Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
97s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2024, 00:13
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-07_fb80bdf0df372b8cdfd2a3c0135e6347_mafia.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2024-07-07_fb80bdf0df372b8cdfd2a3c0135e6347_mafia.exe
Resource
win10v2004-20240704-en
General
-
Target
2024-07-07_fb80bdf0df372b8cdfd2a3c0135e6347_mafia.exe
-
Size
487KB
-
MD5
fb80bdf0df372b8cdfd2a3c0135e6347
-
SHA1
3464c2a3437337bee90e2cb5f1d2f4c91adfd68a
-
SHA256
77bd6337be28e73c0249b649a7847bb1ef310c435dbd096a80215f8f2ce075ff
-
SHA512
bbf8a34abc703e95c0712b17422d4e667f0e5744303820583f52ac76ff2f1e7dafeeb6e8c18e6193cbc9f41a4e42fa14b73d7fe1970b29b3aa05b193ecbdc3ab
-
SSDEEP
12288:HU5rCOTeiJlRHmOKudrsSQxlOHeVbr4VHbbzKNZ:HUQOJJlF5rsSQxlc04kN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1548 9A2D.tmp 4580 9D69.tmp 556 9E24.tmp 3428 9ED0.tmp 4180 9F4D.tmp 2612 9FCA.tmp 3868 A057.tmp 3684 A0B4.tmp 688 A151.tmp 392 A1AE.tmp 4416 A21C.tmp 1820 A27A.tmp 3944 A2F7.tmp 4780 A354.tmp 1084 A3D1.tmp 1188 A42F.tmp 4520 A4BC.tmp 2436 A529.tmp 2668 A587.tmp 1484 A604.tmp 2964 A690.tmp 1580 A73C.tmp 4212 A79A.tmp 3956 A827.tmp 1564 A8A4.tmp 3884 A911.tmp 1092 A99E.tmp 4584 A9FB.tmp 4064 AA78.tmp 2608 AB05.tmp 4768 AB63.tmp 3576 ABD0.tmp 976 AC2E.tmp 1828 AC9B.tmp 2544 ACF9.tmp 4112 AD57.tmp 1284 ADC4.tmp 4080 AE32.tmp 1536 AE9F.tmp 2640 AF2C.tmp 1648 AF89.tmp 552 B026.tmp 4420 B0A3.tmp 3932 B110.tmp 4124 B17D.tmp 4000 B1FA.tmp 2644 B277.tmp 1452 B2F4.tmp 3584 B371.tmp 3704 B3EE.tmp 3352 B44C.tmp 1768 B4C9.tmp 2076 B536.tmp 2572 B621.tmp 2356 B67F.tmp 1876 B6EC.tmp 3968 B759.tmp 1548 B7B7.tmp 1160 B844.tmp 4460 B8B1.tmp 4980 B92E.tmp 4272 B9CA.tmp 5012 BA67.tmp 2564 BAD4.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4136 wrote to memory of 1548 4136 2024-07-07_fb80bdf0df372b8cdfd2a3c0135e6347_mafia.exe 83 PID 4136 wrote to memory of 1548 4136 2024-07-07_fb80bdf0df372b8cdfd2a3c0135e6347_mafia.exe 83 PID 4136 wrote to memory of 1548 4136 2024-07-07_fb80bdf0df372b8cdfd2a3c0135e6347_mafia.exe 83 PID 1548 wrote to memory of 4580 1548 9A2D.tmp 85 PID 1548 wrote to memory of 4580 1548 9A2D.tmp 85 PID 1548 wrote to memory of 4580 1548 9A2D.tmp 85 PID 4580 wrote to memory of 556 4580 9D69.tmp 87 PID 4580 wrote to memory of 556 4580 9D69.tmp 87 PID 4580 wrote to memory of 556 4580 9D69.tmp 87 PID 556 wrote to memory of 3428 556 9E24.tmp 88 PID 556 wrote to memory of 3428 556 9E24.tmp 88 PID 556 wrote to memory of 3428 556 9E24.tmp 88 PID 3428 wrote to memory of 4180 3428 9ED0.tmp 89 PID 3428 wrote to memory of 4180 3428 9ED0.tmp 89 PID 3428 wrote to memory of 4180 3428 9ED0.tmp 89 PID 4180 wrote to memory of 2612 4180 9F4D.tmp 90 PID 4180 wrote to memory of 2612 4180 9F4D.tmp 90 PID 4180 wrote to memory of 2612 4180 9F4D.tmp 90 PID 2612 wrote to memory of 3868 2612 9FCA.tmp 91 PID 2612 wrote to memory of 3868 2612 9FCA.tmp 91 PID 2612 wrote to memory of 3868 2612 9FCA.tmp 91 PID 3868 wrote to memory of 3684 3868 A057.tmp 92 PID 3868 wrote to memory of 3684 3868 A057.tmp 92 PID 3868 wrote to memory of 3684 3868 A057.tmp 92 PID 3684 wrote to memory of 688 3684 A0B4.tmp 93 PID 3684 wrote to memory of 688 3684 A0B4.tmp 93 PID 3684 wrote to memory of 688 3684 A0B4.tmp 93 PID 688 wrote to memory of 392 688 A151.tmp 94 PID 688 wrote to memory of 392 688 A151.tmp 94 PID 688 wrote to memory of 392 688 A151.tmp 94 PID 392 wrote to memory of 4416 392 A1AE.tmp 95 PID 392 wrote to memory of 4416 392 A1AE.tmp 95 PID 392 wrote to memory of 4416 392 A1AE.tmp 95 PID 4416 wrote to memory of 1820 4416 A21C.tmp 96 PID 4416 wrote to memory of 1820 4416 A21C.tmp 96 PID 4416 wrote to memory of 1820 4416 A21C.tmp 96 PID 1820 wrote to memory of 3944 1820 A27A.tmp 97 PID 1820 wrote to memory of 3944 1820 A27A.tmp 97 PID 1820 wrote to memory of 3944 1820 A27A.tmp 97 PID 3944 wrote to memory of 4780 3944 A2F7.tmp 98 PID 3944 wrote to memory of 4780 3944 A2F7.tmp 98 PID 3944 wrote to memory of 4780 3944 A2F7.tmp 98 PID 4780 wrote to memory of 1084 4780 A354.tmp 99 PID 4780 wrote to memory of 1084 4780 A354.tmp 99 PID 4780 wrote to memory of 1084 4780 A354.tmp 99 PID 1084 wrote to memory of 1188 1084 A3D1.tmp 100 PID 1084 wrote to memory of 1188 1084 A3D1.tmp 100 PID 1084 wrote to memory of 1188 1084 A3D1.tmp 100 PID 1188 wrote to memory of 4520 1188 A42F.tmp 101 PID 1188 wrote to memory of 4520 1188 A42F.tmp 101 PID 1188 wrote to memory of 4520 1188 A42F.tmp 101 PID 4520 wrote to memory of 2436 4520 A4BC.tmp 102 PID 4520 wrote to memory of 2436 4520 A4BC.tmp 102 PID 4520 wrote to memory of 2436 4520 A4BC.tmp 102 PID 2436 wrote to memory of 2668 2436 A529.tmp 103 PID 2436 wrote to memory of 2668 2436 A529.tmp 103 PID 2436 wrote to memory of 2668 2436 A529.tmp 103 PID 2668 wrote to memory of 1484 2668 A587.tmp 104 PID 2668 wrote to memory of 1484 2668 A587.tmp 104 PID 2668 wrote to memory of 1484 2668 A587.tmp 104 PID 1484 wrote to memory of 2964 1484 A604.tmp 105 PID 1484 wrote to memory of 2964 1484 A604.tmp 105 PID 1484 wrote to memory of 2964 1484 A604.tmp 105 PID 2964 wrote to memory of 1580 2964 A690.