Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
157s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2024, 22:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-24_fb9669b4e2f1dfb071986e28d71524d0_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-24_fb9669b4e2f1dfb071986e28d71524d0_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-24_fb9669b4e2f1dfb071986e28d71524d0_mafia.exe
-
Size
486KB
-
MD5
fb9669b4e2f1dfb071986e28d71524d0
-
SHA1
cf291b2d6c173f07ba8afacc739361a9cbd5f008
-
SHA256
403bdfab7fb4486f7a575bf7262d70351f69d6786afe888a495df52e46f95cbd
-
SHA512
703a708da6b7446e7095cb2a8c88eaedbe0ec50576d83a92ce2c981465f49a4d8d120c6a41d501c7acfbc27b1ea36a90e60252e9260ab448e409c0429baf64b9
-
SSDEEP
12288:oU5rCOTeiD9ZeYavHaLxhS1xnst1gCuDGBNZ:oUQOJDPePHaLxOstqCuSBN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3912 9981.tmp 2408 9AE8.tmp 1880 9B84.tmp 1476 9C40.tmp 4676 9DB7.tmp 1868 A47D.tmp 5004 A4EB.tmp 4932 A5A6.tmp 1044 A78A.tmp 1648 A827.tmp 4904 A8B3.tmp 1444 A95F.tmp 1116 A9EC.tmp 500 AA78.tmp 560 AC9B.tmp 3992 AD18.tmp 3312 ADA5.tmp 3120 AE32.tmp 3228 AEDD.tmp 1980 AF6A.tmp 3872 B016.tmp 4508 B297.tmp 3704 B342.tmp 5024 B3DF.tmp 4480 B48B.tmp 1208 B4F8.tmp 2428 B556.tmp 2288 B769.tmp 1028 B892.tmp 4768 B90F.tmp 4832 B9EA.tmp 2744 BAB5.tmp 2888 BB70.tmp 4240 BE8D.tmp 1088 BF1A.tmp 4296 BFA6.tmp 4536 C043.tmp 4208 C11D.tmp 4440 C1AA.tmp 492 C237.tmp 4676 C2C3.tmp 3384 C35F.tmp 4696 C3CD.tmp 1888 C44A.tmp 4932 C4E6.tmp 3920 C563.tmp 3672 C786.tmp 3664 C813.tmp 2848 C89F.tmp 3776 C91C.tmp 1324 C98A.tmp 2264 CA07.tmp 5036 CA84.tmp 1896 CB20.tmp 4092 CBEB.tmp 2092 CC87.tmp 3576 CCF5.tmp 3992 CD72.tmp 3372 CDCF.tmp 2064 CE2D.tmp 4960 CE9A.tmp 456 CF27.tmp 3304 CFB4.tmp 3680 D031.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3772 wrote to memory of 3912 3772 2024-01-24_fb9669b4e2f1dfb071986e28d71524d0_mafia.exe 87 PID 3772 wrote to memory of 3912 3772 2024-01-24_fb9669b4e2f1dfb071986e28d71524d0_mafia.exe 87 PID 3772 wrote to memory of 3912 3772 2024-01-24_fb9669b4e2f1dfb071986e28d71524d0_mafia.exe 87 PID 3912 wrote to memory of 2408 3912 9981.tmp 89 PID 3912 wrote to memory of 2408 3912 9981.tmp 89 PID 3912 wrote to memory of 2408 3912 9981.tmp 89 PID 2408 wrote to memory of 1880 2408 9AE8.tmp 90 PID 2408 wrote to memory of 1880 2408 9AE8.tmp 90 PID 2408 wrote to memory of 1880 2408 9AE8.tmp 90 PID 1880 wrote to memory of 1476 1880 9B84.tmp 92 PID 1880 wrote to memory of 1476 1880 9B84.tmp 92 PID 1880 wrote to memory of 1476 1880 9B84.tmp 92 PID 1476 wrote to memory of 4676 1476 9C40.tmp 93 PID 1476 wrote to memory of 4676 1476 9C40.tmp 93 PID 1476 wrote to memory of 4676 1476 9C40.tmp 93 PID 4676 wrote to memory of 1868 4676 9DB7.tmp 94 PID 4676 wrote to memory of 1868 4676 9DB7.tmp 94 PID 4676 wrote to memory of 1868 4676 9DB7.tmp 94 PID 1868 wrote to memory of 5004 1868 A47D.tmp 95 PID 1868 wrote to memory of 5004 1868 A47D.tmp 95 PID 1868 wrote to memory of 5004 1868 A47D.tmp 95 PID 5004 wrote to memory of 4932 5004 A4EB.tmp 96 PID 5004 wrote to memory of 4932 5004 A4EB.tmp 96 PID 5004 wrote to memory of 4932 5004 A4EB.tmp 96 PID 4932 wrote to memory of 1044 4932 A5A6.tmp 97 PID 4932 wrote to memory of 1044 4932 A5A6.tmp 97 PID 4932 wrote to memory of 1044 4932 A5A6.tmp 97 PID 1044 wrote to memory of 1648 1044 A78A.tmp 98 PID 1044 wrote to memory of 1648 1044 A78A.tmp 98 PID 1044 wrote to memory of 1648 1044 A78A.tmp 98 PID 1648 wrote to memory of 4904 1648 A827.tmp 99 PID 1648 wrote to memory of 4904 1648 A827.tmp 99 PID 1648 wrote to memory of 4904 1648 A827.tmp 99 PID 4904 wrote to memory of 1444 4904 A8B3.tmp 101 PID 4904 wrote to memory of 1444 4904 A8B3.tmp 101 PID 4904 wrote to memory of 1444 4904 A8B3.tmp 101 PID 1444 wrote to memory of 1116 1444 A95F.tmp 102 PID 1444 wrote to memory of 1116 1444 A95F.tmp 102 PID 1444 wrote to memory of 1116 1444 A95F.tmp 102 PID 1116 wrote to