Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
162s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2024, 21:00
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-19_cd033af0435fe597f68cf7c49ebabb5d_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-19_cd033af0435fe597f68cf7c49ebabb5d_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-19_cd033af0435fe597f68cf7c49ebabb5d_mafia.exe
-
Size
486KB
-
MD5
cd033af0435fe597f68cf7c49ebabb5d
-
SHA1
cbc570c97e9c5dee4e3975b1cdb6f412ff64cd2c
-
SHA256
8bbeda6c3b6087e008ccc837a0f7dc2eeac545e3a7a6c482bd72723bdddbcedd
-
SHA512
51c645bf18126fe40a706d877e355c793f85c6f54d218323a55d39117384ecb8838f376f9f86d84382099da4a18763d6c6aefd515f62928462dbde802dde78f0
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfDJSDhLPdyltO6U+5GAh6ZYYdRZ2vs8+WbTd2hU:/U5rCOTeiD8FPQl4+5xOZSvMJli6
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3388 5436.tmp 4028 5F90.tmp 4232 6184.tmp 4712 6453.tmp 4704 65D9.tmp 3044 66E3.tmp 5064 67DD.tmp 4084 68F6.tmp 912 6A5D.tmp 516 6BB5.tmp 796 6C80.tmp 1028 6D9A.tmp 1816 6EE2.tmp 3628 728B.tmp 2280 7402.tmp 3348 75E7.tmp 4748 7809.tmp 3168 78C5.tmp 3592 7980.tmp 3512 7A3C.tmp 1020 7BE2.tmp 2068 7D59.tmp 1964 7E24.tmp 3632 7EB1.tmp 2612 7F4D.tmp 3876 8102.tmp 4932 81BE.tmp 2788 8316.tmp 2932 83C1.tmp 4036 849C.tmp 3112 8596.tmp 4588 86A0.tmp 4300 873C.tmp 1260 8846.tmp 640 89CC.tmp 2324 8A49.tmp 3460 8B63.tmp 4352 8BFF.tmp 848 8CDA.tmp 4028 8D76.tmp 1152 8E31.tmp 3144 8E9F.tmp 224 8F3B.tmp 2076 8FA8.tmp 5016 9035.tmp 5036 90D1.tmp 2896 91DB.tmp 4084 9258.tmp 1364 93FE.tmp 1680 948A.tmp 1160 95F2.tmp 548 969E.tmp 1568 970B.tmp 4520 9788.tmp 844 9882.tmp 532 98FF.tmp 4700 9A57.tmp 3800 9AD4.tmp 1456 9B80.tmp 1028 9BED.tmp 1404 9C7A.tmp 2496 9CE7.tmp 3168 9D64.tmp 2636 9E6E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1868 wrote to memory of 3388 1868 2024-04-19_cd033af0435fe597f68cf7c49ebabb5d_mafia.exe 91 PID 1868 wrote to memory of 3388 1868 2024-04-19_cd033af0435fe597f68cf7c49ebabb5d_mafia.exe 91 PID 1868 wrote to memory of 3388 1868 2024-04-19_cd033af0435fe597f68cf7c49ebabb5d_mafia.exe 91 PID 3388 wrote to memory of 4028 3388 5436.tmp 92 PID 3388 wrote to memory of 4028 3388 5436.tmp 92 PID 3388 wrote to memory of 4028 3388 5436.tmp 92 PID 4028 wrote to memory of 4232 4028 5F90.tmp 93 PID 4028 wrote to memory of 4232 4028 5F90.tmp 93 PID 4028 wrote to memory of 4232 4028 5F90.tmp 93 PID 4232 wrote to memory of 4712 4232 6184.tmp 94 PID 4232 wrote to memory of 4712 4232 6184.tmp 94 PID 4232 wrote to memory of 4712 4232 6184.tmp 94 PID 4712 wrote to memory of 4704 4712 6453.tmp 95 PID 4712 wrote to memory of 4704 4712 6453.tmp 95 PID 4712 wrote to memory of 4704 4712 6453.tmp 95 PID 4704 wrote to memory of 3044 4704 65D9.tmp 96 PID 4704 wrote to memory of 3044 4704 65D9.tmp 96 PID 4704 wrote to memory of 3044 4704 65D9.tmp 96 PID 3044 wrote to memory of 5064 3044 66E3.tmp 97 PID 3044 wrote to memory of 5064 3044 66E3.tmp 97 PID 3044 wrote to memory of 5064 3044 66E3.tmp 97 PID 5064 wrote to memory of 4084 5064 67DD.tmp 98 PID 5064 wrote to memory of 4084 5064 67DD.tmp 98 PID 5064 wrote to memory of 4084 5064 67DD.tmp 98 PID 4084 wrote to memory of 912 4084 68F6.tmp 99 PID 4084 wrote to memory of 912 4084 68F6.tmp 99 PID 4084 wrote to memory of 912 4084 68F6.tmp 99 PID 912 wrote to memory of 516 912 6A5D.tmp 100 PID 912 wrote to memory of 516 912 6A5D.tmp 100 PID 912 wrote to memory of 516 912 6A5D.tmp 100 PID 516 wrote to memory of 796 516 6BB5.tmp 101 PID 516 wrote to memory of 796 516 6BB5.tmp 101 PID 516 wrote to memory of 796 516 6BB5.tmp 101 PID 796 wrote to memory of 1028 796 6C80.tmp 102 PID 796 wrote to memory of 1028 796 6C80.tmp 102 