Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28/01/2024, 15:42
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-28_262636a1e81b70c3a21330712f5eb300_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-01-28_262636a1e81b70c3a21330712f5eb300_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-28_262636a1e81b70c3a21330712f5eb300_mafia.exe
-
Size
486KB
-
MD5
262636a1e81b70c3a21330712f5eb300
-
SHA1
c0cacdece09ca653544ecaa60fd837e36bd58f45
-
SHA256
ec774cde1bb12c60aaf66ddaac6406d94010d37c69ce048d33bfd0f0eb9e6a6a
-
SHA512
ed9797862bcf9f7cdda82865a2e2a81ca19a9f963fb8437f9770efcdba80e98567d08e1e881b7639969f651297600eb6a80868e68e020e675d630dd2583c1bb7
-
SSDEEP
12288:/U5rCOTeiDEuIwqIFCSM+KCv8vb6NDwR53uQINZ:/UQOJDEjwOSMpC0jRxuQIN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4988 8A8D.tmp 4220 8B19.tmp 2064 8BB5.tmp 5024 8C42.tmp 3824 8CCF.tmp 1716 8D5B.tmp 1028 8DE8.tmp 5032 8E94.tmp 464 8F40.tmp 3964 8FDC.tmp 800 9078.tmp 448 9124.tmp 1004 91B1.tmp 3164 923D.tmp 1128 92E9.tmp 1940 9376.tmp 4308 9412.tmp 1536 94BE.tmp 4788 954B.tmp 4008 95E7.tmp 2480 9673.tmp 3460 96F0.tmp 4996 97BC.tmp 4752 99FE.tmp 4512 9A8A.tmp 2104 9AF8.tmp 4584 9B94.tmp 4728 9C30.tmp 3704 9CCC.tmp 3144 9D49.tmp 4320 9DC6.tmp 2312 9E53.tmp 4132 9F4D.tmp 3896 9FE9.tmp 4932 A095.tmp 560 A122.tmp 892 A1FD.tmp 860 A2C8.tmp 3864 A335.tmp 4940 A3C2.tmp 1708 A46E.tmp 4964 A4FA.tmp 2620 A596.tmp 2944 A6BF.tmp 4884 A73C.tmp 4988 A7D9.tmp 2936 A875.tmp 3176 A921.tmp 2064 A9BD.tmp 2828 AA78.tmp 1604 AB15.tmp 3188 ABA1.tmp 2720 AC4D.tmp 1716 ACF9.tmp 5064 ADA5.tmp 3208 AE32.tmp 1616 AEFD.tmp 5048 AF89.tmp 4000 B035.tmp 5000 B0D1.tmp 5056 B15E.tmp 1628 B1DB.tmp 976 B277.tmp 3860 B304.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3464 wrote to memory of 4988 3464 2024-01-28_262636a1e81b70c3a21330712f5eb300_mafia.exe 83 PID 3464 wrote to memory of 4988 3464 2024-01-28_262636a1e81b70c3a21330712f5eb300_mafia.exe 83 PID 3464 wrote to memory of 4988 3464 2024-01-28_262636a1e81b70c3a21330712f5eb300_mafia.exe 83 PID 4988 wrote to memory of 4220 4988 8A8D.tmp 84 PID 4988 wrote to memory of 4220 4988 8A8D.tmp 84 PID 4988 wrote to memory of 4220 4988 8A8D.tmp 84 PID 4220 wrote to memory of 2064 4220 8B19.tmp 85 PID 4220 wrote to memory of 2064 4220 8B19.tmp 85 PID 4220 wrote to memory of 2064 4220 8B19.tmp 85 PID 2064 wrote to memory of 5024 2064 8BB5.tmp 86 PID 2064 wrote to memory of 5024 2064 8BB5.tmp 86 PID 2064 wrote to memory of 5024 2064 8BB5.tmp 86 PID 5024 wrote to memory of 3824 5024 8C42.tmp 87 PID 5024 wrote to memory of 3824 5024 8C42.tmp 87 PID 5024 wrote to memory of 3824 5024 8C42.tmp 87 PID 3824 wrote to memory of 1716 3824 8CCF.tmp 88 PID 3824 wrote to memory of 1716 3824 8CCF.tmp 88 PID 3824 wrote to memory of 1716 3824 8CCF.tmp 88 PID 1716 wrote to memory of 1028 1716 8D5B.tmp 89 PID 1716 wrote to memory of 1028 1716 8D5B.tmp 89 PID 1716 wrote to memory of 1028 1716 8D5B.tmp 89 PID 1028 wrote to memory of 5032 1028 8DE8.tmp 90 PID 1028 wrote to memory of 5032 1028 8DE8.tmp 90 PID 1028 wrote to memory of 5032 1028 8DE8.tmp 90 PID 5032 wrote to memory of 464 5032 8E94.tmp 91 PID 5032 wrote to memory of 464 5032 8E94.tmp 91 PID 5032 wrote to memory of 464 5032 8E94.tmp 91 PID 464 wrote to memory of 3964 464 8F40.tmp 92 PID 464 wrote to memory of 3964 464 8F40.tmp 92 PID 464 wrote to memory of 3964 464 8F40.tmp 92 PID 3964 wrote to memory of 800 3964 8FDC.tmp 93 PID 3964 wrote to memory of 800 3964 8FDC.tmp 93 PID 3964 wrote to memory of 800 3964 8FDC.tmp 93 PID 800 wrote to memory of 448 800 9078.tmp 94 PID 800 wrote to memory of 448 800 9078.tmp 94 PID 800 wrote to memory of 448 800 9078.tmp 94 PID 448 wrote to memory of 1004 448 9124.tmp 95 PID 448 wrote to memory of 1004 448 9124.tmp 95 PID 448 wrote to memory of 1004 448 9124.tmp 95 PID 1004 wrote to memory of 3164 1004 91B1.tmp 96 PID 1004 wrote to memory of 3164 1004 91B1.tmp 96 PID 1004 wrote to memory of 3164 1004 91B1.tmp 96 PID 3164 wrote to memory of 1128 3164 923D.tmp 97 PID 3164 wrote to memory of 1128 3164 923D.tmp 97 PID 3164 wrote to memory of 1128 3164 923D.tmp 97 PID 1128 wrote to memory of 1940 1128 92E9.tmp 98 PID 1128 wrote to memory of 1940 1128 92E9.tmp 98 PID 1128 wrote to memory of 1940 1128 92E9.tmp 98 PID 1940 wrote to memory of 4308 1940 9376.tmp 99 PID 1940 wrote to memory of 4308 1940 9376.tmp 99 PID 1940 wrote to memory of 4308 1940 9376.tmp 99 PID 4308 wrote to memory of 1536 4308 9412.tmp 100 PID 4308 wrote to memory of 1536 4308 9412.tmp 100 PID 4308 wrote to memory of 1536 4308 9412.tmp 100 PID 1536 wrote to memory of 4788 1536 94BE.tmp 101 PID 1536 wrote to memory of 4788 1536 94BE.tmp 101 PID 1536 wrote to memory of 4788 1536 94BE.tmp 101 PID 4788 wrote to memory of 4008 4788 954B.tmp 102 PID 4788 wrote to memory of 4008 4788 954B.tmp 102 PID 4788 wrote to memory of 4008 4788 954B.tmp 102 PID 4008 wrote to memory of 2480 4008 95E7.tmp 105 PID 4008 wrote to memory of 2480 4008 95E7.tmp 105 PID 4008 wrote to memory of 2480 4008 95E7.tmp 105 PID 2480 wrote to memory of 3460 2480 9673.