Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
04/02/2024, 14:35
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-04_afa4c9c14f54d63aedb2ec8f78efb35d_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-02-04_afa4c9c14f54d63aedb2ec8f78efb35d_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-04_afa4c9c14f54d63aedb2ec8f78efb35d_mafia.exe
-
Size
530KB
-
MD5
afa4c9c14f54d63aedb2ec8f78efb35d
-
SHA1
fca07a8a7c8861068858efd1b57e61e43d3facfb
-
SHA256
e10612969072444844913af9bffb49ebc62603bc40b00eb2c7e71b236571ec0d
-
SHA512
93f4eac7b5c1a5b96ef66c3bfbab4437f53f4aec744b4369adf2eba8774bc78781591b21758e55c8400fe076305db06ece3b3bb49ba1b3f4745da47ff1a3cf84
-
SSDEEP
12288:AU5rCOTeioVLsZsUEFMv2cp0JdJpLqNZulFVg0M1:AUQOJoFascCoNclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 440 A3A2.tmp 3484 A4AC.tmp 1320 A548.tmp 780 A633.tmp 3440 A6CF.tmp 4612 A78A.tmp 4184 A827.tmp 4128 A901.tmp 560 AD28.tmp 4068 ADF3.tmp 3952 AEDD.tmp 3496 AF7A.tmp 4728 B083.tmp 1532 B120.tmp 2392 B1FA.tmp 3604 B297.tmp 4444 B391.tmp 3108 B42D.tmp 5068 B4E8.tmp 4148 B5A4.tmp 2276 B621.tmp 524 B71B.tmp 3128 B815.tmp 1348 B892.tmp 3600 B95D.tmp 408 B9CA.tmp 3628 BA95.tmp 4312 BB61.tmp 632 BC2C.tmp 3188 BCB8.tmp 1768 BEBC.tmp 3096 BFA6.tmp 4344 C033.tmp 984 C0DF.tmp 1680 C16B.tmp 2436 C1E8.tmp 2936 C285.tmp 896 C302.tmp 2492 C36F.tmp 1184 C3EC.tmp 2324 C469.tmp 4296 C4E6.tmp 1500 C573.tmp 636 C60F.tmp 3788 C6AB.tmp 4872 C757.tmp 1704 C7F3.tmp 3212 C880.tmp 4040 C8FD.tmp 3084 C98A.tmp 392 CA16.tmp 800 CAA3.tmp 4324 CB20.tmp 764 CBCC.tmp 3004 CC49.tmp 4668 CCD5.tmp 228 CE0E.tmp 4496 CE8B.tmp 4572 CEF8.tmp 1320 CFC3.tmp 2908 D040.tmp 3080 D0AE.tmp 4260 D11B.tmp 1716 D198.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 228 wrote to memory of 440 228 2024-02-04_afa4c9c14f54d63aedb2ec8f78efb35d_mafia.exe 82 PID 228 wrote to memory of 440 228 2024-02-04_afa4c9c14f54d63aedb2ec8f78efb35d_mafia.exe 82 PID 228 wrote to memory of 440 228 2024-02-04_afa4c9c14f54d63aedb2ec8f78efb35d_mafia.exe 82 PID 440 wrote to memory of 3484 440 A3A2.tmp 83 PID 440 wrote to memory of 3484 440 A3A2.tmp 83 PID 440 wrote to memory of 3484 440 A3A2.tmp 83 PID 3484 wrote to memory of 1320 3484 A4AC.tmp 84 PID 3484 wrote to memory of 1320 3484 A4AC.tmp 84 PID 3484 wrote to memory of 1320 3484 A4AC.tmp 84 PID 1320 wrote to memory of 780 1320 A548.tmp 85 PID 1320 wrote to memory of 780 1320 A548.tmp 85 PID 1320 wrote to memory of 780 1320 A548.tmp 85 PID 780 wrote to memory of 3440 780 A633.tmp 86 PID 780 wrote to memory of 3440 780 A633.tmp 86 PID 780 wrote to memory of 3440 780 A633.tmp 86 PID 3440 wrote to memory of 4612 3440 A6CF.tmp 87 PID 3440 wrote to memory of 4612 3440 A6CF.tmp 87 PID 3440 wrote to memory of 4612 3440 A6CF.tmp 87 PID 4612 wrote to memory of 4184 4612 A78A.tmp 88 PID 4612 wrote to memory of 4184 4612 A78A.tmp 88 PID 4612 wrote to memory of 4184 4612 A78A.tmp 88 PID 4184 wrote to memory of 4128 4184 A827.tmp 89 PID 4184 wrote to memory of 4128 4184 A827.tmp 89 PID 4184 wrote to memory of 4128 4184 A827.tmp 89 PID 4128 wrote to memory of 560 4128 A901.tmp 90 PID 4128 wrote to memory of 560 4128 A901.tmp 90 PID 4128 wrote to memory of 560 4128 A901.tmp 90 PID 560 wrote to memory of 4068 560 AD28.tmp 91 PID 560 wrote to memory of 4068 560 AD28.tmp 91 PID 560 wrote to memory of 4068 560 AD28.tmp 91 PID 4068 wrote to memory of 3952 4068 ADF3.tmp 92 PID 4068 wrote to memory of 3952 4068 ADF3.tmp 92 PID 4068 wrote to memory of 3952 4068 ADF3.tmp 92 PID 3952 wrote to memory of 3496 3952 AEDD.tmp 93 PID 3952 wrote to memory of 3496 3952 AEDD.tmp 93 PID 3952 wrote to memory of 3496 3952 AEDD.tmp 93 PID 3496 wrote to memory of 4728 3496 AF7A.tmp 94 PID 3496 wrote to memory of 4728 3496 AF7A.tmp 94 PID 3496 wrote to memory of 4728 3496 AF7A.tmp 94 PID 4728 wrote to memory of 1532 4728 B083.tmp 95 PID 4728 wrote to memory of 1532 4728 B083.tmp 95 PID 4728 wrote to memory of 1532 4728 B083.tmp 95 PID 1532 wrote to memory of 2392 1532 B120.tmp 96 PID 