Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 10:49
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-16_29a17d47528e061c2008fdeee7fd1107_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-05-16_29a17d47528e061c2008fdeee7fd1107_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-16_29a17d47528e061c2008fdeee7fd1107_mafia.exe
-
Size
712KB
-
MD5
29a17d47528e061c2008fdeee7fd1107
-
SHA1
29660cc4185699dd4068ffdaa84e44756be8401f
-
SHA256
5043ea1e91970e71d59beaf0960a8a66026b6cac39ef035c1606d4578c076d02
-
SHA512
c59bf6c0072f449ba1ee070382e32d53a2f944ccac06846c97721b19b77d8290cace2f02f23385df6aceaf2029b84e179c0564f8126a841fca0770855c5a8533
-
SSDEEP
12288:FU5rCOTeiDv6aLiecgyC1vW809BLu3H+NZdCvq5TJLCvY90D8/LVBlVk736Y79G5:FUQOJDvi8vWLDL2H+NnCvq5TJLCvY90E
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1552 5EC9.tmp 1692 5F85.tmp 3724 6002.tmp 3268 609E.tmp 1428 611B.tmp 1480 6189.tmp 4680 6215.tmp 4856 6292.tmp 2232 630F.tmp 2212 638C.tmp 5056 63EA.tmp 4980 6467.tmp 3580 64F4.tmp 704 6580.tmp 5088 660D.tmp 5016 6699.tmp 4540 6736.tmp 3180 67B3.tmp 3512 6810.tmp 2652 686E.tmp 4252 68FB.tmp 3412 6968.tmp 3324 69C6.tmp 1684 6A33.tmp 3812 6AC0.tmp 1048 6B2D.tmp 4732 6B7B.tmp 1560 6C08.tmp 1720 6C66.tmp 4240 6CB4.tmp 1508 6D60.tmp 4912 6DEC.tmp 800 6E5A.tmp 2028 6EA8.tmp 1872 6EF6.tmp 4960 6F44.tmp 3984 6F92.tmp 1960 6FF0.tmp 1032 704E.tmp 1584 709C.tmp 3380 70FA.tmp 1732 7157.tmp 2496 71B5.tmp 5012 7203.tmp 4328 7271.tmp 2316 72CE.tmp 2460 732C.tmp 4316 738A.tmp 3260 73D8.tmp 2276 7426.tmp 4896 7474.tmp 4396 74C2.tmp 4160 7520.tmp 2280 756E.tmp 3188 75CC.tmp 2492 762A.tmp 1988 7688.tmp 4012 76D6.tmp 4440 7724.tmp 3724 7772.tmp 3728 77C0.tmp 1184 781E.tmp 4720 787C.tmp 2184 78D9.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4688 wrote to memory of 1552 4688 2024-05-16_29a17d47528e061c2008fdeee7fd1107_mafia.exe 82 PID 4688 wrote to memory of 1552 4688 2024-05-16_29a17d47528e061c2008fdeee7fd1107_mafia.exe 82 PID 4688 wrote to memory of 1552 4688 2024-05-16_29a17d47528e061c2008fdeee7fd1107_mafia.exe 82 PID 1552 wrote to memory of 1692 1552 5EC9.tmp 83 PID 1552 wrote to memory of 1692 1552 5EC9.tmp 83 PID 1552 wrote to memory of 1692 1552 5EC9.tmp 83 PID 1692 wrote to memory of 3724 1692 5F85.tmp 84 PID 1692 wrote to memory of 3724 1692 5F85.tmp 84 PID 1692 wrote to memory of 3724 1692 5F85.tmp 84 PID 3724 wrote to memory of 3268 3724 6002.tmp 85 PID 3724 wrote to memory of 3268 3724 6002.tmp 85 PID 3724 wrote to memory of 3268 3724 6002.tmp 85 PID 3268 wrote to memory of 1428 3268 609E.tmp 86 PID 3268 wrote to memory of 1428 3268 609E.tmp 86 PID 3268 wrote to memory of 1428 3268 609E.tmp 86 PID 1428 wrote to memory of 1480 1428 611B.tmp 87 PID 1428 wrote to memory of 1480 1428 611B.tmp 87 PID 1428 wrote to memory of 1480 1428 611B.tmp 87 PID 1480 wrote to memory of 4680 1480 6189.tmp 88 PID 1480 wrote to memory of 4680 1480 6189.tmp 88 PID 1480 wrote to memory of 4680 1480 6189.tmp 88 PID 4680 wrote to memory of 4856 4680 6215.tmp 89 PID 4680 wrote to memory of 4856 4680 6215.tmp 89 PID 4680 wrote to memory of 4856 4680 6215.tmp 89 PID 4856 wrote to memory of 2232 4856 6292.tmp 90 PID 4856 wrote to memory of 2232 4856 6292.tmp 90 PID 4856 wrote to memory of 2232 4856 6292.tmp 90 PID 2232 wrote to memory of 2212 2232 630F.tmp 91 PID 2232 wrote to memory of 2212 2232 630F.tmp 91 PID 2232 wrote to memory of 2212 2232 630F.tmp 91 PID 2212 wrote to memory of 5056 2212 638C.tmp 92 PID 2212 wrote to memory of 5056 2212 638C.tmp 92 PID 2212 wrote to memory of 5056 2212 638C.tmp 92 PID 5056 wrote to memory of 4980 5056 63EA.tmp 93 PID 5056 wrote to memory of 4980 5056 63EA.tmp 93 PID 5056 wrote to memory of 4980 5056 63EA.tmp 93 PID 4980 wrote to memory of 3580 4980 6467.tmp 94 PID 4980 wrote to memory of 3580 4980 6467.tmp 94 PID 4980 wrote to memory of 3580 4980 6467.tmp 94 PID 3580 wrote to memory of 704 3580 64F4.tmp 95 PID 3580 wrote to memory of 704 3580 64F4.tmp 95 PID 3580 wrote to memory of 704 3580 64F4.tmp 95 PID 704 wrote to memory of 5088 704 6580.tmp 96 PID 704 wrote to memory of 5088 704 6580.tmp 96 PID 704 wrote to memory of 5088 704 6580.tmp 96 PID 5088 wrote to memory of 5016 5088 660D.tmp 97 PID 5088 wrote to memory of 5016 5088 660D.tmp 97 PID 5088 wrote to memory of 5016 5088 660D.tmp 97 PID 5016 wrote to memory of 4540 5016 6699.tmp 98 PID 5016 wrote to memory of 4540 5016 6699.tmp 98 PID 5016 wrote to memory of 4540 5016 6699.tmp 98 PID 4540 wrote to memory of 3180 4540 6736.tmp 99 PID 4540 wrote to memory of 3180 4540 6736.tmp 99 PID 4540 wrote to memory of 3180 4540 6736.tmp 99 PID 3180 wrote to memory of 3512 3180 67B3.tmp 100 PID 3180 wrote to memory of 3512 3180 67B3.tmp 100 PID 3180 wrote to memory of 3512 3180 67B3.tmp 100 PID 3512 wrote to memory of 2652 3512 6810.tmp 101 PID 3512 wrote to memory of 2652 3512 6810.tmp 101 PID 3512 wrote to memory of 2652 3512 6810.tmp 101 PID 2652 wrote to memory of 4252 2652 686E.tmp 102 PID 2652 wrote to memory of 4252 2652 686E.tmp 102 PID 2652 wrote to memory of 4252 2652 686E.tmp 102 PID 4252 wrote to memory of 3412 4252 68FB.