Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/04/2024, 07:37
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-11_6517b529c6ef0d7c42ce4b3bb2a832ed_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-11_6517b529c6ef0d7c42ce4b3bb2a832ed_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-11_6517b529c6ef0d7c42ce4b3bb2a832ed_mafia.exe
-
Size
486KB
-
MD5
6517b529c6ef0d7c42ce4b3bb2a832ed
-
SHA1
1968e9cda4250d610021d34a68e9f37f6dfefe8e
-
SHA256
55fc9ce24158b82b4725cb569e8a284c95cc8d9daee2a4823a9d4e51a4ee2f2e
-
SHA512
4a9a8c9e9410642f0db821c777fd548e465481f8a4fb2181dace053978bd8c28b130135dcd6860da08a291cfdaf580c8569cc570d0f457ede1a8591cea8c539d
-
SSDEEP
12288:/U5rCOTeiDJwD7mTrula8APM8z09QyRtNZ:/UQOJDJw2PHNPjw9vN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3724 EAEC.tmp 2304 EC73.tmp 3108 ED4E.tmp 3372 EE09.tmp 3136 EED4.tmp 4988 EFAF.tmp 3568 F07A.tmp 3188 F117.tmp 2356 F211.tmp 412 F2CC.tmp 1728 F397.tmp 4232 F453.tmp 544 F4FF.tmp 976 FB38.tmp 2784 FC13.tmp 4092 FCEE.tmp 4300 FDE8.tmp 2168 FEE2.tmp 1624 FF7E.tmp 2804 68.tmp 2256 134.tmp 4456 21E.tmp 3552 2CA.tmp 2808 385.tmp 4672 431.tmp 1716 4ED.tmp 208 599.tmp 1836 654.tmp 2300 6F0.tmp 2172 7DB.tmp 3620 887.tmp 4124 913.tmp 3964 9BF.tmp 4916 A3C.tmp 4328 AA9.tmp 1136 B17.tmp 3308 BA3.tmp 3288 C20.tmp 560 C9D.tmp 3108 D2A.tmp 5044 D97.tmp 4440 E24.tmp 1684 EB1.tmp 1912 F3D.tmp 2556 FCA.tmp 3336 10E3.tmp 2356 119F.tmp 1332 12C8.tmp 1948 13A2.tmp 3324 145E.tmp 5000 150A.tmp 4648 15E4.tmp 544 16A0.tmp 3068 174C.tmp 4828 1817.tmp 5100 18B3.tmp 4300 198E.tmp 4408 1A0B.tmp 2968 1AF5.tmp 1624 1BA1.tmp 2804 1C5D.tmp 2796 1CDA.tmp 1484 1D86.tmp 3928 1DF3.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3892 wrote to memory of 3724 3892 2024-04-11_6517b529c6ef0d7c42ce4b3bb2a832ed_mafia.exe 90 PID 3892 wrote to memory of 3724 3892 2024-04-11_6517b529c6ef0d7c42ce4b3bb2a832ed_mafia.exe 90 PID 3892 wrote to memory of 3724 3892 2024-04-11_6517b529c6ef0d7c42ce4b3bb2a832ed_mafia.exe 90 PID 3724 wrote to memory of 2304 3724 EAEC.tmp 91 PID 3724 wrote to memory of 2304 3724 EAEC.tmp 91 PID 3724 wrote to memory of 2304 3724 EAEC.tmp 91 PID 2304 wrote to memory of 3108 2304 EC73.tmp 92 PID 2304 wrote to memory of 3108 2304 EC73.tmp 92 PID 2304 wrote to memory of 3108 2304 EC73.tmp 92 PID 3108 wrote to memory of 3372 3108 ED4E.tmp 93 PID 3108 wrote to memory of 3372 3108 ED4E.tmp 93 PID 3108 wrote to memory of 3372 3108 ED4E.tmp 93 PID 3372 wrote to memory of 3136 3372 EE09.tmp 94 PID 3372 wrote to memory of 3136 3372 EE09.tmp 94 PID 3372 wrote to memory of 3136 3372 EE09.tmp 94 PID 3136 wrote to memory of 4988 3136 EED4.tmp 95 PID 3136 wrote to memory of 4988 3136 EED4.tmp 95 PID 3136 wrote to memory of 4988 3136 EED4.tmp 95 PID 4988 wrote to memory of 3568 4988 EFAF.tmp 96 PID 4988 wrote to memory of 3568 4988 EFAF.tmp 96 PID 4988 wrote to memory of 3568 4988 EFAF.tmp 96 PID 3568 wrote to memory of 3188 3568 F07A.tmp 97 PID 3568 wrote to memory of 3188 3568 F07A.tmp 97 PID 3568 wrote to memory of 3188 3568 F07A.tmp 97 PID 3188 wrote to memory of 2356 3188 F117.tmp 98 PID 3188 wrote to memory of 2356 3188 F117.tmp 98 PID 3188 wrote to memory of 2356 3188 F117.tmp 98 PID 2356 wrote to memory of 412 2356 F211.tmp 99 PID 2356 wrote to memory of 412 2356 F211.tmp 99 PID 2356 wrote to memory of 412 2356 F211.tmp 99 PID 412 wrote to memory of 1728 412 F2CC.tmp 100 PID 412 wrote to memory of 1728 412 F2CC.tmp 100 PID 412 wrote to memory of 1728 412 F2CC.tmp 100 PID 1728 wrote to memory of 4232 1728 F397.tmp 101 PID 1728 wrote to memory of 4232 1728 F397.tmp 101 PID 1728 wrote to memory of 4232 1728 F397.tmp 101 PID 4232 wrote to memory of 544 4232 F453.tmp 102 PID 4232 wrote to memory of 544 4232 F453.tmp 102 PID 4232 wrote to memory of 544 4232 F453.tmp 102 PID 544 wrote to memory of 976 544 F4FF.tmp 103 PID 544 wrote to memory of 976 544 F4FF.tmp 103 PID 544 wrote to memory of 976 544 F4FF.tmp 103 PID 976 wrote to memory of 2784 976 FB38.tmp 104 PID 976 wrote to memory of 2784 976 FB38.tmp 104 PID 976 wrote to memory of 2784 976 FB38.tmp 104 PID 2784 wrote to memory of 4092 2784 FC13.tmp 105 PID 2784 wrote to memory of 4092 2784 FC13.tmp 105 PID 2784 wrote to memory of 4092 2784 FC13.tmp 105 PID 4092 wrote to memory of 4300 4092 FCEE.tmp 106 PID 4092 wrote to memory of 4300 4092 FCEE.tmp 106 PID 4092 wrote to memory of 4300 4092 FCEE.tmp 106 PID 4300 wrote to memory of 2168 4300 FDE8.tmp 107 PID 4300 wrote to memory of 2168 4300 FDE8.tmp 107 PID 4300 wrote to memory of 2168 4300 FDE8.tmp 107 PID 2168 wrote to memory of 1624 2168 FEE2.tmp 108 PID 2168 wrote to memory of 1624 2168 FEE2.tmp 108 PID 2168 wrote to memory of 1624 2168 FEE2.tmp 108 PID 1624 wrote to memory of 2804 1624 FF7E.tmp 109 PID 1624 wrote to memory of 2804 1624 FF7E.tmp 109 PID 1624 wrote to memory of 2804 1624 FF7E.tmp 109 PID 2804 wrote to memory of 2256 2804 68.tmp 110 PID 2804 wrote to memory of 2256 2804 68.tmp 110 PID 2804 wrote to memory of 2256 2804 68.tmp 110 PID 2256 wrote to memory of 4456 2256 134.