Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
159s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15/03/2024, 19:54
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-15_7057384ea1726c24215b4ed16677f69e_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-15_7057384ea1726c24215b4ed16677f69e_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-15_7057384ea1726c24215b4ed16677f69e_mafia.exe
-
Size
487KB
-
MD5
7057384ea1726c24215b4ed16677f69e
-
SHA1
626d98946766661f3b1f802b29c26623102385f8
-
SHA256
50199b5b44f765b673ab2893232c1391e0c64edbdb20979771bf29d6dbe35b54
-
SHA512
54082e5194b411b6195e0f42897155f9fc822b8162d911b3df6144dcbe4715daf8e8e3eae37578e265abd97faf05a2719b50a04d6b2ec9d840bcefc54832f129
-
SSDEEP
12288:yU5rCOTeiNbd4w7EWvlVpuRRxbolZ+k+0xbZ:yUQOJNbd4w7RtuRDbousb
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2980 3B4.tmp 3904 55A.tmp 4564 6B2.tmp 4320 932.tmp 1692 A2C.tmp 1624 BB3.tmp 2456 C9D.tmp 1120 D78.tmp 1648 EC0.tmp 5060 FCA.tmp 4296 1076.tmp 4136 124B.tmp 3756 12D7.tmp 3624 13A2.tmp 2248 141F.tmp 3864 15A6.tmp 2300 1661.tmp 3628 16EE.tmp 1772 179A.tmp 4952 1875.tmp 4512 1930.tmp 3780 19CC.tmp 3924 1A88.tmp 2432 1B34.tmp 1840 1BFF.tmp 3948 1CE9.tmp 4524 1E41.tmp 4212 1FD7.tmp 2456 20B2.tmp 4452 21BC.tmp 1032 2268.tmp 1480 23A0.tmp 1332 2507.tmp 3680 2611.tmp 1536 270B.tmp 2172 2798.tmp 4128 28EF.tmp 1216 29DA.tmp 2688 2A95.tmp 4532 2B22.tmp 1476 2B9F.tmp 4496 2C1C.tmp 3604 2C89.tmp 1380 2CF7.tmp 948 2D74.tmp 3732 2E8D.tmp 1656 2F48.tmp 4688 2FF4.tmp 1372 3091.tmp 2784 318B.tmp 2432 31F8.tmp 5072 3340.tmp 4060 33BD.tmp 1400 34C7.tmp 1692 3573.tmp 3964 35E0.tmp 1828 366D.tmp 2876 3767.tmp 3952 37E4.tmp 2084 3851.tmp 1820 38BE.tmp 4860 392C.tmp 1480 3AC2.tmp 1332 3B3F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3828 wrote to memory of 2980 3828 2024-03-15_7057384ea1726c24215b4ed16677f69e_mafia.exe 100 PID 3828 wrote to memory of 2980 3828 2024-03-15_7057384ea1726c24215b4ed16677f69e_mafia.exe 100 PID 3828 wrote to memory of 2980 3828 2024-03-15_7057384ea1726c24215b4ed16677f69e_mafia.exe 100 PID 2980 wrote to memory of 3904 2980 3B4.tmp 101 PID 2980 wrote to memory of 3904 2980 3B4.tmp 101 PID 2980 wrote to memory of 3904 2980 3B4.tmp 101 PID 3904 wrote to memory of 4564 3904 55A.tmp 102 PID 3904 wrote to memory of 4564 3904 55A.tmp 102 PID 3904 wrote to memory of 4564 3904 55A.tmp 102 PID 4564 wrote to memory of 4320 4564 6B2.tmp 103 PID 4564 wrote to memory of 4320 4564 6B2.tmp 103 PID 4564 wrote to memory of 4320 4564 6B2.tmp 103 PID 4320 wrote to memory of 1692 4320 932.tmp 104 PID 4320 wrote to memory of 1692 4320 932.tmp 104 PID 4320 wrote to memory of 1692 4320 932.tmp 104 PID 1692 wrote to memory of 1624 1692 A2C.tmp 105 PID 1692 wrote to memory of 1624 1692 A2C.tmp 105 PID 1692 wrote to memory of 1624 1692 A2C.tmp 105 PID 1624 wrote to memory of 2456 1624 BB3.tmp 106 PID 1624 wrote to memory of 2456 1624 BB3.tmp 106 PID 1624 wrote to memory of 2456 1624 BB3.tmp 106 PID 2456 wrote to memory of 1120 2456 C9D.tmp 107 PID 2456 wrote to memory of 1120 2456 C9D.tmp 107 PID 2456 wrote to memory of 1120 2456 C9D.tmp 107 PID 1120 wrote to memory of 1648 1120 D78.tmp 108 PID 1120 wrote to memory of 1648 1120 D78.tmp 108 PID 1120 wrote to memory of 1648 1120 D78.tmp 108 PID 1648 wrote to memory of 5060 1648 EC0.tmp 109 PID 1648 wrote to memory of 5060 1648 EC0.tmp 109 PID 1648 wrote to memory of 5060 1648 EC0.tmp 109 PID 5060 wrote to memory of 4296 5060 FCA.tmp 110 PID 5060 wrote to memory of 4296 5060 FCA.tmp 110 PID 5060 wrote to memory of 4296 5060 FCA.tmp 110 PID 4296 wrote to memory of 4136 4296 1076.tmp 111 PID 4296 wrote to memory of 4136 4296 1076.tmp 111 PID 4296 wrote to memory of 4136 4296 1076.tmp 