Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
23/01/2024, 12:04
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-23_35452d781012974700df2626b39aad20_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-23_35452d781012974700df2626b39aad20_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-23_35452d781012974700df2626b39aad20_mafia.exe
-
Size
486KB
-
MD5
35452d781012974700df2626b39aad20
-
SHA1
be8941df932a1f8b02e482c557513e24c0db4958
-
SHA256
3409ef1139da9992754306357bc82f6cc9b88e84b60e6d3e205773e1fb3caba8
-
SHA512
60b29ba2a903dea957cbda55c5cba05c34751a423ef11132f94068824456decd82e23937b9e0bd08655c44c626835326daf28ece117549a9dca75499099759af
-
SSDEEP
12288:oU5rCOTeiDDHmZRmHH4rLKL0J/VdcqNZ:oUQOJDDmuHH4fK0JNdfN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4536 B769.tmp 2372 B95D.tmp 2216 B9F9.tmp 112 BA86.tmp 4696 BB61.tmp 4836 BC1C.tmp 464 BCE7.tmp 3168 BDE1.tmp 4448 BE6E.tmp 3460 BFE5.tmp 1920 C12D.tmp 4904 C217.tmp 2480 C2E2.tmp 4812 C3DC.tmp 804 C498.tmp 1700 C592.tmp 5020 C68C.tmp 3904 C786.tmp 1268 C870.tmp 4648 CA16.tmp 776 CAD2.tmp 3884 CC29.tmp 3140 CCF5.tmp 4464 CEC9.tmp 1224 CFC3.tmp 4124 D08E.tmp 1076 D11B.tmp 2936 D1E6.tmp 4912 D31F.tmp 5012 D496.tmp 2384 D570.tmp 3556 D61C.tmp 1248 D6D8.tmp 5112 D764.tmp 4976 D801.tmp 1760 D88D.tmp 664 D939.tmp 4068 DA14.tmp 4784 DAB0.tmp 2224 DB2D.tmp 2036 DBC9.tmp 2496 DC56.tmp 3108 DCE3.tmp 4120 DD7F.tmp 3208 DE1B.tmp 2072 DE98.tmp 4052 DF54.tmp 4360 DFD1.tmp 892 E177.tmp 2600 E1F4.tmp 2956 E261.tmp 4340 E2CE.tmp 3948 E34B.tmp 1680 E3B9.tmp 1920 E416.tmp 3264 E474.tmp 912 E4F1.tmp 2000 E57E.tmp 2188 E60A.tmp 1904 E697.tmp 3488 E6F5.tmp 2996 E762.tmp 224 E7FE.tmp 4988 E88B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3520 wrote to memory of 4536 3520 2024-01-23_35452d781012974700df2626b39aad20_mafia.exe 88 PID 3520 wrote to memory of 4536 3520 2024-01-23_35452d781012974700df2626b39aad20_mafia.exe 88 PID 3520 wrote to memory of 4536 3520 2024-01-23_35452d781012974700df2626b39aad20_mafia.exe 88 PID 4536 wrote to memory of 2372 4536 B769.tmp 89 PID 4536 wrote to memory of 2372 4536 B769.tmp 89 PID 4536 wrote to memory of 2372 4536 B769.tmp 89 PID 2372 wrote to memory of 2216 2372 B95D.tmp 90 PID 2372 wrote to memory of 2216 2372 B95D.tmp 90 PID 2372 wrote to memory of 2216 2372 B95D.tmp 90 PID 2216 wrote to memory of 112 2216 B9F9.tmp 91 PID 2216 wrote to memory of 112 2216 B9F9.tmp 91 PID 2216 wrote to memory of 112 2216 B9F9.tmp 91 PID 112 wrote to memory of 4696 112 BA86.tmp 92 PID 112 wrote to memory of 4696 112 BA86.tmp 92 PID 112 wrote to memory of 4696 112 BA86.tmp 92 PID 4696 wrote to memory of 4836 4696 BB61.tmp 93 PID 4696 wrote to memory of 4836 4696 BB61.tmp 93 PID 4696 wrote to memory of 4836 4696 BB61.tmp 93 PID 4836 wrote to memory of 464 4836 BC1C.tmp 95 PID 4836 wrote to memory of 464 4836 BC1C.tmp 95 PID 4836 wrote to memory of 464 4836 BC1C.tmp 95 PID 464 wrote to memory of 3168 464 BCE7.tmp 96 PID 464 wrote to memory of 3168 464 BCE7.tmp 96 PID 464 wrote to memory of 3168 464 BCE7.tmp 96 PID 3168 wrote to memory of 4448 3168 BDE1.tmp 97 PID 3168 wrote to memory of 4448 3168 BDE1.tmp 97 PID 3168 wrote to memory of 4448 3168 BDE1.tmp 97 PID 4448 wrote to memory of 3460 4448 BE6E.tmp 98 PID 4448 wrote to memory of 3460 4448 BE6E.tmp 98 PID 4448 wrote to memory of 3460 4448 BE6E.tmp 98 PID 3460 wrote to memory of 1920 3460 BFE5.tmp 99 PID 3460 wrote to memory of 1920 3460 BFE5.tmp 99 PID 3460 wrote to memory of 1920 3460 BFE5.tmp 99 PID 1920 wrote to memory of 4904 1920 C12D.tmp 100 PID 1920 wrote to memory of 4904 1920 C12D.tmp 100 PID 1920 wrote to memory of 4904 1920 C12D.tmp 100 PID 4904 wrote to memory of 2480 4904 C217.tmp 101 PID 4904 wrote to memory of 2480 4904 C217.tmp 101 PID 4904 wrote to memory of 2480 4904 C217.tmp 101 PID 2480 wrote to memory of 4812 2480 C2E2.tmp 102 PID 2480 wrote to memory of 4812 2480 C2E2.tmp 102 PID 2480 wrote to memory of 4812 2480 C2E2.tmp 102 PID 4812 wrote to memory of 804 4812 C3DC.tmp 103 PID 4812 wrote to memory of 804 4812 C3DC.tmp 103 PID 4812 wrote to memory of 804 4812 C3DC.tmp 103 PID 804 wrote to memory of 1700 804 C498.tmp 104 PID 804 wrote to memory of 1700 804 