PID 796 wrote to memory of 1028 796 6C80.tmp 102 PID 1028 wrote to memory of 1816 1028 6D9A.tmp 103 PID 1028 wrote to memory of 1816 1028 6D9A.tmp 103 PID 1028 wrote to memory of 1816 1028 6D9A.tmp 103 PID 1816 wrote to memory of 3628 1816 6EE2.tmp 104 PID 1816 wrote to memory of 3628 1816 6EE2.tmp 104 PID 1816 wrote to memory of 3628 1816 6EE2.tmp 104 PID 3628 wrote to memory of 2280 3628 728B.tmp 105 PID 3628 wrote to memory of 2280 3628 728B.tmp 105 PID 3628 wrote to memory of 2280 3628 728B.tmp 105 PID 2280 wrote to memory of 3348 2280 7402.tmp 106 PID 2280 wrote to memory of 3348 2280 7402.tmp 106 PID 2280 wrote to memory of 3348 2280 7402.tmp 106 PID 3348 wrote to memory of 4748 3348 75E7.tmp 107 PID 3348 wrote to memory of 4748 3348 75E7.tmp 107 PID 3348 wrote to memory of 4748 3348 75E7.tmp 107 PID 4748 wrote to memory of 3168 4748 7809.tmp 108 PID 4748 wrote to memory of 3168 4748 7809.tmp 108 PID 4748 wrote to memory of 3168 4748 7809.tmp 108 PID 3168 wrote to memory of 3592 3168 78C5.tmp 109 PID 3168 wrote to memory of 3592 3168 78C5.tmp 109 PID 3168 wrote to memory of 3592 3168 78C5.tmp 109 PID 3592 wrote to memory of 3512 3592 7980.tmp 110 PID 3592 wrote to memory of 3512 3592 7980.tmp 110 PID 3592 wrote to memory of 3512 3592 7980.tmp 110 PID 3512 wrote to memory of 1020 3512 7A3C.tmp 111 PID 3512 wrote to memory of 1020 3512 7A3C.tmp 111 PID 3512 wrote to memory of 1020 3512 7A3C.tmp 111 PID 1020 wrote to memory of 2068 1020 7BE2.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-19_cd033af0435fe597f68cf7c49ebabb5d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-19_cd033af0435fe597f68cf7c49ebabb5d_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\5436.tmp"C:\Users\Admin\AppData\Local\Temp\5436.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\5F90.tmp"C:\Users\Admin\AppData\Local\Temp\5F90.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\6184.tmp"C:\Users\Admin\AppData\Local\Temp\6184.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\6453.tmp"C:\Users\Admin\AppData\Local\Temp\6453.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\65D9.tmp"C:\Users\Admin\AppData\Local\Temp\65D9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\66E3.tmp"C:\Users\Admin\AppData\Local\Temp\66E3.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\67DD.tmp"C:\Users\Admin\AppData\Local\Temp\67DD.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\68F6.tmp"C:\Users\Admin\AppData\Local\Temp\68F6.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\6A5D.tmp"C:\Users\Admin\AppData\Local\Temp\6A5D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\6BB5.tmp"C:\Users\Admin\AppData\Local\Temp\6BB5.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Users\Admin\AppData\Local\Temp\6C80.tmp"C:\Users\Admin\AppData\Local\Temp\6C80.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\6D9A.tmp"C:\Users\Admin\AppData\Local\Temp\6D9A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\6EE2.tmp"C:\Users\Admin\AppData\Local\Temp\6EE2.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\728B.tmp"C:\Users\Admin\AppData\Local\Temp\728B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\7402.tmp"C:\Users\Admin\AppData\Local\Temp\7402.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\75E7.tmp"C:\Users\Admin\AppData\Local\Temp\75E7.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\7809.tmp"C:\Users\Admin\AppData\Local\Temp\7809.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\78C5.tmp"C:\Users\Admin\AppData\Local\Temp\78C5.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\7980.tmp"C:\Users\Admin\AppData\Local\Temp\7980.