Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
21/05/2024, 02:29
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-21_81e728717f96509e7133c43643f50bfc_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-21_81e728717f96509e7133c43643f50bfc_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-05-21_81e728717f96509e7133c43643f50bfc_mafia.exe
-
Size
530KB
-
MD5
81e728717f96509e7133c43643f50bfc
-
SHA1
f4cf6bd9d089c78b3244cd7ef2dde67877a29829
-
SHA256
431d7e16b9591e2beed53b3c0794b44f5d184e2c01a60161db79f50a27a77012
-
SHA512
ce69565ef9921de1731b0bb760a37581f0d98c82068a9899c3a0e5f1117901efb54569dd91e6a7f915844df855c88ed192cd24935bb3f435b73c41f93929e090
-
SSDEEP
12288:AU5rCOTeiozSxu5gT54a/cxSIROuNZulFVg0M1:AUQOJoz0ui53/aTUuNclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3124 B7E6.tmp 2916 B8FF.tmp 3092 BAC4.tmp 3548 BBCE.tmp 1052 BCD8.tmp 3880 BD55.tmp 2084 BDC2.tmp 3984 BE3F.tmp 4664 BECC.tmp 2328 BF68.tmp 3848 C052.tmp 3564 C0EE.tmp 3636 C1E8.tmp 4756 C2A4.tmp 5088 C39E.tmp 1696 C40B.tmp 4804 C4B7.tmp 3128 C563.tmp 3160 C5C1.tmp 4456 C63E.tmp 2172 C728.tmp 2004 C8AF.tmp 4884 C91C.tmp 4512 C9A9.tmp 4208 CAC2.tmp 2784 CB9D.tmp 2012 CC1A.tmp 1212 CDEF.tmp 4328 CE6C.tmp 2764 CF75.tmp 1372 CFE3.tmp 5092 D040.tmp 2432 D0AE.tmp 3740 D12B.tmp 2968 D254.tmp 4284 D2C1.tmp 5000 D34E.tmp 3952 D3AB.tmp 1568 D419.tmp 2528 D4A5.tmp 1704 D522.tmp 4180 D580.tmp 3124 D5DE.tmp 452 D68A.tmp 1344 D6F7.tmp 3860 D774.tmp 3892 D7E1.tmp 4940 D83F.tmp 2876 D8BC.tmp 3828 D91A.tmp 3504 D978.tmp 2116 D9D5.tmp 4452 DA91.tmp 3984 DAFE.tmp 680 DB5C.tmp 4140 DBC9.tmp 3344 DC85.tmp 1104 DCE3.tmp 2844 DD40.tmp 1124 DDAE.tmp 4604 DE3A.tmp 4860 DEB7.tmp 4952 DF25.tmp 1060 E186.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1704 wrote to memory of 3124 1704 2024-05-21_81e728717f96509e7133c43643f50bfc_mafia.exe 133 PID 1704 wrote to memory of 3124 1704 2024-05-21_81e728717f96509e7133c43643f50bfc_mafia.exe 133 PID 1704 wrote to memory of 3124 1704 2024-05-21_81e728717f96509e7133c43643f50bfc_mafia.exe 133 PID 3124 wrote to memory of 2916 3124 B7E6.tmp 92 PID 3124 wrote to memory of 2916 3124 B7E6.tmp 92 PID 3124 wrote to memory of 2916 3124 B7E6.tmp 92 PID 2916 wrote to memory of 3092 2916 B8FF.tmp 93 PID 2916 wrote to memory of 3092 2916 B8FF.tmp 93 PID 2916 wrote to memory of 3092 2916 B8FF.tmp 93 PID 3092 wrote to memory of 3548 3092 BAC4.tmp 94 PID 3092 wrote to memory of 3548 3092 BAC4.tmp 94 PID 3092 wrote to memory of 3548 3092 BAC4.tmp 94 PID 3548 wrote to memory of 1052 3548 BBCE.tmp 95 PID 3548 wrote to memory of 1052 3548 BBCE.tmp 95 PID 3548 wrote to memory of 1052 3548 BBCE.tmp 95 PID 1052 wrote to memory of 3880 1052 BCD8.tmp 96 PID 1052 wrote to memory of 3880 1052 BCD8.tmp 96 PID 1052 wrote to memory of 3880 1052 BCD8.tmp 96 PID 3880 wrote to memory of 2084 3880 BD55.tmp 97 PID 3880 wrote to memory of 2084 3880 BD55.tmp 97 PID 3880 wrote to memory of 2084 3880 BD55.tmp 97 PID 2084 wrote to memory of 3984 2084 BDC2.tmp 144 PID 2084 wrote to memory of 3984 2084 BDC2.tmp 144 PID 2084 wrote to memory of 3984 2084 BDC2.tmp 144 PID 3984 wrote to memory of 4664 3984 BE3F.tmp 99 PID 3984 wrote to memory of 4664 3984 BE3F.tmp 99 PID 3984 wrote to memory of 4664 3984 BE3F.tmp 99 PID 4664 wrote to memory of 2328 4664 BECC.tmp 100 PID 4664 wrote to memory of 2328 4664 BECC.tmp 100 PID 4664 wrote to memory of 2328 4664 BECC.tmp 100 PID 2328 wrote to memory of 3848 2328 BF68.tmp 101 PID 2328 wrote to memory of 3848 2328 BF68.tmp 101 PID 2328 wrote to memory of 3848 2328 BF68.tmp 101 PID 3848 wrote to memory of 3564 3848 C052.tmp 102 PID 3848 wrote to memory of 3564 3848 C052.tmp 102 PID 3848 wrote to memory of 3564 3848 C052.tmp 102 PID 3564 wrote to memory of 3636 3564 C0EE.tmp 103 PID 3564 wrote to memory of 3636 3564 C0EE.tmp 103 PID 3564 wrote to memory of 3636 3564 C0EE.tmp 103 PID 3636 wrote to memory of 4756 3636 C1E8.tmp 104 PID 3636 wrote to memory of 4756 3636 C1E8.tmp 104 PID 3636 wrote to memory of 4756 3636 C1E8.tmp 104 PID 4756 wrote