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-11_6517b529c6ef0d7c42ce4b3bb2a832ed_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-11_6517b529c6ef0d7c42ce4b3bb2a832ed_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\EC73.tmp"C:\Users\Admin\AppData\Local\Temp\EC73.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\ED4E.tmp"C:\Users\Admin\AppData\Local\Temp\ED4E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\EE09.tmp"C:\Users\Admin\AppData\Local\Temp\EE09.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\EED4.tmp"C:\Users\Admin\AppData\Local\Temp\EED4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\EFAF.tmp"C:\Users\Admin\AppData\Local\Temp\EFAF.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\F07A.tmp"C:\Users\Admin\AppData\Local\Temp\F07A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\F117.tmp"C:\Users\Admin\AppData\Local\Temp\F117.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\F211.tmp"C:\Users\Admin\AppData\Local\Temp\F211.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\F2CC.tmp"C:\Users\Admin\AppData\Local\Temp\F2CC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Users\Admin\AppData\Local\Temp\F397.tmp"C:\Users\Admin\AppData\Local\Temp\F397.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\F453.tmp"C:\Users\Admin\AppData\Local\Temp\F453.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Users\Admin\AppData\Local\Temp\FB38.tmp"C:\Users\Admin\AppData\Local\Temp\FB38.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Local\Temp\FC13.tmp"C:\Users\Admin\AppData\Local\Temp\FC13.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\FEE2.tmp"C:\Users\Admin\AppData\Local\Temp\FEE2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\FF7E.tmp"C:\Users\Admin\AppData\Local\Temp\FF7E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\68.tmp"C:\Users\Admin\AppData\Local\Temp\68.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\134.tmp"C:\Users\Admin\AppData\Local\Temp\134.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\21E.tmp"C:\Users\Admin\AppData\Local\Temp\21E.tmp"23⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\2CA.tmp"C:\Users\Admin\AppData\Local\Temp\2CA.tmp"24⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\385.tmp"C:\Users\Admin\AppData\Local\Temp\385.tmp"25⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\431.tmp"C:\Users\Admin\AppData\Local\Temp\431.tmp"26⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\4ED.tmp"C:\Users\Admin\AppData\Local\Temp\4ED.tmp"27⤵
- Executes dropped EXE
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\599.tmp"C:\Users\Admin\AppData\Local\Temp\599.tmp"28⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\654.tmp"C:\Users\Admin\AppData\Local\Temp\654.tmp"29⤵
- Executes dropped EXE
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\6F0.tmp"C:\Users\Admin\AppData\Local\Temp\6F0.tmp"30⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\7DB.tmp"C:\Users\Admin\AppData\Local\Temp\7DB.tmp"31⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\887.tmp"C:\Users\Admin\AppData\Local\Temp\887.tmp"32⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\913.tmp"C:\Users\Admin\AppData\Local\Temp\913.tmp"33⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\9BF.tmp"C:\Users\Admin\AppData\Local\Temp\9BF.tmp"34⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\A3C.tmp"C:\Users\Admin\AppData\Local\Temp\A3C.tmp"35⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\AA9.tmp"C:\Users\Admin\AppData\Local\Temp\AA9.tmp"36⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\B17.tmp"C:\Users\Admin\AppData\Local\Temp\B17.tmp"37⤵
- Executes dropped EXE
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\BA3.tmp"C:\Users\Admin\AppData\Local\Temp\BA3.tmp"38⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\C20.tmp"C:\Users\Admin\AppData\Local\Temp\C20.tmp"39⤵