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\7A3C.tmp"C:\Users\Admin\AppData\Local\Temp\7A3C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\7BE2.tmp"C:\Users\Admin\AppData\Local\Temp\7BE2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\7D59.tmp"C:\Users\Admin\AppData\Local\Temp\7D59.tmp"23⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\7E24.tmp"C:\Users\Admin\AppData\Local\Temp\7E24.tmp"24⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\7EB1.tmp"C:\Users\Admin\AppData\Local\Temp\7EB1.tmp"25⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"26⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\8102.tmp"C:\Users\Admin\AppData\Local\Temp\8102.tmp"27⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\81BE.tmp"C:\Users\Admin\AppData\Local\Temp\81BE.tmp"28⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\8316.tmp"C:\Users\Admin\AppData\Local\Temp\8316.tmp"29⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\83C1.tmp"C:\Users\Admin\AppData\Local\Temp\83C1.tmp"30⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\849C.tmp"C:\Users\Admin\AppData\Local\Temp\849C.tmp"31⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\8596.tmp"C:\Users\Admin\AppData\Local\Temp\8596.tmp"32⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\86A0.tmp"C:\Users\Admin\AppData\Local\Temp\86A0.tmp"33⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\873C.tmp"C:\Users\Admin\AppData\Local\Temp\873C.tmp"34⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\8846.tmp"C:\Users\Admin\AppData\Local\Temp\8846.tmp"35⤵
- Executes dropped EXE
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\89CC.tmp"C:\Users\Admin\AppData\Local\Temp\89CC.tmp"36⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\8A49.tmp"C:\Users\Admin\AppData\Local\Temp\8A49.tmp"37⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\8B63.tmp"C:\Users\Admin\AppData\Local\Temp\8B63.tmp"38⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\8BFF.tmp"C:\Users\Admin\AppData\Local\Temp\8BFF.tmp"39⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\8CDA.tmp"C:\Users\Admin\AppData\Local\Temp\8CDA.tmp"40⤵
- Executes dropped EXE
PID:848 -
C:\Users\Admin\AppData\Local\Temp\8D76.tmp"C:\Users\Admin\AppData\Local\Temp\8D76.tmp"41⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\8E31.tmp"C:\Users\Admin\AppData\Local\Temp\8E31.tmp"42⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\8E9F.tmp"C:\Users\Admin\AppData\Local\Temp\8E9F.tmp"43⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\8F3B.tmp"C:\Users\Admin\AppData\Local\Temp\8F3B.tmp"44⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\8FA8.tmp"C:\Users\Admin\AppData\Local\Temp\8FA8.tmp"45⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\9035.tmp"C:\Users\Admin\AppData\Local\Temp\9035.tmp"46⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\90D1.tmp"C:\Users\Admin\AppData\Local\Temp\90D1.tmp"47⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\91DB.tmp"C:\Users\Admin\AppData\Local\Temp\91DB.tmp"48⤵
- Executes dropped EXE
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\9258.tmp"C:\Users\Admin\AppData\Local\Temp\9258.tmp"49⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\93FE.tmp"C:\Users\Admin\AppData\Local\Temp\93FE.tmp"50⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\948A.tmp"C:\Users\Admin\AppData\Local\Temp\948A.tmp"51⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\95F2.tmp"C:\Users\Admin\AppData\Local\Temp\95F2.tmp"52⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\969E.tmp"C:\Users\Admin\AppData\Local\Temp\969E.tmp"53⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\970B.tmp"C:\Users\Admin\AppData\Local\Temp\970B.tmp"54⤵
- Executes dropped EXE
