Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
15/04/2024, 11:27
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-15_1ab9830ee4afbca97925a538f647c52b_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-15_1ab9830ee4afbca97925a538f647c52b_mafia.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-15_1ab9830ee4afbca97925a538f647c52b_mafia.exe
-
Size
486KB
-
MD5
1ab9830ee4afbca97925a538f647c52b
-
SHA1
b8097e5c2103e531e0e9861ae1385516de5a6dd4
-
SHA256
09b239f0e8842b21b2efa8bf854bdea808bdd36d55c5e1e90beece01634e0759
-
SHA512
a618e87a4b02686aab8f95904a905d121eb172de700f21ff9b62a96a8589f71d49e8fd4b50932f189e437f0d5c34c3cecf726ead887e069b64cbe9bc045d3bbe
-
SSDEEP
12288:/U5rCOTeiDsf1VyX8ixJGwdMbg93YzsGljQDNZ:/UQOJDsfopJGrbg9384N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 316 7C54.tmp 4648 7CE1.tmp 860 7D6D.tmp 1148 7E58.tmp 4432 7F13.tmp 2804 7FA0.tmp 1072 802C.tmp 540 80E8.tmp 4856 8165.tmp 1460 81F1.tmp 3032 828E.tmp 2536 831A.tmp 1976 83B7.tmp 1672 8443.tmp 2396 84C0.tmp 2464 853D.tmp 4292 85CA.tmp 1656 8685.tmp 4716 8731.tmp 2304 882B.tmp 4660 88D7.tmp 5052 8973.tmp 1924 8A00.tmp 804 8A9C.tmp 1856 8B29.tmp 972 8C23.tmp 740 8CCF.tmp 3356 8DC9.tmp 2712 8E84.tmp 2948 8F9D.tmp 4348 903A.tmp 1612 90D6.tmp 2772 91FF.tmp 1000 928B.tmp 1036 9318.tmp 4648 93A5.tmp 3060 9441.tmp 3392 94DD.tmp 1912 956A.tmp 860 95E7.tmp 4436 9673.tmp 1304 9700.tmp 3936 979C.tmp 4628 9829.tmp 2332 98C5.tmp 5048 9961.tmp 1172 99FE.tmp 540 9A8A.tmp 624 9B07.tmp 4900 9B84.tmp 3044 9C21.tmp 2888 9C9E.tmp 4164 9D1B.tmp 1804 9D98.tmp 1600 9E24.tmp 4044 9E92.tmp 2028 9F0F.tmp 224 9F9B.tmp 1572 A009.tmp 4292 A095.tmp 1160 A131.tmp 3968 A1CE.tmp 2616 A23B.tmp 3352 A2B8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3592 wrote to memory of 316 3592 2024-04-15_1ab9830ee4afbca97925a538f647c52b_mafia.exe 87 PID 3592 wrote to memory of 316 3592 2024-04-15_1ab9830ee4afbca97925a538f647c52b_mafia.exe 87 PID 3592 wrote to memory of 316 3592 2024-04-15_1ab9830ee4afbca97925a538f647c52b_mafia.exe 87 PID 316 wrote to memory of 4648 316 7C54.tmp 88 PID 316 wrote to memory of 4648 316 7C54.tmp 88 PID 316 wrote to memory of 4648 316 7C54.tmp 88 PID 4648 wrote to memory of 860 4648 7CE1.tmp 90 PID 4648 wrote to memory of 860 4648 7CE1.tmp 90 PID 4648 wrote to memory of 860 4648 7CE1.tmp 90 PID 860 wrote to memory of 1148 860 7D6D.tmp 91 PID 860 wrote to memory of 1148 860 7D6D.tmp 91 PID 860 wrote to memory of 1148 860 7D6D.tmp 91 PID 1148 wrote to memory of 4432 1148 7E58.tmp 93 PID 1148 wrote to memory of 4432 1148 7E58.tmp 93 PID 1148 wrote to memory of 4432 1148 7E58.tmp 93 PID 4432 wrote to memory of 2804 4432 7F13.tmp 94 PID 4432 wrote to memory of 2804 4432 7F13.tmp 94 PID 4432 wrote to memory of 2804 4432 7F13.tmp 94 PID 2804 wrote to memory of 1072 2804 7FA0.tmp 95 PID 2804 wrote to memory of 1072 2804 7FA0.tmp 95 PID 2804 wrote to memory of 1072 2804 7FA0.tmp 95 PID 1072 wrote to memory of 540 1072 802C.tmp 96 PID 1072 wrote to memory of 540 1072 802C.tmp 96 PID 1072 wrote to memory of 540 1072 802C.tmp 96 PID 540 wrote to memory of 4856 540 80E8.tmp 97 PID 540 wrote to memory of 4856 540 80E8.tmp 97 PID 540 wrote to memory of 4856 540 80E8.tmp 97 PID 4856 wrote to memory of 1460 4856 8165.tmp 98 PID 4856 wrote to memory of 1460 4856 8165.tmp 98 PID 4856 wrote to memory of 1460 4856 8165.tmp 98 PID 1460 wrote to memory of 3032 1460 81F1.tmp 99 PID 1460 wrote to memory of 3032 1460 81F1.tmp 99 PID 1460 wrote to memory of 3032 1460 81F1.tmp 99 PID 3032 wrote to memory of 2536 3032 828E.tmp 100 PID 3032 wrote to memory of 2536 3032 828E.tmp 100 PID 3032 wrote to memory of 2536 3032 828E.tmp 100 PID 2536 wrote to memory of 1976 2536 831A.tmp 101 PID 2536 wrote to memory of 1976 2536 831A.tmp 101 PID 2536 wrote to memory of 1976 2536 831A.tmp 101 PID 1976 wrote to memory of 1672 1976 83B7.tmp 102 PID 1976 wrote to memory of 1672 1976 83B7.tmp 102 PID 1976 wrote to memory of 1672 1976 83B7.tmp 102 PID 1672 wrote to memory of 2396 1672 8443.tmp 104 PID 1672 wrote to memory of 2396 1672 8443.tmp 104 PID 1672 wrote to memory of 2396 1672 8443.tmp 104 PID 2396 wrote to memory of 2464 2396 84C0.tmp 105 PID 2396 wrote to memory of 2464 2396 84C0.tmp 105 PID 2396 wrote to memory of 2464 2396 84C0.tmp 105 PID 2464 wrote to memory of 4292 2464 853D.tmp 106 PID 2464 wrote to memory of 4292 2464 853D.tmp 106 PID 2464 wrote to memory of 4292 2464 853D.tmp 106 PID 4292 wrote to memory of 1656 4292 85CA.tmp 107 PID 4292 wrote to memory of 1656 4292 85CA.tmp 107 PID 4292 wrote to memory of 1656 4292 85CA.tmp 107 PID 1656 wrote to memory of 4716 1656 8685.tmp 109 PID 1656 wrote to memory of 4716 1656 8685.tmp 109 PID 1656 wrote to memory of 4716 1656 8685.tmp 109 PID 4716 wrote to memory of 2304 4716 8731.tmp 110 PID 4716 wrote to memory of 2304 4716 8731.tmp 110 PID 4716 wrote to memory of 2304 4716 8731.tmp 110 PID 2304 wrote to memory of 4660 2304 882B.tmp 111 PID 2304 wrote to memory of 4660 2304 882B.tmp 111 PID 2304 wrote to memory of 4660 2304 882B.tmp 111 PID 4660 wrote to memory of 5052 4660 88D7.