Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2024, 18:04
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-04_f4f1b121d8e8b33c72f74eadc1796339_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-07-04_f4f1b121d8e8b33c72f74eadc1796339_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-07-04_f4f1b121d8e8b33c72f74eadc1796339_mafia.exe
-
Size
536KB
-
MD5
f4f1b121d8e8b33c72f74eadc1796339
-
SHA1
80feea8d00ddf98f982b1e6abe702ae145010deb
-
SHA256
f7e33266ad8111402d2ac42690785c80b4bf07ff5402475c16250f992c4ad8c6
-
SHA512
8d9ed48cef6bc8be97a7c6288a6cab69cb8c4a5ca303fa67db5e55e5e440bd1e2a58955fced56c090cbe96447e57bad2fb88e4b6c37731933dc6e992118b2535
-
SSDEEP
12288:wU5rCOTeiUbWw787BBAtCBsXJd1juaXs5/IZxVJ0ZT9:wUQOJUz8MtCmHu3xIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 220 DE2B.tmp 4708 DEC7.tmp 1776 DF54.tmp 1616 E00F.tmp 4936 E0DA.tmp 1348 E177.tmp 3332 E1F4.tmp 4064 E29F.tmp 4460 E35B.tmp 2408 E3D8.tmp 1512 E484.tmp 4008 E510.tmp 3868 E5BC.tmp 4248 E678.tmp 3160 E6E5.tmp 2520 E772.tmp 4608 E7EF.tmp 4644 E87B.tmp 1144 E8F8.tmp 2084 E985.tmp 3312 EA12.tmp 1736 EA9E.tmp 1200 EB2B.tmp 4092 EBD7.tmp 4040 EC63.tmp 5052 ED0F.tmp 2264 EDFA.tmp 2452 EE96.tmp 5056 EF42.tmp 632 EFBF.tmp 2248 F04B.tmp 4824 F0E8.tmp 2588 F174.tmp 1716 F1F1.tmp 1168 F23F.tmp 4348 F2BC.tmp 2416 F339.tmp 4712 F397.tmp 2552 F405.tmp 1384 F453.tmp 4064 F4C0.tmp 3788 F51E.tmp 3972 F57C.tmp 2160 F5D9.tmp 3400 F627.tmp 1220 F6B4.tmp 1596 F741.tmp 2516 F79E.tmp 4608 F7FC.tmp 1124 F84A.tmp 2244 F898.tmp 2304 F8E7.tmp 2324 F944.tmp 752 F992.tmp 880 F9F0.tmp 1736 FA4E.tmp 1016 FA9C.tmp 4436 FAEA.tmp 3404 FB38.tmp 1356 FB86.tmp 4576 FBD5.tmp 1044 FC23.tmp 2420 FC71.tmp 2744 FCBF.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3064 wrote to memory of 220 3064 2024-07-04_f4f1b121d8e8b33c72f74eadc1796339_mafia.exe 88 PID 3064 wrote to memory of 220 3064 2024-07-04_f4f1b121d8e8b33c72f74eadc1796339_mafia.exe 88 PID 3064 wrote to memory of 220 3064 2024-07-04_f4f1b121d8e8b33c72f74eadc1796339_mafia.exe 88 PID 220 wrote to memory of 4708 220 DE2B.tmp 89 PID 220 wrote to memory of 4708 220 DE2B.tmp 89 PID 220 wrote to memory of 4708 220 DE2B.tmp 89 PID 4708 wrote to memory of 1776 4708 DEC7.tmp 90 PID 4708 wrote to memory of 1776 4708 DEC7.tmp 90 PID 4708 wrote to memory of 1776 4708 DEC7.tmp 90 PID 1776 wrote to memory of 1616 1776 DF54.tmp 91 PID 1776 wrote to memory of 1616 1776 DF54.tmp 91 PID 1776 wrote to memory of 1616 1776 DF54.tmp 91 PID 1616 wrote to memory of 4936 1616 E00F.tmp 92 PID 1616 wrote to memory of 4936 1616 E00F.tmp 92 PID 1616 wrote to memory of 4936 1616 E00F.tmp 92 PID 4936 wrote to memory of 1348 4936 E0DA.tmp 93 PID 4936 wrote to memory of 1348 4936 E0DA.tmp 93 PID 4936 wrote to memory of 1348 4936 E0DA.tmp 93 PID 1348 wrote to memory of 3332 1348 E177.tmp 94 PID 1348 wrote to memory of 3332 1348 E177.tmp 94 PID 1348 wrote to memory of 3332 1348 E177.tmp 94 PID 3332 wrote to memory of 4064 3332 E1F4.tmp 95 PID 3332 wrote to memory of 4064 3332 E1F4.tmp 95 PID 3332 wrote to memory of 4064 3332 E1F4.tmp 95 PID 4064 wrote to memory of 4460 4064 E29F.tmp 96 PID 4064 wrote to memory of 4460 4064 E29F.tmp 96 PID 4064 wrote to memory of 4460 4064 E29F.tmp 96 PID 4460 wrote to memory of 2408 4460 E35B.tmp 97 PID 4460 wrote to memory of 2408 4460 E35B.tmp 97 PID 4460 wrote to memory of 2408 4460 E35B.tmp 97 PID 2408 wrote to memory of 1512 2408 E3D8.tmp 98 PID 2408 wrote to memory of 1512 2408 E3D8.tmp 98 PID 2408 wrote to memory of 1512 2408 E3D8.tmp 98 PID 1512 wrote to memory of 4008 1512 E484.tmp 99 PID 1512 wrote to memory of 4008 1512 E484.tmp 99 PID 1512 wrote to memory of 4008 1512 E484.tmp 99 PID 4008 wrote to memory of 3868 4008 E510.tmp 100 PID 4008 wrote to memory of 3868 4008 E510.tmp 100 PID 4008 wrote to memory of 3868 4008 E510.tmp 100 PID 3868 wrote to memory of 4248 3868 E5BC.tmp 101 PID 3868 wrote to memory of 4248 3868 E5BC.tmp 101 PID 3868 wrote to memory of 4248 3868 E5BC.tmp 101 PID 4248 wrote to memory of 3160 4248 E678.tmp 102 PID 4248 wrote to memory of 3160 4248 E678.tmp 102 PID 4248 wrote to memory of 3160 4248 E678.tmp 102 PID 3160 wrote to memory of 2520 3160 E6E5.tmp 103 PID 3160 wrote to memory of 2520 3160 E6E5.tmp 103 PID 3160 wrote to memory of 2520 3160 E6E5.tmp 103 PID 2520 wrote to memory of 4608 2520 E772.tmp 104 PID 2520 wrote to memory of 4608 2520 E772.tmp 104 PID 2520 wrote to memory of 4608 2520 