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-28_262636a1e81b70c3a21330712f5eb300_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-28_262636a1e81b70c3a21330712f5eb300_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\8B19.tmp"C:\Users\Admin\AppData\Local\Temp\8B19.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\8C42.tmp"C:\Users\Admin\AppData\Local\Temp\8C42.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\8E94.tmp"C:\Users\Admin\AppData\Local\Temp\8E94.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\8F40.tmp"C:\Users\Admin\AppData\Local\Temp\8F40.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\9078.tmp"C:\Users\Admin\AppData\Local\Temp\9078.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Local\Temp\91B1.tmp"C:\Users\Admin\AppData\Local\Temp\91B1.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\923D.tmp"C:\Users\Admin\AppData\Local\Temp\923D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\9376.tmp"C:\Users\Admin\AppData\Local\Temp\9376.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\9412.tmp"C:\Users\Admin\AppData\Local\Temp\9412.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\94BE.tmp"C:\Users\Admin\AppData\Local\Temp\94BE.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\954B.tmp"C:\Users\Admin\AppData\Local\Temp\954B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\95E7.tmp"C:\Users\Admin\AppData\Local\Temp\95E7.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\9673.tmp"C:\Users\Admin\AppData\Local\Temp\9673.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\96F0.tmp"C:\Users\Admin\AppData\Local\Temp\96F0.tmp"23⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\97BC.tmp"C:\Users\Admin\AppData\Local\Temp\97BC.tmp"24⤵
- Executes dropped EXE
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"25⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"26⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"27⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"28⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"29⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"30⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"31⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"32⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\9E53.tmp"C:\Users\Admin\AppData\Local\Temp\9E53.tmp"33⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"34⤵
- Executes dropped EXE
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"35⤵
- Executes dropped EXE
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\A095.tmp"C:\Users\Admin\AppData\Local\Temp\A095.tmp"36⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"37⤵
- Executes dropped EXE
PID:560 -
C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"38⤵
- Executes dropped EXE
PID:892 -
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"39⤵
- Executes dropped EXE
PID:860 -
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"40⤵
- Executes dropped EXE
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"41⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\A46E.tmp"C:\Users\Admin\AppData\Local\Temp\A46E.tmp"42⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"43⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"44⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"45⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"46⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\A73C.tmp"C:\Users\Admin\AppData\Local\Temp\A73C.tmp"47⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"48⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"49⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\A921.tmp"C:\Users\Admin\AppData\Local\Temp\A921.tmp"50⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"51⤵
- Executes dropped EXE
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"52⤵
- Executes dropped EXE
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\AB15.tmp"C:\Users\Admin\AppData\Local\Temp\AB15.tmp"53⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"54⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"55⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"56⤵
- Executes dropped EXE
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"57⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"58⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"59⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"60⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\B035.tmp"C:\Users\Admin\AppData\Local\Temp\B035.tmp"61⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"62⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\B15E.tmp"C:\Users\Admin\AppData\Local\Temp\B15E.tmp"63⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"64⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\B277.tmp"C:\Users\Admin\AppData\Local\Temp\B277.tmp"65⤵
