Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/01/2024, 03:33
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-25_b934c76dd69be052ef8945abd3de4c0d_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-25_b934c76dd69be052ef8945abd3de4c0d_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-25_b934c76dd69be052ef8945abd3de4c0d_mafia.exe
-
Size
486KB
-
MD5
b934c76dd69be052ef8945abd3de4c0d
-
SHA1
e0e89b822e92471b68a0fd0660af9310ee11ff4a
-
SHA256
b1484fedd74df974418c2e721dc8551636b9cedbedeb682d0c0ce24d5f1406e8
-
SHA512
22441506293ddf979fc5928cbd2f303cf5aba613927aa0debfe1e4882ce658ebd3011384190efdf09aa6fb02a04a2e73f50a883445d0fa0108d80cbe36e1e5f0
-
SSDEEP
12288:/U5rCOTeiDH9nnDLfQv8MgaLrE+rc/ZDNZ:/UQOJDH9nnDL4LrEoc/VN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3900 DFF0.tmp 2240 E416.tmp 3768 E510.tmp 2968 E61A.tmp 3800 E724.tmp 2104 E81E.tmp 2312 E985.tmp 3464 EA7F.tmp 2516 EB69.tmp 3560 ED5D.tmp 4504 EEE4.tmp 1884 EFEE.tmp 1056 F0A9.tmp 2544 F1C2.tmp 4200 F2EB.tmp 2964 F3E5.tmp 836 F4D0.tmp 1064 F5CA.tmp 1264 F6E3.tmp 4580 F889.tmp 4864 F973.tmp 736 FABB.tmp 4756 FB96.tmp 636 FC90.tmp 4612 FDC9.tmp 4008 FEC3.tmp 3240 FF9D.tmp 3660 49.tmp 1956 124.tmp 1768 1B1.tmp 2656 2BA.tmp 3288 356.tmp 3328 441.tmp 5044 4DD.tmp 3688 589.tmp 3460 654.tmp 4312 6E1.tmp 4408 76D.tmp 4316 7FA.tmp 1628 8A6.tmp 4456 952.tmp 3996 9DE.tmp 4912 A7B.tmp 3656 B26.tmp 3916 BD2.tmp 1304 C6F.tmp 1624 D0B.tmp 3100 D88.tmp 2572 E05.tmp 3408 EB1.tmp 4684 FBA.tmp 640 1037.tmp 4148 10C4.tmp 220 1141.tmp 4488 11CE.tmp 1408 125A.tmp 3952 12D7.tmp 5104 1364.tmp 1884 146D.tmp 3532 1519.tmp 1992 15A6.tmp 2396 1613.tmp 2956 1690.tmp 1824 171D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2296 wrote to memory of 3900 2296 2024-01-25_b934c76dd69be052ef8945abd3de4c0d_mafia.exe 87 PID 2296 wrote to memory of 3900 2296 2024-01-25_b934c76dd69be052ef8945abd3de4c0d_mafia.exe 87 PID 2296 wrote to memory of 3900 2296 2024-01-25_b934c76dd69be052ef8945abd3de4c0d_mafia.exe 87 PID 3900 wrote to memory of 2240 3900 DFF0.tmp 88 PID 3900 wrote to memory of 2240 3900 DFF0.tmp 88 PID 3900 wrote to memory of 2240 3900 DFF0.tmp 88 PID 2240 wrote to memory of 3768 2240 E416.tmp 89 PID 2240 wrote to memory of 3768 2240 E416.tmp 89 PID 2240 wrote to memory of 3768 2240 E416.tmp 89 PID 3768 wrote to memory of 2968 3768 E510.tmp 90 PID 3768 wrote to memory of 2968 3768 E510.tmp 90 PID 3768 wrote to memory of 2968 3768 E510.tmp 90 PID 2968 wrote to memory of 3800 2968 E61A.tmp 91 PID 2968 wrote to memory of 3800 2968 E61A.tmp 91 PID 2968 wrote to memory of 3800 2968 E61A.tmp 91 PID 3800 wrote to memory of 2104 3800 E724.tmp 92 PID 3800 wrote to memory of 2104 3800 E724.tmp 92 PID 3800 wrote to memory of 2104 3800 E724.tmp 92 PID 2104 wrote to memory of 2312 2104 E81E.tmp 93 PID 2104 wrote to memory of 2312 2104 E81E.tmp 93 PID 2104 wrote to memory of 2312 2104 E81E.tmp 93 PID 2312 wrote to memory of 3464 2312 E985.tmp 94 PID 2312 wrote to memory of 3464 2312 E985.tmp 94 PID 2312 wrote to memory of 3464 2312 E985.tmp 94 PID 3464 wrote to memory of 2516 3464 EA7F.tmp 95 PID 3464 wrote to memory of 2516 3464 EA7F.tmp 95 PID 3464 wrote to memory of 2516 3464 EA7F.tmp 95 PID 2516 wrote to memory of 3560 2516 EB69.tmp 96 PID 2516 wrote to memory of 3560 2516 EB69.tmp 96 PID 2516 wrote to memory of 3560 2516 EB69.tmp 96 PID 3560 wrote to memory of 4504 3560 ED5D.tmp 97 PID 3560 wrote to memory of 4504 3560 ED5D.tmp 97 PID 3560 wrote to memory of 4504 3560 ED5D.tmp 97 PID 4504 wrote to memory of 1884 4504 EEE4.tmp 98 PID 4504 wrote to memory of 1884 4504 EEE4.tmp 98 PID 4504 wrote to memory of 1884 4504 EEE4.tmp 98 PID 1884 wrote to memory of 1056 1884 EFEE.tmp 99 PID 1884 wrote to memory of 1056 1884 EFEE.tmp 99 PID 1884 wrote to memory of 1056 1884 EFEE.tmp 99 PID 1056 wrote to memory of 2544 1056 F0A9.tmp 100 PID 1056 wrote to memory of 2544 1056 F0A9.tmp 100 PID 1056 wrote to memory of 2544 1056 F0A9.tmp 100 PID 2544 wrote to memory of 4200 2544 F1C2.tmp 101 PID 2544 wrote to memory of 4200 2544 F1C2.tmp 101 PID 2544 wrote to memory of 4200 2544 F1C2.tmp 101 PID 4200 wrote to memory of 2964 4200 F2EB.tmp 102 PID 4200 wrote to memory of 2964 4200 F2EB.tmp 102 PID 4200 wrote to memory of 2964 4200 F2EB.tmp 102 PID 2964 wrote to memory of 836 2964 F3E5.tmp 103 PID 2964 wrote