Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
14/02/2024, 02:44
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-14_7c867bdfc148ef0833e575a59181c68c_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-02-14_7c867bdfc148ef0833e575a59181c68c_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-14_7c867bdfc148ef0833e575a59181c68c_mafia.exe
-
Size
486KB
-
MD5
7c867bdfc148ef0833e575a59181c68c
-
SHA1
10d51516b879da974f797e95767c3447479beaa9
-
SHA256
845747fdfa04b73a98971b4d0711fa54229b7986e417d181dc48eea0dadeb41e
-
SHA512
5ad5aff23c4c0ac35b24f372280d56ea9e41ced4430e5a7fffddf0eaee7a64559742525725606b3043740d1d96ee63cf9cbd3e4eca7811a3cd09c258cc5cfaef
-
SSDEEP
12288:oU5rCOTeiDDcbXKDk7i3PzaM1fCX16frZihRbNZ:oUQOJDDNV1qX104N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3392 BD35.tmp 3276 BF77.tmp 2404 C081.tmp 4852 C14C.tmp 3020 C208.tmp 2692 C2C3.tmp 1052 C350.tmp 1720 C40B.tmp 2956 C4A8.tmp 4816 C544.tmp 1956 C757.tmp 3544 C832.tmp 4576 C95B.tmp 1280 CA26.tmp 5092 CB10.tmp 4544 CBEB.tmp 4408 CCA6.tmp 2552 CDDF.tmp 4264 CE7B.tmp 5048 CF08.tmp 5088 CFB4.tmp 4712 D040.tmp 1636 D14A.tmp 3520 D1D7.tmp 4032 D2C1.tmp 376 D36D.tmp 1340 D438.tmp 2296 D8EB.tmp 2712 DA04.tmp 4120 DBC9.tmp 3152 DD40.tmp 3872 DE89.tmp 4392 E09C.tmp 1568 E186.tmp 2608 E29F.tmp 4856 E36B.tmp 3516 E474.tmp 3508 E5BC.tmp 2280 E668.tmp 1896 E6E5.tmp 1392 E772.tmp 4908 E88B.tmp 1416 E8F8.tmp 3668 EA21.tmp 1660 EB0C.tmp 736 EB79.tmp 2424 EBE6.tmp 4980 ECD1.tmp 4348 ED9C.tmp 4352 EE29.tmp 4736 EEC5.tmp 5016 EF51.tmp 4444 EFEE.tmp 4572 F0E8.tmp 3996 F174.tmp 4524 F201.tmp 4372 F2AD.tmp 4688 F359.tmp 564 F3E5.tmp 1820 F618.tmp 2204 F695.tmp 3976 F770.tmp 1692 F81B.tmp 1104 F8F6.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5112 wrote to memory of 3392 5112 2024-02-14_7c867bdfc148ef0833e575a59181c68c_mafia.exe 84 PID 5112 wrote to memory of 3392 5112 2024-02-14_7c867bdfc148ef0833e575a59181c68c_mafia.exe 84 PID 5112 wrote to memory of 3392 5112 2024-02-14_7c867bdfc148ef0833e575a59181c68c_mafia.exe 84 PID 3392 wrote to memory of 3276 3392 BD35.tmp 85 PID 3392 wrote to memory of 3276 3392 BD35.tmp 85 PID 3392 wrote to memory of 3276 3392 BD35.tmp 85 PID 3276 wrote to memory of 2404 3276 BF77.tmp 86 PID 3276 wrote to memory of 2404 3276 BF77.tmp 86 PID 3276 wrote to memory of 2404 3276 BF77.tmp 86 PID 2404 wrote to memory of 4852 2404 C081.tmp 87 PID 2404 wrote to memory of 4852 2404 C081.tmp 87 PID 2404 wrote to memory of 4852 2404 C081.tmp 87 PID 4852 wrote to memory of 3020 4852 C14C.tmp 88 PID 4852 wrote to memory of 3020 4852 C14C.tmp 88 PID 4852 wrote to memory of 3020 4852 C14C.tmp 88 PID 3020 wrote to memory of 2692 3020 C208.tmp 89 PID 3020 wrote to memory of 2692 3020 C208.tmp 89 PID 3020 wrote to memory of 2692 3020 C208.tmp 89 PID 2692 wrote to memory of 1052 2692 C2C3.tmp 90 PID 2692 wrote to memory of 1052 2692 C2C3.tmp 90 PID 2692 wrote to memory of 1052 2692 C2C3.tmp 90 PID 1052 wrote to memory of 1720 1052 C350.tmp 91 PID 1052 wrote to memory of 1720 1052 C350.tmp 91 PID 1052 wrote to memory of 1720 1052 C350.tmp 91 PID 1720 wrote to memory of 2956 1720 C40B.tmp 92 PID 1720 wrote to memory of 2956 1720 C40B.tmp 92 PID 1720 wrote to memory of 2956 1720 C40B.tmp 92 PID 2956 wrote to memory of 4816 2956 C4A8.tmp 93 PID 2956 wrote to memory of 4816 2956 C4A8.tmp 93 PID 2956 wrote to memory of 4816 2956 C4A8.tmp 93 PID 4816 wrote to memory of 1956 4816 C544.tmp 94 PID 4816 wrote to memory of 1956 4816 C544.tmp 94 PID 4816 wrote to memory of 1956 4816 C544.tmp 94 PID 1956 wrote to memory of 3544 1956 C757.tmp 95 PID 1956 wrote to memory of 3544 1956 C757.tmp 95 PID 1956 wrote to memory of 3544 1956 C757.tmp 95 PID 3544 wrote to memory of 4576 3544 C832.tmp 96 PID 3544 wrote to memory of 4576 3544 C832.tmp 96 PID 3544 wrote to memory of 4576 3544 C832.tmp 96 PID 4576 wrote to memory of 1280 4576 C95B.tmp 97 PID 4576 wrote to memory of 1280 4576 C95B.tmp 97 PID 4576 wrote to memory of 1280 4576 C95B.tmp 97 PID 1280 wrote to memory of 5092 1280 CA26.tmp 98 PID 1280 wrote to memory of 5092 1280 CA26.tmp 98 PID 1280 wrote to memory of 5092 1280 CA26.tmp 98 PID 5092 wrote to memory of 4544 5092 CB10.tmp 99 PID 5092 wrote to memory of 4544 5092 CB10.tmp 99 PID 5092 wrote to memory of 4544 5092 