Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04/06/2024, 17:37
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-04_d64353735694661d4544fbe04ce2f179_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-04_d64353735694661d4544fbe04ce2f179_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-04_d64353735694661d4544fbe04ce2f179_mafia.exe
-
Size
527KB
-
MD5
d64353735694661d4544fbe04ce2f179
-
SHA1
2afd1ecfe6eed7e86147c153bc962c1902d39ece
-
SHA256
c7e410b2fa61a515298ef00da84dd383eae7b30158ecaa5afd831097e9b3338e
-
SHA512
d9becf8209df26b5dd8eb0521113192bd49d224fc2765dd789e6139f69c98b9c2bd96d15a3f90a74627b8b3bc1d12ee302e37129af364a3ea6f772208eca6a52
-
SSDEEP
12288:fU5rCOTeidqpuVdy/41sp0LEzPdkdZYDZu:fUQOJdiay8spaErdksDo
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1912 5803.tmp 528 589F.tmp 5104 590D.tmp 3892 59A9.tmp 4452 5A16.tmp 3464 5A84.tmp 2480 5B10.tmp 3420 5B6E.tmp 5024 5BBC.tmp 3656 5C0A.tmp 4312 5C78.tmp 2840 5CC6.tmp 3428 5D43.tmp 3972 5DC0.tmp 2276 5E2D.tmp 1252 5EAA.tmp 3368 5F08.tmp 3632 5F66.tmp 4304 5FC3.tmp 4388 6040.tmp 2800 60AE.tmp 436 611B.tmp 2608 6179.tmp 1184 6206.tmp 3836 6292.tmp 2644 62F0.tmp 4688 633E.tmp 4072 63AB.tmp 4316 6428.tmp 4636 6477.tmp 2396 64F4.tmp 4372 6571.tmp 1504 65EE.tmp 3960 663C.tmp 4212 6699.tmp 3592 66E8.tmp 1912 6736.tmp 2792 6784.tmp 516 67D2.tmp 5104 6830.tmp 1072 688D.tmp 3892 68DC.tmp 3028 692A.tmp 456 6978.tmp 4440 69C6.tmp 4312 6A14.tmp 1524 6A62.tmp 2364 6AB0.tmp 1660 6B1E.tmp 3924 6B7B.tmp 1240 6BCA.tmp 1720 6C27.tmp 2868 6C85.tmp 3632 6CE3.tmp 1736 6D41.tmp 464 6D8F.tmp 4836 6DEC.tmp 3928 6E3B.tmp 3992 6E89.tmp 4632 6EE6.tmp 2608 6F44.tmp 4284 6FA2.tmp 3168 7000.tmp 3836 705D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4928 wrote to memory of 1912 4928 2024-06-04_d64353735694661d4544fbe04ce2f179_mafia.exe 83 PID 4928 wrote to memory of 1912 4928 2024-06-04_d64353735694661d4544fbe04ce2f179_mafia.exe 83 PID 4928 wrote to memory of 1912 4928 2024-06-04_d64353735694661d4544fbe04ce2f179_mafia.exe 83 PID 1912 wrote to memory of 528 1912 5803.tmp 84 PID 1912 wrote to memory of 528 1912 5803.tmp 84 PID 1912 wrote to memory of 528 1912 5803.tmp 84 PID 528 wrote to memory of 5104 528 589F.tmp 86 PID 528 wrote to memory of 5104 528 589F.tmp 86 PID 528 wrote to memory of 5104 528 589F.tmp 86 PID 5104 wrote to memory of 3892 5104 590D.tmp 88 PID 5104 wrote to memory of 3892 5104 590D.tmp 88 PID 5104 wrote to memory of 3892 5104 590D.tmp 88 PID 3892 wrote to memory of 4452 3892 59A9.tmp 89 PID 3892 wrote to memory of 4452 3892 59A9.tmp 89 PID 3892 wrote to memory of 4452 3892 59A9.tmp 89 PID 4452 wrote to memory of 3464 4452 5A16.tmp 90 PID 4452 wrote to memory of 3464 4452 5A16.tmp 90 PID 4452 wrote to memory of 3464 4452 5A16.tmp 90 PID 3464 wrote to memory of 2480 3464 5A84.tmp 91 PID 3464 wrote to memory of 2480 3464 5A84.tmp 91 PID 3464 wrote to memory of 2480 3464 5A84.tmp 91 PID 2480 wrote to memory of 3420 2480 5B10.tmp 93 PID 2480 wrote to memory of 3420 2480 5B10.tmp 93 PID 2480 wrote to memory of 3420 2480 5B10.tmp 93 PID 3420 wrote to memory of 5024 3420 5B6E.tmp 94 PID 3420 wrote to memory of 5024 3420 5B6E.tmp 94 PID 3420 wrote to memory of 5024 3420 5B6E.tmp 94 PID 5024 wrote to memory of 3656 5024 5BBC.tmp 95 PID 5024 wrote to memory of 3656 5024 5BBC.tmp 95 PID 5024 wrote to memory of 3656 5024 5BBC.tmp 95 PID 3656 wrote to memory of 4312 3656 5C0A.tmp 96 PID 3656 wrote to memory of 4312 3656 5C0A.tmp 96 PID 3656 wrote to memory of 4312 3656 5C0A.tmp 96 PID 4312 wrote to memory of 2840 4312 5C78.tmp 97 PID 4312 wrote to memory of 2840 4312 5C78.tmp 97 PID 4312 wrote to memory of 2840 4312 5C78.tmp 97 PID 2840 wrote to memory of 3428 2840 5CC6.tmp 98 PID 2840 wrote to memory of 3428 2840 5CC6.tmp 98 PID 2840 wrote to memory of 3428 2840 5CC6.tmp 98 PID 3428 wrote to memory of 3972 3428 5D43.tmp 99 PID 3428 wrote to memory of 3972 3428 5D43.tmp 99 PID 3428 wrote to memory of 3972 3428 5D43.tmp 99 PID 3972 wrote to memory of 2276 3972 5DC0.tmp 100 PID 3972 wrote to memory of 2276 3972 5DC0.tmp 100 PID 3972 wrote to memory of 2276 3972 5DC0.tmp 100 PID 2276 wrote to memory of 1252 2276 5E2D.tmp 101 PID 2276 wrote to memory of 1252 2276 5E2D.tmp 101 PID 2276 wrote to memory of 1252 2276 5E2D.tmp 101 PID 1252 wrote to memory of 3368 1252 5EAA.tmp 102 PID 1252 wrote to memory of 3368 1252 5EAA.tmp 102 PID 1252 wrote to memory of 3368 1252 5EAA.tmp 102 PID 3368 wrote to memory of 3632 3368 5F08.tmp 103 PID 3368 wrote to memory of 3632 3368 5F08.tmp 103 PID 3368 wrote to memory of 3632 3368 5F08.tmp 103 PID 3632 wrote to memory of 4304 3632 5F66.tmp 104 PID 3632 wrote to memory of 4304 3632 5F66.tmp 104 PID 3632 wrote to memory of 4304 3632 5F66.tmp 104 PID 4304 wrote to memory of 4388 4304 5FC3.tmp 105 PID 4304 wrote to memory of 4388 4304 5FC3.tmp 105 PID 4304 wrote to memory of 4388 4304 5FC3.tmp 105 PID 4388 wrote to memory of 2800 4388 6040.tmp 106 PID 4388 wrote to memory of 2800 4388 6040.tmp 106 PID 4388 wrote to memory of 2800 4388 6040.tmp 106 PID 2800 wrote to memory of 436 2800 60AE.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-04_d64353735694661d4544fbe04ce2f179_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-04_d64353735694661d4544fbe04ce2f179_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"23⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"24⤵
- Executes dropped EXE
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"25⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"26⤵
- Executes dropped EXE
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"27⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"28⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"29⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"30⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"31⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"32⤵
- Executes dropped EXE
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"33⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"34⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"35⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"36⤵
- Executes dropped EXE
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"37⤵
- Executes dropped EXE
