Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
155s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2024, 22:43
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-27_0af26bad97a8779e9436e4f1738b5cf9_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-01-27_0af26bad97a8779e9436e4f1738b5cf9_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-27_0af26bad97a8779e9436e4f1738b5cf9_mafia.exe
-
Size
487KB
-
MD5
0af26bad97a8779e9436e4f1738b5cf9
-
SHA1
8e347734bb5b7193cace1ed6194d4f550b2d0b6a
-
SHA256
8a1ef93ecc49ff8138a157c6b661132b55a6c047fd67bd5d2fc41cfdb3d6e85f
-
SHA512
22a5208e864ba2aaff8091e3c1c82e6170128ff3e0de005283546b936ed6704818eb736c898ae78eebfed5d1f7c9d4d3319072cf270ffaba851e8a72cd03e6d9
-
SSDEEP
12288:yU5rCOTeiNu9e/W50crC7qZ2PZ5CbpXjH6UlMbZ:yUQOJNuc+DH2x5CbI6Mb
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3992 8983.tmp 3012 8A2F.tmp 4228 8ACB.tmp 1440 8B67.tmp 4552 8CAF.tmp 4440 8D3C.tmp 3300 8DC9.tmp 4252 8E65.tmp 2420 8F30.tmp 3180 900B.tmp 3084 9069.tmp 2280 90F5.tmp 2664 9191.tmp 1188 921E.tmp 3932 929B.tmp 3296 9318.tmp 2008 94BE.tmp 1596 95D7.tmp 908 9664.tmp 4816 96E1.tmp 2572 974E.tmp 1796 97EA.tmp 1652 9896.tmp 3108 9971.tmp 1032 99EE.tmp 1700 9A9A.tmp 752 9B36.tmp 3412 9C01.tmp 3172 9CCC.tmp 4204 9D78.tmp 1564 9DF5.tmp 1960 9F7C.tmp 2792 A018.tmp 2628 A086.tmp 1752 A0E3.tmp 1880 A141.tmp 1712 A1BE.tmp 4392 A4DB.tmp 2092 A5A6.tmp 4900 A633.tmp 4964 A6BF.tmp 1452 A73C.tmp 3756 A7C9.tmp 2944 A827.tmp 3012 A894.tmp 3708 A950.tmp 4688 A9DC.tmp 712 AA59.tmp 3280 AAF5.tmp 4544 AB82.tmp 548 ABFF.tmp 220 AC7C.tmp 4644 AD09.tmp 4768 AD76.tmp 436 AE32.tmp 1444 AE8F.tmp 2360 AEFD.tmp 4836 AF6A.tmp 3220 AFE7.tmp 1260 B083.tmp 2432 B100.tmp 32 B18D.tmp 4540 B20A.tmp 2096 B297.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4964 wrote to memory of 3992 4964 2024-01-27_0af26bad97a8779e9436e4f1738b5cf9_mafia.exe 84 PID 4964 wrote to memory of 3992 4964 2024-01-27_0af26bad97a8779e9436e4f1738b5cf9_mafia.exe 84 PID 4964 wrote to memory of 3992 4964 2024-01-27_0af26bad97a8779e9436e4f1738b5cf9_mafia.exe 84 PID 3992 wrote to memory of 3012 3992 8983.tmp 86 PID 3992 wrote to memory of 3012 3992 8983.tmp 86 PID 3992 wrote to memory of 3012 3992 8983.tmp 86 PID 3012 wrote to memory of 4228 3012 8A2F.tmp 87 PID 3012 wrote to memory of 4228 3012 8A2F.tmp 87 PID 3012 wrote to memory of 4228 3012 8A2F.tmp 87 PID 4228 wrote to memory of 1440 4228 8ACB.tmp 88 PID 4228 wrote to memory of 1440 4228 8ACB.tmp 88 PID 4228 wrote to memory of 1440 4228 8ACB.tmp 88 PID 1440 wrote to memory of 4552 1440 8B67.tmp 89 PID 1440 wrote to memory of 4552 1440 8B67.tmp 89 PID 1440 wrote to memory of 4552 1440 8B67.tmp 89 PID 4552 wrote to memory of 4440 4552 8CAF.tmp 91 PID 4552 wrote to memory of 4440 4552 8CAF.tmp 91 PID 4552 wrote to memory of 4440 4552 8CAF.tmp 91 PID 4440 wrote to memory of 3300 4440 8D3C.tmp 92 PID 4440 wrote to memory of 3300 4440 8D3C.tmp 92 PID 4440 wrote to memory of 3300 4440 8D3C.tmp 92 PID 3300 wrote to memory of 4252 3300 8DC9.tmp 93 PID 3300 wrote to memory of 4252 3300 8DC9.tmp 93 PID 3300 wrote to memory of 4252 3300 8DC9.tmp 93 PID 4252 wrote to memory of 2420 4252 8E65.tmp 94 PID 4252 wrote to memory of 2420 4252 8E65.tmp 94 PID 4252 wrote to memory of 2420 4252 8E65.tmp 94 PID 2420 wrote to memory of 3180 2420 8F30.tmp 96 PID 2420 wrote to memory of 3180 2420 8F30.tmp 96 PID 2420 wrote to memory of 3180 2420 8F30.tmp 96 PID 3180 wrote to memory of 3084 3180 900B.tmp 97 PID 3180 wrote to memory of 3084 3180 900B.tmp 97 PID 3180 wrote to memory of 3084 3180 900B.tmp 97 PID 3084 wrote to memory of 2280 3084 9069.tmp 98 PID 3084 wrote to memory of 2280 3084 9069.tmp 98 PID 3084 wrote to memory of 2280 3084 9069.tmp 98 PID 2280 wrote to memory of 2664 2280 90F5.tmp 99 PID 2280 wrote to memory of 2664 2280 90F5.tmp 99 PID 2280 wrote to memory of 2664 2280 90F5.tmp 99 PID 2664 wrote to memory of 1188 2664 9191.tmp 100 PID 2664 wrote to memory of 1188 2664 9191.tmp 100 PID 2664 wrote to memory of 1188 2664 9191.tmp 100 PID 1188 wrote to memory of 3932 1188 921E.tmp 101 PID 1188 wrote to memory of 3932 1188 921E.tmp 101 PID 1188 wrote to memory of 3932 1188 921E.tmp 101 PID 3932 wrote to memory of 3296 3932 929B.tmp 102 PID 3932 wrote to memory of 3296 3932 929B.tmp 102 PID 3932 wrote to memory of 3296 3932 929B.tmp 102 PID 3296 wrote to memory of 2008 3296 9318.tmp 103 PID 3296 wrote to memory of 2008 3296 9318.tmp 103 PID 3296 wrote to memory of 2008 3296 9318.tmp 103 PID 2008 wrote to memory of 1596 2008 94BE.tmp 104 PID 2008 wrote to memory of 1596 2008 94BE.tmp 104 PID 2008 wrote to memory of 1596 2008 94BE.tmp 104 PID 1596 wrote to memory of 908 1596 95D7.tmp 105 PID 1596 wrote to memory of 908 1596 95D7.tmp 105 PID 1596 wrote to memory of 908 1596 95D7.tmp 105 PID 908 wrote to memory of 4816 908 9664.tmp 106 PID 908 wrote to memory of 4816 908 9664.tmp 106 PID 908 wrote to memory of 4816 908 9664.tmp 106 PID 4816 wrote to memory of 2572 4816 96E1.tmp 107 PID 4816 wrote to memory of 2572 4816 96E1.tmp 107 PID 4816 wrote to memory of 2572 4816 96E1.tmp 107 PID 2572 wrote to memory of 1796 2572 974E.