Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
157s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12/03/2024, 13:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-12_843f398ed4300bae96c22067fafa0084_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-12_843f398ed4300bae96c22067fafa0084_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-12_843f398ed4300bae96c22067fafa0084_mafia.exe
-
Size
530KB
-
MD5
843f398ed4300bae96c22067fafa0084
-
SHA1
818a42d3bea1a90bd034136312052853de294456
-
SHA256
ad5161fc31e47fb4c5f78e58d1881e32381ca9005301138ce24444a42ca62d1d
-
SHA512
00d4900028415593627331c0917d7868acf3ae860daa4482afcaff5e0962bd1eb10cac4dcd70cd0a0353d90d81dac65237631e80705d133c391e535785d95e95
-
SSDEEP
12288:AU5rCOTeioAn3nu9F77tx267V0piNgPwAagyNZulFVg0M1:AUQOJo8Xu9tpx26lOPvfyNclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2156 F5D.tmp 4104 11AE.tmp 3400 1289.tmp 884 13C2.tmp 3176 145E.tmp 4616 1567.tmp 640 16DE.tmp 1328 17C9.tmp 5112 1865.tmp 5004 18F2.tmp 4944 199E.tmp 2644 1A69.tmp 1844 1BC0.tmp 1624 1C8C.tmp 2116 1D57.tmp 8 1E12.tmp 1740 1EAE.tmp 4272 1FB8.tmp 3280 2054.tmp 2056 212F.tmp 2324 21EB.tmp 3880 22F4.tmp 384 23EE.tmp 4216 24D9.tmp 4456 25F2.tmp 3264 269E.tmp 1952 273A.tmp 1432 2853.tmp 3376 292E.tmp 1328 29CA.tmp 4368 2A76.tmp 1968 2B51.tmp 4588 2BDD.tmp 3732 2C99.tmp 4668 2D06.tmp 1216 2D74.tmp 1844 2E00.tmp 2724 2E7D.tmp 4500 2EFA.tmp 4348 2FA6.tmp 8 3014.tmp 2788 30A0.tmp 3212 311D.tmp 768 31AA.tmp 112 3227.tmp 2008 32B3.tmp 2324 337F.tmp 1388 3563.tmp 384 35FF.tmp 568 368C.tmp 1532 36F9.tmp 4456 3812.tmp 4528 3880.tmp 4316 397A.tmp 3548 39E7.tmp 5064 3A64.tmp 4676 3B00.tmp 4896 3B6E.tmp 1720 3BDB.tmp 224 3CB6.tmp 4440 3D33.tmp 2528 3DB0.tmp 2496 3E2D.tmp 1064 3F08.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1272 wrote to memory of 2156 1272 2024-03-12_843f398ed4300bae96c22067fafa0084_mafia.exe 98 PID 1272 wrote to memory of 2156 1272 2024-03-12_843f398ed4300bae96c22067fafa0084_mafia.exe 98 PID 1272 wrote to memory of 2156 1272 2024-03-12_843f398ed4300bae96c22067fafa0084_mafia.exe 98 PID 2156 wrote to memory of 4104 2156 F5D.tmp 99 PID 2156 wrote to memory of 4104 2156 F5D.tmp 99 PID 2156 wrote to memory of 4104 2156 F5D.tmp 99 PID 4104 wrote to memory of 3400 4104 11AE.tmp 100 PID 4104 wrote to memory of 3400 4104 11AE.tmp 100 PID 4104 wrote to memory of 3400 4104 11AE.tmp 100 PID 3400 wrote to memory of 884 3400 1289.tmp 101 PID 3400 wrote to memory of 884 3400 1289.tmp 101 PID 3400 wrote to memory of 884 3400 1289.tmp 101 PID 884 wrote to memory of 3176 884 13C2.tmp 102 PID 884 wrote to memory of 3176 884 13C2.tmp 102 PID 884 wrote to memory of 3176 884 13C2.tmp 102 PID 3176 wrote to memory of 4616 3176 145E.tmp 103 PID 3176 wrote to memory of 4616 3176 145E.tmp 103 PID 3176 wrote to memory of 4616 3176 145E.tmp 103 PID 4616 wrote to memory of 640 4616 1567.tmp 104 PID 4616 wrote to memory of 640 4616 1567.tmp 104 PID 4616 wrote to memory of 640 4616 1567.tmp 104 PID 640 wrote to memory of 1328 640 16DE.tmp 105 PID 640 wrote to memory of 1328 640 16DE.tmp 105 PID 640 wrote to memory of 1328 640 16DE.tmp 105 PID 1328 wrote to memory of 5112 1328 17C9.tmp 106 PID 1328 wrote to memory of 5112 1328 17C9.tmp 106 PID 1328 wrote to memory of 5112 1328 17C9.tmp 106 PID 5112 wrote to memory of 5004 5112 1865.tmp 107 PID 5112 wrote to memory of 5004 5112 1865.tmp 107 PID 5112 wrote to memory of 5004 5112 1865.tmp 107 PID 5004 wrote to memory of 4944 5004 18F2.tmp 108 PID 5004 wrote to memory of 4944 5004 18F2.tmp 108 PID 5004 wrote to memory of 4944 5004 18F2.tmp 108 PID 4944 wrote to memory of 2644 4944 199E.tmp 109 PID 4944 wrote to memory of 2644 4944 199E.tmp 109 