Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2024, 09:46
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-27_4f72e7ba9edeed19a74205cd7179c68e_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-27_4f72e7ba9edeed19a74205cd7179c68e_mafia.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-01-27_4f72e7ba9edeed19a74205cd7179c68e_mafia.exe
-
Size
765KB
-
MD5
4f72e7ba9edeed19a74205cd7179c68e
-
SHA1
afb3f61fe167482e8de6225dc1e819f79cc014cb
-
SHA256
d712b0490fe2222612e7f0392bd6034a9fbca67c687f0afd9e920d43f10969a5
-
SHA512
44565d30ff8e757ff6201bf88e2012fb2e229dc7162bc84724db393be8531a384e1c80ba7d4701121d89d4999e9710c28fa60426411d2ce392dc16cdb86d6c42
-
SSDEEP
12288:ZU5rCOTeiDOVHboHpCz0+0I2ZNepziNTHegn+SO3g3ZF5rn5rLOa54U5w5A:ZUQOJDOlbosYXxZNc5gnYw3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1896 64E4.tmp 1280 45F2.tmp 1028 4640.tmp 1940 468E.tmp 2132 46DC.tmp 2480 474A.tmp 2008 4798.tmp 4188 47F6.tmp 2332 4853.tmp 2384 48A2.tmp 4164 48FF.tmp 1988 494D.tmp 4348 499C.tmp 4428 49F9.tmp 4676 4A57.tmp 4036 4AB5.tmp 5024 4B03.tmp 3484 4B70.tmp 3192 4BBE.tmp 5088 4C0D.tmp 4836 4C7A.tmp 2544 5C87.tmp 4084 4D26.tmp 796 4D74.tmp 3128 4DC2.tmp 2380 4E10.tmp 1488 4E5E.tmp 4616 4EAC.tmp 4840 4F1A.tmp 1372 4F87.tmp 4632 4FD5.tmp 4940 5023.tmp 2524 5081.tmp 2912 50CF.tmp 4568 512D.tmp 4132 517B.tmp 2244 51C9.tmp 4964 5217.tmp 3912 5266.tmp 1140 52D3.tmp 1284 5340.tmp 3840 538E.tmp 3112 53DD.tmp 1768 542B.tmp 4936 5479.tmp 1188 54C7.tmp 1964 5525.tmp 1512 6716.tmp 5020 6765.tmp 2648 67B3.tmp 1956 565D.tmp 4264 56BB.tmp 4588 5719.tmp 3796 5767.tmp 3036 57B5.tmp 1624 5803.tmp 644 5851.tmp 668 589F.tmp 1988 494D.tmp 4348 499C.tmp 1848 598A.tmp 628 59D8.tmp 540 5A26.tmp 4476 5A74.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2096 wrote to memory of 1896 2096 2024-01-27_4f72e7ba9edeed19a74205cd7179c68e_mafia.exe 176 PID 2096 wrote to memory of 1896 2096 2024-01-27_4f72e7ba9edeed19a74205cd7179c68e_mafia.exe 176 PID 2096 wrote to memory of 1896 2096 2024-01-27_4f72e7ba9edeed19a74205cd7179c68e_mafia.exe 176 PID 1896 wrote to memory of 1280 1896 64E4.tmp 88 PID 1896 wrote to memory of 1280 1896 64E4.tmp 88 PID 1896 wrote to memory of 1280 1896 64E4.tmp 88 PID 1280 wrote to memory of 1028 1280 45F2.tmp 89 PID 1280 wrote to memory of 1028 1280 45F2.tmp 89 PID 1280 wrote to memory of 1028 1280 45F2.tmp 89 PID 1028 wrote to memory of 1940 1028 4640.tmp 90 PID 1028 wrote to memory of 1940 1028 4640.tmp 90 PID 1028 wrote to memory of 1940 1028 4640.tmp 90 PID 1940 wrote to memory of 2132 1940 468E.tmp 91 PID 1940 wrote to memory of 2132 1940 468E.tmp 91 PID 1940 wrote to memory of 2132 1940 468E.tmp 91 PID 2132 wrote to memory of 2480 2132 46DC.tmp 92 PID 2132 wrote to memory of 2480 2132 46DC.tmp 92 PID 2132 wrote to memory of 2480 2132 46DC.tmp 92 PID 2480 wrote to memory of 2008 2480 474A.tmp 93 PID 2480 wrote to memory of 2008 2480 474A.tmp 93 PID 2480 wrote to memory of 2008 2480 474A.tmp 93 PID 2008 wrote to memory of 4188 2008 4798.tmp 204 PID 2008 wrote to memory of 4188 2008 4798.tmp 204 PID 2008 wrote to memory of 4188 2008 4798.tmp 204 PID 4188 wrote to memory of 2332 4188 47F6.tmp 203 PID 4188 wrote to memory of 2332 4188 47F6.tmp 203 PID 4188 wrote to memory of 2332 4188 47F6.tmp 203 PID 2332 wrote to memory of 2384 2332 4853.tmp 202 PID 2332 wrote to memory of 2384 2332 4853.tmp 202 PID 2332 wrote to memory of 2384 2332 4853.tmp 202 PID 2384 wrote to memory of 4164 2384 48A2.tmp 94 PID 2384 wrote to memory of 4164 2384 48A2.tmp 94 PID 2384 wrote to memory of 4164 2384 48A2.tmp 94 PID 4164 wrote to memory of 1988 4164 48FF.tmp 201 PID 4164 wrote to memory of 1988 4164 48FF.tmp 201 PID 4164 wrote to memory of 1988 4164 48FF.tmp 201 PID 1988 wrote to memory of 4348 1988 494D.tmp 200 PID 1988 wrote to memory of 4348 1988 494D.tmp 200 PID 1988 wrote to memory of 4348 1988 494D.tmp 200 PID 4348 wrote to memory of 4428 4348 499C.tmp 95 PID 4348 wrote to memory of 4428 4348 499C.tmp 95 PID 4348 wrote to memory of 4428 4348 499C.tmp 95 PID 4428 wrote to memory of 4676 4428 49F9.tmp 199 PID 4428 wrote to memory of 4676 4428 49F9.tmp 199 PID 4428 wrote to memory of 4676 4428 49F9.tmp 199 PID 4676 wrote to memory of 4036 4676 4A57.tmp 96 PID 4676 wrote to memory of 4036 4676 4A57.tmp 96 PID 4676 wrote to memory of 4036 4676 4A57.tmp 96 PID 4036 wrote to memory of 5024 4036 4AB5.tmp 198 PID 4036 wrote to memory of 5024 4036 4AB5.tmp 198 PID 4036 wrote to memory of 5024 4036 4AB5.tmp 198 PID 5024 wrote to memory of 3484 5024 4B03.tmp 197 PID 5024 wrote to memory of 3484 5024 4B03.tmp 197 PID 5024 wrote to memory of 3484 5024 4B03.tmp 197 PID 3484 wrote to memory of 3192 3484 4B70.tmp 97 PID 3484 wrote to memory of 3192 3484 4B70.tmp 97 PID 3484 wrote to memory of 3192 3484 4B70.tmp 97 PID 3192 wrote to memory of 5088 3192 4BBE.tmp 193 PID 3192 wrote to memory of 5088 3192 4BBE.tmp 193 PID 3192 wrote to memory of 5088 3192 4BBE.tmp 193 PID 5088 wrote to memory of 4836 5088 4C0D.tmp 192 PID 5088 wrote to memory of 4836 5088 4C0D.tmp 192 PID 5088 wrote to memory of 4836 5088 4C0D.tmp 192 PID 4836 wrote to memory of 2544 4836 4C7A.tmp 149
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-27_4f72e7ba9edeed19a74205cd7179c68e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-27_4f72e7ba9edeed19a74205cd7179c68e_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"2⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\45F2.tmp"C:\Users\Admin\AppData\Local\Temp\45F2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988
-
-
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676
-
-
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024
