Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17/04/2024, 04:23
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-17_7318b0bb801ab6477f062dba9fe7cf23_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-17_7318b0bb801ab6477f062dba9fe7cf23_mafia.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-17_7318b0bb801ab6477f062dba9fe7cf23_mafia.exe
-
Size
486KB
-
MD5
7318b0bb801ab6477f062dba9fe7cf23
-
SHA1
0a17deb9b1374f18f6d27810b31811b10a624bd5
-
SHA256
5f2e96a62fe9b0e9e8c5fafe038493500149e611f59e78a08ef13c36d5a2030a
-
SHA512
f69706bd4b22b464635c02bc2c0103f9fc93989c1bdcf26d569d9bf3ae05395a467a5f386872b506633090cfeaa1bfca7cbbbfb274823645ae8bd15ece53c777
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfDJuO/v4EC4q3NmSFaM3sndQX+QZ5Em7x52tMoW:/U5rCOTeiDUKvKsSFAS+Xm7x52yoj
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3448 51D9.tmp 1656 5266.tmp 3588 52E3.tmp 2604 538E.tmp 3032 540B.tmp 1816 5479.tmp 1644 5515.tmp 844 5592.tmp 4212 560F.tmp 5028 568C.tmp 4748 56F9.tmp 4996 5767.tmp 4300 57F3.tmp 1860 5870.tmp 3704 58ED.tmp 3620 598A.tmp 4776 59F7.tmp 3388 5A64.tmp 1204 5B01.tmp 1640 5B8D.tmp 4120 5BFB.tmp 1092 5C58.tmp 640 5CC6.tmp 3356 5D43.tmp 3288 5DB0.tmp 1652 5E4C.tmp 520 5EE9.tmp 3784 5F66.tmp 960 6012.tmp 4356 607F.tmp 4936 60EC.tmp 1700 615A.tmp 3076 61D7.tmp 4400 6234.tmp 1960 6292.tmp 1816 62E0.tmp 4448 633E.tmp 2232 639C.tmp 2488 6419.tmp 4728 6467.tmp 4212 64C5.tmp 3372 6522.tmp 4736 6580.tmp 976 65CE.tmp 2908 661C.tmp 4300 668A.tmp 2340 66D8.tmp 852 6726.tmp 3972 6793.tmp 4588 67E2.tmp 1180 6830.tmp 1748 688D.tmp 1636 68FB.tmp 2528 6959.tmp 4608 69C6.tmp 3828 6A33.tmp 1316 6A91.tmp 4844 6ADF.tmp 3344 6B4D.tmp 4444 6B9B.tmp 2024 6BE9.tmp 4604 6C47.tmp 2408 6CB4.tmp 3824 6D12.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3764 wrote to memory of 3448 3764 2024-04-17_7318b0bb801ab6477f062dba9fe7cf23_mafia.exe 84 PID 3764 wrote to memory of 3448 3764 2024-04-17_7318b0bb801ab6477f062dba9fe7cf23_mafia.exe 84 PID 3764 wrote to memory of 3448 3764 2024-04-17_7318b0bb801ab6477f062dba9fe7cf23_mafia.exe 84 PID 3448 wrote to memory of 1656 3448 51D9.tmp 85 PID 3448 wrote to memory of 1656 3448 51D9.tmp 85 PID 3448 wrote to memory of 1656 3448 51D9.tmp 85 PID 1656 wrote to memory of 3588 1656 5266.tmp 86 PID 1656 wrote to memory of 3588 1656 5266.tmp 86 PID 1656 wrote to memory of 3588 1656 5266.tmp 86 PID 3588 wrote to memory of 2604 3588 52E3.tmp 88 PID 3588 wrote to memory of 2604 3588 52E3.tmp 88 PID 3588 wrote to memory of 2604 3588 52E3.tmp 88 PID 2604 wrote to memory of 3032 2604 538E.tmp 90 PID 2604 wrote to memory of 3032 2604 538E.tmp 90 PID 2604 wrote to memory of 3032 2604 538E.tmp 90 PID 3032 wrote to memory of 1816 3032 540B.tmp 92 PID 3032 wrote to memory of 1816 3032 540B.tmp 92 PID 3032 wrote to memory of 1816 3032 540B.tmp 92 PID 1816 wrote to memory of 1644 1816 5479.tmp 93 PID 1816 wrote to memory of 1644 1816 5479.tmp 93 PID 1816 wrote to memory of 1644 1816 5479.tmp 93 PID 1644 wrote to memory of 844 1644 5515.tmp 94 PID 1644 wrote to memory of 844 1644 5515.tmp 94 PID 1644 wrote to memory of 844 1644 5515.tmp 94 PID 844 wrote to memory of 4212 844 5592.tmp 95 PID 844 wrote to memory of 4212 844 5592.tmp 95 PID 844 wrote to memory of 4212 844 5592.tmp 95 PID 4212 wrote to memory of 5028 4212 560F.tmp 96 PID 4212 wrote to memory of 5028 4212 560F.tmp 96 PID 4212 wrote to memory of 5028 4212 560F.tmp 96 PID 5028 wrote to memory of 4748 5028 568C.tmp 97 PID 5028 wrote to memory of 4748 5028 568C.tmp 97 PID 5028 wrote to memory of 4748 5028 568C.tmp 97 PID 4748 wrote to memory of 4996 4748 56F9.tmp 98 PID 4748 wrote to memory of 4996 4748 56F9.tmp 98 PID 4748 wrote to memory of 4996 4748 56F9.tmp 98 PID 4996 wrote to memory of 4300 4996 5767.tmp 99 PID 4996 wrote to memory of 4300 4996 5767.tmp 99 PID 4996 wrote to memory of 4300 4996 5767.tmp 99 PID 4300 wrote to memory of 1860 4300 57F3.tmp 100 PID 4300 wrote to memory of 1860 4300 57F3.tmp 100 PID 4300 wrote to memory of 1860 4300 57F3.tmp 100 PID 1860 wrote to memory of 3704 1860 5870.tmp 101 PID 1860 wrote to memory of 3704 1860 5870.tmp 101 PID 1860 wrote to memory of 3704 1860 5870.tmp 101 PID 3704 wrote to memory of 3620 3704 58ED.tmp 102 PID 3704 wrote to memory of 3620 3704 58ED.tmp 102 PID 3704 wrote to memory of 3620 3704 58ED.tmp 102 PID 3620 wrote to memory of 4776 3620 598A.tmp 103 PID 3620 wrote to memory of 4776 3620 598A.tmp 103 PID 3620 wrote to memory of 4776 3620 598A.tmp 103 PID 4776 wrote to memory of 3388 4776 59F7.tmp 104 PID 4776 wrote to memory of 3388 4776 59F7.tmp 104 PID 4776 wrote to memory of 3388 4776 59F7.tmp 104 PID 3388 wrote to memory of 1204 3388 5A64.tmp 105 PID 3388 wrote to memory of 1204 3388 5A64.tmp 105 PID 3388 wrote to memory of 1204 3388 5A64.tmp 105 PID 1204 wrote to memory of 1640 1204 5B01.tmp 107 PID 1204 wrote to memory of 1640 1204 5B01.tmp 107 PID 1204 wrote to memory of 1640 1204 5B01.tmp 107 PID 1640 wrote to memory of 4120 1640 5B8D.tmp 108 PID 1640 wrote to memory of 4120 1640 5B8D.tmp 108 PID 1640 wrote to memory of 4120 1640 5B8D.tmp 108 PID 4120 wrote to memory of 1092 4120 5BFB.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-17_7318b0bb801ab6477f062dba9fe7cf23_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-17_7318b0bb801ab6477f062dba9fe7cf23_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"23⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"24⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"25⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"26⤵
- Executes dropped EXE
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"27⤵
- Executes dropped EXE
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"28⤵
- Executes dropped EXE
PID:520 -
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"29⤵
- Executes dropped EXE
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"30⤵
- Executes dropped EXE
PID:960 -
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"31⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"32⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"33⤵
- Executes dropped EXE
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"34⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"35⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"36⤵
- Executes dropped EXE
