Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28/01/2024, 15:43
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-28_5d7c7d3a099ca43a37d39e6fb1ca38e9_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-28_5d7c7d3a099ca43a37d39e6fb1ca38e9_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-28_5d7c7d3a099ca43a37d39e6fb1ca38e9_mafia.exe
-
Size
486KB
-
MD5
5d7c7d3a099ca43a37d39e6fb1ca38e9
-
SHA1
a5ae6ae863d14f679c9891c44360b29660b8831a
-
SHA256
3d1030bd8af9c40b9391285f12877e424fb6b68ec848bf75847621be60e73754
-
SHA512
2af4bf444ba921de769964157014277d727f7e1464223f90809d7b17eb0760676574cc39808650f2be45b73e0490f11654d00c6349b7c180b0075b30a6109d50
-
SSDEEP
12288:/U5rCOTeiDIlfhzNQLdUxMM+2xL+L+dZ7UUBAScNZ:/UQOJDYMyxMMZd+wZVkN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3420 C459.tmp 3276 C573.tmp 3644 C6F9.tmp 3908 C822.tmp 4848 C8DE.tmp 1692 C9F7.tmp 1320 CAF1.tmp 1620 CB8D.tmp 4904 CC49.tmp 1884 CD04.tmp 4576 CDDF.tmp 3480 CEBA.tmp 968 CFA4.tmp 812 D050.tmp 4540 D12B.tmp 4456 D205.tmp 4124 D2E0.tmp 1944 D39C.tmp 4264 D448.tmp 3172 D503.tmp 4888 D5AF.tmp 1636 D68A.tmp 3520 D755.tmp 3972 D820.tmp 4600 D8AD.tmp 5064 D978.tmp 4984 DB1E.tmp 4932 DBF8.tmp 3436 DCF2.tmp 3224 DE3A.tmp 3000 DF25.tmp 4016 E02E.tmp 392 E148.tmp 4056 E3B9.tmp 3584 E4D2.tmp 4560 E57E.tmp 3684 E7D0.tmp 3848 E8E9.tmp 2316 E966.tmp 4152 E9D3.tmp 4988 EA6F.tmp 4840 EB0C.tmp 2424 EB69.tmp 3660 EC44.tmp 5100 ECB2.tmp 1848 ED7D.tmp 2996 EE19.tmp 4824 EE77.tmp 4768 EF03.tmp 4372 EF90.tmp 4876 F03C.tmp 564 F0B9.tmp 5068 F24F.tmp 5012 F388.tmp 3768 F414.tmp 2116 F472.tmp 4852 F58B.tmp 2692 F618.tmp 3136 F676.tmp 4492 F7DD.tmp 1956 F85A.tmp 1620 F8C7.tmp 4104 F973.tmp 2784 FA00.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4320 wrote to memory of 3420 4320 2024-01-28_5d7c7d3a099ca43a37d39e6fb1ca38e9_mafia.exe 84 PID 4320 wrote to memory of 3420 4320 2024-01-28_5d7c7d3a099ca43a37d39e6fb1ca38e9_mafia.exe 84 PID 4320 wrote to memory of 3420 4320 2024-01-28_5d7c7d3a099ca43a37d39e6fb1ca38e9_mafia.exe 84 PID 3420 wrote to memory of 3276 3420 C459.tmp 85 PID 3420 wrote to memory of 3276 3420 C459.tmp 85 PID 3420 wrote to memory of 3276 3420 C459.tmp 85 PID 3276 wrote to memory of 3644 3276 C573.tmp 86 PID 3276 wrote to memory of 3644 3276 C573.tmp 86 PID 3276 wrote to memory of 3644 3276 C573.tmp 86 PID 3644 wrote to memory of 3908 3644 C6F9.tmp 87 PID 3644 wrote to memory of 3908 3644 C6F9.tmp 87 PID 3644 wrote to memory of 3908 3644 C6F9.tmp 87 PID 3908 wrote to memory of 4848 3908 C822.tmp 88 PID 3908 wrote to memory of 4848 3908 C822.tmp 88 PID 3908 wrote to memory of 4848 3908 C822.tmp 88 PID 4848 wrote to memory of 1692 4848 C8DE.tmp 89 PID 4848 wrote to memory of 1692 4848 C8DE.tmp 89 PID 4848 wrote to memory of 1692 4848 C8DE.tmp 89 PID 1692 wrote to memory of 1320 1692 C9F7.tmp 90 PID 1692 wrote to memory of 1320 1692 C9F7.tmp 90 PID 1692 wrote to memory of 1320 1692 C9F7.tmp 90 PID 1320 wrote to memory of 1620 1320 CAF1.tmp 91 PID 1320 wrote to memory of 1620 1320 CAF1.tmp 91 PID 1320 wrote to memory of 1620 1320 CAF1.tmp 91 PID 1620 wrote to memory of 4904 1620 CB8D.tmp 92 PID 1620 wrote to memory of 4904 1620 CB8D.tmp 92 PID 1620 wrote to memory of 4904 1620 CB8D.tmp 92 PID 4904 wrote to memory of 1884 4904 CC49.tmp 93 PID 4904 wrote to memory of 1884 4904 CC49.tmp 93 PID 4904 wrote to memory of 1884 4904 CC49.tmp 93 PID 1884 wrote to memory of 4576 1884 CD04.tmp 94 PID 1884 wrote to memory of 4576 1884 CD04.tmp 94 PID 1884 wrote to memory of 4576 1884 CD04.tmp 94 PID 4576 wrote to memory of 3480 4576 CDDF.tmp 95 PID 4576 wrote to memory of 3480 4576 CDDF.tmp 95 PID 4576 wrote to memory of 3480 4576 CDDF.tmp 95 PID 3480 wrote to memory of 968 3480 CEBA.tmp 96 PID 3480 wrote to memory of 968 3480 CEBA.tmp 96 PID 3480 wrote to memory of 968 3480 CEBA.tmp 96 PID 968 wrote to memory of 812 968 CFA4.tmp 97 PID 968 wrote to memory of 812 968 CFA4.tmp 97 PID 968 wrote to memory of 812 968 CFA4.tmp 97 PID 812 wrote to memory of 4540 812 D050.tmp 98 PID 812 wrote to memory of 4540 812 D050.tmp 98 PID 812 wrote to memory of 4540 812 D050.tmp 98 PID 4540 wrote to memory of 4456 4540 D12B.tmp 99 PID 4540 wrote to memory of 4456 4540 D12B.tmp 99 PID 4540 wrote