Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240220-en -
resource tags
arch:x64arch:x86image:win10v2004-20240220-enlocale:en-usos:windows10-2004-x64system -
submitted
21/02/2024, 14:05
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-21_c594ca806de660c18deeead1c338318d_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-02-21_c594ca806de660c18deeead1c338318d_mafia.exe
Resource
win10v2004-20240220-en
General
-
Target
2024-02-21_c594ca806de660c18deeead1c338318d_mafia.exe
-
Size
486KB
-
MD5
c594ca806de660c18deeead1c338318d
-
SHA1
ac0131e2922d111143a148b91f625402ba988d87
-
SHA256
b77bbe9ab444afff2f575c92410c9e2d287d2a2220a6c5f8e779568c09a26940
-
SHA512
802f7e9e0b8d09a29b998faf6c9142a2092328d82dd3b2753b09055193bdab34192c3a40e74b832920d8cdf66581b332c50512680bb11b12df3b1c4c64e0d28e
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7wy8e2ns7GsKKZ08XkciD/w22d1rAEYe2j4UK:/U5rCOTeiDP282u5wjyAD7jn9gCGxNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1668 64C5.tmp 1500 6571.tmp 992 663C.tmp 1156 6716.tmp 3764 67C2.tmp 4880 683F.tmp 2236 68BC.tmp 2648 6939.tmp 2428 69B6.tmp 4304 6A53.tmp 3316 6B7B.tmp 3940 6C66.tmp 1188 6CF2.tmp 4060 6D8F.tmp 4700 6E2B.tmp 4824 6EA8.tmp 2364 6F63.tmp 3336 700F.tmp 2076 70AC.tmp 2220 7129.tmp 3300 71C5.tmp 3624 72A0.tmp 4784 734B.tmp 2892 7417.tmp 1488 74D2.tmp 3936 759D.tmp 1776 7678.tmp 3948 7733.tmp 4676 77FF.tmp 3280 789B.tmp 1608 7985.tmp 3240 7A41.tmp 1208 7AED.tmp 820 7B89.tmp 1984 7C15.tmp 4604 7CB2.tmp 4524 7D4E.tmp 2944 7DFA.tmp 4860 7EA6.tmp 2168 7F23.tmp 1352 7FA0.tmp 2240 802C.tmp 2500 80A9.tmp 2832 8126.tmp 992 81B3.tmp 2224 824F.tmp 4108 82FB.tmp 4908 8388.tmp 1168 8424.tmp 1360 84C0.tmp 1528 853D.tmp 3900 85CA.tmp 5048 8666.tmp 2704 86E3.tmp 4896 877F.tmp 3192 881C.tmp 4140 88C7.tmp 208 8935.tmp 1188 89C1.tmp 2932 8A4E.tmp 4328 8AEA.tmp 1772 8B96.tmp 2600 8C04.tmp 4396 8C90.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4860 wrote to memory of 1668 4860 2024-02-21_c594ca806de660c18deeead1c338318d_mafia.exe 86 PID 4860 wrote to memory of 1668 4860 2024-02-21_c594ca806de660c18deeead1c338318d_mafia.exe 86 PID 4860 wrote to memory of 1668 4860 2024-02-21_c594ca806de660c18deeead1c338318d_mafia.exe 86 PID 1668 wrote to memory of 1500 1668 64C5.tmp 87 PID 1668 wrote to memory of 1500 1668 64C5.tmp 87 PID 1668 wrote to memory of 1500 1668 64C5.tmp 87 PID 1500 wrote to memory of 992 1500 6571.tmp 89 PID 1500 wrote to memory of 992 1500 6571.tmp 89 PID 1500 wrote to memory of 992 1500 6571.tmp 89 PID 992 wrote to memory of 1156 992 663C.tmp 90 PID 992 wrote to memory of 1156 992 663C.tmp 90 PID 992 wrote to memory of 1156 992 663C.tmp 90 PID 1156 wrote to memory of 3764 1156 6716.tmp 91 PID 1156 wrote to memory of 3764 1156 6716.tmp 91 PID 1156 wrote to memory of 3764 1156 6716.tmp 91 PID 3764 wrote to memory of 4880 3764 67C2.tmp 92 PID 3764 wrote to memory of 4880 3764 67C2.tmp 92 PID 3764 wrote to memory of 4880 3764 67C2.tmp 92 PID 4880 wrote to memory of 2236 4880 683F.tmp 93 PID 4880 wrote to memory of 2236 4880 683F.tmp 93 PID 4880 wrote to memory of 2236 4880 683F.tmp 93 PID 2236 wrote to memory of 2648 2236 68BC.tmp 94 PID 2236 wrote to memory of 2648 2236 68BC.tmp 94 PID 2236 wrote to memory of 2648 2236 68BC.tmp 94 PID 2648 wrote to memory of 2428 2648 6939.tmp 95 PID 2648 wrote to memory of 2428 2648 6939.tmp 95 PID 2648 wrote to memory of 2428 2648 6939.tmp 95 PID 2428 wrote to memory of 4304 2428 69B6.tmp 96 PID 2428 wrote to memory of 4304 2428 69B6.tmp 96 PID 2428 wrote to memory of 4304 2428 69B6.tmp 96 PID 4304 wrote to memory of 3316 4304 6A53.tmp 97 PID 4304 wrote to memory of 3316 4304 6A53.tmp 97 PID 4304 wrote to memory of 3316 4304 6A53.tmp 97 PID 3316 wrote to memory of 3940 3316 6B7B.tmp 98 PID 3316 wrote to memory of 3940 3316 6B7B.tmp 98 PID 3316 wrote to memory of 3940 3316 6B7B.tmp 98 PID 3940 wrote to memory of 1188 3940 6C66.tmp 99 PID 3940 wrote to memory of 1188 3940 6C66.tmp 99 PID 3940 wrote to memory of 1188 3940 6C66.tmp 99 PID 1188 wrote to memory of 4060 1188 6CF2.tmp 100 PID 1188 wrote to memory of 4060 1188 6CF2.tmp 100 PID 1188 wrote to memory of 4060 1188 6CF2.tmp 100 PID 4060 wrote to memory of 4700 4060 6D8F.tmp 101 PID 4060 wrote to memory of 4700 4060 6D8F.tmp 101 PID 4060 wrote to memory of 4700 4060 6D8F.tmp 101 PID 4700 wrote to memory of 4824 4700 6E2B.tmp 103 PID 4700 wrote to memory of 4824 4700 6E2B.tmp 103 PID 4700 wrote to memory of 4824 4700 6E2B.tmp 103 PID 4824 wrote to memory of 2364 4824 6EA8.tmp 104 PID 4824 wrote to memory of 2364 4824 6EA8.tmp 104 PID 4824 wrote to memory of 2364 4824 6EA8.tmp 104 PID 2364 wrote to memory of 3336 2364 6F63.tmp 105 PID 2364 wrote to memory of 3336 2364 6F63.tmp 105 PID 2364 wrote to memory of 3336 2364 6F63.tmp 105 PID 3336 wrote to memory of 2076 3336 700F.tmp 106 PID 3336 wrote to memory of 2076 3336 700F.tmp 106 PID 3336 wrote to memory of 2076 3336 700F.tmp 106 PID 2076 wrote to memory of 2220 2076 70AC.tmp 108 PID 2076 wrote to memory of 2220 2076 70AC.tmp 108 PID 2076 wrote to memory of 2220 2076 70AC.tmp 108 PID 2220 wrote to memory of 3300 2220 7129.tmp 109 PID 2220 wrote to memory of 3300 2220 7129.tmp 109 PID 2220 wrote to memory of 3300 2220 7129.tmp 109 PID 3300 wrote to memory of 3624 3300 71C5.