Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
165s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/02/2024, 18:31
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-28_48978b4e5bd83fdc14037107e068d752_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-02-28_48978b4e5bd83fdc14037107e068d752_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-02-28_48978b4e5bd83fdc14037107e068d752_mafia.exe
-
Size
486KB
-
MD5
48978b4e5bd83fdc14037107e068d752
-
SHA1
4cc00513411644fa36d011ba9bb3352a83476dd7
-
SHA256
e9dd43187d20c52ca24dbf6ac51a3f281e2d76ecaff8a38c86f1b8b820d2e93d
-
SHA512
d6a64b8b8913090eba439fb4775068725e6e5dc9d92bd79c360e9fd992cb87e736f36e3456d13944b0aba3aa95545b69d9e145744fcb1d02a768c76325c2d0da
-
SSDEEP
6144:Borf3lPvovsgZnqG2C7mOTeiLfD7lNm9gXgFImdefw/q/xIIThnOCFjNnLPFpgsz:oU5rCOTeiD3m9NIB/eShnv9VFppNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4308 BE9D.tmp 4820 DC75.tmp 1152 DD12.tmp 4892 DED7.tmp 3168 DF54.tmp 2604 DFF0.tmp 224 E0CB.tmp 3772 E196.tmp 3992 E261.tmp 4836 E30D.tmp 3080 E3C8.tmp 4728 E465.tmp 2828 E54F.tmp 4056 E60A.tmp 3988 E6E5.tmp 2244 E781.tmp 2804 E8AA.tmp 3776 E985.tmp 2612 EA7F.tmp 3324 EB3B.tmp 4456 EBA8.tmp 1060 EC25.tmp 644 ED00.tmp 2584 EDDA.tmp 884 EEA6.tmp 1112 EF51.tmp 3168 F00D.tmp 3536 F08A.tmp 1844 F107.tmp 4836 F174.tmp 4788 F211.tmp 980 F2EB.tmp 3464 F388.tmp 5064 F414.tmp 684 F4B0.tmp 4620 F52D.tmp 4200 F5AA.tmp 408 F627.tmp 4688 F6A4.tmp 1840 F721.tmp 2276 F78F.tmp 1268 F86A.tmp 4332 F8F6.tmp 2612 F973.tmp 1640 F9D1.tmp 4336 FA4E.tmp 4456 FAEA.tmp 1060 FB77.tmp 4308 FBD5.tmp 4932 FC71.tmp 4676 FCEE.tmp 4800 FD5B.tmp 1296 FDE8.tmp 1492 FE55.tmp 3860 FEC3.tmp 740 FF40.tmp 2436 FFBD.tmp 3984 3A.tmp 2856 C6.tmp 4728 153.tmp 1288 1DF.tmp 2972 25C.tmp 3576 2F9.tmp 3944 376.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4808 wrote to memory of 4308 4808 2024-02-28_48978b4e5bd83fdc14037107e068d752_mafia.exe 97 PID 4808 wrote to memory of 4308 4808 2024-02-28_48978b4e5bd83fdc14037107e068d752_mafia.exe 97 PID 4808 wrote to memory of 4308 4808 2024-02-28_48978b4e5bd83fdc14037107e068d752_mafia.exe 97 PID 4308 wrote to memory of 4820 4308 BE9D.tmp 98 PID 4308 wrote to memory of 4820 4308 BE9D.tmp 98 PID 4308 wrote to memory of 4820 4308 BE9D.tmp 98 PID 4820 wrote to memory of 1152 4820 DC75.tmp 99 PID 4820 wrote to memory of 1152 4820 DC75.tmp 99 PID 4820 wrote to memory of 1152 4820 DC75.tmp 99 PID 1152 wrote to memory of 4892 1152 DD12.tmp 100 PID 1152 wrote to memory of 4892 1152 DD12.tmp 100 PID 1152 wrote to memory of 4892 1152 DD12.tmp 100 PID 4892 wrote to memory of 3168 4892 DED7.tmp 101 PID 4892 wrote to memory of 3168 4892 DED7.tmp 101 PID 4892 wrote to memory of 3168 4892 DED7.tmp 101 PID 3168 wrote to memory of 2604 3168 DF54.tmp 102 PID 3168 wrote to memory of 2604 3168 DF54.tmp 102 PID 3168 wrote to memory of 2604 3168 DF54.tmp 102 PID 2604 wrote to memory of 224 2604 DFF0.tmp 103 PID 2604 wrote to memory of 224 2604 DFF0.tmp 103 PID 2604 wrote to memory of 224 2604 DFF0.tmp 103 PID 224 wrote to memory of 3772 224 E0CB.tmp 104 PID 224 wrote to memory of 3772 224 E0CB.tmp 104 PID 224 wrote to memory of 3772 224 E0CB.tmp 104 PID 3772 wrote to memory of 3992 3772 E196.tmp 105 PID 3772 wrote to memory of 3992 3772 E196.tmp 105 PID 3772 wrote to memory of 3992 3772 E196.tmp 105 PID 3992 wrote to memory of 4836 3992 E261.tmp 106 PID 3992 wrote to memory of 4836 3992 E261.tmp 106 PID 3992 wrote to memory of 4836 3992 E261.tmp 106 PID 4836 wrote to memory of 3080 4836 E30D.tmp 107 PID 4836 wrote to memory of 3080 4836 E30D.tmp 107 PID 4836 wrote to memory of 3080 4836 E30D.tmp 107 PID 3080 wrote to memory of 4728 3080 E3C8.tmp 108 PID 3080 wrote to memory of 4728 3080 E3C8.tmp 108 PID 3080 wrote to memory of 4728 3080 E3C8.tmp 108 PID 4728 wrote to memory of 2828 4728 E465.tmp 109 PID 4728 wrote to memory of 2828 4728 E465.tmp 109 PID 4728 wrote to memory of 2828 4728 E465.tmp 109 PID 2828 wrote to memory of 4056 2828 E54F.tmp 110 PID 2828 wrote to memory of 4056 2828 E54F.tmp 110 PID 2828 wrote to memory of 4056 2828 E54F.tmp 110 PID 4056 wrote to memory of 3988 4056 E60A.tmp 111 PID 4056 wrote to memory of 3988 4056 E60A.tmp 111 PID 4056 wrote to memory of 3988 4056 E60A.tmp 111 PID 3988 wrote to memory of 2244 3988 E6E5.tmp 113 PID 3988 wrote to memory of 2244 3988 