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-07_fb80bdf0df372b8cdfd2a3c0135e6347_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-07_fb80bdf0df372b8cdfd2a3c0135e6347_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\9D69.tmp"C:\Users\Admin\AppData\Local\Temp\9D69.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\A21C.tmp"C:\Users\Admin\AppData\Local\Temp\A21C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\A354.tmp"C:\Users\Admin\AppData\Local\Temp\A354.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\A73C.tmp"C:\Users\Admin\AppData\Local\Temp\A73C.tmp"23⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"24⤵
- Executes dropped EXE
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\A827.tmp"C:\Users\Admin\AppData\Local\Temp\A827.tmp"25⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"26⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\A911.tmp"C:\Users\Admin\AppData\Local\Temp\A911.tmp"27⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\A99E.tmp"C:\Users\Admin\AppData\Local\Temp\A99E.tmp"28⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"29⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"30⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\AB05.tmp"C:\Users\Admin\AppData\Local\Temp\AB05.tmp"31⤵
- Executes dropped EXE
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"32⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"33⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"34⤵
- Executes dropped EXE
PID:976 -
C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"35⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"36⤵
- Executes dropped EXE
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\AD57.tmp"C:\Users\Admin\AppData\Local\Temp\AD57.tmp"37⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"38⤵
- Executes dropped EXE
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"39⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"40⤵
- Executes dropped EXE
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"41⤵
- Executes dropped EXE
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"42⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"43⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"44⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\B110.tmp"C:\Users\Admin\AppData\Local\Temp\B110.tmp"45⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\B17D.tmp"C:\Users\Admin\AppData\Local\Temp\B17D.tmp"46⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"47⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\B277.tmp"C:\Users\Admin\AppData\Local\Temp\B277.tmp"48⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"49⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\B371.tmp"C:\Users\Admin\AppData\Local\Temp\B371.tmp"50⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"51⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"52⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"53⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\B536.tmp"C:\Users\Admin\AppData\Local\Temp\B536.tmp"54⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\B594.tmp"C:\Users\Admin\AppData\Local\Temp\B594.tmp"55⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\B621.tmp"C:\Users\Admin\AppData\Local\Temp\B621.tmp"56⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\B67F.tmp"C:\Users\Admin\AppData\Local\Temp\B67F.tmp"57⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"58⤵
- Executes dropped EXE
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\B759.tmp"C:\Users\Admin\AppData\Local\Temp\B759.tmp"59⤵
- Executes dropped EXE
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"60⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\B844.tmp"C:\Users\Admin\AppData\Local\Temp\B844.tmp"61⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"62⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"63⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"64⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\BA67.tmp"C:\Users\Admin\AppData\Local\Temp\BA67.tmp"65⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"66⤵
- Executes dropped EXE
