Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
06/06/2024, 10:26
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-06_67968539e3de556798991e70c587bd49_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-06_67968539e3de556798991e70c587bd49_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-06_67968539e3de556798991e70c587bd49_mafia.exe
-
Size
520KB
-
MD5
67968539e3de556798991e70c587bd49
-
SHA1
2eb7f5be40b7244c38fa28e2aae733f9e3a434f4
-
SHA256
950fae2af383fdaaa09e028b39ddb7a8dd0cc7ec7000c4c1e4d3c6663a0a2e4c
-
SHA512
d6c0958884360c7d5b6b2687103f163e84ee79fb1617db73cf8fec1a09dec3018b326da955f58aee8a24e74e066bc1fb568573577d0e5fcc1414aa4a056830be
-
SSDEEP
12288:roRXOQjmOyBJa2ajoqTtoDSMxg/Kt2wFcNNZ:rogQ9y/a2rSouMxg/Kt2+cNN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2492 59B9.tmp 4696 5A26.tmp 3468 5A93.tmp 4520 5B01.tmp 3296 5B8D.tmp 3060 5C1A.tmp 848 5C97.tmp 2456 5CF5.tmp 4744 5D52.tmp 1428 5DA1.tmp 1668 5E0E.tmp 1180 5E6C.tmp 4632 5EBA.tmp 2192 5F27.tmp 1944 5FA4.tmp 4724 6021.tmp 808 608F.tmp 4036 60EC.tmp 884 6179.tmp 1968 61D7.tmp 5024 6254.tmp 3400 62E0.tmp 4732 633E.tmp 2120 638C.tmp 1852 63FA.tmp 2312 6457.tmp 2676 64E4.tmp 3720 6532.tmp 3392 65BF.tmp 3120 660D.tmp 2360 666B.tmp 1992 66D8.tmp 2620 6736.tmp 4188 6793.tmp 4676 67E2.tmp 2356 6830.tmp 4116 687E.tmp 3748 68CC.tmp 1956 691A.tmp 3960 6968.tmp 3372 69B6.tmp 1724 6A04.tmp 260 6A62.tmp 776 6AB0.tmp 1476 6AFE.tmp 2516 6B4D.tmp 2696 6BAA.tmp 5096 6BF8.tmp 4804 6C47.tmp 1308 6C95.tmp 1668 6CE3.tmp 2672 6D31.tmp 3832 6D7F.tmp 2812 6DCD.tmp 2192 6E1B.tmp 3280 6E69.tmp 3104 6EB8.tmp 2204 6F15.tmp 4924 6F73.tmp 2272 6FD1.tmp 4036 701F.tmp 3712 706D.tmp 3376 70BB.tmp 3460 7109.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3116 wrote to memory of 2492 3116 2024-06-06_67968539e3de556798991e70c587bd49_mafia.exe 83 PID 3116 wrote to memory of 2492 3116 2024-06-06_67968539e3de556798991e70c587bd49_mafia.exe 83 PID 3116 wrote to memory of 2492 3116 2024-06-06_67968539e3de556798991e70c587bd49_mafia.exe 83 PID 2492 wrote to memory of 4696 2492 59B9.tmp 84 PID 2492 wrote to memory of 4696 2492 59B9.tmp 84 PID 2492 wrote to memory of 4696 2492 59B9.tmp 84 PID 4696 wrote to memory of 3468 4696 5A26.tmp 85 PID 4696 wrote to memory of 3468 4696 5A26.tmp 85 PID 4696 wrote to memory of 3468 4696 5A26.tmp 85 PID 3468 wrote to memory of 4520 3468 5A93.tmp 86 PID 3468 wrote to memory of 4520 3468 5A93.tmp 86 PID 3468 wrote to memory of 4520 3468 5A93.tmp 86 PID 4520 wrote to memory of 3296 4520 5B01.tmp 87 PID 4520 wrote to memory of 3296 4520 5B01.tmp 87 PID 4520 wrote to memory of 3296 4520 5B01.tmp 87 PID 3296 wrote to memory of 3060 3296 5B8D.tmp 89 PID 3296 wrote to memory of 3060 3296 5B8D.tmp 89 PID 3296 wrote to memory of 3060 3296 5B8D.tmp 89 PID 3060 wrote to memory of 848 3060 5C1A.tmp 90 PID 3060 wrote to memory of 848 3060 5C1A.tmp 90 PID 3060 wrote to memory of 848 3060 5C1A.tmp 90 PID 848 wrote to memory of 2456 848 5C97.tmp 92 PID 848 wrote to memory of 2456 848 5C97.tmp 92 PID 848 wrote to memory of 2456 848 5C97.tmp 92 PID 2456 wrote to memory of 4744 2456 5CF5.tmp 94 PID 2456 wrote to memory of 4744 2456 5CF5.tmp 94 PID 2456 wrote to memory of 4744 2456 5CF5.tmp 94 PID 4744 wrote to memory of 1428 4744 5D52.tmp 95 PID 4744 wrote to memory of 1428 4744 5D52.tmp 95 PID 4744 wrote to memory of 1428 4744 5D52.tmp 95 PID 1428 wrote to memory of 1668 1428 5DA1.tmp 96 PID 1428 wrote to memory of 1668 1428 5DA1.tmp 96 PID 1428 wrote to memory of 1668 1428 5DA1.tmp 96 PID 1668 wrote to memory of 1180 1668 5E0E.tmp 97 PID 1668 wrote to memory of 1180 1668 5E0E.tmp 97 PID 1668 wrote to memory of 1180 1668 5E0E.tmp 97 PID 1180 wrote to memory of 4632 1180 5E6C.tmp 98 PID 1180 wrote to memory of 4632 1180 5E6C.tmp 98 PID 1180 wrote to memory of 4632 1180 5E6C.tmp 98 PID 4632 wrote to memory of 2192 4632 5EBA.tmp 99 PID 4632 wrote to memory of 2192 4632 5EBA.tmp 99 PID 4632 wrote to memory of 2192 4632 5EBA.tmp 99 PID 2192 wrote to memory of 1944 2192 5F27.tmp 100 PID 2192 wrote to memory of 1944 2192 5F27.tmp 100 PID 2192 wrote to memory of 1944 2192 5F27.tmp 100 PID 1944 wrote to memory of 4724 1944 5FA4.tmp 101 PID 1944 wrote to memory of 4724 1944 5FA4.tmp 101 PID 1944 wrote to memory of 4724 1944 5FA4.tmp 101 PID 4724 wrote to memory of 808 4724 6021.tmp 102 PID 4724 wrote to memory of 808 4724 6021.tmp 102 PID 4724 wrote to memory of 808 4724 6021.tmp 102 PID 808 wrote to memory of 4036 808 608F.tmp 103 PID 808 wrote to memory of 4036 808 608F.tmp 103 PID 808 wrote to memory of 4036 808 608F.tmp 103 PID 4036 wrote to memory of 884 4036 60EC.tmp 104 PID 4036 wrote to memory of 884 4036 60EC.tmp 104 PID 4036 wrote to memory of 884 4036 60EC.tmp 104 PID 884 wrote to memory of 1968 884 6179.tmp 105 PID 884 wrote to memory of 1968 884 6179.tmp 105 PID 884 wrote to memory of 1968 884 6179.tmp 105 PID 1968 wrote to memory of 5024 1968 61D7.tmp 106 PID 1968 wrote to memory of 5024 1968 61D7.tmp 106 PID 1968 wrote to memory of 5024 1968 61D7.tmp 106 PID 5024 wrote to memory of 3400 5024 6254.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-06_67968539e3de556798991e70c587bd49_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-06_67968539e3de556798991e70c587bd49_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"23⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"24⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"25⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"26⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"27⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"28⤵
- Executes dropped EXE
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"29⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"30⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"31⤵
- Executes dropped EXE
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"32⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"33⤵
- Executes dropped EXE