E772.tmp 104 PID 4608 wrote to memory of 4644 4608 E7EF.tmp 105 PID 4608 wrote to memory of 4644 4608 E7EF.tmp 105 PID 4608 wrote to memory of 4644 4608 E7EF.tmp 105 PID 4644 wrote to memory of 1144 4644 E87B.tmp 106 PID 4644 wrote to memory of 1144 4644 E87B.tmp 106 PID 4644 wrote to memory of 1144 4644 E87B.tmp 106 PID 1144 wrote to memory of 2084 1144 E8F8.tmp 107 PID 1144 wrote to memory of 2084 1144 E8F8.tmp 107 PID 1144 wrote to memory of 2084 1144 E8F8.tmp 107 PID 2084 wrote to memory of 3312 2084 E985.tmp 108 PID 2084 wrote to memory of 3312 2084 E985.tmp 108 PID 2084 wrote to memory of 3312 2084 E985.tmp 108 PID 3312 wrote to memory of 1736 3312 EA12.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-04_f4f1b121d8e8b33c72f74eadc1796339_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-04_f4f1b121d8e8b33c72f74eadc1796339_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\DE2B.tmp"C:\Users\Admin\AppData\Local\Temp\DE2B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\DEC7.tmp"C:\Users\Admin\AppData\Local\Temp\DEC7.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\DF54.tmp"C:\Users\Admin\AppData\Local\Temp\DF54.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\E00F.tmp"C:\Users\Admin\AppData\Local\Temp\E00F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\E177.tmp"C:\Users\Admin\AppData\Local\Temp\E177.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\E1F4.tmp"C:\Users\Admin\AppData\Local\Temp\E1F4.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\E29F.tmp"C:\Users\Admin\AppData\Local\Temp\E29F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\E35B.tmp"C:\Users\Admin\AppData\Local\Temp\E35B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\E3D8.tmp"C:\Users\Admin\AppData\Local\Temp\E3D8.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\E484.tmp"C:\Users\Admin\AppData\Local\Temp\E484.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\E510.tmp"C:\Users\Admin\AppData\Local\Temp\E510.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\E5BC.tmp"C:\Users\Admin\AppData\Local\Temp\E5BC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\E678.tmp"C:\Users\Admin\AppData\Local\Temp\E678.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\E772.tmp"C:\Users\Admin\AppData\Local\Temp\E772.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\E87B.tmp"C:\Users\Admin\AppData\Local\Temp\E87B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\E985.tmp"C:\Users\Admin\AppData\Local\Temp\E985.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\EA12.tmp"C:\Users\Admin\AppData\Local\Temp\EA12.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\EA9E.tmp"C:\Users\Admin\AppData\Local\Temp\EA9E.tmp"23⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\EB2B.tmp"C:\Users\Admin\AppData\Local\Temp\EB2B.tmp"24⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"25⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\EC63.tmp"C:\Users\Admin\AppData\Local\Temp\EC63.tmp"26⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\ED0F.tmp"C:\Users\Admin\AppData\Local\Temp\ED0F.tmp"27⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\EDFA.tmp"C:\Users\Admin\AppData\Local\Temp\EDFA.tmp"28⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\EE96.tmp"C:\Users\Admin\AppData\Local\Temp\EE96.tmp"29⤵
- Executes dropped EXE
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\EF42.tmp"C:\Users\Admin\AppData\Local\Temp\EF42.tmp"30⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\EFBF.tmp"C:\Users\Admin\AppData\Local\Temp\EFBF.tmp"31⤵
- Executes dropped EXE
PID:632 -
C:\Users\Admin\AppData\Local\Temp\F04B.tmp"C:\Users\Admin\AppData\Local\Temp\F04B.tmp"32⤵
- Executes dropped EXE
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\F0E8.tmp"C:\Users\Admin\AppData\Local\Temp\F0E8.tmp"33⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\F174.tmp"C:\Users\Admin\AppData\Local\Temp\F174.tmp"34⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\F1F1.tmp"C:\Users\Admin\AppData\Local\Temp\F1F1.tmp"35⤵
- Executes dropped EXE
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\F23F.tmp"C:\Users\Admin\AppData\Local\Temp\F23F.tmp"36⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"37⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\F339.tmp"C:\Users\Admin\AppData\Local\Temp\F339.tmp"38⤵
- Executes dropped EXE
