Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24/06/2024, 18:46
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-24_cc3337c690becc574f4ecf517267e7e5_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-06-24_cc3337c690becc574f4ecf517267e7e5_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-24_cc3337c690becc574f4ecf517267e7e5_mafia.exe
-
Size
536KB
-
MD5
cc3337c690becc574f4ecf517267e7e5
-
SHA1
8afab0d25d15a6ec13edff62163f5ed669de738b
-
SHA256
1a0f8c80d6278385a8e69aa900dd4944dc7964ad218b8ec83e6a1c89af2d8c7a
-
SHA512
a2e892d774ec2412538f5d32b5fec3a8c413f5ccd811e583b1f402b8a62de2f352cb385eb9b6925930ead14db4fdc79b1e88b06f728dca1ee61ce04d55b0fce2
-
SSDEEP
12288:wU5rCOTeiUwXuOxj0qYwyHl4KZPOF7K7MqhbRFb0APQIZxVJ0ZT9:wUQOJUw+qwqYbbmhGPcIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 652 5004.tmp 4848 50FE.tmp 3960 517B.tmp 3308 5246.tmp 984 52D3.tmp 2512 5350.tmp 2596 53DD.tmp 1352 5469.tmp 756 5505.tmp 4940 5592.tmp 2524 55FF.tmp 1964 56BB.tmp 3780 5738.tmp 2084 57C5.tmp 1664 5861.tmp 4784 590D.tmp 2684 59A9.tmp 4944 5A45.tmp 2016 5AB3.tmp 1212 5B4F.tmp 2868 5BEB.tmp 4772 5C97.tmp 2280 5D14.tmp 4456 5D91.tmp 5040 5E2D.tmp 3764 5EC9.tmp 228 5F75.tmp 4272 6021.tmp 1856 60DD.tmp 2672 6169.tmp 2252 6206.tmp 3964 6292.tmp 2244 634E.tmp 2568 63BB.tmp 3532 6419.tmp 4676 6496.tmp 3304 6503.tmp 3600 6561.tmp 4552 65DE.tmp 4896 665B.tmp 4608 66A9.tmp 4512 6707.tmp 4036 6755.tmp 336 67A3.tmp 1088 67F1.tmp 3320 684F.tmp 1576 68AD.tmp 1644 692A.tmp 2912 6987.tmp 4308 69E5.tmp 2504 6A33.tmp 3952 6A81.tmp 4360 6AD0.tmp 680 6B2D.tmp 2564 6B8B.tmp 5052 6BE9.tmp 740 6C37.tmp 2264 6C95.tmp 860 6CE3.tmp 3324 6D41.tmp 2512 6D9E.tmp 1080 6DEC.tmp 3180 6E3B.tmp 1152 6E89.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4488 wrote to memory of 652 4488 2024-06-24_cc3337c690becc574f4ecf517267e7e5_mafia.exe 80 PID 4488 wrote to memory of 652 4488 2024-06-24_cc3337c690becc574f4ecf517267e7e5_mafia.exe 80 PID 4488 wrote to memory of 652 4488 2024-06-24_cc3337c690becc574f4ecf517267e7e5_mafia.exe 80 PID 652 wrote to memory of 4848 652 5004.tmp 81 PID 652 wrote to memory of 4848 652 5004.tmp 81 PID 652 wrote to memory of 4848 652 5004.tmp 81 PID 4848 wrote to memory of 3960 4848 50FE.tmp 82 PID 4848 wrote to memory of 3960 4848 50FE.tmp 82 PID 4848 wrote to memory of 3960 4848 50FE.tmp 82 PID 3960 wrote to memory of 3308 3960 517B.tmp 83 PID 3960 wrote to memory of 3308 3960 517B.tmp 83 PID 3960 wrote to memory of 3308 3960 517B.tmp 83 PID 3308 wrote to memory of 984 3308 5246.tmp 84 PID 3308 wrote to memory of 984 3308 5246.tmp 84 PID 3308 wrote to memory of 984 3308 5246.tmp 84 PID 984 wrote to memory of 2512 984 52D3.tmp 85 PID 984 wrote to memory of 2512 984 52D3.tmp 85 PID 984 wrote to memory of 2512 984 52D3.tmp 85 PID 2512 wrote to memory of 2596 2512 5350.tmp 86 PID 2512 wrote to memory of 2596 2512 5350.tmp 86 PID 2512 wrote to memory of 2596 2512 5350.tmp 86 PID 2596 wrote to memory of 1352 2596 53DD.tmp 87 PID 2596 wrote to memory of 1352 2596 53DD.tmp 87 PID 2596 wrote to memory of 1352 2596 53DD.tmp 87 PID 1352 wrote to memory of 756 1352 5469.tmp 88 PID 1352 wrote to memory of 756 1352 5469.tmp 88 PID 1352 wrote to memory of 756 1352 5469.tmp 88 PID 756 wrote to memory of 4940 756 5505.tmp 89 PID 756 wrote to memory of 4940 756 5505.tmp 89 PID 756 wrote to memory of 4940 756 5505.tmp 89 PID 4940 wrote to memory of 2524 4940 5592.tmp 90 PID 4940 wrote to memory of 2524 4940 5592.tmp 90 PID 4940 wrote to memory of 2524 4940 5592.tmp 90 PID 2524 wrote to memory of 1964 2524 55FF.tmp 91 PID 2524 wrote to memory of 1964 2524 55FF.tmp 91 PID 2524 wrote to memory of 1964 2524 55FF.tmp 91 PID 1964 wrote to memory of 3780 1964 56BB.tmp 92 PID 1964 wrote to memory of 3780 1964 56BB.tmp 92 PID 1964 wrote to memory of 3780 1964 56BB.tmp 92 PID 3780 wrote to memory of 2084 3780 5738.tmp 93 PID 3780 wrote to memory of 2084 3780 5738.tmp 93 PID 3780 wrote to memory of 2084 3780 5738.tmp 93 PID 2084 wrote to memory of 1664 2084 57C5.tmp 94 PID 2084 wrote to memory of 1664 2084 57C5.tmp 94 PID 2084 wrote to memory of 1664 2084 57C5.tmp 94 PID 1664 wrote to memory of 4784 1664 5861.tmp 95 PID 1664 wrote to memory of 4784 1664 5861.tmp 95 PID 1664 wrote to memory of 4784 1664 5861.tmp 95 PID 4784 wrote to memory of 2684 4784 590D.tmp 96 PID 4784 wrote to memory of 2684 4784 590D.tmp 96 PID 4784 wrote to memory of 2684 4784 590D.tmp 96 PID 2684 wrote to memory of 4944 2684 59A9.tmp 97 PID 2684 wrote to memory of 4944 2684 59A9.tmp 97 PID 2684 wrote to memory of 4944 2684 59A9.tmp 97 PID 4944 wrote to memory of 2016 4944 5A45.tmp 98 PID 4944 wrote to memory of 2016 4944 5A45.tmp 98 PID 4944 wrote to memory of 2016 4944 5A45.tmp 98 PID 2016 wrote to memory of 1212 2016 5AB3.tmp 99 PID 2016 wrote to memory of 1212 2016 5AB3.tmp 99 PID 2016 wrote to memory of 1212 2016 5AB3.tmp 99 PID 1212 wrote to memory of 2868 1212 5B4F.tmp 100 PID 1212 wrote to memory of 2868 1212 5B4F.tmp 100 PID 1212 wrote to memory of 2868 1212 5B4F.tmp 100 PID 2868 wrote to memory of 4772 2868 5BEB.tmp 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_cc3337c690becc574f4ecf517267e7e5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-24_cc3337c690becc574f4ecf517267e7e5_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"23⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"24⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"25⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"26⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"27⤵
- Executes dropped EXE
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"28⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"29⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"30⤵
- Executes dropped EXE
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"31⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"32⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"33⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"34⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"35⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"36⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"37⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"38⤵
