Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29/01/2024, 11:41
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-29_9dff3271025af9cf32877727948a8d0a_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-29_9dff3271025af9cf32877727948a8d0a_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-29_9dff3271025af9cf32877727948a8d0a_mafia.exe
-
Size
488KB
-
MD5
9dff3271025af9cf32877727948a8d0a
-
SHA1
6d1ae8876c2e0c9a23e43e9a248ecb3d23657832
-
SHA256
b7a7af75b2c200a72ceeb7e17f3784860db8224d17b67387a7233a822e17cd40
-
SHA512
dc4711b80127f69da773b8a27ece690a7729847b05dfc615ae3a353b2987ba98ae5cd6cb0d00ab4433ccd5497c1593c2df0c3ed6dcee75a9fad681b8f0cbda8c
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7SFQ/NK2t9GorykeCPL6zzj40s0QrQujusH3j:/U5rCOTeiDSOt9GoWkeCPL6+Q4NZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4660 69E5.tmp 2096 6AA1.tmp 1648 6B6C.tmp 3068 6C18.tmp 4036 6CA4.tmp 856 6D12.tmp 864 6D8F.tmp 4872 6E4A.tmp 4752 6EC7.tmp 4932 6FB2.tmp 1652 704E.tmp 1180 7109.tmp 2740 7196.tmp 4588 71F4.tmp 3904 72AF.tmp 3556 737A.tmp 4392 73F7.tmp 2228 754F.tmp 4072 75CC.tmp 4544 7659.tmp 4068 76E5.tmp 4672 7782.tmp 4340 782D.tmp 2748 7937.tmp 2292 79C4.tmp 2784 7A70.tmp 3352 7B5A.tmp 4816 7BE7.tmp 1716 7C83.tmp 4656 7D00.tmp 3572 7D7D.tmp 4536 7DDB.tmp 3256 7E38.tmp 1040 7EC5.tmp 1872 7F52.tmp 2700 7FEE.tmp 5016 806B.tmp 1772 80F7.tmp 3836 8174.tmp 2408 8220.tmp 2948 82BD.tmp 1184 8359.tmp 1396 83D6.tmp 5052 8462.tmp 3444 851E.tmp 1740 85AB.tmp 3576 8637.tmp 1792 86B4.tmp 2532 8731.tmp 3896 87AE.tmp 4224 884A.tmp 452 88D7.tmp 64 8973.tmp 2192 8A2F.tmp 4996 8AAC.tmp 1720 8B48.tmp 1364 8BE4.tmp 3996 8C61.tmp 2656 8CEE.tmp 3484 8D7B.tmp 4052 8DE8.tmp 4532 8E84.tmp 4872 8F11.tmp 3900 8F9D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4832 wrote to memory of 4660 4832 2024-01-29_9dff3271025af9cf32877727948a8d0a_mafia.exe 84 PID 4832 wrote to memory of 4660 4832 2024-01-29_9dff3271025af9cf32877727948a8d0a_mafia.exe 84 PID 4832 wrote to memory of 4660 4832 2024-01-29_9dff3271025af9cf32877727948a8d0a_mafia.exe 84 PID 4660 wrote to memory of 2096 4660 69E5.tmp 85 PID 4660 wrote to memory of 2096 4660 69E5.tmp 85 PID 4660 wrote to memory of 2096 4660 69E5.tmp 85 PID 2096 wrote to memory of 1648 2096 6AA1.tmp 86 PID 2096 wrote to memory of 1648 2096 6AA1.tmp 86 PID 2096 wrote to memory of 1648 2096 6AA1.tmp 86 PID 1648 wrote to memory of 3068 1648 6B6C.tmp 87 PID 1648 wrote to memory of 3068 1648 6B6C.tmp 87 PID 1648 wrote to memory of 3068 1648 6B6C.tmp 87 PID 3068 wrote to memory of 4036 3068 6C18.tmp 88 PID 3068 wrote to memory of 4036 3068 6C18.tmp 88 PID 3068 wrote to memory of 4036 3068 6C18.tmp 88 PID 4036 wrote to memory of 856 4036 6CA4.tmp 89 PID 4036 wrote to memory of 856 4036 6CA4.tmp 89 PID 4036 wrote to memory of 856 4036 6CA4.tmp 89 PID 856 wrote to memory of 864 856 6D12.tmp 90 PID 856 wrote to memory of 864 856 6D12.tmp 90 PID 856 wrote to memory of 864 856 6D12.tmp 90 PID 864 wrote to memory of 4872 864 6D8F.tmp 91 PID 864 wrote to memory of 4872 864 6D8F.tmp 91 PID 864 wrote to memory of 4872 864 6D8F.tmp 91 PID 4872 wrote to memory of 4752 4872 6E4A.tmp 92 PID 4872 wrote to memory of 4752 4872 6E4A.tmp 92 PID 4872 wrote to memory of 4752 4872 6E4A.tmp 92 PID 4752 wrote to memory of 4932 4752 6EC7.tmp 93 PID 4752 wrote to memory of 4932 4752 6EC7.tmp 93 PID 4752 wrote to memory of 4932 4752 6EC7.tmp 93 PID 4932 wrote to memory of 1652 4932 6FB2.tmp 94 PID 4932 wrote to memory of 1652 4932 6FB2.tmp 94 PID 4932 wrote to memory of 1652 4932 6FB2.tmp 94 PID 1652 wrote to memory of 1180 1652 704E.tmp 95 PID 1652 wrote to memory of 1180 1652 704E.tmp 95 PID 1652 wrote to memory of 1180 1652 704E.tmp 95 PID 1180 wrote to memory of 2740 1180 7109.tmp 96 PID 1180 wrote to memory of 2740 1180 7109.tmp 96 PID 1180 wrote to memory of 2740 1180 7109.tmp 96 PID 2740 wrote to memory of 4588 2740 7196.tmp 97 PID 2740 wrote to memory of 4588 2740 7196.tmp 97 PID 2740 wrote to memory of 4588 2740 7196.tmp 97 PID 4588 wrote to memory of 3904 4588 71F4.tmp 98 PID 4588 wrote to memory of 3904 4588 71F4.tmp 98 PID 4588 wrote to memory of 3904 4588 71F4.tmp 98 PID 3904 wrote to memory of 3556 3904 72AF.tmp 99 PID 3904 wrote to memory of 3556 3904 72AF.tmp 99 PID 3904 wrote to memory of 3556 3904 72AF.tmp 99 PID 3556 wrote to memory of 4392 3556 737A.tmp 100 PID 3556 wrote to memory of 4392 3556 737A.tmp 100 PID 3556 wrote to memory of 4392 3556 737A.tmp 100 PID 4392 wrote to memory of 2228 4392 73F7.tmp 101 PID 4392 wrote to memory of 2228 4392 73F7.tmp 101 PID 4392 wrote to memory of 2228 4392 73F7.tmp 101 PID 2228 wrote to memory of 4072 2228 754F.tmp 102 PID 2228 wrote to memory of 4072 2228 754F.tmp 102 PID 2228 wrote to memory of 4072 2228 754F.tmp 102 PID 4072 wrote to memory of 4544 4072 75CC.tmp 103 PID 4072 wrote to memory of 4544 4072 75CC.tmp 103 PID 4072 wrote to memory of 4544 4072 75CC.tmp 103 PID 4544 wrote to memory of 4068 4544 7659.tmp 104 PID 4544 wrote to memory of 4068 4544 7659.tmp 104 PID 4544 wrote to memory of 4068 4544 7659.tmp 104 PID 4068 wrote to memory of 4672 4068 76E5.