Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2024, 18:31
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-17_a55ee48c98c13b4bc83fe99e428f1259_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-17_a55ee48c98c13b4bc83fe99e428f1259_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-17_a55ee48c98c13b4bc83fe99e428f1259_mafia.exe
-
Size
486KB
-
MD5
a55ee48c98c13b4bc83fe99e428f1259
-
SHA1
31b9ee53b4fd74f15f85ee115ab0580a7ba60508
-
SHA256
a5e5246b6fa4e7023228f353ef03f28b01b4e68ef3cb8e362bf302a139f110ac
-
SHA512
469cef8a48b168406fa7a2f2e9301f27cb8f1f6d882e0b97be990137702bbabdacb79f541976a7b434085fb259522be0258a4c3ca377d7b9dd561a429d6a4322
-
SSDEEP
6144:Forf3lPvovsgZnqG2C7mOTeiLfD7dcOex0XC5xhs+mZP0/HN8p+HHlFhxpKPDl4s:UU5rCOTeiDd7dXC5k+06oiHNmuouINZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3856 F55C.tmp 5092 F5CA.tmp 2644 F627.tmp 2064 F6A4.tmp 4320 F721.tmp 760 F78F.tmp 1060 F7DD.tmp 2596 F83B.tmp 4688 F898.tmp 824 F8E7.tmp 1488 F954.tmp 4528 F9D1.tmp 1120 FA3E.tmp 980 FABB.tmp 1668 FB19.tmp 2104 FB77.tmp 4396 FBC5.tmp 3096 FC42.tmp 3352 FCA0.tmp 3228 FCFD.tmp 4576 FD4C.tmp 4372 FDB9.tmp 3108 FE26.tmp 2412 FE94.tmp 3500 FEE2.tmp 4168 FF5F.tmp 4904 FFDC.tmp 4044 59.tmp 2064 A7.tmp 3320 105.tmp 3708 162.tmp 3112 1B1.tmp 3496 1FF.tmp 4424 24D.tmp 3680 28B.tmp 1836 2E9.tmp 3988 337.tmp 4528 385.tmp 1264 3D3.tmp 4760 431.tmp 4888 48F.tmp 3148 4DD.tmp 232 52B.tmp 1468 589.tmp 1296 5D7.tmp 1048 635.tmp 3036 683.tmp 3736 6E1.tmp 4576 72F.tmp 3312 77D.tmp 1384 7DB.tmp 2488 829.tmp 4340 877.tmp 2772 8D5.tmp 4856 923.tmp 4836 981.tmp 4800 9DE.tmp 3508 A3C.tmp 4200 A9A.tmp 2188 AF8.tmp 1280 B55.tmp 912 BA3.tmp 1000 C01.tmp 4336 C5F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2244 wrote to memory of 3856 2244 2024-05-17_a55ee48c98c13b4bc83fe99e428f1259_mafia.exe 90 PID 2244 wrote to memory of 3856 2244 2024-05-17_a55ee48c98c13b4bc83fe99e428f1259_mafia.exe 90 PID 2244 wrote to memory of 3856 2244 2024-05-17_a55ee48c98c13b4bc83fe99e428f1259_mafia.exe 90 PID 3856 wrote to memory of 5092 3856 F55C.tmp 91 PID 3856 wrote to memory of 5092 3856 F55C.tmp 91 PID 3856 wrote to memory of 5092 3856 F55C.tmp 91 PID 5092 wrote to memory of 2644 5092 F5CA.tmp 92 PID 5092 wrote to memory of 2644 5092 F5CA.tmp 92 PID 5092 wrote to memory of 2644 5092 F5CA.tmp 92 PID 2644 wrote to memory of 2064 2644 F627.tmp 94 PID 2644 wrote to memory of 2064 2644 F627.tmp 94 PID 2644 wrote to memory of 2064 2644 F627.tmp 94 PID 2064 wrote to memory of 4320 2064 F6A4.tmp 96 PID 2064 wrote to memory of 4320 2064 F6A4.tmp 96 PID 2064 wrote to memory of 4320 2064 F6A4.tmp 96 PID 4320 wrote to memory of 760 4320 F721.tmp 97 PID 4320 wrote to memory of 760 4320 F721.tmp 97 PID 4320 wrote to memory of 760 4320 F721.tmp 97 PID 760 wrote to memory of 1060 760 F78F.tmp 99 PID 760 wrote to memory of 1060 760 F78F.tmp 99 PID 760 wrote to memory of 1060 760 F78F.tmp 99 PID 1060 wrote to memory of 2596 1060 F7DD.tmp 100 PID 1060 wrote to memory of 2596 1060 F7DD.tmp 100 PID 1060 wrote to memory of 2596 1060 F7DD.tmp 100 PID 2596 wrote to memory of 4688 2596 F83B.tmp 101 PID 2596 wrote to memory of 4688 2596 F83B.tmp 101 PID 2596 wrote to memory of 4688 2596 F83B.tmp 101 PID 4688 wrote to memory of 824 4688 F898.tmp 102 PID 4688 wrote to memory of 824 4688 F898.tmp 102 PID 4688 wrote to memory of 824 4688 F898.tmp 102 PID 824 wrote to memory of 1488 824 F8E7.tmp 103 PID 824 wrote to memory of 1488 824 F8E7.tmp 103 PID 824 wrote to memory of 1488 824 F8E7.tmp 103 PID 1488 wrote to memory of 4528 1488 F954.tmp 104 PID 1488 wrote to memory of 4528 1488 F954.tmp 104 PID 1488 wrote to memory of 4528 1488 F954.tmp 104 PID 4528 wrote to memory of 1120 4528 F9D1.tmp 105 PID 4528 wrote to memory of 1120 4528 F9D1.tmp 105 PID 4528 wrote to memory of 1120 4528 F9D1.tmp 105 PID 1120 wrote to memory of 980 1120 FA3E.tmp 106 PID 1120 wrote to memory of 980 1120 FA3E.tmp 106 PID 1120 wrote to memory of 980 1120 FA3E.tmp 106 PID 980 wrote to memory of 1668 980 FABB.tmp 107 PID 980 wrote to memory of 1668 980 FABB.tmp 107 PID 980 wrote to memory of 1668 980 FABB.tmp 107 PID 1668 wrote to memory of 2104 1668 FB19.tmp 108 PID 1668 wrote to memory of 2104 1668 FB19.tmp 108 PID 1668 wrote to memory of 2104 1668 FB19.tmp 108 PID 2104 wrote to memory of 4396 2104 FB77.tmp 109 PID 2104 wrote to memory of 4396 2104 FB77.tmp 109 PID 2104 wrote to memory of 