1532 wrote to memory of 2392 1532 B120.tmp 96 PID 1532 wrote to memory of 2392 1532 B120.tmp 96 PID 2392 wrote to memory of 3604 2392 B1FA.tmp 97 PID 2392 wrote to memory of 3604 2392 B1FA.tmp 97 PID 2392 wrote to memory of 3604 2392 B1FA.tmp 97 PID 3604 wrote to memory of 4444 3604 B297.tmp 98 PID 3604 wrote to memory of 4444 3604 B297.tmp 98 PID 3604 wrote to memory of 4444 3604 B297.tmp 98 PID 4444 wrote to memory of 3108 4444 B391.tmp 99 PID 4444 wrote to memory of 3108 4444 B391.tmp 99 PID 4444 wrote to memory of 3108 4444 B391.tmp 99 PID 3108 wrote to memory of 5068 3108 B42D.tmp 100 PID 3108 wrote to memory of 5068 3108 B42D.tmp 100 PID 3108 wrote to memory of 5068 3108 B42D.tmp 100 PID 5068 wrote to memory of 4148 5068 B4E8.tmp 101 PID 5068 wrote to memory of 4148 5068 B4E8.tmp 101 PID 5068 wrote to memory of 4148 5068 B4E8.tmp 101 PID 4148 wrote to memory of 2276 4148 B5A4.tmp 102 PID 4148 wrote to memory of 2276 4148 B5A4.tmp 102 PID 4148 wrote to memory of 2276 4148 B5A4.tmp 102 PID 2276 wrote to memory of 524 2276 B621.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-04_afa4c9c14f54d63aedb2ec8f78efb35d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-04_afa4c9c14f54d63aedb2ec8f78efb35d_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\A633.tmp"C:\Users\Admin\AppData\Local\Temp\A633.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\A78A.tmp"C:\Users\Admin\AppData\Local\Temp\A78A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\A827.tmp"C:\Users\Admin\AppData\Local\Temp\A827.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\B083.tmp"C:\Users\Admin\AppData\Local\Temp\B083.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\B120.tmp"C:\Users\Admin\AppData\Local\Temp\B120.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\B391.tmp"C:\Users\Admin\AppData\Local\Temp\B391.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\B42D.tmp"C:\Users\Admin\AppData\Local\Temp\B42D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\B621.tmp"C:\Users\Admin\AppData\Local\Temp\B621.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\B71B.tmp"C:\Users\Admin\AppData\Local\Temp\B71B.tmp"23⤵
- Executes dropped EXE
PID:524 -
C:\Users\Admin\AppData\Local\Temp\B815.tmp"C:\Users\Admin\AppData\Local\Temp\B815.tmp"24⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\B892.tmp"C:\Users\Admin\AppData\Local\Temp\B892.tmp"25⤵
- Executes dropped EXE
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\B95D.tmp"C:\Users\Admin\AppData\Local\Temp\B95D.tmp"26⤵
- Executes dropped EXE
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"27⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\BA95.tmp"C:\Users\Admin\AppData\Local\Temp\BA95.tmp"28⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\BB61.tmp"C:\Users\Admin\AppData\Local\Temp\BB61.tmp"29⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"30⤵
- Executes dropped EXE
PID:632 -
C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"31⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"32⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"33⤵
- Executes dropped EXE
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"34⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"35⤵
- Executes dropped EXE
PID:984 -
C:\Users\Admin\AppData\Local\Temp\C16B.tmp"C:\Users\Admin\AppData\Local\Temp\C16B.tmp"36⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"37⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\C285.tmp"C:\Users\Admin\AppData\Local\Temp\C285.tmp"38⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\C302.tmp"C:\Users\Admin\AppData\Local\Temp\C302.tmp"39⤵
- Executes dropped EXE
PID:896 -
C:\Users\Admin\AppData\Local\Temp\C36F.tmp"C:\Users\Admin\AppData\Local\Temp\C36F.tmp"40⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"41⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\C469.tmp"C:\Users\Admin\AppData\Local\Temp\C469.tmp"42⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"43⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\C573.tmp"C:\Users\Admin\AppData\Local\Temp\C573.tmp"44⤵