to memory of 5088 4756 C2A4.tmp 105 PID 4756 wrote to memory of 5088 4756 C2A4.tmp 105 PID 4756 wrote to memory of 5088 4756 C2A4.tmp 105 PID 5088 wrote to memory of 1696 5088 C39E.tmp 106 PID 5088 wrote to memory of 1696 5088 C39E.tmp 106 PID 5088 wrote to memory of 1696 5088 C39E.tmp 106 PID 1696 wrote to memory of 4804 1696 C40B.tmp 155 PID 1696 wrote to memory of 4804 1696 C40B.tmp 155 PID 1696 wrote to memory of 4804 1696 C40B.tmp 155 PID 4804 wrote to memory of 3128 4804 C4B7.tmp 108 PID 4804 wrote to memory of 3128 4804 C4B7.tmp 108 PID 4804 wrote to memory of 3128 4804 C4B7.tmp 108 PID 3128 wrote to memory of 3160 3128 C563.tmp 109 PID 3128 wrote to memory of 3160 3128 C563.tmp 109 PID 3128 wrote to memory of 3160 3128 C563.tmp 109 PID 3160 wrote to memory of 4456 3160 C5C1.tmp 110 PID 3160 wrote to memory of 4456 3160 C5C1.tmp 110 PID 3160 wrote to memory of 4456 3160 C5C1.tmp 110 PID 4456 wrote to memory of 2172 4456 C63E.tmp 111 PID 4456 wrote to memory of 2172 4456 C63E.tmp 111 PID 4456 wrote to memory of 2172 4456 C63E.tmp 111 PID 2172 wrote to memory of 2004 2172 C728.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_81e728717f96509e7133c43643f50bfc_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_81e728717f96509e7133c43643f50bfc_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\BD55.tmp"C:\Users\Admin\AppData\Local\Temp\BD55.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\BF68.tmp"C:\Users\Admin\AppData\Local\Temp\BF68.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\C052.tmp"C:\Users\Admin\AppData\Local\Temp\C052.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\C39E.tmp"C:\Users\Admin\AppData\Local\Temp\C39E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\C40B.tmp"C:\Users\Admin\AppData\Local\Temp\C40B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\C563.tmp"C:\Users\Admin\AppData\Local\Temp\C563.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\C63E.tmp"C:\Users\Admin\AppData\Local\Temp\C63E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\C728.tmp"C:\Users\Admin\AppData\Local\Temp\C728.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"23⤵
- Executes dropped EXE
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\C91C.tmp"C:\Users\Admin\AppData\Local\Temp\C91C.tmp"24⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"25⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\CAC2.tmp"C:\Users\Admin\AppData\Local\Temp\CAC2.tmp"26⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"27⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"28⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\CDEF.tmp"C:\Users\Admin\AppData\Local\Temp\CDEF.tmp"29⤵
- Executes dropped EXE
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"30⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\CF75.tmp"C:\Users\Admin\AppData\Local\Temp\CF75.tmp"31⤵
- Executes dropped EXE
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\CFE3.tmp"C:\Users\Admin\AppData\Local\Temp\CFE3.tmp"32⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\D040.tmp"C:\Users\Admin\AppData\Local\Temp\D040.tmp"33⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"34⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\D12B.tmp"C:\Users\Admin\AppData\Local\Temp\D12B.tmp"35⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\D254.tmp"C:\Users\Admin\AppData\Local\Temp\D254.tmp"36⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\D2C1.tmp"C:\Users\Admin\AppData\Local\Temp\D2C1.tmp"37⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\D34E.tmp"C:\Users\Admin\AppData\Local\Temp\D34E.tmp"38⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"39⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\D419.tmp"C:\Users\Admin\AppData\Local\Temp\D419.tmp"40⤵
- Executes dropped EXE
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"41⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\D522.tmp"C:\Users\Admin\AppData\Local\Temp\D522.tmp"42⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\D580.tmp"C:\Users\Admin\AppData\Local\Temp\D580.tmp"43⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"44⤵
