Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
16/04/2024, 14:02
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-16_2af52c2ed7ec7a56bbc9bff9df197ac1_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-16_2af52c2ed7ec7a56bbc9bff9df197ac1_mafia.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-16_2af52c2ed7ec7a56bbc9bff9df197ac1_mafia.exe
-
Size
487KB
-
MD5
2af52c2ed7ec7a56bbc9bff9df197ac1
-
SHA1
5a1708a3b3a44e5e78a7f8953f2ac681b39f630b
-
SHA256
ac37dedb5759ef774502b4b285a7f4f67537505fe224743eda7a5ca6aaf1aea0
-
SHA512
cd97b7de63cd7cbfc4753b127fb6ce28192f87035dc7de09d81d1d8c5401e038199a6c45a08ca22646df0a234f54a1d5f6766b74795d4c1443391c60cab46c7e
-
SSDEEP
12288:HU5rCOTeiJJswOaqp/xez9RYPexz+/pHXDWnTNZ:HUQOJJ4JUJRtxz+hHWN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1324 4F0A.tmp 4092 4FA6.tmp 4632 5043.tmp 4100 50EF.tmp 1776 518B.tmp 2996 5217.tmp 4708 52B4.tmp 2600 5360.tmp 3156 53AE.tmp 1388 541B.tmp 5020 54A8.tmp 4876 5554.tmp 2544 55E0.tmp 4692 564E.tmp 1660 56CB.tmp 3056 5748.tmp 3420 57C5.tmp 4152 5851.tmp 4456 58DE.tmp 3900 595B.tmp 3496 59B9.tmp 4560 5A36.tmp 4236 5AC2.tmp 836 5B5E.tmp 3276 5BFB.tmp 1280 5C87.tmp 3776 5D04.tmp 400 5D91.tmp 3600 5DFE.tmp 468 5E6C.tmp 116 5EE9.tmp 4408 5F46.tmp 1632 5FC3.tmp 3412 6012.tmp 628 607F.tmp 1356 610C.tmp 4324 6179.tmp 2116 61D7.tmp 4084 6244.tmp 2292 62A2.tmp 2384 630F.tmp 1580 637D.tmp 3100 63EA.tmp 1588 6448.tmp 1992 64C5.tmp 2356 6532.tmp 2816 659F.tmp 2260 65FD.tmp 536 666B.tmp 1316 66C8.tmp 3632 6726.tmp 1536 6793.tmp 3240 6801.tmp 2580 685F.tmp 4908 68CC.tmp 3184 692A.tmp 2472 6978.tmp 4836 69E5.tmp 388 6A33.tmp 3008 6AA1.tmp 4564 6B0E.tmp 3956 6B6C.tmp 4152 6BCA.tmp 3752 6C37.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1632 wrote to memory of 1324 1632 2024-04-16_2af52c2ed7ec7a56bbc9bff9df197ac1_mafia.exe 85 PID 1632 wrote to memory of 1324 1632 2024-04-16_2af52c2ed7ec7a56bbc9bff9df197ac1_mafia.exe 85 PID 1632 wrote to memory of 1324 1632 2024-04-16_2af52c2ed7ec7a56bbc9bff9df197ac1_mafia.exe 85 PID 1324 wrote to memory of 4092 1324 4F0A.tmp 87 PID 1324 wrote to memory of 4092 1324 4F0A.tmp 87 PID 1324 wrote to memory of 4092 1324 4F0A.tmp 87 PID 4092 wrote to memory of 4632 4092 4FA6.tmp 88 PID 4092 wrote to memory of 4632 4092 4FA6.tmp 88 PID 4092 wrote to memory of 4632 4092 4FA6.tmp 88 PID 4632 wrote to memory of 4100 4632 5043.tmp 91 PID 4632 wrote to memory of 4100 4632 5043.tmp 91 PID 4632 wrote to memory of 4100 4632 5043.tmp 91 PID 4100 wrote to memory of 1776 4100 50EF.tmp 92 PID 4100 wrote to memory of 1776 4100 50EF.tmp 92 PID 4100 wrote to memory of 1776 4100 50EF.tmp 92 PID 1776 wrote to memory of 2996 1776 518B.tmp 93 PID 1776 wrote to memory of 2996 1776 518B.tmp 93 PID 1776 wrote to memory of 2996 1776 518B.tmp 93 PID 2996 wrote to memory of 4708 2996 5217.tmp 94 PID 2996 wrote to memory of 4708 2996 5217.tmp 94 PID 2996 wrote to memory of 4708 2996 5217.tmp 94 PID 4708 wrote to memory of 2600 4708 52B4.tmp 95 PID 4708 wrote to memory of 2600 4708 52B4.tmp 95 PID 4708 wrote to memory of 2600 4708 52B4.tmp 95 PID 2600 wrote to memory of 3156 2600 5360.tmp 96 PID 2600 wrote to memory of 3156 2600 5360.tmp 96 PID 2600 wrote to memory of 3156 2600 5360.tmp 96 PID 3156 wrote to memory of 1388 3156 53AE.tmp 97 PID 3156 wrote to memory of 1388 3156 53AE.tmp 97 PID 3156 wrote to memory of 1388 3156 53AE.tmp 97 PID 1388 wrote to memory of 5020 1388 541B.tmp 98 PID 1388 wrote to memory of 5020 1388 541B.tmp 98 PID 1388 wrote to memory of 5020 1388 541B.tmp 98 PID 5020 wrote to memory of 4876 5020 54A8.tmp 99 PID 5020 wrote to memory of 4876 5020 54A8.tmp 99 PID 5020 wrote to memory of 4876 5020 54A8.tmp 99 PID 4876 wrote to memory of 2544 4876 5554.tmp 100 PID 4876 wrote to memory of 2544 4876 5554.tmp 100 PID 4876 wrote to memory of 2544 4876 5554.tmp 100 PID 2544 wrote to memory of 4692 2544 55E0.tmp 101 PID 2544 wrote to memory of 4692 2544 55E0.tmp 101 PID 2544 wrote to memory of 4692 2544 55E0.tmp 101 PID 4692 wrote to memory of 1660 4692 564E.tmp 102 PID 4692 wrote to memory of 1660 4692 564E.tmp 102 PID 4692 wrote to memory of 1660 4692 564E.tmp 102 PID 1660 wrote to memory of 3056 1660 56CB.tmp 104 PID 1660 wrote to memory of 3056 1660 56CB.tmp 104 PID 1660 wrote to memory of 3056 1660 56CB.tmp 104 PID 3056 wrote to memory of 3420 3056 5748.tmp 105 PID 3056 wrote to memory of 3420 3056 5748.tmp 105 PID 3056 wrote to memory of 3420 3056 5748.tmp 105 PID 3420 wrote to memory of 4152 3420 57C5.tmp 106 PID 3420 wrote to memory of 4152 3420 57C5.tmp 106 PID 3420 wrote to memory of 4152 3420 57C5.tmp 106 PID 4152 wrote to memory of 4456 4152 5851.tmp 107 PID 4152 wrote to memory of 4456 4152 5851.tmp 107 PID 4152 wrote to memory of 4456 4152 5851.tmp 107 PID 4456 wrote to memory of 3900 4456 58DE.tmp 109 PID 4456 wrote to memory of 3900 4456 58DE.tmp 109 PID 4456 wrote to memory of 3900 4456 58DE.tmp 109 PID 3900 wrote to memory of 3496 3900 595B.tmp 110 PID 3900 wrote to memory of 3496 3900 595B.tmp 110 PID 3900 wrote to memory of 3496 3900 595B.tmp 110 PID 3496 wrote to memory of 4560 3496 59B9.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-16_2af52c2ed7ec7a56bbc9bff9df197ac1_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-16_2af52c2ed7ec7a56bbc9bff9df197ac1_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"23⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"24⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"25⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"26⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"27⤵
- Executes dropped EXE
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"28⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"29⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"30⤵
- Executes dropped EXE
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"31⤵
- Executes dropped EXE
PID:468 -
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"32⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"33⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"34⤵
- Executes dropped EXE
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"35⤵
- Executes dropped EXE
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"36⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"37⤵
