Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
04/06/2024, 16:34
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-04_d74ffb1af9863b11a2161458dde72799_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-04_d74ffb1af9863b11a2161458dde72799_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-06-04_d74ffb1af9863b11a2161458dde72799_mafia.exe
-
Size
487KB
-
MD5
d74ffb1af9863b11a2161458dde72799
-
SHA1
afcdb2681ebed00860ecfb79ec81140cb86eeedc
-
SHA256
5a770fef3f18314193c50d554b506504789903d3612bc610f9b54b9c0b1942c1
-
SHA512
69dda4be515bb406eec3c057f63bffe1daa421e68f1541bf2acf219fc5f5a5d869b6779ee613d965ab71fdcdfeabe2d71c680dbabbfcbaf17ea76aab12ec11e0
-
SSDEEP
12288:HU5rCOTeiJaehqhVIpZPI8YkINHzAwANZ:HUQOJJaeshVIhPxINHIN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2544 5544.tmp 1016 55E0.tmp 228 566D.tmp 4960 56EA.tmp 3172 5767.tmp 4416 57C5.tmp 2752 5832.tmp 3920 58AF.tmp 4836 591C.tmp 1756 5999.tmp 4520 5A16.tmp 448 5A84.tmp 2500 5B10.tmp 4608 5B9D.tmp 388 5BFB.tmp 3848 5C49.tmp 4992 5C97.tmp 4544 5D04.tmp 4648 5D81.tmp 2980 5DDF.tmp 656 5E4C.tmp 4304 5EC9.tmp 2624 5F27.tmp 1144 5F95.tmp 3460 6012.tmp 5048 607F.tmp 4024 60DD.tmp 772 615A.tmp 1352 61A8.tmp 880 6225.tmp 2824 6273.tmp 1760 62C1.tmp 2052 636D.tmp 3692 63BB.tmp 1772 6409.tmp 3284 6457.tmp 3424 64A5.tmp 4436 64F4.tmp 680 6542.tmp 2272 6590.tmp 3716 65DE.tmp 2744 662C.tmp 3568 667A.tmp 1528 66C8.tmp 2760 6716.tmp 232 6765.tmp 3768 67C2.tmp 4484 6810.tmp 924 687E.tmp 4832 68DC.tmp 1080 6939.tmp 1180 69A7.tmp 4344 69F5.tmp 3864 6A72.tmp 3292 6AEF.tmp 784 6B5C.tmp 3260 6BE9.tmp 1052 6D02.tmp 4324 6D7F.tmp 2104 6E89.tmp 2912 6ED7.tmp 4416 6F25.tmp 2920 6F83.tmp 1236 6FD1.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2648 wrote to memory of 2544 2648 2024-06-04_d74ffb1af9863b11a2161458dde72799_mafia.exe 82 PID 2648 wrote to memory of 2544 2648 2024-06-04_d74ffb1af9863b11a2161458dde72799_mafia.exe 82 PID 2648 wrote to memory of 2544 2648 2024-06-04_d74ffb1af9863b11a2161458dde72799_mafia.exe 82 PID 2544 wrote to memory of 1016 2544 5544.tmp 83 PID 2544 wrote to memory of 1016 2544 5544.tmp 83 PID 2544 wrote to memory of 1016 2544 5544.tmp 83 PID 1016 wrote to memory of 228 1016 55E0.tmp 84 PID 1016 wrote to memory of 228 1016 55E0.tmp 84 PID 1016 wrote to memory of 228 1016 55E0.tmp 84 PID 228 wrote to memory of 4960 228 566D.tmp 86 PID 228 wrote to memory of 4960 228 566D.tmp 86 PID 228 wrote to memory of 4960 228 566D.tmp 86 PID 4960 wrote to memory of 3172 4960 56EA.tmp 88 PID 4960 wrote to memory of 3172 4960 56EA.tmp 88 PID 4960 wrote to memory of 3172 4960 56EA.tmp 88 PID 3172 wrote to memory of 4416 3172 5767.tmp 89 PID 3172 wrote to memory of 4416 3172 5767.tmp 89 PID 3172 wrote to memory of 4416 3172 5767.tmp 89 PID 4416 wrote to memory of 2752 4416 57C5.tmp 90 PID 4416 wrote to memory of 2752 4416 57C5.tmp 90 PID 4416 wrote to memory of 2752 4416 57C5.tmp 90 PID 2752 wrote to memory of 3920 2752 5832.tmp 92 PID 2752 wrote to memory of 3920 2752 5832.tmp 92 PID 2752 wrote to memory of 3920 2752 5832.tmp 92 PID 3920 wrote to memory of 4836 3920 58AF.tmp 93 PID 3920 wrote to memory of 4836 3920 58AF.tmp 93 PID 3920 wrote to memory of 4836 3920 58AF.tmp 93 PID 4836 wrote to memory of 1756 4836 591C.tmp 94 PID 4836 wrote to memory of 1756 4836 591C.tmp 94 PID 4836 wrote to memory of 1756 4836 591C.tmp 94 PID 1756 wrote to memory of 4520 1756 5999.tmp 95 PID 1756 wrote to memory of 4520 1756 5999.tmp 95 PID 1756 wrote to memory of 4520 1756 5999.tmp 95 PID 4520 wrote to memory of 448 4520 5A16.tmp 96 PID 4520 wrote to memory of 448 4520 5A16.tmp 96 PID 4520 wrote to memory of 448 4520 5A16.tmp 96 PID 448 wrote to memory of 2500 448 5A84.tmp 97 PID 448 wrote to memory of 2500 448 5A84.tmp 97 PID 448 wrote to memory of 2500 448 5A84.tmp 97 PID 2500 wrote to memory of 4608 2500 5B10.tmp 98 PID 2500 wrote to memory of 4608 2500 5B10.tmp 98 PID 2500 wrote to memory of 4608 2500 5B10.tmp 98 PID 4608 wrote to memory of 388 4608 5B9D.tmp 99 PID 4608 wrote to memory of 388 4608 5B9D.tmp 99 PID 4608 wrote to memory of 388 4608 5B9D.tmp 99 PID 388 wrote to memory of 3848 388 5BFB.tmp 100 PID 388 wrote to memory of 3848 388 5BFB.tmp 100 PID 388 wrote to memory of 3848 388 5BFB.tmp 100 PID 3848 wrote to memory of 