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-27_0af26bad97a8779e9436e4f1738b5cf9_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-27_0af26bad97a8779e9436e4f1738b5cf9_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\8983.tmp"C:\Users\Admin\AppData\Local\Temp\8983.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\8B67.tmp"C:\Users\Admin\AppData\Local\Temp\8B67.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\8F30.tmp"C:\Users\Admin\AppData\Local\Temp\8F30.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\900B.tmp"C:\Users\Admin\AppData\Local\Temp\900B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\9191.tmp"C:\Users\Admin\AppData\Local\Temp\9191.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\921E.tmp"C:\Users\Admin\AppData\Local\Temp\921E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\929B.tmp"C:\Users\Admin\AppData\Local\Temp\929B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\94BE.tmp"C:\Users\Admin\AppData\Local\Temp\94BE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\95D7.tmp"C:\Users\Admin\AppData\Local\Temp\95D7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\9664.tmp"C:\Users\Admin\AppData\Local\Temp\9664.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\96E1.tmp"C:\Users\Admin\AppData\Local\Temp\96E1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\97EA.tmp"C:\Users\Admin\AppData\Local\Temp\97EA.tmp"23⤵
- Executes dropped EXE
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\9896.tmp"C:\Users\Admin\AppData\Local\Temp\9896.tmp"24⤵
- Executes dropped EXE
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"25⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\99EE.tmp"C:\Users\Admin\AppData\Local\Temp\99EE.tmp"26⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"27⤵
- Executes dropped EXE
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"28⤵
- Executes dropped EXE
PID:752 -
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"29⤵
- Executes dropped EXE
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"30⤵
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\9D78.tmp"C:\Users\Admin\AppData\Local\Temp\9D78.tmp"31⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"32⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"33⤵
- Executes dropped EXE
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"34⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\A086.tmp"C:\Users\Admin\AppData\Local\Temp\A086.tmp"35⤵
- Executes dropped EXE
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"36⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\A141.tmp"C:\Users\Admin\AppData\Local\Temp\A141.tmp"37⤵
- Executes dropped EXE
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"38⤵
- Executes dropped EXE
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"39⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"40⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\A633.tmp"C:\Users\Admin\AppData\Local\Temp\A633.tmp"41⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"42⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\A73C.tmp"C:\Users\Admin\AppData\Local\Temp\A73C.tmp"43⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"44⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\A827.tmp"C:\Users\Admin\AppData\Local\Temp\A827.tmp"45⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\A894.tmp"C:\Users\Admin\AppData\Local\Temp\A894.tmp"46⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\A950.tmp"C:\Users\Admin\AppData\Local\Temp\A950.tmp"47⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"48⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\AA59.tmp"C:\Users\Admin\AppData\Local\Temp\AA59.tmp"49⤵
- Executes dropped EXE
PID:712 -
C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"50⤵
- Executes dropped EXE
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\AB82.tmp"C:\Users\Admin\AppData\Local\Temp\AB82.tmp"51⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"52⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"53⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\AD09.tmp"C:\Users\Admin\AppData\Local\Temp\AD09.tmp"54⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\AD76.tmp"C:\Users\Admin\AppData\Local\Temp\AD76.tmp"55⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"56⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"57⤵
- Executes dropped EXE
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"58⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"59⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"60⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\B083.tmp"C:\Users\Admin\AppData\Local\Temp\B083.tmp"61⤵
- Executes dropped EXE
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\B100.tmp"C:\Users\Admin\AppData\Local\Temp\B100.tmp"62⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\B18D.tmp"C:\Users\Admin\AppData\Local\Temp\B18D.tmp"63⤵