to memory of 836 2964 F3E5.tmp 103 PID 2964 wrote to memory of 836 2964 F3E5.tmp 103 PID 836 wrote to memory of 1064 836 F4D0.tmp 104 PID 836 wrote to memory of 1064 836 F4D0.tmp 104 PID 836 wrote to memory of 1064 836 F4D0.tmp 104 PID 1064 wrote to memory of 1264 1064 F5CA.tmp 105 PID 1064 wrote to memory of 1264 1064 F5CA.tmp 105 PID 1064 wrote to memory of 1264 1064 F5CA.tmp 105 PID 1264 wrote to memory of 4580 1264 F6E3.tmp 106 PID 1264 wrote to memory of 4580 1264 F6E3.tmp 106 PID 1264 wrote to memory of 4580 1264 F6E3.tmp 106 PID 4580 wrote to memory of 4864 4580 F889.tmp 107 PID 4580 wrote to memory of 4864 4580 F889.tmp 107 PID 4580 wrote to memory of 4864 4580 F889.tmp 107 PID 4864 wrote to memory of 736 4864 F973.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_b934c76dd69be052ef8945abd3de4c0d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_b934c76dd69be052ef8945abd3de4c0d_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\E416.tmp"C:\Users\Admin\AppData\Local\Temp\E416.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\E510.tmp"C:\Users\Admin\AppData\Local\Temp\E510.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\E61A.tmp"C:\Users\Admin\AppData\Local\Temp\E61A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\E724.tmp"C:\Users\Admin\AppData\Local\Temp\E724.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\E81E.tmp"C:\Users\Admin\AppData\Local\Temp\E81E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\E985.tmp"C:\Users\Admin\AppData\Local\Temp\E985.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\EB69.tmp"C:\Users\Admin\AppData\Local\Temp\EB69.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\EFEE.tmp"C:\Users\Admin\AppData\Local\Temp\EFEE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\F0A9.tmp"C:\Users\Admin\AppData\Local\Temp\F0A9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\F2EB.tmp"C:\Users\Admin\AppData\Local\Temp\F2EB.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\F3E5.tmp"C:\Users\Admin\AppData\Local\Temp\F3E5.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\F889.tmp"C:\Users\Admin\AppData\Local\Temp\F889.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\F973.tmp"C:\Users\Admin\AppData\Local\Temp\F973.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\FABB.tmp"C:\Users\Admin\AppData\Local\Temp\FABB.tmp"23⤵
- Executes dropped EXE
PID:736 -
C:\Users\Admin\AppData\Local\Temp\FB96.tmp"C:\Users\Admin\AppData\Local\Temp\FB96.tmp"24⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\FC90.tmp"C:\Users\Admin\AppData\Local\Temp\FC90.tmp"25⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"26⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\FEC3.tmp"C:\Users\Admin\AppData\Local\Temp\FEC3.tmp"27⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\FF9D.tmp"C:\Users\Admin\AppData\Local\Temp\FF9D.tmp"28⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\49.tmp"C:\Users\Admin\AppData\Local\Temp\49.tmp"29⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\124.tmp"C:\Users\Admin\AppData\Local\Temp\124.tmp"30⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\1B1.tmp"C:\Users\Admin\AppData\Local\Temp\1B1.tmp"31⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\2BA.tmp"C:\Users\Admin\AppData\Local\Temp\2BA.tmp"32⤵
- Executes dropped EXE
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\356.tmp"C:\Users\Admin\AppData\Local\Temp\356.tmp"33⤵
- Executes dropped EXE
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\441.tmp"C:\Users\Admin\AppData\Local\Temp\441.tmp"34⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\4DD.tmp"C:\Users\Admin\AppData\Local\Temp\4DD.tmp"35⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\589.tmp"C:\Users\Admin\AppData\Local\Temp\589.tmp"36⤵
- Executes dropped EXE