4396 2104 FB77.tmp 109 PID 4396 wrote to memory of 3096 4396 FBC5.tmp 110 PID 4396 wrote to memory of 3096 4396 FBC5.tmp 110 PID 4396 wrote to memory of 3096 4396 FBC5.tmp 110 PID 3096 wrote to memory of 3352 3096 FC42.tmp 111 PID 3096 wrote to memory of 3352 3096 FC42.tmp 111 PID 3096 wrote to memory of 3352 3096 FC42.tmp 111 PID 3352 wrote to memory of 3228 3352 FCA0.tmp 112 PID 3352 wrote to memory of 3228 3352 FCA0.tmp 112 PID 3352 wrote to memory of 3228 3352 FCA0.tmp 112 PID 3228 wrote to memory of 4576 3228 FCFD.tmp 114 PID 3228 wrote to memory of 4576 3228 FCFD.tmp 114 PID 3228 wrote to memory of 4576 3228 FCFD.tmp 114 PID 4576 wrote to memory of 4372 4576 FD4C.tmp 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-17_a55ee48c98c13b4bc83fe99e428f1259_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-17_a55ee48c98c13b4bc83fe99e428f1259_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\F55C.tmp"C:\Users\Admin\AppData\Local\Temp\F55C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\F627.tmp"C:\Users\Admin\AppData\Local\Temp\F627.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\F721.tmp"C:\Users\Admin\AppData\Local\Temp\F721.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\F78F.tmp"C:\Users\Admin\AppData\Local\Temp\F78F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\F83B.tmp"C:\Users\Admin\AppData\Local\Temp\F83B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\F898.tmp"C:\Users\Admin\AppData\Local\Temp\F898.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\F954.tmp"C:\Users\Admin\AppData\Local\Temp\F954.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\FA3E.tmp"C:\Users\Admin\AppData\Local\Temp\FA3E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\FABB.tmp"C:\Users\Admin\AppData\Local\Temp\FABB.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\FB19.tmp"C:\Users\Admin\AppData\Local\Temp\FB19.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\FB77.tmp"C:\Users\Admin\AppData\Local\Temp\FB77.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\FC42.tmp"C:\Users\Admin\AppData\Local\Temp\FC42.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\FCFD.tmp"C:\Users\Admin\AppData\Local\Temp\FCFD.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\FD4C.tmp"C:\Users\Admin\AppData\Local\Temp\FD4C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\FDB9.tmp"C:\Users\Admin\AppData\Local\Temp\FDB9.tmp"23⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\FE26.tmp"C:\Users\Admin\AppData\Local\Temp\FE26.tmp"24⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\FE94.tmp"C:\Users\Admin\AppData\Local\Temp\FE94.tmp"25⤵
- Executes dropped EXE
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\FEE2.tmp"C:\Users\Admin\AppData\Local\Temp\FEE2.tmp"26⤵
- Executes dropped EXE
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\FF5F.tmp"C:\Users\Admin\AppData\Local\Temp\FF5F.tmp"27⤵
- Executes dropped EXE
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"28⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\59.tmp"C:\Users\Admin\AppData\Local\Temp\59.tmp"29⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\A7.tmp"C:\Users\Admin\AppData\Local\Temp\A7.tmp"30⤵
- Executes dropped EXE
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\105.tmp"C:\Users\Admin\AppData\Local\Temp\105.tmp"31⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\162.tmp"C:\Users\Admin\AppData\Local\Temp\162.tmp"32⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\1B1.tmp"C:\Users\Admin\AppData\Local\Temp\1B1.tmp"33⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\1FF.tmp"C:\Users\Admin\AppData\Local\Temp\1FF.tmp"34⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\24D.tmp"C:\Users\Admin\AppData\Local\Temp\24D.tmp"35⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\28B.tmp"C:\Users\Admin\AppData\Local\Temp\28B.tmp"36⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\2E9.tmp"C:\Users\Admin\AppData\Local\Temp\2E9.tmp"37⤵
- Executes dropped EXE
