Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2024, 06:32
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-24_9b92424ed4ef1c5f2f5ed146931a22f4_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-24_9b92424ed4ef1c5f2f5ed146931a22f4_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-24_9b92424ed4ef1c5f2f5ed146931a22f4_mafia.exe
-
Size
487KB
-
MD5
9b92424ed4ef1c5f2f5ed146931a22f4
-
SHA1
ce62a11b8ee43f2baec95ba19c35f9106b7a8a3f
-
SHA256
694a7b8c91eb85b10d6439d414d1956f96d6d19510ce1ea426b481cf2d2c3e39
-
SHA512
116adff88eae68f1fab80fc6a997b391e688b25744d25a1f691c65f6d6e7d5c01f6cd79baba3637279423cee0528b25cf652e0524fd4e59ee56789984b9b722e
-
SSDEEP
12288:yU5rCOTeiNRi4uJrc18K/adnQWd86FsEON9w0CjbZ:yUQOJNcJY1R0nnsL9Eb
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5104 F359.tmp 2844 F491.tmp 1196 F59B.tmp 1852 F685.tmp 4424 F760.tmp 3752 FF7E.tmp 2948 162.tmp 4404 23D.tmp 2984 2F9.tmp 2692 402.tmp 3036 4AE.tmp 4388 56A.tmp 5052 6A2.tmp 932 74E.tmp 3348 819.tmp 316 8E4.tmp 3288 990.tmp 3404 A8A.tmp 1916 B36.tmp 2368 BE2.tmp 5072 CEC.tmp 5040 DA7.tmp 1308 E72.tmp 4544 EFF.tmp 2320 FCA.tmp 4268 1076.tmp 1392 1131.tmp 4292 120C.tmp 3240 1299.tmp 4072 1354.tmp 3428 1400.tmp 2520 14BC.tmp 4420 1577.tmp 3576 15E4.tmp 2768 1652.tmp 4968 16CF.tmp 2824 175B.tmp 4960 1807.tmp 4568 1884.tmp 4272 18F2.tmp 3964 19EC.tmp 1932 1A69.tmp 3924 1B72.tmp 4740 1BFF.tmp 4832 1CDA.tmp 5104 1E22.tmp 920 1EDD.tmp 3768 1F89.tmp 1548 2016.tmp 4396 20C2.tmp 2100 214E.tmp 3472 21CB.tmp 320 2268.tmp 1884 2323.tmp 3420 23BF.tmp 2496 246B.tmp 4732 24F8.tmp 3036 2575.tmp 4388 25E2.tmp 5100 266F.tmp 1044 26DC.tmp 3652 274A.tmp 3564 27D6.tmp 5108 2863.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4112 wrote to memory of 5104 4112 2024-01-24_9b92424ed4ef1c5f2f5ed146931a22f4_mafia.exe 86 PID 4112 wrote to memory of 5104 4112 2024-01-24_9b92424ed4ef1c5f2f5ed146931a22f4_mafia.exe 86 PID 4112 wrote to memory of 5104 4112 2024-01-24_9b92424ed4ef1c5f2f5ed146931a22f4_mafia.exe 86 PID 5104 wrote to memory of 2844 5104 F359.tmp 88 PID 5104 wrote to memory of 2844 5104 F359.tmp 88 PID 5104 wrote to memory of 2844 5104 F359.tmp 88 PID 2844 wrote to memory of 1196 2844 F491.tmp 89 PID 2844 wrote to memory of 1196 2844 F491.tmp 89 PID 2844 wrote to memory of 1196 2844 F491.tmp 89 PID 1196 wrote to memory of 1852 1196 F59B.tmp 90 PID 1196 wrote to memory of 1852 1196 F59B.tmp 90 PID 1196 wrote to memory of 1852 1196 F59B.tmp 90 PID 1852 wrote to memory of 4424 1852 F685.tmp 91 PID 1852 wrote to memory of 4424 1852 F685.tmp 91 PID 1852 wrote to memory of 4424 1852 F685.tmp 91 PID 4424 wrote to memory of 3752 4424 F760.tmp 92 PID 4424 wrote to memory of 3752 4424 F760.tmp 92 PID 4424 wrote to memory of 3752 4424 F760.tmp 92 PID 3752 wrote to memory of 2948 3752 FF7E.tmp 93 PID 3752 wrote to memory of 2948 3752 FF7E.tmp 93 PID 3752 wrote to memory of 2948 3752 FF7E.tmp 93 PID 2948 wrote to memory of 4404 2948 162.tmp 94 PID 2948 wrote to memory of 4404 2948 162.tmp 94 PID 2948 wrote to memory of 4404 2948 162.tmp 94 PID 4404 wrote to memory of 2984 4404 23D.tmp 95 PID 4404 wrote to memory of 2984 4404 23D.tmp 95 PID 4404 wrote to memory of 2984 4404 23D.tmp 95 PID 2984 wrote to memory of 2692 2984 2F9.tmp 96 PID 2984 wrote to memory of 2692 2984 2F9.tmp 96 PID 2984 wrote to memory of 2692 2984 2F9.tmp 96 PID 2692 wrote to memory of 3036 2692 402.tmp 97 PID 2692 wrote to memory of 3036 2692 402.tmp 97 PID 2692 wrote to memory of 3036 2692 402.tmp 97 PID 3036 wrote to memory of 4388 3036 4AE.tmp 98 PID 3036 wrote to memory of 4388 3036 4AE.tmp 98 PID 3036 wrote to