Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2024, 02:23
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-09_24448006621986355d79dd58add30dfa_mafia.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2024-07-09_24448006621986355d79dd58add30dfa_mafia.exe
Resource
win10v2004-20240704-en
General
-
Target
2024-07-09_24448006621986355d79dd58add30dfa_mafia.exe
-
Size
520KB
-
MD5
24448006621986355d79dd58add30dfa
-
SHA1
c753646e57b71605b9446d27dabbfc8e1c5f2df5
-
SHA256
e638d99935179ab3d54fcb96ca8a783bbabd7279fd54a8f420b424c06b06802f
-
SHA512
6a7670ceafd05c3da0435d6c563009c8150212a230cf0c9c53eca8b43c1a0f0a174ba479379c9d8b7b2d924551c671c2a2d3b5ae8256b079b2c7fa888cbc702a
-
SSDEEP
12288:gj8fuxR21t5i8fhptMPkoUI7ES9rin8NZ:gj8fuK1GY2PVFFin8N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2928 97CB.tmp 2256 9858.tmp 4388 98E4.tmp 3304 9933.tmp 3916 9981.tmp 4900 99EE.tmp 2564 9A6B.tmp 4336 9AC9.tmp 1836 9B36.tmp 400 9B94.tmp 1556 9BF2.tmp 2164 9C5F.tmp 3024 9CDC.tmp 1564 9D59.tmp 3280 9F6C.tmp 844 A009.tmp 3112 A066.tmp 4240 A0B4.tmp 1076 A103.tmp 5032 A151.tmp 4528 A1AE.tmp 3168 A1FD.tmp 816 A26A.tmp 4992 A2B8.tmp 796 A316.tmp 3596 A383.tmp 1312 A3E1.tmp 2816 A44E.tmp 1248 A4AC.tmp 1828 A4FA.tmp 1604 A548.tmp 2368 A5B6.tmp 456 A623.tmp 3496 A671.tmp 4036 A6BF.tmp 1924 A71D.tmp 4984 A76B.tmp 2888 A7C9.tmp 2808 A817.tmp 4828 A865.tmp 4644 A8C3.tmp 4932 A921.tmp 4612 A96F.tmp 4272 A9BD.tmp 4380 AA1B.tmp 4492 AA69.tmp 1072 AAC7.tmp 4132 AB15.tmp 5108 AB63.tmp 4008 ABB1.tmp 2968 AC0F.tmp 3132 AC5D.tmp 3680 ACBB.tmp 1672 AD09.tmp 3228 AD57.tmp 3284 ADA5.tmp 872 ADF3.tmp 4432 AE41.tmp 3940 AE8F.tmp 368 AEDD.tmp 3592 AF3B.tmp 4952 AF89.tmp 2932 AFD7.tmp 2572 B035.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1900 wrote to memory of 2928 1900 2024-07-09_24448006621986355d79dd58add30dfa_mafia.exe 83 PID 1900 wrote to memory of 2928 1900 2024-07-09_24448006621986355d79dd58add30dfa_mafia.exe 83 PID 1900 wrote to memory of 2928 1900 2024-07-09_24448006621986355d79dd58add30dfa_mafia.exe 83 PID 2928 wrote to memory of 2256 2928 97CB.tmp 85 PID 2928 wrote to memory of 2256 2928 97CB.tmp 85 PID 2928 wrote to memory of 2256 2928 97CB.tmp 85 PID 2256 wrote to memory of 4388 2256 9858.tmp 87 PID 2256 wrote to memory of 4388 2256 9858.tmp 87 PID 2256 wrote to memory of 4388 2256 9858.tmp 87 PID 4388 wrote to memory of 3304 4388 98E4.tmp 88 PID 4388 wrote to memory of 3304 4388 98E4.tmp 88 PID 4388 wrote to memory of 3304 4388 98E4.tmp 88 PID 3304 wrote to memory of 3916 3304 9933.tmp 89 PID 3304 wrote to memory of 3916 3304 9933.tmp 89 PID 3304 wrote to memory of 3916 3304 9933.tmp 89 PID 3916 wrote to memory of 4900 3916 9981.tmp 91 PID 3916 wrote to memory of 4900 3916 9981.tmp 91 PID 3916 wrote to memory of 4900 3916 9981.tmp 91 PID 4900 wrote to memory of 2564 4900 99EE.tmp 92 PID 4900 wrote to memory of 2564 4900 99EE.tmp 92 PID 4900 wrote to memory of 2564 4900 99EE.tmp 92 PID 2564 wrote to memory of 4336 2564 9A6B.tmp 93 PID 2564 wrote to memory of 4336 2564 9A6B.tmp 93 PID 2564 wrote to memory of 4336 2564 9A6B.tmp 93 PID 4336 wrote to memory of 1836 4336 9AC9.tmp 94 PID 4336 wrote to memory of 1836 4336 9AC9.tmp 94 PID 4336 wrote to memory of 1836 4336 9AC9.tmp 94 PID 1836 wrote to memory of 400 1836 9B36.tmp 95 PID 1836 wrote to memory of 400 1836 9B36.tmp 95 PID 1836 wrote to memory of 400 1836 9B36.tmp 95 PID 400 wrote to memory of 1556 400 9B94.tmp 96 PID 400 wrote to memory of 1556 400 9B94.tmp 96 PID 400 wrote to memory of 1556 400 9B94.tmp 96 PID 1556 wrote to memory of 2164 1556 9BF2.tmp 97 PID 1556 wrote to memory of 2164 1556 9BF2.tmp 97 PID 1556 wrote to memory of 2164 1556 9BF2.tmp 97 PID 2164 wrote to memory of 3024 2164 9C5F.tmp 98 PID 2164 wrote to memory of 3024 2164 9C5F.tmp 98 PID 2164 wrote to memory of 3024 2164 9C5F.tmp 98 PID 3024 wrote to memory of 1564 3024 9CDC.tmp 99 PID 3024 wrote to memory of 1564 3024 9CDC.tmp 99 PID 3024 wrote to memory of 1564 3024 