Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12/06/2024, 15:31
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-12_df4da4046f903d41748d08e175ff67fd_mafia.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2024-06-12_df4da4046f903d41748d08e175ff67fd_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-12_df4da4046f903d41748d08e175ff67fd_mafia.exe
-
Size
765KB
-
MD5
df4da4046f903d41748d08e175ff67fd
-
SHA1
7c038c8810d79d45e01649b311a59d0941cbc99d
-
SHA256
68ba4d03739e9e2c2caac3bf94c530a08aca720bcca13a5e67d7da746a7fc019
-
SHA512
a63594010516f0f0ba88fb41da522111e1e57161d5f2d9b1e10670c15ae2dff0c797f9a6b49cf4e73c497319f5466a6c32a72e2850ab826d2f19e58c8223ce51
-
SSDEEP
12288:ZU5rCOTeiDw/E8bOs7g3nYEnm3ZF5rn5rLOa54U5w5A:ZUQOJDWE8bTannnm3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 512 5F95.tmp 2408 6021.tmp 4968 607F.tmp 1776 613A.tmp 1760 61D7.tmp 3372 6225.tmp 1652 62B1.tmp 332 632E.tmp 1864 637D.tmp 3268 63EA.tmp 372 6467.tmp 4952 64D4.tmp 1900 6532.tmp 4568 6590.tmp 3960 660D.tmp 432 667A.tmp 3756 6707.tmp 1924 6755.tmp 4564 67F1.tmp 5084 683F.tmp 1852 689D.tmp 3040 68FB.tmp 4400 6987.tmp 3924 69E5.tmp 4012 6A43.tmp 4412 6AB0.tmp 3348 6B2D.tmp 3696 6B8B.tmp 3316 6BF8.tmp 1400 6C75.tmp 2704 6CF2.tmp 4044 6D41.tmp 1416 6D9E.tmp 5024 6DEC.tmp 2680 6E3B.tmp 4872 6E89.tmp 3468 6EE6.tmp 4604 6F35.tmp 1904 6F83.tmp 2304 6FE0.tmp 2904 702F.tmp 3528 707D.tmp 1656 70CB.tmp 2860 7119.tmp 880 7167.tmp 4588 71C5.tmp 680 7213.tmp 3520 7261.tmp 764 72AF.tmp 4904 72FD.tmp 1948 735B.tmp 2624 73A9.tmp 4856 7407.tmp 212 7465.tmp 3668 74B3.tmp 3168 7511.tmp 320 755F.tmp 3560 75BC.tmp 400 761A.tmp 4504 7668.tmp 3744 76C6.tmp 2112 7724.tmp 2688 7772.tmp 2160 77C0.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3548 wrote to memory of 512 3548 2024-06-12_df4da4046f903d41748d08e175ff67fd_mafia.exe 80 PID 3548 wrote to memory of 512 3548 2024-06-12_df4da4046f903d41748d08e175ff67fd_mafia.exe 80 PID 3548 wrote to memory of 512 3548 2024-06-12_df4da4046f903d41748d08e175ff67fd_mafia.exe 80 PID 512 wrote to memory of 2408 512 5F95.tmp 81 PID 512 wrote to memory of 2408 512 5F95.tmp 81 PID 512 wrote to memory of 2408 512 5F95.tmp 81 PID 2408 wrote to memory of 4968 2408 6021.tmp 82 PID 2408 wrote to memory of 4968 2408 6021.tmp 82 PID 2408 wrote to memory of 4968 2408 6021.tmp 82 PID 4968 wrote to memory of 1776 4968 607F.tmp 83 PID 4968 wrote to memory of 1776 4968 607F.tmp 83 PID 4968 wrote to memory of 1776 4968 607F.tmp 83 PID 1776 wrote to memory of 1760 1776 613A.tmp 84 PID 1776 wrote to memory of 1760 1776 613A.tmp 84 PID 1776 wrote to memory of 1760 1776 613A.tmp 84 PID 1760 wrote to memory of 3372 1760 61D7.tmp 85 PID 1760 wrote to memory of 3372 1760 61D7.tmp 85 PID 1760 wrote to memory of 3372 1760 61D7.tmp 85 PID 3372 wrote to memory of 1652 3372 6225.tmp 86 PID 3372 wrote to memory of 1652 3372 6225.tmp 86 PID 3372 wrote to memory of 1652 3372 6225.tmp 86 PID 1652 wrote to memory of 332 1652 62B1.tmp 87 PID 1652 wrote to memory of 332 1652 62B1.tmp 87 PID 1652 wrote to memory of 332 1652 62B1.tmp 87 PID 332 wrote to memory of 1864 332 632E.tmp 88 PID 332 wrote to memory of 1864 332 632E.tmp 88 PID 332 wrote to memory of 1864 332 632E.tmp 88 PID 1864 wrote to memory of 3268 1864 637D.tmp 89 PID 1864 wrote to memory of 3268 1864 637D.tmp 89 PID 1864 wrote to memory of 3268 1864 637D.tmp 89 PID 3268 wrote to memory of 372 3268 63EA.tmp 90 PID 3268 wrote to memory of 372 3268 63EA.tmp 90 PID 3268 wrote to memory of 372 3268 63EA.tmp 90 PID 372 wrote to memory of 4952 372 6467.tmp 91 PID 372 wrote to memory of 4952 372 6467.tmp 91 PID 372 wrote to memory of 4952 372 6467.tmp 91 PID 4952 wrote to memory of 1900 4952 64D4.tmp 92 PID 4952 wrote to memory of 1900 4952 64D4.tmp 92 PID 4952 wrote to memory of 1900 4952 64D4.tmp 92 PID 1900 wrote to memory of 4568 1900 6532.tmp 93 PID 1900 wrote to memory of 4568 1900 6532.tmp 93 PID 1900 wrote to memory of 4568 1900 6532.tmp 93 PID 4568 wrote to memory of 3960 4568 6590.tmp 94 PID 4568 wrote to memory of 3960 4568 6590.tmp 94 PID 4568 wrote to memory of 3960 4568 6590.tmp 94 PID 3960 wrote to memory of 432 3960 660D.tmp 95 PID 3960 wrote to memory of 432 3960 660D.tmp 95 PID 3960 wrote to memory of 432 3960 660D.tmp 95 PID 432 wrote to memory of 3756 432 667A.tmp 96 PID 432 wrote to memory of 3756 432 667A.tmp 96 PID 432 wrote to memory of 3756 432 667A.tmp 96 PID 3756 wrote to memory of 1924 3756 6707.tmp 97 PID 3756 wrote to memory of 1924 3756 6707.tmp 97 