Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19/02/2024, 05:41
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-19_8ca138a5dcbc83776cd967aa73689b2a_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-02-19_8ca138a5dcbc83776cd967aa73689b2a_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-19_8ca138a5dcbc83776cd967aa73689b2a_mafia.exe
-
Size
486KB
-
MD5
8ca138a5dcbc83776cd967aa73689b2a
-
SHA1
2dc6fda14c500039fb0e120721e8304c7181f7b2
-
SHA256
f83fbc950cdbf44f7b65dda33403ec84217f7f9d07b6b4bcff1673afb93c6f2d
-
SHA512
bf27251d6c56ced6bad0ffbb860f431f03c98e2862fa2fd2c3edd669eb92823e50c1e5797da3521df5ccd972dca56ab68aa6a96f225f33fe785cf70f178ca39e
-
SSDEEP
12288:oU5rCOTeiDPK27rRDKHMIztF+C6oygYcE6fJkXNZ:oUQOJDPKMMP27omWJkXN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5112 7223.tmp 2760 72CE.tmp 224 738A.tmp 1468 7426.tmp 4908 74E2.tmp 2616 756E.tmp 1616 75FB.tmp 1812 76A7.tmp 3972 7782.tmp 4168 787C.tmp 4944 7908.tmp 1124 7985.tmp 348 7A31.tmp 3508 7ABE.tmp 4536 7BE7.tmp 1784 7D0F.tmp 2440 7DEA.tmp 3936 7EE4.tmp 868 7F90.tmp 2364 80B9.tmp 2820 81C3.tmp 5092 82AD.tmp 2764 8349.tmp 4648 8462.tmp 3008 852E.tmp 3144 8618.tmp 4092 86B4.tmp 2576 87AE.tmp 3244 8899.tmp 552 8944.tmp 2444 8A1F.tmp 4936 8AEA.tmp 2900 8BD5.tmp 2092 8C61.tmp 3060 8CFE.tmp 2524 8D9A.tmp 3024 8E17.tmp 888 8E94.tmp 2696 8EF2.tmp 2344 8F8E.tmp 1956 902A.tmp 1636 90C6.tmp 3576 9143.tmp 3056 91C0.tmp 3928 923D.tmp 4744 92CA.tmp 1448 9337.tmp 1340 9395.tmp 4856 9412.tmp 2808 953B.tmp 4964 95A8.tmp 4680 9625.tmp 5004 9683.tmp 4056 9710.tmp 2128 979C.tmp 2540 9819.tmp 1376 9896.tmp 1856 9923.tmp 2584 99B0.tmp 4420 9A3C.tmp 4572 9AE8.tmp 3572 9B84.tmp 4832 9C21.tmp 2544 9CAD.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2828 wrote to memory of 5112 2828 2024-02-19_8ca138a5dcbc83776cd967aa73689b2a_mafia.exe 84 PID 2828 wrote to memory of 5112 2828 2024-02-19_8ca138a5dcbc83776cd967aa73689b2a_mafia.exe 84 PID 2828 wrote to memory of 5112 2828 2024-02-19_8ca138a5dcbc83776cd967aa73689b2a_mafia.exe 84 PID 5112 wrote to memory of 2760 5112 7223.tmp 85 PID 5112 wrote to memory of 2760 5112 7223.tmp 85 PID 5112 wrote to memory of 2760 5112 7223.tmp 85 PID 2760 wrote to memory of 224 2760 72CE.tmp 86 PID 2760 wrote to memory of 224 2760 72CE.tmp 86 PID 2760 wrote to memory of 224 2760 72CE.tmp 86 PID 224 wrote to memory of 1468 224 738A.tmp 87 PID 224 wrote to memory of 1468 224 738A.tmp 87 PID 224 wrote to memory of 1468 224 738A.tmp 87 PID 1468 wrote to memory of 4908 1468 7426.tmp 88 PID 1468 wrote to memory of 4908 1468 7426.tmp 88 PID 1468 wrote to memory of 4908 1468 7426.tmp 88 PID 4908 wrote to memory of 2616 4908 74E2.tmp 89 PID 4908 wrote to memory of 2616 4908 74E2.tmp 89 PID 4908 wrote to memory of 2616 4908 74E2.tmp 89 PID 2616 wrote to memory of 1616 2616 756E.tmp 90 PID 2616 wrote to memory of 1616 2616 756E.tmp 90 PID 2616 wrote to memory of 1616 2616 756E.tmp 90 PID 1616 wrote to memory of 1812 1616 75FB.tmp 91 PID 1616 wrote to memory of 1812 1616 75FB.tmp 91 PID 1616 wrote to memory of 1812 1616 75FB.tmp 91 PID 1812 wrote to memory of 3972 1812 76A7.tmp 92 PID 1812 wrote to memory of 3972 1812 76A7.tmp 92 PID 1812 wrote to memory of 3972 1812 76A7.tmp 92 PID 3972 wrote to memory of 4168 3972 7782.tmp 93 PID 3972 wrote to memory of 4168 3972 7782.tmp 93 PID 3972 wrote to memory of 4168 3972 7782.tmp 93 PID 4168 wrote to memory of 4944 4168 787C.tmp 94 PID 4168 wrote to memory of 4944 4168 787C.tmp 94 PID 4168 wrote to memory of 4944 4168 787C.tmp 94 PID 4944 wrote to memory of 1124 4944 7908.tmp 95 PID 4944 wrote to memory of 1124 4944 7908.tmp 95 PID 4944 wrote to memory of 1124 4944 7908.tmp 95 PID 1124 wrote to memory of 348 1124 7985.tmp 96 PID 1124 wrote to memory of 348 1124 7985.tmp 96 PID 1124 wrote to memory of 348 1124 7985.tmp 96 PID 348 wrote to memory of 3508 348 7A31.tmp 97 PID 348 wrote to memory of 3508 348 7A31.tmp 97 PID 348 wrote to memory of 3508 348 7A31.tmp 97 PID 3508 wrote to memory of 4536 3508 7ABE.tmp 98 PID 3508 wrote to memory of 4536 3508 7ABE.tmp 98 PID 3508 wrote to memory of 4536 3508 7ABE.tmp 98 PID 4536 wrote to memory of 1784 4536 7BE7.tmp 99 PID 4536 wrote to memory of 1784 4536 7BE7.tmp 99 PID 4536 wrote to memory of 1784 4536 7BE7.tmp 99 PID 1784 wrote to memory of 2440 1784 7D0F.tmp 100 PID 1784 wrote to memory of 2440 1784 7D0F.tmp 100 PID 1784 wrote to memory of 2440 1784 7D0F.tmp 100 PID 2440 wrote to memory of 3936 2440 7DEA.tmp 101 PID 2440 wrote to memory of 3936 2440 7DEA.tmp 101 PID 2440 wrote to memory of 3936 2440 7DEA.tmp 101 PID 3936 wrote to memory of 868 3936 7EE4.tmp 102 PID 3936 wrote to memory of 868 3936 7EE4.tmp 102 PID 3936 wrote to memory of 868 3936 7EE4.tmp 102 PID 868 wrote to memory of 2364 868 7F90.tmp 103 PID 868 wrote to memory of 2364 868 7F90.tmp 103 PID 868 wrote to memory of 2364 868 7F90.tmp 103 PID 2364 wrote to memory of 2820 2364 80B9.tmp 104 PID 2364 wrote to memory of 2820 2364 80B9.tmp 104 PID 2364 wrote to memory of 2820 2364 80B9.tmp 104 PID 2820 wrote to memory of 5092 2820 81C3.