to memory of 4456 4540 D12B.tmp 99 PID 4456 wrote to memory of 4124 4456 D205.tmp 100 PID 4456 wrote to memory of 4124 4456 D205.tmp 100 PID 4456 wrote to memory of 4124 4456 D205.tmp 100 PID 4124 wrote to memory of 1944 4124 D2E0.tmp 101 PID 4124 wrote to memory of 1944 4124 D2E0.tmp 101 PID 4124 wrote to memory of 1944 4124 D2E0.tmp 101 PID 1944 wrote to memory of 4264 1944 D39C.tmp 102 PID 1944 wrote to memory of 4264 1944 D39C.tmp 102 PID 1944 wrote to memory of 4264 1944 D39C.tmp 102 PID 4264 wrote to memory of 3172 4264 D448.tmp 103 PID 4264 wrote to memory of 3172 4264 D448.tmp 103 PID 4264 wrote to memory of 3172 4264 D448.tmp 103 PID 3172 wrote to memory of 4888 3172 D503.tmp 104 PID 3172 wrote to memory of 4888 3172 D503.tmp 104 PID 3172 wrote to memory of 4888 3172 D503.tmp 104 PID 4888 wrote to memory of 1636 4888 D5AF.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-28_5d7c7d3a099ca43a37d39e6fb1ca38e9_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-28_5d7c7d3a099ca43a37d39e6fb1ca38e9_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\C459.tmp"C:\Users\Admin\AppData\Local\Temp\C459.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\C573.tmp"C:\Users\Admin\AppData\Local\Temp\C573.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\C822.tmp"C:\Users\Admin\AppData\Local\Temp\C822.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\CC49.tmp"C:\Users\Admin\AppData\Local\Temp\CC49.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\CD04.tmp"C:\Users\Admin\AppData\Local\Temp\CD04.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\CDDF.tmp"C:\Users\Admin\AppData\Local\Temp\CDDF.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\D050.tmp"C:\Users\Admin\AppData\Local\Temp\D050.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Users\Admin\AppData\Local\Temp\D12B.tmp"C:\Users\Admin\AppData\Local\Temp\D12B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\D205.tmp"C:\Users\Admin\AppData\Local\Temp\D205.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\D39C.tmp"C:\Users\Admin\AppData\Local\Temp\D39C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\D448.tmp"C:\Users\Admin\AppData\Local\Temp\D448.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\D503.tmp"C:\Users\Admin\AppData\Local\Temp\D503.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\D68A.tmp"C:\Users\Admin\AppData\Local\Temp\D68A.tmp"23⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\D755.tmp"C:\Users\Admin\AppData\Local\Temp\D755.tmp"24⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\D820.tmp"C:\Users\Admin\AppData\Local\Temp\D820.tmp"25⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\D8AD.tmp"C:\Users\Admin\AppData\Local\Temp\D8AD.tmp"26⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\D978.tmp"C:\Users\Admin\AppData\Local\Temp\D978.tmp"27⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"28⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\DBF8.tmp"C:\Users\Admin\AppData\Local\Temp\DBF8.tmp"29⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\DCF2.tmp"C:\Users\Admin\AppData\Local\Temp\DCF2.tmp"30⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\DE3A.tmp"C:\Users\Admin\AppData\Local\Temp\DE3A.tmp"31⤵
- Executes dropped EXE
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\DF25.tmp"C:\Users\Admin\AppData\Local\Temp\DF25.tmp"32⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\E02E.tmp"C:\Users\Admin\AppData\Local\Temp\E02E.tmp"33⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\E148.tmp"C:\Users\Admin\AppData\Local\Temp\E148.tmp"34⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"35⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\E4D2.tmp"C:\Users\Admin\AppData\Local\Temp\E4D2.tmp"36⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\E57E.tmp"C:\Users\Admin\AppData\Local\Temp\E57E.tmp"37⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"38⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"39⤵
- Executes dropped EXE
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\E966.tmp"C:\Users\Admin\AppData\Local\Temp\E966.tmp"40⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"41⤵
- Executes dropped EXE
