Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
08/06/2024, 06:31
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-08_43068e0a6f0c1a8190817ded12c100b9_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-08_43068e0a6f0c1a8190817ded12c100b9_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-08_43068e0a6f0c1a8190817ded12c100b9_mafia.exe
-
Size
536KB
-
MD5
43068e0a6f0c1a8190817ded12c100b9
-
SHA1
6c85f8f93a3a63a15f5abd06d504bfdeade7abf3
-
SHA256
12386c5aef17f215928357fef54fb53fb33991e1a9d26e96ce1c774d03100001
-
SHA512
a787c29608d6fbe0d2536c4e645e702e4680ab237678f9cb758ef1d59c61fc03963d65c10f91cc55013cdf41aecd41ede26c28b22472e9fbd3af138caf0f7023
-
SSDEEP
12288:wU5rCOTeiU30X0zSsjmoFBqAZlEWOFIZxVJ0ZT9:wUQOJUkXRsSoFwOKFIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4616 7484.tmp 1072 7520.tmp 5084 75FB.tmp 4976 76B6.tmp 1512 77A1.tmp 720 787C.tmp 3172 7918.tmp 2304 79B4.tmp 4868 7A60.tmp 4592 7AFC.tmp 624 7C83.tmp 4120 7D2F.tmp 4196 7DDB.tmp 2456 7E58.tmp 1496 7F03.tmp 3396 7FA0.tmp 3764 802C.tmp 4044 80D8.tmp 2164 8146.tmp 3164 81F1.tmp 4884 82BD.tmp 3000 832A.tmp 4092 83A7.tmp 456 8443.tmp 832 84D0.tmp 1608 857C.tmp 4832 8656.tmp 5060 8702.tmp 4624 87AE.tmp 1820 883B.tmp 2328 88B8.tmp 4628 8954.tmp 4584 89E1.tmp 1692 8A4E.tmp 1036 8AAC.tmp 1856 8B0A.tmp 4392 8B67.tmp 1344 8BC5.tmp 2072 8C32.tmp 4616 8CA0.tmp 3644 8D2C.tmp 2748 8D9A.tmp 2460 8E26.tmp 1920 8E84.tmp 4976 8EF2.tmp 1860 8F6F.tmp 4200 8FEC.tmp 1000 9088.tmp 1268 90D6.tmp 4656 9124.tmp 4868 9172.tmp 4592 91D0.tmp 5008 922E.tmp 724 928B.tmp 4120 92E9.tmp 3080 9347.tmp 60 9395.tmp 2076 93F3.tmp 4680 9441.tmp 2756 949F.tmp 4004 94ED.tmp 4036 954B.tmp 5012 95A8.tmp 4556 9606.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 464 wrote to memory of 4616 464 2024-06-08_43068e0a6f0c1a8190817ded12c100b9_mafia.exe 83 PID 464 wrote to memory of 4616 464 2024-06-08_43068e0a6f0c1a8190817ded12c100b9_mafia.exe 83 PID 464 wrote to memory of 4616 464 2024-06-08_43068e0a6f0c1a8190817ded12c100b9_mafia.exe 83 PID 4616 wrote to memory of 1072 4616 7484.tmp 84 PID 4616 wrote to memory of 1072 4616 7484.tmp 84 PID 4616 wrote to memory of 1072 4616 7484.tmp 84 PID 1072 wrote to memory of 5084 1072 7520.tmp 85 PID 1072 wrote to memory of 5084 1072 7520.tmp 85 PID 1072 wrote to memory of 5084 1072 7520.tmp 85 PID 5084 wrote to memory of 4976 5084 75FB.tmp 86 PID 5084 wrote to memory of 4976 5084 75FB.tmp 86 PID 5084 wrote to memory of 4976 5084 75FB.tmp 86 PID 4976 wrote to memory of 1512 4976 76B6.tmp 87 PID 4976 wrote to memory of 1512 4976 76B6.tmp 87 PID 4976 wrote to memory of 1512 4976 76B6.tmp 87 PID 1512 wrote to memory of 720 1512 77A1.tmp 88 PID 1512 wrote to memory of 720 1512 77A1.tmp 88 PID 1512 wrote to memory of 720 1512 77A1.tmp 88 PID 720 wrote to memory of 3172 720 787C.tmp 89 PID 720 wrote to memory of 3172 720 787C.tmp 89 PID 720 wrote to memory of 3172 720 787C.tmp 89 PID 3172 wrote to memory of 2304 3172 7918.tmp 90 PID 3172 wrote to memory of 2304 3172 7918.tmp 90 PID 3172 wrote to memory of 2304 3172 7918.tmp 90 PID 2304 wrote to memory of 4868 2304 79B4.tmp 91 PID 2304 wrote to memory of 4868 2304 79B4.tmp 91 PID 2304 wrote to memory of 4868 2304 79B4.tmp 91 PID 4868 wrote to memory of 4592 4868 7A60.tmp 92 PID 4868 wrote to memory of 4592 4868 7A60.tmp 92 PID 4868 wrote to memory of 4592 4868 7A60.tmp 92 PID 4592 wrote to memory of 624 4592 7AFC.tmp 93 PID 4592 wrote to memory of 624 4592 7AFC.tmp 93 PID 4592 wrote to memory of 624 4592 7AFC.tmp 93 PID 624 wrote to memory of 4120 624 7C83.tmp 94 PID 624 wrote to memory of 4120 624 7C83.tmp 94 PID 624 wrote to memory of 4120 624 7C83.tmp 94 PID 4120 wrote to memory of 4196 4120 7D2F.tmp 95 PID 4120 wrote to memory of 4196 4120 7D2F.tmp 95 PID 4120 wrote to memory of 4196 4120 7D2F.tmp 95 PID 4196 wrote to memory of 2456 4196 7DDB.tmp 96 PID 4196 wrote to memory of 2456 4196 7DDB.tmp 96 PID 4196 wrote to memory of 2456 4196 7DDB.tmp 96 PID 2456 wrote to memory of 1496 2456 7E58.tmp 97 PID 2456 wrote to memory of 1496 2456 7E58.tmp 97 PID 2456 wrote to memory of 1496 2456 7E58.tmp 97 PID 1496 wrote to memory of 3396 1496 7F03.tmp 98 PID 1496 wrote to memory of 3396 1496 7F03.tmp 98 PID 1496 wrote to memory of 3396 1496 7F03.tmp 98 PID 3396 wrote to memory of 3764 3396 7FA0.tmp 99 PID 3396 wrote to memory of 3764 3396 7FA0.tmp 99 PID 3396 wrote to memory of 3764 3396 7FA0.tmp 99 PID 3764 wrote to memory of 4044 3764 802C.tmp 102 PID 3764 wrote to memory of 4044 3764 802C.tmp 102 PID 3764 wrote to memory of 4044 3764 802C.tmp 102 PID 4044 wrote to memory of 2164 4044 80D8.tmp 103 PID 4044 wrote to memory of 2164 4044 80D8.tmp 103 PID 4044 wrote to memory of 2164 4044 80D8.tmp 103 PID 2164 wrote to memory of 3164 2164 8146.tmp 104 PID 2164 wrote to memory of 3164 2164 8146.tmp 104 PID 2164 wrote to memory of 3164 2164 8146.tmp 104 PID 3164 wrote to memory of 4884 3164 81F1.tmp 105 PID 3164 wrote to memory of 4884 3164 81F1.tmp 105 PID 3164 wrote to memory of 4884 3164 81F1.tmp 105 PID 4884 wrote to memory of 3000 4884 82BD.