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\BB41.tmp"C:\Users\Admin\AppData\Local\Temp\BB41.tmp"67⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"68⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"69⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"70⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\BD16.tmp"C:\Users\Admin\AppData\Local\Temp\BD16.tmp"71⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\BD93.tmp"C:\Users\Admin\AppData\Local\Temp\BD93.tmp"72⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"73⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"74⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"75⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\BF39.tmp"C:\Users\Admin\AppData\Local\Temp\BF39.tmp"76⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\BF97.tmp"C:\Users\Admin\AppData\Local\Temp\BF97.tmp"77⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"78⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\C052.tmp"C:\Users\Admin\AppData\Local\Temp\C052.tmp"79⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"80⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"81⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"82⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\C208.tmp"C:\Users\Admin\AppData\Local\Temp\C208.tmp"83⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\C275.tmp"C:\Users\Admin\AppData\Local\Temp\C275.tmp"84⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"85⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\C340.tmp"C:\Users\Admin\AppData\Local\Temp\C340.tmp"86⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"87⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\C41B.tmp"C:\Users\Admin\AppData\Local\Temp\C41B.tmp"88⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\C479.tmp"C:\Users\Admin\AppData\Local\Temp\C479.tmp"89⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\C4C7.tmp"C:\Users\Admin\AppData\Local\Temp\C4C7.tmp"90⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\C515.tmp"C:\Users\Admin\AppData\Local\Temp\C515.tmp"91⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\C582.tmp"C:\Users\Admin\AppData\Local\Temp\C582.tmp"92⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\C5F0.tmp"C:\Users\Admin\AppData\Local\Temp\C5F0.tmp"93⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\C64D.tmp"C:\Users\Admin\AppData\Local\Temp\C64D.tmp"94⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"95⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\C728.tmp"C:\Users\Admin\AppData\Local\Temp\C728.tmp"96⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\C786.tmp"C:\Users\Admin\AppData\Local\Temp\C786.tmp"97⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"98⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\C851.tmp"C:\Users\Admin\AppData\Local\Temp\C851.tmp"99⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"100⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\C92C.tmp"C:\Users\Admin\AppData\Local\Temp\C92C.tmp"101⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\C999.tmp"C:\Users\Admin\AppData\Local\Temp\C999.tmp"102⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"103⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\CA55.tmp"C:\Users\Admin\AppData\Local\Temp\CA55.tmp"104⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\CAC2.tmp"C:\Users\Admin\AppData\Local\Temp\CAC2.tmp"105⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\CB20.tmp"C:\Users\Admin\AppData\Local\Temp\CB20.tmp"106⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"107⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"108⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\CC68.tmp"C:\Users\Admin\AppData\Local\Temp\CC68.tmp"109⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"110⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\CD62.tmp"C:\Users\Admin\AppData\Local\Temp\CD62.tmp"111⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"112⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\CE3D.tmp"C:\Users\Admin\AppData\Local\Temp\CE3D.tmp"113⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"114⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\CEF8.tmp"C:\Users\Admin\AppData\Local\Temp\CEF8.tmp"115⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\CF56.tmp"C:\Users\Admin\AppData\Local\Temp\CF56.tmp"116⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"117⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\D021.tmp"C:\Users\Admin\AppData\Local\Temp\D021.tmp"118⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\D08E.tmp"C:\Users\Admin\AppData\Local\Temp\D08E.tmp"119⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"120⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\D15A.tmp"C:\Users\Admin\AppData\Local\Temp\D15A.tmp"121⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"122⤵PID:1612
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-