Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30/06/2024, 03:02
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-30_78cb7cd7971ecbea3f59c3fd5a5f640c_mafia.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2024-06-30_78cb7cd7971ecbea3f59c3fd5a5f640c_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-30_78cb7cd7971ecbea3f59c3fd5a5f640c_mafia.exe
-
Size
541KB
-
MD5
78cb7cd7971ecbea3f59c3fd5a5f640c
-
SHA1
7773be09c4373a8f19d8ca1c90906d627cfff27c
-
SHA256
98dd71f9103ed8074b660a49e2bbbc91bbb1447b329c7f7d841cdb7e5597b9bf
-
SHA512
1963cfbe55c8e8ecb9b2b1f210359fe0f52b1132eb734c75327c87c139be367b6c80d163b948d68308de05d083b3ec806ff963bed1878ae4c091b5194196cb55
-
SSDEEP
12288:UU5rCOTeiffnmY2kTVuCKLKdwLrnzExUQmNrZa73ctO:UUQOJffmY2CuKdwvzExUQmNrU73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3112 3BC1.tmp 2372 3C1E.tmp 5064 3C8C.tmp 4344 3D38.tmp 5112 3DB5.tmp 3540 3E32.tmp 4852 3E9F.tmp 64 3F0C.tmp 4656 3F6A.tmp 3576 3FD8.tmp 3196 4026.tmp 2220 4083.tmp 1468 40D2.tmp 1240 412F.tmp 4076 418D.tmp 4912 41EB.tmp 2724 4249.tmp 1564 42B6.tmp 4260 4304.tmp 5096 4371.tmp 2404 43C0.tmp 3676 443D.tmp 1132 448B.tmp 1128 44F8.tmp 2664 4556.tmp 4616 45B4.tmp 4772 4611.tmp 2708 469E.tmp 452 470B.tmp 916 4759.tmp 1368 47B7.tmp 3876 4825.tmp 4632 48A2.tmp 2568 48F0.tmp 5116 493E.tmp 1204 498C.tmp 2712 49DA.tmp 4240 4A28.tmp 2140 4A86.tmp 4504 4AE4.tmp 1672 4B41.tmp 4820 4B9F.tmp 3220 4BED.tmp 1972 4C2C.tmp 3288 4C7A.tmp 4380 4CD8.tmp 4988 4D35.tmp 1776 4D84.tmp 3144 4DE1.tmp 2804 4E2F.tmp 1980 4E7E.tmp 4796 4EDB.tmp 1984 4F39.tmp 4392 4F97.tmp 3668 4FF5.tmp 4420 5043.tmp 3112 50A0.tmp 2456 50FE.tmp 5028 514C.tmp 4496 519A.tmp 5048 51E9.tmp 3440 5237.tmp 4344 5275.tmp 2552 52C3.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2736 wrote to memory of 3112 2736 2024-06-30_78cb7cd7971ecbea3f59c3fd5a5f640c_mafia.exe 80 PID 2736 wrote to memory of 3112 2736 2024-06-30_78cb7cd7971ecbea3f59c3fd5a5f640c_mafia.exe 80 PID 2736 wrote to memory of 3112 2736 2024-06-30_78cb7cd7971ecbea3f59c3fd5a5f640c_mafia.exe 80 PID 3112 wrote to memory of 2372 3112 3BC1.tmp 81 PID 3112 wrote to memory of 2372 3112 3BC1.tmp 81 PID 3112 wrote to memory of 2372 3112 3BC1.tmp 81 PID 2372 wrote to memory of 5064 2372 3C1E.tmp 82 PID 2372 wrote to memory of 5064 2372 3C1E.tmp 82 PID 2372 wrote to memory of 5064 2372 3C1E.tmp 82 PID 5064 wrote to memory of 4344 5064 3C8C.tmp 83 PID 5064 wrote to memory of 4344 5064 3C8C.tmp 83 PID 5064 wrote to memory of 4344 5064 3C8C.tmp 83 PID 4344 wrote to memory of 5112 4344 3D38.tmp 84 PID 4344 wrote to memory of 5112 4344 3D38.tmp 84 PID 4344 wrote to memory of 5112 4344 3D38.tmp 84 PID 5112 wrote to memory of 3540 5112 3DB5.tmp 85 PID 5112 wrote to memory of 3540 5112 3DB5.tmp 85 PID 5112 wrote to memory of 3540 5112 3DB5.tmp 85 PID 3540 wrote to memory of 4852 3540 3E32.tmp 86 PID 3540 wrote to memory of 4852 3540 3E32.tmp 86 PID 3540 wrote to memory of 4852 3540 3E32.tmp 86 PID 4852 wrote to memory of 64 4852 3E9F.tmp 87 PID 4852 wrote to memory of 64 4852 3E9F.tmp 87 PID 4852 wrote to memory of 64 4852 3E9F.tmp 87 PID 64 wrote to memory of 4656 64 3F0C.tmp 88 PID 64 wrote to memory of 4656 64 3F0C.tmp 88 PID 64 wrote to memory of 4656 64 3F0C.tmp 88 PID 4656 wrote to memory of 3576 4656 3F6A.tmp 89 PID 4656 wrote to memory of 3576 4656 3F6A.tmp 89 PID 4656 wrote to memory of 3576 4656 3F6A.tmp 89 PID 3576 wrote to memory of 3196 3576 3FD8.tmp 90 PID 3576 wrote to memory of 3196 3576 3FD8.tmp 90 PID 3576 wrote to memory of 3196 3576 3FD8.tmp 90 PID 3196 wrote to memory of 2220 3196 4026.tmp 91 PID 3196 wrote to memory of 2220 3196 4026.tmp 91 PID 3196 wrote to memory of 2220 3196 4026.tmp 91 PID 2220 wrote to memory of 1468 2220 4083.tmp 92 PID 2220 wrote to memory of 1468 2220 4083.tmp 92 PID 2220 wrote to memory of 1468 2220 4083.tmp 92 PID 1468 wrote to memory of 1240 1468 40D2.tmp 93 PID 1468 wrote to memory of 1240 1468 40D2.tmp 93 PID 1468 wrote to memory of 1240 1468 40D2.tmp 93 PID 1240 wrote to memory of 4076 1240 412F.tmp 94 PID 1240 wrote to memory of 4076 1240 412F.tmp 94 PID 1240 wrote to memory of 4076 1240 412F.tmp 94 PID 4076 wrote to memory of 4912 4076 418D.tmp 95 PID 4076 wrote to memory of 4912 4076 418D.tmp 95 PID 4076 wrote to memory of 4912 4076 418D.tmp 95 PID 4912 wrote to memory of 2724 4912 41EB.tmp 96 PID 4912 wrote to memory of 2724 4912 41EB.tmp 96 PID 4912 wrote to memory of 2724 4912 41EB.tmp 96 PID 2724 wrote to memory of 1564 2724 4249.tmp 97 PID 2724 wrote to memory of 1564 2724 4249.tmp 97 PID 2724 wrote to memory of 1564 2724 4249.tmp 97 PID 1564 wrote to memory of 4260 1564 42B6.tmp 98 PID 1564 wrote to memory of 4260 1564 42B6.tmp 98 PID 1564 wrote to memory of 4260 1564 42B6.tmp 98 PID 4260 wrote to memory of 5096 4260 4304.tmp 99 PID 4260 wrote to memory of 5096 4260 4304.tmp 99 PID 4260 wrote to memory of 5096 4260 4304.tmp 99 PID 5096 wrote to memory of 2404 5096 4371.tmp 100 PID 5096 wrote to memory of 2404 5096 4371.tmp 100 PID 5096 wrote to memory of 2404 5096 4371.tmp 100 PID 2404 wrote to memory of 3676 2404 43C0.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-30_78cb7cd7971ecbea3f59c3fd5a5f640c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-30_78cb7cd7971ecbea3f59c3fd5a5f640c_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\3D38.tmp"C:\Users\Admin\AppData\Local\Temp\3D38.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\3E32.tmp"C:\Users\Admin\AppData\Local\Temp\3E32.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\4026.tmp"C:\Users\Admin\AppData\Local\Temp\4026.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\4083.tmp"C:\Users\Admin\AppData\Local\Temp\4083.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\40D2.tmp"C:\Users\Admin\AppData\Local\Temp\40D2.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\412F.tmp"C:\Users\Admin\AppData\Local\Temp\412F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\418D.tmp"C:\Users\Admin\AppData\Local\Temp\418D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\41EB.tmp"C:\Users\Admin\AppData\Local\Temp\41EB.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\42B6.tmp"C:\Users\Admin\AppData\Local\Temp\42B6.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\4304.tmp"C:\Users\Admin\AppData\Local\Temp\4304.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\4371.tmp"C:\Users\Admin\AppData\Local\Temp\4371.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\43C0.tmp"C:\Users\Admin\AppData\Local\Temp\43C0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\443D.tmp"C:\Users\Admin\AppData\Local\Temp\443D.tmp"23⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\448B.tmp"C:\Users\Admin\AppData\Local\Temp\448B.tmp"24⤵
