Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18/04/2024, 18:57
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-18_67662be4c708150e64a5eb2477800db4_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-18_67662be4c708150e64a5eb2477800db4_mafia.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-18_67662be4c708150e64a5eb2477800db4_mafia.exe
-
Size
536KB
-
MD5
67662be4c708150e64a5eb2477800db4
-
SHA1
6a7b6e386cfd5803a3ec327bfb31ad1f9ca2963f
-
SHA256
adbffad102f40ff5721e0bef209453286a7aa2ea336571491a2373f80aab7594
-
SHA512
625f8f44837fc8624ee62fbca2f4a81473d66f47c411afcbc8a0377c59df015b4a7c5a7bfd3643a254a091dec5015897dd5e4fb203af14e55adc6a4d1311310d
-
SSDEEP
12288:wU5rCOTeiUcvNFjWelMaefpeTUMQGMOwWvmf+pKIZxVJ0ZT9:wUQOJUMFSelFeBQUMtWWvE+gIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3588 D040.tmp 4332 D0EC.tmp 1216 D14A.tmp 2812 D234.tmp 1348 D2F0.tmp 4048 D35D.tmp 1044 D3DA.tmp 1760 D457.tmp 4676 D4C5.tmp 4216 D532.tmp 3380 D5BF.tmp 4376 D61C.tmp 1556 D6B9.tmp 544 D755.tmp 228 D7C2.tmp 3772 D84F.tmp 1716 D8DB.tmp 2052 D958.tmp 2304 D9E5.tmp 3512 DA81.tmp 2860 DAEF.tmp 4476 DB5C.tmp 4352 DBC9.tmp 1752 DC46.tmp 1492 DCB4.tmp 5080 DD21.tmp 4496 DD8F.tmp 1472 DDFC.tmp 2660 DE98.tmp 5016 DF34.tmp 920 DFD1.tmp 4588 E02E.tmp 668 E0DA.tmp 4440 E128.tmp 4320 E177.tmp 2848 E1C5.tmp 2176 E213.tmp 5088 E261.tmp 4392 E2BF.tmp 3504 E30D.tmp 716 E35B.tmp 4428 E3A9.tmp 2324 E407.tmp 4420 E455.tmp 2772 E4B3.tmp 3384 E501.tmp 4404 E55F.tmp 2460 E5AD.tmp 860 E5FB.tmp 3904 E649.tmp 4752 E6A7.tmp 1600 E6F5.tmp 4696 E753.tmp 5060 E7A1.tmp 924 E7EF.tmp 3408 E83D.tmp 624 E88B.tmp 4432 E8D9.tmp 4376 E927.tmp 628 E985.tmp 544 E9D3.tmp 968 EA21.tmp 4028 EA6F.tmp 2284 EACD.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2864 wrote to memory of 3588 2864 2024-04-18_67662be4c708150e64a5eb2477800db4_mafia.exe 87 PID 2864 wrote to memory of 3588 2864 2024-04-18_67662be4c708150e64a5eb2477800db4_mafia.exe 87 PID 2864 wrote to memory of 3588 2864 2024-04-18_67662be4c708150e64a5eb2477800db4_mafia.exe 87 PID 3588 wrote to memory of 4332 3588 D040.tmp 88 PID 3588 wrote to memory of 4332 3588 D040.tmp 88 PID 3588 wrote to memory of 4332 3588 D040.tmp 88 PID 4332 wrote to memory of 1216 4332 D0EC.tmp 89 PID 4332 wrote to memory of 1216 4332 D0EC.tmp 89 PID 4332 wrote to memory of 1216 4332 D0EC.tmp 89 PID 1216 wrote to memory of 2812 1216 D14A.tmp 90 PID 1216 wrote to memory of 2812 1216 D14A.tmp 90 PID 1216 wrote to memory of 2812 1216 D14A.tmp 90 PID 2812 wrote to memory of 1348 2812 D234.tmp 91 PID 2812 wrote to memory of 1348 2812 D234.tmp 91 PID 2812 wrote to memory of 1348 2812 D234.tmp 91 PID 1348 wrote to memory of 4048 1348 D2F0.tmp 92 PID 1348 wrote to memory of 4048 1348 D2F0.tmp 92 PID 1348 wrote to memory of 4048 1348 D2F0.tmp 92 PID 4048 wrote to memory of 1044 4048 D35D.tmp 93 PID 4048 wrote to memory of 1044 4048 D35D.tmp 93 PID 4048 wrote to memory of 1044 4048 D35D.tmp 93 PID 1044 wrote to memory of 1760 1044 D3DA.tmp 94 PID 1044 wrote to memory of 1760 1044 D3DA.tmp 94 PID 1044 wrote to memory of 1760 1044 D3DA.tmp 94 PID 1760 wrote to memory of 4676 1760 D457.tmp 95 PID 1760 wrote to memory of 4676 1760 D457.tmp 95 PID 1760 wrote to memory of 4676 1760 D457.tmp 95 PID 4676 wrote to memory of 4216 4676 D4C5.tmp 96 PID 4676 wrote to memory of 4216 4676 D4C5.tmp 96 PID 4676 wrote to memory of 4216 4676 D4C5.tmp 96 PID 4216 wrote to memory of 3380 4216 D532.tmp 97 PID 4216 wrote to memory of 3380 4216 D532.tmp 97 PID 4216 wrote to memory of 3380 4216 D532.tmp 97 PID 3380 wrote to memory of 4376 3380 D5BF.tmp 98 PID 3380 wrote to memory of 4376 3380 D5BF.tmp 98 PID 3380 wrote to memory of 4376 3380 D5BF.tmp 98 PID 4376 wrote to memory of 1556 4376 D61C.tmp 99 PID 4376 wrote to memory of 1556 4376 D61C.tmp 99 PID 4376 wrote to memory of 1556 4376 D61C.tmp 99 PID 1556 wrote to memory of 544 1556 D6B9.tmp 100 PID 1556 wrote to memory of 544 1556 D6B9.tmp 100 PID 1556 wrote to memory of 544 1556 D6B9.tmp 100 PID 544 wrote to memory of 228 544 D755.tmp 101 PID 544 wrote to memory of 228 544 D755.tmp 101 PID 544 wrote to memory of 228 544 D755.tmp 101 PID 228 wrote to memory of 3772 228 D7C2.tmp 102 PID 228 wrote to memory of 