- Executes dropped EXE
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\C60F.tmp"C:\Users\Admin\AppData\Local\Temp\C60F.tmp"45⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"46⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\C757.tmp"C:\Users\Admin\AppData\Local\Temp\C757.tmp"47⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"48⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\C880.tmp"C:\Users\Admin\AppData\Local\Temp\C880.tmp"49⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"50⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\C98A.tmp"C:\Users\Admin\AppData\Local\Temp\C98A.tmp"51⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\CA16.tmp"C:\Users\Admin\AppData\Local\Temp\CA16.tmp"52⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"53⤵
- Executes dropped EXE
PID:800 -
C:\Users\Admin\AppData\Local\Temp\CB20.tmp"C:\Users\Admin\AppData\Local\Temp\CB20.tmp"54⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"55⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\CC49.tmp"C:\Users\Admin\AppData\Local\Temp\CC49.tmp"56⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\CCD5.tmp"C:\Users\Admin\AppData\Local\Temp\CCD5.tmp"57⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\CE0E.tmp"C:\Users\Admin\AppData\Local\Temp\CE0E.tmp"58⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"59⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\CEF8.tmp"C:\Users\Admin\AppData\Local\Temp\CEF8.tmp"60⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"61⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\D040.tmp"C:\Users\Admin\AppData\Local\Temp\D040.tmp"62⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"63⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\D11B.tmp"C:\Users\Admin\AppData\Local\Temp\D11B.tmp"64⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\D198.tmp"C:\Users\Admin\AppData\Local\Temp\D198.tmp"65⤵
- Executes dropped EXE
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\D205.tmp"C:\Users\Admin\AppData\Local\Temp\D205.tmp"66⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\D2A2.tmp"C:\Users\Admin\AppData\Local\Temp\D2A2.tmp"67⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\D36D.tmp"C:\Users\Admin\AppData\Local\Temp\D36D.tmp"68⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\D3F9.tmp"C:\Users\Admin\AppData\Local\Temp\D3F9.tmp"69⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\D486.tmp"C:\Users\Admin\AppData\Local\Temp\D486.tmp"70⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\D4F3.tmp"C:\Users\Admin\AppData\Local\Temp\D4F3.tmp"71⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\D59F.tmp"C:\Users\Admin\AppData\Local\Temp\D59F.tmp"72⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\D60D.tmp"C:\Users\Admin\AppData\Local\Temp\D60D.tmp"73⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\D699.tmp"C:\Users\Admin\AppData\Local\Temp\D699.tmp"74⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\D726.tmp"C:\Users\Admin\AppData\Local\Temp\D726.tmp"75⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\D7E1.tmp"C:\Users\Admin\AppData\Local\Temp\D7E1.tmp"76⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\D85E.tmp"C:\Users\Admin\AppData\Local\Temp\D85E.tmp"77⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\D90A.tmp"C:\Users\Admin\AppData\Local\Temp\D90A.tmp"78⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\D987.tmp"C:\Users\Admin\AppData\Local\Temp\D987.tmp"79⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\DA04.tmp"C:\Users\Admin\AppData\Local\Temp\DA04.tmp"80⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\DA72.tmp"C:\Users\Admin\AppData\Local\Temp\DA72.tmp"81⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\DB0E.tmp"C:\Users\Admin\AppData\Local\Temp\DB0E.tmp"82⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"83⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