Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2024, 16:02
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-08_7c5d19d19da5fad4c87af3172dad805d_mafia.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2024-07-08_7c5d19d19da5fad4c87af3172dad805d_mafia.exe
Resource
win10v2004-20240704-en
General
-
Target
2024-07-08_7c5d19d19da5fad4c87af3172dad805d_mafia.exe
-
Size
529KB
-
MD5
7c5d19d19da5fad4c87af3172dad805d
-
SHA1
e167d84ca198b2782648403ea9677609bedadb8b
-
SHA256
f88c6d14dd348720a3d71b3b46b1fe8f93b9b0d739383c5b5880d8daaaedfb66
-
SHA512
168d1cb45878f0479634b2f398edd30c75b222964a169b4e398b59f87ccc6cd46f78c63075c08b0ef0ea09fde3c34ce893e2b652fcc0506345cb8e9e0d0870a8
-
SSDEEP
12288:NU5rCOTeij0kdF/ztSzT7YYyTQDjn38TZwlH4Hp:NUQOJjHdF/ztSJy+jMTSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2596 E5DC.tmp 4088 E743.tmp 4112 E7FE.tmp 3012 E927.tmp 4684 EA41.tmp 4432 EB89.tmp 3080 ECB2.tmp 3584 EDBB.tmp 4044 EE67.tmp 4704 EF51.tmp 3332 EFFD.tmp 3256 F09A.tmp 2020 F184.tmp 2580 F230.tmp 2112 F2DC.tmp 2000 F3E5.tmp 740 F4A1.tmp 3448 F5BA.tmp 4984 F676.tmp 1732 F750.tmp 640 F84A.tmp 780 F8D7.tmp 4736 F992.tmp 4252 FA4E.tmp 232 FB19.tmp 3476 FBA6.tmp 5072 FC42.tmp 2244 FCBF.tmp 1728 FD5B.tmp 3236 FE26.tmp 1792 FF01.tmp 2832 FFCC.tmp 1516 49.tmp 3040 B7.tmp 1584 134.tmp 1996 1DF.tmp 316 23D.tmp 4172 2F9.tmp 2648 366.tmp 3260 3E3.tmp 3796 450.tmp 1164 4BE.tmp 3772 52B.tmp 3732 5A8.tmp 2416 616.tmp 1100 693.tmp 816 72F.tmp 1308 7AC.tmp 4444 829.tmp 3632 8B5.tmp 3148 923.tmp 1764 990.tmp 2400 9EE.tmp 5060 A6B.tmp 2168 AC9.tmp 680 B46.tmp 4892 BD2.tmp 2524 C5F.tmp 4144 CDC.tmp 1916 D59.tmp 2724 DD6.tmp 1388 E53.tmp 2076 ED0.tmp 5052 F5D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3232 wrote to memory of 2596 3232 2024-07-08_7c5d19d19da5fad4c87af3172dad805d_mafia.exe 85 PID 3232 wrote to memory of 2596 3232 2024-07-08_7c5d19d19da5fad4c87af3172dad805d_mafia.exe 85 PID 3232 wrote to memory of 2596 3232 2024-07-08_7c5d19d19da5fad4c87af3172dad805d_mafia.exe 85 PID 2596 wrote to memory of 4088 2596 E5DC.tmp 86 PID 2596 wrote to memory of 4088 2596 E5DC.tmp 86 PID 2596 wrote to memory of 4088 2596 E5DC.tmp 86 PID 4088 wrote to memory of 4112 4088 E743.tmp 87 PID 4088 wrote to memory of 4112 4088 E743.tmp 87 PID 4088 wrote to memory of 4112 4088 E743.tmp 87 PID 4112 wrote to memory of 3012 4112 E7FE.tmp 88 PID 4112 wrote to memory of 3012 4112 E7FE.tmp 88 PID 4112 wrote to memory of 3012 4112 E7FE.tmp 88 PID 3012 wrote to memory of 4684 3012 E927.tmp 89 PID 3012 wrote to memory of 4684 3012 E927.tmp 89 PID 3012 wrote to memory of 4684 3012 E927.tmp 89 PID 4684 wrote to memory of 4432 4684 EA41.tmp 90 PID 4684 wrote to memory of 4432 4684 EA41.tmp 90 PID 4684 wrote to memory of 4432 4684 EA41.tmp 90 PID 4432 wrote to memory of 3080 4432 EB89.tmp 91 PID 4432 wrote to memory of 3080 4432 EB89.tmp 91 PID 4432 wrote to memory of 3080 4432 EB89.tmp 91 PID 3080 wrote to memory of 3584 3080 ECB2.tmp 92 PID 3080 wrote to memory of 3584 3080 ECB2.tmp 92 PID 3080 wrote to memory of 3584 3080 ECB2.tmp 92 PID 3584 wrote to memory of 4044 3584 EDBB.tmp 93 PID 3584 wrote to memory of 4044 3584 EDBB.tmp 93 PID 3584 wrote to memory of 4044 3584 EDBB.tmp 93 PID 4044 wrote to memory of 4704 4044 EE67.tmp 94 PID 4044 wrote to memory of 4704 4044 EE67.tmp 94 PID 4044 wrote to memory of 4704 4044 EE67.tmp 94 PID 4704 wrote to memory of 3332 4704 EF51.tmp 95 PID 4704 wrote to memory of 3332 4704 EF51.tmp 95 PID 4704 wrote to memory of 3332 4704 EF51.tmp 95 PID 3332 wrote to memory