Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 10:38
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-26_608f39a26a891dd2b198a47c54373ba5_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-26_608f39a26a891dd2b198a47c54373ba5_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-26_608f39a26a891dd2b198a47c54373ba5_mafia.exe
-
Size
536KB
-
MD5
608f39a26a891dd2b198a47c54373ba5
-
SHA1
7c545df5eb11d2eb07d6ff12cea3dbd8b57b2bac
-
SHA256
39f77b63c43bc08ccdb7757d100c746ea1467ac801e8d4e094829ddf16f1995a
-
SHA512
2baadd85fc63b3eada3a97d612dfd9c1e4cd9309f079a30663f6e18b4594d8eb5d7a554ad011bbab4d2cadb3275169ee2f7bde5cd307e957b24ab5560ce80f29
-
SSDEEP
12288:wU5rCOTeiUXEIk693y6zVp6RG2KIZxVJ0ZT9:wUQOJUXGmzVP2KIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2208 E232.tmp 4564 E2DE.tmp 1496 E399.tmp 1548 E445.tmp 4216 E4E2.tmp 4600 E57E.tmp 1192 E62A.tmp 5020 E6D6.tmp 4588 E781.tmp 5068 E84D.tmp 396 E8E9.tmp 3728 E975.tmp 1608 E9F2.tmp 1936 EA7F.tmp 3992 EAFC.tmp 2888 EB79.tmp 408 EC15.tmp 5084 ECA2.tmp 3880 ED5D.tmp 1928 EE19.tmp 5076 EED4.tmp 2096 EF51.tmp 3788 EFCE.tmp 1252 F07A.tmp 1156 F0E8.tmp 952 F1B3.tmp 944 F230.tmp 2276 F2AD.tmp 728 F32A.tmp 4668 F3E5.tmp 3436 F472.tmp 3024 F50E.tmp 2768 F5D9.tmp 1708 F656.tmp 4384 F6A4.tmp 2464 F721.tmp 1928 F78F.tmp 2468 F81B.tmp 4492 F8A8.tmp 1148 F915.tmp 1212 F973.tmp 3468 F9E1.tmp 3528 FA6D.tmp 4216 FAEA.tmp 1192 FB38.tmp 944 FBC5.tmp 2640 FC42.tmp 4868 FCBF.tmp 4600 FD2C.tmp 3728 FD8A.tmp 2016 FDD8.tmp 4468 FE26.tmp 3436 FE74.tmp 2792 FEC3.tmp 1596 FF11.tmp 4252 FF6E.tmp 1408 FFCC.tmp 4928 1A.tmp 1744 78.tmp 2452 C6.tmp 2264 114.tmp 664 162.tmp 1928 1C0.tmp 3064 21E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4572 wrote to memory of 2208 4572 2024-05-26_608f39a26a891dd2b198a47c54373ba5_mafia.exe 90 PID 4572 wrote to memory of 2208 4572 2024-05-26_608f39a26a891dd2b198a47c54373ba5_mafia.exe 90 PID 4572 wrote to memory of 2208 4572 2024-05-26_608f39a26a891dd2b198a47c54373ba5_mafia.exe 90 PID 2208 wrote to memory of 4564 2208 E232.tmp 91 PID 2208 wrote to memory of 4564 2208 E232.tmp 91 PID 2208 wrote to memory of 4564 2208 E232.tmp 91 PID 4564 wrote to memory of 1496 4564 E2DE.tmp 93 PID 4564 wrote to memory of 1496 4564 E2DE.tmp 93 PID 4564 wrote to memory of 1496 4564 E2DE.tmp 93 PID 1496 wrote to memory of 1548 1496 E399.tmp 96 PID 1496 wrote to memory of 1548 1496 E399.tmp 96 PID 1496 wrote to memory of 1548 1496 E399.tmp 96 PID 1548 wrote to memory of 4216 1548 E445.tmp 97 PID 1548 wrote to memory of 4216 1548 E445.tmp 97 PID 1548 wrote to memory of 4216 1548 E445.tmp 97 PID 4216 wrote to memory of 4600 4216 E4E2.tmp 98 PID 4216 wrote to memory of 4600 4216 E4E2.tmp 98 PID 4216 wrote to memory of 4600 4216 E4E2.tmp 98 PID 4600 wrote to memory of 1192 4600 E57E.tmp 99 PID 4600 wrote to memory of 1192 4600 E57E.tmp 99 PID 4600 wrote to memory of 1192 4600 E57E.tmp 99 PID 1192 wrote to memory of 5020 1192 E62A.tmp 100 PID 1192 wrote to memory of 5020 1192 E62A.tmp 100 PID 1192 wrote to memory of 5020 1192 E62A.tmp 100 PID 5020 wrote to memory of 4588 5020 E6D6.tmp 101 PID 5020 wrote to memory of 4588 5020 E6D6.tmp 101 PID 5020 wrote to memory of 4588 5020 E6D6.tmp 101 PID 4588 wrote to memory of 5068 4588 E781.tmp 102 PID 4588 wrote to memory of 5068 4588 E781.tmp 102 PID 4588 wrote to memory of 5068 4588 E781.tmp 102 PID 5068 wrote to memory of 396 5068 E84D.tmp 103 PID 5068 wrote to memory of 396 5068 E84D.tmp 103 PID 5068 wrote to memory of 396 5068 E84D.tmp 103 PID 396 wrote to memory of 3728 396 E8E9.tmp 104 PID 396 wrote to memory of 3728 396 E8E9.tmp 104 PID 396 wrote to memory of 3728 396 E8E9.tmp 104 PID 3728 wrote to memory of 1608 3728 E975.tmp 105 PID 3728 wrote to memory of 1608 3728 E975.tmp 105 PID 3728 wrote to memory of 1608 3728 E975.tmp 105 PID 1608 wrote to memory of 1936 1608 E9F2.tmp 106 PID 1608 wrote to memory of 1936 1608 E9F2.tmp 106 PID 1608 wrote to memory of 1936 1608 E9F2.tmp 106 PID 1936 wrote to memory of 3992 1936 EA7F.tmp 107 PID 1936 wrote to memory of 3992 1936 EA7F.tmp 107 PID 1936 wrote to memory of 3992 1936 EA7F.tmp 107 PID 3992 wrote to memory of 2888 3992 EAFC.tmp 108 PID 3992 wrote to memory of 2888 3992 EAFC.tmp 108 PID 3992 wrote to memory of 2888 3992 EAFC.tmp 108 PID 2888 wrote to memory of 408 2888 EB79.tmp 109 PID 2888 wrote to memory of 408 2888 EB79.tmp 