Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
165s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/01/2024, 06:00
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-11_6c297b87540227f7672b04563793a896_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-11_6c297b87540227f7672b04563793a896_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-11_6c297b87540227f7672b04563793a896_mafia.exe
-
Size
520KB
-
MD5
6c297b87540227f7672b04563793a896
-
SHA1
d8106bdc76ae9c2860384f0ebcbefea4f5ce0fa0
-
SHA256
6820d5aa3322de8894cbb787c746a1a65eefa6e42068c580d5f6cdf5956dcca4
-
SHA512
384b8b393d708fe5cf6e9b0ce7082ae776392aded67d5e16c97bced9adbd77077ec9dc389d8f6b3b3408c916d5d0b04e8f2067870bb9088509863c3b5e0f4d4e
-
SSDEEP
6144:pXT6Oq8HBh4huuAOBdRFyh1T55i8fkbBl+gXQW+XOy3JzjDUSewLGm0X8rw8Ylf:gj8fuxR21t5i8fKzh+XdJXvYlh8NZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3932 6973.tmp 384 6BE4.tmp 4412 6EF1.tmp 1064 6FCC.tmp 2712 70A7.tmp 3652 728B.tmp 2788 7579.tmp 2328 7615.tmp 2412 7858.tmp 4592 7913.tmp 5100 7BC3.tmp 1600 7D68.tmp 1000 823B.tmp 4484 845E.tmp 2628 8642.tmp 5112 876B.tmp 4376 8807.tmp 3764 8911.tmp 3976 8C8B.tmp 1380 8D47.tmp 1992 8E22.tmp 3196 8EFC.tmp 4108 8FB8.tmp 1784 9064.tmp 4464 945B.tmp 2140 94D8.tmp 4456 97B7.tmp 1420 98C0.tmp 4536 99BA.tmp 2836 9A86.tmp 4792 9BBE.tmp 724 9C89.tmp 2672 9E1F.tmp 4396 9EBC.tmp 432 9FB6.tmp 2968 A071.tmp 2352 A0EE.tmp 5084 A15C.tmp 1860 A246.tmp 1772 A515.tmp 5088 A5A1.tmp 5096 A7C4.tmp 3960 A851.tmp 3480 A8DD.tmp 2372 A94B.tmp 3180 A9C8.tmp 2804 AA35.tmp 4388 AB9D.tmp 4496 ACD5.tmp 2756 AD52.tmp 4132 ADDF.tmp 2920 AEE8.tmp 4824 AFB3.tmp 4484 B1A7.tmp 3772 B34D.tmp 4744 B447.tmp 4788 B4E4.tmp 440 B551.tmp 3268 B689.tmp 2608 B716.tmp 2856 BA04.tmp 4860 BB2D.tmp 3904 BBBA.tmp 3196 BC65.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3176 wrote to memory of 3932 3176 2024-01-11_6c297b87540227f7672b04563793a896_mafia.exe 92 PID 3176 wrote to memory of 3932 3176 2024-01-11_6c297b87540227f7672b04563793a896_mafia.exe 92 PID 3176 wrote to memory of 3932 3176 2024-01-11_6c297b87540227f7672b04563793a896_mafia.exe 92 PID 3932 wrote to memory of 384 3932 6973.tmp 94 PID 3932 wrote to memory of 384 3932 6973.tmp 94 PID 3932 wrote to memory of 384 3932 6973.tmp 94 PID 384 wrote to memory of 4412 384 6BE4.tmp 95 PID 384 wrote to memory of 4412 384 6BE4.tmp 95 PID 384 wrote to memory of 4412 384 6BE4.tmp 95 PID 4412 wrote to memory of 1064 4412 6EF1.tmp 96 PID 4412 wrote to memory of 1064 4412 6EF1.tmp 96 PID 4412 wrote to memory of 1064 4412 6EF1.tmp 96 PID 1064 wrote to memory of 2712 1064 6FCC.tmp 97 PID 1064 wrote to memory of 2712 1064 6FCC.tmp 97 PID 1064 wrote to memory of 2712 1064 6FCC.tmp 97 PID 2712 wrote to memory of 3652 2712 70A7.tmp 98 PID 2712 wrote to memory of 3652 2712 70A7.tmp 98 PID 2712 wrote to memory of 3652 2712 70A7.tmp 98 PID 3652 wrote to memory of 2788 3652 728B.tmp 99 PID 3652 wrote to memory of 2788 3652 728B.tmp 99 PID 3652 wrote to memory of 2788 3652 728B.tmp 99 PID 2788 wrote to memory of 2328 2788 7579.tmp 100 PID 2788 wrote to memory of 2328 2788 7579.tmp 100 PID 2788 wrote to memory of 2328 2788 7579.tmp 100 PID 2328 wrote to memory of 2412 2328 7615.tmp 101 PID 2328 wrote to memory of 2412 2328 7615.tmp 101 PID 2328 wrote to memory of 2412 2328 7615.tmp 101 PID 2412 wrote to memory of 4592 2412 7858.tmp 102 PID 2412 wrote to memory of 4592 2412 7858.tmp 102 PID 2412 wrote to memory of 4592 2412 7858.tmp 102 PID 4592 wrote to memory of 5100 4592 7913.tmp 103 PID 4592 wrote to memory of 5100 4592 7913.tmp 103 PID 4592 wrote to memory of 5100 4592 7913.tmp 103 PID 5100 wrote to memory of 1600 5100 7BC3.tmp 104 PID 5100 wrote to memory of 1600 5100 7BC3.tmp 104 PID 5100 wrote to memory of 