- Executes dropped EXE
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"25⤵
- Executes dropped EXE
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"26⤵
- Executes dropped EXE
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"27⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"28⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"29⤵
- Executes dropped EXE
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"30⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"31⤵
- Executes dropped EXE
PID:916 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"32⤵
- Executes dropped EXE
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"33⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"34⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"35⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"36⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"37⤵
- Executes dropped EXE
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"38⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"39⤵
- Executes dropped EXE
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"40⤵
- Executes dropped EXE
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"41⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"42⤵
- Executes dropped EXE
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"43⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"44⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"45⤵
- Executes dropped EXE
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"46⤵
- Executes dropped EXE
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"47⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"48⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"49⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"50⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"51⤵
- Executes dropped EXE
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"52⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"53⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"54⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"55⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"56⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"57⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"58⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"59⤵
- Executes dropped EXE
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"60⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"61⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"62⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"63⤵
- Executes dropped EXE
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"64⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"65⤵
- Executes dropped EXE
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"66⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"67⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"68⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"69⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"70⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"71⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"72⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"73⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"74⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"75⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"76⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"77⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"78⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"79⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"80⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"81⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"82⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"83⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"84⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"85⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"86⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"87⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"88⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"89⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"90⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"91⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"92⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"93⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"94⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"95⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"96⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"97⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"98⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"99⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"100⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"101⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"102⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"103⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"104⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"105⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"106⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"107⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"108⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"109⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"110⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"111⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"112⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"113⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"114⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"115⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"116⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"117⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"118⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"119⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"120⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"121⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"122⤵PID:4176
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-