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-29_9dff3271025af9cf32877727948a8d0a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-29_9dff3271025af9cf32877727948a8d0a_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\73F7.tmp"C:\Users\Admin\AppData\Local\Temp\73F7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\754F.tmp"C:\Users\Admin\AppData\Local\Temp\754F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\7659.tmp"C:\Users\Admin\AppData\Local\Temp\7659.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"23⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\782D.tmp"C:\Users\Admin\AppData\Local\Temp\782D.tmp"24⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\7937.tmp"C:\Users\Admin\AppData\Local\Temp\7937.tmp"25⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\79C4.tmp"C:\Users\Admin\AppData\Local\Temp\79C4.tmp"26⤵
- Executes dropped EXE
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\7A70.tmp"C:\Users\Admin\AppData\Local\Temp\7A70.tmp"27⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"28⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"29⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\7C83.tmp"C:\Users\Admin\AppData\Local\Temp\7C83.tmp"30⤵
- Executes dropped EXE
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\7D00.tmp"C:\Users\Admin\AppData\Local\Temp\7D00.tmp"31⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"32⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"33⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\7E38.tmp"C:\Users\Admin\AppData\Local\Temp\7E38.tmp"34⤵
- Executes dropped EXE
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"35⤵
- Executes dropped EXE
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\7F52.tmp"C:\Users\Admin\AppData\Local\Temp\7F52.tmp"36⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"37⤵
- Executes dropped EXE
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"38⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\80F7.tmp"C:\Users\Admin\AppData\Local\Temp\80F7.tmp"39⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\8174.tmp"C:\Users\Admin\AppData\Local\Temp\8174.tmp"40⤵
- Executes dropped EXE
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\8220.tmp"C:\Users\Admin\AppData\Local\Temp\8220.tmp"41⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\82BD.tmp"C:\Users\Admin\AppData\Local\Temp\82BD.tmp"42⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\8359.tmp"C:\Users\Admin\AppData\Local\Temp\8359.tmp"43⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\83D6.tmp"C:\Users\Admin\AppData\Local\Temp\83D6.tmp"44⤵
- Executes dropped EXE
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\8462.tmp"C:\Users\Admin\AppData\Local\Temp\8462.tmp"45⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\851E.tmp"C:\Users\Admin\AppData\Local\Temp\851E.tmp"46⤵
- Executes dropped EXE
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\85AB.tmp"C:\Users\Admin\AppData\Local\Temp\85AB.tmp"47⤵
- Executes dropped EXE
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\8637.tmp"C:\Users\Admin\AppData\Local\Temp\8637.tmp"48⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"49⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\8731.tmp"C:\Users\Admin\AppData\Local\Temp\8731.tmp"50⤵
- Executes dropped EXE
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\87AE.tmp"C:\Users\Admin\AppData\Local\Temp\87AE.tmp"51⤵
- Executes dropped EXE
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"52⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"53⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\8973.tmp"C:\Users\Admin\AppData\Local\Temp\8973.tmp"54⤵
- Executes dropped EXE
PID:64 -
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"55⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"56⤵
- Executes dropped EXE
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\8B48.tmp"C:\Users\Admin\AppData\Local\Temp\8B48.tmp"57⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"58⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\8C61.tmp"C:\Users\Admin\AppData\Local\Temp\8C61.tmp"59⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"60⤵
- Executes dropped EXE