PID 4944 wrote to memory of 2644 4944 199E.tmp 109 PID 2644 wrote to memory of 1844 2644 1A69.tmp 110 PID 2644 wrote to memory of 1844 2644 1A69.tmp 110 PID 2644 wrote to memory of 1844 2644 1A69.tmp 110 PID 1844 wrote to memory of 1624 1844 1BC0.tmp 111 PID 1844 wrote to memory of 1624 1844 1BC0.tmp 111 PID 1844 wrote to memory of 1624 1844 1BC0.tmp 111 PID 1624 wrote to memory of 2116 1624 1C8C.tmp 112 PID 1624 wrote to memory of 2116 1624 1C8C.tmp 112 PID 1624 wrote to memory of 2116 1624 1C8C.tmp 112 PID 2116 wrote to memory of 8 2116 1D57.tmp 113 PID 2116 wrote to memory of 8 2116 1D57.tmp 113 PID 2116 wrote to memory of 8 2116 1D57.tmp 113 PID 8 wrote to memory of 1740 8 1E12.tmp 114 PID 8 wrote to memory of 1740 8 1E12.tmp 114 PID 8 wrote to memory of 1740 8 1E12.tmp 114 PID 1740 wrote to memory of 4272 1740 1EAE.tmp 115 PID 1740 wrote to memory of 4272 1740 1EAE.tmp 115 PID 1740 wrote to memory of 4272 1740 1EAE.tmp 115 PID 4272 wrote to memory of 3280 4272 1FB8.tmp 116 PID 4272 wrote to memory of 3280 4272 1FB8.tmp 116 PID 4272 wrote to memory of 3280 4272 1FB8.tmp 116 PID 3280 wrote to memory of 2056 3280 2054.tmp 117 PID 3280 wrote to memory of 2056 3280 2054.tmp 117 PID 3280 wrote to memory of 2056 3280 2054.tmp 117 PID 2056 wrote to memory of 2324 2056 212F.tmp 118 PID 2056 wrote to memory of 2324 2056 212F.tmp 118 PID 2056 wrote to memory of 2324 2056 212F.tmp 118 PID 2324 wrote to memory of 3880 2324 21EB.tmp 119
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-12_843f398ed4300bae96c22067fafa0084_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-12_843f398ed4300bae96c22067fafa0084_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\F5D.tmp"C:\Users\Admin\AppData\Local\Temp\F5D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\11AE.tmp"C:\Users\Admin\AppData\Local\Temp\11AE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\1289.tmp"C:\Users\Admin\AppData\Local\Temp\1289.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\13C2.tmp"C:\Users\Admin\AppData\Local\Temp\13C2.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\145E.tmp"C:\Users\Admin\AppData\Local\Temp\145E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\1567.tmp"C:\Users\Admin\AppData\Local\Temp\1567.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\16DE.tmp"C:\Users\Admin\AppData\Local\Temp\16DE.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\17C9.tmp"C:\Users\Admin\AppData\Local\Temp\17C9.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\1865.tmp"C:\Users\Admin\AppData\Local\Temp\1865.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\18F2.tmp"C:\Users\Admin\AppData\Local\Temp\18F2.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\199E.tmp"C:\Users\Admin\AppData\Local\Temp\199E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\1A69.tmp"C:\Users\Admin\AppData\Local\Temp\1A69.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\1BC0.tmp"C:\Users\Admin\AppData\Local\Temp\1BC0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\1C8C.tmp"C:\Users\Admin\AppData\Local\Temp\1C8C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\1D57.tmp"C:\Users\Admin\AppData\Local\Temp\1D57.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\1E12.tmp"C:\Users\Admin\AppData\Local\Temp\1E12.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\1FB8.tmp"C:\Users\Admin\AppData\Local\Temp\1FB8.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\2054.tmp"C:\Users\Admin\AppData\Local\Temp\2054.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\212F.tmp"C:\Users\Admin\AppData\Local\Temp\212F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\21EB.tmp"C:\Users\Admin\AppData\Local\Temp\21EB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\22F4.tmp"C:\Users\Admin\AppData\Local\Temp\22F4.tmp"23⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\23EE.tmp"C:\Users\Admin\AppData\Local\Temp\23EE.tmp"24⤵