memory of 4388 3036 4AE.tmp 98 PID 4388 wrote to memory of 5052 4388 56A.tmp 99 PID 4388 wrote to memory of 5052 4388 56A.tmp 99 PID 4388 wrote to memory of 5052 4388 56A.tmp 99 PID 5052 wrote to memory of 932 5052 6A2.tmp 100 PID 5052 wrote to memory of 932 5052 6A2.tmp 100 PID 5052 wrote to memory of 932 5052 6A2.tmp 100 PID 932 wrote to memory of 3348 932 74E.tmp 101 PID 932 wrote to memory of 3348 932 74E.tmp 101 PID 932 wrote to memory of 3348 932 74E.tmp 101 PID 3348 wrote to memory of 316 3348 819.tmp 102 PID 3348 wrote to memory of 316 3348 819.tmp 102 PID 3348 wrote to memory of 316 3348 819.tmp 102 PID 316 wrote to memory of 3288 316 8E4.tmp 103 PID 316 wrote to memory of 3288 316 8E4.tmp 103 PID 316 wrote to memory of 3288 316 8E4.tmp 103 PID 3288 wrote to memory of 3404 3288 990.tmp 104 PID 3288 wrote to memory of 3404 3288 990.tmp 104 PID 3288 wrote to memory of 3404 3288 990.tmp 104 PID 3404 wrote to memory of 1916 3404 A8A.tmp 105 PID 3404 wrote to memory of 1916 3404 A8A.tmp 105 PID 3404 wrote to memory of 1916 3404 A8A.tmp 105 PID 1916 wrote to memory of 2368 1916 B36.tmp 106 PID 1916 wrote to memory of 2368 1916 B36.tmp 106 PID 1916 wrote to memory of 2368 1916 B36.tmp 106 PID 2368 wrote to memory of 5072 2368 BE2.tmp 107 PID 2368 wrote to memory of 5072 2368 BE2.tmp 107 PID 2368 wrote to memory of 5072 2368 BE2.tmp 107 PID 5072 wrote to memory of 5040 5072 CEC.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-24_9b92424ed4ef1c5f2f5ed146931a22f4_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-24_9b92424ed4ef1c5f2f5ed146931a22f4_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\F359.tmp"C:\Users\Admin\AppData\Local\Temp\F359.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\F491.tmp"C:\Users\Admin\AppData\Local\Temp\F491.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\F59B.tmp"C:\Users\Admin\AppData\Local\Temp\F59B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\F685.tmp"C:\Users\Admin\AppData\Local\Temp\F685.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\F760.tmp"C:\Users\Admin\AppData\Local\Temp\F760.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\FF7E.tmp"C:\Users\Admin\AppData\Local\Temp\FF7E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\162.tmp"C:\Users\Admin\AppData\Local\Temp\162.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\23D.tmp"C:\Users\Admin\AppData\Local\Temp\23D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\2F9.tmp"C:\Users\Admin\AppData\Local\Temp\2F9.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\402.tmp"C:\Users\Admin\AppData\Local\Temp\402.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\4AE.tmp"C:\Users\Admin\AppData\Local\Temp\4AE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\56A.tmp"C:\Users\Admin\AppData\Local\Temp\56A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\6A2.tmp"C:\Users\Admin\AppData\Local\Temp\6A2.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\74E.tmp"C:\Users\Admin\AppData\Local\Temp\74E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\819.tmp"C:\Users\Admin\AppData\Local\Temp\819.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\8E4.tmp"C:\Users\Admin\AppData\Local\Temp\8E4.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Users\Admin\AppData\Local\Temp\990.tmp"C:\Users\Admin\AppData\Local\Temp\990.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\A8A.tmp"C:\Users\Admin\AppData\Local\Temp\A8A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\B36.tmp"C:\Users\Admin\AppData\Local\Temp\B36.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\BE2.tmp"C:\Users\Admin\AppData\Local\Temp\BE2.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\CEC.tmp"C:\Users\Admin\AppData\Local\Temp\CEC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"23⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\E72.tmp"C:\Users\Admin\AppData\Local\Temp\E72.tmp"24⤵