CB10.tmp 99 PID 4544 wrote to memory of 4408 4544 CBEB.tmp 100 PID 4544 wrote to memory of 4408 4544 CBEB.tmp 100 PID 4544 wrote to memory of 4408 4544 CBEB.tmp 100 PID 4408 wrote to memory of 2552 4408 CCA6.tmp 101 PID 4408 wrote to memory of 2552 4408 CCA6.tmp 101 PID 4408 wrote to memory of 2552 4408 CCA6.tmp 101 PID 2552 wrote to memory of 4264 2552 CDDF.tmp 102 PID 2552 wrote to memory of 4264 2552 CDDF.tmp 102 PID 2552 wrote to memory of 4264 2552 CDDF.tmp 102 PID 4264 wrote to memory of 5048 4264 CE7B.tmp 103 PID 4264 wrote to memory of 5048 4264 CE7B.tmp 103 PID 4264 wrote to memory of 5048 4264 CE7B.tmp 103 PID 5048 wrote to memory of 5088 5048 CF08.tmp 104 PID 5048 wrote to memory of 5088 5048 CF08.tmp 104 PID 5048 wrote to memory of 5088 5048 CF08.tmp 104 PID 5088 wrote to memory of 4712 5088 CFB4.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-14_7c867bdfc148ef0833e575a59181c68c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-14_7c867bdfc148ef0833e575a59181c68c_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\BD35.tmp"C:\Users\Admin\AppData\Local\Temp\BD35.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\BF77.tmp"C:\Users\Admin\AppData\Local\Temp\BF77.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\C208.tmp"C:\Users\Admin\AppData\Local\Temp\C208.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\C350.tmp"C:\Users\Admin\AppData\Local\Temp\C350.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\C40B.tmp"C:\Users\Admin\AppData\Local\Temp\C40B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\C544.tmp"C:\Users\Admin\AppData\Local\Temp\C544.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\C757.tmp"C:\Users\Admin\AppData\Local\Temp\C757.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\C832.tmp"C:\Users\Admin\AppData\Local\Temp\C832.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\C95B.tmp"C:\Users\Admin\AppData\Local\Temp\C95B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\CA26.tmp"C:\Users\Admin\AppData\Local\Temp\CA26.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\CB10.tmp"C:\Users\Admin\AppData\Local\Temp\CB10.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\CDDF.tmp"C:\Users\Admin\AppData\Local\Temp\CDDF.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\CF08.tmp"C:\Users\Admin\AppData\Local\Temp\CF08.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\D040.tmp"C:\Users\Admin\AppData\Local\Temp\D040.tmp"23⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\D14A.tmp"C:\Users\Admin\AppData\Local\Temp\D14A.tmp"24⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\D1D7.tmp"C:\Users\Admin\AppData\Local\Temp\D1D7.tmp"25⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\D2C1.tmp"C:\Users\Admin\AppData\Local\Temp\D2C1.tmp"26⤵
- Executes dropped EXE
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\D36D.tmp"C:\Users\Admin\AppData\Local\Temp\D36D.tmp"27⤵
- Executes dropped EXE
PID:376 -
C:\Users\Admin\AppData\Local\Temp\D438.tmp"C:\Users\Admin\AppData\Local\Temp\D438.tmp"28⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"29⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\DA04.tmp"C:\Users\Admin\AppData\Local\Temp\DA04.tmp"30⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"31⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\DD40.tmp"C:\Users\Admin\AppData\Local\Temp\DD40.tmp"32⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\DE89.tmp"C:\Users\Admin\AppData\Local\Temp\DE89.tmp"33⤵
- Executes dropped EXE
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\E09C.tmp"C:\Users\Admin\AppData\Local\Temp\E09C.tmp"34⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\E186.tmp"C:\Users\Admin\AppData\Local\Temp\E186.tmp"35⤵
- Executes dropped EXE
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\E29F.tmp"C:\Users\Admin\AppData\Local\Temp\E29F.tmp"36⤵
- Executes dropped EXE
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\E36B.tmp"C:\Users\Admin\AppData\Local\Temp\E36B.tmp"37⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\E474.tmp"C:\Users\Admin\AppData\Local\Temp\E474.tmp"38⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\E5BC.tmp"C:\Users\Admin\AppData\Local\Temp\E5BC.tmp"39⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\E668.tmp"C:\Users\Admin\AppData\Local\Temp\E668.tmp"40⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"41⤵