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-21_c594ca806de660c18deeead1c338318d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-21_c594ca806de660c18deeead1c338318d_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\6F63.tmp"C:\Users\Admin\AppData\Local\Temp\6F63.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\72A0.tmp"C:\Users\Admin\AppData\Local\Temp\72A0.tmp"23⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"24⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"25⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"26⤵
- Executes dropped EXE
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"27⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"28⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"29⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\77FF.tmp"C:\Users\Admin\AppData\Local\Temp\77FF.tmp"30⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\789B.tmp"C:\Users\Admin\AppData\Local\Temp\789B.tmp"31⤵
- Executes dropped EXE
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"32⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"33⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\7AED.tmp"C:\Users\Admin\AppData\Local\Temp\7AED.tmp"34⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\7B89.tmp"C:\Users\Admin\AppData\Local\Temp\7B89.tmp"35⤵
- Executes dropped EXE
PID:820 -
C:\Users\Admin\AppData\Local\Temp\7C15.tmp"C:\Users\Admin\AppData\Local\Temp\7C15.tmp"36⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"37⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"38⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"39⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"40⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\7F23.tmp"C:\Users\Admin\AppData\Local\Temp\7F23.tmp"41⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"42⤵
- Executes dropped EXE
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\802C.tmp"C:\Users\Admin\AppData\Local\Temp\802C.tmp"43⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\80A9.tmp"C:\Users\Admin\AppData\Local\Temp\80A9.tmp"44⤵
- Executes dropped EXE
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\8126.tmp"C:\Users\Admin\AppData\Local\Temp\8126.tmp"45⤵
- Executes dropped EXE
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\81B3.tmp"C:\Users\Admin\AppData\Local\Temp\81B3.tmp"46⤵
- Executes dropped EXE
PID:992 -
C:\Users\Admin\AppData\Local\Temp\824F.tmp"C:\Users\Admin\AppData\Local\Temp\824F.tmp"47⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\82FB.tmp"C:\Users\Admin\AppData\Local\Temp\82FB.tmp"48⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\8388.tmp"C:\Users\Admin\AppData\Local\Temp\8388.tmp"49⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\8424.tmp"C:\Users\Admin\AppData\Local\Temp\8424.tmp"50⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\84C0.tmp"C:\Users\Admin\AppData\Local\Temp\84C0.tmp"51⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\853D.tmp"C:\Users\Admin\AppData\Local\Temp\853D.tmp"52⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\85CA.tmp"C:\Users\Admin\AppData\Local\Temp\85CA.tmp"53⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\8666.tmp"C:\Users\Admin\AppData\Local\Temp\8666.tmp"54⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\86E3.tmp"C:\Users\Admin\AppData\Local\Temp\86E3.tmp"55⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\877F.tmp"C:\Users\Admin\AppData\Local\Temp\877F.tmp"56⤵
- Executes dropped EXE
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\881C.tmp"C:\Users\Admin\AppData\Local\Temp\881C.tmp"57⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\88C7.tmp"C:\Users\Admin\AppData\Local\Temp\88C7.tmp"58⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\8935.tmp"C:\Users\Admin\AppData\Local\Temp\8935.tmp"59⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\89C1.tmp"C:\Users\Admin\AppData\Local\Temp\89C1.tmp"60⤵
- Executes dropped EXE
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"61⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"62⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\8B96.tmp"C:\Users\Admin\AppData\Local\Temp\8B96.tmp"63⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\8C04.tmp"C:\Users\Admin\AppData\Local\Temp\8C04.tmp"64⤵
