Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26/03/2024, 10:42
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-26_05afd2a0393983023e0146462e1c46c5_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-26_05afd2a0393983023e0146462e1c46c5_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-26_05afd2a0393983023e0146462e1c46c5_mafia.exe
-
Size
527KB
-
MD5
05afd2a0393983023e0146462e1c46c5
-
SHA1
8c5b440e6188b7d9ece0dad82af13c4ec3909c3e
-
SHA256
ada7eaf93053df33e1721162cceb2638fea21cc3ead4be50f6fe68781b67904f
-
SHA512
979421bdb4abe42660cebe0c066e97ced2cbad571c4c36514e7a2b3d4f684a9cd6a7454cd8dd598b7137729258e433799731887d7b4e1ec00be8173018d67b05
-
SSDEEP
12288:fU5rCOTeidCwfsYBTnT2KVjBHQDCdnboDZu:fUQOJd6YBDvV9XVboDo
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4392 DD12.tmp 4624 DE98.tmp 3284 DF73.tmp 4076 E05D.tmp 4184 E138.tmp 4336 E1E4.tmp 4176 E2FD.tmp 2308 E426.tmp 3124 E530.tmp 4140 E62A.tmp 1796 E6F5.tmp 4996 E791.tmp 1456 E85C.tmp 4372 E927.tmp 4208 E9C4.tmp 3800 EA8F.tmp 5012 EB79.tmp 492 EC25.tmp 1432 ED1F.tmp 1596 EDBB.tmp 4880 EE67.tmp 4596 EF23.tmp 2016 F02C.tmp 3308 F0F7.tmp 1852 F1A3.tmp 1868 F27E.tmp 4660 F368.tmp 2308 F405.tmp 3124 F491.tmp 5076 F53D.tmp 2516 F627.tmp 3036 F750.tmp 4328 F80C.tmp 1312 F898.tmp 3024 F906.tmp 5112 F9A2.tmp 3292 FA0F.tmp 2972 FA7D.tmp 1432 FAFA.tmp 3720 FBC5.tmp 4880 FC71.tmp 4084 FCEE.tmp 1956 FDB9.tmp 3308 FE94.tmp 4072 FF4F.tmp 2432 FFFB.tmp 4536 88.tmp 380 105.tmp 4320 172.tmp 3036 1FF.tmp 4236 2AB.tmp 368 356.tmp 2500 3F3.tmp 5012 49F.tmp 2368 54A.tmp 1732 5C7.tmp 1332 654.tmp 1596 700.tmp 4624 78D.tmp 2152 819.tmp 2992 8A6.tmp 4740 981.tmp 496 9FE.tmp 4176 A7B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2972 wrote to memory of 4392 2972 2024-03-26_05afd2a0393983023e0146462e1c46c5_mafia.exe 98 PID 2972 wrote to memory of 4392 2972 2024-03-26_05afd2a0393983023e0146462e1c46c5_mafia.exe 98 PID 2972 wrote to memory of 4392 2972 2024-03-26_05afd2a0393983023e0146462e1c46c5_mafia.exe 98 PID 4392 wrote to memory of 4624 4392 DD12.tmp 100 PID 4392 wrote to memory of 4624 4392 DD12.tmp 100 PID 4392 wrote to memory of 4624 4392 DD12.tmp 100 PID 4624 wrote to memory of 3284 4624 DE98.tmp 101 PID 4624 wrote to memory of 3284 4624 DE98.tmp 101 PID 4624 wrote to memory of 3284 4624 DE98.tmp 101 PID 3284 wrote to memory of 4076 3284 DF73.tmp 102 PID 3284 wrote to memory of 4076 3284 DF73.tmp 102 PID 3284 wrote to memory of 4076 3284 DF73.tmp 102 PID 4076 wrote to memory of 4184 4076 E05D.tmp 103 PID 4076 wrote to memory of 4184 4076 E05D.tmp 103 PID 4076 wrote to memory of 4184 4076 E05D.tmp 103 PID 4184 wrote to memory of 4336 4184 E138.tmp 104 PID 4184 wrote to memory of 4336 4184 E138.tmp 104 PID 4184 wrote to memory of 4336 4184 E138.tmp 104 PID 4336 wrote to memory of 4176 4336 E1E4.tmp 105 PID 4336 wrote to memory of 4176 4336 E1E4.tmp 105 PID 4336 wrote to memory of 4176 4336 E1E4.tmp 105 PID 4176 wrote to memory of 2308 4176 E2FD.tmp 106 PID 4176 wrote to memory of 2308 4176 E2FD.tmp 106 PID 4176 wrote to memory of 2308 4176 E2FD.tmp 106 PID 2308 wrote to memory of 3124 2308 E426.tmp 107 PID 2308 wrote to memory of 3124 2308 E426.tmp 107 PID 2308 wrote to memory of 3124 2308 E426.tmp 107 PID 3124 wrote to memory of 4140 3124 E530.tmp 108 PID 3124 wrote to memory of 4140 3124 E530.tmp 108 PID 3124 wrote to memory of 4140 3124 E530.tmp 108 PID 4140 wrote to memory of 1796 4140 E62A.tmp 109 PID 4140 wrote to memory of 1796 4140 E62A.tmp 109 PID 4140 wrote to memory of 1796 4140 E62A.tmp 109 PID 1796 wrote to memory of 4996 1796 E6F5.tmp 111 PID 1796 wrote to memory of 4996 1796 E6F5.tmp 111 PID 1796 wrote to memory of 4996 1796 E6F5.tmp 111 PID 4996 wrote to memory of 1456 4996 E791.tmp 112 PID 4996 wrote to memory of 1456 4996 E791.tmp 112 PID 4996 wrote to memory of 1456 4996 E791.tmp 112 PID 1456 wrote to memory of 4372 1456 E85C.tmp 113 PID 1456 wrote to memory of 4372 1456 E85C.tmp 113 PID 1456 wrote to memory of 4372 1456 E85C.tmp 113 PID 4372 wrote to memory of 4208 4372 E927.tmp 114 PID 4372 wrote to memory of 4208 4372 E927.tmp 114 PID 4372 wrote to memory of 4208 4372 E927.tmp 114 PID 4208 wrote to memory of 3800 4208 E9C4.tmp 116 PID 4208 wrote to memory of 3800 4208 E9C4.tmp 116 PID 4208 wrote to memory of 3800 4208 E9C4.tmp 116 PID 3800 wrote to memory of 5012 3800 EA8F.tmp 117 PID 3800 wrote to memory of 5012 3800 EA8F.tmp 117 PID 3800 wrote to memory of 5012 3800 EA8F.tmp 117 PID 5012 wrote to memory of 492 5012 EB79.tmp 118 PID 5012 wrote to memory of 492 5012 EB79.tmp 118 PID 5012 wrote to memory of 492 5012 EB79.tmp 118 PID 492 wrote to memory of 1432 492 EC25.tmp 119 PID 492 wrote to memory of 1432 492 EC25.tmp 119 PID 492 wrote to memory of 1432 492 EC25.tmp 119 PID 1432 wrote to memory of 1596 1432 ED1F.tmp 120 PID 1432 wrote to memory of 1596 1432 ED1F.tmp 120 PID 1432 wrote to memory of 1596 1432 ED1F.tmp 120 PID 1596 wrote to memory of 4880 1596 EDBB.tmp 121 PID 1596 wrote to memory of 4880 1596 EDBB.tmp 121 PID 1596 wrote to memory of 4880 1596 EDBB.tmp 121 PID 4880 wrote to memory of 4596 4880 EE67.tmp 122