- Executes dropped EXE
PID:976 -
C:\Users\Admin\AppData\Local\Temp\B304.tmp"C:\Users\Admin\AppData\Local\Temp\B304.tmp"66⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\B371.tmp"C:\Users\Admin\AppData\Local\Temp\B371.tmp"67⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"68⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"69⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"70⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"71⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"72⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\B67F.tmp"C:\Users\Admin\AppData\Local\Temp\B67F.tmp"73⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\B70B.tmp"C:\Users\Admin\AppData\Local\Temp\B70B.tmp"74⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\B798.tmp"C:\Users\Admin\AppData\Local\Temp\B798.tmp"75⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\B824.tmp"C:\Users\Admin\AppData\Local\Temp\B824.tmp"76⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"77⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"78⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"79⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\BA38.tmp"C:\Users\Admin\AppData\Local\Temp\BA38.tmp"80⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"81⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"82⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"83⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"84⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"85⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\BD64.tmp"C:\Users\Admin\AppData\Local\Temp\BD64.tmp"86⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"87⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"88⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"89⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\BF87.tmp"C:\Users\Admin\AppData\Local\Temp\BF87.tmp"90⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\C004.tmp"C:\Users\Admin\AppData\Local\Temp\C004.tmp"91⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\C062.tmp"C:\Users\Admin\AppData\Local\Temp\C062.tmp"92⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"93⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\C11D.tmp"C:\Users\Admin\AppData\Local\Temp\C11D.tmp"94⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"95⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\C237.tmp"C:\Users\Admin\AppData\Local\Temp\C237.tmp"96⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"97⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\C36F.tmp"C:\Users\Admin\AppData\Local\Temp\C36F.tmp"98⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"99⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\C479.tmp"C:\Users\Admin\AppData\Local\Temp\C479.tmp"100⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"101⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\C563.tmp"C:\Users\Admin\AppData\Local\Temp\C563.tmp"102⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\C5F0.tmp"C:\Users\Admin\AppData\Local\Temp\C5F0.tmp"103⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\C67C.tmp"C:\Users\Admin\AppData\Local\Temp\C67C.tmp"104⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\C728.tmp"C:\Users\Admin\AppData\Local\Temp\C728.tmp"105⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"106⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\C861.tmp"C:\Users\Admin\AppData\Local\Temp\C861.tmp"107⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"108⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\C96A.tmp"C:\Users\Admin\AppData\Local\Temp\C96A.tmp"109⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"110⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\CA55.tmp"C:\Users\Admin\AppData\Local\Temp\CA55.tmp"111⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\CAD2.tmp"C:\Users\Admin\AppData\Local\Temp\CAD2.tmp"112⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"113⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"114⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"115⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\CD33.tmp"C:\Users\Admin\AppData\Local\Temp\CD33.tmp"116⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"117⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\CE5C.tmp"C:\Users\Admin\AppData\Local\Temp\CE5C.tmp"118⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\CF08.tmp"C:\Users\Admin\AppData\Local\Temp\CF08.tmp"119⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"120⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\D021.tmp"C:\Users\Admin\AppData\Local\Temp\D021.tmp"121⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"122⤵PID:4384
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-