4992 3848 5C49.tmp 101 PID 3848 wrote to memory of 4992 3848 5C49.tmp 101 PID 3848 wrote to memory of 4992 3848 5C49.tmp 101 PID 4992 wrote to memory of 4544 4992 5C97.tmp 102 PID 4992 wrote to memory of 4544 4992 5C97.tmp 102 PID 4992 wrote to memory of 4544 4992 5C97.tmp 102 PID 4544 wrote to memory of 4648 4544 5D04.tmp 103 PID 4544 wrote to memory of 4648 4544 5D04.tmp 103 PID 4544 wrote to memory of 4648 4544 5D04.tmp 103 PID 4648 wrote to memory of 2980 4648 5D81.tmp 104 PID 4648 wrote to memory of 2980 4648 5D81.tmp 104 PID 4648 wrote to memory of 2980 4648 5D81.tmp 104 PID 2980 wrote to memory of 656 2980 5DDF.tmp 105 PID 2980 wrote to memory of 656 2980 5DDF.tmp 105 PID 2980 wrote to memory of 656 2980 5DDF.tmp 105 PID 656 wrote to memory of 4304 656 5E4C.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-04_d74ffb1af9863b11a2161458dde72799_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-04_d74ffb1af9863b11a2161458dde72799_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"23⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"24⤵
- Executes dropped EXE
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"25⤵
- Executes dropped EXE
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"26⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"27⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"28⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"29⤵
- Executes dropped EXE
PID:772 -
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"30⤵
- Executes dropped EXE
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"31⤵
- Executes dropped EXE
PID:880 -
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"32⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"33⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"34⤵
- Executes dropped EXE
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"35⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"36⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"37⤵
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"38⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"39⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"40⤵
- Executes dropped EXE
PID:680 -
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"41⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"42⤵
- Executes dropped EXE
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"43⤵
- Executes dropped EXE
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"44⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"45⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"46⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"47⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"48⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"49⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"50⤵
- Executes dropped EXE
PID:924 -
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"51⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"52⤵
- Executes dropped EXE
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"53⤵
- Executes dropped EXE
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"54⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"55⤵
- Executes dropped EXE
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"56⤵
- Executes dropped EXE
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"57⤵
- Executes dropped EXE
PID:784 -
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"58⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"59⤵
- Executes dropped EXE
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"60⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"61⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"62⤵
- Executes dropped EXE
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"63⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"64⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"65⤵
- Executes dropped EXE