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"34⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"35⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"36⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"37⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"38⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"39⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"40⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"41⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"42⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"43⤵
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"44⤵
- Executes dropped EXE
PID:260 -
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"45⤵
- Executes dropped EXE
PID:776 -
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"46⤵
- Executes dropped EXE
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"47⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"48⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"49⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"50⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"51⤵
- Executes dropped EXE
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"52⤵
- Executes dropped EXE
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"53⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"54⤵
- Executes dropped EXE
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"55⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"56⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"57⤵
- Executes dropped EXE
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"58⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"59⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"60⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"61⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"62⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"63⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"64⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"65⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"66⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"67⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"68⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"69⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"70⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"71⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"72⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"73⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"74⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"75⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"76⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"77⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"78⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"79⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"80⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"81⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"82⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\7743.tmp"C:\Users\Admin\AppData\Local\Temp\7743.tmp"83⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\7791.tmp"C:\Users\Admin\AppData\Local\Temp\7791.tmp"84⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\77DF.tmp"C:\Users\Admin\AppData\Local\Temp\77DF.tmp"85⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\783D.tmp"C:\Users\Admin\AppData\Local\Temp\783D.tmp"86⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\789B.tmp"C:\Users\Admin\AppData\Local\Temp\789B.tmp"87⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"88⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"89⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\79A4.tmp"C:\Users\Admin\AppData\Local\Temp\79A4.tmp"90⤵PID:260
-
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"91⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\7A50.tmp"C:\Users\Admin\AppData\Local\Temp\7A50.tmp"92⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"93⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"94⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"95⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"96⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\7C15.tmp"C:\Users\Admin\AppData\Local\Temp\7C15.tmp"97⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\7C73.tmp"C:\Users\Admin\AppData\Local\Temp\7C73.tmp"98⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"99⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"100⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"101⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"102⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\7E38.tmp"C:\Users\Admin\AppData\Local\Temp\7E38.tmp"103⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\7E96.tmp"C:\Users\Admin\AppData\Local\Temp\7E96.tmp"104⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"105⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\7F52.tmp"C:\Users\Admin\AppData\Local\Temp\7F52.tmp"106⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"107⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"108⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\805B.tmp"C:\Users\Admin\AppData\Local\Temp\805B.tmp"109⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\80B9.tmp"C:\Users\Admin\AppData\Local\Temp\80B9.tmp"110⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\8107.tmp"C:\Users\Admin\AppData\Local\Temp\8107.tmp"111⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\8165.tmp"C:\Users\Admin\AppData\Local\Temp\8165.tmp"112⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\81B3.tmp"C:\Users\Admin\AppData\Local\Temp\81B3.tmp"113⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"114⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"115⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"116⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"117⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\8378.tmp"C:\Users\Admin\AppData\Local\Temp\8378.tmp"118⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\83C6.tmp"C:\Users\Admin\AppData\Local\Temp\83C6.tmp"119⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\8414.tmp"C:\Users\Admin\AppData\Local\Temp\8414.tmp"120⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\8472.tmp"C:\Users\Admin\AppData\Local\Temp\8472.tmp"121⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\84C0.tmp"C:\Users\Admin\AppData\Local\Temp\84C0.tmp"122⤵PID:936
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-