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"38⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"39⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"40⤵
- Executes dropped EXE
PID:516 -
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"41⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"42⤵
- Executes dropped EXE
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"43⤵
- Executes dropped EXE
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"44⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"45⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"46⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"47⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"48⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"49⤵
- Executes dropped EXE
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"50⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"51⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"52⤵
- Executes dropped EXE
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"53⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"54⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"55⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"56⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"57⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"58⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"59⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"60⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"61⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"62⤵
- Executes dropped EXE
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"63⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"64⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"65⤵
- Executes dropped EXE
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"66⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"67⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\7177.tmp"C:\Users\Admin\AppData\Local\Temp\7177.tmp"68⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"69⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\7232.tmp"C:\Users\Admin\AppData\Local\Temp\7232.tmp"70⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\7290.tmp"C:\Users\Admin\AppData\Local\Temp\7290.tmp"71⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\72EE.tmp"C:\Users\Admin\AppData\Local\Temp\72EE.tmp"72⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"73⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"74⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"75⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"76⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\74C2.tmp"C:\Users\Admin\AppData\Local\Temp\74C2.tmp"77⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"78⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"79⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"80⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"81⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"82⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\7705.tmp"C:\Users\Admin\AppData\Local\Temp\7705.tmp"83⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\7762.tmp"C:\Users\Admin\AppData\Local\Temp\7762.tmp"84⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"85⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"86⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"87⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"88⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\7927.tmp"C:\Users\Admin\AppData\Local\Temp\7927.tmp"89⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"90⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"91⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"92⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"93⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"94⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"95⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"96⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\7C35.tmp"C:\Users\Admin\AppData\Local\Temp\7C35.tmp"97⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\7C92.tmp"C:\Users\Admin\AppData\Local\Temp\7C92.tmp"98⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"99⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"100⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"101⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"102⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"103⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"104⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"105⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\7F52.tmp"C:\Users\Admin\AppData\Local\Temp\7F52.tmp"106⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"107⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\800D.tmp"C:\Users\Admin\AppData\Local\Temp\800D.tmp"108⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"109⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\80C9.tmp"C:\Users\Admin\AppData\Local\Temp\80C9.tmp"110⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\8117.tmp"C:\Users\Admin\AppData\Local\Temp\8117.tmp"111⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\8174.tmp"C:\Users\Admin\AppData\Local\Temp\8174.tmp"112⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\81C3.tmp"C:\Users\Admin\AppData\Local\Temp\81C3.tmp"113⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"114⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"115⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"116⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"117⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\8378.tmp"C:\Users\Admin\AppData\Local\Temp\8378.tmp"118⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\83D6.tmp"C:\Users\Admin\AppData\Local\Temp\83D6.tmp"119⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\8434.tmp"C:\Users\Admin\AppData\Local\Temp\8434.tmp"120⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\8491.tmp"C:\Users\Admin\AppData\Local\Temp\8491.tmp"121⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\84EF.tmp"C:\Users\Admin\AppData\Local\Temp\84EF.tmp"122⤵PID:1984
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-