111 PID 4136 wrote to memory of 3756 4136 124B.tmp 112 PID 4136 wrote to memory of 3756 4136 124B.tmp 112 PID 4136 wrote to memory of 3756 4136 124B.tmp 112 PID 3756 wrote to memory of 3624 3756 12D7.tmp 113 PID 3756 wrote to memory of 3624 3756 12D7.tmp 113 PID 3756 wrote to memory of 3624 3756 12D7.tmp 113 PID 3624 wrote to memory of 2248 3624 13A2.tmp 114 PID 3624 wrote to memory of 2248 3624 13A2.tmp 114 PID 3624 wrote to memory of 2248 3624 13A2.tmp 114 PID 2248 wrote to memory of 3864 2248 141F.tmp 115 PID 2248 wrote to memory of 3864 2248 141F.tmp 115 PID 2248 wrote to memory of 3864 2248 141F.tmp 115 PID 3864 wrote to memory of 2300 3864 15A6.tmp 116 PID 3864 wrote to memory of 2300 3864 15A6.tmp 116 PID 3864 wrote to memory of 2300 3864 15A6.tmp 116 PID 2300 wrote to memory of 3628 2300 1661.tmp 117 PID 2300 wrote to memory of 3628 2300 1661.tmp 117 PID 2300 wrote to memory of 3628 2300 1661.tmp 117 PID 3628 wrote to memory of 1772 3628 16EE.tmp 118 PID 3628 wrote to memory of 1772 3628 16EE.tmp 118 PID 3628 wrote to memory of 1772 3628 16EE.tmp 118 PID 1772 wrote to memory of 4952 1772 179A.tmp 119 PID 1772 wrote to memory of 4952 1772 179A.tmp 119 PID 1772 wrote to memory of 4952 1772 179A.tmp 119 PID 4952 wrote to memory of 4512 4952 1875.tmp 120 PID 4952 wrote to memory of 4512 4952 1875.tmp 120 PID 4952 wrote to memory of 4512 4952 1875.tmp 120 PID 4512 wrote to memory of 3780 4512 1930.tmp 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-15_7057384ea1726c24215b4ed16677f69e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-15_7057384ea1726c24215b4ed16677f69e_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\3B4.tmp"C:\Users\Admin\AppData\Local\Temp\3B4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\55A.tmp"C:\Users\Admin\AppData\Local\Temp\55A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\6B2.tmp"C:\Users\Admin\AppData\Local\Temp\6B2.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\932.tmp"C:\Users\Admin\AppData\Local\Temp\932.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\A2C.tmp"C:\Users\Admin\AppData\Local\Temp\A2C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\BB3.tmp"C:\Users\Admin\AppData\Local\Temp\BB3.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\C9D.tmp"C:\Users\Admin\AppData\Local\Temp\C9D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\D78.tmp"C:\Users\Admin\AppData\Local\Temp\D78.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\EC0.tmp"C:\Users\Admin\AppData\Local\Temp\EC0.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\FCA.tmp"C:\Users\Admin\AppData\Local\Temp\FCA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\1076.tmp"C:\Users\Admin\AppData\Local\Temp\1076.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\124B.tmp"C:\Users\Admin\AppData\Local\Temp\124B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\12D7.tmp"C:\Users\Admin\AppData\Local\Temp\12D7.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\13A2.tmp"C:\Users\Admin\AppData\Local\Temp\13A2.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\141F.tmp"C:\Users\Admin\AppData\Local\Temp\141F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\15A6.tmp"C:\Users\Admin\AppData\Local\Temp\15A6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\1661.tmp"C:\Users\Admin\AppData\Local\Temp\1661.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\16EE.tmp"C:\Users\Admin\AppData\Local\Temp\16EE.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\179A.tmp"C:\Users\Admin\AppData\Local\Temp\179A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\1875.tmp"C:\Users\Admin\AppData\Local\Temp\1875.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\1930.tmp"C:\Users\Admin\AppData\Local\Temp\1930.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\19CC.tmp"C:\Users\Admin\AppData\Local\Temp\19CC.tmp"23⤵
