Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2024, 15:54
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-08_d32903debdef4e91c4941b41f34a428f_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-07-08_d32903debdef4e91c4941b41f34a428f_mafia.exe
Resource
win10v2004-20240704-en
General
-
Target
2024-07-08_d32903debdef4e91c4941b41f34a428f_mafia.exe
-
Size
529KB
-
MD5
d32903debdef4e91c4941b41f34a428f
-
SHA1
8f6cfe20d560137f73a23041e4a8393ad5804cea
-
SHA256
2ee72525cf048ac440bf17d4905d7118c833ba985b73c9134c3c0cb105ba9a92
-
SHA512
a543e208a9a99b998e47630ab7691cc2c9a8f4356a2a283328e3c605537bfb33795034d73684f843150cdb25f17f768124d2a7972fd7723b4b8183d378acb953
-
SSDEEP
12288:NU5rCOTeijYGY/hvhQb86Riaqjl+BZcC+TZwlH4Hp:NUQOJjYGY5vhQY6Ya4l+vcjTSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2500 9904.tmp 5092 9990.tmp 1884 9A6B.tmp 1508 9B07.tmp 2440 9BA4.tmp 212 9C6F.tmp 3112 9D1B.tmp 4952 9D88.tmp 4404 9E24.tmp 1104 9EC0.tmp 1572 9F8C.tmp 1536 A057.tmp 1936 A0D4.tmp 3988 A180.tmp 2820 A1FD.tmp 5060 A289.tmp 744 A316.tmp 2816 A3D1.tmp 1804 A48D.tmp 1968 A50A.tmp 1932 A568.tmp 3968 A5F4.tmp 844 A681.tmp 1912 A6EE.tmp 2004 A74C.tmp 3912 A7D9.tmp 3880 A894.tmp 3136 A921.tmp 4308 A99E.tmp 1644 AA1B.tmp 4252 AAA7.tmp 532 AB15.tmp 3732 ABA1.tmp 1356 AC0F.tmp 4560 AC7C.tmp 4348 ACF9.tmp 3336 AD66.tmp 1708 ADB5.tmp 4440 AE32.tmp 2472 AE9F.tmp 4464 AF0C.tmp 1320 AF89.tmp 2248 AFF7.tmp 3692 B064.tmp 1584 B0D1.tmp 2096 B13F.tmp 2844 B1AC.tmp 3020 B21A.tmp 3508 B277.tmp 4688 B2D5.tmp 2104 B352.tmp 4396 B3B0.tmp 4420 B42D.tmp 1832 B48B.tmp 5020 B4E8.tmp 3232 B556.tmp 5064 B5B3.tmp 5092 B630.tmp 3628 B69E.tmp 1648 B70B.tmp 116 B779.tmp 4864 B7F6.tmp 1508 B863.tmp 4712 B8B1.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1928 wrote to memory of 2500 1928 2024-07-08_d32903debdef4e91c4941b41f34a428f_mafia.exe 82 PID 1928 wrote to memory of 2500 1928 2024-07-08_d32903debdef4e91c4941b41f34a428f_mafia.exe 82 PID 1928 wrote to memory of 2500 1928 2024-07-08_d32903debdef4e91c4941b41f34a428f_mafia.exe 82 PID 2500 wrote to memory of 5092 2500 9904.tmp 84 PID 2500 wrote to memory of 5092 2500 9904.tmp 84 PID 2500 wrote to memory of 5092 2500 9904.tmp 84 PID 5092 wrote to memory of 1884 5092 9990.tmp 86 PID 5092 wrote to memory of 1884 5092 9990.tmp 86 PID 5092 wrote to memory of 1884 5092 9990.tmp 86 PID 1884 wrote to memory of 1508 1884 9A6B.tmp 87 PID 1884 wrote to memory of 1508 1884 9A6B.tmp 87 PID 1884 wrote to memory of 1508 1884 9A6B.tmp 87 PID 1508 wrote to memory of 2440 1508 9B07.tmp 89 PID 1508 wrote to memory of 2440 1508 9B07.tmp 89 PID 1508 wrote to memory of 2440 1508 9B07.tmp 89 PID 2440 wrote to memory of 212 2440 9BA4.tmp 90 PID 2440 wrote to memory of 212 2440 9BA4.tmp 90 PID 2440 wrote to memory of 212 2440 9BA4.tmp 90 PID 212 wrote to memory of 3112 212 9C6F.tmp 91 PID 212 wrote to memory of 3112 212 9C6F.tmp 91 PID 212 wrote to memory of 3112 212 9C6F.tmp 91 PID 3112 wrote to memory of 4952 3112 9D1B.tmp 92 PID 3112 wrote to memory of 4952 3112 9D1B.tmp 92 PID 3112 wrote to memory of 4952 3112 9D1B.tmp 92 PID 4952 wrote to memory of 4404 4952 9D88.tmp 93 PID 4952 wrote to memory of 4404 4952 9D88.tmp 93 PID 4952 wrote to memory of 4404 4952 9D88.tmp 93 PID 4404 wrote to memory of 1104 4404 9E24.tmp 94 PID 4404 wrote to memory of 1104 4404 9E24.tmp 94 PID 4404 wrote to memory of 1104 4404 9E24.tmp 94 PID 1104 wrote to memory of 1572 1104 9EC0.tmp 95 PID 1104 wrote to memory of 1572 1104 9EC0.tmp 95 PID 1104 wrote to memory of 1572 1104 9EC0.tmp 95 PID 1572 wrote to memory of 1536 1572 9F8C.tmp 96 PID 1572 wrote to memory of 1536 1572 9F8C.tmp 96 PID 1572 wrote to memory of 1536 1572 9F8C.tmp 96 PID 1536 wrote to memory of 1936 1536 A057.tmp 97 PID 1536 wrote to memory of 1936 1536 A057.tmp 97 PID 1536 wrote to memory of 1936 1536 A057.tmp 97 PID 1936 wrote to memory of 3988 1936 A0D4.tmp 98 PID 1936 wrote to memory of 3988 1936 A0D4.tmp 98 PID 1936 wrote to memory of 3988 1936 A0D4.tmp 98 PID 3988 wrote to memory of 2820 3988 A180.tmp 99 PID 3988 wrote to memory of 2820 3988 A180.tmp 99 PID 3988 wrote to memory of 2820 3988 A180.tmp 99 PID 2820 wrote to memory of 5060 2820 A1FD.tmp 100 PID 2820 wrote to memory of 5060 2820 A1FD.tmp 100 PID 2820 wrote to memory of 5060 2820 A1FD.tmp 100 PID 5060 wrote to memory of 744 5060 A289.tmp 101 PID 5060 wrote to memory of 744 5060 A289.tmp 101 PID 5060 wrote to memory of 744 5060 A289.tmp 101 PID 744 wrote to memory of 2816 744 A316.tmp 102 PID 744 wrote to memory of 2816 744 A316.tmp 102 PID 744 wrote to memory of 2816 744 A316.tmp 102 PID 2816 wrote to memory of 1804 2816 A3D1.tmp 103 PID 2816 wrote to memory of 1804 2816 A3D1.tmp 103 PID 2816 wrote to memory of 1804 2816 A3D1.tmp 103 PID 1804 wrote to memory of 1968 1804 A48D.tmp 104 PID 1804 wrote to memory of 1968 1804 A48D.tmp 104 PID 1804 wrote to memory of 1968 1804 A48D.tmp 104 PID 1968 wrote to memory of 1932 1968 A50A.tmp 105 PID 1968 wrote to memory of 1932 1968 A50A.tmp 105 PID 1968 wrote to memory of 1932 1968 A50A.tmp 105 PID 1932 wrote to memory of 3968 1932 A568.