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"66⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"67⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"68⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"69⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\7177.tmp"C:\Users\Admin\AppData\Local\Temp\7177.tmp"70⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"71⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"72⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"73⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"74⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"75⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\73F7.tmp"C:\Users\Admin\AppData\Local\Temp\73F7.tmp"76⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"77⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"78⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"79⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"80⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"81⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"82⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"83⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\7714.tmp"C:\Users\Admin\AppData\Local\Temp\7714.tmp"84⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\7772.tmp"C:\Users\Admin\AppData\Local\Temp\7772.tmp"85⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\77DF.tmp"C:\Users\Admin\AppData\Local\Temp\77DF.tmp"86⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\782D.tmp"C:\Users\Admin\AppData\Local\Temp\782D.tmp"87⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"88⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\7918.tmp"C:\Users\Admin\AppData\Local\Temp\7918.tmp"89⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\7966.tmp"C:\Users\Admin\AppData\Local\Temp\7966.tmp"90⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\79D3.tmp"C:\Users\Admin\AppData\Local\Temp\79D3.tmp"91⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"92⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"93⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"94⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"95⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"96⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\7C06.tmp"C:\Users\Admin\AppData\Local\Temp\7C06.tmp"97⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\7C54.tmp"C:\Users\Admin\AppData\Local\Temp\7C54.tmp"98⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"99⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\7D00.tmp"C:\Users\Admin\AppData\Local\Temp\7D00.tmp"100⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"101⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"102⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"103⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\7E77.tmp"C:\Users\Admin\AppData\Local\Temp\7E77.tmp"104⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"105⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\7F32.tmp"C:\Users\Admin\AppData\Local\Temp\7F32.tmp"106⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"107⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"108⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\803C.tmp"C:\Users\Admin\AppData\Local\Temp\803C.tmp"109⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\808A.tmp"C:\Users\Admin\AppData\Local\Temp\808A.tmp"110⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\80E8.tmp"C:\Users\Admin\AppData\Local\Temp\80E8.tmp"111⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\8146.tmp"C:\Users\Admin\AppData\Local\Temp\8146.tmp"112⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\81A3.tmp"C:\Users\Admin\AppData\Local\Temp\81A3.tmp"113⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\8201.tmp"C:\Users\Admin\AppData\Local\Temp\8201.tmp"114⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"115⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\82BD.tmp"C:\Users\Admin\AppData\Local\Temp\82BD.tmp"116⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"117⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"118⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\83E5.tmp"C:\Users\Admin\AppData\Local\Temp\83E5.tmp"119⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\8453.tmp"C:\Users\Admin\AppData\Local\Temp\8453.tmp"120⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\84A1.tmp"C:\Users\Admin\AppData\Local\Temp\84A1.tmp"121⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\84FF.tmp"C:\Users\Admin\AppData\Local\Temp\84FF.tmp"122⤵PID:852
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-