Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
13/02/2024, 17:42
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-13_33689ed8fded1a045fc96dcce8b33872_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-13_33689ed8fded1a045fc96dcce8b33872_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-13_33689ed8fded1a045fc96dcce8b33872_mafia.exe
-
Size
765KB
-
MD5
33689ed8fded1a045fc96dcce8b33872
-
SHA1
5825ea0f001dfa8ba7d797081ca638cbbbd0e21a
-
SHA256
de5ef77290fdcfb4834a915db641e2607ed5a3730d4591cdbb19465bbfdeff4e
-
SHA512
cf8afec0ea0e582d58f4f0ca732a460226ac00183032594ebf62daef976d30a412351fc8dcc0cda42c1d462c5451668c4e8482c931272a2c2d5ce70b26dbd46a
-
SSDEEP
12288:ZU5rCOTeiDpTRuQhqV36SSze/5uAE0S8gOV+1jRN3ZF5rn5rLOa54U5w5A:ZUQOJDHo0Fq/mOVGdN3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2668 52F0.tmp 2688 535E.tmp 2872 53FA.tmp 2584 5486.tmp 2880 5503.tmp 2980 559F.tmp 2620 562B.tmp 2588 56C7.tmp 2700 5754.tmp 2624 57FF.tmp 2008 588C.tmp 596 5928.tmp 1176 59D3.tmp 1156 5A50.tmp 2764 5AEC.tmp 2896 5B78.tmp 2616 5C05.tmp 2068 5C82.tmp 2548 5D1E.tmp 364 5DBA.tmp 1996 5E46.tmp 2092 5EB3.tmp 2900 5F20.tmp 1868 5F7E.tmp 1820 5FDC.tmp 1608 6039.tmp 2088 6097.tmp 1124 6104.tmp 2256 6171.tmp 2284 61DE.tmp 3036 624C.tmp 2476 62F7.tmp 2992 6336.tmp 1832 63C2.tmp 1740 6410.tmp 1788 6596.tmp 848 6632.tmp 1132 66AF.tmp 2788 670D.tmp 1540 6799.tmp 536 6845.tmp 1352 68C1.tmp 1652 691F.tmp 1624 696D.tmp 620 69EA.tmp 2516 6A38.tmp 1804 6AA5.tmp 2380 6B22.tmp 1940 6B8F.tmp 392 6C0C.tmp 2072 6C5A.tmp 892 6CC7.tmp 2012 6D34.tmp 2128 6D92.tmp 1568 6DE0.tmp 1692 6E5D.tmp 2868 6ED9.tmp 2712 6F47.tmp 2612 6FB4.tmp 2940 7021.tmp 3024 708E.tmp 2412 70FB.tmp 2544 7169.tmp 2556 71C6.tmp -
Loads dropped DLL 64 IoCs
pid Process 2024 2024-02-13_33689ed8fded1a045fc96dcce8b33872_mafia.exe 2668 52F0.tmp 2688 535E.tmp 2872 53FA.tmp 2584 5486.tmp 2880 5503.tmp 2980 559F.tmp 2620 562B.tmp 2588 56C7.tmp 2700 5754.tmp 2624 57FF.tmp 2008 588C.tmp 596 5928.tmp 1176 59D3.tmp 1156 5A50.tmp 2764 5AEC.tmp 2896 5B78.tmp 2616 5C05.tmp 2068 5C82.tmp 2548 5D1E.tmp 364 5DBA.tmp 1996 5E46.tmp 2092 5EB3.tmp 2900 5F20.tmp 1868 5F7E.tmp 1820 5FDC.tmp 1608 6039.tmp 2088 6097.tmp 1124 6104.tmp 2256 6171.tmp 2284 61DE.tmp 3036 624C.tmp 2476 62F7.tmp 2992 6336.tmp 1832 63C2.tmp 1740 6410.tmp 1788 6596.tmp 848 6632.tmp 1132 66AF.tmp 2788 670D.tmp 1540 6799.tmp 536 6845.tmp 1352 68C1.tmp 1652 691F.tmp 1624 696D.tmp 620 69EA.tmp 2516 6A38.tmp 1804 6AA5.tmp 2380 6B22.tmp 1940 6B8F.tmp 392 6C0C.tmp 2072 6C5A.tmp 892 6CC7.tmp 2012 6D34.tmp 2128 6D92.tmp 1568 6DE0.tmp 1692 6E5D.tmp 2868 6ED9.tmp 2712 6F47.tmp 2612 6FB4.tmp 2940 7021.tmp 3024 708E.tmp 2412 70FB.tmp 2544 7169.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2024 wrote to memory of 2668 2024 2024-02-13_33689ed8fded1a045fc96dcce8b33872_mafia.exe 28 PID 2024 wrote to memory of 2668 2024 2024-02-13_33689ed8fded1a045fc96dcce8b33872_mafia.exe 28 PID 2024 wrote to memory of 2668 2024 2024-02-13_33689ed8fded1a045fc96dcce8b33872_mafia.exe 28 PID 2024 wrote to memory of 2668 2024 2024-02-13_33689ed8fded1a045fc96dcce8b33872_mafia.exe 28 PID 2668 wrote to memory of 2688 2668 52F0.tmp 29 PID 2668 wrote to memory of 2688 2668 52F0.tmp 29 PID 2668 wrote to memory of 2688 2668 52F0.tmp 29 PID 2668 wrote to memory of 2688 2668 52F0.tmp 29 PID 2688 wrote to memory of 2872 2688 535E.tmp 30 PID 2688 wrote to memory of 2872 2688 535E.tmp 30 PID 2688 wrote to memory of 2872 2688 535E.tmp 30 PID 2688 wrote to memory of 2872 2688 535E.tmp 30 PID 2872 wrote to memory of 2584 2872 53FA.tmp 31 PID 2872 wrote to memory of 2584 2872 53FA.tmp 31 PID 2872 wrote to memory of 2584 2872 53FA.tmp 31 PID 2872 wrote to memory of 2584 2872 53FA.tmp 31 PID 2584 wrote to memory of 2880 2584 5486.tmp 57 PID 2584 wrote to memory of 2880 2584 5486.tmp 57 PID 2584 wrote to memory of 2880 2584 5486.tmp 57 PID 2584 wrote to memory of 2880 2584 5486.tmp 57 PID 2880 wrote to memory of 2980 2880 5503.tmp 56 PID 2880 wrote to memory of 2980 2880 5503.tmp 56 PID 2880 wrote to memory of 2980 2880 5503.tmp 