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-15_1ab9830ee4afbca97925a538f647c52b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-15_1ab9830ee4afbca97925a538f647c52b_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\7C54.tmp"C:\Users\Admin\AppData\Local\Temp\7C54.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\7F13.tmp"C:\Users\Admin\AppData\Local\Temp\7F13.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\802C.tmp"C:\Users\Admin\AppData\Local\Temp\802C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\80E8.tmp"C:\Users\Admin\AppData\Local\Temp\80E8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\8165.tmp"C:\Users\Admin\AppData\Local\Temp\8165.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\81F1.tmp"C:\Users\Admin\AppData\Local\Temp\81F1.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\828E.tmp"C:\Users\Admin\AppData\Local\Temp\828E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\83B7.tmp"C:\Users\Admin\AppData\Local\Temp\83B7.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\84C0.tmp"C:\Users\Admin\AppData\Local\Temp\84C0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\853D.tmp"C:\Users\Admin\AppData\Local\Temp\853D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\85CA.tmp"C:\Users\Admin\AppData\Local\Temp\85CA.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\8685.tmp"C:\Users\Admin\AppData\Local\Temp\8685.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\8731.tmp"C:\Users\Admin\AppData\Local\Temp\8731.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\882B.tmp"C:\Users\Admin\AppData\Local\Temp\882B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\8973.tmp"C:\Users\Admin\AppData\Local\Temp\8973.tmp"23⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\8A00.tmp"C:\Users\Admin\AppData\Local\Temp\8A00.tmp"24⤵
- Executes dropped EXE
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"25⤵
- Executes dropped EXE
PID:804 -
C:\Users\Admin\AppData\Local\Temp\8B29.tmp"C:\Users\Admin\AppData\Local\Temp\8B29.tmp"26⤵
- Executes dropped EXE
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\8C23.tmp"C:\Users\Admin\AppData\Local\Temp\8C23.tmp"27⤵
- Executes dropped EXE
PID:972 -
C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"28⤵
- Executes dropped EXE
PID:740 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"29⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\8E84.tmp"C:\Users\Admin\AppData\Local\Temp\8E84.tmp"30⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"31⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\903A.tmp"C:\Users\Admin\AppData\Local\Temp\903A.tmp"32⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"33⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp"34⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"35⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"36⤵
- Executes dropped EXE
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"37⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\93A5.tmp"C:\Users\Admin\AppData\Local\Temp\93A5.tmp"38⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\9441.tmp"C:\Users\Admin\AppData\Local\Temp\9441.tmp"39⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\94DD.tmp"C:\Users\Admin\AppData\Local\Temp\94DD.tmp"40⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\956A.tmp"C:\Users\Admin\AppData\Local\Temp\956A.tmp"41⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\95E7.tmp"C:\Users\Admin\AppData\Local\Temp\95E7.tmp"42⤵
- Executes dropped EXE
PID:860 -
C:\Users\Admin\AppData\Local\Temp\9673.tmp"C:\Users\Admin\AppData\Local\Temp\9673.tmp"43⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\9700.tmp"C:\Users\Admin\AppData\Local\Temp\9700.tmp"44⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"45⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"46⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\98C5.tmp"C:\Users\Admin\AppData\Local\Temp\98C5.tmp"47⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"48⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"49⤵
- Executes dropped EXE
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"50⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"51⤵
- Executes dropped EXE
PID:624 -
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"52⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\9C21.tmp"C:\Users\Admin\AppData\Local\Temp\9C21.tmp"53⤵
- Executes dropped EXE
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"54⤵
- Executes dropped EXE
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"55⤵
- Executes dropped EXE
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"56⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"57⤵
- Executes dropped EXE