- Executes dropped EXE
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\1A88.tmp"C:\Users\Admin\AppData\Local\Temp\1A88.tmp"24⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\1B34.tmp"C:\Users\Admin\AppData\Local\Temp\1B34.tmp"25⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\1BFF.tmp"C:\Users\Admin\AppData\Local\Temp\1BFF.tmp"26⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\1CE9.tmp"C:\Users\Admin\AppData\Local\Temp\1CE9.tmp"27⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\1E41.tmp"C:\Users\Admin\AppData\Local\Temp\1E41.tmp"28⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\1FD7.tmp"C:\Users\Admin\AppData\Local\Temp\1FD7.tmp"29⤵
- Executes dropped EXE
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\20B2.tmp"C:\Users\Admin\AppData\Local\Temp\20B2.tmp"30⤵
- Executes dropped EXE
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\21BC.tmp"C:\Users\Admin\AppData\Local\Temp\21BC.tmp"31⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\2268.tmp"C:\Users\Admin\AppData\Local\Temp\2268.tmp"32⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\23A0.tmp"C:\Users\Admin\AppData\Local\Temp\23A0.tmp"33⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\2507.tmp"C:\Users\Admin\AppData\Local\Temp\2507.tmp"34⤵
- Executes dropped EXE
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\2611.tmp"C:\Users\Admin\AppData\Local\Temp\2611.tmp"35⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\270B.tmp"C:\Users\Admin\AppData\Local\Temp\270B.tmp"36⤵
- Executes dropped EXE
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\2798.tmp"C:\Users\Admin\AppData\Local\Temp\2798.tmp"37⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\28EF.tmp"C:\Users\Admin\AppData\Local\Temp\28EF.tmp"38⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\29DA.tmp"C:\Users\Admin\AppData\Local\Temp\29DA.tmp"39⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\2A95.tmp"C:\Users\Admin\AppData\Local\Temp\2A95.tmp"40⤵
- Executes dropped EXE
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\2B22.tmp"C:\Users\Admin\AppData\Local\Temp\2B22.tmp"41⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\2B9F.tmp"C:\Users\Admin\AppData\Local\Temp\2B9F.tmp"42⤵
- Executes dropped EXE
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\2C1C.tmp"C:\Users\Admin\AppData\Local\Temp\2C1C.tmp"43⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\2C89.tmp"C:\Users\Admin\AppData\Local\Temp\2C89.tmp"44⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\2CF7.tmp"C:\Users\Admin\AppData\Local\Temp\2CF7.tmp"45⤵
- Executes dropped EXE
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\2D74.tmp"C:\Users\Admin\AppData\Local\Temp\2D74.tmp"46⤵
- Executes dropped EXE
PID:948 -
C:\Users\Admin\AppData\Local\Temp\2E8D.tmp"C:\Users\Admin\AppData\Local\Temp\2E8D.tmp"47⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\2F48.tmp"C:\Users\Admin\AppData\Local\Temp\2F48.tmp"48⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\2FF4.tmp"C:\Users\Admin\AppData\Local\Temp\2FF4.tmp"49⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\3091.tmp"C:\Users\Admin\AppData\Local\Temp\3091.tmp"50⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\318B.tmp"C:\Users\Admin\AppData\Local\Temp\318B.tmp"51⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\31F8.tmp"C:\Users\Admin\AppData\Local\Temp\31F8.tmp"52⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\3340.tmp"C:\Users\Admin\AppData\Local\Temp\3340.tmp"53⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\33BD.tmp"C:\Users\Admin\AppData\Local\Temp\33BD.tmp"54⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