56 PID 2880 wrote to memory of 2980 2880 5503.tmp 56 PID 2980 wrote to memory of 2620 2980 559F.tmp 55 PID 2980 wrote to memory of 2620 2980 559F.tmp 55 PID 2980 wrote to memory of 2620 2980 559F.tmp 55 PID 2980 wrote to memory of 2620 2980 559F.tmp 55 PID 2620 wrote to memory of 2588 2620 562B.tmp 54 PID 2620 wrote to memory of 2588 2620 562B.tmp 54 PID 2620 wrote to memory of 2588 2620 562B.tmp 54 PID 2620 wrote to memory of 2588 2620 562B.tmp 54 PID 2588 wrote to memory of 2700 2588 56C7.tmp 32 PID 2588 wrote to memory of 2700 2588 56C7.tmp 32 PID 2588 wrote to memory of 2700 2588 56C7.tmp 32 PID 2588 wrote to memory of 2700 2588 56C7.tmp 32 PID 2700 wrote to memory of 2624 2700 5754.tmp 53 PID 2700 wrote to memory of 2624 2700 5754.tmp 53 PID 2700 wrote to memory of 2624 2700 5754.tmp 53 PID 2700 wrote to memory of 2624 2700 5754.tmp 53 PID 2624 wrote to memory of 2008 2624 57FF.tmp 52 PID 2624 wrote to memory of 2008 2624 57FF.tmp 52 PID 2624 wrote to memory of 2008 2624 57FF.tmp 52 PID 2624 wrote to memory of 2008 2624 57FF.tmp 52 PID 2008 wrote to memory of 596 2008 588C.tmp 51 PID 2008 wrote to memory of 596 2008 588C.tmp 51 PID 2008 wrote to memory of 596 2008 588C.tmp 51 PID 2008 wrote to memory of 596 2008 588C.tmp 51 PID 596 wrote to memory of 1176 596 5928.tmp 50 PID 596 wrote to memory of 1176 596 5928.tmp 50 PID 596 wrote to memory of 1176 596 5928.tmp 50 PID 596 wrote to memory of 1176 596 5928.tmp 50 PID 1176 wrote to memory of 1156 1176 59D3.tmp 49 PID 1176 wrote to memory of 1156 1176 59D3.tmp 49 PID 1176 wrote to memory of 1156 1176 59D3.tmp 49 PID 1176 wrote to memory of 1156 1176 59D3.tmp 49 PID 1156 wrote to memory of 2764 1156 5A50.tmp 48 PID 1156 wrote to memory of 2764 1156 5A50.tmp 48 PID 1156 wrote to memory of 2764 1156 5A50.tmp 48 PID 1156 wrote to memory of 2764 1156 5A50.tmp 48 PID 2764 wrote to memory of 2896 2764 5AEC.tmp 47 PID 2764 wrote to memory of 2896 2764 5AEC.tmp 47 PID 2764 wrote to memory of 2896 2764 5AEC.tmp 47 PID 2764 wrote to memory of 2896 2764 5AEC.tmp 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-13_33689ed8fded1a045fc96dcce8b33872_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-13_33689ed8fded1a045fc96dcce8b33872_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\52F0.tmp"C:\Users\Admin\AppData\Local\Temp\52F0.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\535E.tmp"C:\Users\Admin\AppData\Local\Temp\535E.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\53FA.tmp"C:\Users\Admin\AppData\Local\Temp\53FA.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\5486.tmp"C:\Users\Admin\AppData\Local\Temp\5486.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\5503.tmp"C:\Users\Admin\AppData\Local\Temp\5503.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2880
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\5754.tmp"C:\Users\Admin\AppData\Local\Temp\5754.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\57FF.tmp"C:\Users\Admin\AppData\Local\Temp\57FF.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624
-
-
C:\Users\Admin\AppData\Local\Temp\5F7E.tmp"C:\Users\Admin\AppData\Local\Temp\5F7E.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\5FDC.tmp"C:\Users\Admin\AppData\Local\Temp\5FDC.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820
-
-
C:\Users\Admin\AppData\Local\Temp\6039.tmp"C:\Users\Admin\AppData\Local\Temp\6039.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\6097.tmp"C:\Users\Admin\AppData\Local\Temp\6097.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\6104.tmp"C:\Users\Admin\AppData\Local\Temp\6104.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\6171.tmp"C:\Users\Admin\AppData\Local\Temp\6171.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\61DE.tmp"C:\Users\Admin\AppData\Local\Temp\61DE.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\624C.tmp"C:\Users\Admin\AppData\Local\Temp\624C.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\62F7.tmp"C:\Users\Admin\AppData\Local\Temp\62F7.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\6336.tmp"C:\Users\Admin\AppData\Local\Temp\6336.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\63C2.tmp"C:\Users\Admin\AppData\Local\Temp\63C2.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\6410.tmp"C:\Users\Admin\AppData\Local\Temp\6410.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\6596.tmp"C:\Users\Admin\AppData\Local\Temp\6596.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\6632.tmp"C:\Users\Admin\AppData\Local\Temp\6632.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:848 -