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-08_43068e0a6f0c1a8190817ded12c100b9_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-08_43068e0a6f0c1a8190817ded12c100b9_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\77A1.tmp"C:\Users\Admin\AppData\Local\Temp\77A1.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Users\Admin\AppData\Local\Temp\7918.tmp"C:\Users\Admin\AppData\Local\Temp\7918.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\79B4.tmp"C:\Users\Admin\AppData\Local\Temp\79B4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\7A60.tmp"C:\Users\Admin\AppData\Local\Temp\7A60.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\7C83.tmp"C:\Users\Admin\AppData\Local\Temp\7C83.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\7F03.tmp"C:\Users\Admin\AppData\Local\Temp\7F03.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\802C.tmp"C:\Users\Admin\AppData\Local\Temp\802C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\80D8.tmp"C:\Users\Admin\AppData\Local\Temp\80D8.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\8146.tmp"C:\Users\Admin\AppData\Local\Temp\8146.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\81F1.tmp"C:\Users\Admin\AppData\Local\Temp\81F1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\82BD.tmp"C:\Users\Admin\AppData\Local\Temp\82BD.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"23⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\83A7.tmp"C:\Users\Admin\AppData\Local\Temp\83A7.tmp"24⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"25⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\84D0.tmp"C:\Users\Admin\AppData\Local\Temp\84D0.tmp"26⤵
- Executes dropped EXE
PID:832 -
C:\Users\Admin\AppData\Local\Temp\857C.tmp"C:\Users\Admin\AppData\Local\Temp\857C.tmp"27⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"28⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\8702.tmp"C:\Users\Admin\AppData\Local\Temp\8702.tmp"29⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\87AE.tmp"C:\Users\Admin\AppData\Local\Temp\87AE.tmp"30⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\883B.tmp"C:\Users\Admin\AppData\Local\Temp\883B.tmp"31⤵
- Executes dropped EXE
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\88B8.tmp"C:\Users\Admin\AppData\Local\Temp\88B8.tmp"32⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\8954.tmp"C:\Users\Admin\AppData\Local\Temp\8954.tmp"33⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\89E1.tmp"C:\Users\Admin\AppData\Local\Temp\89E1.tmp"34⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"35⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"36⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"37⤵
- Executes dropped EXE
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\8B67.tmp"C:\Users\Admin\AppData\Local\Temp\8B67.tmp"38⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"39⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\8C32.tmp"C:\Users\Admin\AppData\Local\Temp\8C32.tmp"40⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"41⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"42⤵
- Executes dropped EXE
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"43⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\8E26.tmp"C:\Users\Admin\AppData\Local\Temp\8E26.tmp"44⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\8E84.tmp"C:\Users\Admin\AppData\Local\Temp\8E84.tmp"45⤵
- Executes dropped EXE
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"46⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"47⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"48⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"49⤵
- Executes dropped EXE
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"50⤵
- Executes dropped EXE
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"51⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp"52⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\91D0.tmp"C:\Users\Admin\AppData\Local\Temp\91D0.tmp"53⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\922E.tmp"C:\Users\Admin\AppData\Local\Temp\922E.tmp"54⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"55⤵
- Executes dropped EXE
PID:724 -
