Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14/03/2024, 06:10
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-14_f31a762c1c143aaae409be4793345eef_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-03-14_f31a762c1c143aaae409be4793345eef_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-14_f31a762c1c143aaae409be4793345eef_mafia.exe
-
Size
486KB
-
MD5
f31a762c1c143aaae409be4793345eef
-
SHA1
2b06c352ee5726173aae9a1d5245fdbb8328b2c4
-
SHA256
103d3a3579a5493a66f0816b56ee67642842dce473765ad8bad83888f4ab274e
-
SHA512
bd4cf9ba01be176dd7d3c90dbee12ba23f3b5c058cb341f4f22a196a26d96a98143ca62278781c98391e4a7cde6bf1f4505b1f1c998d41968113a90f1240ab9c
-
SSDEEP
12288:/U5rCOTeiDn/geGPMEQS++h9PhcOY7YuNZ:/UQOJD/geGPsS+q9PNY71N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4416 2C11.tmp 5052 2C6F.tmp 852 2CEC.tmp 5100 2D4A.tmp 2140 2DA7.tmp 3664 2E15.tmp 1664 2F0F.tmp 404 2F8C.tmp 1168 2FE9.tmp 3940 3047.tmp 3372 3095.tmp 3332 30E3.tmp 4560 3160.tmp 4524 31AF.tmp 860 321C.tmp 3264 3289.tmp 3912 32F7.tmp 3380 3364.tmp 3568 33E1.tmp 2272 345E.tmp 1712 34CB.tmp 2860 3529.tmp 3668 3577.tmp 4428 35F4.tmp 1624 3662.tmp 5080 36DF.tmp 2476 372D.tmp 2268 379A.tmp 1504 37E8.tmp 516 3856.tmp 4368 38B3.tmp 3988 3921.tmp 2600 397F.tmp 4844 39CD.tmp 1028 3A2A.tmp 4916 3A88.tmp 3452 3AE6.tmp 4808 3B34.tmp 2140 3B82.tmp 1004 3BE0.tmp 3664 3C2E.tmp 2252 3C8C.tmp 1448 3CDA.tmp 4052 3D38.tmp 5096 3D86.tmp 2400 3DE4.tmp 4960 3E32.tmp 1548 3E8F.tmp 3620 3EDE.tmp 2764 3F2C.tmp 1544 3F7A.tmp 448 3FD8.tmp 4992 4035.tmp 2000 4083.tmp 3472 40D2.tmp 3652 412F.tmp 4920 418D.tmp 2256 41EB.tmp 3576 4239.tmp 468 4287.tmp 1180 42D5.tmp 2472 4323.tmp 1712 4371.tmp 3392 43C0.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3308 wrote to memory of 4416 3308 2024-03-14_f31a762c1c143aaae409be4793345eef_mafia.exe 89 PID 3308 wrote to memory of 4416 3308 2024-03-14_f31a762c1c143aaae409be4793345eef_mafia.exe 89 PID 3308 wrote to memory of 4416 3308 2024-03-14_f31a762c1c143aaae409be4793345eef_mafia.exe 89 PID 4416 wrote to memory of 5052 4416 2C11.tmp 90 PID 4416 wrote to memory of 5052 4416 2C11.tmp 90 PID 4416 wrote to memory of 5052 4416 2C11.tmp 90 PID 5052 wrote to memory of 852 5052 2C6F.tmp 91 PID 5052 wrote to memory of 852 5052 2C6F.tmp 91 PID 5052 wrote to memory of 852 5052 2C6F.tmp 91 PID 852 wrote to memory of 5100 852 2CEC.tmp 92 PID 852 wrote to memory of 5100 852 2CEC.tmp 92 PID 852 wrote to memory of 5100 852 2CEC.tmp 92 PID 5100 wrote to memory of 2140 5100 2D4A.tmp 93 PID 5100 wrote to memory of 2140 5100 2D4A.tmp 93 PID 5100 wrote to memory of 2140 5100 2D4A.tmp 93 PID 2140 wrote to memory of 3664 2140 2DA7.tmp 95 PID 2140 wrote to memory of 3664 2140 2DA7.tmp 95 PID 2140 wrote to memory of 3664 2140 2DA7.tmp 95 PID 3664 wrote to memory of 1664 3664 2E15.tmp 97 PID 3664 wrote to memory of 1664 3664 2E15.tmp 97 PID 3664 wrote to memory of 1664 3664 2E15.tmp 97 PID 1664 wrote to memory of 404 1664 2F0F.tmp 99 PID 1664 wrote to memory of 404 1664 2F0F.tmp 99 PID 1664 wrote to memory of 404 1664 2F0F.tmp 99 PID 404 wrote to memory of 1168 404 2F8C.tmp 100 PID 404 wrote to memory of 1168 404 2F8C.tmp 100 PID 404 wrote to memory of 1168 404 2F8C.tmp 100 PID 1168 wrote to memory of 3940 1168 2FE9.tmp 101 PID 1168 wrote to memory of 3940 1168 2FE9.tmp 101 PID 1168 wrote to memory of 3940 1168 2FE9.tmp 101 PID 3940 wrote to memory of 3372 3940 3047.tmp 102 PID 3940 wrote to memory of 3372 3940 3047.tmp 102 PID 3940 wrote to memory of 3372 3940 3047.tmp 102 PID 3372 wrote to memory of 3332 3372 3095.tmp 103 PID 3372 wrote to memory of 3332 3372 3095.tmp 103 PID 3372 wrote to memory of 3332 3372 3095.tmp 103 PID 3332 wrote to memory of 4560 3332 30E3.tmp 104 PID 3332 wrote to memory of 4560 3332 30E3.tmp 104 PID 3332 wrote to memory of 4560 3332 30E3.tmp 104 PID 4560 wrote to memory of 4524 4560 3160.tmp 105 PID 4560 wrote to memory of 4524 4560 3160.tmp 105 PID 4560 wrote to memory of 4524 4560 3160.tmp 105 PID 4524 wrote to memory of 860 4524 31AF.tmp 106 PID 4524 wrote to memory of 860 4524 31AF.tmp 106 PID 4524 wrote to memory of 860 4524 31AF.tmp 106 PID 860 wrote to memory of 3264 860 321C.tmp 107 PID 860 wrote to memory of 3264 860 321C.tmp 107 PID 860 wrote to memory of 3264 860 321C.tmp 107 PID 3264 wrote to memory of 3912 3264 3289.tmp 108 PID 3264 wrote to memory of 3912 3264 3289.tmp 108 PID 3264 wrote to memory of 3912 3264 3289.tmp 108 PID 3912 wrote to memory of 3380 3912 32F7.tmp 109 PID 3912 wrote to memory of 3380 3912 32F7.tmp 109 PID 3912 wrote to memory of 3380 3912 32F7.tmp 109 PID 3380 wrote to memory of 3568 3380 3364.tmp 110 PID 3380 wrote to memory of 3568 3380 3364.tmp 110 PID 3380 wrote to memory of 3568 3380 3364.tmp 110 PID 3568 wrote to memory of 2272 3568 33E1.tmp 111 PID 3568 wrote to memory of 2272 3568 33E1.tmp 111 PID 3568 wrote to memory of 2272 3568 33E1.tmp 111 PID 2272 wrote to memory of 1712 2272 345E.tmp 112 PID 2272 wrote to memory of 1712 2272 345E.tmp 112 PID 2272 wrote to memory of 1712 2272 345E.tmp 112 PID 1712 wrote to memory of 2860 1712 34CB.tmp 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-14_f31a762c1c143aaae409be4793345eef_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-14_f31a762c1c143aaae409be4793345eef_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\2C11.tmp"C:\Users\Admin\AppData\Local\Temp\2C11.