Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
25/02/2024, 05:08
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-25_f8a2bb06e4dca774b4a3c98eb5ac601e_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-02-25_f8a2bb06e4dca774b4a3c98eb5ac601e_mafia.exe
Resource
win10v2004-20240221-en
General
-
Target
2024-02-25_f8a2bb06e4dca774b4a3c98eb5ac601e_mafia.exe
-
Size
541KB
-
MD5
f8a2bb06e4dca774b4a3c98eb5ac601e
-
SHA1
e6a69a730351b64ad8b5e3c551c76bf9f4911e8d
-
SHA256
63d784898396337bcd333834ebf9e006efb594cc6b5d6c5a44f12ab0920d9cad
-
SHA512
cbd6a5199854adfe9ec4801d7ac2484344270ad35ad0feccf05b66fabb2bcb5f87550f5cda304e1007c4fa7e3e63fe8c6d56dcbd53b4f848e0449c4d04f81f91
-
SSDEEP
12288:UU5rCOTeifnsmSJcb3NMUPn899fkpI7C2NfHrZa73ctO:UUQOJfnsmSyxMknWkpI7F/rU73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 348 50B0.tmp 4884 515C.tmp 4488 51F8.tmp 1016 52A4.tmp 2528 5311.tmp 4688 539E.tmp 1856 541B.tmp 1488 5479.tmp 3108 5515.tmp 2940 5592.tmp 3668 561F.tmp 1548 56BB.tmp 1456 5757.tmp 916 5803.tmp 3876 5880.tmp 2668 58ED.tmp 2056 595B.tmp 3868 59E7.tmp 3104 5A64.tmp 2416 5AD2.tmp 952 5B5E.tmp 3960 5BCC.tmp 3040 5C49.tmp 1796 5CE5.tmp 4848 5D72.tmp 4960 5DEF.tmp 3240 5E5C.tmp 1704 5F08.tmp 3044 5FA4.tmp 2152 6040.tmp 2036 60AE.tmp 4512 6169.tmp 2844 61F6.tmp 2060 6263.tmp 4692 62B1.tmp 2052 631F.tmp 1464 636D.tmp 2672 63FA.tmp 4328 6457.tmp 2260 64B5.tmp 1808 6522.tmp 348 6580.tmp 2928 65DE.tmp 4780 664B.tmp 2720 66A9.tmp 848 6716.tmp 4556 6765.tmp 3116 67C2.tmp 2528 6830.tmp 4476 688D.tmp 1720 68FB.tmp 440 6968.tmp 2880 69C6.tmp 3708 6A24.tmp 4680 6A91.tmp 2692 6AFE.tmp 2840 6B4D.tmp 2940 6BAA.tmp 3680 6C18.tmp 5004 6C75.tmp 1548 6CD3.tmp 1456 6D31.tmp 3412 6D8F.tmp 1648 6DEC.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4552 wrote to memory of 348 4552 2024-02-25_f8a2bb06e4dca774b4a3c98eb5ac601e_mafia.exe 86 PID 4552 wrote to memory of 348 4552 2024-02-25_f8a2bb06e4dca774b4a3c98eb5ac601e_mafia.exe 86 PID 4552 wrote to memory of 348 4552 2024-02-25_f8a2bb06e4dca774b4a3c98eb5ac601e_mafia.exe 86 PID 348 wrote to memory of 4884 348 50B0.tmp 87 PID 348 wrote to memory of 4884 348 50B0.tmp 87 PID 348 wrote to memory of 4884 348 50B0.tmp 87 PID 4884 wrote to memory of 4488 4884 515C.tmp 88 PID 4884 wrote to memory of 4488 4884 515C.tmp 88 PID 4884 wrote to memory of 4488 4884 515C.tmp 88 PID 4488 wrote to memory of 1016 4488 51F8.tmp 89 PID 4488 wrote to memory of 1016 4488 51F8.tmp 89 PID 4488 wrote to memory of 1016 4488 51F8.tmp 89 PID 1016 wrote to memory of 2528 1016 52A4.tmp 91 PID 1016 wrote to memory of 2528 1016 52A4.tmp 91 PID 1016 wrote to memory of 2528 1016 52A4.tmp 91 PID 2528 wrote to memory of 4688 2528 5311.tmp 93 PID 2528 wrote to memory of 4688 2528 5311.tmp 93 PID 2528 wrote to memory of 4688 2528 5311.tmp 93 PID 4688 wrote to memory of 1856 4688 539E.tmp 94 PID 4688 wrote to memory of 1856 4688 539E.tmp 94 PID 4688 wrote to memory of 1856 4688 539E.tmp 94 PID 1856 wrote to memory of 1488 1856 541B.tmp 96 PID 1856 wrote to memory of 1488 1856 541B.tmp 96 PID 1856 wrote to memory of 1488 1856 541B.tmp 96 PID 1488 wrote to memory of 3108 1488 5479.tmp 97 PID 1488 wrote to memory of 3108 1488 5479.tmp 97 PID 1488 wrote to memory of 3108 1488 5479.tmp 97 PID 3108 wrote to memory of 2940 3108 5515.tmp 98 PID 3108 wrote to memory of 2940 3108 5515.tmp 98 PID 3108 wrote to memory of 2940 3108 5515.tmp 98 PID 2940 wrote to memory of 3668 2940 5592.tmp 99 PID 2940 wrote to memory of 3668 2940 5592.tmp 99 PID 2940 wrote to memory of 3668 2940 5592.tmp 99 PID 3668 wrote to memory of 1548 3668 561F.tmp 100 PID 3668 wrote to memory of 1548 3668 561F.tmp 100 PID 3668 wrote to memory of 1548 3668 561F.tmp 100 PID 1548 wrote to memory of 1456 1548 56BB.tmp 101 PID 1548 wrote to memory of 1456 1548 56BB.tmp 101 PID 1548 wrote to memory of 1456 1548 56BB.tmp 101 PID 1456 wrote to memory of 916 1456 5757.tmp 102 PID 1456 wrote to memory of 916 1456 5757.tmp 102 PID 1456 wrote to memory of 916 1456 5757.tmp 102 PID 916 wrote to memory of 3876 916 5803.tmp 103 PID 916 wrote to memory of 3876 916 5803.tmp 103 PID 916 wrote to memory of 3876 916 5803.tmp 103 PID 3876 wrote to memory of 2668 3876 5880.tmp 104 PID 3876 wrote to memory of 2668 3876 5880.tmp 104 PID 3876 wrote to memory of 2668 3876 5880.tmp 104 PID 2668 wrote to memory of 2056 2668 58ED.tmp 105 PID 2668 wrote to memory of 2056 2668 58ED.tmp 105 PID 2668 wrote to memory of 2056 2668 58ED.tmp 105 PID 2056 wrote to memory of 3868 2056 595B.tmp 106 PID 2056 wrote to memory of 3868 2056 595B.tmp 106 PID 2056 wrote to memory of 3868 2056 595B.tmp 106 PID 3868 wrote to memory of 3104 3868 59E7.tmp 107 PID 3868 wrote to memory of 3104 3868 59E7.tmp 107 PID 3868 wrote to memory of 3104 3868 59E7.tmp 107 PID 3104 wrote to memory of 2416 3104 5A64.tmp 108 PID 3104 wrote to memory of 2416 3104 5A64.tmp 108 PID 3104 wrote to memory of 2416 3104 5A64.tmp 108 PID 2416 wrote to memory of 952 2416 5AD2.tmp 110 PID 2416 wrote to memory of 952 2416 5AD2.tmp 110 PID 2416 wrote to memory of 952 2416 5AD2.tmp 110 PID 952 wrote to memory of 3960 952 5B5E.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-25_f8a2bb06e4dca774b4a3c98eb5ac601e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-25_f8a2bb06e4dca774b4a3c98eb5ac601e_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"23⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"24⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"25⤵
- Executes dropped EXE
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"26⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"27⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"28⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"29⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"30⤵
- Executes dropped EXE
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"31⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"32⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"33⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"34⤵
- Executes dropped EXE
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"35⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"36⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"37⤵