- Executes dropped EXE
PID:32 -
C:\Users\Admin\AppData\Local\Temp\B20A.tmp"C:\Users\Admin\AppData\Local\Temp\B20A.tmp"64⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"65⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\B314.tmp"C:\Users\Admin\AppData\Local\Temp\B314.tmp"66⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"67⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\B42D.tmp"C:\Users\Admin\AppData\Local\Temp\B42D.tmp"68⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"69⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\B536.tmp"C:\Users\Admin\AppData\Local\Temp\B536.tmp"70⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"71⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\B640.tmp"C:\Users\Admin\AppData\Local\Temp\B640.tmp"72⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"73⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\B74A.tmp"C:\Users\Admin\AppData\Local\Temp\B74A.tmp"74⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"75⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\B834.tmp"C:\Users\Admin\AppData\Local\Temp\B834.tmp"76⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"77⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\B96D.tmp"C:\Users\Admin\AppData\Local\Temp\B96D.tmp"78⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\BA09.tmp"C:\Users\Admin\AppData\Local\Temp\BA09.tmp"79⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\BA95.tmp"C:\Users\Admin\AppData\Local\Temp\BA95.tmp"80⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\BB22.tmp"C:\Users\Admin\AppData\Local\Temp\BB22.tmp"81⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"82⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"83⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\BC89.tmp"C:\Users\Admin\AppData\Local\Temp\BC89.tmp"84⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\BD26.tmp"C:\Users\Admin\AppData\Local\Temp\BD26.tmp"85⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"86⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"87⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"88⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\BF58.tmp"C:\Users\Admin\AppData\Local\Temp\BF58.tmp"89⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"90⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"91⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"92⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"93⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"94⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"95⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\C340.tmp"C:\Users\Admin\AppData\Local\Temp\C340.tmp"96⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"97⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\C43A.tmp"C:\Users\Admin\AppData\Local\Temp\C43A.tmp"98⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\C498.tmp"C:\Users\Admin\AppData\Local\Temp\C498.tmp"99⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\C505.tmp"C:\Users\Admin\AppData\Local\Temp\C505.tmp"100⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"101⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\C62E.tmp"C:\Users\Admin\AppData\Local\Temp\C62E.tmp"102⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"103⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\C747.tmp"C:\Users\Admin\AppData\Local\Temp\C747.tmp"104⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\C7E4.tmp"C:\Users\Admin\AppData\Local\Temp\C7E4.tmp"105⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\C851.tmp"C:\Users\Admin\AppData\Local\Temp\C851.tmp"106⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"107⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\C95B.tmp"C:\Users\Admin\AppData\Local\Temp\C95B.tmp"108⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\C9C8.tmp"C:\Users\Admin\AppData\Local\Temp\C9C8.tmp"109⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\CA64.tmp"C:\Users\Admin\AppData\Local\Temp\CA64.tmp"110⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"111⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"112⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"113⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\CC87.tmp"C:\Users\Admin\AppData\Local\Temp\CC87.tmp"114⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\CD14.tmp"C:\Users\Admin\AppData\Local\Temp\CD14.tmp"115⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\CD91.tmp"C:\Users\Admin\AppData\Local\Temp\CD91.tmp"116⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"117⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"118⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\CF27.tmp"C:\Users\Admin\AppData\Local\Temp\CF27.tmp"119⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"120⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\D050.tmp"C:\Users\Admin\AppData\Local\Temp\D050.tmp"121⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"122⤵PID:3940
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-