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\2C6F.tmp"C:\Users\Admin\AppData\Local\Temp\2C6F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\2CEC.tmp"C:\Users\Admin\AppData\Local\Temp\2CEC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\2D4A.tmp"C:\Users\Admin\AppData\Local\Temp\2D4A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\2DA7.tmp"C:\Users\Admin\AppData\Local\Temp\2DA7.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\2E15.tmp"C:\Users\Admin\AppData\Local\Temp\2E15.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\2F0F.tmp"C:\Users\Admin\AppData\Local\Temp\2F0F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\2F8C.tmp"C:\Users\Admin\AppData\Local\Temp\2F8C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\2FE9.tmp"C:\Users\Admin\AppData\Local\Temp\2FE9.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\3047.tmp"C:\Users\Admin\AppData\Local\Temp\3047.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\3095.tmp"C:\Users\Admin\AppData\Local\Temp\3095.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\30E3.tmp"C:\Users\Admin\AppData\Local\Temp\30E3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\3160.tmp"C:\Users\Admin\AppData\Local\Temp\3160.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\31AF.tmp"C:\Users\Admin\AppData\Local\Temp\31AF.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\321C.tmp"C:\Users\Admin\AppData\Local\Temp\321C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\3289.tmp"C:\Users\Admin\AppData\Local\Temp\3289.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\32F7.tmp"C:\Users\Admin\AppData\Local\Temp\32F7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\3364.tmp"C:\Users\Admin\AppData\Local\Temp\3364.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\33E1.tmp"C:\Users\Admin\AppData\Local\Temp\33E1.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\345E.tmp"C:\Users\Admin\AppData\Local\Temp\345E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\34CB.tmp"C:\Users\Admin\AppData\Local\Temp\34CB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\3529.tmp"C:\Users\Admin\AppData\Local\Temp\3529.tmp"23⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\3577.tmp"C:\Users\Admin\AppData\Local\Temp\3577.tmp"24⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\35F4.tmp"C:\Users\Admin\AppData\Local\Temp\35F4.tmp"25⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\3662.tmp"C:\Users\Admin\AppData\Local\Temp\3662.tmp"26⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\36DF.tmp"C:\Users\Admin\AppData\Local\Temp\36DF.tmp"27⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\372D.tmp"C:\Users\Admin\AppData\Local\Temp\372D.tmp"28⤵
- Executes dropped EXE
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\379A.tmp"C:\Users\Admin\AppData\Local\Temp\379A.tmp"29⤵
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\37E8.tmp"C:\Users\Admin\AppData\Local\Temp\37E8.tmp"30⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\3856.tmp"C:\Users\Admin\AppData\Local\Temp\3856.tmp"31⤵
- Executes dropped EXE
PID:516 -
C:\Users\Admin\AppData\Local\Temp\38B3.tmp"C:\Users\Admin\AppData\Local\Temp\38B3.tmp"32⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\3921.tmp"C:\Users\Admin\AppData\Local\Temp\3921.tmp"33⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\397F.tmp"C:\Users\Admin\AppData\Local\Temp\397F.tmp"34⤵
- Executes dropped EXE
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\39CD.tmp"C:\Users\Admin\AppData\Local\Temp\39CD.tmp"35⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"36⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\3A88.tmp"C:\Users\Admin\AppData\Local\Temp\3A88.tmp"37⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"38⤵
- Executes dropped EXE
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\3B34.tmp"C:\Users\Admin\AppData\Local\Temp\3B34.tmp"39⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\3B82.tmp"C:\Users\Admin\AppData\Local\Temp\3B82.tmp"40⤵
- Executes dropped EXE
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"41⤵
- Executes dropped EXE
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"42⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"43⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"44⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\3D38.tmp"C:\Users\Admin\AppData\Local\Temp\3D38.tmp"45⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\3D86.tmp"C:\Users\Admin\AppData\Local\Temp\3D86.tmp"46⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"47⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\3E32.tmp"C:\Users\Admin\AppData\Local\Temp\3E32.tmp"48⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"49⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"50⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"51⤵