C498.tmp 104 PID 804 wrote to memory of 1700 804 C498.tmp 104 PID 1700 wrote to memory of 5020 1700 C592.tmp 105 PID 1700 wrote to memory of 5020 1700 C592.tmp 105 PID 1700 wrote to memory of 5020 1700 C592.tmp 105 PID 5020 wrote to memory of 3904 5020 C68C.tmp 106 PID 5020 wrote to memory of 3904 5020 C68C.tmp 106 PID 5020 wrote to memory of 3904 5020 C68C.tmp 106 PID 3904 wrote to memory of 1268 3904 C786.tmp 107 PID 3904 wrote to memory of 1268 3904 C786.tmp 107 PID 3904 wrote to memory of 1268 3904 C786.tmp 107 PID 1268 wrote to memory of 4648 1268 C870.tmp 108 PID 1268 wrote to memory of 4648 1268 C870.tmp 108 PID 1268 wrote to memory of 4648 1268 C870.tmp 108 PID 4648 wrote to memory of 776 4648 CA16.tmp 109 PID 4648 wrote to memory of 776 4648 CA16.tmp 109 PID 4648 wrote to memory of 776 4648 CA16.tmp 109 PID 776 wrote to memory of 3884 776 CAD2.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-23_35452d781012974700df2626b39aad20_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-23_35452d781012974700df2626b39aad20_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\B769.tmp"C:\Users\Admin\AppData\Local\Temp\B769.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\B95D.tmp"C:\Users\Admin\AppData\Local\Temp\B95D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\BA86.tmp"C:\Users\Admin\AppData\Local\Temp\BA86.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Users\Admin\AppData\Local\Temp\BB61.tmp"C:\Users\Admin\AppData\Local\Temp\BB61.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\C217.tmp"C:\Users\Admin\AppData\Local\Temp\C217.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\C3DC.tmp"C:\Users\Admin\AppData\Local\Temp\C3DC.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\C498.tmp"C:\Users\Admin\AppData\Local\Temp\C498.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\C592.tmp"C:\Users\Admin\AppData\Local\Temp\C592.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\C68C.tmp"C:\Users\Admin\AppData\Local\Temp\C68C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\C786.tmp"C:\Users\Admin\AppData\Local\Temp\C786.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\C870.tmp"C:\Users\Admin\AppData\Local\Temp\C870.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\CA16.tmp"C:\Users\Admin\AppData\Local\Temp\CA16.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\CAD2.tmp"C:\Users\Admin\AppData\Local\Temp\CAD2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Users\Admin\AppData\Local\Temp\CC29.tmp"C:\Users\Admin\AppData\Local\Temp\CC29.tmp"23⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"24⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\CEC9.tmp"C:\Users\Admin\AppData\Local\Temp\CEC9.tmp"25⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"26⤵
- Executes dropped EXE
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\D08E.tmp"C:\Users\Admin\AppData\Local\Temp\D08E.tmp"27⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\D11B.tmp"C:\Users\Admin\AppData\Local\Temp\D11B.tmp"28⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"29⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\D31F.tmp"C:\Users\Admin\AppData\Local\Temp\D31F.tmp"30⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\D496.tmp"C:\Users\Admin\AppData\Local\Temp\D496.tmp"31⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\D570.tmp"C:\Users\Admin\AppData\Local\Temp\D570.tmp"32⤵
- Executes dropped EXE
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\D61C.tmp"C:\Users\Admin\AppData\Local\Temp\D61C.tmp"33⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\D6D8.tmp"C:\Users\Admin\AppData\Local\Temp\D6D8.tmp"34⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\D764.tmp"C:\Users\Admin\AppData\Local\Temp\D764.tmp"35⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\D801.tmp"C:\Users\Admin\AppData\Local\Temp\D801.tmp"36⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\D88D.tmp"C:\Users\Admin\AppData\Local\Temp\D88D.tmp"37⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\D939.tmp"C:\Users\Admin\AppData\Local\Temp\D939.tmp"38⤵
- Executes dropped EXE
PID:664 -
