Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
15/04/2024, 05:49
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-15_4dc49241dd6a923c5c31b33de2c7b4cb_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-15_4dc49241dd6a923c5c31b33de2c7b4cb_mafia.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-15_4dc49241dd6a923c5c31b33de2c7b4cb_mafia.exe
-
Size
486KB
-
MD5
4dc49241dd6a923c5c31b33de2c7b4cb
-
SHA1
102668c75b53c2abc77b96ed063801a1f50e35fb
-
SHA256
ad75ea2bfb70ba5f41fd61b5b406f76293c52111c1898bbcf5c3582cf4647d72
-
SHA512
231898a72b71f0bda00962c63371e31d0e9d34d032fb7cc2f60ad06395812035d741ba9df966e81147df0e07f4e3b209ca8f7bf0f72357d94df023f638f62e3b
-
SSDEEP
12288:/U5rCOTeiDXyvbjdBN4ZvZ7Cm1U4GuJ1:/UQOJDMnNCvzUAJ1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1444 4EEB.tmp 2400 4F68.tmp 4104 4FE5.tmp 816 5072.tmp 2132 512D.tmp 1436 519A.tmp 4108 5227.tmp 4132 52B4.tmp 4124 5321.tmp 4552 537F.tmp 2600 53EC.tmp 4872 545A.tmp 1964 54D7.tmp 3388 5544.tmp 1972 55C1.tmp 4192 564E.tmp 4020 56CB.tmp 3720 5748.tmp 1788 57D4.tmp 3888 5870.tmp 3464 58DE.tmp 4320 596A.tmp 3840 59E7.tmp 1032 5A74.tmp 4720 5AE1.tmp 1044 5B5E.tmp 1944 5BFB.tmp 3116 5C87.tmp 3768 5CF5.tmp 3136 5D91.tmp 624 5E0E.tmp 692 5E9B.tmp 4820 5F27.tmp 1912 5F85.tmp 3084 5FE3.tmp 2536 6050.tmp 4700 60AE.tmp 3180 60FC.tmp 1812 615A.tmp 2588 61B7.tmp 2160 6215.tmp 1452 6263.tmp 1736 62C1.tmp 1436 632E.tmp 3320 639C.tmp 3256 63FA.tmp 4132 6477.tmp 1648 64E4.tmp 4984 6551.tmp 780 659F.tmp 2600 65FD.tmp 4872 664B.tmp 3168 66B9.tmp 1964 6726.tmp 3388 67A3.tmp 2708 6810.tmp 4724 686E.tmp 3632 68CC.tmp 2144 6939.tmp 1404 6987.tmp 3404 69F5.tmp 1544 6A43.tmp 4732 6AB0.tmp 3888 6B0E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1912 wrote to memory of 1444 1912 2024-04-15_4dc49241dd6a923c5c31b33de2c7b4cb_mafia.exe 86 PID 1912 wrote to memory of 1444 1912 2024-04-15_4dc49241dd6a923c5c31b33de2c7b4cb_mafia.exe 86 PID 1912 wrote to memory of 1444 1912 2024-04-15_4dc49241dd6a923c5c31b33de2c7b4cb_mafia.exe 86 PID 1444 wrote to memory of 2400 1444 4EEB.tmp 88 PID 1444 wrote to memory of 2400 1444 4EEB.tmp 88 PID 1444 wrote to memory of 2400 1444 4EEB.tmp 88 PID 2400 wrote to memory of 4104 2400 4F68.tmp 90 PID 2400 wrote to memory of 4104 2400 4F68.tmp 90 PID 2400 wrote to memory of 4104 2400 4F68.tmp 90 PID 4104 wrote to memory of 816 4104 4FE5.tmp 91 PID 4104 wrote to memory of 816 4104 4FE5.tmp 91 PID 4104 wrote to memory of 816 4104 4FE5.tmp 91 PID 816 wrote to memory of 2132 816 5072.tmp 93 PID 816 wrote to memory of 2132 816 5072.tmp 93 PID 816 wrote to memory of 2132 816 5072.tmp 93 PID 2132 wrote to memory of 1436 2132 512D.tmp 94 PID 2132 wrote to memory of 1436 2132 512D.tmp 94 PID 2132 wrote to memory of 1436 2132 512D.tmp 94 PID 1436 wrote to memory of 4108 1436 519A.tmp 95 PID 1436 wrote to memory of 4108 1436 519A.tmp 95 PID 1436 wrote to memory of 4108 1436 519A.tmp 95 PID 4108 wrote to memory of 4132 4108 5227.tmp 96 PID 4108 wrote to memory of 4132 4108 5227.tmp 96 PID 4108 wrote to memory of 4132 4108 5227.tmp 96 PID 4132 wrote to memory of 4124 4132 52B4.tmp 97 PID 4132 wrote to memory of 4124 4132 52B4.tmp 97 PID 4132 wrote to memory of 4124 4132 52B4.tmp 97 PID 4124 wrote to memory of 4552 4124 5321.tmp 98 PID 4124 wrote to memory of 4552 4124 5321.tmp 98 PID 4124 wrote to memory of 4552 4124 5321.tmp 98 PID 4552 wrote to memory of 2600 4552 537F.tmp 99 PID 4552 wrote to memory of 2600 4552 537F.tmp 99 PID 4552 wrote to memory of 2600 4552 537F.tmp 99 PID 2600 wrote to memory of 4872 2600 53EC.tmp 100 PID 2600 wrote to memory of 4872 2600 53EC.tmp 100 PID 2600 wrote to memory of 4872 2600 53EC.tmp 100 PID 4872 wrote to memory of 1964 4872 545A.tmp 101 PID 4872 wrote to memory of 1964 4872 545A.tmp 101 PID 4872 wrote to memory of 1964 4872 545A.tmp 101 PID 1964 wrote to memory of 3388 1964 54D7.tmp 102 PID 1964 wrote to memory of 3388 1964 54D7.tmp 102 PID 1964 wrote to memory of 3388 1964 54D7.tmp 102 PID 3388 wrote to memory of 1972 3388 5544.tmp 103 PID 3388 wrote to memory of 1972 3388 5544.tmp 103 PID 3388 wrote to memory of 1972 3388 5544.tmp 103 PID 1972 wrote to memory of 4192 1972 55C1.tmp 104 PID 1972 wrote to memory of 4192 1972 55C1.tmp 104 PID 1972 wrote to memory of 4192 1972 55C1.tmp 104 PID 4192 wrote to memory of 4020 4192 564E.tmp 105 PID 4192 wrote to memory of 4020 4192 564E.tmp 105 PID 4192 wrote to memory of 4020 4192 564E.tmp 105 PID 4020 wrote to memory of 3720 4020 56CB.tmp 106 PID 4020 wrote to memory of 3720 4020 56CB.tmp 106 PID 4020 wrote to memory of 3720 4020 56CB.tmp 106 PID 3720 wrote to memory of 1788 3720 5748.tmp 107 PID 3720 wrote to memory of 1788 3720 5748.tmp 107 PID 3720 wrote to memory of 1788 3720 5748.tmp 107 PID 1788 wrote to memory of 3888 1788 57D4.tmp 109 PID 1788 wrote to memory of 3888 1788 57D4.tmp 109 PID 1788 wrote to memory of 3888 1788 57D4.tmp 109 PID 3888 wrote to memory of 3464 3888 5870.tmp 111 PID 3888 wrote to memory of 3464 3888 5870.tmp 111 PID 3888 wrote to memory of 3464 3888 5870.tmp 111 PID 3464 wrote to memory of 4320 3464 58DE.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-15_4dc49241dd6a923c5c31b33de2c7b4cb_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-15_4dc49241dd6a923c5c31b33de2c7b4cb_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"23⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"24⤵
- Executes dropped EXE
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"25⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"26⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"27⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"28⤵
- Executes dropped EXE
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"29⤵
- Executes dropped EXE
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"30⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"31⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"32⤵
- Executes dropped EXE
PID:624 -