- Executes dropped EXE
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"65⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"66⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"67⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\8E26.tmp"C:\Users\Admin\AppData\Local\Temp\8E26.tmp"68⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"69⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"70⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"71⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\9097.tmp"C:\Users\Admin\AppData\Local\Temp\9097.tmp"72⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\9134.tmp"C:\Users\Admin\AppData\Local\Temp\9134.tmp"73⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\91E0.tmp"C:\Users\Admin\AppData\Local\Temp\91E0.tmp"74⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\929B.tmp"C:\Users\Admin\AppData\Local\Temp\929B.tmp"75⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\9328.tmp"C:\Users\Admin\AppData\Local\Temp\9328.tmp"76⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"77⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\9441.tmp"C:\Users\Admin\AppData\Local\Temp\9441.tmp"78⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\94FC.tmp"C:\Users\Admin\AppData\Local\Temp\94FC.tmp"79⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"80⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"81⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\96C2.tmp"C:\Users\Admin\AppData\Local\Temp\96C2.tmp"82⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"83⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\97DB.tmp"C:\Users\Admin\AppData\Local\Temp\97DB.tmp"84⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\9877.tmp"C:\Users\Admin\AppData\Local\Temp\9877.tmp"85⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\98F4.tmp"C:\Users\Admin\AppData\Local\Temp\98F4.tmp"86⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\99A0.tmp"C:\Users\Admin\AppData\Local\Temp\99A0.tmp"87⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"88⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"89⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"90⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"91⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"92⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"93⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"94⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"95⤵PID:492
-
C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"96⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"97⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"98⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\A066.tmp"C:\Users\Admin\AppData\Local\Temp\A066.tmp"99⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"100⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"101⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"102⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\A23B.tmp"C:\Users\Admin\AppData\Local\Temp\A23B.tmp"103⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"104⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\A364.tmp"C:\Users\Admin\AppData\Local\Temp\A364.tmp"105⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"106⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\A47D.tmp"C:\Users\Admin\AppData\Local\Temp\A47D.tmp"107⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\A539.tmp"C:\Users\Admin\AppData\Local\Temp\A539.tmp"108⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"109⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"110⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"111⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\A78A.tmp"C:\Users\Admin\AppData\Local\Temp\A78A.tmp"112⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"113⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\A894.tmp"C:\Users\Admin\AppData\Local\Temp\A894.tmp"114⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"115⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"116⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"117⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\AA88.tmp"C:\Users\Admin\AppData\Local\Temp\AA88.tmp"118⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\AB15.tmp"C:\Users\Admin\AppData\Local\Temp\AB15.tmp"119⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"120⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"121⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"122⤵PID:2552
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-