Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
23/01/2024, 14:02
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-23_0cddd84120001dee4ac2c2409689aef1_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-23_0cddd84120001dee4ac2c2409689aef1_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-23_0cddd84120001dee4ac2c2409689aef1_mafia.exe
-
Size
765KB
-
MD5
0cddd84120001dee4ac2c2409689aef1
-
SHA1
a0875f6a9e2c7da3f41201c6f667d98cb84ba574
-
SHA256
cbb850f4442a61fefd0ce06c97802d6d8b5cb1b8071cc79396d2788f7d058f7b
-
SHA512
d5cf0ce730837d04abfd2ceacd44ac3b9e850ddf97ba7721c9b8459069040d182ff4ce66a5a7b4d487b4ffb8cebaf1e464390c2375f532fc23af13ea2ca2d77e
-
SSDEEP
12288:ZU5rCOTeiDauiZ9l65NvjNqnA+93ZF5rn5rLOa54U5w5A:ZUQOJDaZa5NvjYnAw3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4408 E985.tmp 4380 EB98.tmp 1716 ECD1.tmp 1460 F7CD.tmp 4172 F992.tmp 1828 FA9C.tmp 544 FBC5.tmp 1808 FCEE.tmp 2284 FDC9.tmp 3280 FEA3.tmp 3260 FFBD.tmp 3472 78.tmp 1384 134.tmp 4720 21E.tmp 1484 308.tmp 3740 3F3.tmp 1232 4FC.tmp 3876 5E7.tmp 3340 6A2.tmp 5032 79C.tmp 1712 896.tmp 3372 981.tmp 3976 A5B.tmp 116 B75.tmp 2812 C6F.tmp 3376 D59.tmp 520 E72.tmp 1852 F9B.tmp 1608 1085.tmp 2648 118F.tmp 2164 1279.tmp 2572 13A2.tmp 4612 146D.tmp 3328 150A.tmp 3620 1596.tmp 4444 1623.tmp 3500 16DE.tmp 1028 175B.tmp 3104 17F8.tmp 2104 1911.tmp 4292 199E.tmp 3484 1A1B.tmp 2688 1A88.tmp 4892 1B24.tmp 1828 1BC0.tmp 2056 1C6C.tmp 4684 1D28.tmp 544 1DC4.tmp 1424 1E51.tmp 2492 1EDD.tmp 220 1F7A.tmp 4724 2045.tmp 3536 20B2.tmp 1552 215E.tmp 4124 21DB.tmp 1040 2277.tmp 3312 22F4.tmp 924 2390.tmp 4496 241D.tmp 2332 24AA.tmp 3364 2517.tmp 3876 25A4.tmp 3340 2621.tmp 4872 26AD.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5076 wrote to memory of 4408 5076 2024-01-23_0cddd84120001dee4ac2c2409689aef1_mafia.exe 88 PID 5076 wrote to memory of 4408 5076 2024-01-23_0cddd84120001dee4ac2c2409689aef1_mafia.exe 88 PID 5076 wrote to memory of 4408 5076 2024-01-23_0cddd84120001dee4ac2c2409689aef1_mafia.exe 88 PID 4408 wrote to memory of 4380 4408 E985.tmp 90 PID 4408 wrote to memory of 4380 4408 E985.tmp 90 PID 4408 wrote to memory of 4380 4408 E985.tmp 90 PID 4380 wrote to memory of 1716 4380 EB98.tmp 91 PID 4380 wrote to memory of 1716 4380 EB98.tmp 91 PID 4380 wrote to memory of 1716 4380 EB98.tmp 91 PID 1716 wrote to memory of 1460 1716 ECD1.tmp 92 PID 1716 wrote to memory of 1460 1716 ECD1.tmp 92 PID 1716 wrote to memory of 1460 1716 ECD1.tmp 92 PID 1460 wrote to memory of 4172 1460 F7CD.tmp 93 PID 1460 wrote to memory of 4172 1460 F7CD.tmp 93 PID 1460 wrote to memory of 4172 1460 F7CD.tmp 93 PID 4172 wrote to memory of 1828 4172 F992.tmp 94 PID 4172 wrote to memory of 1828 4172 F992.tmp 94 PID 4172 wrote to memory of 1828 4172 F992.tmp 94 PID 1828 wrote to memory of 544 1828 FA9C.tmp 95 PID 1828 wrote to memory of 544 1828 FA9C.tmp 95 PID 1828 wrote to memory of 544 1828 FA9C.tmp 95 PID 544 wrote to memory of 1808 544 FBC5.tmp 96 PID 544 wrote to memory of 1808 544 FBC5.tmp 96 PID 544 wrote to memory of 1808 544 FBC5.tmp 96 PID 1808 wrote to memory of 2284 1808 FCEE.tmp 97 PID 1808 wrote to memory of 2284 1808 FCEE.tmp 97 PID 1808 wrote to memory of 2284 1808 FCEE.tmp 97 PID 2284 wrote to memory of 3280 2284 FDC9.tmp 98 PID 2284 wrote to memory of 3280 2284 FDC9.tmp 98 PID 2284 wrote to memory of 3280 2284 FDC9.tmp 98 PID 3280 wrote to memory of 3260 3280 FEA3.tmp 99 PID 3280 wrote to memory of 3260 3280 FEA3.tmp 99 PID 3280 wrote to memory of 3260 3280 FEA3.tmp 99 PID 3260 wrote to memory of 3472 3260 FFBD.tmp 100 PID 3260 wrote to memory of 3472 3260 FFBD.tmp 100 PID 3260 wrote to memory of 3472 3260 FFBD.tmp 100 PID 3472 wrote to memory of 1384 3472 78.tmp 101 PID 3472 wrote to memory of 1384 3472 78.tmp 101 PID 3472 wrote to memory of 1384 3472 78.tmp 101 PID 1384 wrote to memory of 4720 1384 134.tmp 102 PID 1384 wrote to memory of 4720 1384 134.tmp 102 PID 1384 wrote to memory of 4720 1384 134.tmp 102 PID 4720 wrote to memory of 1484 4720 21E.tmp 103 PID 4720 wrote to memory of 1484 4720 21E.tmp 103 PID 4720 wrote to memory of 1484 4720 21E.tmp 103 PID 1484 wrote to memory of 3740 1484 308.tmp 104 PID 1484 wrote to memory of 3740 1484 308.tmp 104 PID 1484 wrote to memory of 3740 1484 308.tmp 104 PID 3740 wrote to memory of 1232 3740 3F3.tmp 105 PID 3740 wrote to