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"58⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"59⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"60⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"61⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\A095.tmp"C:\Users\Admin\AppData\Local\Temp\A095.tmp"62⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"63⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"64⤵
- Executes dropped EXE
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\A23B.tmp"C:\Users\Admin\AppData\Local\Temp\A23B.tmp"65⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"66⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"67⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"68⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"69⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"70⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\A613.tmp"C:\Users\Admin\AppData\Local\Temp\A613.tmp"71⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"72⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"73⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"74⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\A827.tmp"C:\Users\Admin\AppData\Local\Temp\A827.tmp"75⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"76⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\A921.tmp"C:\Users\Admin\AppData\Local\Temp\A921.tmp"77⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\A99E.tmp"C:\Users\Admin\AppData\Local\Temp\A99E.tmp"78⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"79⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"80⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\AB53.tmp"C:\Users\Admin\AppData\Local\Temp\AB53.tmp"81⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"82⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"83⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"84⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\AD57.tmp"C:\Users\Admin\AppData\Local\Temp\AD57.tmp"85⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"86⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\AE60.tmp"C:\Users\Admin\AppData\Local\Temp\AE60.tmp"87⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"88⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"89⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"90⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"91⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\B12F.tmp"C:\Users\Admin\AppData\Local\Temp\B12F.tmp"92⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"93⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\B277.tmp"C:\Users\Admin\AppData\Local\Temp\B277.tmp"94⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"95⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"96⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\B42D.tmp"C:\Users\Admin\AppData\Local\Temp\B42D.tmp"97⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\B49A.tmp"C:\Users\Admin\AppData\Local\Temp\B49A.tmp"98⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\B536.tmp"C:\Users\Admin\AppData\Local\Temp\B536.tmp"99⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"100⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"101⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"102⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\B769.tmp"C:\Users\Admin\AppData\Local\Temp\B769.tmp"103⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\B805.tmp"C:\Users\Admin\AppData\Local\Temp\B805.tmp"104⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\B892.tmp"C:\Users\Admin\AppData\Local\Temp\B892.tmp"105⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"106⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\B97C.tmp"C:\Users\Admin\AppData\Local\Temp\B97C.tmp"107⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\BA57.tmp"C:\Users\Admin\AppData\Local\Temp\BA57.tmp"108⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"109⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\BB41.tmp"C:\Users\Admin\AppData\Local\Temp\BB41.tmp"110⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"111⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"112⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\BC99.tmp"C:\Users\Admin\AppData\Local\Temp\BC99.tmp"113⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\BD16.tmp"C:\Users\Admin\AppData\Local\Temp\BD16.tmp"114⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"115⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"116⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"117⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\BF49.tmp"C:\Users\Admin\AppData\Local\Temp\BF49.tmp"118⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"119⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"120⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"121⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"122⤵PID:3516
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-