of 3256 3332 EFFD.tmp 96 PID 3332 wrote to memory of 3256 3332 EFFD.tmp 96 PID 3332 wrote to memory of 3256 3332 EFFD.tmp 96 PID 3256 wrote to memory of 2020 3256 F09A.tmp 97 PID 3256 wrote to memory of 2020 3256 F09A.tmp 97 PID 3256 wrote to memory of 2020 3256 F09A.tmp 97 PID 2020 wrote to memory of 2580 2020 F184.tmp 98 PID 2020 wrote to memory of 2580 2020 F184.tmp 98 PID 2020 wrote to memory of 2580 2020 F184.tmp 98 PID 2580 wrote to memory of 2112 2580 F230.tmp 99 PID 2580 wrote to memory of 2112 2580 F230.tmp 99 PID 2580 wrote to memory of 2112 2580 F230.tmp 99 PID 2112 wrote to memory of 2000 2112 F2DC.tmp 100 PID 2112 wrote to memory of 2000 2112 F2DC.tmp 100 PID 2112 wrote to memory of 2000 2112 F2DC.tmp 100 PID 2000 wrote to memory of 740 2000 F3E5.tmp 101 PID 2000 wrote to memory of 740 2000 F3E5.tmp 101 PID 2000 wrote to memory of 740 2000 F3E5.tmp 101 PID 740 wrote to memory of 3448 740 F4A1.tmp 102 PID 740 wrote to memory of 3448 740 F4A1.tmp 102 PID 740 wrote to memory of 3448 740 F4A1.tmp 102 PID 3448 wrote to memory of 4984 3448 F5BA.tmp 103 PID 3448 wrote to memory of 4984 3448 F5BA.tmp 103 PID 3448 wrote to memory of 4984 3448 F5BA.tmp 103 PID 4984 wrote to memory of 1732 4984 F676.tmp 104 PID 4984 wrote to memory of 1732 4984 F676.tmp 104 PID 4984 wrote to memory of 1732 4984 F676.tmp 104 PID 1732 wrote to memory of 640 1732 F750.tmp 105 PID 1732 wrote to memory of 640 1732 F750.tmp 105 PID 1732 wrote to memory of 640 1732 F750.tmp 105 PID 640 wrote to memory of 780 640 F84A.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-08_7c5d19d19da5fad4c87af3172dad805d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-08_7c5d19d19da5fad4c87af3172dad805d_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\E743.tmp"C:\Users\Admin\AppData\Local\Temp\E743.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\E927.tmp"C:\Users\Admin\AppData\Local\Temp\E927.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\EA41.tmp"C:\Users\Admin\AppData\Local\Temp\EA41.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\EB89.tmp"C:\Users\Admin\AppData\Local\Temp\EB89.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\ECB2.tmp"C:\Users\Admin\AppData\Local\Temp\ECB2.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\EE67.tmp"C:\Users\Admin\AppData\Local\Temp\EE67.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\EF51.tmp"C:\Users\Admin\AppData\Local\Temp\EF51.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\F09A.tmp"C:\Users\Admin\AppData\Local\Temp\F09A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\F184.tmp"C:\Users\Admin\AppData\Local\Temp\F184.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\F230.tmp"C:\Users\Admin\AppData\Local\Temp\F230.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\F2DC.tmp"C:\Users\Admin\AppData\Local\Temp\F2DC.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\F3E5.tmp"C:\Users\Admin\AppData\Local\Temp\F3E5.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\F5BA.tmp"C:\Users\Admin\AppData\Local\Temp\F5BA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\F676.tmp"C:\Users\Admin\AppData\Local\Temp\F676.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\F750.tmp"C:\Users\Admin\AppData\Local\Temp\F750.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\F84A.tmp"C:\Users\Admin\AppData\Local\Temp\F84A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\F8D7.tmp"C:\Users\Admin\AppData\Local\Temp\F8D7.tmp"23⤵
- Executes dropped EXE
PID:780 -
