Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
33s -
max time network
58s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26/03/2024, 01:35
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-26_73c57dcd084c75988c6d901b6013da33_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-26_73c57dcd084c75988c6d901b6013da33_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-26_73c57dcd084c75988c6d901b6013da33_mafia.exe
-
Size
486KB
-
MD5
73c57dcd084c75988c6d901b6013da33
-
SHA1
4a6f27fc883497c0f9e92b92c91172e05b1e00c4
-
SHA256
3e714519b1fefba534d2b70ece3baeffc18cc30b37d16dd99d22569b51430d70
-
SHA512
e367bca15241dac673a21cb2bfd220e66f225ab94e897a3ce73f1d66d6ac88cea45e169868a145db4447b4dd638a43db6e2cf48d28f1043ddabe6205633fea97
-
SSDEEP
12288:/U5rCOTeiDQzYvkuI9V8r/H2afxtGdC2Ze9NZ:/UQOJDQzYvrI9Kr/WafxtG/ZyN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2632 F6D3.tmp 3492 F7FC.tmp 908 F8C7.tmp 1044 F9D1.tmp 1996 FA9C.tmp 1416 FB67.tmp 2936 FC42.tmp 3544 FCEE.tmp 4532 FD9A.tmp 4356 FE65.tmp 3212 FF7E.tmp 1072 59.tmp 4200 182.tmp 3476 26C.tmp 3316 328.tmp 4340 3B4.tmp 2404 450.tmp 2392 50C.tmp 3912 616.tmp 2624 6F0.tmp 4272 79C.tmp 1692 887.tmp 3292 942.tmp 4040 A1D.tmp 1076 B17.tmp 864 C01.tmp 456 D0B.tmp 4796 DE6.tmp 1728 EB1.tmp 1616 FAB.tmp 1928 1037.tmp 2244 1122.tmp 3272 11ED.tmp 4404 1354.tmp 2228 1400.tmp 644 14AC.tmp 3960 1567.tmp 2332 15F4.tmp 1044 1690.tmp 232 17E8.tmp 3536 1865.tmp 4728 18E2.tmp 4288 195F.tmp 776 19DC.tmp 4548 1A69.tmp 3716 1AE6.tmp 552 1B92.tmp 1928 1C1E.tmp 3316 1CCA.tmp 2928 1D66.tmp 940 1DD4.tmp 4292 1E60.tmp 644 1EED.tmp 4192 1F89.tmp 3912 2016.tmp 4640 20B2.tmp 1496 212F.tmp 2188 21DB.tmp 420 2258.tmp 1600 22D5.tmp 4104 2352.tmp 3652 23DF.tmp 2176 245C.tmp 2256 2507.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3000 wrote to memory of 2632 3000 2024-03-26_73c57dcd084c75988c6d901b6013da33_mafia.exe 95 PID 3000 wrote to memory of 2632 3000 2024-03-26_73c57dcd084c75988c6d901b6013da33_mafia.exe 95 PID 3000 wrote to memory of 2632 3000 2024-03-26_73c57dcd084c75988c6d901b6013da33_mafia.exe 95 PID 2632 wrote to memory of 3492 2632 F6D3.tmp 96 PID 2632 wrote to memory of 3492 2632 F6D3.tmp 96 PID 2632 wrote to memory of 3492 2632 F6D3.tmp 96 PID 3492 wrote to memory of 908 3492 F7FC.tmp 97 PID 3492 wrote to memory of 908 3492 F7FC.tmp 97 PID 3492 wrote to memory of 908 3492 F7FC.tmp 97 PID 908 wrote to memory of 1044 908 F8C7.tmp 99 PID 908 wrote to memory of 1044 908 F8C7.tmp 99 PID 908 wrote to memory of 1044 908 F8C7.tmp 99 PID 1044 wrote to memory of 1996 1044 F9D1.tmp 100 PID 1044 wrote to memory of 1996 1044 F9D1.tmp 100 PID 1044 wrote to memory of 1996 1044 F9D1.tmp 100 PID 1996 wrote to memory of 1416 1996 FA9C.tmp 101 PID 1996 wrote to memory of 1416 1996 FA9C.tmp 101 PID 1996 wrote to memory of 1416 1996 FA9C.tmp 101 PID 1416 wrote to memory of 2936 1416 FB67.tmp 102 PID 1416 wrote to memory of 2936 1416 FB67.tmp 102 PID 1416 wrote to memory of 2936 1416 FB67.tmp 102 PID 2936 wrote to memory of 3544 2936 FC42.tmp 104 PID 2936 wrote to memory of 3544 2936 FC42.tmp 104 PID 2936 wrote to memory of 3544 2936 FC42.tmp 104 PID 3544 wrote to memory of 4532 3544 FCEE.tmp 105 PID 3544 wrote to memory of 4532 3544 FCEE.tmp 105 PID 3544 wrote to memory of 4532 3544 FCEE.tmp 105 PID 4532 wrote to memory of 4356 4532 FD9A.tmp 106 PID 4532 wrote to memory of 4356 4532 FD9A.tmp 106 PID 4532 wrote to memory of 4356 4532 FD9A.tmp 106 PID 4356 wrote to memory of 3212 4356 FE65.tmp 108 PID 4356 wrote to memory of 3212 4356 FE65.tmp 108 PID 4356 wrote