109 PID 2888 wrote to memory of 408 2888 EB79.tmp 109 PID 408 wrote to memory of 5084 408 EC15.tmp 110 PID 408 wrote to memory of 5084 408 EC15.tmp 110 PID 408 wrote to memory of 5084 408 EC15.tmp 110 PID 5084 wrote to memory of 3880 5084 ECA2.tmp 111 PID 5084 wrote to memory of 3880 5084 ECA2.tmp 111 PID 5084 wrote to memory of 3880 5084 ECA2.tmp 111 PID 3880 wrote to memory of 1928 3880 ED5D.tmp 114 PID 3880 wrote to memory of 1928 3880 ED5D.tmp 114 PID 3880 wrote to memory of 1928 3880 ED5D.tmp 114 PID 1928 wrote to memory of 5076 1928 EE19.tmp 116 PID 1928 wrote to memory of 5076 1928 EE19.tmp 116 PID 1928 wrote to memory of 5076 1928 EE19.tmp 116 PID 5076 wrote to memory of 2096 5076 EED4.tmp 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_608f39a26a891dd2b198a47c54373ba5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-26_608f39a26a891dd2b198a47c54373ba5_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\E232.tmp"C:\Users\Admin\AppData\Local\Temp\E232.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\E2DE.tmp"C:\Users\Admin\AppData\Local\Temp\E2DE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\E399.tmp"C:\Users\Admin\AppData\Local\Temp\E399.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\E445.tmp"C:\Users\Admin\AppData\Local\Temp\E445.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\E4E2.tmp"C:\Users\Admin\AppData\Local\Temp\E4E2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\E57E.tmp"C:\Users\Admin\AppData\Local\Temp\E57E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\E62A.tmp"C:\Users\Admin\AppData\Local\Temp\E62A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\E781.tmp"C:\Users\Admin\AppData\Local\Temp\E781.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\E84D.tmp"C:\Users\Admin\AppData\Local\Temp\E84D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\E975.tmp"C:\Users\Admin\AppData\Local\Temp\E975.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\EAFC.tmp"C:\Users\Admin\AppData\Local\Temp\EAFC.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\EB79.tmp"C:\Users\Admin\AppData\Local\Temp\EB79.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\EC15.tmp"C:\Users\Admin\AppData\Local\Temp\EC15.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\ECA2.tmp"C:\Users\Admin\AppData\Local\Temp\ECA2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\EE19.tmp"C:\Users\Admin\AppData\Local\Temp\EE19.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\EED4.tmp"C:\Users\Admin\AppData\Local\Temp\EED4.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\EF51.tmp"C:\Users\Admin\AppData\Local\Temp\EF51.tmp"23⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"24⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\F07A.tmp"C:\Users\Admin\AppData\Local\Temp\F07A.tmp"25⤵
- Executes dropped EXE
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\F0E8.tmp"C:\Users\Admin\AppData\Local\Temp\F0E8.tmp"26⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\F1B3.tmp"C:\Users\Admin\AppData\Local\Temp\F1B3.tmp"27⤵
- Executes dropped EXE
PID:952 -
C:\Users\Admin\AppData\Local\Temp\F230.tmp"C:\Users\Admin\AppData\Local\Temp\F230.tmp"28⤵
- Executes dropped EXE
PID:944 -
C:\Users\Admin\AppData\Local\Temp\F2AD.tmp"C:\Users\Admin\AppData\Local\Temp\F2AD.tmp"29⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\F32A.tmp"C:\Users\Admin\AppData\Local\Temp\F32A.tmp"30⤵
- Executes dropped EXE
PID:728 -
C:\Users\Admin\AppData\Local\Temp\F3E5.tmp"C:\Users\Admin\AppData\Local\Temp\F3E5.tmp"31⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\F472.tmp"C:\Users\Admin\AppData\Local\Temp\F472.tmp"32⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\F50E.tmp"C:\Users\Admin\AppData\Local\Temp\F50E.tmp"33⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"34⤵
- Executes dropped EXE
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\F656.tmp"C:\Users\Admin\AppData\Local\Temp\F656.tmp"35⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"36⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\F721.tmp"C:\Users\Admin\AppData\Local\Temp\F721.tmp"37⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\F78F.tmp"C:\Users\Admin\AppData\Local\Temp\F78F.tmp"38⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\F81B.tmp"C:\Users\Admin\AppData\Local\Temp\F81B.tmp"39⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"40⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\F915.tmp"C:\Users\Admin\AppData\Local\Temp\F915.tmp"41⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\F973.tmp"C:\Users\Admin\AppData\Local\Temp\F973.tmp"42⤵
