Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2024, 13:44
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-22_189c3304a74b9ea470b0972063005b99_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-07-22_189c3304a74b9ea470b0972063005b99_mafia.exe
Resource
win10v2004-20240709-en
General
-
Target
2024-07-22_189c3304a74b9ea470b0972063005b99_mafia.exe
-
Size
765KB
-
MD5
189c3304a74b9ea470b0972063005b99
-
SHA1
2ddaef4030d80b4e3c9f976e49a7f205b5c71d98
-
SHA256
cec1249b9d7fee89ebf847b81e4e64479e2ac900bb4abb5d498a5bc0c5402793
-
SHA512
a34aef90a3643fcc5ce732b1e4ed610ee659a63780801a2ab6bdf9216c78b43ae870e7abbb495ae8ca94e5fbac11a718df0030e3fe46e6926f8690d5363ea6d7
-
SSDEEP
12288:ZU5rCOTeiD7Fky5Oo4QLvXWS3PAP3ZF5rn5rLOa54U5w5A:ZUQOJD7eyMoTL+S343vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1628 8FBD.tmp 3976 903A.tmp 1440 90D6.tmp 1760 91C0.tmp 5084 923D.tmp 3188 92DA.tmp 3492 9366.tmp 1992 9422.tmp 4624 949F.tmp 2024 951C.tmp 2424 9589.tmp 860 9606.tmp 1128 9683.tmp 3260 96F0.tmp 1944 977D.tmp 3424 980A.tmp 2512 9877.tmp 1796 9913.tmp 680 9981.tmp 4352 99CF.tmp 1736 9A3C.tmp 4080 9AC9.tmp 4224 9B17.tmp 4056 9B84.tmp 3700 9BF2.tmp 1448 9C5F.tmp 1272 9CFB.tmp 420 9D88.tmp 2780 9DF5.tmp 4680 9E53.tmp 2816 9EE0.tmp 2516 9F9B.tmp 444 9FE9.tmp 3020 A047.tmp 1828 A0A5.tmp 3112 A103.tmp 1624 A151.tmp 2456 A19F.tmp 2216 A1ED.tmp 4012 A25A.tmp 1096 A2C8.tmp 4068 A345.tmp 3104 A3B2.tmp 1964 A42F.tmp 3452 A4AC.tmp 4752 A539.tmp 3876 A5A6.tmp 4840 A604.tmp 2196 A652.tmp 3188 A6B0.tmp 4104 A6FE.tmp 604 A76B.tmp 540 A7C9.tmp 472 A817.tmp 1912 A875.tmp 2968 A8E2.tmp 4800 A930.tmp 1544 A99E.tmp 860 A9FB.tmp 1144 AA59.tmp 1288 AAB7.tmp 2040 AB15.tmp 1944 AB72.tmp 468 ABE0.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4860 wrote to memory of 1628 4860 2024-07-22_189c3304a74b9ea470b0972063005b99_mafia.exe 84 PID 4860 wrote to memory of 1628 4860 2024-07-22_189c3304a74b9ea470b0972063005b99_mafia.exe 84 PID 4860 wrote to memory of 1628 4860 2024-07-22_189c3304a74b9ea470b0972063005b99_mafia.exe 84 PID 1628 wrote to memory of 3976 1628 8FBD.tmp 86 PID 1628 wrote to memory of 3976 1628 8FBD.tmp 86 PID 1628 wrote to memory of 3976 1628 8FBD.tmp 86 PID 3976 wrote to memory of 1440 3976 903A.tmp 88 PID 3976 wrote to memory of 1440 3976 903A.tmp 88 PID 3976 wrote to memory of 1440 3976 903A.tmp 88 PID 1440 wrote to memory of 1760 1440 90D6.tmp 90 PID 1440 wrote to memory of 1760 1440 90D6.tmp 90 PID 1440 wrote to memory of 1760 1440 90D6.tmp 90 PID 1760 wrote to memory of 5084 1760 91C0.tmp 91 PID 1760 wrote to memory of 5084 1760 91C0.tmp 91 PID 1760 wrote to memory of 5084 1760 91C0.tmp 91 PID 5084 wrote to memory of 3188 5084 923D.tmp 92 PID 5084 wrote to memory of 3188 5084 923D.tmp 92 PID 5084 wrote to memory of 3188 5084 923D.tmp 92 PID 3188 wrote to memory of 3492 3188 92DA.tmp 93 PID 3188 wrote to memory of 3492 3188 92DA.tmp 93 PID 3188 wrote to memory of 3492 3188 92DA.tmp 93 PID 3492 wrote to memory of 1992 3492 9366.tmp 94 PID 3492 wrote to memory of 1992 3492 9366.tmp 94 PID 3492 wrote to memory of 1992 3492 9366.tmp 94 PID 1992 wrote to memory of 4624 1992 9422.tmp 95 PID 1992 wrote to memory of 4624 1992 9422.tmp 95 PID 1992 wrote to memory of 4624 1992 9422.tmp 95 PID 4624 wrote to memory of 2024 4624 949F.tmp 96 PID 4624 wrote to memory of 2024 4624 949F.tmp 96 PID 4624 wrote to memory of 2024 4624 949F.tmp 96 PID 2024 wrote to memory of 2424 2024 951C.tmp 97 PID 2024 wrote to memory of 2424 2024 951C.tmp 97 PID 2024 wrote to memory of 2424 2024 951C.tmp 97 PID 2424 wrote to memory of 860 2424 9589.tmp 98 PID 2424 wrote to memory of 860 2424 9589.tmp 98 PID 2424 wrote to memory of 860 2424 9589.tmp 98 PID 860 wrote to memory of 1128 860 9606.tmp 99 PID 860 wrote to memory of 1128 860 9606.tmp 99 PID 860 wrote to memory of 1128 860 9606.tmp 99 PID 1128 wrote to memory of 3260 1128 9683.tmp 100 PID 1128 wrote to memory of 3260 1128 9683.tmp 100 PID 1128 wrote to memory of 3260 1128 9683.tmp 100 PID 3260 wrote to memory of 1944 3260 96F0.tmp 101 PID 3260 wrote to memory of 1944 3260 96F0.tmp 101 PID 3260 wrote to memory of 1944 3260 96F0.tmp 101 PID 1944 wrote to memory of 3424 1944 977D.tmp 102 PID 1944 wrote to memory of 3424 1944 977D.tmp 102 PID 1944 wrote to memory of 3424 1944 977D.tmp 102 PID 3424 wrote to memory of 2512 3424 980A.tmp 103 PID 3424 wrote to memory of 2512 3424 980A.tmp 103 PID 3424 wrote to memory of 2512 3424 980A.tmp 103 PID 2512 wrote to memory of 1796 2512 9877.tmp 104 PID 2512 wrote to memory of 1796 2512 9877.tmp 104 PID 2512 wrote to memory of 1796 2512 9877.tmp 104 PID 1796 wrote to memory of 680 1796 9913.tmp 105 PID 1796 wrote to memory of 680 1796 9913.tmp 105 PID 1796 wrote to memory of 680 1796 9913.tmp 105 PID 680 wrote to memory of 4352 680 9981.tmp 106 PID 680 wrote to memory of 4352 680 9981.tmp 106 PID 680 wrote to memory of 4352 680 9981.tmp 106 PID 4352 wrote to memory of 1736 4352 99CF.tmp 107 PID 4352 wrote to memory of 1736 4352 99CF.tmp 107 PID 4352 wrote to memory of 1736 4352 99CF.tmp 107 PID 1736 wrote to memory of 4080 1736 9A3C.