C:\Users\Admin\AppData\Local\Temp\F992.tmp"C:\Users\Admin\AppData\Local\Temp\F992.tmp"24⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"25⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\FB19.tmp"C:\Users\Admin\AppData\Local\Temp\FB19.tmp"26⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"27⤵
- Executes dropped EXE
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\FC42.tmp"C:\Users\Admin\AppData\Local\Temp\FC42.tmp"28⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\FCBF.tmp"C:\Users\Admin\AppData\Local\Temp\FCBF.tmp"29⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"30⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\FE26.tmp"C:\Users\Admin\AppData\Local\Temp\FE26.tmp"31⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\FF01.tmp"C:\Users\Admin\AppData\Local\Temp\FF01.tmp"32⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\FFCC.tmp"C:\Users\Admin\AppData\Local\Temp\FFCC.tmp"33⤵
- Executes dropped EXE
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\49.tmp"C:\Users\Admin\AppData\Local\Temp\49.tmp"34⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7.tmp"35⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\134.tmp"C:\Users\Admin\AppData\Local\Temp\134.tmp"36⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\1DF.tmp"C:\Users\Admin\AppData\Local\Temp\1DF.tmp"37⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\23D.tmp"C:\Users\Admin\AppData\Local\Temp\23D.tmp"38⤵
- Executes dropped EXE
PID:316 -
C:\Users\Admin\AppData\Local\Temp\2F9.tmp"C:\Users\Admin\AppData\Local\Temp\2F9.tmp"39⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\366.tmp"C:\Users\Admin\AppData\Local\Temp\366.tmp"40⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\3E3.tmp"C:\Users\Admin\AppData\Local\Temp\3E3.tmp"41⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\450.tmp"C:\Users\Admin\AppData\Local\Temp\450.tmp"42⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\4BE.tmp"C:\Users\Admin\AppData\Local\Temp\4BE.tmp"43⤵
- Executes dropped EXE
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\52B.tmp"C:\Users\Admin\AppData\Local\Temp\52B.tmp"44⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\5A8.tmp"C:\Users\Admin\AppData\Local\Temp\5A8.tmp"45⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\616.tmp"C:\Users\Admin\AppData\Local\Temp\616.tmp"46⤵
- Executes dropped EXE
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\693.tmp"C:\Users\Admin\AppData\Local\Temp\693.tmp"47⤵
- Executes dropped EXE
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\72F.tmp"C:\Users\Admin\AppData\Local\Temp\72F.tmp"48⤵
- Executes dropped EXE
PID:816 -
C:\Users\Admin\AppData\Local\Temp\7AC.tmp"C:\Users\Admin\AppData\Local\Temp\7AC.tmp"49⤵
- Executes dropped EXE
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\829.tmp"C:\Users\Admin\AppData\Local\Temp\829.tmp"50⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\8B5.tmp"C:\Users\Admin\AppData\Local\Temp\8B5.tmp"51⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\923.tmp"C:\Users\Admin\AppData\Local\Temp\923.tmp"52⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\990.tmp"C:\Users\Admin\AppData\Local\Temp\990.tmp"53⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\9EE.tmp"C:\Users\Admin\AppData\Local\Temp\9EE.tmp"54⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\A6B.tmp"C:\Users\Admin\AppData\Local\Temp\A6B.tmp"55⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\AC9.tmp"C:\Users\Admin\AppData\Local\Temp\AC9.tmp"56⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\B46.tmp"C:\Users\Admin\AppData\Local\Temp\B46.tmp"57⤵