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"33⤵
- Executes dropped EXE
PID:692 -
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"34⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"35⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"36⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"37⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"38⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"39⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"40⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"41⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"42⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"43⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"44⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"45⤵
- Executes dropped EXE
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"46⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"47⤵
- Executes dropped EXE
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"48⤵
- Executes dropped EXE
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"49⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"50⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"51⤵
- Executes dropped EXE
PID:780 -
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"52⤵
- Executes dropped EXE
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"53⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"54⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"55⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"56⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"57⤵
- Executes dropped EXE
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"58⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"59⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"60⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"61⤵
- Executes dropped EXE
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"62⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"63⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"64⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"65⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"66⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"67⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"68⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"69⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"70⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"71⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"72⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"73⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"74⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"75⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"76⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"77⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"78⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"79⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"80⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"81⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"82⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"83⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"84⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"85⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"86⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"87⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"88⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"89⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"90⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"91⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"92⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"93⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"94⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"95⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"96⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"97⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"98⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"99⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"100⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\7791.tmp"C:\Users\Admin\AppData\Local\Temp\7791.tmp"101⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\77DF.tmp"C:\Users\Admin\AppData\Local\Temp\77DF.tmp"102⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\783D.tmp"C:\Users\Admin\AppData\Local\Temp\783D.tmp"103⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\788B.tmp"C:\Users\Admin\AppData\Local\Temp\788B.tmp"104⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"105⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\7937.tmp"C:\Users\Admin\AppData\Local\Temp\7937.tmp"106⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\7995.tmp"C:\Users\Admin\AppData\Local\Temp\7995.tmp"107⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"108⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"109⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"110⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"111⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"112⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\7B89.tmp"C:\Users\Admin\AppData\Local\Temp\7B89.tmp"113⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"114⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\7C35.tmp"C:\Users\Admin\AppData\Local\Temp\7C35.tmp"115⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"116⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\7D00.tmp"C:\Users\Admin\AppData\Local\Temp\7D00.tmp"117⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"118⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"119⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"120⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\7E77.tmp"C:\Users\Admin\AppData\Local\Temp\7E77.tmp"121⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"122⤵PID:4732
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-