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-22_189c3304a74b9ea470b0972063005b99_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-22_189c3304a74b9ea470b0972063005b99_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\903A.tmp"C:\Users\Admin\AppData\Local\Temp\903A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\91C0.tmp"C:\Users\Admin\AppData\Local\Temp\91C0.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\923D.tmp"C:\Users\Admin\AppData\Local\Temp\923D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\92DA.tmp"C:\Users\Admin\AppData\Local\Temp\92DA.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\9366.tmp"C:\Users\Admin\AppData\Local\Temp\9366.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\9422.tmp"C:\Users\Admin\AppData\Local\Temp\9422.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\951C.tmp"C:\Users\Admin\AppData\Local\Temp\951C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\9606.tmp"C:\Users\Admin\AppData\Local\Temp\9606.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\96F0.tmp"C:\Users\Admin\AppData\Local\Temp\96F0.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\977D.tmp"C:\Users\Admin\AppData\Local\Temp\977D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\9877.tmp"C:\Users\Admin\AppData\Local\Temp\9877.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"23⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"24⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"25⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"26⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"27⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"28⤵
- Executes dropped EXE
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"29⤵
- Executes dropped EXE
PID:420 -
C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"30⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\9E53.tmp"C:\Users\Admin\AppData\Local\Temp\9E53.tmp"31⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"32⤵
- Executes dropped EXE
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"33⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"34⤵
- Executes dropped EXE
PID:444 -
C:\Users\Admin\AppData\Local\Temp\A047.tmp"C:\Users\Admin\AppData\Local\Temp\A047.tmp"35⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"36⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\A103.tmp"C:\Users\Admin\AppData\Local\Temp\A103.tmp"37⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"38⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\A19F.tmp"C:\Users\Admin\AppData\Local\Temp\A19F.tmp"39⤵
- Executes dropped EXE
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"40⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"41⤵
- Executes dropped EXE
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"42⤵
- Executes dropped EXE
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"43⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"44⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"45⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"46⤵
- Executes dropped EXE
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\A539.tmp"C:\Users\Admin\AppData\Local\Temp\A539.tmp"47⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"48⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"49⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"50⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"51⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"52⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\A76B.tmp"C:\Users\Admin\AppData\Local\Temp\A76B.tmp"53⤵
- Executes dropped EXE
PID:604 -
C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"54⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\A817.tmp"C:\Users\Admin\AppData\Local\Temp\A817.tmp"55⤵
- Executes dropped EXE
PID:472 -
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"56⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"57⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"58⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\A99E.tmp"C:\Users\Admin\AppData\Local\Temp\A99E.tmp"59⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"60⤵
- Executes dropped EXE
PID:860 -
C:\Users\Admin\AppData\Local\Temp\AA59.tmp"C:\Users\Admin\AppData\Local\Temp\AA59.tmp"61⤵
- Executes dropped EXE
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"62⤵
- Executes dropped EXE
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\AB15.tmp"C:\Users\Admin\AppData\Local\Temp\AB15.tmp"63⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\AB72.tmp"C:\Users\Admin\AppData\Local\Temp\AB72.tmp"64⤵