3772 228 D7C2.tmp 102 PID 228 wrote to memory of 3772 228 D7C2.tmp 102 PID 3772 wrote to memory of 1716 3772 D84F.tmp 103 PID 3772 wrote to memory of 1716 3772 D84F.tmp 103 PID 3772 wrote to memory of 1716 3772 D84F.tmp 103 PID 1716 wrote to memory of 2052 1716 D8DB.tmp 104 PID 1716 wrote to memory of 2052 1716 D8DB.tmp 104 PID 1716 wrote to memory of 2052 1716 D8DB.tmp 104 PID 2052 wrote to memory of 2304 2052 D958.tmp 105 PID 2052 wrote to memory of 2304 2052 D958.tmp 105 PID 2052 wrote to memory of 2304 2052 D958.tmp 105 PID 2304 wrote to memory of 3512 2304 D9E5.tmp 106 PID 2304 wrote to memory of 3512 2304 D9E5.tmp 106 PID 2304 wrote to memory of 3512 2304 D9E5.tmp 106 PID 3512 wrote to memory of 2860 3512 DA81.tmp 107 PID 3512 wrote to memory of 2860 3512 DA81.tmp 107 PID 3512 wrote to memory of 2860 3512 DA81.tmp 107 PID 2860 wrote to memory of 4476 2860 DAEF.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-18_67662be4c708150e64a5eb2477800db4_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-18_67662be4c708150e64a5eb2477800db4_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\D040.tmp"C:\Users\Admin\AppData\Local\Temp\D040.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\D14A.tmp"C:\Users\Admin\AppData\Local\Temp\D14A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\D234.tmp"C:\Users\Admin\AppData\Local\Temp\D234.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\D35D.tmp"C:\Users\Admin\AppData\Local\Temp\D35D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\D3DA.tmp"C:\Users\Admin\AppData\Local\Temp\D3DA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\D457.tmp"C:\Users\Admin\AppData\Local\Temp\D457.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\D4C5.tmp"C:\Users\Admin\AppData\Local\Temp\D4C5.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\D532.tmp"C:\Users\Admin\AppData\Local\Temp\D532.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\D5BF.tmp"C:\Users\Admin\AppData\Local\Temp\D5BF.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\D61C.tmp"C:\Users\Admin\AppData\Local\Temp\D61C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\D6B9.tmp"C:\Users\Admin\AppData\Local\Temp\D6B9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\D755.tmp"C:\Users\Admin\AppData\Local\Temp\D755.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Users\Admin\AppData\Local\Temp\D7C2.tmp"C:\Users\Admin\AppData\Local\Temp\D7C2.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\D84F.tmp"C:\Users\Admin\AppData\Local\Temp\D84F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\D958.tmp"C:\Users\Admin\AppData\Local\Temp\D958.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\D9E5.tmp"C:\Users\Admin\AppData\Local\Temp\D9E5.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\DA81.tmp"C:\Users\Admin\AppData\Local\Temp\DA81.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\DAEF.tmp"C:\Users\Admin\AppData\Local\Temp\DAEF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"23⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"24⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\DC46.tmp"C:\Users\Admin\AppData\Local\Temp\DC46.tmp"25⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"26⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\DD21.tmp"C:\Users\Admin\AppData\Local\Temp\DD21.tmp"27⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\DD8F.tmp"C:\Users\Admin\AppData\Local\Temp\DD8F.tmp"28⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"29⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\DE98.tmp"C:\Users\Admin\AppData\Local\Temp\DE98.tmp"30⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\DF34.tmp"C:\Users\Admin\AppData\Local\Temp\DF34.tmp"31⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"32⤵
- Executes dropped EXE
PID:920 -
C:\Users\Admin\AppData\Local\Temp\E02E.tmp"C:\Users\Admin\AppData\Local\Temp\E02E.tmp"33⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"34⤵
- Executes dropped EXE
PID:668 -