- Executes dropped EXE
PID:384 -
C:\Users\Admin\AppData\Local\Temp\24D9.tmp"C:\Users\Admin\AppData\Local\Temp\24D9.tmp"25⤵
- Executes dropped EXE
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\25F2.tmp"C:\Users\Admin\AppData\Local\Temp\25F2.tmp"26⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\269E.tmp"C:\Users\Admin\AppData\Local\Temp\269E.tmp"27⤵
- Executes dropped EXE
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\273A.tmp"C:\Users\Admin\AppData\Local\Temp\273A.tmp"28⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\2853.tmp"C:\Users\Admin\AppData\Local\Temp\2853.tmp"29⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\292E.tmp"C:\Users\Admin\AppData\Local\Temp\292E.tmp"30⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\29CA.tmp"C:\Users\Admin\AppData\Local\Temp\29CA.tmp"31⤵
- Executes dropped EXE
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\2A76.tmp"C:\Users\Admin\AppData\Local\Temp\2A76.tmp"32⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\2B51.tmp"C:\Users\Admin\AppData\Local\Temp\2B51.tmp"33⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"34⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\2C99.tmp"C:\Users\Admin\AppData\Local\Temp\2C99.tmp"35⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\2D06.tmp"C:\Users\Admin\AppData\Local\Temp\2D06.tmp"36⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\2D74.tmp"C:\Users\Admin\AppData\Local\Temp\2D74.tmp"37⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\2E00.tmp"C:\Users\Admin\AppData\Local\Temp\2E00.tmp"38⤵
- Executes dropped EXE
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\2E7D.tmp"C:\Users\Admin\AppData\Local\Temp\2E7D.tmp"39⤵
- Executes dropped EXE
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\2EFA.tmp"C:\Users\Admin\AppData\Local\Temp\2EFA.tmp"40⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"41⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\3014.tmp"C:\Users\Admin\AppData\Local\Temp\3014.tmp"42⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\30A0.tmp"C:\Users\Admin\AppData\Local\Temp\30A0.tmp"43⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\311D.tmp"C:\Users\Admin\AppData\Local\Temp\311D.tmp"44⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\31AA.tmp"C:\Users\Admin\AppData\Local\Temp\31AA.tmp"45⤵
- Executes dropped EXE
PID:768 -
C:\Users\Admin\AppData\Local\Temp\3227.tmp"C:\Users\Admin\AppData\Local\Temp\3227.tmp"46⤵
- Executes dropped EXE
PID:112 -
C:\Users\Admin\AppData\Local\Temp\32B3.tmp"C:\Users\Admin\AppData\Local\Temp\32B3.tmp"47⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"48⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\3563.tmp"C:\Users\Admin\AppData\Local\Temp\3563.tmp"49⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\35FF.tmp"C:\Users\Admin\AppData\Local\Temp\35FF.tmp"50⤵
- Executes dropped EXE
PID:384 -
C:\Users\Admin\AppData\Local\Temp\368C.tmp"C:\Users\Admin\AppData\Local\Temp\368C.tmp"51⤵
- Executes dropped EXE
PID:568 -
C:\Users\Admin\AppData\Local\Temp\36F9.tmp"C:\Users\Admin\AppData\Local\Temp\36F9.tmp"52⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\3812.tmp"C:\Users\Admin\AppData\Local\Temp\3812.tmp"53⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\3880.tmp"C:\Users\Admin\AppData\Local\Temp\3880.tmp"54⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\397A.tmp"C:\Users\Admin\AppData\Local\Temp\397A.tmp"55⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\39E7.tmp"C:\Users\Admin\AppData\Local\Temp\39E7.tmp"56⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\3A64.tmp"C:\Users\Admin\AppData\Local\Temp\3A64.tmp"57⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\3B00.tmp"C:\Users\Admin\AppData\Local\Temp\3B00.tmp"58⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\3B6E.tmp"C:\Users\Admin\AppData\Local\Temp\3B6E.tmp"59⤵