C:\Users\Admin\AppData\Local\Temp\66AF.tmp"C:\Users\Admin\AppData\Local\Temp\66AF.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\670D.tmp"C:\Users\Admin\AppData\Local\Temp\670D.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\6799.tmp"C:\Users\Admin\AppData\Local\Temp\6799.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\6845.tmp"C:\Users\Admin\AppData\Local\Temp\6845.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
PID:536 -
C:\Users\Admin\AppData\Local\Temp\68C1.tmp"C:\Users\Admin\AppData\Local\Temp\68C1.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\691F.tmp"C:\Users\Admin\AppData\Local\Temp\691F.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\696D.tmp"C:\Users\Admin\AppData\Local\Temp\696D.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\69EA.tmp"C:\Users\Admin\AppData\Local\Temp\69EA.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:620 -
C:\Users\Admin\AppData\Local\Temp\6A38.tmp"C:\Users\Admin\AppData\Local\Temp\6A38.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\6AA5.tmp"C:\Users\Admin\AppData\Local\Temp\6AA5.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\6B22.tmp"C:\Users\Admin\AppData\Local\Temp\6B22.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\6B8F.tmp"C:\Users\Admin\AppData\Local\Temp\6B8F.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\6C0C.tmp"C:\Users\Admin\AppData\Local\Temp\6C0C.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:392 -
C:\Users\Admin\AppData\Local\Temp\6C5A.tmp"C:\Users\Admin\AppData\Local\Temp\6C5A.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\6CC7.tmp"C:\Users\Admin\AppData\Local\Temp\6CC7.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Users\Admin\AppData\Local\Temp\6D34.tmp"C:\Users\Admin\AppData\Local\Temp\6D34.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\6D92.tmp"C:\Users\Admin\AppData\Local\Temp\6D92.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\6DE0.tmp"C:\Users\Admin\AppData\Local\Temp\6DE0.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\6E5D.tmp"C:\Users\Admin\AppData\Local\Temp\6E5D.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\6ED9.tmp"C:\Users\Admin\AppData\Local\Temp\6ED9.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\6F47.tmp"C:\Users\Admin\AppData\Local\Temp\6F47.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\6FB4.tmp"C:\Users\Admin\AppData\Local\Temp\6FB4.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\7021.tmp"C:\Users\Admin\AppData\Local\Temp\7021.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\708E.tmp"C:\Users\Admin\AppData\Local\Temp\708E.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\70FB.tmp"C:\Users\Admin\AppData\Local\Temp\70FB.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\7169.tmp"C:\Users\Admin\AppData\Local\Temp\7169.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\71C6.tmp"C:\Users\Admin\AppData\Local\Temp\71C6.tmp"39⤵
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\7243.tmp"C:\Users\Admin\AppData\Local\Temp\7243.tmp"40⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\72A1.tmp"C:\Users\Admin\AppData\Local\Temp\72A1.tmp"41⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\730E.tmp"C:\Users\Admin\AppData\Local\Temp\730E.tmp"42⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\737B.tmp"C:\Users\Admin\AppData\Local\Temp\737B.tmp"43⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\73D9.tmp"C:\Users\Admin\AppData\Local\Temp\73D9.tmp"44⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"45⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