1600 5100 7BC3.tmp 104 PID 1600 wrote to memory of 1000 1600 7D68.tmp 105 PID 1600 wrote to memory of 1000 1600 7D68.tmp 105 PID 1600 wrote to memory of 1000 1600 7D68.tmp 105 PID 1000 wrote to memory of 4484 1000 823B.tmp 106 PID 1000 wrote to memory of 4484 1000 823B.tmp 106 PID 1000 wrote to memory of 4484 1000 823B.tmp 106 PID 4484 wrote to memory of 2628 4484 845E.tmp 107 PID 4484 wrote to memory of 2628 4484 845E.tmp 107 PID 4484 wrote to memory of 2628 4484 845E.tmp 107 PID 2628 wrote to memory of 5112 2628 8642.tmp 108 PID 2628 wrote to memory of 5112 2628 8642.tmp 108 PID 2628 wrote to memory of 5112 2628 8642.tmp 108 PID 5112 wrote to memory of 4376 5112 876B.tmp 109 PID 5112 wrote to memory of 4376 5112 876B.tmp 109 PID 5112 wrote to memory of 4376 5112 876B.tmp 109 PID 4376 wrote to memory of 3764 4376 8807.tmp 110 PID 4376 wrote to memory of 3764 4376 8807.tmp 110 PID 4376 wrote to memory of 3764 4376 8807.tmp 110 PID 3764 wrote to memory of 3976 3764 8911.tmp 111 PID 3764 wrote to memory of 3976 3764 8911.tmp 111 PID 3764 wrote to memory of 3976 3764 8911.tmp 111 PID 3976 wrote to memory of 1380 3976 8C8B.tmp 113 PID 3976 wrote to memory of 1380 3976 8C8B.tmp 113 PID 3976 wrote to memory of 1380 3976 8C8B.tmp 113 PID 1380 wrote to memory of 1992 1380 8D47.tmp 114 PID 1380 wrote to memory of 1992 1380 8D47.tmp 114 PID 1380 wrote to memory of 1992 1380 8D47.tmp 114 PID 1992 wrote to memory of 3196 1992 8E22.tmp 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-11_6c297b87540227f7672b04563793a896_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-11_6c297b87540227f7672b04563793a896_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\6973.tmp"C:\Users\Admin\AppData\Local\Temp\6973.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\6BE4.tmp"C:\Users\Admin\AppData\Local\Temp\6BE4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\AppData\Local\Temp\6EF1.tmp"C:\Users\Admin\AppData\Local\Temp\6EF1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\6FCC.tmp"C:\Users\Admin\AppData\Local\Temp\6FCC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\70A7.tmp"C:\Users\Admin\AppData\Local\Temp\70A7.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\728B.tmp"C:\Users\Admin\AppData\Local\Temp\728B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\7579.tmp"C:\Users\Admin\AppData\Local\Temp\7579.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\7615.tmp"C:\Users\Admin\AppData\Local\Temp\7615.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\7858.tmp"C:\Users\Admin\AppData\Local\Temp\7858.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\7913.tmp"C:\Users\Admin\AppData\Local\Temp\7913.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\7BC3.tmp"C:\Users\Admin\AppData\Local\Temp\7BC3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\7D68.tmp"C:\Users\Admin\AppData\Local\Temp\7D68.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\823B.tmp"C:\Users\Admin\AppData\Local\Temp\823B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\845E.tmp"C:\Users\Admin\AppData\Local\Temp\845E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\8642.tmp"C:\Users\Admin\AppData\Local\Temp\8642.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\876B.tmp"C:\Users\Admin\AppData\Local\Temp\876B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\8807.tmp"C:\Users\Admin\AppData\Local\Temp\8807.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\8911.tmp"C:\Users\Admin\AppData\Local\Temp\8911.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\8C8B.tmp"C:\Users\Admin\AppData\Local\Temp\8C8B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\8D47.tmp"C:\Users\Admin\AppData\Local\Temp\8D47.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\8E22.tmp"C:\Users\Admin\AppData\Local\Temp\8E22.