- Executes dropped EXE
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\F9E1.tmp"C:\Users\Admin\AppData\Local\Temp\F9E1.tmp"43⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"44⤵
- Executes dropped EXE
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"45⤵
- Executes dropped EXE
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\FB38.tmp"C:\Users\Admin\AppData\Local\Temp\FB38.tmp"46⤵
- Executes dropped EXE
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"47⤵
- Executes dropped EXE
PID:944 -
C:\Users\Admin\AppData\Local\Temp\FC42.tmp"C:\Users\Admin\AppData\Local\Temp\FC42.tmp"48⤵
- Executes dropped EXE
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\FCBF.tmp"C:\Users\Admin\AppData\Local\Temp\FCBF.tmp"49⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"50⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\FD8A.tmp"C:\Users\Admin\AppData\Local\Temp\FD8A.tmp"51⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\FDD8.tmp"C:\Users\Admin\AppData\Local\Temp\FDD8.tmp"52⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\FE26.tmp"C:\Users\Admin\AppData\Local\Temp\FE26.tmp"53⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\FE74.tmp"C:\Users\Admin\AppData\Local\Temp\FE74.tmp"54⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\FEC3.tmp"C:\Users\Admin\AppData\Local\Temp\FEC3.tmp"55⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\FF11.tmp"C:\Users\Admin\AppData\Local\Temp\FF11.tmp"56⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"57⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\FFCC.tmp"C:\Users\Admin\AppData\Local\Temp\FFCC.tmp"58⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\1A.tmp"C:\Users\Admin\AppData\Local\Temp\1A.tmp"59⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\78.tmp"C:\Users\Admin\AppData\Local\Temp\78.tmp"60⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\C6.tmp"C:\Users\Admin\AppData\Local\Temp\C6.tmp"61⤵
- Executes dropped EXE
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\114.tmp"C:\Users\Admin\AppData\Local\Temp\114.tmp"62⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\162.tmp"C:\Users\Admin\AppData\Local\Temp\162.tmp"63⤵
- Executes dropped EXE
PID:664 -
C:\Users\Admin\AppData\Local\Temp\1C0.tmp"C:\Users\Admin\AppData\Local\Temp\1C0.tmp"64⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\21E.tmp"C:\Users\Admin\AppData\Local\Temp\21E.tmp"65⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\26C.tmp"C:\Users\Admin\AppData\Local\Temp\26C.tmp"66⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\2BA.tmp"C:\Users\Admin\AppData\Local\Temp\2BA.tmp"67⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\318.tmp"C:\Users\Admin\AppData\Local\Temp\318.tmp"68⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\366.tmp"C:\Users\Admin\AppData\Local\Temp\366.tmp"69⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\3B4.tmp"C:\Users\Admin\AppData\Local\Temp\3B4.tmp"70⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\402.tmp"C:\Users\Admin\AppData\Local\Temp\402.tmp"71⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\460.tmp"C:\Users\Admin\AppData\Local\Temp\460.tmp"72⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\4CD.tmp"C:\Users\Admin\AppData\Local\Temp\4CD.tmp"73⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\52B.tmp"C:\Users\Admin\AppData\Local\Temp\52B.tmp"74⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\589.tmp"C:\Users\Admin\AppData\Local\Temp\589.tmp"75⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\5D7.tmp"C:\Users\Admin\AppData\Local\Temp\5D7.tmp"76⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\644.tmp"C:\Users\Admin\AppData\Local\Temp\644.tmp"77⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\693.tmp"C:\Users\Admin\AppData\Local\Temp\693.tmp"78⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\6F0.tmp"C:\Users\Admin\AppData\Local\Temp\6F0.tmp"79⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\74E.tmp"C:\Users\Admin\AppData\Local\Temp\74E.tmp"80⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\79C.tmp"C:\Users\Admin\AppData\Local\Temp\79C.tmp"81⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