Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23/05/2024, 08:48
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-23_b68a99d80b36af50307a1ef23c3365b3_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-23_b68a99d80b36af50307a1ef23c3365b3_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-23_b68a99d80b36af50307a1ef23c3365b3_mafia.exe
-
Size
486KB
-
MD5
b68a99d80b36af50307a1ef23c3365b3
-
SHA1
bf552466d31dea7f082236b0a624918b5565c731
-
SHA256
73fc74cd44c2187cd0abdd94be184081d0009747ea51ace8d0263fd2de47612b
-
SHA512
965d00785be5ff90f6408869b071cd781a31ea8ffbe65b094d1153b8a68beb66fb5dc3dd5691f82bfbb92300655c414b0026f15249a01e570ca5247dd47c6609
-
SSDEEP
12288:UU5rCOTeiDjRtakjQ7OZvU3LqCM2pJcZNZ:UUQOJDjRQRylOuCDpqN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4152 5498.tmp 2428 54E6.tmp 4632 5554.tmp 4744 55C1.tmp 252 561F.tmp 2680 567C.tmp 2120 56CB.tmp 3240 5728.tmp 3536 5786.tmp 4976 5803.tmp 1376 5861.tmp 736 58CE.tmp 3720 593C.tmp 2788 59A9.tmp 1036 5A16.tmp 412 5A64.tmp 2736 5AD2.tmp 4880 5B20.tmp 860 5B6E.tmp 2596 5BCC.tmp 4408 5C49.tmp 2088 5CA7.tmp 2356 5D14.tmp 2224 5D62.tmp 884 5DCF.tmp 4680 5E3D.tmp 4836 5E9B.tmp 4876 5EE9.tmp 3984 5F56.tmp 3596 5FC3.tmp 2080 6040.tmp 3456 60AE.tmp 1796 612B.tmp 1924 6179.tmp 3808 61C7.tmp 232 6215.tmp 4364 6263.tmp 1636 62B1.tmp 1176 6300.tmp 2276 634E.tmp 252 639C.tmp 3012 63FA.tmp 5112 6448.tmp 4500 6496.tmp 4224 64E4.tmp 112 6542.tmp 1376 659F.tmp 4816 65FD.tmp 756 664B.tmp 4848 6699.tmp 4676 66E8.tmp 1296 6736.tmp 2736 6784.tmp 2272 67D2.tmp 3084 6820.tmp 2932 686E.tmp 1600 68BC.tmp 2392 691A.tmp 1000 6968.tmp 1612 69B6.tmp 3872 6A14.tmp 1608 6A72.tmp 2620 6AC0.tmp 3608 6B1E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2148 wrote to memory of 4152 2148 2024-05-23_b68a99d80b36af50307a1ef23c3365b3_mafia.exe 82 PID 2148 wrote to memory of 4152 2148 2024-05-23_b68a99d80b36af50307a1ef23c3365b3_mafia.exe 82 PID 2148 wrote to memory of 4152 2148 2024-05-23_b68a99d80b36af50307a1ef23c3365b3_mafia.exe 82 PID 4152 wrote to memory of 2428 4152 5498.tmp 83 PID 4152 wrote to memory of 2428 4152 5498.tmp 83 PID 4152 wrote to memory of 2428 4152 5498.tmp 83 PID 2428 wrote to memory of 4632 2428 54E6.tmp 84 PID 2428 wrote to memory of 4632 2428 54E6.tmp 84 PID 2428 wrote to memory of 4632 2428 54E6.tmp 84 PID 4632 wrote to memory of 4744 4632 5554.tmp 85 PID 4632 wrote to memory of 4744 4632 5554.tmp 85 PID 4632 wrote to memory of 4744 4632 5554.tmp 85 PID 4744 wrote to memory of 252 4744 55C1.tmp 86 PID 4744 wrote to memory of 252 4744 55C1.tmp 86 PID 4744 wrote to memory of 252 4744 55C1.tmp 86 PID 252 wrote to memory of 2680 252 561F.tmp 88 PID 252 wrote to memory of 2680 252 561F.tmp 88 PID 252 wrote to memory of 2680 252 561F.tmp 88 PID 2680 wrote to memory of 2120 2680 567C.tmp 89 PID 2680 wrote to memory of 2120 2680 567C.tmp 89 PID 2680 wrote to memory of 2120 2680 567C.tmp 89 PID 2120 wrote to memory of 3240 2120 56CB.tmp 90 PID 2120 wrote to memory of 3240 2120 56CB.tmp 90 PID 2120 wrote to memory of 3240 2120 56CB.tmp 90 PID 3240 wrote to memory of 3536 3240 5728.tmp 92 PID 3240 wrote to memory of 3536 3240 5728.tmp 92 PID 3240 wrote to memory of 3536 3240 5728.tmp 92 PID 3536 wrote to memory of 4976 3536 5786.tmp 93 PID 3536 wrote to memory of 4976 3536 5786.tmp 93 PID 3536 wrote to memory of 4976 3536 5786.tmp 93 PID 4976 wrote to memory of 1376 4976 5803.tmp 95 PID 4976 wrote to memory of 1376 4976 5803.tmp 95 PID 4976 wrote to memory of 1376 4976 5803.tmp 95 PID 1376 wrote to memory of 736 1376 5861.tmp 96 PID 1376 wrote to memory of 736 1376 5861.tmp 96 PID 1376 wrote to memory of 736 1376 5861.tmp 96 PID 736 wrote to memory of 3720 736 58CE.tmp 97 PID 736 wrote to memory of 3720 736 58CE.tmp 97 PID 736 wrote to memory of 3720 736 58CE.tmp 97 PID 3720 wrote to memory of 2788 3720 593C.tmp 98 PID 3720 wrote to memory of 2788 3720 593C.tmp 98 PID 3720 wrote to memory of 2788 3720 593C.tmp 98 PID 2788 wrote to memory of 1036 2788 59A9.tmp 99 PID 2788 wrote to memory of 1036 2788 59A9.tmp 99 PID 2788 wrote to memory of 1036 2788 59A9.tmp 99 PID 1036 wrote to memory of 412 1036 5A16.tmp 100 PID 1036 wrote to memory of 412 1036 5A16.tmp 100 PID 1036 wrote to memory of 412 1036 5A16.tmp 100 PID 412 wrote to memory of 2736 412 5A64.tmp 101 PID 412 wrote to memory of 2736 412 5A64.tmp 101 PID 412 wrote to memory of 2736 412 5A64.tmp 101 PID 2736 wrote to memory of 4880 2736 5AD2.tmp 102 PID 2736 wrote to memory of 4880 2736 5AD2.tmp 102 PID 2736 wrote to memory of 4880 2736 5AD2.tmp 102 PID 4880 wrote to memory of 860 4880 5B20.tmp 103 PID 4880 wrote to memory of 860 4880 5B20.tmp 103 PID 4880 wrote to memory of 860 4880 5B20.tmp 103 PID 860 wrote to memory of 2596 860 5B6E.tmp 104 PID 860 wrote to memory of 2596 860 5B6E.tmp 104 PID 860 wrote to memory of 2596 860 5B6E.tmp 104 PID 2596 wrote to memory of 4408 2596 5BCC.tmp 105 PID 2596 wrote to memory of 4408 2596 5BCC.tmp 105 PID 2596 wrote to memory of 4408 2596 5BCC.tmp 105 PID 4408 wrote to memory of 2088 4408 5C49.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_b68a99d80b36af50307a1ef23c3365b3_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_b68a99d80b36af50307a1ef23c3365b3_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"23⤵
- Executes dropped EXE
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"24⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"25⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"26⤵
- Executes dropped EXE
PID:884 -
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"27⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"28⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"29⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"30⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"31⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"32⤵
- Executes dropped EXE
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"33⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"34⤵
- Executes dropped EXE
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"35⤵