- Executes dropped EXE
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\C9D.tmp"C:\Users\Admin\AppData\Local\Temp\C9D.tmp"40⤵
- Executes dropped EXE
PID:560 -
C:\Users\Admin\AppData\Local\Temp\D2A.tmp"C:\Users\Admin\AppData\Local\Temp\D2A.tmp"41⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\D97.tmp"C:\Users\Admin\AppData\Local\Temp\D97.tmp"42⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"43⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\EB1.tmp"C:\Users\Admin\AppData\Local\Temp\EB1.tmp"44⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\F3D.tmp"C:\Users\Admin\AppData\Local\Temp\F3D.tmp"45⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\FCA.tmp"C:\Users\Admin\AppData\Local\Temp\FCA.tmp"46⤵
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\10E3.tmp"C:\Users\Admin\AppData\Local\Temp\10E3.tmp"47⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\119F.tmp"C:\Users\Admin\AppData\Local\Temp\119F.tmp"48⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\12C8.tmp"C:\Users\Admin\AppData\Local\Temp\12C8.tmp"49⤵
- Executes dropped EXE
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\13A2.tmp"C:\Users\Admin\AppData\Local\Temp\13A2.tmp"50⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\145E.tmp"C:\Users\Admin\AppData\Local\Temp\145E.tmp"51⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\150A.tmp"C:\Users\Admin\AppData\Local\Temp\150A.tmp"52⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\15E4.tmp"C:\Users\Admin\AppData\Local\Temp\15E4.tmp"53⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\16A0.tmp"C:\Users\Admin\AppData\Local\Temp\16A0.tmp"54⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\174C.tmp"C:\Users\Admin\AppData\Local\Temp\174C.tmp"55⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\1817.tmp"C:\Users\Admin\AppData\Local\Temp\1817.tmp"56⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\18B3.tmp"C:\Users\Admin\AppData\Local\Temp\18B3.tmp"57⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\198E.tmp"C:\Users\Admin\AppData\Local\Temp\198E.tmp"58⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"59⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"60⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"61⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"62⤵
- Executes dropped EXE
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"63⤵
- Executes dropped EXE
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\1D86.tmp"C:\Users\Admin\AppData\Local\Temp\1D86.tmp"64⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\1DF3.tmp"C:\Users\Admin\AppData\Local\Temp\1DF3.tmp"65⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\1EBE.tmp"C:\Users\Admin\AppData\Local\Temp\1EBE.tmp"66⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\1F3B.tmp"C:\Users\Admin\AppData\Local\Temp\1F3B.tmp"67⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"68⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\2035.tmp"C:\Users\Admin\AppData\Local\Temp\2035.tmp"69⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\20D1.tmp"C:\Users\Admin\AppData\Local\Temp\20D1.tmp"70⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\215E.tmp"C:\Users\Admin\AppData\Local\Temp\215E.tmp"71⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\21FA.tmp"C:\Users\Admin\AppData\Local\Temp\21FA.tmp"72⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\2277.tmp"C:\Users\Admin\AppData\Local\Temp\2277.tmp"73⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\2304.tmp"C:\Users\Admin\AppData\Local\Temp\2304.tmp"74⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\2371.tmp"C:\Users\Admin\AppData\Local\Temp\2371.tmp"75⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\241D.tmp"C:\Users\Admin\AppData\Local\Temp\241D.tmp"76⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\249A.tmp"C:\Users\Admin\AppData\Local\Temp\249A.tmp"77⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\25A4.tmp"C:\Users\Admin\AppData\Local\Temp\25A4.tmp"78⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\2630.tmp"C:\Users\Admin\AppData\Local\Temp\2630.tmp"79⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\26AD.tmp"C:\Users\Admin\AppData\Local\Temp\26AD.tmp"80⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\271B.tmp"C:\Users\Admin\AppData\Local\Temp\271B.tmp"81⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