memory of 1232 3740 3F3.tmp 105 PID 3740 wrote to memory of 1232 3740 3F3.tmp 105 PID 1232 wrote to memory of 3876 1232 4FC.tmp 106 PID 1232 wrote to memory of 3876 1232 4FC.tmp 106 PID 1232 wrote to memory of 3876 1232 4FC.tmp 106 PID 3876 wrote to memory of 3340 3876 5E7.tmp 107 PID 3876 wrote to memory of 3340 3876 5E7.tmp 107 PID 3876 wrote to memory of 3340 3876 5E7.tmp 107 PID 3340 wrote to memory of 5032 3340 6A2.tmp 108 PID 3340 wrote to memory of 5032 3340 6A2.tmp 108 PID 3340 wrote to memory of 5032 3340 6A2.tmp 108 PID 5032 wrote to memory of 1712 5032 79C.tmp 109 PID 5032 wrote to memory of 1712 5032 79C.tmp 109 PID 5032 wrote to memory of 1712 5032 79C.tmp 109 PID 1712 wrote to memory of 3372 1712 896.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-23_0cddd84120001dee4ac2c2409689aef1_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-23_0cddd84120001dee4ac2c2409689aef1_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\E985.tmp"C:\Users\Admin\AppData\Local\Temp\E985.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\EB98.tmp"C:\Users\Admin\AppData\Local\Temp\EB98.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\F7CD.tmp"C:\Users\Admin\AppData\Local\Temp\F7CD.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\F992.tmp"C:\Users\Admin\AppData\Local\Temp\F992.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\78.tmp"C:\Users\Admin\AppData\Local\Temp\78.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\134.tmp"C:\Users\Admin\AppData\Local\Temp\134.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\21E.tmp"C:\Users\Admin\AppData\Local\Temp\21E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\308.tmp"C:\Users\Admin\AppData\Local\Temp\308.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\3F3.tmp"C:\Users\Admin\AppData\Local\Temp\3F3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\4FC.tmp"C:\Users\Admin\AppData\Local\Temp\4FC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\5E7.tmp"C:\Users\Admin\AppData\Local\Temp\5E7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\6A2.tmp"C:\Users\Admin\AppData\Local\Temp\6A2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\79C.tmp"C:\Users\Admin\AppData\Local\Temp\79C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\896.tmp"C:\Users\Admin\AppData\Local\Temp\896.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\981.tmp"C:\Users\Admin\AppData\Local\Temp\981.tmp"23⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\A5B.tmp"C:\Users\Admin\AppData\Local\Temp\A5B.tmp"24⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\B75.tmp"C:\Users\Admin\AppData\Local\Temp\B75.tmp"25⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"26⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\D59.tmp"C:\Users\Admin\AppData\Local\Temp\D59.tmp"27⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\E72.tmp"C:\Users\Admin\AppData\Local\Temp\E72.tmp"28⤵
- Executes dropped EXE
PID:520 -
C:\Users\Admin\AppData\Local\Temp\F9B.tmp"C:\Users\Admin\AppData\Local\Temp\F9B.tmp"29⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\1085.tmp"C:\Users\Admin\AppData\Local\Temp\1085.tmp"30⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\118F.tmp"C:\Users\Admin\AppData\Local\Temp\118F.tmp"31⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\1279.tmp"C:\Users\Admin\AppData\Local\Temp\1279.tmp"32⤵
- Executes dropped EXE
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\13A2.tmp"C:\Users\Admin\AppData\Local\Temp\13A2.tmp"33⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\146D.tmp"C:\Users\Admin\AppData\Local\Temp\146D.tmp"34⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\150A.tmp"C:\Users\Admin\AppData\Local\Temp\150A.tmp"35⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\1596.tmp"C:\Users\Admin\AppData\Local\Temp\1596.tmp"36⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\1623.tmp"C:\Users\Admin\AppData\Local\Temp\1623.tmp"37⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\16DE.tmp"C:\Users\Admin\AppData\Local\Temp\16DE.tmp"38⤵
- Executes dropped EXE