- Executes dropped EXE
PID:680 -
C:\Users\Admin\AppData\Local\Temp\BD2.tmp"C:\Users\Admin\AppData\Local\Temp\BD2.tmp"58⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\C5F.tmp"C:\Users\Admin\AppData\Local\Temp\C5F.tmp"59⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\CDC.tmp"C:\Users\Admin\AppData\Local\Temp\CDC.tmp"60⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\D59.tmp"C:\Users\Admin\AppData\Local\Temp\D59.tmp"61⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\DD6.tmp"C:\Users\Admin\AppData\Local\Temp\DD6.tmp"62⤵
- Executes dropped EXE
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\E53.tmp"C:\Users\Admin\AppData\Local\Temp\E53.tmp"63⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"64⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\F5D.tmp"C:\Users\Admin\AppData\Local\Temp\F5D.tmp"65⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"66⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\1047.tmp"C:\Users\Admin\AppData\Local\Temp\1047.tmp"67⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\10D4.tmp"C:\Users\Admin\AppData\Local\Temp\10D4.tmp"68⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\1151.tmp"C:\Users\Admin\AppData\Local\Temp\1151.tmp"69⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\11CE.tmp"C:\Users\Admin\AppData\Local\Temp\11CE.tmp"70⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\123B.tmp"C:\Users\Admin\AppData\Local\Temp\123B.tmp"71⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\1299.tmp"C:\Users\Admin\AppData\Local\Temp\1299.tmp"72⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\1316.tmp"C:\Users\Admin\AppData\Local\Temp\1316.tmp"73⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\13A2.tmp"C:\Users\Admin\AppData\Local\Temp\13A2.tmp"74⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\141F.tmp"C:\Users\Admin\AppData\Local\Temp\141F.tmp"75⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\147D.tmp"C:\Users\Admin\AppData\Local\Temp\147D.tmp"76⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\14DB.tmp"C:\Users\Admin\AppData\Local\Temp\14DB.tmp"77⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\1558.tmp"C:\Users\Admin\AppData\Local\Temp\1558.tmp"78⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\15B6.tmp"C:\Users\Admin\AppData\Local\Temp\15B6.tmp"79⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\1633.tmp"C:\Users\Admin\AppData\Local\Temp\1633.tmp"80⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\16B0.tmp"C:\Users\Admin\AppData\Local\Temp\16B0.tmp"81⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\170D.tmp"C:\Users\Admin\AppData\Local\Temp\170D.tmp"82⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\177B.tmp"C:\Users\Admin\AppData\Local\Temp\177B.tmp"83⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\1827.tmp"C:\Users\Admin\AppData\Local\Temp\1827.tmp"84⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\18A4.tmp"C:\Users\Admin\AppData\Local\Temp\18A4.tmp"85⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\1911.tmp"C:\Users\Admin\AppData\Local\Temp\1911.tmp"86⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\196F.tmp"C:\Users\Admin\AppData\Local\Temp\196F.tmp"87⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\19EC.tmp"C:\Users\Admin\AppData\Local\Temp\19EC.tmp"88⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\1A69.tmp"C:\Users\Admin\AppData\Local\Temp\1A69.tmp"89⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\1AE6.tmp