Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 09:50
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-26_f9b8a3c6fc01cdcad416eedda5dc0f83_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-26_f9b8a3c6fc01cdcad416eedda5dc0f83_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-26_f9b8a3c6fc01cdcad416eedda5dc0f83_mafia.exe
-
Size
536KB
-
MD5
f9b8a3c6fc01cdcad416eedda5dc0f83
-
SHA1
4dbe52f32f72d6660d65e91f93442654a0bb3b87
-
SHA256
2f710f9f7964fd561d74894d8da5b70be2aa32006115ed6f2d1166b966531a67
-
SHA512
f7c1466f77e5990f01ada005eedcb612cc013816ad76be3548ecce221a37ea170e93467ab0fda91377630a8e2e7e041a3244d404faa655e7d7b4e0f2d502bc1b
-
SSDEEP
12288:wU5rCOTeiUwQlbVlqPfzmnv6wIY9yTvUEaaIZxVJ0ZT9:wUQOJUrymSRY9YIaIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 232 88E7.tmp 1980 89B2.tmp 1620 8A4E.tmp 408 8B19.tmp 2088 8BC5.tmp 3864 8C61.tmp 1972 8D1D.tmp 316 8DB9.tmp 3924 8E55.tmp 4508 8ED2.tmp 2672 8F8E.tmp 3312 901A.tmp 864 90C6.tmp 3160 9143.tmp 1600 91B1.tmp 1316 922E.tmp 2024 92DA.tmp 868 9347.tmp 1716 9402.tmp 2624 94AE.tmp 1812 953B.tmp 3980 95F6.tmp 2468 96B2.tmp 1036 975E.tmp 1592 9819.tmp 2272 98A6.tmp 4768 9952.tmp 4432 9A1D.tmp 4920 9AE8.tmp 4872 9B94.tmp 1636 9C4F.tmp 1292 9CEC.tmp 3856 9DA7.tmp 1896 9E24.tmp 3956 9EB1.tmp 1416 9F3D.tmp 1464 9F9B.tmp 2540 A018.tmp 4744 A095.tmp 2544 A103.tmp 1540 A160.tmp 4456 A1CE.tmp 3480 A22B.tmp 864 A2B8.tmp 1600 A316.tmp 4932 A393.tmp 1904 A410.tmp 4132 A47D.tmp 2612 A4DB.tmp 1428 A529.tmp 3104 A577.tmp 3060 A5C5.tmp 2784 A623.tmp 1588 A681.tmp 3296 A6CF.tmp 2360 A72D.tmp 4152 A77B.tmp 3824 A7C9.tmp 3272 A827.tmp 4492 A884.tmp 2220 A8D3.tmp 5016 A921.tmp 232 A96F.tmp 4872 A9BD.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5004 wrote to memory of 232 5004 2024-05-26_f9b8a3c6fc01cdcad416eedda5dc0f83_mafia.exe 83 PID 5004 wrote to memory of 232 5004 2024-05-26_f9b8a3c6fc01cdcad416eedda5dc0f83_mafia.exe 83 PID 5004 wrote to memory of 232 5004 2024-05-26_f9b8a3c6fc01cdcad416eedda5dc0f83_mafia.exe 83 PID 232 wrote to memory of 1980 232 88E7.tmp 84 PID 232 wrote to memory of 1980 232 88E7.tmp 84 PID 232 wrote to memory of 1980 232 88E7.tmp 84 PID 1980 wrote to memory of 1620 1980 89B2.tmp 86 PID 1980 wrote to memory of 1620 1980 89B2.tmp 86 PID 1980 wrote to memory of 1620 1980 89B2.tmp 86 PID 1620 wrote to memory of 408 1620 8A4E.tmp 88 PID 1620 wrote to memory of 408 1620 8A4E.tmp 88 PID 1620 wrote to memory of 408 1620 8A4E.tmp 88 PID 408 wrote to memory of 2088 408 8B19.tmp 89 PID 408 wrote to memory of 2088 408 8B19.tmp 89 PID 408 wrote to memory of 2088 408 8B19.tmp 89 PID 2088 wrote to memory of 3864 2088 8BC5.tmp 91 PID 2088 wrote to memory of 3864 2088 8BC5.tmp 91 PID 2088 wrote to memory of 3864 2088 8BC5.tmp 91 PID 3864 wrote to memory of 1972 3864 8C61.tmp 92 PID 3864 wrote to memory of 1972 3864 8C61.tmp 92 PID 3864 wrote to memory of 1972 3864 8C61.tmp 92 PID 1972 wrote to memory of 316 1972 8D1D.tmp 93 PID 1972 wrote to memory of 316 1972 8D1D.tmp 93 PID 1972 wrote to memory of 316 1972 8D1D.tmp 93 PID 316 wrote to memory of 3924 316 8DB9.tmp 94 PID 316 wrote to memory of 3924 316 8DB9.tmp 94 PID 316 wrote to memory of 3924 316 8DB9.tmp 94 PID 3924 wrote to memory of 4508 3924 8E55.tmp 95 PID 3924 wrote to memory of 4508 3924 8E55.tmp 95 PID 3924 wrote to memory of 4508 3924 8E55.tmp 95 PID 4508 wrote to memory of 2672 4508 8ED2.tmp 96 PID 4508 wrote to memory of 2672 4508 8ED2.tmp 96 PID 4508 wrote to memory of 2672 4508 8ED2.tmp 96 PID 2672 wrote to memory of 3312 2672 8F8E.tmp 99 PID 2672 wrote to memory of 3312 2672 8F8E.tmp 99 PID 2672 wrote to memory of 3312 2672 8F8E.tmp 99 PID 3312 wrote to memory of 864 3312 901A.tmp 100 PID 3312 wrote to memory of 864 3312 901A.tmp 100 PID 3312 wrote to memory of 864 3312 901A.tmp 100 PID 864 wrote to memory of 3160 864 90C6.tmp 101 PID 864 wrote to memory of 3160 864 90C6.tmp 101 PID 864 wrote to memory of 3160 864 90C6.tmp 101 PID 3160 wrote to memory of 1600 3160 9143.tmp 102 PID 3160 wrote to memory of 1600 3160 9143.tmp 102 PID 3160 wrote to memory of 1600 3160 9143.tmp 102 PID 1600 wrote to memory of 1316 1600 91B1.tmp 103 PID 1600 wrote to memory of 1316 1600 91B1.tmp 103 PID 1600 wrote to memory of 1316 1600 91B1.tmp 103 PID 1316 wrote to memory of 2024 1316 922E.tmp 104 PID 1316 wrote to memory of 2024 1316 922E.tmp 104 PID 1316 wrote to memory of 2024 1316 922E.tmp 104 PID 2024 wrote to memory of 868 2024 92DA.tmp 105 PID 2024 wrote to memory of 868 2024 92DA.tmp 105 PID 2024 wrote to memory of 868 2024 92DA.tmp 105 PID 868 wrote to memory of 1716 868 9347.tmp 107 PID 868 wrote to memory of 1716 868 9347.tmp 107 PID 868 wrote to memory of 1716 868 9347.tmp 107 PID 1716 wrote to memory of 2624 1716 9402.tmp 109 PID 1716 wrote to memory of 2624 1716 9402.tmp 109 PID 1716 wrote to memory of 2624 1716 9402.tmp 109 PID 2624 wrote to memory of 1812 2624 94AE.tmp 110 PID 2624 wrote to memory of 1812 2624 94AE.tmp 110 PID 2624 wrote to memory of 1812 2624 94AE.tmp 110 PID 1812 wrote to memory of 3980 1812 953B.