E6E5.tmp 113 PID 3988 wrote to memory of 2244 3988 E6E5.tmp 113 PID 2244 wrote to memory of 2804 2244 E781.tmp 114 PID 2244 wrote to memory of 2804 2244 E781.tmp 114 PID 2244 wrote to memory of 2804 2244 E781.tmp 114 PID 2804 wrote to memory of 3776 2804 E8AA.tmp 115 PID 2804 wrote to memory of 3776 2804 E8AA.tmp 115 PID 2804 wrote to memory of 3776 2804 E8AA.tmp 115 PID 3776 wrote to memory of 2612 3776 E985.tmp 116 PID 3776 wrote to memory of 2612 3776 E985.tmp 116 PID 3776 wrote to memory of 2612 3776 E985.tmp 116 PID 2612 wrote to memory of 3324 2612 EA7F.tmp 118 PID 2612 wrote to memory of 3324 2612 EA7F.tmp 118 PID 2612 wrote to memory of 3324 2612 EA7F.tmp 118 PID 3324 wrote to memory of 4456 3324 EB3B.tmp 119 PID 3324 wrote to memory of 4456 3324 EB3B.tmp 119 PID 3324 wrote to memory of 4456 3324 EB3B.tmp 119 PID 4456 wrote to memory of 1060 4456 EBA8.tmp 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-28_48978b4e5bd83fdc14037107e068d752_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-28_48978b4e5bd83fdc14037107e068d752_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\DC75.tmp"C:\Users\Admin\AppData\Local\Temp\DC75.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\DD12.tmp"C:\Users\Admin\AppData\Local\Temp\DD12.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\DED7.tmp"C:\Users\Admin\AppData\Local\Temp\DED7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\DF54.tmp"C:\Users\Admin\AppData\Local\Temp\DF54.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\E0CB.tmp"C:\Users\Admin\AppData\Local\Temp\E0CB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\E196.tmp"C:\Users\Admin\AppData\Local\Temp\E196.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\E261.tmp"C:\Users\Admin\AppData\Local\Temp\E261.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\E30D.tmp"C:\Users\Admin\AppData\Local\Temp\E30D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\E465.tmp"C:\Users\Admin\AppData\Local\Temp\E465.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\E54F.tmp"C:\Users\Admin\AppData\Local\Temp\E54F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\E60A.tmp"C:\Users\Admin\AppData\Local\Temp\E60A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\E781.tmp"C:\Users\Admin\AppData\Local\Temp\E781.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\E8AA.tmp"C:\Users\Admin\AppData\Local\Temp\E8AA.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\E985.tmp"C:\Users\Admin\AppData\Local\Temp\E985.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\EB3B.tmp"C:\Users\Admin\AppData\Local\Temp\EB3B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\EC25.tmp"C:\Users\Admin\AppData\Local\Temp\EC25.tmp"23⤵
- Executes dropped EXE
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\ED00.tmp"C:\Users\Admin\AppData\Local\Temp\ED00.tmp"24⤵
- Executes dropped EXE
PID:644 -
C:\Users\Admin\AppData\Local\Temp\EDDA.tmp"C:\Users\Admin\AppData\Local\Temp\EDDA.tmp"25⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\EEA6.tmp"C:\Users\Admin\AppData\Local\Temp\EEA6.tmp"26⤵
- Executes dropped EXE
PID:884 -
C:\Users\Admin\AppData\Local\Temp\EF51.tmp"C:\Users\Admin\AppData\Local\Temp\EF51.tmp"27⤵
- Executes dropped EXE
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\F00D.tmp"C:\Users\Admin\AppData\Local\Temp\F00D.tmp"28⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\F08A.tmp"C:\Users\Admin\AppData\Local\Temp\F08A.tmp"29⤵
- Executes dropped EXE
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\F107.tmp"C:\Users\Admin\AppData\Local\Temp\F107.tmp"30⤵
- Executes dropped EXE
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\F174.tmp"C:\Users\Admin\AppData\Local\Temp\F174.tmp"31⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\F211.tmp"C:\Users\Admin\AppData\Local\Temp\F211.tmp"32⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\F2EB.tmp"C:\Users\Admin\AppData\Local\Temp\F2EB.tmp"33⤵
- Executes dropped EXE
PID:980 -
C:\Users\Admin\AppData\Local\Temp\F388.tmp"C:\Users\Admin\AppData\Local\Temp\F388.tmp"34⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\F414.tmp"C:\Users\Admin\AppData\Local\Temp\F414.tmp"35⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\F4B0.tmp"C:\Users\Admin\AppData\Local\Temp\F4B0.tmp"36⤵
- Executes dropped EXE
PID:684 -