to memory of 3212 4356 FE65.tmp 108 PID 3212 wrote to memory of 1072 3212 FF7E.tmp 109 PID 3212 wrote to memory of 1072 3212 FF7E.tmp 109 PID 3212 wrote to memory of 1072 3212 FF7E.tmp 109 PID 1072 wrote to memory of 4200 1072 59.tmp 110 PID 1072 wrote to memory of 4200 1072 59.tmp 110 PID 1072 wrote to memory of 4200 1072 59.tmp 110 PID 4200 wrote to memory of 3476 4200 182.tmp 112 PID 4200 wrote to memory of 3476 4200 182.tmp 112 PID 4200 wrote to memory of 3476 4200 182.tmp 112 PID 3476 wrote to memory of 3316 3476 26C.tmp 113 PID 3476 wrote to memory of 3316 3476 26C.tmp 113 PID 3476 wrote to memory of 3316 3476 26C.tmp 113 PID 3316 wrote to memory of 4340 3316 328.tmp 114 PID 3316 wrote to memory of 4340 3316 328.tmp 114 PID 3316 wrote to memory of 4340 3316 328.tmp 114 PID 4340 wrote to memory of 2404 4340 3B4.tmp 115 PID 4340 wrote to memory of 2404 4340 3B4.tmp 115 PID 4340 wrote to memory of 2404 4340 3B4.tmp 115 PID 2404 wrote to memory of 2392 2404 450.tmp 116 PID 2404 wrote to memory of 2392 2404 450.tmp 116 PID 2404 wrote to memory of 2392 2404 450.tmp 116 PID 2392 wrote to memory of 3912 2392 50C.tmp 118 PID 2392 wrote to memory of 3912 2392 50C.tmp 118 PID 2392 wrote to memory of 3912 2392 50C.tmp 118 PID 3912 wrote to memory of 2624 3912 616.tmp 119 PID 3912 wrote to memory of 2624 3912 616.tmp 119 PID 3912 wrote to memory of 2624 3912 616.tmp 119 PID 2624 wrote to memory of 4272 2624 6F0.tmp 120 PID 2624 wrote to memory of 4272 2624 6F0.tmp 120 PID 2624 wrote to memory of 4272 2624 6F0.tmp 120 PID 4272 wrote to memory of 1692 4272 79C.tmp 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-26_73c57dcd084c75988c6d901b6013da33_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-26_73c57dcd084c75988c6d901b6013da33_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\F7FC.tmp"C:\Users\Admin\AppData\Local\Temp\F7FC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\F8C7.tmp"C:\Users\Admin\AppData\Local\Temp\F8C7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\FB67.tmp"C:\Users\Admin\AppData\Local\Temp\FB67.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\FC42.tmp"C:\Users\Admin\AppData\Local\Temp\FC42.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\FD9A.tmp"C:\Users\Admin\AppData\Local\Temp\FD9A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\FE65.tmp"C:\Users\Admin\AppData\Local\Temp\FE65.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\FF7E.tmp"C:\Users\Admin\AppData\Local\Temp\FF7E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\59.tmp"C:\Users\Admin\AppData\Local\Temp\59.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\182.tmp"C:\Users\Admin\AppData\Local\Temp\182.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\26C.tmp"C:\Users\Admin\AppData\Local\Temp\26C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\328.tmp"C:\Users\Admin\AppData\Local\Temp\328.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\3B4.tmp"C:\Users\Admin\AppData\Local\Temp\3B4.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\450.tmp"C:\Users\Admin\AppData\Local\Temp\450.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\50C.tmp"C:\Users\Admin\AppData\Local\Temp\50C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\616.tmp"C:\Users\Admin\AppData\Local\Temp\616.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\6F0.tmp"C:\Users\Admin\AppData\Local\Temp\6F0.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\79C.tmp"C:\Users\Admin\AppData\Local\Temp\79C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\887.tmp"C:\Users\Admin\AppData\Local\Temp\887.tmp"23⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\942.tmp"C:\Users\Admin\AppData\Local\Temp\942.tmp"24⤵