PID 3756 wrote to memory of 1924 3756 6707.tmp 97 PID 1924 wrote to memory of 4564 1924 6755.tmp 98 PID 1924 wrote to memory of 4564 1924 6755.tmp 98 PID 1924 wrote to memory of 4564 1924 6755.tmp 98 PID 4564 wrote to memory of 5084 4564 67F1.tmp 99 PID 4564 wrote to memory of 5084 4564 67F1.tmp 99 PID 4564 wrote to memory of 5084 4564 67F1.tmp 99 PID 5084 wrote to memory of 1852 5084 683F.tmp 100 PID 5084 wrote to memory of 1852 5084 683F.tmp 100 PID 5084 wrote to memory of 1852 5084 683F.tmp 100 PID 1852 wrote to memory of 3040 1852 689D.tmp 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-12_df4da4046f903d41748d08e175ff67fd_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-12_df4da4046f903d41748d08e175ff67fd_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"23⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"24⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"25⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"26⤵
- Executes dropped EXE
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"27⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"28⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"29⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"30⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"31⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"32⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"33⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"34⤵
- Executes dropped EXE
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"35⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"36⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"37⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"38⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"39⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"40⤵
- Executes dropped EXE
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"41⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"42⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"43⤵
- Executes dropped EXE
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"44⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"45⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"46⤵
- Executes dropped EXE
PID:880 -
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"47⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\7213.tmp"C:\Users\Admin\AppData\Local\Temp\7213.tmp"48⤵
- Executes dropped EXE
PID:680 -
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"49⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"50⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"51⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"52⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"53⤵
- Executes dropped EXE
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"54⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"55⤵
- Executes dropped EXE
PID:212 -
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"56⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"57⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"58⤵
- Executes dropped EXE
PID:320 -
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"59⤵
- Executes dropped EXE
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"60⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"61⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"62⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\7724.tmp"C:\Users\Admin\AppData\Local\Temp\7724.tmp"63⤵
- Executes dropped EXE
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\7772.tmp"C:\Users\Admin\AppData\Local\Temp\7772.tmp"64⤵
- Executes dropped EXE
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"65⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\780E.tmp"C:\Users\Admin\AppData\Local\Temp\780E.tmp"66⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\786C.tmp"C:\Users\Admin\AppData\Local\Temp\786C.tmp"67⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\78BA.tmp"C:\Users\Admin\AppData\Local\Temp\78BA.tmp"68⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\7908.tmp"C:\Users\Admin\AppData\Local\Temp\7908.tmp"69⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\7956.tmp"C:\Users\Admin\AppData\Local\Temp\7956.tmp"70⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\79A4.tmp"C:\Users\Admin\AppData\Local\Temp\79A4.tmp"71⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"72⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"73⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"74⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"75⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"76⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\7B89.tmp"C:\Users\Admin\AppData\Local\Temp\7B89.tmp"77⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"78⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\7C35.tmp"C:\Users\Admin\AppData\Local\Temp\7C35.tmp"79⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\7C83.tmp"C:\Users\Admin\AppData\Local\Temp\7C83.tmp"80⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"81⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"82⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"83⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"84⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\7E09.tmp"C:\Users\Admin\AppData\Local\Temp\7E09.tmp"85⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\7E67.tmp"C:\Users\Admin\AppData\Local\Temp\7E67.tmp"86⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"87⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\7F03.tmp"C:\Users\Admin\AppData\Local\Temp\7F03.tmp"88⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\7F52.tmp"C:\Users\Admin\AppData\Local\Temp\7F52.tmp"89⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"90⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\800D.tmp"C:\Users\Admin\AppData\Local\Temp\800D.tmp"91⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\805B.tmp"C:\Users\Admin\AppData\Local\Temp\805B.tmp"92⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\80A9.tmp"C:\Users\Admin\AppData\Local\Temp\80A9.tmp"93⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\80F7.tmp"C:\Users\Admin\AppData\Local\Temp\80F7.tmp"94⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\8146.tmp"C:\Users\Admin\AppData\Local\Temp\8146.tmp"95⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\81A3.tmp"C:\Users\Admin\AppData\Local\Temp\81A3.tmp"96⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\8201.tmp"C:\Users\Admin\AppData\Local\Temp\8201.tmp"97⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\825F.tmp"C:\Users\Admin\AppData\Local\Temp\825F.tmp"98⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\82AD.tmp"C:\Users\Admin\AppData\Local\Temp\82AD.tmp"99⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\82FB.tmp"C:\Users\Admin\AppData\Local\Temp\82FB.tmp"100⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\8349.tmp"C:\Users\Admin\AppData\Local\Temp\8349.tmp"101⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"102⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\83F5.tmp"C:\Users\Admin\AppData\Local\Temp\83F5.tmp"103⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"104⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\8491.tmp"C:\Users\Admin\AppData\Local\Temp\8491.tmp"105⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\84DF.tmp"C:\Users\Admin\AppData\Local\Temp\84DF.tmp"106⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\853D.tmp"C:\Users\Admin\AppData\Local\Temp\853D.tmp"107⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\859B.tmp"C:\Users\Admin\AppData\Local\Temp\859B.tmp"108⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"109⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\8637.tmp"C:\Users\Admin\AppData\Local\Temp\8637.tmp"110⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\8685.tmp"C:\Users\Admin\AppData\Local\Temp\8685.tmp"111⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\86F3.tmp"C:\Users\Admin\AppData\Local\Temp\86F3.tmp"112⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\8741.tmp"C:\Users\Admin\AppData\Local\Temp\8741.tmp"113⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\879F.tmp"C:\Users\Admin\AppData\Local\Temp\879F.tmp"114⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"115⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"116⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\8899.tmp"C:\Users\Admin\AppData\Local\Temp\8899.tmp"117⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\88E7.tmp"C:\Users\Admin\AppData\Local\Temp\88E7.tmp"118⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"119⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\8993.tmp"C:\Users\Admin\AppData\Local\Temp\8993.tmp"120⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\89E1.tmp"C:\Users\Admin\AppData\Local\Temp\89E1.tmp"121⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"122⤵PID:724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-