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\9788.tmp"C:\Users\Admin\AppData\Local\Temp\9788.tmp"55⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\9882.tmp"C:\Users\Admin\AppData\Local\Temp\9882.tmp"56⤵
- Executes dropped EXE
PID:844 -
C:\Users\Admin\AppData\Local\Temp\98FF.tmp"C:\Users\Admin\AppData\Local\Temp\98FF.tmp"57⤵
- Executes dropped EXE
PID:532 -
C:\Users\Admin\AppData\Local\Temp\9A57.tmp"C:\Users\Admin\AppData\Local\Temp\9A57.tmp"58⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\9AD4.tmp"C:\Users\Admin\AppData\Local\Temp\9AD4.tmp"59⤵
- Executes dropped EXE
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\9B80.tmp"C:\Users\Admin\AppData\Local\Temp\9B80.tmp"60⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\9BED.tmp"C:\Users\Admin\AppData\Local\Temp\9BED.tmp"61⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\9C7A.tmp"C:\Users\Admin\AppData\Local\Temp\9C7A.tmp"62⤵
- Executes dropped EXE
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\9CE7.tmp"C:\Users\Admin\AppData\Local\Temp\9CE7.tmp"63⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\9D64.tmp"C:\Users\Admin\AppData\Local\Temp\9D64.tmp"64⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\9E6E.tmp"C:\Users\Admin\AppData\Local\Temp\9E6E.tmp"65⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\9EEB.tmp"C:\Users\Admin\AppData\Local\Temp\9EEB.tmp"66⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\9F77.tmp"C:\Users\Admin\AppData\Local\Temp\9F77.tmp"67⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\A294.tmp"C:\Users\Admin\AppData\Local\Temp\A294.tmp"68⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\A350.tmp"C:\Users\Admin\AppData\Local\Temp\A350.tmp"69⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\A5EF.tmp"C:\Users\Admin\AppData\Local\Temp\A5EF.tmp"70⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\A67C.tmp"C:\Users\Admin\AppData\Local\Temp\A67C.tmp"71⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"72⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"73⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\A88F.tmp"C:\Users\Admin\AppData\Local\Temp\A88F.tmp"74⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\A8FD.tmp"C:\Users\Admin\AppData\Local\Temp\A8FD.tmp"75⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\A96A.tmp"C:\Users\Admin\AppData\Local\Temp\A96A.tmp"76⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\A9F7.tmp"C:\Users\Admin\AppData\Local\Temp\A9F7.tmp"77⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\AA74.tmp"C:\Users\Admin\AppData\Local\Temp\AA74.tmp"78⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\AAE1.tmp"C:\Users\Admin\AppData\Local\Temp\AAE1.tmp"79⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\AB6E.tmp"C:\Users\Admin\AppData\Local\Temp\AB6E.tmp"80⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\AC29.tmp"C:\Users\Admin\AppData\Local\Temp\AC29.tmp"81⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\ACE5.tmp"C:\Users\Admin\AppData\Local\Temp\ACE5.tmp"82⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\AD52.tmp"C:\Users\Admin\AppData\Local\Temp\AD52.tmp"83⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\AF08.tmp"C:\Users\Admin\AppData\Local\Temp\AF08.tmp"84⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\AFB3.tmp"C:\Users\Admin\AppData\Local\Temp\AFB3.tmp"85⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\B030.tmp"C:\Users\Admin\AppData\Local\Temp\B030.tmp"86⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\B0BD.tmp"C:\Users\Admin\AppData\Local\Temp\B0BD.tmp"87⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\B32E.tmp"C:\Users\Admin\AppData\Local\Temp\B32E.tmp"88⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