\34C7.tmp"C:\Users\Admin\AppData\Local\Temp\34C7.tmp"55⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\3573.tmp"C:\Users\Admin\AppData\Local\Temp\3573.tmp"56⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\35E0.tmp"C:\Users\Admin\AppData\Local\Temp\35E0.tmp"57⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\366D.tmp"C:\Users\Admin\AppData\Local\Temp\366D.tmp"58⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\3767.tmp"C:\Users\Admin\AppData\Local\Temp\3767.tmp"59⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\37E4.tmp"C:\Users\Admin\AppData\Local\Temp\37E4.tmp"60⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\3851.tmp"C:\Users\Admin\AppData\Local\Temp\3851.tmp"61⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\38BE.tmp"C:\Users\Admin\AppData\Local\Temp\38BE.tmp"62⤵
- Executes dropped EXE
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\392C.tmp"C:\Users\Admin\AppData\Local\Temp\392C.tmp"63⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\3AC2.tmp"C:\Users\Admin\AppData\Local\Temp\3AC2.tmp"64⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"65⤵
- Executes dropped EXE
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\3CC6.tmp"C:\Users\Admin\AppData\Local\Temp\3CC6.tmp"66⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\3D52.tmp"C:\Users\Admin\AppData\Local\Temp\3D52.tmp"67⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\3F65.tmp"C:\Users\Admin\AppData\Local\Temp\3F65.tmp"68⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\3FF2.tmp"C:\Users\Admin\AppData\Local\Temp\3FF2.tmp"69⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\4050.tmp"C:\Users\Admin\AppData\Local\Temp\4050.tmp"70⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\40BD.tmp"C:\Users\Admin\AppData\Local\Temp\40BD.tmp"71⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\4179.tmp"C:\Users\Admin\AppData\Local\Temp\4179.tmp"72⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\4205.tmp"C:\Users\Admin\AppData\Local\Temp\4205.tmp"73⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\42A2.tmp"C:\Users\Admin\AppData\Local\Temp\42A2.tmp"74⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\43DA.tmp"C:\Users\Admin\AppData\Local\Temp\43DA.tmp"75⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\4476.tmp"C:\Users\Admin\AppData\Local\Temp\4476.tmp"76⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\47C2.tmp"C:\Users\Admin\AppData\Local\Temp\47C2.tmp"77⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\4AEF.tmp"C:\Users\Admin\AppData\Local\Temp\4AEF.tmp"78⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\4B5C.tmp"C:\Users\Admin\AppData\Local\Temp\4B5C.tmp"79⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\4BE9.tmp"C:\Users\Admin\AppData\Local\Temp\4BE9.tmp"80⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\4C56.tmp"C:\Users\Admin\AppData\Local\Temp\4C56.tmp"81⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\4D9E.tmp"C:\Users\Admin\AppData\Local\Temp\4D9E.tmp"82⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\4E0B.tmp"C:\Users\Admin\AppData\Local\Temp\4E0B.tmp"83⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\4EA8.tmp"C:\Users\Admin\AppData\Local\Temp\4EA8.tmp"84⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\4FE0.tmp"C:\Users\Admin\AppData\Local\Temp\4FE0.tmp"85⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\50BB.tmp"C:\Users\Admin\AppData\Local\Temp\50BB.tmp"86⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\5520.tmp"C:\Users\Admin\AppData\Local\Temp\5520.tmp"87⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\558D.tmp"C:\Users\Admin\AppData\Local\Temp\558D.tmp"88⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