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-08_d32903debdef4e91c4941b41f34a428f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-08_d32903debdef4e91c4941b41f34a428f_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\9904.tmp"C:\Users\Admin\AppData\Local\Temp\9904.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\A180.tmp"C:\Users\Admin\AppData\Local\Temp\A180.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\A50A.tmp"C:\Users\Admin\AppData\Local\Temp\A50A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"23⤵
- Executes dropped EXE
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"24⤵
- Executes dropped EXE
PID:844 -
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"25⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\A74C.tmp"C:\Users\Admin\AppData\Local\Temp\A74C.tmp"26⤵
- Executes dropped EXE
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"27⤵
- Executes dropped EXE
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\A894.tmp"C:\Users\Admin\AppData\Local\Temp\A894.tmp"28⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\A921.tmp"C:\Users\Admin\AppData\Local\Temp\A921.tmp"29⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\A99E.tmp"C:\Users\Admin\AppData\Local\Temp\A99E.tmp"30⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"31⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"32⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\AB15.tmp"C:\Users\Admin\AppData\Local\Temp\AB15.tmp"33⤵
- Executes dropped EXE
PID:532 -
C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"34⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"35⤵
- Executes dropped EXE
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"36⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"37⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\AD66.tmp"C:\Users\Admin\AppData\Local\Temp\AD66.tmp"38⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"39⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"40⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"41⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"42⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"43⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"44⤵
- Executes dropped EXE
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\B064.tmp"C:\Users\Admin\AppData\Local\Temp\B064.tmp"45⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"46⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"47⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"48⤵
- Executes dropped EXE
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\B21A.tmp"C:\Users\Admin\AppData\Local\Temp\B21A.tmp"49⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\B277.tmp"C:\Users\Admin\AppData\Local\Temp\B277.tmp"50⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"51⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\B352.tmp"C:\Users\Admin\AppData\Local\Temp\B352.tmp"52⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"53⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\B42D.tmp"C:\Users\Admin\AppData\Local\Temp\B42D.tmp"54⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\B48B.tmp"C:\Users\Admin\AppData\Local\Temp\B48B.tmp"55⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"56⤵
- Executes dropped EXE
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"57⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"58⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"59⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\B69E.tmp"C:\Users\Admin\AppData\Local\Temp\B69E.tmp"60⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\B70B.tmp"C:\Users\Admin\AppData\Local\Temp\B70B.tmp"61⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\B779.tmp"C:\Users\Admin\AppData\Local\Temp\B779.tmp"62⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"63⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\B863.tmp"C:\Users\Admin\AppData\Local\Temp\B863.tmp"64⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"65⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\B91E.tmp"C:\Users\Admin\AppData\Local\Temp\B91E.tmp"66⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\B98C.tmp"C:\Users\Admin\AppData\Local\Temp\B98C.tmp"67⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"68⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