- Executes dropped EXE
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\D68A.tmp"C:\Users\Admin\AppData\Local\Temp\D68A.tmp"45⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"46⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\D774.tmp"C:\Users\Admin\AppData\Local\Temp\D774.tmp"47⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\D7E1.tmp"C:\Users\Admin\AppData\Local\Temp\D7E1.tmp"48⤵
- Executes dropped EXE
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\D83F.tmp"C:\Users\Admin\AppData\Local\Temp\D83F.tmp"49⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"50⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\D91A.tmp"C:\Users\Admin\AppData\Local\Temp\D91A.tmp"51⤵
- Executes dropped EXE
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\D978.tmp"C:\Users\Admin\AppData\Local\Temp\D978.tmp"52⤵
- Executes dropped EXE
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"53⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\DA91.tmp"C:\Users\Admin\AppData\Local\Temp\DA91.tmp"54⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\DAFE.tmp"C:\Users\Admin\AppData\Local\Temp\DAFE.tmp"55⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"56⤵
- Executes dropped EXE
PID:680 -
C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"57⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\DC85.tmp"C:\Users\Admin\AppData\Local\Temp\DC85.tmp"58⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\DCE3.tmp"C:\Users\Admin\AppData\Local\Temp\DCE3.tmp"59⤵
- Executes dropped EXE
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\DD40.tmp"C:\Users\Admin\AppData\Local\Temp\DD40.tmp"60⤵
- Executes dropped EXE
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"61⤵
- Executes dropped EXE
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\DE3A.tmp"C:\Users\Admin\AppData\Local\Temp\DE3A.tmp"62⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\DEB7.tmp"C:\Users\Admin\AppData\Local\Temp\DEB7.tmp"63⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\DF25.tmp"C:\Users\Admin\AppData\Local\Temp\DF25.tmp"64⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\E186.tmp"C:\Users\Admin\AppData\Local\Temp\E186.tmp"65⤵
- Executes dropped EXE
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\E1F4.tmp"C:\Users\Admin\AppData\Local\Temp\E1F4.tmp"66⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\E261.tmp"C:\Users\Admin\AppData\Local\Temp\E261.tmp"67⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"68⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\E33C.tmp"C:\Users\Admin\AppData\Local\Temp\E33C.tmp"69⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\E3A9.tmp"C:\Users\Admin\AppData\Local\Temp\E3A9.tmp"70⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\E407.tmp"C:\Users\Admin\AppData\Local\Temp\E407.tmp"71⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\E484.tmp"C:\Users\Admin\AppData\Local\Temp\E484.tmp"72⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\E639.tmp"C:\Users\Admin\AppData\Local\Temp\E639.tmp"73⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"74⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\E733.tmp"C:\Users\Admin\AppData\Local\Temp\E733.tmp"75⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"76⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\E84D.tmp"C:\Users\Admin\AppData\Local\Temp\E84D.tmp"77⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"78⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\E966.tmp"C:\Users\Admin\AppData\Local\Temp\E966.tmp"79⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"80⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"81⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\EB2B.tmp"C:\Users\Admin\AppData\Local\Temp\EB2B.tmp"82⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"83⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\EC35.tmp"C:\Users\Admin\AppData\Local