Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
07/06/2024, 08:51
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-07_518346a3a6e5d0cf89a81ea52bf5171d_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-06-07_518346a3a6e5d0cf89a81ea52bf5171d_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-07_518346a3a6e5d0cf89a81ea52bf5171d_mafia.exe
-
Size
765KB
-
MD5
518346a3a6e5d0cf89a81ea52bf5171d
-
SHA1
2fae3629eefe68fa56385218513d0117c2491dbc
-
SHA256
b11b3131d6d3756025ced7f2e5db05f6b5394b0495c61a8ca98040a1b49b28ed
-
SHA512
c949141bf292934def082c4d910c0fb51cd43967ab8e778c9ad63fe31a7991aabe181945a58d575fd5848604755e05feb09aba0b2b0b329b357b58bd0368524a
-
SSDEEP
12288:ZU5rCOTeiD6mcgIeQXrJN+Te3ZF5rn5rLOa54U5w5A:ZUQOJDnMlr+e3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2256 63EA.tmp 1476 6467.tmp 2196 64E4.tmp 4992 6561.tmp 708 65DE.tmp 1480 662C.tmp 1732 668A.tmp 2000 66D8.tmp 3500 6765.tmp 2668 67C2.tmp 2936 6820.tmp 796 689D.tmp 8 690A.tmp 3760 6959.tmp 4808 69A7.tmp 2528 6A04.tmp 5092 6AEF.tmp 1524 6B5C.tmp 4528 6BCA.tmp 5016 6C27.tmp 680 6C75.tmp 2784 6CD3.tmp 4532 6D31.tmp 4948 6D8F.tmp 4844 6DEC.tmp 2328 6E4A.tmp 3984 6EE6.tmp 4520 6F54.tmp 2468 6FA2.tmp 2524 7000.tmp 2316 705D.tmp 1736 70AC.tmp 4296 70FA.tmp 432 7148.tmp 896 71B5.tmp 860 7203.tmp 1476 7251.tmp 1880 72A0.tmp 2196 72EE.tmp 3936 733C.tmp 4572 739A.tmp 1548 73E8.tmp 4340 7436.tmp 2412 7484.tmp 1696 74D2.tmp 1248 7520.tmp 1008 756E.tmp 4492 75BC.tmp 1780 760B.tmp 4420 7659.tmp 1572 76A7.tmp 4880 76F5.tmp 4792 7743.tmp 1132 7791.tmp 3956 77DF.tmp 1612 782D.tmp 4768 787C.tmp 4884 78CA.tmp 628 7918.tmp 4204 7966.tmp 3884 79B4.tmp 4628 7A02.tmp 3372 7A50.tmp 2504 7A9E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4708 wrote to memory of 2256 4708 2024-06-07_518346a3a6e5d0cf89a81ea52bf5171d_mafia.exe 82 PID 4708 wrote to memory of 2256 4708 2024-06-07_518346a3a6e5d0cf89a81ea52bf5171d_mafia.exe 82 PID 4708 wrote to memory of 2256 4708 2024-06-07_518346a3a6e5d0cf89a81ea52bf5171d_mafia.exe 82 PID 2256 wrote to memory of 1476 2256 63EA.tmp 124 PID 2256 wrote to memory of 1476 2256 63EA.tmp 124 PID 2256 wrote to memory of 1476 2256 63EA.tmp 124 PID 1476 wrote to memory of 2196 1476 6467.tmp 913 PID 1476 wrote to memory of 2196 1476 6467.tmp 913 PID 1476 wrote to memory of 2196 1476 6467.tmp 913 PID 2196 wrote to memory of 4992 2196 64E4.tmp 633 PID 2196 wrote to memory of 4992 2196 64E4.tmp 633 PID 2196 wrote to memory of 4992 2196 64E4.tmp 633 PID 4992 wrote to memory of 708 4992 6561.tmp 130 PID 4992 wrote to memory of 708 4992 6561.tmp 130 PID 4992 wrote to memory of 708 4992 6561.tmp 130 PID 708 wrote to memory of 1480 708 65DE.tmp 89 PID 708 wrote to memory of 1480 708 65DE.tmp 89 PID 708 wrote to memory of 1480 708 65DE.tmp 89 PID 1480 wrote to memory of 1732 1480 662C.tmp 918 PID 1480 wrote to memory of 1732 1480 662C.tmp 918 PID 1480 wrote to memory of 1732 1480 662C.tmp 918 PID 1732 wrote to memory of 2000 1732 668A.tmp 1224 PID 1732 wrote to memory of 2000 1732 668A.tmp 1224 PID 1732 wrote to memory of 2000 1732 668A.tmp 1224 PID 2000 wrote to memory of 3500 2000 66D8.tmp 1155 PID 2000 wrote to memory of 3500 2000 66D8.tmp 1155 PID 2000 wrote to memory of 3500 2000 66D8.tmp 1155 PID 3500 wrote to memory of 2668 3500 6765.tmp 866 PID 3500 wrote to memory of 2668 3500 6765.tmp 866 PID 3500 wrote to memory of 2668 3500 6765.tmp 866 PID 2668 wrote to memory of 2936 2668 67C2.tmp 762 PID 2668 wrote to memory of 2936 2668 67C2.tmp 762 PID 2668 wrote to memory of 2936 2668 67C2.tmp 762 PID 2936 wrote to memory of 796 2936 6820.tmp 1321 PID 2936 wrote to memory of 796 2936 6820.tmp 1321 PID 2936 wrote to memory of 796 2936 6820.tmp 1321 PID 796 wrote to memory of 8 796 689D.tmp 826 PID 796 wrote to memory of 8 796 689D.tmp 826 PID 796 wrote to memory of 8 796 689D.tmp 826 PID 8 wrote to memory of 3760 8 690A.tmp 886 PID 8 wrote to memory of 3760 8 690A.tmp 886 PID 8 wrote to memory of 3760 8 690A.tmp 886 PID 3760 wrote to memory of 4808 3760 6959.tmp 100 PID 3760 wrote to memory of 4808 3760 6959.tmp 100 PID 3760 wrote to memory of 4808 3760 6959.tmp 100 PID 4808 wrote to memory of 2528 4808 69A7.tmp 707 PID 4808 wrote to memory of 2528 4808 69A7.tmp 707 PID 4808 wrote to memory of 2528 4808 69A7.tmp 707 PID 2528 wrote to memory of 5092 2528 6A04.tmp 1075 PID 2528 wrote to memory of 5092 2528 6A04.tmp 1075 PID 2528 wrote to memory of 5092 2528 6A04.tmp 1075 PID 5092 wrote to memory of 1524 5092 6AEF.tmp 557 PID 5092 wrote to memory of 1524 5092 6AEF.tmp 557 PID 5092 wrote to memory of 1524 5092 6AEF.tmp 557 PID 1524 wrote to memory of 4528 1524 6B5C.tmp 1281 PID 1524 wrote to memory of 4528 1524 6B5C.tmp 1281 PID 1524 wrote to memory of 4528 1524 6B5C.tmp 1281 PID 4528 wrote to memory of 5016 4528 6BCA.tmp 741 PID 4528 wrote to memory of 5016 4528 6BCA.tmp 741 PID 4528 wrote to memory of 5016 4528 6BCA.tmp 741 PID 5016 wrote to memory of 680 5016 6C27.tmp 563 PID 5016 wrote to memory of 680 5016 6C27.tmp 563 PID 5016 wrote to memory of 680 5016 6C27.tmp 563 PID 680 wrote to memory of 2784 680 6C75.tmp 790