- Executes dropped EXE
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\EFF.tmp"C:\Users\Admin\AppData\Local\Temp\EFF.tmp"25⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\FCA.tmp"C:\Users\Admin\AppData\Local\Temp\FCA.tmp"26⤵
- Executes dropped EXE
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\1076.tmp"C:\Users\Admin\AppData\Local\Temp\1076.tmp"27⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\1131.tmp"C:\Users\Admin\AppData\Local\Temp\1131.tmp"28⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\120C.tmp"C:\Users\Admin\AppData\Local\Temp\120C.tmp"29⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\1299.tmp"C:\Users\Admin\AppData\Local\Temp\1299.tmp"30⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\1354.tmp"C:\Users\Admin\AppData\Local\Temp\1354.tmp"31⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\1400.tmp"C:\Users\Admin\AppData\Local\Temp\1400.tmp"32⤵
- Executes dropped EXE
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\14BC.tmp"C:\Users\Admin\AppData\Local\Temp\14BC.tmp"33⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\1577.tmp"C:\Users\Admin\AppData\Local\Temp\1577.tmp"34⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\15E4.tmp"C:\Users\Admin\AppData\Local\Temp\15E4.tmp"35⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\1652.tmp"C:\Users\Admin\AppData\Local\Temp\1652.tmp"36⤵
- Executes dropped EXE
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\16CF.tmp"C:\Users\Admin\AppData\Local\Temp\16CF.tmp"37⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\175B.tmp"C:\Users\Admin\AppData\Local\Temp\175B.tmp"38⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\1807.tmp"C:\Users\Admin\AppData\Local\Temp\1807.tmp"39⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\1884.tmp"C:\Users\Admin\AppData\Local\Temp\1884.tmp"40⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\18F2.tmp"C:\Users\Admin\AppData\Local\Temp\18F2.tmp"41⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\19EC.tmp"C:\Users\Admin\AppData\Local\Temp\19EC.tmp"42⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\1A69.tmp"C:\Users\Admin\AppData\Local\Temp\1A69.tmp"43⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\1B72.tmp"C:\Users\Admin\AppData\Local\Temp\1B72.tmp"44⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\1BFF.tmp"C:\Users\Admin\AppData\Local\Temp\1BFF.tmp"45⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"46⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\1E22.tmp"C:\Users\Admin\AppData\Local\Temp\1E22.tmp"47⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\1EDD.tmp"C:\Users\Admin\AppData\Local\Temp\1EDD.tmp"48⤵
- Executes dropped EXE
PID:920 -
C:\Users\Admin\AppData\Local\Temp\1F89.tmp"C:\Users\Admin\AppData\Local\Temp\1F89.tmp"49⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\2016.tmp"C:\Users\Admin\AppData\Local\Temp\2016.tmp"50⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\20C2.tmp"C:\Users\Admin\AppData\Local\Temp\20C2.tmp"51⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\214E.tmp"C:\Users\Admin\AppData\Local\Temp\214E.tmp"52⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\21CB.tmp"C:\Users\Admin\AppData\Local\Temp\21CB.tmp"53⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\2268.tmp"C:\Users\Admin\AppData\Local\Temp\2268.tmp"54⤵