- Executes dropped EXE
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\A1D.tmp"C:\Users\Admin\AppData\Local\Temp\A1D.tmp"25⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\B17.tmp"C:\Users\Admin\AppData\Local\Temp\B17.tmp"26⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\C01.tmp"C:\Users\Admin\AppData\Local\Temp\C01.tmp"27⤵
- Executes dropped EXE
PID:864 -
C:\Users\Admin\AppData\Local\Temp\D0B.tmp"C:\Users\Admin\AppData\Local\Temp\D0B.tmp"28⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\DE6.tmp"C:\Users\Admin\AppData\Local\Temp\DE6.tmp"29⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\EB1.tmp"C:\Users\Admin\AppData\Local\Temp\EB1.tmp"30⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\FAB.tmp"C:\Users\Admin\AppData\Local\Temp\FAB.tmp"31⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\1037.tmp"C:\Users\Admin\AppData\Local\Temp\1037.tmp"32⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\1122.tmp"C:\Users\Admin\AppData\Local\Temp\1122.tmp"33⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\11ED.tmp"C:\Users\Admin\AppData\Local\Temp\11ED.tmp"34⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\1354.tmp"C:\Users\Admin\AppData\Local\Temp\1354.tmp"35⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\1400.tmp"C:\Users\Admin\AppData\Local\Temp\1400.tmp"36⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\14AC.tmp"C:\Users\Admin\AppData\Local\Temp\14AC.tmp"37⤵
- Executes dropped EXE
PID:644 -
C:\Users\Admin\AppData\Local\Temp\1567.tmp"C:\Users\Admin\AppData\Local\Temp\1567.tmp"38⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\15F4.tmp"C:\Users\Admin\AppData\Local\Temp\15F4.tmp"39⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\1690.tmp"C:\Users\Admin\AppData\Local\Temp\1690.tmp"40⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\17E8.tmp"C:\Users\Admin\AppData\Local\Temp\17E8.tmp"41⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\1865.tmp"C:\Users\Admin\AppData\Local\Temp\1865.tmp"42⤵
- Executes dropped EXE
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\18E2.tmp"C:\Users\Admin\AppData\Local\Temp\18E2.tmp"43⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\195F.tmp"C:\Users\Admin\AppData\Local\Temp\195F.tmp"44⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\19DC.tmp"C:\Users\Admin\AppData\Local\Temp\19DC.tmp"45⤵
- Executes dropped EXE
PID:776 -
C:\Users\Admin\AppData\Local\Temp\1A69.tmp"C:\Users\Admin\AppData\Local\Temp\1A69.tmp"46⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\1AE6.tmp"C:\Users\Admin\AppData\Local\Temp\1AE6.tmp"47⤵
- Executes dropped EXE
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\1B92.tmp"C:\Users\Admin\AppData\Local\Temp\1B92.tmp"48⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"49⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"50⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\1D66.tmp"C:\Users\Admin\AppData\Local\Temp\1D66.tmp"51⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"52⤵
- Executes dropped EXE
PID:940 -
C:\Users\Admin\AppData\Local\Temp\1E60.tmp"C:\Users\Admin\AppData\Local\Temp\1E60.tmp"53⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\1EED.tmp"C:\Users\Admin\AppData\Local\Temp\1EED.tmp"54⤵
- Executes dropped EXE
PID:644 -
C:\Users\Admin\AppData\Local\Temp\1F89.tmp"C:\Users\Admin\AppData\Local\Temp\1F89.tmp"55⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\2016.tmp"C:\Users\Admin\AppData\Local\Temp\2016.tmp"56⤵