\BA67.tmp"C:\Users\Admin\AppData\Local\Temp\BA67.tmp"69⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"70⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\BB22.tmp"C:\Users\Admin\AppData\Local\Temp\BB22.tmp"71⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\BB70.tmp"C:\Users\Admin\AppData\Local\Temp\BB70.tmp"72⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"73⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"74⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"75⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\BD16.tmp"C:\Users\Admin\AppData\Local\Temp\BD16.tmp"76⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\BD74.tmp"C:\Users\Admin\AppData\Local\Temp\BD74.tmp"77⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"78⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"79⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"80⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"81⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\BF68.tmp"C:\Users\Admin\AppData\Local\Temp\BF68.tmp"82⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"83⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\C023.tmp"C:\Users\Admin\AppData\Local\Temp\C023.tmp"84⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"85⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"86⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"87⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"88⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"89⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\C285.tmp"C:\Users\Admin\AppData\Local\Temp\C285.tmp"90⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\C302.tmp"C:\Users\Admin\AppData\Local\Temp\C302.tmp"91⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\C35F.tmp"C:\Users\Admin\AppData\Local\Temp\C35F.tmp"92⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"93⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\C42B.tmp"C:\Users\Admin\AppData\Local\Temp\C42B.tmp"94⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\C479.tmp"C:\Users\Admin\AppData\Local\Temp\C479.tmp"95⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"96⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\C553.tmp"C:\Users\Admin\AppData\Local\Temp\C553.tmp"97⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"98⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\C62E.tmp"C:\Users\Admin\AppData\Local\Temp\C62E.tmp"99⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\C69C.tmp"C:\Users\Admin\AppData\Local\Temp\C69C.tmp"100⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\C709.tmp"C:\Users\Admin\AppData\Local\Temp\C709.tmp"101⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\C776.tmp"C:\Users\Admin\AppData\Local\Temp\C776.tmp"102⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"103⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\C841.tmp"C:\Users\Admin\AppData\Local\Temp\C841.tmp"104⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"105⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\C91C.tmp"C:\Users\Admin\AppData\Local\Temp\C91C.tmp"106⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\C96A.tmp"C:\Users\Admin\AppData\Local\Temp\C96A.tmp"107⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\C9C8.tmp"C:\Users\Admin\AppData\Local\Temp\C9C8.tmp"108⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\CA45.tmp"C:\Users\Admin\AppData\Local\Temp\CA45.tmp"109⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\CA93.tmp"C:\Users\Admin\AppData\Local\Temp\CA93.tmp"110⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"111⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\CB3F.tmp"C:\Users\Admin\AppData\Local\Temp\CB3F.tmp"112⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"113⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"114⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\CC58.tmp"C:\Users\Admin\AppData\Local\Temp\CC58.tmp"115⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"116⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\CD04.tmp"C:\Users\Admin\AppData\Local\Temp\CD04.tmp"117⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\CD72.tmp"C:\Users\Admin\AppData\Local\Temp\CD72.tmp"118⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\CDC0.tmp"C:\Users\Admin\AppData\Local\Temp\CDC0.tmp"119⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\CE0E.tmp"C:\Users\Admin\AppData\Local\Temp\CE0E.tmp"120⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"121⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\CED9.tmp"C:\Users\Admin\AppData\Local\Temp\CED9.tmp"122⤵PID:2880
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-