memory of 500 1116 A9EC.tmp 103 PID 1116 wrote to memory of 500 1116 A9EC.tmp 103 PID 1116 wrote to memory of 500 1116 A9EC.tmp 103 PID 500 wrote to memory of 560 500 AA78.tmp 104 PID 500 wrote to memory of 560 500 AA78.tmp 104 PID 500 wrote to memory of 560 500 AA78.tmp 104 PID 560 wrote to memory of 3992 560 AC9B.tmp 105 PID 560 wrote to memory of 3992 560 AC9B.tmp 105 PID 560 wrote to memory of 3992 560 AC9B.tmp 105 PID 3992 wrote to memory of 3312 3992 AD18.tmp 106 PID 3992 wrote to memory of 3312 3992 AD18.tmp 106 PID 3992 wrote to memory of 3312 3992 AD18.tmp 106 PID 3312 wrote to memory of 3120 3312 ADA5.tmp 107 PID 3312 wrote to memory of 3120 3312 ADA5.tmp 107 PID 3312 wrote to memory of 3120 3312 ADA5.tmp 107 PID 3120 wrote to memory of 3228 3120 AE32.tmp 108 PID 3120 wrote to memory of 3228 3120 AE32.tmp 108 PID 3120 wrote to memory of 3228 3120 AE32.tmp 108 PID 3228 wrote to memory of 1980 3228 AEDD.tmp 109 PID 3228 wrote to memory of 1980 3228 AEDD.tmp 109 PID 3228 wrote to memory of 1980 3228 AEDD.tmp 109 PID 1980 wrote to memory of 3872 1980 AF6A.tmp 112 PID 1980 wrote to memory of 3872 1980 AF6A.tmp 112 PID 1980 wrote to memory of 3872 1980 AF6A.tmp 112 PID 3872 wrote to memory of 4508 3872 B016.tmp 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-24_fb9669b4e2f1dfb071986e28d71524d0_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-24_fb9669b4e2f1dfb071986e28d71524d0_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\A47D.tmp"C:\Users\Admin\AppData\Local\Temp\A47D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\A78A.tmp"C:\Users\Admin\AppData\Local\Temp\A78A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\A827.tmp"C:\Users\Admin\AppData\Local\Temp\A827.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:500 -
C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\AD18.tmp"C:\Users\Admin\AppData\Local\Temp\AD18.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\B016.tmp"C:\Users\Admin\AppData\Local\Temp\B016.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"23⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\B342.tmp"C:\Users\Admin\AppData\Local\Temp\B342.tmp"24⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"25⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\B48B.tmp"C:\Users\Admin\AppData\Local\Temp\B48B.tmp"26⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"27⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"28⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\B769.tmp"C:\Users\Admin\AppData\Local\Temp\B769.tmp"29⤵
- Executes dropped EXE
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\B892.tmp"C:\Users\Admin\AppData\Local\Temp\B892.tmp"30⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\B90F.tmp"C:\Users\Admin\AppData\Local\Temp\B90F.tmp"31⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"32⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"33⤵
- Executes dropped EXE
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\BB70.tmp"C:\Users\Admin\AppData\Local\Temp\BB70.tmp"34⤵
- Executes dropped EXE
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"35⤵
- Executes dropped EXE
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"36⤵
- Executes dropped EXE
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"37⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\C043.tmp"C:\Users\Admin\AppData\Local\Temp\C043.tmp"38⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\C11D.tmp"C:\Users\Admin\AppData\Local\Temp\C11D.tmp"39⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"40⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\C237.tmp"C:\Users\Admin\AppData\Local\Temp\C237.tmp"41⤵
- Executes dropped EXE
PID:492 -
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"42⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\C35F.tmp"C:\Users\Admin\AppData\Local\Temp\C35F.tmp"43⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"44⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\C44A.tmp"C:\Users\Admin\AppData\Local\Temp\C44A.tmp"45⤵