\Temp\EC35.tmp"84⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"85⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\ED7D.tmp"C:\Users\Admin\AppData\Local\Temp\ED7D.tmp"86⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\EE19.tmp"C:\Users\Admin\AppData\Local\Temp\EE19.tmp"87⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\EE96.tmp"C:\Users\Admin\AppData\Local\Temp\EE96.tmp"88⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\EF13.tmp"C:\Users\Admin\AppData\Local\Temp\EF13.tmp"89⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\EFBF.tmp"C:\Users\Admin\AppData\Local\Temp\EFBF.tmp"90⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\F0A9.tmp"C:\Users\Admin\AppData\Local\Temp\F0A9.tmp"91⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\F165.tmp"C:\Users\Admin\AppData\Local\Temp\F165.tmp"92⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\F211.tmp"C:\Users\Admin\AppData\Local\Temp\F211.tmp"93⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\F28E.tmp"C:\Users\Admin\AppData\Local\Temp\F28E.tmp"94⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\F359.tmp"C:\Users\Admin\AppData\Local\Temp\F359.tmp"95⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\F3F5.tmp"C:\Users\Admin\AppData\Local\Temp\F3F5.tmp"96⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\F4EF.tmp"C:\Users\Admin\AppData\Local\Temp\F4EF.tmp"97⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\F8F6.tmp"C:\Users\Admin\AppData\Local\Temp\F8F6.tmp"98⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\F983.tmp"C:\Users\Admin\AppData\Local\Temp\F983.tmp"99⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"100⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\FB09.tmp"C:\Users\Admin\AppData\Local\Temp\FB09.tmp"101⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\FC52.tmp"C:\Users\Admin\AppData\Local\Temp\FC52.tmp"102⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"103⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"104⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\FE55.tmp"C:\Users\Admin\AppData\Local\Temp\FE55.tmp"105⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\FF4F.tmp"C:\Users\Admin\AppData\Local\Temp\FF4F.tmp"106⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\2A.tmp"C:\Users\Admin\AppData\Local\Temp\2A.tmp"107⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\A7.tmp"C:\Users\Admin\AppData\Local\Temp\A7.tmp"108⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\124.tmp"C:\Users\Admin\AppData\Local\Temp\124.tmp"109⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\3F3.tmp"C:\Users\Admin\AppData\Local\Temp\3F3.tmp"110⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\4AE.tmp"C:\Users\Admin\AppData\Local\Temp\4AE.tmp"111⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\56A.tmp"C:\Users\Admin\AppData\Local\Temp\56A.tmp"112⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\635.tmp"C:\Users\Admin\AppData\Local\Temp\635.tmp"113⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\6A2.tmp"C:\Users\Admin\AppData\Local\Temp\6A2.tmp"114⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\71F.tmp"C:\Users\Admin\AppData\Local\Temp\71F.tmp"115⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\7DB.tmp"C:\Users\Admin\AppData\Local\Temp\7DB.tmp"116⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\858.tmp"C:\Users\Admin\AppData\Local\Temp\858.tmp"117⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\8C5.tmp"C:\Users\Admin\AppData\Local\Temp\8C5.tmp"118⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\942.tmp"C:\Users\Admin\AppData\Local\Temp\942.tmp"119⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\9AF.tmp"C:\Users\Admin\AppData\Local\Temp\9AF.tmp"120⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\A6B.tmp"C:\Users\Admin\AppData\Local\Temp\A6B.tmp"121⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\B17.tmp"C:\Users\Admin\AppData\Local\Temp\B17.tmp"122⤵PID:5092
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-