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\337.tmp"C:\Users\Admin\AppData\Local\Temp\337.tmp"38⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\385.tmp"C:\Users\Admin\AppData\Local\Temp\385.tmp"39⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\3D3.tmp"C:\Users\Admin\AppData\Local\Temp\3D3.tmp"40⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\431.tmp"C:\Users\Admin\AppData\Local\Temp\431.tmp"41⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\48F.tmp"C:\Users\Admin\AppData\Local\Temp\48F.tmp"42⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\4DD.tmp"C:\Users\Admin\AppData\Local\Temp\4DD.tmp"43⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\52B.tmp"C:\Users\Admin\AppData\Local\Temp\52B.tmp"44⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\589.tmp"C:\Users\Admin\AppData\Local\Temp\589.tmp"45⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\5D7.tmp"C:\Users\Admin\AppData\Local\Temp\5D7.tmp"46⤵
- Executes dropped EXE
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\635.tmp"C:\Users\Admin\AppData\Local\Temp\635.tmp"47⤵
- Executes dropped EXE
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\683.tmp"C:\Users\Admin\AppData\Local\Temp\683.tmp"48⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\6E1.tmp"C:\Users\Admin\AppData\Local\Temp\6E1.tmp"49⤵
- Executes dropped EXE
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\72F.tmp"C:\Users\Admin\AppData\Local\Temp\72F.tmp"50⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\77D.tmp"C:\Users\Admin\AppData\Local\Temp\77D.tmp"51⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\7DB.tmp"C:\Users\Admin\AppData\Local\Temp\7DB.tmp"52⤵
- Executes dropped EXE
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\829.tmp"C:\Users\Admin\AppData\Local\Temp\829.tmp"53⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\877.tmp"C:\Users\Admin\AppData\Local\Temp\877.tmp"54⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\8D5.tmp"C:\Users\Admin\AppData\Local\Temp\8D5.tmp"55⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\923.tmp"C:\Users\Admin\AppData\Local\Temp\923.tmp"56⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\981.tmp"C:\Users\Admin\AppData\Local\Temp\981.tmp"57⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\9DE.tmp"C:\Users\Admin\AppData\Local\Temp\9DE.tmp"58⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\A3C.tmp"C:\Users\Admin\AppData\Local\Temp\A3C.tmp"59⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\A9A.tmp"C:\Users\Admin\AppData\Local\Temp\A9A.tmp"60⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\AF8.tmp"C:\Users\Admin\AppData\Local\Temp\AF8.tmp"61⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\B55.tmp"C:\Users\Admin\AppData\Local\Temp\B55.tmp"62⤵
- Executes dropped EXE
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\BA3.tmp"C:\Users\Admin\AppData\Local\Temp\BA3.tmp"63⤵
- Executes dropped EXE
PID:912 -
C:\Users\Admin\AppData\Local\Temp\C01.tmp"C:\Users\Admin\AppData\Local\Temp\C01.tmp"64⤵
- Executes dropped EXE
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\C5F.tmp"C:\Users\Admin\AppData\Local\Temp\C5F.tmp"65⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\CBD.tmp"C:\Users\Admin\AppData\Local\Temp\CBD.tmp"66⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\D1A.tmp"C:\Users\Admin\AppData\Local\Temp\D1A.tmp"67⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\D69.tmp"C:\Users\Admin\AppData\Local\Temp\D69.tmp"68⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\DC6.tmp"C:\Users\Admin\AppData\Local\Temp\DC6.tmp"69⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"70⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\E82.tmp"C:\Users\Admin\AppData\Local\Temp\E82.tmp"71⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"72⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\F2E.tmp"C:\Users\Admin\AppData\Local\Temp\F2E.tmp"73⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"74⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\FE9.tmp"C:\Users\Admin\AppData\Local\Temp\FE9.tmp"75⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\1047.tmp"C:\Users\Admin\AppData\Local\Temp\1047.tmp"76⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\10A5.tmp"C:\Users\Admin\AppData\Local\Temp\10A5.tmp"77⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\1102.tmp"C:\Users\Admin\AppData\Local\Temp\1102.tmp"78⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\1160.tmp"C:\Users\Admin\AppData\Local\Temp\1160.tmp"79⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\11BE.tmp"C:\Users\Admin\AppData\Local\Temp\11BE.tmp"80⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\121C.tmp"C:\Users\Admin\AppData\Local\Temp\121C.tmp"81⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\1279.tmp"C:\Users