- Executes dropped EXE
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\20B2.tmp"C:\Users\Admin\AppData\Local\Temp\20B2.tmp"57⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\212F.tmp"C:\Users\Admin\AppData\Local\Temp\212F.tmp"58⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\21DB.tmp"C:\Users\Admin\AppData\Local\Temp\21DB.tmp"59⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\2258.tmp"C:\Users\Admin\AppData\Local\Temp\2258.tmp"60⤵
- Executes dropped EXE
PID:420 -
C:\Users\Admin\AppData\Local\Temp\22D5.tmp"C:\Users\Admin\AppData\Local\Temp\22D5.tmp"61⤵
- Executes dropped EXE
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\2352.tmp"C:\Users\Admin\AppData\Local\Temp\2352.tmp"62⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\23DF.tmp"C:\Users\Admin\AppData\Local\Temp\23DF.tmp"63⤵
- Executes dropped EXE
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\245C.tmp"C:\Users\Admin\AppData\Local\Temp\245C.tmp"64⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\2507.tmp"C:\Users\Admin\AppData\Local\Temp\2507.tmp"65⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\2584.tmp"C:\Users\Admin\AppData\Local\Temp\2584.tmp"66⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\25F2.tmp"C:\Users\Admin\AppData\Local\Temp\25F2.tmp"67⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\269E.tmp"C:\Users\Admin\AppData\Local\Temp\269E.tmp"68⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\271B.tmp"C:\Users\Admin\AppData\Local\Temp\271B.tmp"69⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\2788.tmp"C:\Users\Admin\AppData\Local\Temp\2788.tmp"70⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\27F5.tmp"C:\Users\Admin\AppData\Local\Temp\27F5.tmp"71⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\2872.tmp"C:\Users\Admin\AppData\Local\Temp\2872.tmp"72⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\28FF.tmp"C:\Users\Admin\AppData\Local\Temp\28FF.tmp"73⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\298C.tmp"C:\Users\Admin\AppData\Local\Temp\298C.tmp"74⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\29F9.tmp"C:\Users\Admin\AppData\Local\Temp\29F9.tmp"75⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\2B03.tmp"C:\Users\Admin\AppData\Local\Temp\2B03.tmp"76⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\2B70.tmp"C:\Users\Admin\AppData\Local\Temp\2B70.tmp"77⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"78⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\2C7A.tmp"C:\Users\Admin\AppData\Local\Temp\2C7A.tmp"79⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\2D26.tmp"C:\Users\Admin\AppData\Local\Temp\2D26.tmp"80⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\2D93.tmp"C:\Users\Admin\AppData\Local\Temp\2D93.tmp"81⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\2E20.tmp"C:\Users\Admin\AppData\Local\Temp\2E20.tmp"82⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"83⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\2F48.tmp"C:\Users\Admin\AppData\Local\Temp\2F48.tmp"84⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\2FC5.tmp"C:\Users\Admin\AppData\Local\Temp\2FC5.tmp"85⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\3052.tmp"C:\Users\Admin\AppData\Local\Temp\3052.tmp"86⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\30DF.tmp"C:\Users\Admin\AppData\Local\Temp\30DF.tmp"87⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\316B.tmp"C:\Users\Admin\AppData\Local\Temp\316B.tmp"88⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\31E8.tmp"C:\Users\Admin\AppData\Local\Temp\31E8.tmp"89⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"90⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\32C3.tmp"C:\Users\Admin\AppData\Local\Temp\32C3.tmp"91⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"92⤵PID:420
