05581ca3465dd6c04bd405c82eb4d7dd141e16
-
SHA512
843332ed5d73edb3cb1a4c12d04194d12e2076ba98bc1de55aaa02350a69d6e3c6db9898bf69691230b946edaa1a3e3f8913463df7e1e3990693b00943ab669d
-
SSDEEP
12288:roRXOQjmOyiEaZ5rztmYfV4O9AjHDY95lc2NZ:rogQ9yf8rZpt4OAjx2N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3828 4F1A.tmp 3256 4F97.tmp 4124 5033.tmp 3648 50EF.tmp 4648 518B.tmp 664 51F8.tmp 316 5285.tmp 2668 52F2.tmp 4876 5360.tmp 2156 53BD.tmp 2024 543A.tmp 3732 5488.tmp 3488 54F6.tmp 1960 5544.tmp 4576 55D1.tmp 4716 561F.tmp 2368 567C.tmp 3144 56EA.tmp 232 5757.tmp 2492 57D4.tmp 4584 5842.tmp 3032 58AF.tmp 3116 592C.tmp 400 598A.tmp 5028 59E7.tmp 1468 5A55.tmp 4480 5AB3.tmp 4012 5B01.tmp 2608 5B5E.tmp 3356 5BCC.tmp 760 5C49.tmp 4244 5CA7.tmp 1648 5D43.tmp 3400 5D91.tmp 4360 5DEF.tmp 412 5E4C.tmp 4604 5EAA.tmp 688 5F08.tmp 3256 5F56.tmp 3028 5FB4.tmp 3312 6012.tmp 692 606F.tmp 1416 60BD.tmp 2232 610C.tmp 2332 615A.tmp 4848 61B7.tmp 2168 6215.tmp 1384 6263.tmp 2672 62B1.tmp 2320 6300.tmp 4224 634E.tmp 808 63AB.tmp 3608 63FA.tmp 3636 6448.tmp 1036 64A5.tmp 2980 6503.tmp 840 6561.tmp 2368 65AF.tmp 4760 660D.tmp 1076 666B.tmp 1064 66C8.tmp 2216 6726.tmp 3800 6784.tmp 1592 67E2.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4300 wrote to memory of 3828 4300 2024-05-31_3f840108a0cdffa6fda3f6f837ddbd4e_mafia.exe 83 PID 4300 wrote to memory of 3828 4300 2024-05-31_3f840108a0cdffa6fda3f6f837ddbd4e_mafia.exe 83 PID 4300 wrote to memory of 3828 4300 2024-05-31_3f840108a0cdffa6fda3f6f837ddbd4e_mafia.exe 83 PID 3828 wrote to memory of 3256 3828 4F1A.tmp 84 PID 3828 wrote to memory of 3256 3828 4F1A.tmp 84 PID 3828 wrote to memory of 3256 3828 4F1A.tmp 84 PID 3256 wrote to memory of 4124 3256 4F97.tmp 85 PID 3256 wrote to memory of 4124 3256 4F97.tmp 85 PID 3256 wrote to memory of 4124 3256 4F97.tmp 85 PID 4124 wrote to memory of 3648 4124 5033.tmp 86 PID 4124 wrote to memory of 3648 4124 5033.tmp 86 PID 4124 wrote to memory of 3648 4124 5033.tmp 86 PID 3648 wrote to memory of 4648 3648 50EF.tmp 88 PID 3648 wrote to memory of 4648 3648 50EF.tmp 88 PID 3648 wrote to memory of 4648 3648 50EF.tmp 88 PID 4648 wrote to memory of 664 4648 518B.tmp 89 PID 4648 wrote to memory of 664 4648 518B.tmp 89 PID 4648 wrote to memory of 664 4648 518B.tmp 89 PID 664 wrote to memory of 316 664 51F8.tmp 90 PID 664 wrote to memory of 316 664 51F8.tmp 90 PID 664 wrote to memory of 316 664 51F8.tmp 90 PID 316 wrote to memory of 2668 316 5285.tmp 92 PID 316 wrote to memory of 2668 316 5285.tmp 92 PID 316 wrote to memory of 2668 316 5285.tmp 92 PID 2668 wrote to memory of 4876 2668 52F2.tmp 93 PID 2668 wrote to memory of 4876 2668 52F2.tmp 93 PID 2668 wrote to memory of 4876 2668 52F2.tmp 93 PID 4876 wrote to memory of 2156 4876 5360.tmp 94 PID 4876 wrote to memory of 2156 4876 5360.tmp 94 PID 4876 wrote to memory of 2156 4876 5360.tmp 94 PID 2156 wrote to memory of 2024 2156 53BD.tmp 96 PID 2156 wrote to memory of 2024 2156 53BD.tmp 96 PID 2156 wrote to memory of 2024 2156 53BD.tmp 96 PID 2024 wrote to memory of 3732 2024 543A.tmp 97 PID 2024 wrote to memory of 3732 2024 543A.tmp 97 PID 2024 wrote to memory of 3732 2024 543A.tmp 97 PID 3732 wrote to memory of 3488 3732 5488.tmp 98 PID 3732 wrote to memory of 3488 3732 5488.tmp 98 PID 3732 wrote to memory of 3488 3732 5488.tmp 98 PID 3488 wrote to memory of 1960 3488 54F6.tmp 99 PID 3488 wrote to memory of 1960 3488 54F6.tmp 99 PID 3488 wrote to memory of 1960 3488 54F6.tmp 99 PID 1960 wrote to memory of 4576 1960 5544.tmp 100 PID 1960 wrote to memory of 4576 1960 5544.tmp 100 PID 1960 wrote to memory of 4576 1960 5544.tmp 100 PID 4576 wrote to memory of 4716 4576 55D1.tmp 101 PID 4576 wrote to memory of 4716 4576 55D1.tmp 101 PID 4576 wrote to memory of 4716 4576 55D1.tmp 101 PID 4716 wrote to memory of 2368 4716 561F.tmp 102 PID 4716 wrote to memory of 2368 4716 561F.tmp 102 PID 4716 wrote to memory of 2368 4716 561F.tmp 102 PID 2368 wrote to memory of 3144 2368 567C.tmp 103 PID 2368 wrote to memory of 3144 2368 567C.tmp 103 PID 2368 wrote to memory of 3144 2368 567C.tmp 103 PID 3144 wrote to memory of 232 3144 56EA.tmp 104 PID 3144 wrote to memory of 232 3144 56EA.tmp 104 PID 3144 wrote to memory of 232 3144 56EA.tmp 104 PID 232 wrote to memory of 2492 232 5757.tmp 105 PID 232 wrote to memory of 2492 232 5757.tmp 105 PID 232 wrote to memory of 2492 232 5757.tmp 105 PID 2492 wrote to memory of 4584 2492 57D4.tmp 106 PID 2492 wrote to memory of 4584 2492 57D4.tmp 106 PID 2492 wrote to memory of 4584 2492 57D4.tmp 106 PID 4584 wrote to memory of 3032 4584 5842.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-31_3f840108a0cdffa6fda3f6f837ddbd4e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-31_3f840108a0cdffa6fda3f6f837ddbd4e_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"23⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"24⤵
- Executes dropped EXE
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"25⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"26⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"27⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"28⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"29⤵
- Executes dropped EXE
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"30⤵
- Executes dropped EXE
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"31⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"32⤵
- Executes dropped EXE
PID:760 -
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"33⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"34⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"35⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"36⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"37⤵
- Executes dropped EXE
PID:412 -
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"38⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"39⤵
- Executes dropped EXE
PID:688 -