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-26_05afd2a0393983023e0146462e1c46c5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-26_05afd2a0393983023e0146462e1c46c5_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\DD12.tmp"C:\Users\Admin\AppData\Local\Temp\DD12.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\DE98.tmp"C:\Users\Admin\AppData\Local\Temp\DE98.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\DF73.tmp"C:\Users\Admin\AppData\Local\Temp\DF73.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\E05D.tmp"C:\Users\Admin\AppData\Local\Temp\E05D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\E138.tmp"C:\Users\Admin\AppData\Local\Temp\E138.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\E2FD.tmp"C:\Users\Admin\AppData\Local\Temp\E2FD.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\E426.tmp"C:\Users\Admin\AppData\Local\Temp\E426.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\E530.tmp"C:\Users\Admin\AppData\Local\Temp\E530.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\E62A.tmp"C:\Users\Admin\AppData\Local\Temp\E62A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\E791.tmp"C:\Users\Admin\AppData\Local\Temp\E791.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\E85C.tmp"C:\Users\Admin\AppData\Local\Temp\E85C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\E927.tmp"C:\Users\Admin\AppData\Local\Temp\E927.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\EA8F.tmp"C:\Users\Admin\AppData\Local\Temp\EA8F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\EB79.tmp"C:\Users\Admin\AppData\Local\Temp\EB79.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\EC25.tmp"C:\Users\Admin\AppData\Local\Temp\EC25.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:492 -
C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\EE67.tmp"C:\Users\Admin\AppData\Local\Temp\EE67.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\EF23.tmp"C:\Users\Admin\AppData\Local\Temp\EF23.tmp"23⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\F02C.tmp"C:\Users\Admin\AppData\Local\Temp\F02C.tmp"24⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\F0F7.tmp"C:\Users\Admin\AppData\Local\Temp\F0F7.tmp"25⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\F1A3.tmp"C:\Users\Admin\AppData\Local\Temp\F1A3.tmp"26⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\F27E.tmp"C:\Users\Admin\AppData\Local\Temp\F27E.tmp"27⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\F368.tmp"C:\Users\Admin\AppData\Local\Temp\F368.tmp"28⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\F405.tmp"C:\Users\Admin\AppData\Local\Temp\F405.tmp"29⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\F491.tmp"C:\Users\Admin\AppData\Local\Temp\F491.tmp"30⤵
- Executes dropped EXE
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\F53D.tmp"C:\Users\Admin\AppData\Local\Temp\F53D.tmp"31⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\F627.tmp"C:\Users\Admin\AppData\Local\Temp\F627.tmp"32⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\F750.tmp"C:\Users\Admin\AppData\Local\Temp\F750.tmp"33⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\F80C.tmp"C:\Users\Admin\AppData\Local\Temp\F80C.tmp"34⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\F898.tmp"C:\Users\Admin\AppData\Local\Temp\F898.tmp"35⤵
- Executes dropped EXE
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\F906.tmp"C:\Users\Admin\AppData\Local\Temp\F906.tmp"36⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\F9A2.tmp"C:\Users\Admin\AppData\Local\Temp\F9A2.tmp"37⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\FA0F.tmp"C:\Users\Admin\AppData\Local\Temp\FA0F.tmp"38⤵
- Executes dropped EXE
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\FA7D.tmp"C:\Users\Admin\AppData\Local\Temp\FA7D.tmp"39⤵