C:\Users\Admin\AppData\Local\Temp\F52D.tmp"C:\Users\Admin\AppData\Local\Temp\F52D.tmp"37⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\F5AA.tmp"C:\Users\Admin\AppData\Local\Temp\F5AA.tmp"38⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\F627.tmp"C:\Users\Admin\AppData\Local\Temp\F627.tmp"39⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"40⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\F721.tmp"C:\Users\Admin\AppData\Local\Temp\F721.tmp"41⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\F78F.tmp"C:\Users\Admin\AppData\Local\Temp\F78F.tmp"42⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\F86A.tmp"C:\Users\Admin\AppData\Local\Temp\F86A.tmp"43⤵
- Executes dropped EXE
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\F8F6.tmp"C:\Users\Admin\AppData\Local\Temp\F8F6.tmp"44⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\F973.tmp"C:\Users\Admin\AppData\Local\Temp\F973.tmp"45⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"46⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"47⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"48⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\FB77.tmp"C:\Users\Admin\AppData\Local\Temp\FB77.tmp"49⤵
- Executes dropped EXE
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"50⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\FC71.tmp"C:\Users\Admin\AppData\Local\Temp\FC71.tmp"51⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"52⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"53⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"54⤵
- Executes dropped EXE
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\FE55.tmp"C:\Users\Admin\AppData\Local\Temp\FE55.tmp"55⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\FEC3.tmp"C:\Users\Admin\AppData\Local\Temp\FEC3.tmp"56⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\FF40.tmp"C:\Users\Admin\AppData\Local\Temp\FF40.tmp"57⤵
- Executes dropped EXE
PID:740 -
C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"58⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A.tmp"59⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\C6.tmp"C:\Users\Admin\AppData\Local\Temp\C6.tmp"60⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\153.tmp"C:\Users\Admin\AppData\Local\Temp\153.tmp"61⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\1DF.tmp"C:\Users\Admin\AppData\Local\Temp\1DF.tmp"62⤵
- Executes dropped EXE
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\25C.tmp"C:\Users\Admin\AppData\Local\Temp\25C.tmp"63⤵
- Executes dropped EXE
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\2F9.tmp"C:\Users\Admin\AppData\Local\Temp\2F9.tmp"64⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\376.tmp"C:\Users\Admin\AppData\Local\Temp\376.tmp"65⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\3D3.tmp"C:\Users\Admin\AppData\Local\Temp\3D3.tmp"66⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\441.tmp"C:\Users\Admin\AppData\Local\Temp\441.tmp"67⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\4CD.tmp"C:\Users\Admin\AppData\Local\Temp\4CD.tmp"68⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\54A.tmp"C:\Users\Admin\AppData\Local\Temp\54A.tmp"69⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\5B8.tmp"C:\Users\Admin\AppData\Local\Temp\5B8.tmp"70⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\625.tmp"C:\Users\Admin\AppData\Local\Temp\625.tmp"71⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\6A2.tmp"C:\Users\Admin\AppData\Local\Temp\6A2.tmp"72⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\710.tmp"C:\Users\Admin\AppData\Local\Temp\710.tmp"73⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\78D.tmp"C:\Users\Admin\AppData\Local\Temp\78D.tmp"74⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\819.tmp"C:\Users\Admin\AppData\Local\Temp\819.tmp"75⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\8B5.tmp"C:\Users\Admin\AppData\Local\Temp\8B5.tmp"76⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\932.tmp"C:\Users\Admin\AppData\Local\Temp\932.tmp"77⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\9CF.tmp"C:\Users\Admin\AppData\Local\Temp\9CF.tmp"78⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\A5B.tmp"C:\Users\Admin\AppData\Local\Temp\A5B.tmp"79⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\AC9.tmp"C:\Users\Admin\AppData