Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
13/02/2024, 18:56
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-13_cd10e3f1dd522332607a1d863786820a_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-13_cd10e3f1dd522332607a1d863786820a_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-13_cd10e3f1dd522332607a1d863786820a_mafia.exe
-
Size
520KB
-
MD5
cd10e3f1dd522332607a1d863786820a
-
SHA1
96cb325381b04595c9eaa612c17e88f9890f2b65
-
SHA256
70d46e1f863c5e697faadb8fddeb5d47676e3b27a1b6c67a32ee55ac02a65d0b
-
SHA512
e9b9141efd80cc0a438ca42f8673cd1241c683cddc4dd5e4397a3ffaf4cf66e6c19b7e58465d32e3038c5aaecaecdf7242f660ec7affb2df6c92682a6e67daf5
-
SSDEEP
6144:lLvd/XzCjUIF1UuXLyQjmOH+JjL9lOrw4IV+AGDId6yfy4ecboWqSQLmB3fQEaOo:roRXOQjmOyNl6BqX07KiiqSamqJOmNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3108 514C.tmp 5088 51E9.tmp 692 5285.tmp 4064 5331.tmp 3472 53CD.tmp 2692 5469.tmp 1248 54B7.tmp 4192 5544.tmp 3736 5592.tmp 4320 55F0.tmp 2168 564E.tmp 3832 56BB.tmp 4072 5719.tmp 5000 5767.tmp 3116 57B5.tmp 4956 5803.tmp 4608 5870.tmp 1072 58CE.tmp 1112 596A.tmp 5036 59C8.tmp 1952 5A36.tmp 4948 5AA3.tmp 5024 5B20.tmp 4264 5B6E.tmp 4392 5BEB.tmp 1100 5C78.tmp 1244 5CD5.tmp 4976 5D24.tmp 512 5D91.tmp 3548 5E0E.tmp 2432 5E8B.tmp 4656 5EE9.tmp 1648 5F56.tmp 3740 5FA4.tmp 3192 6002.tmp 1252 6050.tmp 4924 609E.tmp 2000 60FC.tmp 4736 615A.tmp 2180 61A8.tmp 1752 6206.tmp 3920 6263.tmp 3616 62B1.tmp 2188 630F.tmp 376 635D.tmp 1716 63BB.tmp 2724 6409.tmp 5068 6467.tmp 2764 64C5.tmp 1212 6513.tmp 824 6561.tmp 1872 65BF.tmp 1472 661C.tmp 2844 666B.tmp 532 66B9.tmp 1580 6707.tmp 1260 6755.tmp 4492 67A3.tmp 4660 67F1.tmp 1572 683F.tmp 1780 689D.tmp 4788 68EB.tmp 2148 6939.tmp 4600 6997.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4836 wrote to memory of 3108 4836 2024-02-13_cd10e3f1dd522332607a1d863786820a_mafia.exe 84 PID 4836 wrote to memory of 3108 4836 2024-02-13_cd10e3f1dd522332607a1d863786820a_mafia.exe 84 PID 4836 wrote to memory of 3108 4836 2024-02-13_cd10e3f1dd522332607a1d863786820a_mafia.exe 84 PID 3108 wrote to memory of 5088 3108 514C.tmp 85 PID 3108 wrote to memory of 5088 3108 514C.tmp 85 PID 3108 wrote to memory of 5088 3108 514C.tmp 85 PID 5088 wrote to memory of 692 5088 51E9.tmp 86 PID 5088 wrote to memory of 692 5088 51E9.tmp 86 PID 5088 wrote to memory of 692 5088 51E9.tmp 86 PID 692 wrote to memory of 4064 692 5285.tmp 87 PID 692 wrote to memory of 4064 692 5285.tmp 87 PID 692 wrote to memory of 4064 692 5285.tmp 87 PID 4064 wrote to memory of 3472 4064 5331.tmp 88 PID 4064 wrote to memory of 3472 4064 5331.tmp 88 PID 4064 wrote to memory of 3472 4064 5331.tmp 88 PID 3472 wrote to memory of 2692 3472 53CD.tmp 90 PID 3472 wrote to memory of 2692 3472 53CD.tmp 90 PID 3472 wrote to memory of 2692 3472 53CD.tmp 90 PID 2692 wrote to memory of 1248 2692 5469.tmp 89 PID 2692 wrote to memory of 1248 2692 5469.tmp 89 PID 2692 wrote to memory of 1248 2692 5469.tmp 89 PID 1248 wrote to memory of 4192 1248 54B7.tmp 91 PID 1248 wrote to memory of 4192 1248 54B7.tmp 91 PID 1248 wrote to memory of 4192 1248 54B7.tmp 91 PID 4192 wrote to memory of 3736 4192 5544.tmp 92 PID 4192 wrote to memory of 3736 4192 5544.tmp 92 PID 4192 wrote to memory of 3736 4192 5544.tmp 92 PID 3736 wrote to memory of 4320 3736 5592.tmp 93 PID 3736 wrote to memory of 4320 3736 5592.tmp 93 PID 3736 wrote to memory of 4320 3736 5592.tmp 93 PID 4320 wrote to memory of 2168 4320 55F0.tmp 94 PID 4320 wrote to memory of 2168 4320 55F0.tmp 94 PID 4320 wrote to memory of 2168 4320 55F0.tmp 94 PID 2168 wrote to memory of 3832 2168 564E.tmp 95 PID 2168 wrote to memory of 3832 2168 564E.tmp 95 PID 2168 wrote to memory of 3832 2168 564E.tmp 95 PID 3832 wrote to memory of 4072 3832 56BB.tmp 97 PID 3832 wrote to memory of 4072 3832 56BB.tmp 97 PID 3832 wrote to memory of 4072 3832 56BB.tmp 97 PID 4072 wrote to memory of 5000 4072 5719.tmp 96 PID 4072 wrote to memory of 5000 4072 5719.tmp 96 PID 4072 wrote to memory of 5000 4072 5719.tmp 96 PID 5000 wrote to memory of 3116 5000 5767.tmp 98 PID 5000 wrote to memory of 3116 5000 5767.tmp 98 PID 5000 wrote to memory of 3116 5000 5767.tmp 98 PID 3116 wrote to memory of 4956 3116 57B5.tmp 99 PID 3116 wrote to memory of 4956 3116 57B5.tmp 99 PID 3116 wrote to memory of 4956 3116 57B5.tmp 99 PID 4956 wrote to memory of 4608 4956 5803.tmp 100 PID 4956 wrote to memory of 4608 4956 5803.tmp 100 PID 4956 wrote to memory of 4608 4956 5803.tmp 100 PID 4608 wrote to memory of 1072 4608 5870.tmp 101 PID 4608 wrote to memory of 1072 4608 5870.tmp 101 PID 4608 wrote to memory of 1072 4608 5870.tmp 101 PID 1072 wrote to memory of 1112 1072 58CE.tmp 102 PID 1072 wrote to memory of 1112 1072 58CE.tmp 102 PID 1072 wrote to memory of 1112 1072 58CE.tmp 102 PID 1112 wrote to memory of 5036 1112 596A.tmp 103 PID 1112 wrote to memory of 5036 1112 596A.tmp 103 PID 1112 wrote to memory of 5036 1112 596A.tmp 103 PID 5036 wrote to memory of 1952 5036 59C8.tmp 104 PID 5036 wrote to memory of 1952 5036 59C8.tmp 104 PID 5036 wrote to memory of 1952 5036 59C8.tmp 104 PID 1952 wrote to memory of 4948 1952 5A36.