Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2024, 06:24
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-24_24d884883616a28071d51f35711b5bf6_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-24_24d884883616a28071d51f35711b5bf6_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-24_24d884883616a28071d51f35711b5bf6_mafia.exe
-
Size
486KB
-
MD5
24d884883616a28071d51f35711b5bf6
-
SHA1
cfa0add1adccf1ba1af6ea8ae0d3eaad72c5282d
-
SHA256
74075420458590f230142db193f89efc81dbdd230299eab810a79e0cdb6ff1b8
-
SHA512
c5d70758c9d090422efcd5836907ce52e4e316807dc477d62c0675bcbd3b5fbf4d452615ed79deefb6ce81a15ef774928db27fac8ded504785559453614f92b8
-
SSDEEP
12288:/U5rCOTeiDAanCOUZvCMHgN6+HifFZqraXPNZ:/UQOJDA+CO8vzHgN6+CyraXPN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2704 A5C5.tmp 3988 A74C.tmp 1068 AE70.tmp 3984 AF5A.tmp 2064 B054.tmp 4920 B0E1.tmp 2392 B297.tmp 4700 B40E.tmp 4904 B4E8.tmp 1404 B5B3.tmp 1076 B66F.tmp 964 B73A.tmp 2540 B815.tmp 3756 B92E.tmp 1468 B9F9.tmp 4472 BAB5.tmp 1932 BB61.tmp 3024 BC1C.tmp 4676 BD06.tmp 3608 BDC2.tmp 3612 BE2F.tmp 556 BEFA.tmp 4520 BFA6.tmp 5060 C071.tmp 1276 C12D.tmp 1644 C1D9.tmp 4868 C265.tmp 1116 C553.tmp 2720 C5E0.tmp 4916 C709.tmp 1796 C90D.tmp 2072 C999.tmp 1248 CA26.tmp 1284 CAD2.tmp 4468 CB3F.tmp 2788 CC58.tmp 820 CCF5.tmp 2704 CD62.tmp 4228 CE9A.tmp 4064 CF56.tmp 2384 CFD3.tmp 2812 D08E.tmp 2256 D15A.tmp 648 D1D7.tmp 4364 D273.tmp 4744 D30F.tmp 4464 D39C.tmp 2200 D448.tmp 4904 D590.tmp 1320 D66A.tmp 2412 D6E7.tmp 2992 D774.tmp 3148 D7F1.tmp 3116 D85E.tmp 3796 D90A.tmp 3000 D978.tmp 1468 DA04.tmp 4328 DA81.tmp 232 DB3D.tmp 2168 DBBA.tmp 3468 DC27.tmp 1932 DC95.tmp 3024 DD21.tmp 1400 DDAE.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 820 wrote to memory of 2704 820 2024-01-24_24d884883616a28071d51f35711b5bf6_mafia.exe 88 PID 820 wrote to memory of 2704 820 2024-01-24_24d884883616a28071d51f35711b5bf6_mafia.exe 88 PID 820 wrote to memory of 2704 820 2024-01-24_24d884883616a28071d51f35711b5bf6_mafia.exe 88 PID 2704 wrote to memory of 3988 2704 A5C5.tmp 89 PID 2704 wrote to memory of 3988 2704 A5C5.tmp 89 PID 2704 wrote to memory of 3988 2704 A5C5.tmp 89 PID 3988 wrote to memory of 1068 3988 A74C.tmp 91 PID 3988 wrote to memory of 1068 3988 A74C.tmp 91 PID 3988 wrote to memory of 1068 3988 A74C.tmp 91 PID 1068 wrote to memory of 3984 1068 AE70.tmp 92 PID 1068 wrote to memory of 3984 1068 AE70.tmp 92 PID 1068 wrote to memory of 3984 1068 AE70.tmp 92 PID 3984 wrote to memory of 2064 3984 AF5A.tmp 93 PID 3984 wrote to memory of 2064 3984 AF5A.tmp 93 PID 3984 wrote to memory of 2064 3984 AF5A.tmp 93 PID 2064 wrote to memory of 4920 2064 B054.tmp 94 PID 2064 wrote to memory of 4920 2064 B054.tmp 94 PID 2064 wrote to memory of 4920 2064 B054.tmp 94 PID 4920 wrote to memory of 2392 4920 B0E1.tmp 95 PID 4920 wrote to memory of 2392 4920 B0E1.tmp 95 PID 4920 wrote to memory of 2392 4920 B0E1.tmp 95 PID 2392 wrote to memory of 4700 2392 B297.tmp 96 PID 2392 wrote to memory of 4700 2392 B297.tmp 96 PID 2392 wrote to memory of 4700 2392 B297.tmp 96 PID 4700 wrote to memory of 4904 4700 B40E.tmp 97 PID 4700 wrote to memory of 4904 4700 B40E.tmp 97 PID 4700 wrote to memory of 4904 4700 B40E.tmp 97 PID 4904 wrote to memory of 1404 4904 B4E8.tmp 98 PID 4904 wrote to memory of 1404 4904 B4E8.tmp 98 PID 4904 wrote to memory of 1404 4904 B4E8.tmp 98 PID 1404 wrote to memory of 1076 1404 B5B3.tmp 99 PID 1404 wrote to memory of 1076 1404 B5B3.tmp 99 PID 1404 wrote to memory of 1076 1404 B5B3.tmp 99 PID 1076 wrote to memory of 964 1076 B66F.tmp 100 PID 1076 wrote to memory of 964 1076 B66F.tmp 100 PID 1076 wrote to memory of 964 1076 B66F.tmp 100 PID 964 wrote to memory of 2540 964 B73A.tmp 101 PID 964 wrote to memory of 2540 964 B73A.tmp 101 PID 964 wrote to memory of 2540 964 B73A.tmp 101 PID 2540 wrote to memory of 3756 2540 B815.tmp 102 PID 2540 wrote to memory of 3756 2540 B815.tmp 102 PID 2540 wrote to memory of 3756 2540 B815.tmp 102 PID 3756 wrote to memory of 1468 3756 B92E.tmp 103 PID 3756 wrote to memory of 1468 3756 B92E.tmp 103 PID 3756 wrote to memory of 