-
C:\Users\Admin\AppData\Local\Temp\34F6.tmp"C:\Users\Admin\AppData\Local\Temp\34F6.tmp"93⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"94⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\361E.tmp"C:\Users\Admin\AppData\Local\Temp\361E.tmp"95⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\36BB.tmp"C:\Users\Admin\AppData\Local\Temp\36BB.tmp"96⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\3747.tmp"C:\Users\Admin\AppData\Local\Temp\3747.tmp"97⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\38CE.tmp"C:\Users\Admin\AppData\Local\Temp\38CE.tmp"98⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\397A.tmp"C:\Users\Admin\AppData\Local\Temp\397A.tmp"99⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\39F7.tmp"C:\Users\Admin\AppData\Local\Temp\39F7.tmp"100⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\3A93.tmp"C:\Users\Admin\AppData\Local\Temp\3A93.tmp"101⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\3B10.tmp"C:\Users\Admin\AppData\Local\Temp\3B10.tmp"102⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\3BBC.tmp"C:\Users\Admin\AppData\Local\Temp\3BBC.tmp"103⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\3C29.tmp"C:\Users\Admin\AppData\Local\Temp\3C29.tmp"104⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\3CA6.tmp"C:\Users\Admin\AppData\Local\Temp\3CA6.tmp"105⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\3D14.tmp"C:\Users\Admin\AppData\Local\Temp\3D14.tmp"106⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\3D91.tmp"C:\Users\Admin\AppData\Local\Temp\3D91.tmp"107⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\3DFE.tmp"C:\Users\Admin\AppData\Local\Temp\3DFE.tmp"108⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\3E8B.tmp"C:\Users\Admin\AppData\Local\Temp\3E8B.tmp"109⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\3F08.tmp"C:\Users\Admin\AppData\Local\Temp\3F08.tmp"110⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"111⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\4031.tmp"C:\Users\Admin\AppData\Local\Temp\4031.tmp"112⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\40BD.tmp"C:\Users\Admin\AppData\Local\Temp\40BD.tmp"113⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\412B.tmp"C:\Users\Admin\AppData\Local\Temp\412B.tmp"114⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\41B7.tmp"C:\Users\Admin\AppData\Local\Temp\41B7.tmp"115⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\4234.tmp"C:\Users\Admin\AppData\Local\Temp\4234.tmp"116⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\42A2.tmp"C:\Users\Admin\AppData\Local\Temp\42A2.tmp"117⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\432E.tmp"C:\Users\Admin\AppData\Local\Temp\432E.tmp"118⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\43AB.tmp"C:\Users\Admin\AppData\Local\Temp\43AB.tmp"119⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\4457.tmp"C:\Users\Admin\AppData\Local\Temp\4457.tmp"120⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\44D4.tmp"C:\Users\Admin\AppData\Local\Temp\44D4.tmp"121⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\4541.tmp"C:\Users\Admin\AppData\Local\Temp\4541.tmp"122⤵PID:4196
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-