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-19_8ca138a5dcbc83776cd967aa73689b2a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-19_8ca138a5dcbc83776cd967aa73689b2a_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\7908.tmp"C:\Users\Admin\AppData\Local\Temp\7908.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\7F90.tmp"C:\Users\Admin\AppData\Local\Temp\7F90.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Users\Admin\AppData\Local\Temp\80B9.tmp"C:\Users\Admin\AppData\Local\Temp\80B9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\81C3.tmp"C:\Users\Admin\AppData\Local\Temp\81C3.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\82AD.tmp"C:\Users\Admin\AppData\Local\Temp\82AD.tmp"23⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\8349.tmp"C:\Users\Admin\AppData\Local\Temp\8349.tmp"24⤵
- Executes dropped EXE
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\8462.tmp"C:\Users\Admin\AppData\Local\Temp\8462.tmp"25⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\852E.tmp"C:\Users\Admin\AppData\Local\Temp\852E.tmp"26⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\8618.tmp"C:\Users\Admin\AppData\Local\Temp\8618.tmp"27⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"28⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\87AE.tmp"C:\Users\Admin\AppData\Local\Temp\87AE.tmp"29⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\8899.tmp"C:\Users\Admin\AppData\Local\Temp\8899.tmp"30⤵
- Executes dropped EXE
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"31⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"32⤵
- Executes dropped EXE
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"33⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"34⤵
- Executes dropped EXE
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\8C61.tmp"C:\Users\Admin\AppData\Local\Temp\8C61.tmp"35⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"36⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"37⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\8E17.tmp"C:\Users\Admin\AppData\Local\Temp\8E17.tmp"38⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\8E94.tmp"C:\Users\Admin\AppData\Local\Temp\8E94.tmp"39⤵
- Executes dropped EXE
PID:888 -
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"40⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"41⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\902A.tmp"C:\Users\Admin\AppData\Local\Temp\902A.tmp"42⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"43⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\9143.tmp"C:\Users\Admin\AppData\Local\Temp\9143.tmp"44⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\91C0.tmp"C:\Users\Admin\AppData\Local\Temp\91C0.tmp"45⤵
- Executes dropped EXE
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\923D.tmp"C:\Users\Admin\AppData\Local\Temp\923D.tmp"46⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\92CA.tmp"C:\Users\Admin\AppData\Local\Temp\92CA.tmp"47⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\9337.tmp"C:\Users\Admin\AppData\Local\Temp\9337.tmp"48⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\9395.tmp"C:\Users\Admin\AppData\Local\Temp\9395.tmp"49⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\9412.tmp"C:\Users\Admin\AppData\Local\Temp\9412.tmp"50⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"51⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"52⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\9625.tmp"C:\Users\Admin\AppData\Local\Temp\9625.tmp"53⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"54⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\9710.tmp"C:\Users\Admin\AppData\Local\Temp\9710.tmp"55⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"56⤵
- Executes dropped EXE
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\9819.tmp"C:\Users\Admin\AppData\Local\Temp\9819.tmp"57⤵
- Executes dropped EXE
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\9896.tmp"C:\Users\Admin\AppData\Local\Temp\9896.tmp"58⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\9923.tmp"C:\Users\Admin\AppData\Local\Temp\9923.tmp"59⤵