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"40⤵
- Executes dropped EXE
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"41⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"42⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"43⤵
- Executes dropped EXE
PID:692 -
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"44⤵
- Executes dropped EXE
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"45⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"46⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"47⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"48⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"49⤵
- Executes dropped EXE
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"50⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"51⤵
- Executes dropped EXE
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"52⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"53⤵
- Executes dropped EXE
PID:808 -
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"54⤵
- Executes dropped EXE
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"55⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"56⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"57⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"58⤵
- Executes dropped EXE
PID:840 -
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"59⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"60⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"61⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"62⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"63⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"64⤵
- Executes dropped EXE
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"65⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"66⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"67⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"68⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"69⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"70⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"71⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"72⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"73⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"74⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"75⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"76⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"77⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"78⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"79⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"80⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"81⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"82⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"83⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"84⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"85⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"86⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"87⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"88⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"89⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"90⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\7157.tmp"C:\Users\Admin\AppData\Local\Temp\7157.tmp"91⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"92⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\7232.tmp"C:\Users\Admin\AppData\Local\Temp\7232.tmp"93⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\72A0.tmp"C:\Users\Admin\AppData\Local\Temp\72A0.tmp"94⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\72EE.tmp"C:\Users\Admin\AppData\Local\Temp\72EE.tmp"95⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"96⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"97⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\73F7.tmp"C:\Users\Admin\AppData\Local\Temp\73F7.tmp"98⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"99⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"100⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\74F1.tmp"C:\Users\Admin\AppData\Local\Temp\74F1.tmp"101⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\754F.tmp"C:\Users\Admin\AppData\Local\Temp\754F.tmp"102⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"103⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\760B.tmp"C:\Users\Admin\AppData\Local\Temp\760B.tmp"104⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"105⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"106⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\7724.tmp"C:\Users\Admin\AppData\Local\Temp\7724.tmp"107⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\7772.tmp"C:\Users\Admin\AppData\Local\Temp\7772.tmp"108⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"109⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\782D.tmp"C:\Users\Admin\AppData\Local\Temp\782D.tmp"110⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\788B.tmp"C:\Users\Admin\AppData\Local\Temp\788B.tmp"111⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"112⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"113⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\79A4.tmp"C:\Users\Admin\AppData\Local\Temp\79A4.tmp"114⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"115⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"116⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"117⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\7AED.tmp"C:\Users\Admin\AppData\Local\Temp\7AED.tmp"118⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"119⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\7B89.tmp"C:\Users\Admin\AppData\Local\Temp\7B89.tmp"120⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"121⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\7C44.tmp"C:\Users\Admin\AppData\Local\Temp\7C44.tmp"122⤵PID:4040
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-