- Executes dropped EXE
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"38⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"39⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"40⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"41⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"42⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"43⤵
- Executes dropped EXE
PID:348 -
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"44⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"45⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"46⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"47⤵
- Executes dropped EXE
PID:848 -
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"48⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"49⤵
- Executes dropped EXE
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"50⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"51⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"52⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"53⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"54⤵
- Executes dropped EXE
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"55⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"56⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"57⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"58⤵
- Executes dropped EXE
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"59⤵
- Executes dropped EXE
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"60⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"61⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"62⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"63⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"64⤵
- Executes dropped EXE
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"65⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"66⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"67⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"68⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\6F63.tmp"C:\Users\Admin\AppData\Local\Temp\6F63.tmp"69⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"70⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"71⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"72⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"73⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"74⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"75⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"76⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"77⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\7290.tmp"C:\Users\Admin\AppData\Local\Temp\7290.tmp"78⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\72EE.tmp"C:\Users\Admin\AppData\Local\Temp\72EE.tmp"79⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"80⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"81⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"82⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"83⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"84⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"85⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"86⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"87⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"88⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"89⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"90⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"91⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\77DF.tmp"C:\Users\Admin\AppData\Local\Temp\77DF.tmp"92⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"93⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"94⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\7918.tmp"C:\Users\Admin\AppData\Local\Temp\7918.tmp"95⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\7976.tmp"C:\Users\Admin\AppData\Local\Temp\7976.tmp"96⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\79D3.tmp"C:\Users\Admin\AppData\Local\Temp\79D3.tmp"97⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"98⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"99⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"100⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"101⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\7B98.tmp"C:\Users\Admin\AppData\Local\Temp\7B98.tmp"102⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"103⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\7C54.tmp"C:\Users\Admin\AppData\Local\Temp\7C54.tmp"104⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"105⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"106⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"107⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"108⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\7E48.tmp"C:\Users\Admin\AppData\Local\Temp\7E48.tmp"109⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"110⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\7F13.tmp"C:\Users\Admin\AppData\Local\Temp\7F13.tmp"111⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\7F71.tmp"C:\Users\Admin\AppData\Local\Temp\7F71.tmp"112⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"113⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\804C.tmp"C:\Users\Admin\AppData\Local\Temp\804C.tmp"114⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\80B9.tmp"C:\Users\Admin\AppData\Local\Temp\80B9.tmp"115⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\8107.tmp"C:\Users\Admin\AppData\Local\Temp\8107.tmp"116⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\8155.tmp"C:\Users\Admin\AppData\Local\Temp\8155.tmp"117⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\81C3.tmp"C:\Users\Admin\AppData\Local\Temp\81C3.tmp"118⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\8220.tmp"C:\Users\Admin\AppData\Local\Temp\8220.tmp"119⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"120⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\82BD.tmp"C:\Users\Admin\AppData\Local\Temp\82BD.tmp"121⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"122⤵PID:1548
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-