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_f9b8a3c6fc01cdcad416eedda5dc0f83_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-26_f9b8a3c6fc01cdcad416eedda5dc0f83_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\88E7.tmp"C:\Users\Admin\AppData\Local\Temp\88E7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Users\Admin\AppData\Local\Temp\89B2.tmp"C:\Users\Admin\AppData\Local\Temp\89B2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\8B19.tmp"C:\Users\Admin\AppData\Local\Temp\8B19.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\8C61.tmp"C:\Users\Admin\AppData\Local\Temp\8C61.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Users\Admin\AppData\Local\Temp\8E55.tmp"C:\Users\Admin\AppData\Local\Temp\8E55.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\901A.tmp"C:\Users\Admin\AppData\Local\Temp\901A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\9143.tmp"C:\Users\Admin\AppData\Local\Temp\9143.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\91B1.tmp"C:\Users\Admin\AppData\Local\Temp\91B1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\922E.tmp"C:\Users\Admin\AppData\Local\Temp\922E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\92DA.tmp"C:\Users\Admin\AppData\Local\Temp\92DA.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Users\Admin\AppData\Local\Temp\9402.tmp"C:\Users\Admin\AppData\Local\Temp\9402.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\94AE.tmp"C:\Users\Admin\AppData\Local\Temp\94AE.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\95F6.tmp"C:\Users\Admin\AppData\Local\Temp\95F6.tmp"23⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\96B2.tmp"C:\Users\Admin\AppData\Local\Temp\96B2.tmp"24⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"25⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\9819.tmp"C:\Users\Admin\AppData\Local\Temp\9819.tmp"26⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\98A6.tmp"C:\Users\Admin\AppData\Local\Temp\98A6.tmp"27⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\9952.tmp"C:\Users\Admin\AppData\Local\Temp\9952.tmp"28⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"29⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"30⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"31⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"32⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"33⤵
- Executes dropped EXE
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"34⤵
- Executes dropped EXE
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"35⤵
- Executes dropped EXE
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"36⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"37⤵
- Executes dropped EXE
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"38⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"39⤵
- Executes dropped EXE
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\A095.tmp"C:\Users\Admin\AppData\Local\Temp\A095.tmp"40⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\A103.tmp"C:\Users\Admin\AppData\Local\Temp\A103.tmp"41⤵
- Executes dropped EXE
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\A160.tmp"C:\Users\Admin\AppData\Local\Temp\A160.tmp"42⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"43⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"44⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"45⤵
- Executes dropped EXE
PID:864 -
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"46⤵
- Executes dropped EXE
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"47⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\A410.tmp"C:\Users\Admin\AppData\Local\Temp\A410.tmp"48⤵
- Executes dropped EXE
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\A47D.tmp"C:\Users\Admin\AppData\Local\Temp\A47D.tmp"49⤵
- Executes dropped EXE
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"50⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"51⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\A577.tmp"C:\Users\Admin\AppData\Local\Temp\A577.tmp"52⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"53⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"54⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"55⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"56⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"57⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"58⤵
- Executes dropped EXE
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"59⤵
- Executes dropped EXE