\DC27.tmp"C:\Users\Admin\AppData\Local\Temp\DC27.tmp"84⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\DCA4.tmp"C:\Users\Admin\AppData\Local\Temp\DCA4.tmp"85⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\DD31.tmp"C:\Users\Admin\AppData\Local\Temp\DD31.tmp"86⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\DDBD.tmp"C:\Users\Admin\AppData\Local\Temp\DDBD.tmp"87⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\DE69.tmp"C:\Users\Admin\AppData\Local\Temp\DE69.tmp"88⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\DED7.tmp"C:\Users\Admin\AppData\Local\Temp\DED7.tmp"89⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\DF54.tmp"C:\Users\Admin\AppData\Local\Temp\DF54.tmp"90⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\E00F.tmp"C:\Users\Admin\AppData\Local\Temp\E00F.tmp"91⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\E08C.tmp"C:\Users\Admin\AppData\Local\Temp\E08C.tmp"92⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"93⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\E1D4.tmp"C:\Users\Admin\AppData\Local\Temp\E1D4.tmp"94⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\E242.tmp"C:\Users\Admin\AppData\Local\Temp\E242.tmp"95⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"96⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\E34B.tmp"C:\Users\Admin\AppData\Local\Temp\E34B.tmp"97⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"98⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\E445.tmp"C:\Users\Admin\AppData\Local\Temp\E445.tmp"99⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\E4B3.tmp"C:\Users\Admin\AppData\Local\Temp\E4B3.tmp"100⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\E520.tmp"C:\Users\Admin\AppData\Local\Temp\E520.tmp"101⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\E5CC.tmp"C:\Users\Admin\AppData\Local\Temp\E5CC.tmp"102⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\E659.tmp"C:\Users\Admin\AppData\Local\Temp\E659.tmp"103⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"104⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\E791.tmp"C:\Users\Admin\AppData\Local\Temp\E791.tmp"105⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\E80E.tmp"C:\Users\Admin\AppData\Local\Temp\E80E.tmp"106⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\E88B.tmp"C:\Users\Admin\AppData\Local\Temp\E88B.tmp"107⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"108⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\E985.tmp"C:\Users\Admin\AppData\Local\Temp\E985.tmp"109⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\EA12.tmp"C:\Users\Admin\AppData\Local\Temp\EA12.tmp"110⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\EA8F.tmp"C:\Users\Admin\AppData\Local\Temp\EA8F.tmp"111⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\EAFC.tmp"C:\Users\Admin\AppData\Local\Temp\EAFC.tmp"112⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\EB89.tmp"C:\Users\Admin\AppData\Local\Temp\EB89.tmp"113⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\EC06.tmp"C:\Users\Admin\AppData\Local\Temp\EC06.tmp"114⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\EC83.tmp"C:\Users\Admin\AppData\Local\Temp\EC83.tmp"115⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\ED4E.tmp"C:\Users\Admin\AppData\Local\Temp\ED4E.tmp"116⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\EDDA.tmp"C:\Users\Admin\AppData\Local\Temp\EDDA.tmp"117⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\EE48.tmp"C:\Users\Admin\AppData\Local\Temp\EE48.tmp"118⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\EED4.tmp"C:\Users\Admin\AppData\Local\Temp\EED4.tmp"119⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\EF61.tmp"C:\Users\Admin\AppData\Local\Temp\EF61.tmp"120⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"121⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\F04B.tmp"C:\Users\Admin\AppData\Local\Temp\F04B.tmp"122⤵PID:4656
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-