- Executes dropped EXE
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\3BDB.tmp"C:\Users\Admin\AppData\Local\Temp\3BDB.tmp"60⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\3CB6.tmp"C:\Users\Admin\AppData\Local\Temp\3CB6.tmp"61⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\3D33.tmp"C:\Users\Admin\AppData\Local\Temp\3D33.tmp"62⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\3DB0.tmp"C:\Users\Admin\AppData\Local\Temp\3DB0.tmp"63⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\3E2D.tmp"C:\Users\Admin\AppData\Local\Temp\3E2D.tmp"64⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\3F08.tmp"C:\Users\Admin\AppData\Local\Temp\3F08.tmp"65⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\3F94.tmp"C:\Users\Admin\AppData\Local\Temp\3F94.tmp"66⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\4011.tmp"C:\Users\Admin\AppData\Local\Temp\4011.tmp"67⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\407F.tmp"C:\Users\Admin\AppData\Local\Temp\407F.tmp"68⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\412B.tmp"C:\Users\Admin\AppData\Local\Temp\412B.tmp"69⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\41D6.tmp"C:\Users\Admin\AppData\Local\Temp\41D6.tmp"70⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\4244.tmp"C:\Users\Admin\AppData\Local\Temp\4244.tmp"71⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\42FF.tmp"C:\Users\Admin\AppData\Local\Temp\42FF.tmp"72⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\436D.tmp"C:\Users\Admin\AppData\Local\Temp\436D.tmp"73⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\43EA.tmp"C:\Users\Admin\AppData\Local\Temp\43EA.tmp"74⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\4467.tmp"C:\Users\Admin\AppData\Local\Temp\4467.tmp"75⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\459F.tmp"C:\Users\Admin\AppData\Local\Temp\459F.tmp"76⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\462C.tmp"C:\Users\Admin\AppData\Local\Temp\462C.tmp"77⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\46C8.tmp"C:\Users\Admin\AppData\Local\Temp\46C8.tmp"78⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\4735.tmp"C:\Users\Admin\AppData\Local\Temp\4735.tmp"79⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\482F.tmp"C:\Users\Admin\AppData\Local\Temp\482F.tmp"80⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\489D.tmp"C:\Users\Admin\AppData\Local\Temp\489D.tmp"81⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\490A.tmp"C:\Users\Admin\AppData\Local\Temp\490A.tmp"82⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\4997.tmp"C:\Users\Admin\AppData\Local\Temp\4997.tmp"83⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\4AEF.tmp"C:\Users\Admin\AppData\Local\Temp\4AEF.tmp"84⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\4BC9.tmp"C:\Users\Admin\AppData\Local\Temp\4BC9.tmp"85⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\4C46.tmp"C:\Users\Admin\AppData\Local\Temp\4C46.tmp"86⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\4CC3.tmp"C:\Users\Admin\AppData\Local\Temp\4CC3.tmp"87⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\4DFC.tmp"C:\Users\Admin\AppData\Local\Temp\4DFC.tmp"88⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\4E69.tmp"C:\Users\Admin\AppData\Local\Temp\4E69.tmp"89⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\4ED7.tmp"C:\Users\Admin\AppData\Local\Temp\4ED7.tmp"90⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\506D.tmp"C:\Users\Admin\AppData\Local\Temp\506D.tmp"91⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\50F9.tmp"C:\Users\Admin\AppData\Local\Temp\50F9.tmp"92⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\5186.tmp"C:\Users\Admin\AppData\Local\Temp\5186.tmp"93⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\5203.tmp"C:\Users\Admin\AppData\Local\Temp\5203.tmp"94⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\52AF.tmp"C:\Users\Admin\AppData\Local\Temp\52AF.tmp"95⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\534B.tmp"C:\Users\Admin\AppData\Local\Temp\534B.tmp"96⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\53C8.tmp"C:\Users\Admin\AppData\Local\Temp\53C8.tmp"97⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\5445.tmp"C:\Users\Admin\AppData\Local\Temp\5445.tmp"98⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\5501.tmp"C:\Users\Admin\AppData\Local\Temp\5501.tmp"99⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\557E.tmp"C:\Users\Admin\AppData\Local\Temp\557E.tmp"100⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\55EB.tmp"C:\Users\Admin\AppData\Local\Temp\55EB.tmp"101⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\5791.tmp"C:\Users\Admin\AppData\Local\Temp\5791.tmp"102⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\57FE.tmp"C:\Users\Admin\AppData\Local\Temp\57FE.tmp"103⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\587B.tmp"C:\Users\Admin\AppData\Local\Temp\587B.tmp"104⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\5937.tmp"C:\Users\Admin\AppData\Local\Temp\5937.tmp"105⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\59B4.tmp"C:\Users\Admin\AppData\Local\Temp\59B4.tmp"106⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\5A40.tmp"C:\Users\Admin\AppData\Local\Temp\5A40.tmp"107⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\5ACD.tmp"C:\Users\Admin\AppData\Local\Temp\5ACD.tmp"108⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\5B79.tmp"C:\Users\Admin\AppData\Local\Temp\5B79.tmp"109⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\5C06.tmp"C:\Users\Admin\AppData\Local\Temp\5C06.tmp"110⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\5C73.tmp"C:\Users\Admin\AppData\Local\Temp\5C73.tmp"111⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\5CE0.tmp"C:\Users\Admin\AppData\Local\Temp\5CE0.tmp"112⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\5D9C.tmp"C:\Users\Admin\AppData\Local\Temp\5D9C.tmp"113⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\5E28.tmp"C:\Users\Admin\AppData\Local\Temp\5E28.tmp"114⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\5E96.tmp"C:\Users\Admin\AppData\Local\Temp\5E96.tmp"115⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\5F22.tmp"C:\Users\Admin\AppData\Local\Temp\5F22.tmp"116⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\5FBF.tmp"C:\Users\Admin\AppData\Local\Temp\5FBF.tmp"117⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\602C.tmp"C:\Users\Admin\AppData\Local\Temp\602C.tmp"118⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\60B9.tmp"C:\Users\Admin\AppData\Local\Temp\60B9.tmp"119⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\6136.tmp"C:\Users\Admin\AppData\Local\Temp\6136.tmp"120⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\61C2.tmp"C:\Users\Admin\AppData\Local\Temp\61C2.tmp"121⤵PID:524
-
C:\Users\Admin\AppData\Local\Temp\624F.tmp"C:\Users\Admin\AppData\Local\Temp\624F.tmp"122⤵PID:4392
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-