-
-
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088
-
-
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"1⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"1⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"2⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"3⤵
- Executes dropped EXE
PID:1488
-
-
-
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"1⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"2⤵
- Executes dropped EXE
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"3⤵
- Executes dropped EXE
PID:4568
-
-
-
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"1⤵
- Executes dropped EXE
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"2⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"3⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"4⤵
- Executes dropped EXE
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"5⤵
- Executes dropped EXE
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"6⤵
- Executes dropped EXE
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"7⤵
- Executes dropped EXE
PID:3840
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"1⤵
- Executes dropped EXE
PID:4940
-
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"1⤵
- Executes dropped EXE
PID:4632
-
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"1⤵
- Executes dropped EXE
PID:1372
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"1⤵
- Executes dropped EXE
PID:4840
-
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"1⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"2⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"3⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"4⤵
- Executes dropped EXE
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"5⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"6⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"7⤵PID:5020
-
-
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"7⤵
- Executes dropped EXE
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"8⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"9⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"10⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"11⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"12⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"13⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"14⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"15⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"16⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"17⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"18⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"19⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"20⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"21⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"22⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"23⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"24⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"25⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"26⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"27⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"28⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"29⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"30⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"31⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"32⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"33⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\73F7.tmp"C:\Users\Admin\AppData\Local\Temp\73F7.tmp"34⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\7445.tmp"C:\Users\Admin\AppData\Local\Temp\7445.tmp"35⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"36⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"37⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"38⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"39⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"40⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"41⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"42⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"43⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\7724.tmp"C:\Users\Admin\AppData\Local\Temp\7724.tmp"44⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"45⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\77DF.tmp"C:\Users\Admin\AppData\Local\Temp\77DF.tmp"46⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\782D.tmp"C:\Users\Admin\AppData\Local\Temp\782D.tmp"47⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"48⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"49⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\7927.tmp"C:\Users\Admin\AppData\Local\Temp\7927.tmp"50⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\7976.tmp"C:\Users\Admin\AppData\Local\Temp\7976.tmp"51⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\79D3.tmp"C:\Users\Admin\AppData\Local\Temp\79D3.tmp"52⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\7A21.tmp"C:\Users\Admin\AppData\Local\Temp\7A21.tmp"53⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\7A60.tmp"C:\Users\Admin\AppData\Local\Temp\7A60.tmp"54⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"55⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"56⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"57⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"58⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\7C15.tmp"C:\Users\Admin\AppData\Local\Temp\7C15.tmp"59⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\7C64.tmp"C:\Users\Admin\AppData\Local\Temp\7C64.tmp"60⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"61⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"62⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"63⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"64⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"65⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\7E48.tmp"C:\Users\Admin\AppData\Local\Temp\7E48.tmp"66⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"67⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\7F03.tmp"C:\Users\Admin\AppData\Local\Temp\7F03.tmp"68⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\7F52.tmp"C:\Users\Admin\AppData\Local\Temp\7F52.tmp"69⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"70⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\800D.tmp"C:\Users\Admin\AppData\Local\Temp\800D.tmp"71⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"72⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\80B9.tmp"C:\Users\Admin\AppData\Local\Temp\80B9.tmp"73⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\8117.tmp"C:\Users\Admin\AppData\Local\Temp\8117.tmp"74⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\8165.tmp"C:\Users\Admin\AppData\Local\Temp\8165.tmp"75⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\81C3.tmp"C:\Users\Admin\AppData\Local\Temp\81C3.tmp"76⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"77⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\825F.tmp"C:\Users\Admin\AppData\Local\Temp\825F.tmp"78⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\82BD.tmp"C:\Users\Admin\AppData\Local\Temp\82BD.tmp"79⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"80⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\8368.tmp"C:\Users\Admin\AppData\Local\Temp\8368.tmp"81⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\83B7.tmp"C:\Users\Admin\AppData\Local\Temp\83B7.tmp"82⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\8405.tmp"C:\Users\Admin\AppData\Local\Temp\8405.tmp"83⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\8453.tmp"C:\Users\Admin\AppData\Local\Temp\8453.tmp"84⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\84A1.tmp"C:\Users\Admin\AppData\Local\Temp\84A1.tmp"85⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\84EF.tmp"C:\Users\Admin\AppData\Local\Temp\84EF.tmp"86⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\854D.tmp"C:\Users\Admin\AppData\Local\Temp\854D.tmp"87⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\859B.tmp"C:\Users\Admin\AppData\Local\Temp\859B.tmp"88⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"89⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\8647.tmp"C:\Users\Admin\AppData\Local\Temp\8647.tmp"90⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\8695.tmp"C:\Users\Admin\AppData\Local\Temp\8695.tmp"91⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\86E3.tmp"C:\Users\Admin\AppData\Local\Temp\86E3.tmp"92⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\8741.tmp"C:\Users\Admin\AppData\Local\Temp\8741.tmp"93⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\878F.tmp"C:\Users\Admin\AppData\Local\Temp\878F.tmp"94⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\87DD.tmp"C:\Users\Admin\AppData\Local\Temp\87DD.tmp"95⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\883B.tmp"C:\Users\Admin\AppData\Local\Temp\883B.tmp"96⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\8899.tmp"C:\Users\Admin\AppData\Local\Temp\8899.tmp"97⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\88E7.tmp"C:\Users\Admin\AppData\Local\Temp\88E7.tmp"98⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"99⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\8993.tmp"C:\Users\Admin\AppData\Local\Temp\8993.tmp"100⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\89E1.tmp"C:\Users\Admin\AppData\Local\Temp\89E1.tmp"101⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"102⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"103⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"104⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\8B38.tmp"C:\Users\Admin\AppData\Local\Temp\8B38.tmp"105⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\8B87.tmp"C:\Users\Admin\AppData\Local\Temp\8B87.tmp"106⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"107⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\8C23.tmp"C:\Users\Admin\AppData\Local\Temp\8C23.tmp"108⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\8C71.tmp"C:\Users\Admin\AppData\Local\Temp\8C71.tmp"109⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"110⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"111⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"112⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"113⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\8E26.tmp"C:\Users\Admin\AppData\Local\Temp\8E26.tmp"114⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\8E84.tmp"C:\Users\Admin\AppData\Local\Temp\8E84.tmp"115⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"116⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\8F20.tmp"C:\Users\Admin\AppData\Local\Temp\8F20.tmp"117⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"118⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"119⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\902A.tmp"C:\Users\Admin\AppData\Local\Temp\902A.tmp"120⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\9078.tmp"C:\Users\Admin\AppData\Local\Temp\9078.tmp"121⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"122⤵PID:4564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-