\561A.tmp"C:\Users\Admin\AppData\Local\Temp\561A.tmp"89⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\5687.tmp"C:\Users\Admin\AppData\Local\Temp\5687.tmp"90⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\5772.tmp"C:\Users\Admin\AppData\Local\Temp\5772.tmp"91⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\5937.tmp"C:\Users\Admin\AppData\Local\Temp\5937.tmp"92⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\5A40.tmp"C:\Users\Admin\AppData\Local\Temp\5A40.tmp"93⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\5BD7.tmp"C:\Users\Admin\AppData\Local\Temp\5BD7.tmp"94⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\5D5D.tmp"C:\Users\Admin\AppData\Local\Temp\5D5D.tmp"95⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\5DCB.tmp"C:\Users\Admin\AppData\Local\Temp\5DCB.tmp"96⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\5E48.tmp"C:\Users\Admin\AppData\Local\Temp\5E48.tmp"97⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"98⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\5F90.tmp"C:\Users\Admin\AppData\Local\Temp\5F90.tmp"99⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\601C.tmp"C:\Users\Admin\AppData\Local\Temp\601C.tmp"100⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\6099.tmp"C:\Users\Admin\AppData\Local\Temp\6099.tmp"101⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\6126.tmp"C:\Users\Admin\AppData\Local\Temp\6126.tmp"102⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\61A3.tmp"C:\Users\Admin\AppData\Local\Temp\61A3.tmp"103⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\6349.tmp"C:\Users\Admin\AppData\Local\Temp\6349.tmp"104⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\63E5.tmp"C:\Users\Admin\AppData\Local\Temp\63E5.tmp"105⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\6462.tmp"C:\Users\Admin\AppData\Local\Temp\6462.tmp"106⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\64EF.tmp"C:\Users\Admin\AppData\Local\Temp\64EF.tmp"107⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\6608.tmp"C:\Users\Admin\AppData\Local\Temp\6608.tmp"108⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\6685.tmp"C:\Users\Admin\AppData\Local\Temp\6685.tmp"109⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\6712.tmp"C:\Users\Admin\AppData\Local\Temp\6712.tmp"110⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\678F.tmp"C:\Users\Admin\AppData\Local\Temp\678F.tmp"111⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\67FC.tmp"C:\Users\Admin\AppData\Local\Temp\67FC.tmp"112⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\68A8.tmp"C:\Users\Admin\AppData\Local\Temp\68A8.tmp"113⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\6915.tmp"C:\Users\Admin\AppData\Local\Temp\6915.tmp"114⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\6983.tmp"C:\Users\Admin\AppData\Local\Temp\6983.tmp"115⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\6A1F.tmp"C:\Users\Admin\AppData\Local\Temp\6A1F.tmp"116⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\6A9C.tmp"C:\Users\Admin\AppData\Local\Temp\6A9C.tmp"117⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\6B09.tmp"C:\Users\Admin\AppData\Local\Temp\6B09.tmp"118⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\6BE4.tmp"C:\Users\Admin\AppData\Local\Temp\6BE4.tmp"119⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\6C71.tmp"C:\Users\Admin\AppData\Local\Temp\6C71.tmp"120⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\6CFD.tmp"C:\Users\Admin\AppData\Local\Temp\6CFD.tmp"121⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\6DF7.tmp"C:\Users\Admin\AppData\Local\Temp\6DF7.tmp"122⤵PID:1400
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-