\27C7.tmp"C:\Users\Admin\AppData\Local\Temp\27C7.tmp"82⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\2863.tmp"C:\Users\Admin\AppData\Local\Temp\2863.tmp"83⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\293E.tmp"C:\Users\Admin\AppData\Local\Temp\293E.tmp"84⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\29CA.tmp"C:\Users\Admin\AppData\Local\Temp\29CA.tmp"85⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\2A57.tmp"C:\Users\Admin\AppData\Local\Temp\2A57.tmp"86⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\2B12.tmp"C:\Users\Admin\AppData\Local\Temp\2B12.tmp"87⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\2BAF.tmp"C:\Users\Admin\AppData\Local\Temp\2BAF.tmp"88⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\2C5A.tmp"C:\Users\Admin\AppData\Local\Temp\2C5A.tmp"89⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\2CF7.tmp"C:\Users\Admin\AppData\Local\Temp\2CF7.tmp"90⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\2D93.tmp"C:\Users\Admin\AppData\Local\Temp\2D93.tmp"91⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\2E2F.tmp"C:\Users\Admin\AppData\Local\Temp\2E2F.tmp"92⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\2EAC.tmp"C:\Users\Admin\AppData\Local\Temp\2EAC.tmp"93⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\2F48.tmp"C:\Users\Admin\AppData\Local\Temp\2F48.tmp"94⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\2FB6.tmp"C:\Users\Admin\AppData\Local\Temp\2FB6.tmp"95⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\3052.tmp"C:\Users\Admin\AppData\Local\Temp\3052.tmp"96⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\30CF.tmp"C:\Users\Admin\AppData\Local\Temp\30CF.tmp"97⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\314C.tmp"C:\Users\Admin\AppData\Local\Temp\314C.tmp"98⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\31F8.tmp"C:\Users\Admin\AppData\Local\Temp\31F8.tmp"99⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\32E2.tmp"C:\Users\Admin\AppData\Local\Temp\32E2.tmp"100⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\336F.tmp"C:\Users\Admin\AppData\Local\Temp\336F.tmp"101⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"102⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"103⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\34F6.tmp"C:\Users\Admin\AppData\Local\Temp\34F6.tmp"104⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\3592.tmp"C:\Users\Admin\AppData\Local\Temp\3592.tmp"105⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\3718.tmp"C:\Users\Admin\AppData\Local\Temp\3718.tmp"106⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\3786.tmp"C:\Users\Admin\AppData\Local\Temp\3786.tmp"107⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\3812.tmp"C:\Users\Admin\AppData\Local\Temp\3812.tmp"108⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\388F.tmp"C:\Users\Admin\AppData\Local\Temp\388F.tmp"109⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\390C.tmp"C:\Users\Admin\AppData\Local\Temp\390C.tmp"110⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\3989.tmp"C:\Users\Admin\AppData\Local\Temp\3989.tmp"111⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\3A35.tmp"C:\Users\Admin\AppData\Local\Temp\3A35.tmp"112⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\3AA3.tmp"C:\Users\Admin\AppData\Local\Temp\3AA3.tmp"113⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\3B4F.tmp"C:\Users\Admin\AppData\Local\Temp\3B4F.tmp"114⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\3BDB.tmp"C:\Users\Admin\AppData\Local\Temp\3BDB.tmp"115⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\3C68.tmp"C:\Users\Admin\AppData\Local\Temp\3C68.tmp"116⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\3D14.tmp"C:\Users\Admin\AppData\Local\Temp\3D14.tmp"117⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\3D91.tmp"C:\Users\Admin\AppData\Local\Temp\3D91.tmp"118⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\3E1D.tmp"C:\Users\Admin\AppData\Local\Temp\3E1D.tmp"119⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\3EBA.tmp"C:\Users\Admin\AppData\Local\Temp\3EBA.tmp"120⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\3F46.tmp"C:\Users\Admin\AppData\Local\Temp\3F46.tmp"121⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\3FF2.tmp"C:\Users\Admin\AppData\Local\Temp\3FF2.tmp"122⤵PID:5024
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-