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_29a17d47528e061c2008fdeee7fd1107_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-16_29a17d47528e061c2008fdeee7fd1107_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"23⤵
- Executes dropped EXE
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"24⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"25⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"26⤵
- Executes dropped EXE
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"27⤵
- Executes dropped EXE
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"28⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"29⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"30⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"31⤵
- Executes dropped EXE
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"32⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"33⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"34⤵
- Executes dropped EXE
PID:800 -
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"35⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"36⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"37⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"38⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"39⤵
- Executes dropped EXE
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"40⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"41⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"42⤵
- Executes dropped EXE
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\7157.tmp"C:\Users\Admin\AppData\Local\Temp\7157.tmp"43⤵
- Executes dropped EXE
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\71B5.tmp"C:\Users\Admin\AppData\Local\Temp\71B5.tmp"44⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"45⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"46⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"47⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"48⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"49⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"50⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"51⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"52⤵
- Executes dropped EXE
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\74C2.tmp"C:\Users\Admin\AppData\Local\Temp\74C2.tmp"53⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"54⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"55⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"56⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"57⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"58⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"59⤵
- Executes dropped EXE
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\7724.tmp"C:\Users\Admin\AppData\Local\Temp\7724.tmp"60⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\7772.tmp"C:\Users\Admin\AppData\Local\Temp\7772.tmp"61⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"62⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"63⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"64⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\78D9.tmp"C:\Users\Admin\AppData\Local\Temp\78D9.tmp"65⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\7927.tmp"C:\Users\Admin\AppData\Local\Temp\7927.tmp"66⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"67⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\79D3.tmp"C:\Users\Admin\AppData\Local\Temp\79D3.tmp"68⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"69⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"70⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\7AED.tmp"C:\Users\Admin\AppData\Local\Temp\7AED.tmp"71⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"72⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"73⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