- Executes dropped EXE
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"36⤵
- Executes dropped EXE
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"37⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"38⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"39⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"40⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"41⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"42⤵
- Executes dropped EXE
PID:252 -
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"43⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"44⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"45⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"46⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"47⤵
- Executes dropped EXE
PID:112 -
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"48⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"49⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"50⤵
- Executes dropped EXE
PID:756 -
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"51⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"52⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"53⤵
- Executes dropped EXE
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"54⤵
- Executes dropped EXE
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"55⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"56⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"57⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"58⤵
- Executes dropped EXE
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"59⤵
- Executes dropped EXE
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"60⤵
- Executes dropped EXE
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"61⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"62⤵
- Executes dropped EXE
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"63⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"64⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"65⤵
- Executes dropped EXE
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"66⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"67⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"68⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"69⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"70⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"71⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"72⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"73⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"74⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"75⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"76⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"77⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"78⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"79⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"80⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"81⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\7148.tmp"C:\Users\Admin\AppData\Local\Temp\7148.tmp"82⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"83⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"84⤵PID:252
-
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"85⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"86⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"87⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"88⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"89⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"90⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"91⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"92⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"93⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"94⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"95⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"96⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"97⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"98⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"99⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\7791.tmp"C:\Users\Admin\AppData\Local\Temp\7791.tmp"100⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\77EF.tmp"C:\Users\Admin\AppData\Local\Temp\77EF.tmp"101⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"102⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"103⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\7908.tmp"C:\Users\Admin\AppData\Local\Temp\7908.tmp"104⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\7966.tmp"C:\Users\Admin\AppData\Local\Temp\7966.tmp"105⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\79B4.tmp"C:\Users\Admin\AppData\Local\Temp\79B4.tmp"106⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\7A12.tmp"C:\Users\Admin\AppData\Local\Temp\7A12.tmp"107⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\7A70.tmp"C:\Users\Admin\AppData\Local\Temp\7A70.tmp"108⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"109⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"110⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"111⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"112⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\7C06.tmp"C:\Users\Admin\AppData\Local\Temp\7C06.tmp"113⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\7C54.tmp"C:\Users\Admin\AppData\Local\Temp\7C54.tmp"114⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"115⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\7D00.tmp"C:\Users\Admin\AppData\Local\Temp\7D00.tmp"116⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"117⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"118⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\7E09.tmp"C:\Users\Admin\AppData\Local\Temp\7E09.tmp"119⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"120⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"121⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\7F03.tmp"C:\Users\Admin\AppData\Local\Temp\7F03.tmp"122⤵PID:1392
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-