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"61⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"62⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\8E84.tmp"C:\Users\Admin\AppData\Local\Temp\8E84.tmp"63⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"64⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"65⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\902A.tmp"C:\Users\Admin\AppData\Local\Temp\902A.tmp"66⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\90B7.tmp"C:\Users\Admin\AppData\Local\Temp\90B7.tmp"67⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\9143.tmp"C:\Users\Admin\AppData\Local\Temp\9143.tmp"68⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\91E0.tmp"C:\Users\Admin\AppData\Local\Temp\91E0.tmp"69⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\926C.tmp"C:\Users\Admin\AppData\Local\Temp\926C.tmp"70⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\92F9.tmp"C:\Users\Admin\AppData\Local\Temp\92F9.tmp"71⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\9385.tmp"C:\Users\Admin\AppData\Local\Temp\9385.tmp"72⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\93F3.tmp"C:\Users\Admin\AppData\Local\Temp\93F3.tmp"73⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\9460.tmp"C:\Users\Admin\AppData\Local\Temp\9460.tmp"74⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\94BE.tmp"C:\Users\Admin\AppData\Local\Temp\94BE.tmp"75⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"76⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\95B8.tmp"C:\Users\Admin\AppData\Local\Temp\95B8.tmp"77⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\9625.tmp"C:\Users\Admin\AppData\Local\Temp\9625.tmp"78⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"79⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"80⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\978D.tmp"C:\Users\Admin\AppData\Local\Temp\978D.tmp"81⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\9819.tmp"C:\Users\Admin\AppData\Local\Temp\9819.tmp"82⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\9896.tmp"C:\Users\Admin\AppData\Local\Temp\9896.tmp"83⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\9923.tmp"C:\Users\Admin\AppData\Local\Temp\9923.tmp"84⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"85⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\99EE.tmp"C:\Users\Admin\AppData\Local\Temp\99EE.tmp"86⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"87⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"88⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"89⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"90⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"91⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\9D69.tmp"C:\Users\Admin\AppData\Local\Temp\9D69.tmp"92⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\9E53.tmp"C:\Users\Admin\AppData\Local\Temp\9E53.tmp"93⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"94⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"95⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"96⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\A095.tmp"C:\Users\Admin\AppData\Local\Temp\A095.tmp"97⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\A103.tmp"C:\Users\Admin\AppData\Local\Temp\A103.tmp"98⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"99⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"100⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"101⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"102⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"103⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"104⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"105⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\A519.tmp"C:\Users\Admin\AppData\Local\Temp\A519.tmp"106⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"107⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"108⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"109⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\A74C.tmp"C:\Users\Admin\AppData\Local\Temp\A74C.tmp"110⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"111⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"112⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"113⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\A96F.tmp"C:\Users\Admin\AppData\Local\Temp\A96F.tmp"114⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\AA69.tmp"C:\Users\Admin\AppData\Local\Temp\AA69.tmp"115⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"116⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\AB72.tmp"C:\Users\Admin\AppData\Local\Temp\AB72.tmp"117⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"118⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"119⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\AD18.tmp"C:\Users\Admin\AppData\Local\Temp\AD18.tmp"120⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"121⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\AE60.tmp"C:\Users\Admin\AppData\Local\Temp\AE60.tmp"122⤵PID:4676
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-