\7C15.tmp"C:\Users\Admin\AppData\Local\Temp\7C15.tmp"74⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\7C64.tmp"C:\Users\Admin\AppData\Local\Temp\7C64.tmp"75⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"76⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"77⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"78⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"79⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"80⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\7E67.tmp"C:\Users\Admin\AppData\Local\Temp\7E67.tmp"81⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"82⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\7F23.tmp"C:\Users\Admin\AppData\Local\Temp\7F23.tmp"83⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\7F80.tmp"C:\Users\Admin\AppData\Local\Temp\7F80.tmp"84⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"85⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\802C.tmp"C:\Users\Admin\AppData\Local\Temp\802C.tmp"86⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\808A.tmp"C:\Users\Admin\AppData\Local\Temp\808A.tmp"87⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\80F7.tmp"C:\Users\Admin\AppData\Local\Temp\80F7.tmp"88⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\8155.tmp"C:\Users\Admin\AppData\Local\Temp\8155.tmp"89⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\81B3.tmp"C:\Users\Admin\AppData\Local\Temp\81B3.tmp"90⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"91⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"92⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"93⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"94⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\8378.tmp"C:\Users\Admin\AppData\Local\Temp\8378.tmp"95⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\83D6.tmp"C:\Users\Admin\AppData\Local\Temp\83D6.tmp"96⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\8434.tmp"C:\Users\Admin\AppData\Local\Temp\8434.tmp"97⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\8491.tmp"C:\Users\Admin\AppData\Local\Temp\8491.tmp"98⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\84DF.tmp"C:\Users\Admin\AppData\Local\Temp\84DF.tmp"99⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\852E.tmp"C:\Users\Admin\AppData\Local\Temp\852E.tmp"100⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\858B.tmp"C:\Users\Admin\AppData\Local\Temp\858B.tmp"101⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"102⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\8637.tmp"C:\Users\Admin\AppData\Local\Temp\8637.tmp"103⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\8695.tmp"C:\Users\Admin\AppData\Local\Temp\8695.tmp"104⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\86E3.tmp"C:\Users\Admin\AppData\Local\Temp\86E3.tmp"105⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\8731.tmp"C:\Users\Admin\AppData\Local\Temp\8731.tmp"106⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\877F.tmp"C:\Users\Admin\AppData\Local\Temp\877F.tmp"107⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\87DD.tmp"C:\Users\Admin\AppData\Local\Temp\87DD.tmp"108⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\885A.tmp"C:\Users\Admin\AppData\Local\Temp\885A.tmp"109⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\88C7.tmp"C:\Users\Admin\AppData\Local\Temp\88C7.tmp"110⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\8916.tmp"C:\Users\Admin\AppData\Local\Temp\8916.tmp"111⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\8973.tmp"C:\Users\Admin\AppData\Local\Temp\8973.tmp"112⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\89E1.tmp"C:\Users\Admin\AppData\Local\Temp\89E1.tmp"113⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"114⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"115⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"116⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\8B58.tmp"C:\Users\Admin\AppData\Local\Temp\8B58.tmp"117⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"118⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\8C13.tmp"C:\Users\Admin\AppData\Local\Temp\8C13.tmp"119⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\8C81.tmp"C:\Users\Admin\AppData\Local\Temp\8C81.tmp"120⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"121⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"122⤵PID:4012
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-