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\654.tmp"C:\Users\Admin\AppData\Local\Temp\654.tmp"37⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\6E1.tmp"C:\Users\Admin\AppData\Local\Temp\6E1.tmp"38⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\76D.tmp"C:\Users\Admin\AppData\Local\Temp\76D.tmp"39⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\7FA.tmp"C:\Users\Admin\AppData\Local\Temp\7FA.tmp"40⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\8A6.tmp"C:\Users\Admin\AppData\Local\Temp\8A6.tmp"41⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\952.tmp"C:\Users\Admin\AppData\Local\Temp\952.tmp"42⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\9DE.tmp"C:\Users\Admin\AppData\Local\Temp\9DE.tmp"43⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\A7B.tmp"C:\Users\Admin\AppData\Local\Temp\A7B.tmp"44⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\B26.tmp"C:\Users\Admin\AppData\Local\Temp\B26.tmp"45⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\BD2.tmp"C:\Users\Admin\AppData\Local\Temp\BD2.tmp"46⤵
- Executes dropped EXE
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"47⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\D0B.tmp"C:\Users\Admin\AppData\Local\Temp\D0B.tmp"48⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\D88.tmp"C:\Users\Admin\AppData\Local\Temp\D88.tmp"49⤵
- Executes dropped EXE
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\E05.tmp"C:\Users\Admin\AppData\Local\Temp\E05.tmp"50⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\EB1.tmp"C:\Users\Admin\AppData\Local\Temp\EB1.tmp"51⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"52⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\1037.tmp"C:\Users\Admin\AppData\Local\Temp\1037.tmp"53⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\10C4.tmp"C:\Users\Admin\AppData\Local\Temp\10C4.tmp"54⤵
- Executes dropped EXE
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\1141.tmp"C:\Users\Admin\AppData\Local\Temp\1141.tmp"55⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\11CE.tmp"C:\Users\Admin\AppData\Local\Temp\11CE.tmp"56⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\125A.tmp"C:\Users\Admin\AppData\Local\Temp\125A.tmp"57⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\12D7.tmp"C:\Users\Admin\AppData\Local\Temp\12D7.tmp"58⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\1364.tmp"C:\Users\Admin\AppData\Local\Temp\1364.tmp"59⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\146D.tmp"C:\Users\Admin\AppData\Local\Temp\146D.tmp"60⤵
- Executes dropped EXE
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\1519.tmp"C:\Users\Admin\AppData\Local\Temp\1519.tmp"61⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\15A6.tmp"C:\Users\Admin\AppData\Local\Temp\15A6.tmp"62⤵
- Executes dropped EXE
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\1613.tmp"C:\Users\Admin\AppData\Local\Temp\1613.tmp"63⤵
- Executes dropped EXE
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\1690.tmp"C:\Users\Admin\AppData\Local\Temp\1690.tmp"64⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\171D.tmp"C:\Users\Admin\AppData\Local\Temp\171D.tmp"65⤵
- Executes dropped EXE
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\17B9.tmp"C:\Users\Admin\AppData\Local\Temp\17B9.tmp"66⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\1836.tmp"C:\Users\Admin\AppData\Local\Temp\1836.tmp"67⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\18A4.tmp"C:\Users\Admin\AppData\Local\Temp\18A4.tmp"68⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\1911.tmp"C:\Users\Admin\AppData\Local\Temp\1911.tmp"69⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\19DC.tmp"C:\Users\Admin\AppData\Local\Temp\19DC.tmp"70⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\1A88.tmp"C:\Users\Admin\AppData\Local\Temp\1A88.tmp"71⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"72⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"73⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"74⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\1C9B.tmp"C:\Users\Admin\AppData\Local\Temp\1C9B.tmp"75⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\1D18.tmp"C:\Users\Admin\AppData\Local\Temp\1D18.tmp"76⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\1DB4.tmp"C:\Users\Admin\AppData\Local\Temp\1DB4.tmp"77⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\1E51.tmp"C:\Users\Admin\AppData\Local\Temp\1E51.tmp"78⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\1EDD.tmp"C:\Users\Admin\AppData\Local\Temp\1EDD.tmp"79⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\1F89.tmp"C:\Users\Admin\AppData\Local\Temp\1F89.tmp"80⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\2054.tmp"C:\Users\Admin\AppData\Local\Temp\2054.tmp"81⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