- Executes dropped EXE
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"65⤵
- Executes dropped EXE
PID:468 -
C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"66⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"67⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\AD18.tmp"C:\Users\Admin\AppData\Local\Temp\AD18.tmp"68⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"69⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"70⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\AE51.tmp"C:\Users\Admin\AppData\Local\Temp\AE51.tmp"71⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"72⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"73⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"74⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"75⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\B054.tmp"C:\Users\Admin\AppData\Local\Temp\B054.tmp"76⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"77⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\B120.tmp"C:\Users\Admin\AppData\Local\Temp\B120.tmp"78⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\B18D.tmp"C:\Users\Admin\AppData\Local\Temp\B18D.tmp"79⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"80⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\B268.tmp"C:\Users\Admin\AppData\Local\Temp\B268.tmp"81⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"82⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"83⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"84⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\B40E.tmp"C:\Users\Admin\AppData\Local\Temp\B40E.tmp"85⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\B47B.tmp"C:\Users\Admin\AppData\Local\Temp\B47B.tmp"86⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"87⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"88⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"89⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\B602.tmp"C:\Users\Admin\AppData\Local\Temp\B602.tmp"90⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\B650.tmp"C:\Users\Admin\AppData\Local\Temp\B650.tmp"91⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"92⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\B70B.tmp"C:\Users\Admin\AppData\Local\Temp\B70B.tmp"93⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\B759.tmp"C:\Users\Admin\AppData\Local\Temp\B759.tmp"94⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"95⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\B824.tmp"C:\Users\Admin\AppData\Local\Temp\B824.tmp"96⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\B873.tmp"C:\Users\Admin\AppData\Local\Temp\B873.tmp"97⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"98⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\B93E.tmp"C:\Users\Admin\AppData\Local\Temp\B93E.tmp"99⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\B99B.tmp"C:\Users\Admin\AppData\Local\Temp\B99B.tmp"100⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"101⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\BA47.tmp"C:\Users\Admin\AppData\Local\Temp\BA47.tmp"102⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"103⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\BB12.tmp"C:\Users\Admin\AppData\Local\Temp\BB12.tmp"104⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\BB70.tmp"C:\Users\Admin\AppData\Local\Temp\BB70.tmp"105⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"106⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"107⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"108⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"109⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\BD35.tmp"C:\Users\Admin\AppData\Local\Temp\BD35.tmp"110⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\BD83.tmp"C:\Users\Admin\AppData\Local\Temp\BD83.tmp"111⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"112⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"113⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"114⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"115⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\BF39.tmp"C:\Users\Admin\AppData\Local\Temp\BF39.tmp"116⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\BF97.tmp"C:\Users\Admin\AppData\Local\Temp\BF97.tmp"117⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"118⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\C052.tmp"C:\Users\Admin\AppData\Local\Temp\C052.tmp"119⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"120⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\C10E.tmp"C:\Users\Admin\AppData\Local\Temp\C10E.tmp"121⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\C16B.tmp"C:\Users\Admin\AppData\Local\Temp\C16B.tmp"122⤵PID:1796
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-