C:\Users\Admin\AppData\Local\Temp\DA14.tmp"C:\Users\Admin\AppData\Local\Temp\DA14.tmp"39⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\DAB0.tmp"C:\Users\Admin\AppData\Local\Temp\DAB0.tmp"40⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\DB2D.tmp"C:\Users\Admin\AppData\Local\Temp\DB2D.tmp"41⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"42⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\DC56.tmp"C:\Users\Admin\AppData\Local\Temp\DC56.tmp"43⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\DCE3.tmp"C:\Users\Admin\AppData\Local\Temp\DCE3.tmp"44⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\DD7F.tmp"C:\Users\Admin\AppData\Local\Temp\DD7F.tmp"45⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"46⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\DE98.tmp"C:\Users\Admin\AppData\Local\Temp\DE98.tmp"47⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\DF54.tmp"C:\Users\Admin\AppData\Local\Temp\DF54.tmp"48⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"49⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\E177.tmp"C:\Users\Admin\AppData\Local\Temp\E177.tmp"50⤵
- Executes dropped EXE
PID:892 -
C:\Users\Admin\AppData\Local\Temp\E1F4.tmp"C:\Users\Admin\AppData\Local\Temp\E1F4.tmp"51⤵
- Executes dropped EXE
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\E261.tmp"C:\Users\Admin\AppData\Local\Temp\E261.tmp"52⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"53⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\E34B.tmp"C:\Users\Admin\AppData\Local\Temp\E34B.tmp"54⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"55⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\E416.tmp"C:\Users\Admin\AppData\Local\Temp\E416.tmp"56⤵
- Executes dropped EXE
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\E474.tmp"C:\Users\Admin\AppData\Local\Temp\E474.tmp"57⤵
- Executes dropped EXE
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\E4F1.tmp"C:\Users\Admin\AppData\Local\Temp\E4F1.tmp"58⤵
- Executes dropped EXE
PID:912 -
C:\Users\Admin\AppData\Local\Temp\E57E.tmp"C:\Users\Admin\AppData\Local\Temp\E57E.tmp"59⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\E60A.tmp"C:\Users\Admin\AppData\Local\Temp\E60A.tmp"60⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\E697.tmp"C:\Users\Admin\AppData\Local\Temp\E697.tmp"61⤵
- Executes dropped EXE
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"62⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\E762.tmp"C:\Users\Admin\AppData\Local\Temp\E762.tmp"63⤵
- Executes dropped EXE
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"64⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\E88B.tmp"C:\Users\Admin\AppData\Local\Temp\E88B.tmp"65⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\E937.tmp"C:\Users\Admin\AppData\Local\Temp\E937.tmp"66⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"67⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\EA31.tmp"C:\Users\Admin\AppData\Local\Temp\EA31.tmp"68⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\EA9E.tmp"C:\Users\Admin\AppData\Local\Temp\EA9E.tmp"69⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\EB2B.tmp"C:\Users\Admin\AppData\Local\Temp\EB2B.tmp"70⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"71⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\EC35.tmp"C:\Users\Admin\AppData\Local\Temp\EC35.tmp"72⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"73⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\ED3E.tmp"C:\Users\Admin\AppData\Local\Temp\ED3E.tmp"74⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"75⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\EEC5.tmp"C:\Users\Admin\AppData\Local\Temp\EEC5.tmp"76⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\EF32.tmp"C:\Users\Admin\AppData\Local\Temp\EF32.tmp"77⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\EFAF.tmp"C:\Users\Admin\AppData\Local\Temp\EFAF.tmp"78⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\F03C.tmp"C:\Users\Admin\AppData\Local\Temp\F03C.tmp"79⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"80⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\F145.tmp"C:\Users\Admin\AppData\Local\Temp\F145.tmp"81⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\F397.tmp"C:\Users