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"56⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"57⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\9395.tmp"C:\Users\Admin\AppData\Local\Temp\9395.tmp"58⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\93F3.tmp"C:\Users\Admin\AppData\Local\Temp\93F3.tmp"59⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\9441.tmp"C:\Users\Admin\AppData\Local\Temp\9441.tmp"60⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"61⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\94ED.tmp"C:\Users\Admin\AppData\Local\Temp\94ED.tmp"62⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\954B.tmp"C:\Users\Admin\AppData\Local\Temp\954B.tmp"63⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"64⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\9606.tmp"C:\Users\Admin\AppData\Local\Temp\9606.tmp"65⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\9654.tmp"C:\Users\Admin\AppData\Local\Temp\9654.tmp"66⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"67⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\96F0.tmp"C:\Users\Admin\AppData\Local\Temp\96F0.tmp"68⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"69⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"70⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"71⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\9867.tmp"C:\Users\Admin\AppData\Local\Temp\9867.tmp"72⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\98C5.tmp"C:\Users\Admin\AppData\Local\Temp\98C5.tmp"73⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"74⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"75⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\99BF.tmp"C:\Users\Admin\AppData\Local\Temp\99BF.tmp"76⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"77⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"78⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"79⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"80⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"81⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"82⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"83⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"84⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"85⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"86⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"87⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"88⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"89⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"90⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"91⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"92⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"93⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"94⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"95⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"96⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"97⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\A103.tmp"C:\Users\Admin\AppData\Local\Temp\A103.tmp"98⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\A160.tmp"C:\Users\Admin\AppData\Local\Temp\A160.tmp"99⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"100⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\A20C.tmp"C:\Users\Admin\AppData\Local\Temp\A20C.tmp"101⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\A26A.tmp"C:\Users\Admin\AppData\Local\Temp\A26A.tmp"102⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"103⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"104⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\A364.tmp"C:\Users\Admin\AppData\Local\Temp\A364.tmp"105⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"106⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"107⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"108⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"109⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"110⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"111⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"112⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"113⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"114⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"115⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"116⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\A73C.tmp"C:\Users\Admin\AppData\Local\Temp\A73C.tmp"117⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\A78A.tmp"C:\Users\Admin\AppData\Local\Temp\A78A.tmp"118⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"119⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\A827.tmp"C:\Users\Admin\AppData\Local\Temp\A827.tmp"120⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"121⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"122⤵PID:4608
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-