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\175B.tmp"C:\Users\Admin\AppData\Local\Temp\175B.tmp"39⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\17F8.tmp"C:\Users\Admin\AppData\Local\Temp\17F8.tmp"40⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\1911.tmp"C:\Users\Admin\AppData\Local\Temp\1911.tmp"41⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\199E.tmp"C:\Users\Admin\AppData\Local\Temp\199E.tmp"42⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"43⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\1A88.tmp"C:\Users\Admin\AppData\Local\Temp\1A88.tmp"44⤵
- Executes dropped EXE
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\1B24.tmp"C:\Users\Admin\AppData\Local\Temp\1B24.tmp"45⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\1BC0.tmp"C:\Users\Admin\AppData\Local\Temp\1BC0.tmp"46⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"47⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\1D28.tmp"C:\Users\Admin\AppData\Local\Temp\1D28.tmp"48⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\1DC4.tmp"C:\Users\Admin\AppData\Local\Temp\1DC4.tmp"49⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\1E51.tmp"C:\Users\Admin\AppData\Local\Temp\1E51.tmp"50⤵
- Executes dropped EXE
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\1EDD.tmp"C:\Users\Admin\AppData\Local\Temp\1EDD.tmp"51⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\1F7A.tmp"C:\Users\Admin\AppData\Local\Temp\1F7A.tmp"52⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\2045.tmp"C:\Users\Admin\AppData\Local\Temp\2045.tmp"53⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\20B2.tmp"C:\Users\Admin\AppData\Local\Temp\20B2.tmp"54⤵
- Executes dropped EXE
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\215E.tmp"C:\Users\Admin\AppData\Local\Temp\215E.tmp"55⤵
- Executes dropped EXE
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\21DB.tmp"C:\Users\Admin\AppData\Local\Temp\21DB.tmp"56⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\2277.tmp"C:\Users\Admin\AppData\Local\Temp\2277.tmp"57⤵
- Executes dropped EXE
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\22F4.tmp"C:\Users\Admin\AppData\Local\Temp\22F4.tmp"58⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\2390.tmp"C:\Users\Admin\AppData\Local\Temp\2390.tmp"59⤵
- Executes dropped EXE
PID:924 -
C:\Users\Admin\AppData\Local\Temp\241D.tmp"C:\Users\Admin\AppData\Local\Temp\241D.tmp"60⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\24AA.tmp"C:\Users\Admin\AppData\Local\Temp\24AA.tmp"61⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\2517.tmp"C:\Users\Admin\AppData\Local\Temp\2517.tmp"62⤵
- Executes dropped EXE
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\25A4.tmp"C:\Users\Admin\AppData\Local\Temp\25A4.tmp"63⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\2621.tmp"C:\Users\Admin\AppData\Local\Temp\2621.tmp"64⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\26AD.tmp"C:\Users\Admin\AppData\Local\Temp\26AD.tmp"65⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\272A.tmp"C:\Users\Admin\AppData\Local\Temp\272A.tmp"66⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\27B7.tmp"C:\Users\Admin\AppData\Local\Temp\27B7.tmp"67⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\2824.tmp"C:\Users\Admin\AppData\Local\Temp\2824.tmp"68⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\28A1.tmp"C:\Users\Admin\AppData\Local\Temp\28A1.tmp"69⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\294D.tmp"C:\Users\Admin\AppData\Local\Temp\294D.tmp"70⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\29DA.tmp"C:\Users\Admin\AppData\Local\Temp\29DA.tmp"71⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\2A66.tmp"C:\Users\Admin\AppData\Local\Temp\2A66.tmp"72⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"73⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\2B70.tmp"C:\Users\Admin\AppData\Local\Temp\2B70.tmp"74⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\2C0C.tmp"C:\Users\Admin\AppData\Local\Temp\2C0C.tmp"75⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\2CB8.tmp"C:\Users\Admin\AppData\Local\Temp\2CB8.tmp"76⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\2D26.tmp"C:\Users\Admin\AppData\Local\Temp\2D26.tmp"77⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"78⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\2E5E.tmp"C:\Users\Admin\AppData\Local\Temp\2E5E.tmp"79⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\2F0A.tmp"C:\Users\Admin\AppData\Local\Temp\2F0A.tmp"80⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