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"42⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"43⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\EB69.tmp"C:\Users\Admin\AppData\Local\Temp\EB69.tmp"44⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\EC44.tmp"C:\Users\Admin\AppData\Local\Temp\EC44.tmp"45⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\ECB2.tmp"C:\Users\Admin\AppData\Local\Temp\ECB2.tmp"46⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\ED7D.tmp"C:\Users\Admin\AppData\Local\Temp\ED7D.tmp"47⤵
- Executes dropped EXE
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\EE19.tmp"C:\Users\Admin\AppData\Local\Temp\EE19.tmp"48⤵
- Executes dropped EXE
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\EE77.tmp"C:\Users\Admin\AppData\Local\Temp\EE77.tmp"49⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\EF03.tmp"C:\Users\Admin\AppData\Local\Temp\EF03.tmp"50⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\EF90.tmp"C:\Users\Admin\AppData\Local\Temp\EF90.tmp"51⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\F03C.tmp"C:\Users\Admin\AppData\Local\Temp\F03C.tmp"52⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\F0B9.tmp"C:\Users\Admin\AppData\Local\Temp\F0B9.tmp"53⤵
- Executes dropped EXE
PID:564 -
C:\Users\Admin\AppData\Local\Temp\F24F.tmp"C:\Users\Admin\AppData\Local\Temp\F24F.tmp"54⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\F388.tmp"C:\Users\Admin\AppData\Local\Temp\F388.tmp"55⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\F414.tmp"C:\Users\Admin\AppData\Local\Temp\F414.tmp"56⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\F472.tmp"C:\Users\Admin\AppData\Local\Temp\F472.tmp"57⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\F58B.tmp"C:\Users\Admin\AppData\Local\Temp\F58B.tmp"58⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\F618.tmp"C:\Users\Admin\AppData\Local\Temp\F618.tmp"59⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\F676.tmp"C:\Users\Admin\AppData\Local\Temp\F676.tmp"60⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"61⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\F85A.tmp"C:\Users\Admin\AppData\Local\Temp\F85A.tmp"62⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\F8C7.tmp"C:\Users\Admin\AppData\Local\Temp\F8C7.tmp"63⤵
- Executes dropped EXE
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\F973.tmp"C:\Users\Admin\AppData\Local\Temp\F973.tmp"64⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\FA00.tmp"C:\Users\Admin\AppData\Local\Temp\FA00.tmp"65⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"66⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\FB29.tmp"C:\Users\Admin\AppData\Local\Temp\FB29.tmp"67⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"68⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"69⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\FD7A.tmp"C:\Users\Admin\AppData\Local\Temp\FD7A.tmp"70⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\FE07.tmp"C:\Users\Admin\AppData\Local\Temp\FE07.tmp"71⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\FE74.tmp"C:\Users\Admin\AppData\Local\Temp\FE74.tmp"72⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\FF01.tmp"C:\Users\Admin\AppData\Local\Temp\FF01.tmp"73⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"74⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\1A.tmp"C:\Users\Admin\AppData\Local\Temp\1A.tmp"75⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7.tmp"76⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\143.tmp"C:\Users\Admin\AppData\Local\Temp\143.tmp"77⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\1D0.tmp"C:\Users\Admin\AppData\Local\Temp\1D0.tmp"78⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\24D.tmp"C:\Users\Admin\AppData\Local\Temp\24D.tmp"79⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\2E9.tmp"C:\Users\Admin\AppData\Local\Temp\2E9.tmp"80⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\376.tmp"C:\Users\Admin\AppData\Local\Temp\376.tmp"81⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\402.tmp"C:\Users\Admin\AppData\Local\Temp\402.tmp"82⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\470.tmp"C:\Users\Admin\AppData\Local\Temp\470.tmp"83⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