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-13_cd10e3f1dd522332607a1d863786820a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-13_cd10e3f1dd522332607a1d863786820a_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"9⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"10⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"11⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"12⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"13⤵
- Executes dropped EXE
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"14⤵
- Executes dropped EXE
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"15⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"16⤵
- Executes dropped EXE
PID:512 -
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"17⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"18⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"19⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"20⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"21⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"22⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"23⤵
- Executes dropped EXE
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"24⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"25⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"26⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"27⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"28⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"29⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"30⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"31⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"32⤵
- Executes dropped EXE
PID:376 -
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"33⤵
- Executes dropped EXE
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"34⤵
- Executes dropped EXE
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"35⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"36⤵
- Executes dropped EXE
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"37⤵
- Executes dropped EXE
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"38⤵
- Executes dropped EXE
PID:824 -
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"39⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"40⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"41⤵
- Executes dropped EXE
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"42⤵
- Executes dropped EXE
PID:532 -
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"43⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"44⤵
- Executes dropped EXE
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"45⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"46⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"47⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"48⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"49⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"50⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"51⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"52⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"53⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"54⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"55⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"56⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"57⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"58⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"59⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"60⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"61⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"62⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"63⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"64⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"65⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"66⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"67⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"68⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"69⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\72A0.tmp"C:\Users\Admin\AppData\Local\Temp\72A0.tmp"70⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"71⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"72⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"73⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"74⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"75⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"76⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"77⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\7772.tmp"C:\Users\Admin\AppData\Local\Temp\7772.tmp"78⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"79⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"80⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\7918.tmp"C:\Users\Admin\AppData\Local\Temp\7918.tmp"81⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\7976.tmp"C:\Users\Admin\AppData\Local\Temp\7976.tmp"82⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\79C4.tmp"C:\Users\Admin\AppData\Local\Temp\79C4.tmp"83⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\7A21.tmp"C:\Users\Admin\AppData\Local\Temp\7A21.tmp"84⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"85⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"86⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"87⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"88⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"89⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\7C54.tmp"C:\Users\Admin\AppData\Local\Temp\7C54.tmp"90⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"91⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"92⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"93⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"94⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\7E38.tmp"C:\Users\Admin\AppData\Local\Temp\7E38.tmp"95⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"96⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\7F03.tmp"C:\Users\Admin\AppData\Local\Temp\7F03.tmp"97⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\7F71.tmp"C:\Users\Admin\AppData\Local\Temp\7F71.tmp"98⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"99⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\803C.tmp"C:\Users\Admin\AppData\Local\Temp\803C.tmp"100⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\80A9.tmp"C:\Users\Admin\AppData\Local\Temp\80A9.tmp"101⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\8117.tmp"C:\Users\Admin\AppData\Local\Temp\8117.tmp"102⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\8174.tmp"C:\Users\Admin\AppData\Local\Temp\8174.tmp"103⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\81E2.tmp"C:\Users\Admin\AppData\Local\Temp\81E2.tmp"104⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\8230.tmp"C:\Users\Admin\AppData\Local\Temp\8230.tmp"105⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\827E.tmp"C:\Users\Admin\AppData\Local\Temp\827E.tmp"106⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"107⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\833A.tmp"C:\Users\Admin\AppData\Local\Temp\833A.tmp"108⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"109⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\83F5.tmp"C:\Users\Admin\AppData\Local\Temp\83F5.tmp"110⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\8453.tmp"C:\Users\Admin\AppData\Local\Temp\8453.tmp"111⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\84A1.tmp"C:\Users\Admin\AppData\Local\Temp\84A1.tmp"112⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\84FF.tmp"C:\Users\Admin\AppData\Local\Temp\84FF.tmp"113⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\854D.tmp"C:\Users\Admin\AppData\Local\Temp\854D.tmp"114⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\859B.tmp"C:\Users\Admin\AppData\Local\Temp\859B.tmp"115⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\8608.tmp"C:\Users\Admin\AppData\Local\Temp\8608.tmp"116⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"117⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\86A5.tmp"C:\Users\Admin\AppData\Local\Temp\86A5.tmp"118⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\86F3.tmp"C:\Users\Admin\AppData\Local\Temp\86F3.tmp"119⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\8750.tmp"C:\Users\Admin\AppData\Local\Temp\8750.tmp"120⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\879F.tmp"C:\Users\Admin\AppData\Local\Temp\879F.tmp"121⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"122⤵PID:232
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-