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\F397.tmp"C:\Users\Admin\AppData\Local\Temp\F397.tmp"39⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\F405.tmp"C:\Users\Admin\AppData\Local\Temp\F405.tmp"40⤵
- Executes dropped EXE
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\F453.tmp"C:\Users\Admin\AppData\Local\Temp\F453.tmp"41⤵
- Executes dropped EXE
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\F4C0.tmp"C:\Users\Admin\AppData\Local\Temp\F4C0.tmp"42⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\F51E.tmp"C:\Users\Admin\AppData\Local\Temp\F51E.tmp"43⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\F57C.tmp"C:\Users\Admin\AppData\Local\Temp\F57C.tmp"44⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"45⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\F627.tmp"C:\Users\Admin\AppData\Local\Temp\F627.tmp"46⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\F6B4.tmp"C:\Users\Admin\AppData\Local\Temp\F6B4.tmp"47⤵
- Executes dropped EXE
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\F741.tmp"C:\Users\Admin\AppData\Local\Temp\F741.tmp"48⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\F79E.tmp"C:\Users\Admin\AppData\Local\Temp\F79E.tmp"49⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\F7FC.tmp"C:\Users\Admin\AppData\Local\Temp\F7FC.tmp"50⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\F84A.tmp"C:\Users\Admin\AppData\Local\Temp\F84A.tmp"51⤵
- Executes dropped EXE
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\F898.tmp"C:\Users\Admin\AppData\Local\Temp\F898.tmp"52⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"53⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\F944.tmp"C:\Users\Admin\AppData\Local\Temp\F944.tmp"54⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\F992.tmp"C:\Users\Admin\AppData\Local\Temp\F992.tmp"55⤵
- Executes dropped EXE
PID:752 -
C:\Users\Admin\AppData\Local\Temp\F9F0.tmp"C:\Users\Admin\AppData\Local\Temp\F9F0.tmp"56⤵
- Executes dropped EXE
PID:880 -
C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"57⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"58⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"59⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\FB38.tmp"C:\Users\Admin\AppData\Local\Temp\FB38.tmp"60⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\FB86.tmp"C:\Users\Admin\AppData\Local\Temp\FB86.tmp"61⤵
- Executes dropped EXE
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"62⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\FC23.tmp"C:\Users\Admin\AppData\Local\Temp\FC23.tmp"63⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\FC71.tmp"C:\Users\Admin\AppData\Local\Temp\FC71.tmp"64⤵
- Executes dropped EXE
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\FCBF.tmp"C:\Users\Admin\AppData\Local\Temp\FCBF.tmp"65⤵
- Executes dropped EXE
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\FD1D.tmp"C:\Users\Admin\AppData\Local\Temp\FD1D.tmp"66⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\FD6B.tmp"C:\Users\Admin\AppData\Local\Temp\FD6B.tmp"67⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\FDB9.tmp"C:\Users\Admin\AppData\Local\Temp\FDB9.tmp"68⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\FE07.tmp"C:\Users\Admin\AppData\Local\Temp\FE07.tmp"69⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\FE55.tmp"C:\Users\Admin\AppData\Local\Temp\FE55.tmp"70⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"71⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"72⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\FF4F.tmp"C:\Users\Admin\AppData\Local\Temp\FF4F.tmp"73⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\FF9D.tmp"C:\Users\Admin\AppData\Local\Temp\FF9D.tmp"74⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\FFEB.tmp"C:\Users\Admin\AppData\Local\Temp\FFEB.tmp"75⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\49.tmp"C:\Users\Admin\AppData\Local\Temp\49.tmp"76⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\A7.tmp"C:\Users\Admin\AppData\Local\Temp\A7.tmp"77⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\F5.tmp"C:\Users\Admin\AppData\Local\Temp\F5.tmp"78⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\143.tmp"C:\Users\Admin\AppData\Local\Temp\143.tmp"79⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\191.tmp"C:\Users\Admin\AppData\Local\Temp\191.tmp"80⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\1EF.tmp"C:\Users\Admin\AppData\Local\Temp\1EF.tmp"81⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