\B409.tmp"C:\Users\Admin\AppData\Local\Temp\B409.tmp"89⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\B495.tmp"C:\Users\Admin\AppData\Local\Temp\B495.tmp"90⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\B522.tmp"C:\Users\Admin\AppData\Local\Temp\B522.tmp"91⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\B755.tmp"C:\Users\Admin\AppData\Local\Temp\B755.tmp"92⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\B7C2.tmp"C:\Users\Admin\AppData\Local\Temp\B7C2.tmp"93⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\B9E5.tmp"C:\Users\Admin\AppData\Local\Temp\B9E5.tmp"94⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\BA52.tmp"C:\Users\Admin\AppData\Local\Temp\BA52.tmp"95⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\BACF.tmp"C:\Users\Admin\AppData\Local\Temp\BACF.tmp"96⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\BB5C.tmp"C:\Users\Admin\AppData\Local\Temp\BB5C.tmp"97⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\BBE8.tmp"C:\Users\Admin\AppData\Local\Temp\BBE8.tmp"98⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\BC56.tmp"C:\Users\Admin\AppData\Local\Temp\BC56.tmp"99⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\BCE2.tmp"C:\Users\Admin\AppData\Local\Temp\BCE2.tmp"100⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\BD5F.tmp"C:\Users\Admin\AppData\Local\Temp\BD5F.tmp"101⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\BDDC.tmp"C:\Users\Admin\AppData\Local\Temp\BDDC.tmp"102⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\C06D.tmp"C:\Users\Admin\AppData\Local\Temp\C06D.tmp"103⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\C128.tmp"C:\Users\Admin\AppData\Local\Temp\C128.tmp"104⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\C1E4.tmp"C:\Users\Admin\AppData\Local\Temp\C1E4.tmp"105⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\C29F.tmp"C:\Users\Admin\AppData\Local\Temp\C29F.tmp"106⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\C399.tmp"C:\Users\Admin\AppData\Local\Temp\C399.tmp"107⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\C4A3.tmp"C:\Users\Admin\AppData\Local\Temp\C4A3.tmp"108⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\C54F.tmp"C:\Users\Admin\AppData\Local\Temp\C54F.tmp"109⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\C60A.tmp"C:\Users\Admin\AppData\Local\Temp\C60A.tmp"110⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\C714.tmp"C:\Users\Admin\AppData\Local\Temp\C714.tmp"111⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\C7DF.tmp"C:\Users\Admin\AppData\Local\Temp\C7DF.tmp"112⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\C86C.tmp"C:\Users\Admin\AppData\Local\Temp\C86C.tmp"113⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\C917.tmp"C:\Users\Admin\AppData\Local\Temp\C917.tmp"114⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\C9D3.tmp"C:\Users\Admin\AppData\Local\Temp\C9D3.tmp"115⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\CA60.tmp"C:\Users\Admin\AppData\Local\Temp\CA60.tmp"116⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\CAFC.tmp"C:\Users\Admin\AppData\Local\Temp\CAFC.tmp"117⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\CB69.tmp"C:\Users\Admin\AppData\Local\Temp\CB69.tmp"118⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\CC73.tmp"C:\Users\Admin\AppData\Local\Temp\CC73.tmp"119⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\CCE0.tmp"C:\Users\Admin\AppData\Local\Temp\CCE0.tmp"120⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\CD6D.tmp"C:\Users\Admin\AppData\Local\Temp\CD6D.tmp"121⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"122⤵PID:3460
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-