- Executes dropped EXE
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"60⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"61⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"62⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"63⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\9C21.tmp"C:\Users\Admin\AppData\Local\Temp\9C21.tmp"64⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"65⤵
- Executes dropped EXE
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"66⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"67⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\9E63.tmp"C:\Users\Admin\AppData\Local\Temp\9E63.tmp"68⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"69⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"70⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"71⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\A047.tmp"C:\Users\Admin\AppData\Local\Temp\A047.tmp"72⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"73⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"74⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"75⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"76⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"77⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\A374.tmp"C:\Users\Admin\AppData\Local\Temp\A374.tmp"78⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"79⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\A47D.tmp"C:\Users\Admin\AppData\Local\Temp\A47D.tmp"80⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\A50A.tmp"C:\Users\Admin\AppData\Local\Temp\A50A.tmp"81⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"82⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"83⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"84⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\A74C.tmp"C:\Users\Admin\AppData\Local\Temp\A74C.tmp"85⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"86⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"87⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"88⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"89⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"90⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"91⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"92⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"93⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"94⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"95⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\AD09.tmp"C:\Users\Admin\AppData\Local\Temp\AD09.tmp"96⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"97⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"98⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"99⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"100⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"101⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\B035.tmp"C:\Users\Admin\AppData\Local\Temp\B035.tmp"102⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"103⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\B15E.tmp"C:\Users\Admin\AppData\Local\Temp\B15E.tmp"104⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"105⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\B258.tmp"C:\Users\Admin\AppData\Local\Temp\B258.tmp"106⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"107⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"108⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"109⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"110⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"111⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\B565.tmp"C:\Users\Admin\AppData\Local\Temp\B565.tmp"112⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"113⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\B640.tmp"C:\Users\Admin\AppData\Local\Temp\B640.tmp"114⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"115⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\B74A.tmp"C:\Users\Admin\AppData\Local\Temp\B74A.tmp"116⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"117⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\B834.tmp"C:\Users\Admin\AppData\Local\Temp\B834.tmp"118⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"119⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"120⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"121⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\BA57.tmp"C:\Users\Admin\AppData\Local\Temp\BA57.tmp"122⤵PID:3284
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-