\Admin\AppData\Local\Temp\F397.tmp"82⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\F424.tmp"C:\Users\Admin\AppData\Local\Temp\F424.tmp"83⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"84⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\F58B.tmp"C:\Users\Admin\AppData\Local\Temp\F58B.tmp"85⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\F618.tmp"C:\Users\Admin\AppData\Local\Temp\F618.tmp"86⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\F6B4.tmp"C:\Users\Admin\AppData\Local\Temp\F6B4.tmp"87⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\F770.tmp"C:\Users\Admin\AppData\Local\Temp\F770.tmp"88⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\F80C.tmp"C:\Users\Admin\AppData\Local\Temp\F80C.tmp"89⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\F889.tmp"C:\Users\Admin\AppData\Local\Temp\F889.tmp"90⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\F935.tmp"C:\Users\Admin\AppData\Local\Temp\F935.tmp"91⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\F9E1.tmp"C:\Users\Admin\AppData\Local\Temp\F9E1.tmp"92⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"93⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\FB29.tmp"C:\Users\Admin\AppData\Local\Temp\FB29.tmp"94⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"95⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\FC32.tmp"C:\Users\Admin\AppData\Local\Temp\FC32.tmp"96⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"97⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\FD1D.tmp"C:\Users\Admin\AppData\Local\Temp\FD1D.tmp"98⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\FDF7.tmp"C:\Users\Admin\AppData\Local\Temp\FDF7.tmp"99⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\FE84.tmp"C:\Users\Admin\AppData\Local\Temp\FE84.tmp"100⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\FF4F.tmp"C:\Users\Admin\AppData\Local\Temp\FF4F.tmp"101⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"102⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\49.tmp"C:\Users\Admin\AppData\Local\Temp\49.tmp"103⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\C6.tmp"C:\Users\Admin\AppData\Local\Temp\C6.tmp"104⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\134.tmp"C:\Users\Admin\AppData\Local\Temp\134.tmp"105⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\23D.tmp"C:\Users\Admin\AppData\Local\Temp\23D.tmp"106⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\2CA.tmp"C:\Users\Admin\AppData\Local\Temp\2CA.tmp"107⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\366.tmp"C:\Users\Admin\AppData\Local\Temp\366.tmp"108⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\3F3.tmp"C:\Users\Admin\AppData\Local\Temp\3F3.tmp"109⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\47F.tmp"C:\Users\Admin\AppData\Local\Temp\47F.tmp"110⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\55A.tmp"C:\Users\Admin\AppData\Local\Temp\55A.tmp"111⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\5C7.tmp"C:\Users\Admin\AppData\Local\Temp\5C7.tmp"112⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\644.tmp"C:\Users\Admin\AppData\Local\Temp\644.tmp"113⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\7FA.tmp"C:\Users\Admin\AppData\Local\Temp\7FA.tmp"114⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\867.tmp"C:\Users\Admin\AppData\Local\Temp\867.tmp"115⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\AD8.tmp"C:\Users\Admin\AppData\Local\Temp\AD8.tmp"116⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\B84.tmp"C:\Users\Admin\AppData\Local\Temp\B84.tmp"117⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\C11.tmp"C:\Users\Admin\AppData\Local\Temp\C11.tmp"118⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\C7E.tmp"C:\Users\Admin\AppData\Local\Temp\C7E.tmp"119⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\CDC.tmp"C:\Users\Admin\AppData\Local\Temp\CDC.tmp"120⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\D69.tmp"C:\Users\Admin\AppData\Local\Temp\D69.tmp"121⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\E53.tmp"C:\Users\Admin\AppData\Local\Temp\E53.tmp"122⤵PID:924
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-