- Executes dropped EXE
PID:320 -
C:\Users\Admin\AppData\Local\Temp\2323.tmp"C:\Users\Admin\AppData\Local\Temp\2323.tmp"55⤵
- Executes dropped EXE
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\23BF.tmp"C:\Users\Admin\AppData\Local\Temp\23BF.tmp"56⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\246B.tmp"C:\Users\Admin\AppData\Local\Temp\246B.tmp"57⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\24F8.tmp"C:\Users\Admin\AppData\Local\Temp\24F8.tmp"58⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\2575.tmp"C:\Users\Admin\AppData\Local\Temp\2575.tmp"59⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\25E2.tmp"C:\Users\Admin\AppData\Local\Temp\25E2.tmp"60⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\266F.tmp"C:\Users\Admin\AppData\Local\Temp\266F.tmp"61⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\26DC.tmp"C:\Users\Admin\AppData\Local\Temp\26DC.tmp"62⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\274A.tmp"C:\Users\Admin\AppData\Local\Temp\274A.tmp"63⤵
- Executes dropped EXE
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\27D6.tmp"C:\Users\Admin\AppData\Local\Temp\27D6.tmp"64⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\2863.tmp"C:\Users\Admin\AppData\Local\Temp\2863.tmp"65⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\290F.tmp"C:\Users\Admin\AppData\Local\Temp\290F.tmp"66⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\29AB.tmp"C:\Users\Admin\AppData\Local\Temp\29AB.tmp"67⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\2A47.tmp"C:\Users\Admin\AppData\Local\Temp\2A47.tmp"68⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"69⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\2B60.tmp"C:\Users\Admin\AppData\Local\Temp\2B60.tmp"70⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\2BED.tmp"C:\Users\Admin\AppData\Local\Temp\2BED.tmp"71⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\2C7A.tmp"C:\Users\Admin\AppData\Local\Temp\2C7A.tmp"72⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\2D26.tmp"C:\Users\Admin\AppData\Local\Temp\2D26.tmp"73⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"74⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"75⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\2EDB.tmp"C:\Users\Admin\AppData\Local\Temp\2EDB.tmp"76⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\2F68.tmp"C:\Users\Admin\AppData\Local\Temp\2F68.tmp"77⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\3004.tmp"C:\Users\Admin\AppData\Local\Temp\3004.tmp"78⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\30B0.tmp"C:\Users\Admin\AppData\Local\Temp\30B0.tmp"79⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\312D.tmp"C:\Users\Admin\AppData\Local\Temp\312D.tmp"80⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\31AA.tmp"C:\Users\Admin\AppData\Local\Temp\31AA.tmp"81⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"82⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"83⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"84⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"85⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\3524.tmp"C:\Users\Admin\AppData\Local\Temp\3524.tmp"86⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\35F0.tmp"C:\Users\Admin\AppData\Local\Temp\35F0.tmp"87⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\368C.tmp"C:\Users\Admin\AppData\Local\Temp\368C.tmp"88⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\3709.tmp"C:\Users\Admin\AppData\Local\Temp\3709.tmp"89⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\3776.tmp"C:\Users\Admin