"C:\Users\Admin\AppData\Local\Temp\1AE6.tmp"90⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\1B53.tmp"C:\Users\Admin\AppData\Local\Temp\1B53.tmp"91⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\1BC0.tmp"C:\Users\Admin\AppData\Local\Temp\1BC0.tmp"92⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\1C2E.tmp"C:\Users\Admin\AppData\Local\Temp\1C2E.tmp"93⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\1C9B.tmp"C:\Users\Admin\AppData\Local\Temp\1C9B.tmp"94⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\1D18.tmp"C:\Users\Admin\AppData\Local\Temp\1D18.tmp"95⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\1D86.tmp"C:\Users\Admin\AppData\Local\Temp\1D86.tmp"96⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\1DF3.tmp"C:\Users\Admin\AppData\Local\Temp\1DF3.tmp"97⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\1E51.tmp"C:\Users\Admin\AppData\Local\Temp\1E51.tmp"98⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"99⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\1F2B.tmp"C:\Users\Admin\AppData\Local\Temp\1F2B.tmp"100⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\1F99.tmp"C:\Users\Admin\AppData\Local\Temp\1F99.tmp"101⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"102⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\2074.tmp"C:\Users\Admin\AppData\Local\Temp\2074.tmp"103⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\2100.tmp"C:\Users\Admin\AppData\Local\Temp\2100.tmp"104⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\217D.tmp"C:\Users\Admin\AppData\Local\Temp\217D.tmp"105⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\21DB.tmp"C:\Users\Admin\AppData\Local\Temp\21DB.tmp"106⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\2248.tmp"C:\Users\Admin\AppData\Local\Temp\2248.tmp"107⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\22C5.tmp"C:\Users\Admin\AppData\Local\Temp\22C5.tmp"108⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\2323.tmp"C:\Users\Admin\AppData\Local\Temp\2323.tmp"109⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\2381.tmp"C:\Users\Admin\AppData\Local\Temp\2381.tmp"110⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\23EE.tmp"C:\Users\Admin\AppData\Local\Temp\23EE.tmp"111⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\244C.tmp"C:\Users\Admin\AppData\Local\Temp\244C.tmp"112⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\24C9.tmp"C:\Users\Admin\AppData\Local\Temp\24C9.tmp"113⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\2536.tmp"C:\Users\Admin\AppData\Local\Temp\2536.tmp"114⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\25C3.tmp"C:\Users\Admin\AppData\Local\Temp\25C3.tmp"115⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\2630.tmp"C:\Users\Admin\AppData\Local\Temp\2630.tmp"116⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\26AD.tmp"C:\Users\Admin\AppData\Local\Temp\26AD.tmp"117⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\272A.tmp"C:\Users\Admin\AppData\Local\Temp\272A.tmp"118⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\2788.tmp"C:\Users\Admin\AppData\Local\Temp\2788.tmp"119⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\27F5.tmp"C:\Users\Admin\AppData\Local\Temp\27F5.tmp"120⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\2872.tmp"C:\Users\Admin\AppData\Local\Temp\2872.tmp"121⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\28E0.tmp"C:\Users\Admin\AppData\Local\Temp\28E0.tmp"122⤵PID:2460
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-