- Executes dropped EXE
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"38⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"39⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"40⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"41⤵
- Executes dropped EXE
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"42⤵
- Executes dropped EXE
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"43⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"44⤵
- Executes dropped EXE
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"45⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"46⤵
- Executes dropped EXE
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"47⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"48⤵
- Executes dropped EXE
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"49⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"50⤵
- Executes dropped EXE
PID:536 -
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"51⤵
- Executes dropped EXE
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"52⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"53⤵
- Executes dropped EXE
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"54⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"55⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"56⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"57⤵
- Executes dropped EXE
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"58⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"59⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"60⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"61⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"62⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"63⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"64⤵
- Executes dropped EXE
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"65⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"66⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"67⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"68⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"69⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"70⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"71⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"72⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"73⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"74⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"75⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"76⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"77⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\7157.tmp"C:\Users\Admin\AppData\Local\Temp\7157.tmp"78⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"79⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\7232.tmp"C:\Users\Admin\AppData\Local\Temp\7232.tmp"80⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\7290.tmp"C:\Users\Admin\AppData\Local\Temp\7290.tmp"81⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"82⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"83⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"84⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"85⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"86⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\74C2.tmp"C:\Users\Admin\AppData\Local\Temp\74C2.tmp"87⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"88⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"89⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"90⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"91⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"92⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"93⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\7724.tmp"C:\Users\Admin\AppData\Local\Temp\7724.tmp"94⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\7791.tmp"C:\Users\Admin\AppData\Local\Temp\7791.tmp"95⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\77FF.tmp"C:\Users\Admin\AppData\Local\Temp\77FF.tmp"96⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\785C.tmp"C:\Users\Admin\AppData\Local\Temp\785C.tmp"97⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"98⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\7937.tmp"C:\Users\Admin\AppData\Local\Temp\7937.tmp"99⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\79A4.tmp"C:\Users\Admin\AppData\Local\Temp\79A4.tmp"100⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"101⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"102⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"103⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"104⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"105⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"106⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\7C15.tmp"C:\Users\Admin\AppData\Local\Temp\7C15.tmp"107⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\7C73.tmp"C:\Users\Admin\AppData\Local\Temp\7C73.tmp"108⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"109⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"110⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"111⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"112⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\7E29.tmp"C:\Users\Admin\AppData\Local\Temp\7E29.tmp"113⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"114⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"115⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\7F61.tmp"C:\Users\Admin\AppData\Local\Temp\7F61.tmp"116⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"117⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\802C.tmp"C:\Users\Admin\AppData\Local\Temp\802C.tmp"118⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\807A.tmp"C:\Users\Admin\AppData\Local\Temp\807A.tmp"119⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\80E8.tmp"C:\Users\Admin\AppData\Local\Temp\80E8.tmp"120⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\8146.tmp"C:\Users\Admin\AppData\Local\Temp\8146.tmp"121⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\81B3.tmp"C:\Users\Admin\AppData\Local\Temp\81B3.tmp"122⤵PID:3752
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-