\7EA.tmp"C:\Users\Admin\AppData\Local\Temp\7EA.tmp"82⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\838.tmp"C:\Users\Admin\AppData\Local\Temp\838.tmp"83⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\896.tmp"C:\Users\Admin\AppData\Local\Temp\896.tmp"84⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\8F4.tmp"C:\Users\Admin\AppData\Local\Temp\8F4.tmp"85⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\952.tmp"C:\Users\Admin\AppData\Local\Temp\952.tmp"86⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\9AF.tmp"C:\Users\Admin\AppData\Local\Temp\9AF.tmp"87⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\A0D.tmp"C:\Users\Admin\AppData\Local\Temp\A0D.tmp"88⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\A5B.tmp"C:\Users\Admin\AppData\Local\Temp\A5B.tmp"89⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\AA9.tmp"C:\Users\Admin\AppData\Local\Temp\AA9.tmp"90⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\AF8.tmp"C:\Users\Admin\AppData\Local\Temp\AF8.tmp"91⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\B46.tmp"C:\Users\Admin\AppData\Local\Temp\B46.tmp"92⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\B94.tmp"C:\Users\Admin\AppData\Local\Temp\B94.tmp"93⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\BE2.tmp"C:\Users\Admin\AppData\Local\Temp\BE2.tmp"94⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\C30.tmp"C:\Users\Admin\AppData\Local\Temp\C30.tmp"95⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\C8E.tmp"C:\Users\Admin\AppData\Local\Temp\C8E.tmp"96⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\CEC.tmp"C:\Users\Admin\AppData\Local\Temp\CEC.tmp"97⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\D3A.tmp"C:\Users\Admin\AppData\Local\Temp\D3A.tmp"98⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\D97.tmp"C:\Users\Admin\AppData\Local\Temp\D97.tmp"99⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\DE6.tmp"C:\Users\Admin\AppData\Local\Temp\DE6.tmp"100⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"101⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\E82.tmp"C:\Users\Admin\AppData\Local\Temp\E82.tmp"102⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"103⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"104⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\F7C.tmp"C:\Users\Admin\AppData\Local\Temp\F7C.tmp"105⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\FDA.tmp"C:\Users\Admin\AppData\Local\Temp\FDA.tmp"106⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\1028.tmp"C:\Users\Admin\AppData\Local\Temp\1028.tmp"107⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\1076.tmp"C:\Users\Admin\AppData\Local\Temp\1076.tmp"108⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\10C4.tmp"C:\Users\Admin\AppData\Local\Temp\10C4.tmp"109⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\1112.tmp"C:\Users\Admin\AppData\Local\Temp\1112.tmp"110⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\1160.tmp"C:\Users\Admin\AppData\Local\Temp\1160.tmp"111⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\11AE.tmp"C:\Users\Admin\AppData\Local\Temp\11AE.tmp"112⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\120C.tmp"C:\Users\Admin\AppData\Local\Temp\120C.tmp"113⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\126A.tmp"C:\Users\Admin\AppData\Local\Temp\126A.tmp"114⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\12B8.tmp"C:\Users\Admin\AppData\Local\Temp\12B8.tmp"115⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\1306.tmp"C:\Users\Admin\AppData\Local\Temp\1306.tmp"116⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\1354.tmp"C:\Users\Admin\AppData\Local\Temp\1354.tmp"117⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\13B2.tmp"C:\Users\Admin\AppData\Local\Temp\13B2.tmp"118⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\1400.tmp"C:\Users\Admin\AppData\Local\Temp\1400.tmp"119⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\144E.tmp"C:\Users\Admin\AppData\Local\Temp\144E.tmp"120⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\149C.tmp"C:\Users\Admin\AppData\Local\Temp\149C.tmp"121⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\14EA.tmp"C:\Users\Admin\AppData\Local\Temp\14EA.tmp"122⤵PID:4252
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-