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\8EFC.tmp"C:\Users\Admin\AppData\Local\Temp\8EFC.tmp"23⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\8FB8.tmp"C:\Users\Admin\AppData\Local\Temp\8FB8.tmp"24⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\9064.tmp"C:\Users\Admin\AppData\Local\Temp\9064.tmp"25⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\945B.tmp"C:\Users\Admin\AppData\Local\Temp\945B.tmp"26⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\94D8.tmp"C:\Users\Admin\AppData\Local\Temp\94D8.tmp"27⤵
- Executes dropped EXE
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\97B7.tmp"C:\Users\Admin\AppData\Local\Temp\97B7.tmp"28⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\98C0.tmp"C:\Users\Admin\AppData\Local\Temp\98C0.tmp"29⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\99BA.tmp"C:\Users\Admin\AppData\Local\Temp\99BA.tmp"30⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\9A86.tmp"C:\Users\Admin\AppData\Local\Temp\9A86.tmp"31⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\9BBE.tmp"C:\Users\Admin\AppData\Local\Temp\9BBE.tmp"32⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\9C89.tmp"C:\Users\Admin\AppData\Local\Temp\9C89.tmp"33⤵
- Executes dropped EXE
PID:724 -
C:\Users\Admin\AppData\Local\Temp\9E1F.tmp"C:\Users\Admin\AppData\Local\Temp\9E1F.tmp"34⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\9EBC.tmp"C:\Users\Admin\AppData\Local\Temp\9EBC.tmp"35⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\9FB6.tmp"C:\Users\Admin\AppData\Local\Temp\9FB6.tmp"36⤵
- Executes dropped EXE
PID:432 -
C:\Users\Admin\AppData\Local\Temp\A071.tmp"C:\Users\Admin\AppData\Local\Temp\A071.tmp"37⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\A0EE.tmp"C:\Users\Admin\AppData\Local\Temp\A0EE.tmp"38⤵
- Executes dropped EXE
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\A15C.tmp"C:\Users\Admin\AppData\Local\Temp\A15C.tmp"39⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\A246.tmp"C:\Users\Admin\AppData\Local\Temp\A246.tmp"40⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\A515.tmp"C:\Users\Admin\AppData\Local\Temp\A515.tmp"41⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\A5A1.tmp"C:\Users\Admin\AppData\Local\Temp\A5A1.tmp"42⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\A7C4.tmp"C:\Users\Admin\AppData\Local\Temp\A7C4.tmp"43⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\A851.tmp"C:\Users\Admin\AppData\Local\Temp\A851.tmp"44⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\A8DD.tmp"C:\Users\Admin\AppData\Local\Temp\A8DD.tmp"45⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\A94B.tmp"C:\Users\Admin\AppData\Local\Temp\A94B.tmp"46⤵
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\A9C8.tmp"C:\Users\Admin\AppData\Local\Temp\A9C8.tmp"47⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\AA35.tmp"C:\Users\Admin\AppData\Local\Temp\AA35.tmp"48⤵
- Executes dropped EXE
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\AB9D.tmp"C:\Users\Admin\AppData\Local\Temp\AB9D.tmp"49⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\ACD5.tmp"C:\Users\Admin\AppData\Local\Temp\ACD5.tmp"50⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\AD52.tmp"C:\Users\Admin\AppData\Local\Temp\AD52.tmp"51⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\ADDF.tmp"C:\Users\Admin\AppData\Local\Temp\ADDF.tmp"52⤵
- Executes dropped EXE