\23D.tmp"C:\Users\Admin\AppData\Local\Temp\23D.tmp"82⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\28B.tmp"C:\Users\Admin\AppData\Local\Temp\28B.tmp"83⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\2D9.tmp"C:\Users\Admin\AppData\Local\Temp\2D9.tmp"84⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\328.tmp"C:\Users\Admin\AppData\Local\Temp\328.tmp"85⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\376.tmp"C:\Users\Admin\AppData\Local\Temp\376.tmp"86⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\3C4.tmp"C:\Users\Admin\AppData\Local\Temp\3C4.tmp"87⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\412.tmp"C:\Users\Admin\AppData\Local\Temp\412.tmp"88⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\460.tmp"C:\Users\Admin\AppData\Local\Temp\460.tmp"89⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\4AE.tmp"C:\Users\Admin\AppData\Local\Temp\4AE.tmp"90⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\4FC.tmp"C:\Users\Admin\AppData\Local\Temp\4FC.tmp"91⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\54A.tmp"C:\Users\Admin\AppData\Local\Temp\54A.tmp"92⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\599.tmp"C:\Users\Admin\AppData\Local\Temp\599.tmp"93⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\5E7.tmp"C:\Users\Admin\AppData\Local\Temp\5E7.tmp"94⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\635.tmp"C:\Users\Admin\AppData\Local\Temp\635.tmp"95⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\683.tmp"C:\Users\Admin\AppData\Local\Temp\683.tmp"96⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\6D1.tmp"C:\Users\Admin\AppData\Local\Temp\6D1.tmp"97⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\73E.tmp"C:\Users\Admin\AppData\Local\Temp\73E.tmp"98⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\7AC.tmp"C:\Users\Admin\AppData\Local\Temp\7AC.tmp"99⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\80A.tmp"C:\Users\Admin\AppData\Local\Temp\80A.tmp"100⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\858.tmp"C:\Users\Admin\AppData\Local\Temp\858.tmp"101⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\8A6.tmp"C:\Users\Admin\AppData\Local\Temp\8A6.tmp"102⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\8F4.tmp"C:\Users\Admin\AppData\Local\Temp\8F4.tmp"103⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\942.tmp"C:\Users\Admin\AppData\Local\Temp\942.tmp"104⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\990.tmp"C:\Users\Admin\AppData\Local\Temp\990.tmp"105⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\9DE.tmp"C:\Users\Admin\AppData\Local\Temp\9DE.tmp"106⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\A2C.tmp"C:\Users\Admin\AppData\Local\Temp\A2C.tmp"107⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\A7B.tmp"C:\Users\Admin\AppData\Local\Temp\A7B.tmp"108⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\AC9.tmp"C:\Users\Admin\AppData\Local\Temp\AC9.tmp"109⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\B17.tmp"C:\Users\Admin\AppData\Local\Temp\B17.tmp"110⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\B65.tmp"C:\Users\Admin\AppData\Local\Temp\B65.tmp"111⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\BB3.tmp"C:\Users\Admin\AppData\Local\Temp\BB3.tmp"112⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\C01.tmp"C:\Users\Admin\AppData\Local\Temp\C01.tmp"113⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\C4F.tmp"C:\Users\Admin\AppData\Local\Temp\C4F.tmp"114⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\C9D.tmp"C:\Users\Admin\AppData\Local\Temp\C9D.tmp"115⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\CEC.tmp"C:\Users\Admin\AppData\Local\Temp\CEC.tmp"116⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\D3A.tmp"C:\Users\Admin\AppData\Local\Temp\D3A.tmp"117⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\D88.tmp"C:\Users\Admin\AppData\Local\Temp\D88.tmp"118⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\DD6.tmp"C:\Users\Admin\AppData\Local\Temp\DD6.tmp"119⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"120⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\E72.tmp"C:\Users\Admin\AppData\Local\Temp\E72.tmp"121⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\EC0.tmp"C:\Users\Admin\AppData\Local\Temp\EC0.tmp"122⤵PID:1864
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-