- Executes dropped EXE
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\E772.tmp"C:\Users\Admin\AppData\Local\Temp\E772.tmp"42⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\E88B.tmp"C:\Users\Admin\AppData\Local\Temp\E88B.tmp"43⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"44⤵
- Executes dropped EXE
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\EA21.tmp"C:\Users\Admin\AppData\Local\Temp\EA21.tmp"45⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"46⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\EB79.tmp"C:\Users\Admin\AppData\Local\Temp\EB79.tmp"47⤵
- Executes dropped EXE
PID:736 -
C:\Users\Admin\AppData\Local\Temp\EBE6.tmp"C:\Users\Admin\AppData\Local\Temp\EBE6.tmp"48⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"49⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\ED9C.tmp"C:\Users\Admin\AppData\Local\Temp\ED9C.tmp"50⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\EE29.tmp"C:\Users\Admin\AppData\Local\Temp\EE29.tmp"51⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\EEC5.tmp"C:\Users\Admin\AppData\Local\Temp\EEC5.tmp"52⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\EF51.tmp"C:\Users\Admin\AppData\Local\Temp\EF51.tmp"53⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\EFEE.tmp"C:\Users\Admin\AppData\Local\Temp\EFEE.tmp"54⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\F0E8.tmp"C:\Users\Admin\AppData\Local\Temp\F0E8.tmp"55⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\F174.tmp"C:\Users\Admin\AppData\Local\Temp\F174.tmp"56⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\F201.tmp"C:\Users\Admin\AppData\Local\Temp\F201.tmp"57⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\F2AD.tmp"C:\Users\Admin\AppData\Local\Temp\F2AD.tmp"58⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\F359.tmp"C:\Users\Admin\AppData\Local\Temp\F359.tmp"59⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\F3E5.tmp"C:\Users\Admin\AppData\Local\Temp\F3E5.tmp"60⤵
- Executes dropped EXE
PID:564 -
C:\Users\Admin\AppData\Local\Temp\F618.tmp"C:\Users\Admin\AppData\Local\Temp\F618.tmp"61⤵
- Executes dropped EXE
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\F695.tmp"C:\Users\Admin\AppData\Local\Temp\F695.tmp"62⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\F770.tmp"C:\Users\Admin\AppData\Local\Temp\F770.tmp"63⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\F81B.tmp"C:\Users\Admin\AppData\Local\Temp\F81B.tmp"64⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\F8F6.tmp"C:\Users\Admin\AppData\Local\Temp\F8F6.tmp"65⤵
- Executes dropped EXE
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\F992.tmp"C:\Users\Admin\AppData\Local\Temp\F992.tmp"66⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"67⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"68⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"69⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\FC61.tmp"C:\Users\Admin\AppData\Local\Temp\FC61.tmp"70⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\FCFD.tmp"C:\Users\Admin\AppData\Local\Temp\FCFD.tmp"71⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\FD7A.tmp"C:\Users\Admin\AppData\Local\Temp\FD7A.tmp"72⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\FE07.tmp"C:\Users\Admin\AppData\Local\Temp\FE07.tmp"73⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\FED2.tmp"C:\Users\Admin\AppData\Local\Temp\FED2.tmp"74⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\FF5F.tmp"C:\Users\Admin\AppData\Local\Temp\FF5F.tmp"75⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"76⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\59.tmp"C:\Users\Admin\AppData\Local\Temp\59.tmp"77⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\D6.tmp"C:\Users\Admin\AppData\Local\Temp\D6.tmp"78⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\143.tmp"C:\Users\Admin\AppData\Local\Temp\143.tmp"79⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\1C0.tmp"C:\Users\Admin\AppData\Local\Temp\1C0.tmp"80⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\25C.tmp"C:\Users\Admin\AppData\Local\Temp\25C.tmp"81⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