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\AEE8.tmp"C:\Users\Admin\AppData\Local\Temp\AEE8.tmp"53⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\AFB3.tmp"C:\Users\Admin\AppData\Local\Temp\AFB3.tmp"54⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\B1A7.tmp"C:\Users\Admin\AppData\Local\Temp\B1A7.tmp"55⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\B34D.tmp"C:\Users\Admin\AppData\Local\Temp\B34D.tmp"56⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\B447.tmp"C:\Users\Admin\AppData\Local\Temp\B447.tmp"57⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\B4E4.tmp"C:\Users\Admin\AppData\Local\Temp\B4E4.tmp"58⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\B551.tmp"C:\Users\Admin\AppData\Local\Temp\B551.tmp"59⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\B689.tmp"C:\Users\Admin\AppData\Local\Temp\B689.tmp"60⤵
- Executes dropped EXE
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\B716.tmp"C:\Users\Admin\AppData\Local\Temp\B716.tmp"61⤵
- Executes dropped EXE
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\BA04.tmp"C:\Users\Admin\AppData\Local\Temp\BA04.tmp"62⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\BB2D.tmp"C:\Users\Admin\AppData\Local\Temp\BB2D.tmp"63⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\BBBA.tmp"C:\Users\Admin\AppData\Local\Temp\BBBA.tmp"64⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\BC65.tmp"C:\Users\Admin\AppData\Local\Temp\BC65.tmp"65⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\BCE2.tmp"C:\Users\Admin\AppData\Local\Temp\BCE2.tmp"66⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\BD7F.tmp"C:\Users\Admin\AppData\Local\Temp\BD7F.tmp"67⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\BE0B.tmp"C:\Users\Admin\AppData\Local\Temp\BE0B.tmp"68⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\BEA8.tmp"C:\Users\Admin\AppData\Local\Temp\BEA8.tmp"69⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\BFF0.tmp"C:\Users\Admin\AppData\Local\Temp\BFF0.tmp"70⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\C07C.tmp"C:\Users\Admin\AppData\Local\Temp\C07C.tmp"71⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\C109.tmp"C:\Users\Admin\AppData\Local\Temp\C109.tmp"72⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\C186.tmp"C:\Users\Admin\AppData\Local\Temp\C186.tmp"73⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\C38A.tmp"C:\Users\Admin\AppData\Local\Temp\C38A.tmp"74⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\C3F7.tmp"C:\Users\Admin\AppData\Local\Temp\C3F7.tmp"75⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\C520.tmp"C:\Users\Admin\AppData\Local\Temp\C520.tmp"76⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\C59D.tmp"C:\Users\Admin\AppData\Local\Temp\C59D.tmp"77⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\C723.tmp"C:\Users\Admin\AppData\Local\Temp\C723.tmp"78⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\C791.tmp"C:\Users\Admin\AppData\Local\Temp\C791.tmp"79⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\C7FE.tmp"C:\Users\Admin\AppData\Local\Temp\C7FE.tmp"80⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\C86C.tmp"C:\Users\Admin\AppData\Local\Temp\C86C.tmp"81⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\C908.tmp"C:\Users\Admin\AppData\Local\Temp\C908.tmp"82⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\C994.tmp"C:\Users\Admin\AppData\Local\Temp\C994.tmp"83⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\CA02.tmp"C:\Users\Admin\AppData\Local\Temp\CA02.tmp"84⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\CB1B.tmp"C:\Users\Admin\AppData\Local\Temp\CB1B.tmp"85⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\CD9C.tmp"C:\Users\Admin\AppData\Local\Temp\CD9C.tmp"86⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\CEE4.tmp"C:\Users\Admin\AppData\Local\Temp\CEE4.tmp"87⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\D07A.tmp"C:\Users\Admin\AppData\Local\Temp\D07A.tmp"88⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\D0F7