\Local\Temp\AC9.tmp"80⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\B46.tmp"C:\Users\Admin\AppData\Local\Temp\B46.tmp"81⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\BB3.tmp"C:\Users\Admin\AppData\Local\Temp\BB3.tmp"82⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\C20.tmp"C:\Users\Admin\AppData\Local\Temp\C20.tmp"83⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\CBD.tmp"C:\Users\Admin\AppData\Local\Temp\CBD.tmp"84⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\D88.tmp"C:\Users\Admin\AppData\Local\Temp\D88.tmp"85⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\E14.tmp"C:\Users\Admin\AppData\Local\Temp\E14.tmp"86⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\EA1.tmp"C:\Users\Admin\AppData\Local\Temp\EA1.tmp"87⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"88⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"89⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\1018.tmp"C:\Users\Admin\AppData\Local\Temp\1018.tmp"90⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\1095.tmp"C:\Users\Admin\AppData\Local\Temp\1095.tmp"91⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\1122.tmp"C:\Users\Admin\AppData\Local\Temp\1122.tmp"92⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\11AE.tmp"C:\Users\Admin\AppData\Local\Temp\11AE.tmp"93⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\123B.tmp"C:\Users\Admin\AppData\Local\Temp\123B.tmp"94⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\12C8.tmp"C:\Users\Admin\AppData\Local\Temp\12C8.tmp"95⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\1354.tmp"C:\Users\Admin\AppData\Local\Temp\1354.tmp"96⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\13D1.tmp"C:\Users\Admin\AppData\Local\Temp\13D1.tmp"97⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\144E.tmp"C:\Users\Admin\AppData\Local\Temp\144E.tmp"98⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\14DB.tmp"C:\Users\Admin\AppData\Local\Temp\14DB.tmp"99⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\1567.tmp"C:\Users\Admin\AppData\Local\Temp\1567.tmp"100⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\15F4.tmp"C:\Users\Admin\AppData\Local\Temp\15F4.tmp"101⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\1671.tmp"C:\Users\Admin\AppData\Local\Temp\1671.tmp"102⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\16DE.tmp"C:\Users\Admin\AppData\Local\Temp\16DE.tmp"103⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\175B.tmp"C:\Users\Admin\AppData\Local\Temp\175B.tmp"104⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\1894.tmp"C:\Users\Admin\AppData\Local\Temp\1894.tmp"105⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\1930.tmp"C:\Users\Admin\AppData\Local\Temp\1930.tmp"106⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\19AD.tmp"C:\Users\Admin\AppData\Local\Temp\19AD.tmp"107⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"108⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\1A78.tmp"C:\Users\Admin\AppData\Local\Temp\1A78.tmp"109⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\1B05.tmp"C:\Users\Admin\AppData\Local\Temp\1B05.tmp"110⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\1B82.tmp"C:\Users\Admin\AppData\Local\Temp\1B82.tmp"111⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"112⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"113⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"114⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\1D86.tmp"C:\Users\Admin\AppData\Local\Temp\1D86.tmp"115⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\1E03.tmp"C:\Users\Admin\AppData\Local\Temp\1E03.tmp"116⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\1E80.tmp"C:\Users\Admin\AppData\Local\Temp\1E80.tmp"117⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"118⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\1F99.tmp"C:\Users\Admin\AppData\Local\Temp\1F99.tmp"119⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\2035.tmp"C:\Users\Admin\AppData\Local\Temp\2035.tmp"120⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\20B2.tmp"C:\Users\Admin\AppData\Local\Temp\20B2.tmp"121⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\213F.tmp"C:\Users\Admin\AppData\Local\Temp\213F.tmp"122⤵PID:2860
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-