\Admin\AppData\Local\Temp\1279.tmp"82⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\12D7.tmp"C:\Users\Admin\AppData\Local\Temp\12D7.tmp"83⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\1325.tmp"C:\Users\Admin\AppData\Local\Temp\1325.tmp"84⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\1383.tmp"C:\Users\Admin\AppData\Local\Temp\1383.tmp"85⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\13E1.tmp"C:\Users\Admin\AppData\Local\Temp\13E1.tmp"86⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\143F.tmp"C:\Users\Admin\AppData\Local\Temp\143F.tmp"87⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\149C.tmp"C:\Users\Admin\AppData\Local\Temp\149C.tmp"88⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\14FA.tmp"C:\Users\Admin\AppData\Local\Temp\14FA.tmp"89⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\1558.tmp"C:\Users\Admin\AppData\Local\Temp\1558.tmp"90⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\15B6.tmp"C:\Users\Admin\AppData\Local\Temp\15B6.tmp"91⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\1613.tmp"C:\Users\Admin\AppData\Local\Temp\1613.tmp"92⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\1671.tmp"C:\Users\Admin\AppData\Local\Temp\1671.tmp"93⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\16CF.tmp"C:\Users\Admin\AppData\Local\Temp\16CF.tmp"94⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\171D.tmp"C:\Users\Admin\AppData\Local\Temp\171D.tmp"95⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\177B.tmp"C:\Users\Admin\AppData\Local\Temp\177B.tmp"96⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\17D8.tmp"C:\Users\Admin\AppData\Local\Temp\17D8.tmp"97⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\1836.tmp"C:\Users\Admin\AppData\Local\Temp\1836.tmp"98⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\1884.tmp"C:\Users\Admin\AppData\Local\Temp\1884.tmp"99⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\18D2.tmp"C:\Users\Admin\AppData\Local\Temp\18D2.tmp"100⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\1921.tmp"C:\Users\Admin\AppData\Local\Temp\1921.tmp"101⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\197E.tmp"C:\Users\Admin\AppData\Local\Temp\197E.tmp"102⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\19DC.tmp"C:\Users\Admin\AppData\Local\Temp\19DC.tmp"103⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\1A2A.tmp"C:\Users\Admin\AppData\Local\Temp\1A2A.tmp"104⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\1A78.tmp"C:\Users\Admin\AppData\Local\Temp\1A78.tmp"105⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\1AD6.tmp"C:\Users\Admin\AppData\Local\Temp\1AD6.tmp"106⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\1B24.tmp"C:\Users\Admin\AppData\Local\Temp\1B24.tmp"107⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\1B82.tmp"C:\Users\Admin\AppData\Local\Temp\1B82.tmp"108⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"109⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\1C3D.tmp"C:\Users\Admin\AppData\Local\Temp\1C3D.tmp"110⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\1C8C.tmp"C:\Users\Admin\AppData\Local\Temp\1C8C.tmp"111⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\1CE9.tmp"C:\Users\Admin\AppData\Local\Temp\1CE9.tmp"112⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\1D37.tmp"C:\Users\Admin\AppData\Local\Temp\1D37.tmp"113⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\1D86.tmp"C:\Users\Admin\AppData\Local\Temp\1D86.tmp"114⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"115⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\1E31.tmp"C:\Users\Admin\AppData\Local\Temp\1E31.tmp"116⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\1E80.tmp"C:\Users\Admin\AppData\Local\Temp\1E80.tmp"117⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\1ECE.tmp"C:\Users\Admin\AppData\Local\Temp\1ECE.tmp"118⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\1F2B.tmp"C:\Users\Admin\AppData\Local\Temp\1F2B.tmp"119⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\1F7A.tmp"C:\Users\Admin\AppData\Local\Temp\1F7A.tmp"120⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\1FC8.tmp"C:\Users\Admin\AppData\Local\Temp\1FC8.tmp"121⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\2016.tmp"C:\Users\Admin\AppData\Local\Temp\2016.tmp"122⤵PID:3108
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-