\2100.tmp"C:\Users\Admin\AppData\Local\Temp\2100.tmp"82⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\21EB.tmp"C:\Users\Admin\AppData\Local\Temp\21EB.tmp"83⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\22C5.tmp"C:\Users\Admin\AppData\Local\Temp\22C5.tmp"84⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\2381.tmp"C:\Users\Admin\AppData\Local\Temp\2381.tmp"85⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\246B.tmp"C:\Users\Admin\AppData\Local\Temp\246B.tmp"86⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\2556.tmp"C:\Users\Admin\AppData\Local\Temp\2556.tmp"87⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\2640.tmp"C:\Users\Admin\AppData\Local\Temp\2640.tmp"88⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\2759.tmp"C:\Users\Admin\AppData\Local\Temp\2759.tmp"89⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\2815.tmp"C:\Users\Admin\AppData\Local\Temp\2815.tmp"90⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\28C1.tmp"C:\Users\Admin\AppData\Local\Temp\28C1.tmp"91⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\296C.tmp"C:\Users\Admin\AppData\Local\Temp\296C.tmp"92⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\2A18.tmp"C:\Users\Admin\AppData\Local\Temp\2A18.tmp"93⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\2AA5.tmp"C:\Users\Admin\AppData\Local\Temp\2AA5.tmp"94⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\2B22.tmp"C:\Users\Admin\AppData\Local\Temp\2B22.tmp"95⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\2BCE.tmp"C:\Users\Admin\AppData\Local\Temp\2BCE.tmp"96⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\2D35.tmp"C:\Users\Admin\AppData\Local\Temp\2D35.tmp"97⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\2DD1.tmp"C:\Users\Admin\AppData\Local\Temp\2DD1.tmp"98⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"99⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\2EDB.tmp"C:\Users\Admin\AppData\Local\Temp\2EDB.tmp"100⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\2F58.tmp"C:\Users\Admin\AppData\Local\Temp\2F58.tmp"101⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\2FF4.tmp"C:\Users\Admin\AppData\Local\Temp\2FF4.tmp"102⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\3091.tmp"C:\Users\Admin\AppData\Local\Temp\3091.tmp"103⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\316B.tmp"C:\Users\Admin\AppData\Local\Temp\316B.tmp"104⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\31F8.tmp"C:\Users\Admin\AppData\Local\Temp\31F8.tmp"105⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\3275.tmp"C:\Users\Admin\AppData\Local\Temp\3275.tmp"106⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\32F2.tmp"C:\Users\Admin\AppData\Local\Temp\32F2.tmp"107⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"108⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"109⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\34C7.tmp"C:\Users\Admin\AppData\Local\Temp\34C7.tmp"110⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\3544.tmp"C:\Users\Admin\AppData\Local\Temp\3544.tmp"111⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\35B1.tmp"C:\Users\Admin\AppData\Local\Temp\35B1.tmp"112⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\362E.tmp"C:\Users\Admin\AppData\Local\Temp\362E.tmp"113⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\36F9.tmp"C:\Users\Admin\AppData\Local\Temp\36F9.tmp"114⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\3767.tmp"C:\Users\Admin\AppData\Local\Temp\3767.tmp"115⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\3803.tmp"C:\Users\Admin\AppData\Local\Temp\3803.tmp"116⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\388F.tmp"C:\Users\Admin\AppData\Local\Temp\388F.tmp"117⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\391C.tmp"C:\Users\Admin\AppData\Local\Temp\391C.tmp"118⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\3989.tmp"C:\Users\Admin\AppData\Local\Temp\3989.tmp"119⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\3A06.tmp"C:\Users\Admin\AppData\Local\Temp\3A06.tmp"120⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\3AB2.tmp"C:\Users\Admin\AppData\Local\Temp\3AB2.tmp"121⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"122⤵PID:2228
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-