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-07_518346a3a6e5d0cf89a81ea52bf5171d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-07_518346a3a6e5d0cf89a81ea52bf5171d_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"23⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"24⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"25⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"26⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"27⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"28⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"29⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"30⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"31⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"32⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"33⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"34⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\7148.tmp"C:\Users\Admin\AppData\Local\Temp\7148.tmp"35⤵
- Executes dropped EXE
PID:432 -
C:\Users\Admin\AppData\Local\Temp\71B5.tmp"C:\Users\Admin\AppData\Local\Temp\71B5.tmp"36⤵
- Executes dropped EXE
PID:896 -
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"37⤵
- Executes dropped EXE
PID:860 -
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"38⤵
- Executes dropped EXE
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\72A0.tmp"C:\Users\Admin\AppData\Local\Temp\72A0.tmp"39⤵
- Executes dropped EXE
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\72EE.tmp"C:\Users\Admin\AppData\Local\Temp\72EE.tmp"40⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"41⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"42⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\73E8.tmp"C:\Users\Admin\AppData\Local\Temp\73E8.tmp"43⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"44⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"45⤵
- Executes dropped EXE
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"46⤵
- Executes dropped EXE
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"47⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"48⤵
- Executes dropped EXE
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"49⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\760B.tmp"C:\Users\Admin\AppData\Local\Temp\760B.tmp"50⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\7659.tmp"C:\Users\Admin\AppData\Local\Temp\7659.tmp"51⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"52⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\76F5.tmp"C:\Users\Admin\AppData\Local\Temp\76F5.tmp"53⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\7743.tmp"C:\Users\Admin\AppData\Local\Temp\7743.tmp"54⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\7791.tmp"C:\Users\Admin\AppData\Local\Temp\7791.tmp"55⤵
- Executes dropped EXE
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\77DF.tmp"C:\Users\Admin\AppData\Local\Temp\77DF.tmp"56⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\782D.tmp"C:\Users\Admin\AppData\Local\Temp\782D.tmp"57⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"58⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"59⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\7918.tmp"C:\Users\Admin\AppData\Local\Temp\7918.tmp"60⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\7966.tmp"C:\Users\Admin\AppData\Local\Temp\7966.tmp"61⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\79B4.tmp"C:\Users\Admin\AppData\Local\Temp\79B4.tmp"62⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\7A02.tmp"C:\Users\Admin\AppData\Local\Temp\7A02.tmp"63⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\7A50.tmp"C:\Users\Admin\AppData\Local\Temp\7A50.tmp"64⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"65⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\7AED.tmp"C:\Users\Admin\AppData\Local\Temp\7AED.tmp"66⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"67⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\7B89.tmp"C:\Users\Admin\AppData\Local\Temp\7B89.tmp"68⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"69⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"70⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\7C73.tmp"C:\Users\Admin\AppData\Local\Temp\7C73.tmp"71⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"72⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"73⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