\2CA.tmp"C:\Users\Admin\AppData\Local\Temp\2CA.tmp"82⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\356.tmp"C:\Users\Admin\AppData\Local\Temp\356.tmp"83⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\422.tmp"C:\Users\Admin\AppData\Local\Temp\422.tmp"84⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\4CD.tmp"C:\Users\Admin\AppData\Local\Temp\4CD.tmp"85⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\55A.tmp"C:\Users\Admin\AppData\Local\Temp\55A.tmp"86⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\5C7.tmp"C:\Users\Admin\AppData\Local\Temp\5C7.tmp"87⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\683.tmp"C:\Users\Admin\AppData\Local\Temp\683.tmp"88⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\700.tmp"C:\Users\Admin\AppData\Local\Temp\700.tmp"89⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\77D.tmp"C:\Users\Admin\AppData\Local\Temp\77D.tmp"90⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\80A.tmp"C:\Users\Admin\AppData\Local\Temp\80A.tmp"91⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\896.tmp"C:\Users\Admin\AppData\Local\Temp\896.tmp"92⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\923.tmp"C:\Users\Admin\AppData\Local\Temp\923.tmp"93⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\9A0.tmp"C:\Users\Admin\AppData\Local\Temp\9A0.tmp"94⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\9FE.tmp"C:\Users\Admin\AppData\Local\Temp\9FE.tmp"95⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\A6B.tmp"C:\Users\Admin\AppData\Local\Temp\A6B.tmp"96⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\AD8.tmp"C:\Users\Admin\AppData\Local\Temp\AD8.tmp"97⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\B75.tmp"C:\Users\Admin\AppData\Local\Temp\B75.tmp"98⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"99⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\C8E.tmp"C:\Users\Admin\AppData\Local\Temp\C8E.tmp"100⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\D1A.tmp"C:\Users\Admin\AppData\Local\Temp\D1A.tmp"101⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"102⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"103⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\EE0.tmp"C:\Users\Admin\AppData\Local\Temp\EE0.tmp"104⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"105⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\FF9.tmp"C:\Users\Admin\AppData\Local\Temp\FF9.tmp"106⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\1095.tmp"C:\Users\Admin\AppData\Local\Temp\1095.tmp"107⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\1151.tmp"C:\Users\Admin\AppData\Local\Temp\1151.tmp"108⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\11CE.tmp"C:\Users\Admin\AppData\Local\Temp\11CE.tmp"109⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\124B.tmp"C:\Users\Admin\AppData\Local\Temp\124B.tmp"110⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\12C8.tmp"C:\Users\Admin\AppData\Local\Temp\12C8.tmp"111⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\13B2.tmp"C:\Users\Admin\AppData\Local\Temp\13B2.tmp"112⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\143F.tmp"C:\Users\Admin\AppData\Local\Temp\143F.tmp"113⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\14AC.tmp"C:\Users\Admin\AppData\Local\Temp\14AC.tmp"114⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\15F4.tmp"C:\Users\Admin\AppData\Local\Temp\15F4.tmp"115⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\1661.tmp"C:\Users\Admin\AppData\Local\Temp\1661.tmp"116⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\16FE.tmp"C:\Users\Admin\AppData\Local\Temp\16FE.tmp"117⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\175B.tmp"C:\Users\Admin\AppData\Local\Temp\175B.tmp"118⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\17C9.tmp"C:\Users\Admin\AppData\Local\Temp\17C9.tmp"119⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\1855.tmp"C:\Users\Admin\AppData\Local\Temp\1855.tmp"120⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\18E2.tmp"C:\Users\Admin\AppData\Local\Temp\18E2.tmp"121⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\1A69.tmp"C:\Users\Admin\AppData\Local\Temp\1A69.tmp"122⤵PID:2116
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-