"46⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"47⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"48⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"49⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"50⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\76D5.tmp"C:\Users\Admin\AppData\Local\Temp\76D5.tmp"51⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\7742.tmp"C:\Users\Admin\AppData\Local\Temp\7742.tmp"52⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\77AF.tmp"C:\Users\Admin\AppData\Local\Temp\77AF.tmp"53⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\780D.tmp"C:\Users\Admin\AppData\Local\Temp\780D.tmp"54⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\785B.tmp"C:\Users\Admin\AppData\Local\Temp\785B.tmp"55⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\78D8.tmp"C:\Users\Admin\AppData\Local\Temp\78D8.tmp"56⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\7A2F.tmp"C:\Users\Admin\AppData\Local\Temp\7A2F.tmp"57⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\7AAC.tmp"C:\Users\Admin\AppData\Local\Temp\7AAC.tmp"58⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\7B29.tmp"C:\Users\Admin\AppData\Local\Temp\7B29.tmp"59⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\7B86.tmp"C:\Users\Admin\AppData\Local\Temp\7B86.tmp"60⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\7C03.tmp"C:\Users\Admin\AppData\Local\Temp\7C03.tmp"61⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\7C70.tmp"C:\Users\Admin\AppData\Local\Temp\7C70.tmp"62⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\7CED.tmp"C:\Users\Admin\AppData\Local\Temp\7CED.tmp"63⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\7D4B.tmp"C:\Users\Admin\AppData\Local\Temp\7D4B.tmp"64⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\7DC7.tmp"C:\Users\Admin\AppData\Local\Temp\7DC7.tmp"65⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\7E25.tmp"C:\Users\Admin\AppData\Local\Temp\7E25.tmp"66⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\7E92.tmp"C:\Users\Admin\AppData\Local\Temp\7E92.tmp"67⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\7F0F.tmp"C:\Users\Admin\AppData\Local\Temp\7F0F.tmp"68⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\7F7C.tmp"C:\Users\Admin\AppData\Local\Temp\7F7C.tmp"69⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\7FE9.tmp"C:\Users\Admin\AppData\Local\Temp\7FE9.tmp"70⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\8066.tmp"C:\Users\Admin\AppData\Local\Temp\8066.tmp"71⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\80D3.tmp"C:\Users\Admin\AppData\Local\Temp\80D3.tmp"72⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\8141.tmp"C:\Users\Admin\AppData\Local\Temp\8141.tmp"73⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\819E.tmp"C:\Users\Admin\AppData\Local\Temp\819E.tmp"74⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\820B.tmp"C:\Users\Admin\AppData\Local\Temp\820B.tmp"75⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\8279.tmp"C:\Users\Admin\AppData\Local\Temp\8279.tmp"76⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\82F5.tmp"C:\Users\Admin\AppData\Local\Temp\82F5.tmp"77⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\8363.tmp"C:\Users\Admin\AppData\Local\Temp\8363.tmp"78⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\83C0.tmp"C:\Users\Admin\AppData\Local\Temp\83C0.tmp"79⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\841E.tmp"C:\Users\Admin\AppData\Local\Temp\841E.tmp"80⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\847B.tmp"C:\Users\Admin\AppData\Local\Temp\847B.tmp"81⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\84C9.tmp"C:\Users\Admin\AppData\Local\Temp\84C9.tmp"82⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\8517.tmp"C:\Users\Admin\AppData\Local\Temp\8517.tmp"83⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\8594.tmp"C:\Users\Admin\AppData\Local\Temp\8594.tmp"84⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\8601.tmp"C:\Users\Admin\AppData\Local\Temp\8601.tmp"85⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\866F.tmp"C:\Users\Admin\AppData\Local\Temp\866F.tmp"86⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\86DC.tmp"C:\Users\Admin\AppData\Local\Temp\86DC.tmp"87⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\8749.tmp"C:\Users\Admin\AppData\Local\Temp\8749.tmp"88⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\87A7.tmp"C:\Users\Admin\AppData\Local\Temp\87A7.tmp"89⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\8804.tmp"C:\Users\Admin\AppData\Local\Temp\8804.tmp"90⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\8871.tmp"C:\Users\Admin\AppData\Local\Temp\8871.tmp"91⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\88DF.tmp"C:\Users\Admin\AppData\Local\Temp\88DF.tmp"92⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\894C.tmp"C:\Users\Admin\AppData\Local\Temp\894C.tmp"93⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\89B9.tmp"C:\Users\Admin\AppData\Local\Temp\89B9.tmp"94⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\8A26.tmp"C:\Users\Admin\AppData\Local\Temp\8A26.tmp"95⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\8A84.tmp"C:\Users\Admin\AppData\Local\Temp\8A84.tmp"96⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\8AF1.tmp"C:\Users\Admin\AppData\Local\Temp\8AF1.tmp"97⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"98⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"99⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\8C29.tmp"C:\Users\Admin\AppData\Local\Temp\8C29.tmp"100⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\8C96.tmp"C:\Users\Admin\AppData\Local\Temp\8C96.tmp"101⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\8CF4.tmp"C:\Users\Admin\AppData\Local\Temp\8CF4.tmp"102⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\8D61.tmp"C:\Users\Admin\AppData\Local\Temp\8D61.tmp"103⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\8DCE.tmp"C:\Users\Admin\AppData\Local\Temp\8DCE.tmp"104⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\8EA9.tmp"C:\Users\Admin\AppData\Local\Temp\8EA9.tmp"105⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\8F35.tmp"C:\Users\Admin\AppData\Local\Temp\8F35.tmp"106⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\8FC1.tmp"C:\Users\Admin\AppData\Local\Temp\8FC1.tmp"107⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\901F.tmp"C:\Users\Admin\AppData\Local\Temp\901F.tmp"108⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\90AB.tmp"C:\Users\Admin\AppData\Local\Temp\90AB.tmp"109⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\9119.tmp"C:\Users\Admin\AppData\Local\Temp\9119.tmp"110⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\91B5.tmp"C:\Users\Admin\AppData\Local\Temp\91B5.tmp"111⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\9212.tmp"C:\Users\Admin\AppData\Local\Temp\9212.tmp"112⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\927F.tmp"C:\Users\Admin\AppData\Local\Temp\927F.tmp"113⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\92FC.tmp"C:\Users\Admin\AppData\Local\Temp\92FC.tmp"114⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\9369.tmp"C:\Users\Admin\AppData\Local\Temp\9369.tmp"115⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\93D7.tmp"C:\Users\Admin\AppData\Local\Temp\93D7.tmp"116⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\9463.tmp"C:\Users\Admin\AppData\Local\Temp\9463.tmp"117⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\956C.tmp"C:\Users\Admin\AppData\Local\Temp\956C.tmp"118⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\95D9.tmp"C:\Users\Admin\AppData\Local\Temp\95D9.tmp"119⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\9647.tmp"C:\Users\Admin\AppData\Local\Temp\9647.tmp"120⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\9702.tmp"C:\Users\Admin\AppData\Local\Temp\9702.tmp"121⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\978E.tmp"C:\Users\Admin\AppData\Local\Temp\978E.tmp"122⤵PID:1808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-