- Executes dropped EXE
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"46⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\C563.tmp"C:\Users\Admin\AppData\Local\Temp\C563.tmp"47⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\C786.tmp"C:\Users\Admin\AppData\Local\Temp\C786.tmp"48⤵
- Executes dropped EXE
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\C813.tmp"C:\Users\Admin\AppData\Local\Temp\C813.tmp"49⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\C89F.tmp"C:\Users\Admin\AppData\Local\Temp\C89F.tmp"50⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\C91C.tmp"C:\Users\Admin\AppData\Local\Temp\C91C.tmp"51⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\C98A.tmp"C:\Users\Admin\AppData\Local\Temp\C98A.tmp"52⤵
- Executes dropped EXE
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\CA07.tmp"C:\Users\Admin\AppData\Local\Temp\CA07.tmp"53⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\CA84.tmp"C:\Users\Admin\AppData\Local\Temp\CA84.tmp"54⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\CB20.tmp"C:\Users\Admin\AppData\Local\Temp\CB20.tmp"55⤵
- Executes dropped EXE
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"56⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\CC87.tmp"C:\Users\Admin\AppData\Local\Temp\CC87.tmp"57⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"58⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\CD72.tmp"C:\Users\Admin\AppData\Local\Temp\CD72.tmp"59⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"60⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"61⤵
- Executes dropped EXE
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"62⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\CF27.tmp"C:\Users\Admin\AppData\Local\Temp\CF27.tmp"63⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"64⤵
- Executes dropped EXE
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\D031.tmp"C:\Users\Admin\AppData\Local\Temp\D031.tmp"65⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\D30F.tmp"C:\Users\Admin\AppData\Local\Temp\D30F.tmp"66⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\D38C.tmp"C:\Users\Admin\AppData\Local\Temp\D38C.tmp"67⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\D409.tmp"C:\Users\Admin\AppData\Local\Temp\D409.tmp"68⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\D496.tmp"C:\Users\Admin\AppData\Local\Temp\D496.tmp"69⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\D503.tmp"C:\Users\Admin\AppData\Local\Temp\D503.tmp"70⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"71⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"72⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\DA72.tmp"C:\Users\Admin\AppData\Local\Temp\DA72.tmp"73⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\DADF.tmp"C:\Users\Admin\AppData\Local\Temp\DADF.tmp"74⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\DBF8.tmp"C:\Users\Admin\AppData\Local\Temp\DBF8.tmp"75⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"76⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\DD6F.tmp"C:\Users\Admin\AppData\Local\Temp\DD6F.tmp"77⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\DEF6.tmp"C:\Users\Admin\AppData\Local\Temp\DEF6.tmp"78⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\DF73.tmp"C:\Users\Admin\AppData\Local\Temp\DF73.tmp"79⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\E01F.tmp"C:\Users\Admin\AppData\Local\Temp\E01F.tmp"80⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\E119.tmp"C:\Users\Admin\AppData\Local\Temp\E119.tmp"81⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\E203.tmp"C:\Users\Admin\AppData\Local\Temp\E203.tmp"82⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\E2FD.tmp"C:\Users\Admin\AppData\Local\Temp\E2FD.tmp"83⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"84⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\E426.tmp"C:\Users\Admin\AppData\Local\Temp\E426.tmp"85⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\E484.tmp"C:\Users\Admin\AppData\Local\Temp\E484.tmp"86⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\E510.tmp"C:\Users\Admin\AppData\Local\Temp\E510.tmp"87⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\E59D.tmp"C:\Users\Admin\AppData\Local\Temp\E59D.tmp"88⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\E649.tmp"C:\Users\Admin\AppData\Local\Temp\E649.tmp"89⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"90⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\E733.tmp"C:\Users\Admin\AppData\Local\Temp\E733.tmp"91⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"92⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\E84D.tmp"C:\Users\Admin\AppData\Local\Temp\E84D.tmp"93⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"94⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\E985.tmp"C:\Users\Admin\AppData\Local\Temp\E985.tmp"95⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\EA12.tmp"C:\Users\Admin\AppData\Local\Temp\EA12.tmp"96⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\EA8F.tmp"C:\Users\Admin\AppData\Local\Temp\EA8F.tmp"97⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"98⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\EC35.tmp"C:\Users\Admin\AppData\Local\Temp\EC35.tmp"99⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\ECB2.tmp"C:\Users\Admin\AppData\Local\Temp\ECB2.tmp"100⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\ED3E.tmp"C:\Users\Admin\AppData\Local\Temp\ED3E.tmp"101⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\EDCB.tmp"C:\Users\Admin\AppData\Local\Temp\EDCB.tmp"102⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\EE57.tmp"C:\Users\Admin\AppData\Local\Temp\EE57.tmp"103⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"104⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\EF90.tmp"C:\Users\Admin\AppData\Local\Temp\EF90.tmp"105⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\F00D.tmp"C:\Users\Admin\AppData\Local\Temp\F00D.tmp"106⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\F388.tmp"C:\Users\Admin\AppData\Local\Temp\F388.tmp"107⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\F414.tmp"C:\Users\Admin\AppData\Local\Temp\F414.tmp"108⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\F482.tmp"C:\Users\Admin\AppData\Local\Temp\F482.tmp"109⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\F50E.tmp"C:\Users\Admin\AppData\Local\Temp\F50E.tmp"110⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\F5AA.tmp"C:\Users\Admin\AppData\Local\Temp\F5AA.tmp"111⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\F647.tmp"C:\Users\Admin\AppData\Local\Temp\F647.tmp"112⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"113⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\F721.tmp"C:\Users\Admin\AppData\Local\Temp\F721.tmp"114⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\F79E.tmp"C:\Users\Admin\AppData\Local\Temp\F79E.tmp"115⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\F80C.tmp"C:\Users\Admin\AppData\Local\Temp\F80C.tmp"116⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\F889.tmp"C:\Users\Admin\AppData\Local\Temp\F889.tmp"117⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\F964.tmp"C:\Users\Admin\AppData\Local\Temp\F964.tmp"118⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"119⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"120⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\FB09.tmp"C:\Users\Admin\AppData\Local\Temp\FB09.tmp"121⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\FB96.tmp"C:\Users\Admin\AppData\Local\Temp\FB96.tmp"122⤵PID:2360
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-