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"37⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"38⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"39⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"40⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"41⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"42⤵
- Executes dropped EXE
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"43⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"44⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"45⤵
- Executes dropped EXE
PID:976 -
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"46⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"47⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"48⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"49⤵
- Executes dropped EXE
PID:852 -
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"50⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"51⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"52⤵
- Executes dropped EXE
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"53⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"54⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"55⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"56⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"57⤵
- Executes dropped EXE
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"58⤵
- Executes dropped EXE
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"59⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"60⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"61⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"62⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"63⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"64⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"65⤵
- Executes dropped EXE
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"66⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"67⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"68⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"69⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"70⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"71⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"72⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"73⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"74⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"75⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"76⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\7157.tmp"C:\Users\Admin\AppData\Local\Temp\7157.tmp"77⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"78⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"79⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"80⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"81⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"82⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"83⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"84⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\7445.tmp"C:\Users\Admin\AppData\Local\Temp\7445.tmp"85⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"86⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"87⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"88⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"89⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"90⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"91⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\7705.tmp"C:\Users\Admin\AppData\Local\Temp\7705.tmp"92⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\7762.tmp"C:\Users\Admin\AppData\Local\Temp\7762.tmp"93⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"94⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\782D.tmp"C:\Users\Admin\AppData\Local\Temp\782D.tmp"95⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\788B.tmp"C:\Users\Admin\AppData\Local\Temp\788B.tmp"96⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\78D9.tmp"C:\Users\Admin\AppData\Local\Temp\78D9.tmp"97⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"98⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\7995.tmp"C:\Users\Admin\AppData\Local\Temp\7995.tmp"99⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"100⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\7A50.tmp"C:\Users\Admin\AppData\Local\Temp\7A50.tmp"101⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"102⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"103⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\7B89.tmp"C:\Users\Admin\AppData\Local\Temp\7B89.tmp"104⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"105⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\7C44.tmp"C:\Users\Admin\AppData\Local\Temp\7C44.tmp"106⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"107⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"108⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"109⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"110⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\7E29.tmp"C:\Users\Admin\AppData\Local\Temp\7E29.tmp"111⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\7E77.tmp"C:\Users\Admin\AppData\Local\Temp\7E77.tmp"112⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"113⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\7F42.tmp"C:\Users\Admin\AppData\Local\Temp\7F42.tmp"114⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\7F90.tmp"C:\Users\Admin\AppData\Local\Temp\7F90.tmp"115⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"116⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\805B.tmp"C:\Users\Admin\AppData\Local\Temp\805B.tmp"117⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\80C9.tmp"C:\Users\Admin\AppData\Local\Temp\80C9.tmp"118⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\8126.tmp"C:\Users\Admin\AppData\Local\Temp\8126.tmp"119⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\8184.tmp"C:\Users\Admin\AppData\Local\Temp\8184.tmp"120⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\81E2.tmp"C:\Users\Admin\AppData\Local\Temp\81E2.tmp"121⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\824F.tmp"C:\Users\Admin\AppData\Local\Temp\824F.tmp"122⤵PID:2652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-