.tmp"C:\Users\Admin\AppData\Local\Temp\D0F7.tmp"89⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\D164.tmp"C:\Users\Admin\AppData\Local\Temp\D164.tmp"90⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\D1F1.tmp"C:\Users\Admin\AppData\Local\Temp\D1F1.tmp"91⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\D29D.tmp"C:\Users\Admin\AppData\Local\Temp\D29D.tmp"92⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\D31A.tmp"C:\Users\Admin\AppData\Local\Temp\D31A.tmp"93⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\D397.tmp"C:\Users\Admin\AppData\Local\Temp\D397.tmp"94⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\DBC5.tmp"C:\Users\Admin\AppData\Local\Temp\DBC5.tmp"95⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\E039.tmp"C:\Users\Admin\AppData\Local\Temp\E039.tmp"96⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\E327.tmp"C:\Users\Admin\AppData\Local\Temp\E327.tmp"97⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\E50C.tmp"C:\Users\Admin\AppData\Local\Temp\E50C.tmp"98⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\E5B8.tmp"C:\Users\Admin\AppData\Local\Temp\E5B8.tmp"99⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\E625.tmp"C:\Users\Admin\AppData\Local\Temp\E625.tmp"100⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\E857.tmp"C:\Users\Admin\AppData\Local\Temp\E857.tmp"101⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\E8C5.tmp"C:\Users\Admin\AppData\Local\Temp\E8C5.tmp"102⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\E961.tmp"C:\Users\Admin\AppData\Local\Temp\E961.tmp"103⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\EC7E.tmp"C:\Users\Admin\AppData\Local\Temp\EC7E.tmp"104⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\EEA1.tmp"C:\Users\Admin\AppData\Local\Temp\EEA1.tmp"105⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\EF1E.tmp"C:\Users\Admin\AppData\Local\Temp\EF1E.tmp"106⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\EF9B.tmp"C:\Users\Admin\AppData\Local\Temp\EF9B.tmp"107⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\F0E3.tmp"C:\Users\Admin\AppData\Local\Temp\F0E3.tmp"108⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\F160.tmp"C:\Users\Admin\AppData\Local\Temp\F160.tmp"109⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\F1ED.tmp"C:\Users\Admin\AppData\Local\Temp\F1ED.tmp"110⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\F306.tmp"C:\Users\Admin\AppData\Local\Temp\F306.tmp"111⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\F373.tmp"C:\Users\Admin\AppData\Local\Temp\F373.tmp"112⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\F3E1.tmp"C:\Users\Admin\AppData\Local\Temp\F3E1.tmp"113⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\F45E.tmp"C:\Users\Admin\AppData\Local\Temp\F45E.tmp"114⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\F548.tmp"C:\Users\Admin\AppData\Local\Temp\F548.tmp"115⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\F603.tmp"C:\Users\Admin\AppData\Local\Temp\F603.tmp"116⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\F690.tmp"C:\Users\Admin\AppData\Local\Temp\F690.tmp"117⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\F6FD.tmp"C:\Users\Admin\AppData\Local\Temp\F6FD.tmp"118⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\F7E8.tmp"C:\Users\Admin\AppData\Local\Temp\F7E8.tmp"119⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\F865.tmp"C:\Users\Admin\AppData\Local\Temp\F865.tmp"120⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\F8E2.tmp"C:\Users\Admin\AppData\Local\Temp\F8E2.tmp"121⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\FAA7.tmp"C:\Users\Admin\AppData\Local\Temp\FAA7.tmp"122⤵PID:2140
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-