"74⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"75⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"76⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\7E48.tmp"C:\Users\Admin\AppData\Local\Temp\7E48.tmp"77⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\7E96.tmp"C:\Users\Admin\AppData\Local\Temp\7E96.tmp"78⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"79⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\7F32.tmp"C:\Users\Admin\AppData\Local\Temp\7F32.tmp"80⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\7F80.tmp"C:\Users\Admin\AppData\Local\Temp\7F80.tmp"81⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"82⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\801D.tmp"C:\Users\Admin\AppData\Local\Temp\801D.tmp"83⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"84⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\80B9.tmp"C:\Users\Admin\AppData\Local\Temp\80B9.tmp"85⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\8107.tmp"C:\Users\Admin\AppData\Local\Temp\8107.tmp"86⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\8155.tmp"C:\Users\Admin\AppData\Local\Temp\8155.tmp"87⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\81A3.tmp"C:\Users\Admin\AppData\Local\Temp\81A3.tmp"88⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\81F1.tmp"C:\Users\Admin\AppData\Local\Temp\81F1.tmp"89⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\8240.tmp"C:\Users\Admin\AppData\Local\Temp\8240.tmp"90⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\828E.tmp"C:\Users\Admin\AppData\Local\Temp\828E.tmp"91⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\82DC.tmp"C:\Users\Admin\AppData\Local\Temp\82DC.tmp"92⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"93⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\8378.tmp"C:\Users\Admin\AppData\Local\Temp\8378.tmp"94⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\83C6.tmp"C:\Users\Admin\AppData\Local\Temp\83C6.tmp"95⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\8414.tmp"C:\Users\Admin\AppData\Local\Temp\8414.tmp"96⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\8462.tmp"C:\Users\Admin\AppData\Local\Temp\8462.tmp"97⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\84B1.tmp"C:\Users\Admin\AppData\Local\Temp\84B1.tmp"98⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\84FF.tmp"C:\Users\Admin\AppData\Local\Temp\84FF.tmp"99⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\854D.tmp"C:\Users\Admin\AppData\Local\Temp\854D.tmp"100⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\859B.tmp"C:\Users\Admin\AppData\Local\Temp\859B.tmp"101⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"102⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\8637.tmp"C:\Users\Admin\AppData\Local\Temp\8637.tmp"103⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\8685.tmp"C:\Users\Admin\AppData\Local\Temp\8685.tmp"104⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\86D3.tmp"C:\Users\Admin\AppData\Local\Temp\86D3.tmp"105⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\8722.tmp"C:\Users\Admin\AppData\Local\Temp\8722.tmp"106⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\8770.tmp"C:\Users\Admin\AppData\Local\Temp\8770.tmp"107⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\87BE.tmp"C:\Users\Admin\AppData\Local\Temp\87BE.tmp"108⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\880C.tmp"C:\Users\Admin\AppData\Local\Temp\880C.tmp"109⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\885A.tmp"C:\Users\Admin\AppData\Local\Temp\885A.tmp"110⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\88A8.tmp"C:\Users\Admin\AppData\Local\Temp\88A8.tmp"111⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\88F6.tmp"C:\Users\Admin\AppData\Local\Temp\88F6.tmp"112⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"113⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\8993.tmp"C:\Users\Admin\AppData\Local\Temp\8993.tmp"114⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\89E1.tmp"C:\Users\Admin\AppData\Local\Temp\89E1.tmp"115⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"116⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"117⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"118⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\8B29.tmp"C:\Users\Admin\AppData\Local\Temp\8B29.tmp"119⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\8B77.tmp"C:\Users\Admin\AppData\Local\Temp\8B77.tmp"120⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"121⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\8C13.tmp"C:\Users\Admin\AppData\Local\Temp\8C13.tmp"122⤵PID:3140
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-