Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24/04/2024, 00:53
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-24_aab4d31d9b143835f71c0de47b2954bb_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-24_aab4d31d9b143835f71c0de47b2954bb_mafia.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-24_aab4d31d9b143835f71c0de47b2954bb_mafia.exe
-
Size
520KB
-
MD5
aab4d31d9b143835f71c0de47b2954bb
-
SHA1
86e7a45ec6375516b91f8957e2553c88cb65e50f
-
SHA256
761b19f48327d525caf9a486b0363af1597351ea009aa8b282fa4a130e1379d3
-
SHA512
338fc7448ba4fdfda4be6fd2c2e263f1183c61417783ce534d1bb2673cd3ca0149898f4eff839f8c593b6b604bf292a0a5148d8d0f7f5702b22086841af0ccab
-
SSDEEP
12288:gj8fuxR21t5i8fdrZYS4wjjfPmRB9Ct8nNZ:gj8fuK1GY5iSNjACunN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4796 540B.tmp 3848 5488.tmp 4468 54F6.tmp 4076 5582.tmp 4560 55F0.tmp 1000 565D.tmp 4240 56DA.tmp 5116 5728.tmp 3876 5776.tmp 4500 57C5.tmp 3576 5822.tmp 4004 589F.tmp 2736 591C.tmp 5028 5999.tmp 3360 5A07.tmp 4824 5A84.tmp 3596 5AD2.tmp 1812 5B4F.tmp 4764 5B9D.tmp 3264 5C0A.tmp 4508 5C78.tmp 4144 5CE5.tmp 4108 5D52.tmp 1916 5DC0.tmp 5068 5E1E.tmp 3136 5E6C.tmp 2068 5ED9.tmp 4940 5F56.tmp 1528 5FB4.tmp 4916 6021.tmp 3520 608F.tmp 3660 610C.tmp 2288 6169.tmp 4724 61C7.tmp 1448 6215.tmp 4076 6273.tmp 3396 62C1.tmp 1432 631F.tmp 3876 636D.tmp 4500 63BB.tmp 3132 6419.tmp 2692 6477.tmp 1572 64E4.tmp 2788 6542.tmp 2736 659F.tmp 3292 65FD.tmp 220 665B.tmp 2156 66B9.tmp 4824 6716.tmp 1308 6765.tmp 2800 67C2.tmp 1812 6820.tmp 4764 687E.tmp 1072 68DC.tmp 4728 6939.tmp 2500 6997.tmp 3176 69F5.tmp 2796 6A53.tmp 2352 6AB0.tmp 3272 6B0E.tmp 936 6B6C.tmp 1664 6BCA.tmp 644 6C18.tmp 2460 6C75.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4996 wrote to memory of 4796 4996 2024-04-24_aab4d31d9b143835f71c0de47b2954bb_mafia.exe 86 PID 4996 wrote to memory of 4796 4996 2024-04-24_aab4d31d9b143835f71c0de47b2954bb_mafia.exe 86 PID 4996 wrote to memory of 4796 4996 2024-04-24_aab4d31d9b143835f71c0de47b2954bb_mafia.exe 86 PID 4796 wrote to memory of 3848 4796 540B.tmp 87 PID 4796 wrote to memory of 3848 4796 540B.tmp 87 PID 4796 wrote to memory of 3848 4796 540B.tmp 87 PID 3848 wrote to memory of 4468 3848 5488.tmp 88 PID 3848 wrote to memory of 4468 3848 5488.tmp 88 PID 3848 wrote to memory of 4468 3848 5488.tmp 88 PID 4468 wrote to memory of 4076 4468 54F6.tmp 91 PID 4468 wrote to memory of 4076 4468 54F6.tmp 91 PID 4468 wrote to memory of 4076 4468 54F6.tmp 91 PID 4076 wrote to memory of 4560 4076 5582.tmp 92 PID 4076 wrote to memory of 4560 4076 5582.tmp 92 PID 4076 wrote to memory of 4560 4076 5582.tmp 92 PID 4560 wrote to memory of 1000 4560 55F0.tmp 94 PID 4560 wrote to memory of 1000 4560 55F0.tmp 94 PID 4560 wrote to memory of 1000 4560 55F0.tmp 94 PID 1000 wrote to memory of 4240 1000 565D.tmp 95 PID 1000 wrote to memory of 4240 1000 565D.tmp 95 PID 1000 wrote to memory of 4240 1000 565D.tmp 95 PID 4240 wrote to memory of 5116 4240 56DA.tmp 96 PID 4240 wrote to memory of 5116 4240 56DA.tmp 96 PID 4240 wrote to memory of 5116 4240 56DA.tmp 96 PID 5116 wrote to memory of 3876 5116 5728.tmp 97 PID 5116 wrote to memory of 3876 5116 5728.tmp 97 PID 5116 wrote to memory of 3876 5116 5728.tmp 97 PID 3876 wrote to memory of 4500 3876 5776.tmp 98 PID 3876 wrote to memory of 4500 3876 5776.tmp 98 PID 3876 wrote to memory of 4500 3876 5776.tmp 98 PID 4500 wrote to memory of 3576 4500 57C5.tmp 99 PID 4500 wrote to memory of 3576 4500 57C5.tmp 99 PID 4500 wrote to memory of 3576 4500 57C5.tmp 99 PID 3576 wrote to memory of 4004 3576 5822.tmp 100 PID 3576 wrote to memory of 4004 3576 5822.tmp 100 PID 3576 wrote to memory of 4004 3576 5822.tmp 100 PID 4004 wrote to memory of 2736 4004 589F.tmp 101 PID 4004 wrote to memory of 2736 4004 589F.tmp 101 PID 4004 wrote to memory of 2736 4004 589F.tmp 101 PID 2736 wrote to memory of 5028 2736 591C.tmp 102 PID 2736 wrote to memory of 5028 2736 591C.tmp 102 PID 2736 wrote to memory of 5028 2736 591C.tmp 102 PID 5028 wrote to memory of 3360 5028 5999.tmp 103 PID 5028 wrote to memory of 3360 5028 5999.tmp 103 PID 5028 wrote to memory of 3360 5028 5999.tmp 103 PID 3360 wrote to memory of 4824 3360 5A07.tmp 104 PID 3360 wrote to memory of 4824 3360 5A07.tmp 104 PID 3360 wrote to memory of 4824 3360 5A07.tmp 104 PID 4824 wrote to memory of 3596 4824 5A84.tmp 105 PID 4824 wrote to memory of 3596 4824 5A84.tmp 105 PID 4824 wrote to memory of 3596 4824 5A84.tmp 105 PID 3596 wrote to memory of 1812 3596 5AD2.tmp 106 PID 3596 wrote to memory of 1812 3596 5AD2.tmp 106 PID 3596 wrote to memory of 1812 3596 5AD2.tmp 106 PID 1812 wrote to memory of 4764 1812 5B4F.tmp 107 PID 1812 wrote to memory of 4764 1812 5B4F.tmp 107 PID 1812 wrote to memory of 4764 1812 5B4F.tmp 107 PID 4764 wrote to memory of 3264 4764 5B9D.tmp 108 PID 4764 wrote to memory of 3264 4764 5B9D.tmp 108 PID 4764 wrote to memory of 3264 4764 5B9D.tmp 108 PID 3264 wrote to memory of 4508 3264 5C0A.tmp 109 PID 3264 wrote to memory of 4508 3264 5C0A.tmp 109 PID 3264 wrote to memory of 4508 3264 5C0A.tmp 109 PID 4508 wrote to memory of 4144 4508 5C78.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-24_aab4d31d9b143835f71c0de47b2954bb_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-24_aab4d31d9b143835f71c0de47b2954bb_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"23⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"24⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"25⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"26⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"27⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"28⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"29⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"30⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"31⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"32⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"33⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"34⤵
- Executes dropped EXE