C:\Users\Admin\AppData\Local\Temp\E128.tmp"C:\Users\Admin\AppData\Local\Temp\E128.tmp"35⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\E177.tmp"C:\Users\Admin\AppData\Local\Temp\E177.tmp"36⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"37⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\E213.tmp"C:\Users\Admin\AppData\Local\Temp\E213.tmp"38⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\E261.tmp"C:\Users\Admin\AppData\Local\Temp\E261.tmp"39⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"40⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\E30D.tmp"C:\Users\Admin\AppData\Local\Temp\E30D.tmp"41⤵
- Executes dropped EXE
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\E35B.tmp"C:\Users\Admin\AppData\Local\Temp\E35B.tmp"42⤵
- Executes dropped EXE
PID:716 -
C:\Users\Admin\AppData\Local\Temp\E3A9.tmp"C:\Users\Admin\AppData\Local\Temp\E3A9.tmp"43⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\E407.tmp"C:\Users\Admin\AppData\Local\Temp\E407.tmp"44⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\E455.tmp"C:\Users\Admin\AppData\Local\Temp\E455.tmp"45⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\E4B3.tmp"C:\Users\Admin\AppData\Local\Temp\E4B3.tmp"46⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\E501.tmp"C:\Users\Admin\AppData\Local\Temp\E501.tmp"47⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\E55F.tmp"C:\Users\Admin\AppData\Local\Temp\E55F.tmp"48⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"49⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"50⤵
- Executes dropped EXE
PID:860 -
C:\Users\Admin\AppData\Local\Temp\E649.tmp"C:\Users\Admin\AppData\Local\Temp\E649.tmp"51⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"52⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"53⤵
- Executes dropped EXE
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\E753.tmp"C:\Users\Admin\AppData\Local\Temp\E753.tmp"54⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"55⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"56⤵
- Executes dropped EXE
PID:924 -
C:\Users\Admin\AppData\Local\Temp\E83D.tmp"C:\Users\Admin\AppData\Local\Temp\E83D.tmp"57⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\E88B.tmp"C:\Users\Admin\AppData\Local\Temp\E88B.tmp"58⤵
- Executes dropped EXE
PID:624 -
C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"59⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\E927.tmp"C:\Users\Admin\AppData\Local\Temp\E927.tmp"60⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\E985.tmp"C:\Users\Admin\AppData\Local\Temp\E985.tmp"61⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"62⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\EA21.tmp"C:\Users\Admin\AppData\Local\Temp\EA21.tmp"63⤵
- Executes dropped EXE
PID:968 -
C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"64⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\EACD.tmp"C:\Users\Admin\AppData\Local\Temp\EACD.tmp"65⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\EB2B.tmp"C:\Users\Admin\AppData\Local\Temp\EB2B.tmp"66⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\EB79.tmp"C:\Users\Admin\AppData\Local\Temp\EB79.tmp"67⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\EBC7.tmp"C:\Users\Admin\AppData\Local\Temp\EBC7.tmp"68⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\EC15.tmp"C:\Users\Admin\AppData\Local\Temp\EC15.tmp"69⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\EC73.tmp"C:\Users\Admin\AppData\Local\Temp\EC73.tmp"70⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"71⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"72⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\ED7D.tmp"C:\Users\Admin\AppData\Local\Temp\ED7D.tmp"73⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\EDCB.tmp"C:\Users\Admin\AppData\Local\Temp\EDCB.tmp"74⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\EE19.tmp"C:\Users\Admin\AppData\Local\Temp\EE19.tmp"75⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\EE67.tmp"C:\Users\Admin\AppData\Local\Temp\EE67.tmp"76⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\EEC5.tmp"C:\Users\Admin\AppData\Local\Temp\EEC5.tmp"77⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\EF13.tmp"C:\Users\Admin\AppData\Local\Temp\EF13.tmp"78⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\EF61.tmp"C:\Users\Admin\AppData\Local\Temp\EF61.tmp"79⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\EFAF.tmp"C:\Users\Admin\AppData\Local\Temp\EFAF.tmp"80⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"81⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\F04B.tmp"C:\Users\Admin\AppData\Local\Temp\F04B.tmp"82⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\F09A.tmp"C:\Users\Admin\AppData\Local\Temp\F09A.tmp"83⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\F0F7.tmp"C:\Users\Admin\AppData\Local\Temp\F0F7.tmp"84⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\F145.tmp"C:\Users\Admin\AppData\Local\Temp\F145.tmp"85⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\F194.tmp"C:\Users\Admin\AppData\Local\Temp\F194.tmp"86⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\F1E2.tmp"C:\Users\Admin\AppData\Local\Temp\F1E2.tmp"87⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\F23F.tmp"C:\Users\Admin\AppData\Local\Temp\F23F.tmp"88⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\F29D.tmp"C:\Users\Admin\AppData\Local\Temp\F29D.tmp"89⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\F2EB.tmp"C:\Users\Admin\AppData\Local\Temp\F2EB.tmp"90⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\F339.tmp"C:\Users\Admin\AppData\Local\Temp\F339.tmp"91⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\F3A7.tmp"C:\Users\Admin\AppData\Local\Temp\F3A7.tmp"92⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\F405.tmp"C:\Users\Admin\AppData\Local\Temp\F405.tmp"93⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\F482.tmp"C:\Users\Admin\AppData\Local\Temp\F482.tmp"94⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"95⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\F51E.tmp"C:\Users\Admin\AppData\Local\Temp\F51E.tmp"96⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\F57C.tmp"C:\Users\Admin\AppData\Local\Temp\F57C.tmp"97⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"98⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\F656.tmp"C:\Users\Admin\AppData\Local\Temp\F656.tmp"99⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"100⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\F712.tmp"C:\Users\Admin\AppData\Local\Temp\F712.tmp"101⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\F78F.tmp"C:\Users\Admin\AppData\Local\Temp\F78F.tmp"102⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"103⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\F82B.tmp"C:\Users\Admin\AppData\Local\Temp\F82B.tmp"104⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\F879.tmp"C:\Users\Admin\AppData\Local\Temp\F879.tmp"105⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\F8C7.tmp"C:\Users\Admin\AppData\Local\Temp\F8C7.tmp"106⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\F925.tmp"C:\Users\Admin\AppData\Local\Temp\F925.tmp"107⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\F973.tmp"C:\Users\Admin\AppData\Local\Temp\F973.tmp"108⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\F9C1.tmp"C:\Users\Admin\AppData\Local\Temp\F9C1.tmp"109⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\FA0F.tmp"C:\Users\Admin\AppData\Local\Temp\FA0F.tmp"110⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"111⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\FABB.tmp"C:\Users\Admin\AppData\Local\Temp\FABB.tmp"112⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\FB09.tmp"C:\Users\Admin\AppData\Local\Temp\FB09.tmp"113⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\FB58.tmp"C:\Users\Admin\AppData\Local\Temp\FB58.tmp"114⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"115⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"116⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\FC42.tmp"C:\Users\Admin\AppData\Local\Temp\FC42.tmp"117⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\FC90.tmp"C:\Users\Admin\AppData\Local\Temp\FC90.tmp"118⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\FCDE.tmp"C:\Users\Admin\AppData\Local\Temp\FCDE.tmp"119⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"120⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\FD8A.tmp"C:\Users\Admin\AppData\Local\Temp\FD8A.tmp"121⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"122⤵PID:3980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-