1468 3756 B92E.tmp 103 PID 1468 wrote to memory of 4472 1468 B9F9.tmp 104 PID 1468 wrote to memory of 4472 1468 B9F9.tmp 104 PID 1468 wrote to memory of 4472 1468 B9F9.tmp 104 PID 4472 wrote to memory of 1932 4472 BAB5.tmp 105 PID 4472 wrote to memory of 1932 4472 BAB5.tmp 105 PID 4472 wrote to memory of 1932 4472 BAB5.tmp 105 PID 1932 wrote to memory of 3024 1932 BB61.tmp 106 PID 1932 wrote to memory of 3024 1932 BB61.tmp 106 PID 1932 wrote to memory of 3024 1932 BB61.tmp 106 PID 3024 wrote to memory of 4676 3024 BC1C.tmp 107 PID 3024 wrote to memory of 4676 3024 BC1C.tmp 107 PID 3024 wrote to memory of 4676 3024 BC1C.tmp 107 PID 4676 wrote to memory of 3608 4676 BD06.tmp 108 PID 4676 wrote to memory of 3608 4676 BD06.tmp 108 PID 4676 wrote to memory of 3608 4676 BD06.tmp 108 PID 3608 wrote to memory of 3612 3608 BDC2.tmp 109 PID 3608 wrote to memory of 3612 3608 BDC2.tmp 109 PID 3608 wrote to memory of 3612 3608 BDC2.tmp 109 PID 3612 wrote to memory of 556 3612 BE2F.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-24_24d884883616a28071d51f35711b5bf6_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-24_24d884883616a28071d51f35711b5bf6_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\A74C.tmp"C:\Users\Admin\AppData\Local\Temp\A74C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\AE70.tmp"C:\Users\Admin\AppData\Local\Temp\AE70.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\B054.tmp"C:\Users\Admin\AppData\Local\Temp\B054.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\B40E.tmp"C:\Users\Admin\AppData\Local\Temp\B40E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\B66F.tmp"C:\Users\Admin\AppData\Local\Temp\B66F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\B73A.tmp"C:\Users\Admin\AppData\Local\Temp\B73A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\B815.tmp"C:\Users\Admin\AppData\Local\Temp\B815.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\BB61.tmp"C:\Users\Admin\AppData\Local\Temp\BB61.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\BD06.tmp"C:\Users\Admin\AppData\Local\Temp\BD06.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"23⤵
- Executes dropped EXE
PID:556 -
C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"24⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\C071.tmp"C:\Users\Admin\AppData\Local\Temp\C071.tmp"25⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"26⤵
- Executes dropped EXE
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"27⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"28⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\C553.tmp"C:\Users\Admin\AppData\Local\Temp\C553.tmp"29⤵
- Executes dropped EXE
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"30⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\C709.tmp"C:\Users\Admin\AppData\Local\Temp\C709.tmp"31⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\C90D.tmp"C:\Users\Admin\AppData\Local\Temp\C90D.tmp"32⤵
- Executes dropped EXE
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\C999.tmp"C:\Users\Admin\AppData\Local\Temp\C999.tmp"33⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\CA26.tmp"C:\Users\Admin\AppData\Local\Temp\CA26.tmp"34⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\CAD2.tmp"C:\Users\Admin\AppData\Local\Temp\CAD2.tmp"35⤵
- Executes dropped EXE
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\CB3F.tmp"C:\Users\Admin\AppData\Local\Temp\CB3F.tmp"36⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\CC58.tmp"C:\Users\Admin\AppData\Local\Temp\CC58.tmp"37⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"38⤵
- Executes dropped EXE
PID:820 -
C:\Users\Admin\AppData\Local\Temp\CD62.tmp"C:\Users\Admin\AppData\Local\Temp\CD62.tmp"39⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"40⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\CF56.tmp"C:\Users\Admin\AppData\Local\Temp\CF56.tmp"41⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"42⤵
- Executes dropped EXE