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\A827.tmp"C:\Users\Admin\AppData\Local\Temp\A827.tmp"60⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\A884.tmp"C:\Users\Admin\AppData\Local\Temp\A884.tmp"61⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"62⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\A921.tmp"C:\Users\Admin\AppData\Local\Temp\A921.tmp"63⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\A96F.tmp"C:\Users\Admin\AppData\Local\Temp\A96F.tmp"64⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"65⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"66⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\AA69.tmp"C:\Users\Admin\AppData\Local\Temp\AA69.tmp"67⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"68⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\AB05.tmp"C:\Users\Admin\AppData\Local\Temp\AB05.tmp"69⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\AB53.tmp"C:\Users\Admin\AppData\Local\Temp\AB53.tmp"70⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"71⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"72⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"73⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"74⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\AD18.tmp"C:\Users\Admin\AppData\Local\Temp\AD18.tmp"75⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\AD66.tmp"C:\Users\Admin\AppData\Local\Temp\AD66.tmp"76⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"77⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\AE12.tmp"C:\Users\Admin\AppData\Local\Temp\AE12.tmp"78⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\AE60.tmp"C:\Users\Admin\AppData\Local\Temp\AE60.tmp"79⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"80⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"81⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"82⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"83⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\B016.tmp"C:\Users\Admin\AppData\Local\Temp\B016.tmp"84⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\B064.tmp"C:\Users\Admin\AppData\Local\Temp\B064.tmp"85⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"86⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\B100.tmp"C:\Users\Admin\AppData\Local\Temp\B100.tmp"87⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\B14E.tmp"C:\Users\Admin\AppData\Local\Temp\B14E.tmp"88⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\B19D.tmp"C:\Users\Admin\AppData\Local\Temp\B19D.tmp"89⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"90⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\B239.tmp"C:\Users\Admin\AppData\Local\Temp\B239.tmp"91⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\B287.tmp"C:\Users\Admin\AppData\Local\Temp\B287.tmp"92⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"93⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"94⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\B381.tmp"C:\Users\Admin\AppData\Local\Temp\B381.tmp"95⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"96⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\B43C.tmp"C:\Users\Admin\AppData\Local\Temp\B43C.tmp"97⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\B49A.tmp"C:\Users\Admin\AppData\Local\Temp\B49A.tmp"98⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"99⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\B546.tmp"C:\Users\Admin\AppData\Local\Temp\B546.tmp"100⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\B594.tmp"C:\Users\Admin\AppData\Local\Temp\B594.tmp"101⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"102⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"103⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\B67F.tmp"C:\Users\Admin\AppData\Local\Temp\B67F.tmp"104⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"105⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\B71B.tmp"C:\Users\Admin\AppData\Local\Temp\B71B.tmp"106⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\B779.tmp"C:\Users\Admin\AppData\Local\Temp\B779.tmp"107⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"108⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\B815.tmp"C:\Users\Admin\AppData\Local\Temp\B815.tmp"109⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\B863.tmp"C:\Users\Admin\AppData\Local\Temp\B863.tmp"110⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"111⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\B90F.tmp"C:\Users\Admin\AppData\Local\Temp\B90F.tmp"112⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\B96D.tmp"C:\Users\Admin\AppData\Local\Temp\B96D.tmp"113⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"114⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\BA09.tmp"C:\Users\Admin\AppData\Local\Temp\BA09.tmp"115⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\BA67.tmp"C:\Users\Admin\AppData\Local\Temp\BA67.tmp"116⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"117⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\BB12.tmp"C:\Users\Admin\AppData\Local\Temp\BB12.tmp"118⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\BB61.tmp"C:\Users\Admin\AppData\Local\Temp\BB61.tmp"119⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"120⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"121⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"122⤵PID:3164
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-