- Executes dropped EXE
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"39⤵
- Executes dropped EXE
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"40⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"41⤵
- Executes dropped EXE
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"42⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"43⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"44⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"45⤵
- Executes dropped EXE
PID:336 -
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"46⤵
- Executes dropped EXE
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"47⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"48⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"49⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"50⤵
- Executes dropped EXE
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"51⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"52⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"53⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"54⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"55⤵
- Executes dropped EXE
PID:680 -
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"56⤵
- Executes dropped EXE
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"57⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"58⤵
- Executes dropped EXE
PID:740 -
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"59⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"60⤵
- Executes dropped EXE
PID:860 -
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"61⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"62⤵
- Executes dropped EXE
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"63⤵
- Executes dropped EXE
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"64⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"65⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"66⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"67⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"68⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"69⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"70⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"71⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"72⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"73⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"74⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\71B5.tmp"C:\Users\Admin\AppData\Local\Temp\71B5.tmp"75⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"76⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"77⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\72A0.tmp"C:\Users\Admin\AppData\Local\Temp\72A0.tmp"78⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\72EE.tmp"C:\Users\Admin\AppData\Local\Temp\72EE.tmp"79⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"80⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"81⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"82⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"83⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"84⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"85⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"86⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"87⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"88⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"89⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"90⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"91⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\7724.tmp"C:\Users\Admin\AppData\Local\Temp\7724.tmp"92⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\7772.tmp"C:\Users\Admin\AppData\Local\Temp\7772.tmp"93⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"94⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\780E.tmp"C:\Users\Admin\AppData\Local\Temp\780E.tmp"95⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\785C.tmp"C:\Users\Admin\AppData\Local\Temp\785C.tmp"96⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"97⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\78F9.tmp"C:\Users\Admin\AppData\Local\Temp\78F9.tmp"98⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"99⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\7995.tmp"C:\Users\Admin\AppData\Local\Temp\7995.tmp"100⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"101⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"102⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"103⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"104⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"105⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\7B79.tmp"C:\Users\Admin\AppData\Local\Temp\7B79.tmp"106⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"107⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"108⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\7C73.tmp"C:\Users\Admin\AppData\Local\Temp\7C73.tmp"109⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"110⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"111⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"112⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"113⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\7E09.tmp"C:\Users\Admin\AppData\Local\Temp\7E09.tmp"114⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"115⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"116⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"117⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\7F42.tmp"C:\Users\Admin\AppData\Local\Temp\7F42.tmp"118⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\7F90.tmp"C:\Users\Admin\AppData\Local\Temp\7F90.tmp"119⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"120⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\804C.tmp"C:\Users\Admin\AppData\Local\Temp\804C.tmp"121⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\809A.tmp"C:\Users\Admin\AppData\Local\Temp\809A.tmp"122⤵PID:1352
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-