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\D08E.tmp"C:\Users\Admin\AppData\Local\Temp\D08E.tmp"43⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\D15A.tmp"C:\Users\Admin\AppData\Local\Temp\D15A.tmp"44⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\D1D7.tmp"C:\Users\Admin\AppData\Local\Temp\D1D7.tmp"45⤵
- Executes dropped EXE
PID:648 -
C:\Users\Admin\AppData\Local\Temp\D273.tmp"C:\Users\Admin\AppData\Local\Temp\D273.tmp"46⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\D30F.tmp"C:\Users\Admin\AppData\Local\Temp\D30F.tmp"47⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\D39C.tmp"C:\Users\Admin\AppData\Local\Temp\D39C.tmp"48⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\D448.tmp"C:\Users\Admin\AppData\Local\Temp\D448.tmp"49⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\D590.tmp"C:\Users\Admin\AppData\Local\Temp\D590.tmp"50⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\D66A.tmp"C:\Users\Admin\AppData\Local\Temp\D66A.tmp"51⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\D6E7.tmp"C:\Users\Admin\AppData\Local\Temp\D6E7.tmp"52⤵
- Executes dropped EXE
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\D774.tmp"C:\Users\Admin\AppData\Local\Temp\D774.tmp"53⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\D7F1.tmp"C:\Users\Admin\AppData\Local\Temp\D7F1.tmp"54⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\D85E.tmp"C:\Users\Admin\AppData\Local\Temp\D85E.tmp"55⤵
- Executes dropped EXE
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\D90A.tmp"C:\Users\Admin\AppData\Local\Temp\D90A.tmp"56⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\D978.tmp"C:\Users\Admin\AppData\Local\Temp\D978.tmp"57⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\DA04.tmp"C:\Users\Admin\AppData\Local\Temp\DA04.tmp"58⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\DA81.tmp"C:\Users\Admin\AppData\Local\Temp\DA81.tmp"59⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"60⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\DBBA.tmp"C:\Users\Admin\AppData\Local\Temp\DBBA.tmp"61⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\DC27.tmp"C:\Users\Admin\AppData\Local\Temp\DC27.tmp"62⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\DC95.tmp"C:\Users\Admin\AppData\Local\Temp\DC95.tmp"63⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\DD21.tmp"C:\Users\Admin\AppData\Local\Temp\DD21.tmp"64⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"65⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\DE3A.tmp"C:\Users\Admin\AppData\Local\Temp\DE3A.tmp"66⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"67⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\DF44.tmp"C:\Users\Admin\AppData\Local\Temp\DF44.tmp"68⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\DFA2.tmp"C:\Users\Admin\AppData\Local\Temp\DFA2.tmp"69⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\E01F.tmp"C:\Users\Admin\AppData\Local\Temp\E01F.tmp"70⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\E119.tmp"C:\Users\Admin\AppData\Local\Temp\E119.tmp"71⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\E1B5.tmp"C:\Users\Admin\AppData\Local\Temp\E1B5.tmp"72⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\E222.tmp"C:\Users\Admin\AppData\Local\Temp\E222.tmp"73⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\E2AF.tmp"C:\Users\Admin\AppData\Local\Temp\E2AF.tmp"74⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\E30D.tmp"C:\Users\Admin\AppData\Local\Temp\E30D.tmp"75⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\E407.tmp"C:\Users\Admin\AppData\Local\Temp\E407.tmp"76⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\E474.tmp"C:\Users\Admin\AppData\Local\Temp\E474.tmp"77⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\E4E2.tmp"C:\Users\Admin\AppData\Local\Temp\E4E2.tmp"78⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\E56E.tmp"C:\Users\Admin\AppData\Local\Temp\E56E.tmp"79⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"80⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"81⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\E714.tmp"C:\Users\Admin\AppData\Local\Temp\E714.tmp"82⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