- Executes dropped EXE
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"52⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"53⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\4035.tmp"C:\Users\Admin\AppData\Local\Temp\4035.tmp"54⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\4083.tmp"C:\Users\Admin\AppData\Local\Temp\4083.tmp"55⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\40D2.tmp"C:\Users\Admin\AppData\Local\Temp\40D2.tmp"56⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\412F.tmp"C:\Users\Admin\AppData\Local\Temp\412F.tmp"57⤵
- Executes dropped EXE
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\418D.tmp"C:\Users\Admin\AppData\Local\Temp\418D.tmp"58⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\41EB.tmp"C:\Users\Admin\AppData\Local\Temp\41EB.tmp"59⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"60⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\4287.tmp"C:\Users\Admin\AppData\Local\Temp\4287.tmp"61⤵
- Executes dropped EXE
PID:468 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"62⤵
- Executes dropped EXE
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"63⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\4371.tmp"C:\Users\Admin\AppData\Local\Temp\4371.tmp"64⤵
- Executes dropped EXE
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\43C0.tmp"C:\Users\Admin\AppData\Local\Temp\43C0.tmp"65⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"66⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"67⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"68⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"69⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"70⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"71⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\45F2.tmp"C:\Users\Admin\AppData\Local\Temp\45F2.tmp"72⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"73⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"74⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\46EC.tmp"C:\Users\Admin\AppData\Local\Temp\46EC.tmp"75⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"76⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"77⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"78⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"79⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"80⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"81⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"82⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"83⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"84⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\4A19.tmp"C:\Users\Admin\AppData\Local\Temp\4A19.tmp"85⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"86⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"87⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"88⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"89⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"90⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"91⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"92⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"93⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"94⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"95⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"96⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"97⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"98⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"99⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"100⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"101⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"102⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"103⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"104⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"105⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"106⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"107⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"108⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"109⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"110⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"111⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"112⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"113⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"114⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"115⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"116⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"117⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"118⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"119⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"120⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"121⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"122⤵PID:2120
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-