\AppData\Local\Temp\3776.tmp"90⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\3812.tmp"C:\Users\Admin\AppData\Local\Temp\3812.tmp"91⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\389F.tmp"C:\Users\Admin\AppData\Local\Temp\389F.tmp"92⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\392C.tmp"C:\Users\Admin\AppData\Local\Temp\392C.tmp"93⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\39F7.tmp"C:\Users\Admin\AppData\Local\Temp\39F7.tmp"94⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\3A83.tmp"C:\Users\Admin\AppData\Local\Temp\3A83.tmp"95⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\3B6E.tmp"C:\Users\Admin\AppData\Local\Temp\3B6E.tmp"96⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\3BFA.tmp"C:\Users\Admin\AppData\Local\Temp\3BFA.tmp"97⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\3C68.tmp"C:\Users\Admin\AppData\Local\Temp\3C68.tmp"98⤵PID:180
-
C:\Users\Admin\AppData\Local\Temp\3CF4.tmp"C:\Users\Admin\AppData\Local\Temp\3CF4.tmp"99⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\3E3D.tmp"C:\Users\Admin\AppData\Local\Temp\3E3D.tmp"100⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\3F08.tmp"C:\Users\Admin\AppData\Local\Temp\3F08.tmp"101⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\3FC3.tmp"C:\Users\Admin\AppData\Local\Temp\3FC3.tmp"102⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\4050.tmp"C:\Users\Admin\AppData\Local\Temp\4050.tmp"103⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\40BD.tmp"C:\Users\Admin\AppData\Local\Temp\40BD.tmp"104⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\4159.tmp"C:\Users\Admin\AppData\Local\Temp\4159.tmp"105⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\4234.tmp"C:\Users\Admin\AppData\Local\Temp\4234.tmp"106⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\42A2.tmp"C:\Users\Admin\AppData\Local\Temp\42A2.tmp"107⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\437C.tmp"C:\Users\Admin\AppData\Local\Temp\437C.tmp"108⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\4409.tmp"C:\Users\Admin\AppData\Local\Temp\4409.tmp"109⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\4522.tmp"C:\Users\Admin\AppData\Local\Temp\4522.tmp"110⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\459F.tmp"C:\Users\Admin\AppData\Local\Temp\459F.tmp"111⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\46D8.tmp"C:\Users\Admin\AppData\Local\Temp\46D8.tmp"112⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\4745.tmp"C:\Users\Admin\AppData\Local\Temp\4745.tmp"113⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\4810.tmp"C:\Users\Admin\AppData\Local\Temp\4810.tmp"114⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\4929.tmp"C:\Users\Admin\AppData\Local\Temp\4929.tmp"115⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\4997.tmp"C:\Users\Admin\AppData\Local\Temp\4997.tmp"116⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\4A62.tmp"C:\Users\Admin\AppData\Local\Temp\4A62.tmp"117⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\4AEF.tmp"C:\Users\Admin\AppData\Local\Temp\4AEF.tmp"118⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\4B6C.tmp"C:\Users\Admin\AppData\Local\Temp\4B6C.tmp"119⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\4BD9.tmp"C:\Users\Admin\AppData\Local\Temp\4BD9.tmp"120⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\4D50.tmp"C:\Users\Admin\AppData\Local\Temp\4D50.tmp"121⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\4E0B.tmp"C:\Users\Admin\AppData\Local\Temp\4E0B.tmp"122⤵PID:1896
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-