\2F97.tmp"C:\Users\Admin\AppData\Local\Temp\2F97.tmp"81⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\3023.tmp"C:\Users\Admin\AppData\Local\Temp\3023.tmp"82⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\30BF.tmp"C:\Users\Admin\AppData\Local\Temp\30BF.tmp"83⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\313C.tmp"C:\Users\Admin\AppData\Local\Temp\313C.tmp"84⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"85⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"86⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\3311.tmp"C:\Users\Admin\AppData\Local\Temp\3311.tmp"87⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"88⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"89⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"90⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"91⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\35E0.tmp"C:\Users\Admin\AppData\Local\Temp\35E0.tmp"92⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\366D.tmp"C:\Users\Admin\AppData\Local\Temp\366D.tmp"93⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\3728.tmp"C:\Users\Admin\AppData\Local\Temp\3728.tmp"94⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\37D4.tmp"C:\Users\Admin\AppData\Local\Temp\37D4.tmp"95⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\3851.tmp"C:\Users\Admin\AppData\Local\Temp\3851.tmp"96⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\38DE.tmp"C:\Users\Admin\AppData\Local\Temp\38DE.tmp"97⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\397A.tmp"C:\Users\Admin\AppData\Local\Temp\397A.tmp"98⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\3A06.tmp"C:\Users\Admin\AppData\Local\Temp\3A06.tmp"99⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\3B4F.tmp"C:\Users\Admin\AppData\Local\Temp\3B4F.tmp"100⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\3BEB.tmp"C:\Users\Admin\AppData\Local\Temp\3BEB.tmp"101⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\3C68.tmp"C:\Users\Admin\AppData\Local\Temp\3C68.tmp"102⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\3CE5.tmp"C:\Users\Admin\AppData\Local\Temp\3CE5.tmp"103⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\3D71.tmp"C:\Users\Admin\AppData\Local\Temp\3D71.tmp"104⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\3E0E.tmp"C:\Users\Admin\AppData\Local\Temp\3E0E.tmp"105⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\3E7B.tmp"C:\Users\Admin\AppData\Local\Temp\3E7B.tmp"106⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\3EF8.tmp"C:\Users\Admin\AppData\Local\Temp\3EF8.tmp"107⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\3F65.tmp"C:\Users\Admin\AppData\Local\Temp\3F65.tmp"108⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\3FF2.tmp"C:\Users\Admin\AppData\Local\Temp\3FF2.tmp"109⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\409E.tmp"C:\Users\Admin\AppData\Local\Temp\409E.tmp"110⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\410B.tmp"C:\Users\Admin\AppData\Local\Temp\410B.tmp"111⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\41A8.tmp"C:\Users\Admin\AppData\Local\Temp\41A8.tmp"112⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\4244.tmp"C:\Users\Admin\AppData\Local\Temp\4244.tmp"113⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\42C1.tmp"C:\Users\Admin\AppData\Local\Temp\42C1.tmp"114⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\438C.tmp"C:\Users\Admin\AppData\Local\Temp\438C.tmp"115⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\4409.tmp"C:\Users\Admin\AppData\Local\Temp\4409.tmp"116⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\44A5.tmp"C:\Users\Admin\AppData\Local\Temp\44A5.tmp"117⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\4522.tmp"C:\Users\Admin\AppData\Local\Temp\4522.tmp"118⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\4590.tmp"C:\Users\Admin\AppData\Local\Temp\4590.tmp"119⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\463B.tmp"C:\Users\Admin\AppData\Local\Temp\463B.tmp"120⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\46A9.tmp"C:\Users\Admin\AppData\Local\Temp\46A9.tmp"121⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\4745.tmp"C:\Users\Admin\AppData\Local\Temp\4745.tmp"122⤵PID:1500
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-