\4FC.tmp"C:\Users\Admin\AppData\Local\Temp\4FC.tmp"84⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\599.tmp"C:\Users\Admin\AppData\Local\Temp\599.tmp"85⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\635.tmp"C:\Users\Admin\AppData\Local\Temp\635.tmp"86⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\6C1.tmp"C:\Users\Admin\AppData\Local\Temp\6C1.tmp"87⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\73E.tmp"C:\Users\Admin\AppData\Local\Temp\73E.tmp"88⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\7AC.tmp"C:\Users\Admin\AppData\Local\Temp\7AC.tmp"89⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\838.tmp"C:\Users\Admin\AppData\Local\Temp\838.tmp"90⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\8A6.tmp"C:\Users\Admin\AppData\Local\Temp\8A6.tmp"91⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\913.tmp"C:\Users\Admin\AppData\Local\Temp\913.tmp"92⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\9A0.tmp"C:\Users\Admin\AppData\Local\Temp\9A0.tmp"93⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\A4C.tmp"C:\Users\Admin\AppData\Local\Temp\A4C.tmp"94⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\AC9.tmp"C:\Users\Admin\AppData\Local\Temp\AC9.tmp"95⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\B46.tmp"C:\Users\Admin\AppData\Local\Temp\B46.tmp"96⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\BB3.tmp"C:\Users\Admin\AppData\Local\Temp\BB3.tmp"97⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\C7E.tmp"C:\Users\Admin\AppData\Local\Temp\C7E.tmp"98⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\CEC.tmp"C:\Users\Admin\AppData\Local\Temp\CEC.tmp"99⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\E82.tmp"C:\Users\Admin\AppData\Local\Temp\E82.tmp"100⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\EE0.tmp"C:\Users\Admin\AppData\Local\Temp\EE0.tmp"101⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"102⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\1018.tmp"C:\Users\Admin\AppData\Local\Temp\1018.tmp"103⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\1076.tmp"C:\Users\Admin\AppData\Local\Temp\1076.tmp"104⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\10E3.tmp"C:\Users\Admin\AppData\Local\Temp\10E3.tmp"105⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\117F.tmp"C:\Users\Admin\AppData\Local\Temp\117F.tmp"106⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\120C.tmp"C:\Users\Admin\AppData\Local\Temp\120C.tmp"107⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\1299.tmp"C:\Users\Admin\AppData\Local\Temp\1299.tmp"108⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\12F6.tmp"C:\Users\Admin\AppData\Local\Temp\12F6.tmp"109⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\1354.tmp"C:\Users\Admin\AppData\Local\Temp\1354.tmp"110⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\13C2.tmp"C:\Users\Admin\AppData\Local\Temp\13C2.tmp"111⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\144E.tmp"C:\Users\Admin\AppData\Local\Temp\144E.tmp"112⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\14BC.tmp"C:\Users\Admin\AppData\Local\Temp\14BC.tmp"113⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\1529.tmp"C:\Users\Admin\AppData\Local\Temp\1529.tmp"114⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\15A6.tmp"C:\Users\Admin\AppData\Local\Temp\15A6.tmp"115⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\173C.tmp"C:\Users\Admin\AppData\Local\Temp\173C.tmp"116⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\17C9.tmp"C:\Users\Admin\AppData\Local\Temp\17C9.tmp"117⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\1855.tmp"C:\Users\Admin\AppData\Local\Temp\1855.tmp"118⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\18F2.tmp"C:\Users\Admin\AppData\Local\Temp\18F2.tmp"119⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\196F.tmp"C:\Users\Admin\AppData\Local\Temp\196F.tmp"120⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\1B15.tmp"C:\Users\Admin\AppData\Local\Temp\1B15.tmp"121⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\1B92.tmp"C:\Users\Admin\AppData\Local\Temp\1B92.tmp"122⤵PID:1328
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-