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"35⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"36⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"37⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"38⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"39⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"40⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"41⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"42⤵
- Executes dropped EXE
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"43⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"44⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"45⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"46⤵
- Executes dropped EXE
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"47⤵
- Executes dropped EXE
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"48⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"49⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"50⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"51⤵
- Executes dropped EXE
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"52⤵
- Executes dropped EXE
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"53⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"54⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"55⤵
- Executes dropped EXE
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"56⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"57⤵
- Executes dropped EXE
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"58⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"59⤵
- Executes dropped EXE
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"60⤵
- Executes dropped EXE
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"61⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"62⤵
- Executes dropped EXE
PID:936 -
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"63⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"64⤵
- Executes dropped EXE
PID:644 -
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"65⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"66⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"67⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"68⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"69⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"70⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"71⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"72⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"73⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"74⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"75⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"76⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"77⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"78⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"79⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"80⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"81⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"82⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"83⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"84⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"85⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"86⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"87⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"88⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"89⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"90⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"91⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"92⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"93⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"94⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"95⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"96⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"97⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"98⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\782D.tmp"C:\Users\Admin\AppData\Local\Temp\782D.tmp"99⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"100⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\78D9.tmp"C:\Users\Admin\AppData\Local\Temp\78D9.tmp"101⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\7927.tmp"C:\Users\Admin\AppData\Local\Temp\7927.tmp"102⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"103⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\79D3.tmp"C:\Users\Admin\AppData\Local\Temp\79D3.tmp"104⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\7A21.tmp"C:\Users\Admin\AppData\Local\Temp\7A21.tmp"105⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\7A70.tmp"C:\Users\Admin\AppData\Local\Temp\7A70.tmp"106⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"107⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"108⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\7B79.tmp"C:\Users\Admin\AppData\Local\Temp\7B79.tmp"109⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"110⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"111⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\7C73.tmp"C:\Users\Admin\AppData\Local\Temp\7C73.tmp"112⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"113⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"114⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"115⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"116⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"117⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\7E67.tmp"C:\Users\Admin\AppData\Local\Temp\7E67.tmp"118⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"119⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\7F13.tmp"C:\Users\Admin\AppData\Local\Temp\7F13.tmp"120⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\7F71.tmp"C:\Users\Admin\AppData\Local\Temp\7F71.tmp"121⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"122⤵PID:4788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-