\E791.tmp"C:\Users\Admin\AppData\Local\Temp\E791.tmp"83⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\E83D.tmp"C:\Users\Admin\AppData\Local\Temp\E83D.tmp"84⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\E8AA.tmp"C:\Users\Admin\AppData\Local\Temp\E8AA.tmp"85⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\E947.tmp"C:\Users\Admin\AppData\Local\Temp\E947.tmp"86⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\EA02.tmp"C:\Users\Admin\AppData\Local\Temp\EA02.tmp"87⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"88⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\EADD.tmp"C:\Users\Admin\AppData\Local\Temp\EADD.tmp"89⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\EBC7.tmp"C:\Users\Admin\AppData\Local\Temp\EBC7.tmp"90⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\EC44.tmp"C:\Users\Admin\AppData\Local\Temp\EC44.tmp"91⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\ECB2.tmp"C:\Users\Admin\AppData\Local\Temp\ECB2.tmp"92⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\ED3E.tmp"C:\Users\Admin\AppData\Local\Temp\ED3E.tmp"93⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\EDAC.tmp"C:\Users\Admin\AppData\Local\Temp\EDAC.tmp"94⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\EE29.tmp"C:\Users\Admin\AppData\Local\Temp\EE29.tmp"95⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\EEA6.tmp"C:\Users\Admin\AppData\Local\Temp\EEA6.tmp"96⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\EF51.tmp"C:\Users\Admin\AppData\Local\Temp\EF51.tmp"97⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\EFDE.tmp"C:\Users\Admin\AppData\Local\Temp\EFDE.tmp"98⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\F08A.tmp"C:\Users\Admin\AppData\Local\Temp\F08A.tmp"99⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\F117.tmp"C:\Users\Admin\AppData\Local\Temp\F117.tmp"100⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\F184.tmp"C:\Users\Admin\AppData\Local\Temp\F184.tmp"101⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\F1F1.tmp"C:\Users\Admin\AppData\Local\Temp\F1F1.tmp"102⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\F26E.tmp"C:\Users\Admin\AppData\Local\Temp\F26E.tmp"103⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\F30B.tmp"C:\Users\Admin\AppData\Local\Temp\F30B.tmp"104⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\F397.tmp"C:\Users\Admin\AppData\Local\Temp\F397.tmp"105⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\F424.tmp"C:\Users\Admin\AppData\Local\Temp\F424.tmp"106⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"107⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\F50E.tmp"C:\Users\Admin\AppData\Local\Temp\F50E.tmp"108⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\F5AA.tmp"C:\Users\Admin\AppData\Local\Temp\F5AA.tmp"109⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\F618.tmp"C:\Users\Admin\AppData\Local\Temp\F618.tmp"110⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"111⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\F721.tmp"C:\Users\Admin\AppData\Local\Temp\F721.tmp"112⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\F7BE.tmp"C:\Users\Admin\AppData\Local\Temp\F7BE.tmp"113⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\F83B.tmp"C:\Users\Admin\AppData\Local\Temp\F83B.tmp"114⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"115⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\F935.tmp"C:\Users\Admin\AppData\Local\Temp\F935.tmp"116⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\F9C1.tmp"C:\Users\Admin\AppData\Local\Temp\F9C1.tmp"117⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\FA1F.tmp"C:\Users\Admin\AppData\Local\Temp\FA1F.tmp"118⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"119⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\FB09.tmp"C:\Users\Admin\AppData\Local\Temp\FB09.tmp"120⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"121⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\FC13.tmp"C:\Users\Admin\AppData\Local\Temp\FC13.tmp"122⤵PID:852
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-