- Executes dropped EXE
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"40⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"41⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\FC71.tmp"C:\Users\Admin\AppData\Local\Temp\FC71.tmp"42⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"43⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\FDB9.tmp"C:\Users\Admin\AppData\Local\Temp\FDB9.tmp"44⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\FE94.tmp"C:\Users\Admin\AppData\Local\Temp\FE94.tmp"45⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\FF4F.tmp"C:\Users\Admin\AppData\Local\Temp\FF4F.tmp"46⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\FFFB.tmp"C:\Users\Admin\AppData\Local\Temp\FFFB.tmp"47⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\88.tmp"C:\Users\Admin\AppData\Local\Temp\88.tmp"48⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\105.tmp"C:\Users\Admin\AppData\Local\Temp\105.tmp"49⤵
- Executes dropped EXE
PID:380 -
C:\Users\Admin\AppData\Local\Temp\172.tmp"C:\Users\Admin\AppData\Local\Temp\172.tmp"50⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\1FF.tmp"C:\Users\Admin\AppData\Local\Temp\1FF.tmp"51⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\2AB.tmp"C:\Users\Admin\AppData\Local\Temp\2AB.tmp"52⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\356.tmp"C:\Users\Admin\AppData\Local\Temp\356.tmp"53⤵
- Executes dropped EXE
PID:368 -
C:\Users\Admin\AppData\Local\Temp\3F3.tmp"C:\Users\Admin\AppData\Local\Temp\3F3.tmp"54⤵
- Executes dropped EXE
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\49F.tmp"C:\Users\Admin\AppData\Local\Temp\49F.tmp"55⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\54A.tmp"C:\Users\Admin\AppData\Local\Temp\54A.tmp"56⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\5C7.tmp"C:\Users\Admin\AppData\Local\Temp\5C7.tmp"57⤵
- Executes dropped EXE
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\654.tmp"C:\Users\Admin\AppData\Local\Temp\654.tmp"58⤵
- Executes dropped EXE
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\700.tmp"C:\Users\Admin\AppData\Local\Temp\700.tmp"59⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\78D.tmp"C:\Users\Admin\AppData\Local\Temp\78D.tmp"60⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\819.tmp"C:\Users\Admin\AppData\Local\Temp\819.tmp"61⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\8A6.tmp"C:\Users\Admin\AppData\Local\Temp\8A6.tmp"62⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\981.tmp"C:\Users\Admin\AppData\Local\Temp\981.tmp"63⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\9FE.tmp"C:\Users\Admin\AppData\Local\Temp\9FE.tmp"64⤵
- Executes dropped EXE
PID:496 -
C:\Users\Admin\AppData\Local\Temp\A7B.tmp"C:\Users\Admin\AppData\Local\Temp\A7B.tmp"65⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\B07.tmp"C:\Users\Admin\AppData\Local\Temp\B07.tmp"66⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\BC3.tmp"C:\Users\Admin\AppData\Local\Temp\BC3.tmp"67⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\C5F.tmp"C:\Users\Admin\AppData\Local\Temp\C5F.tmp"68⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\CEC.tmp"C:\Users\Admin\AppData\Local\Temp\CEC.tmp"69⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\DB7.tmp"C:\Users\Admin\AppData\Local\Temp\DB7.tmp"70⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\E72.tmp"C:\Users\Admin\AppData\Local\Temp\E72.tmp"71⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\F3D.tmp"C:\Users\Admin\AppData\Local\Temp\F3D.tmp"72⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\FCA.tmp"C:\Users\Admin\AppData\Local\Temp\FCA.tmp"73⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\1066.tmp"C:\Users\Admin\AppData\Local\Temp\1066.tmp"74⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\1102.tmp"C:\Users\Admin\AppData\Local\Temp\1102.tmp"75⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\11BE.tmp"C:\Users\Admin\AppData\Local\Temp\11BE.tmp"76⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\125A.tmp"C:\Users\Admin\AppData\Local\Temp\125A.tmp"77⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\12C8.tmp"C:\Users\Admin\AppData\Local\Temp\12C8.tmp"78⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\1345.tmp"C:\Users\Admin\AppData\Local\Temp\1345.tmp"79⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\13D1.tmp"C:\Users\Admin\AppData\Local\Temp\13D1.tmp"80⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\144E.tmp"C:\Users\Admin\AppData\Local\Temp\144E.tmp"81⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\14EA.tmp"C:\Users\Admin\AppData\Local\Temp\14EA.tmp"82⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\1577.tmp"C:\Users\Admin\AppData\Local\Temp\1577.tmp"83⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\15F4.tmp"C:\Users\Admin\AppData\Local\Temp\15F4.tmp"84⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\1690.tmp"C:\Users\Admin\AppData\Local\Temp\1690.tmp"85⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\170D.tmp"C:\Users\Admin\AppData\Local\Temp\170D.tmp"86⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\179A.tmp"C:\Users\Admin\AppData\Local\Temp\179A.tmp"87⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\1817.tmp"C:\Users\Admin\AppData\Local\Temp\1817.tmp"88⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\1884.tmp"C:\Users\Admin\AppData\Local\Temp\1884.tmp"89⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\1911.tmp"C:\Users\Admin\AppData\Local\Temp\1911.tmp"90⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\199E.tmp"C:\Users\Admin\AppData\Local\Temp\199E.tmp"91⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\1A59.tmp"C:\Users\Admin\AppData\Local\Temp\1A59.tmp"92⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\1AE6.tmp"C:\Users\Admin\AppData\Local\Temp\1AE6.tmp"93⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\1B63.tmp"C:\Users\Admin\AppData\Local\Temp\1B63.tmp"94⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"95⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\1C7C.tmp"C:\Users\Admin\AppData\Local\Temp\1C7C.tmp"96⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\1D28.tmp"C:\Users\Admin\AppData\Local\Temp\1D28.tmp"97⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\1DC4.tmp"C:\Users\Admin\AppData\Local\Temp\1DC4.tmp"98⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\1E41.tmp"C:\Users\Admin\AppData\Local\Temp\1E41.tmp"99⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"100⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"101⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\1FC8.tmp"C:\Users\Admin\AppData\Local\Temp\1FC8.tmp"102⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\2054.tmp"C:\Users\Admin\AppData\Local\Temp\2054.tmp"103⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\20E1.tmp"C:\Users\Admin\AppData\Local\Temp\20E1.tmp"104⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\214E.tmp"C:\Users\Admin\AppData\Local\Temp\214E.tmp"105⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\21DB.tmp"C:\Users\Admin\AppData\Local\Temp\21DB.tmp"106⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\2277.tmp"C:\Users\Admin\AppData\Local\Temp\2277.tmp"107⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\22F4.tmp"C:\Users\Admin\AppData\Local\Temp\22F4.tmp"108⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\2371.tmp"C:\Users\Admin\AppData\Local\Temp\2371.tmp"109⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\23FE.tmp"C:\Users\Admin\AppData\Local\Temp\23FE.tmp"110⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\248A.tmp"C:\Users\Admin\AppData\Local\Temp\248A.tmp"111⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\24E8.tmp"C:\Users\Admin\AppData\Local\Temp\24E8.tmp"112⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\2565.tmp"C:\Users\Admin\AppData\Local\Temp\2565.tmp"113⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\25C3.tmp"C:\Users\Admin\AppData\Local\Temp\25C3.tmp"114⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\2621.tmp"C:\Users\Admin\AppData\Local\Temp\2621.tmp"115⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\269E.tmp"C:\Users\Admin\AppData\Local\Temp\269E.tmp"116⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\273A.tmp"C:\Users\Admin\AppData\Local\Temp\273A.tmp"117⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\27A7.tmp"C:\Users\Admin\AppData\Local\Temp\27A7.tmp"118⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\2824.tmp"C:\Users\Admin\AppData\Local\Temp\2824.tmp"119⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\28E0.tmp"C:\Users\Admin\AppData\Local\Temp\28E0.tmp"120⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\295D.tmp"C:\Users\Admin\AppData\Local\Temp\295D.tmp"121⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\29BB.tmp"C:\Users\Admin\AppData\Local\Temp\29BB.tmp"122⤵PID:4560
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-