9CDC.tmp 99 PID 1564 wrote to memory of 3280 1564 9D59.tmp 100 PID 1564 wrote to memory of 3280 1564 9D59.tmp 100 PID 1564 wrote to memory of 3280 1564 9D59.tmp 100 PID 3280 wrote to memory of 844 3280 9F6C.tmp 101 PID 3280 wrote to memory of 844 3280 9F6C.tmp 101 PID 3280 wrote to memory of 844 3280 9F6C.tmp 101 PID 844 wrote to memory of 3112 844 A009.tmp 102 PID 844 wrote to memory of 3112 844 A009.tmp 102 PID 844 wrote to memory of 3112 844 A009.tmp 102 PID 3112 wrote to memory of 4240 3112 A066.tmp 103 PID 3112 wrote to memory of 4240 3112 A066.tmp 103 PID 3112 wrote to memory of 4240 3112 A066.tmp 103 PID 4240 wrote to memory of 1076 4240 A0B4.tmp 104 PID 4240 wrote to memory of 1076 4240 A0B4.tmp 104 PID 4240 wrote to memory of 1076 4240 A0B4.tmp 104 PID 1076 wrote to memory of 5032 1076 A103.tmp 105 PID 1076 wrote to memory of 5032 1076 A103.tmp 105 PID 1076 wrote to memory of 5032 1076 A103.tmp 105 PID 5032 wrote to memory of 4528 5032 A151.tmp 106 PID 5032 wrote to memory of 4528 5032 A151.tmp 106 PID 5032 wrote to memory of 4528 5032 A151.tmp 106 PID 4528 wrote to memory of 3168 4528 A1AE.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-09_24448006621986355d79dd58add30dfa_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-09_24448006621986355d79dd58add30dfa_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\97CB.tmp"C:\Users\Admin\AppData\Local\Temp\97CB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\98E4.tmp"C:\Users\Admin\AppData\Local\Temp\98E4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\99EE.tmp"C:\Users\Admin\AppData\Local\Temp\99EE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\9D59.tmp"C:\Users\Admin\AppData\Local\Temp\9D59.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\A066.tmp"C:\Users\Admin\AppData\Local\Temp\A066.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\A103.tmp"C:\Users\Admin\AppData\Local\Temp\A103.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"23⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\A26A.tmp"C:\Users\Admin\AppData\Local\Temp\A26A.tmp"24⤵
- Executes dropped EXE
PID:816 -
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"25⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"26⤵
- Executes dropped EXE
PID:796 -
C:\Users\Admin\AppData\Local\Temp\A383.tmp"C:\Users\Admin\AppData\Local\Temp\A383.tmp"27⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"28⤵
- Executes dropped EXE
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"29⤵
- Executes dropped EXE
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"30⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"31⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"32⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"33⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"34⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\A671.tmp"C:\Users\Admin\AppData\Local\Temp\A671.tmp"35⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"36⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"37⤵
- Executes dropped EXE
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\A76B.tmp"C:\Users\Admin\AppData\Local\Temp\A76B.tmp"38⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"39⤵
- Executes dropped EXE
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\A817.tmp"C:\Users\Admin\AppData\Local\Temp\A817.tmp"40⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"41⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"42⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\A921.tmp"C:\Users\Admin\AppData\Local\Temp\A921.tmp"43⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\A96F.tmp"C:\Users\Admin\AppData\Local\Temp\A96F.tmp"44⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"45⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"46⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\AA69.tmp"C:\Users\Admin\AppData\Local\Temp\AA69.tmp"47⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"48⤵
- Executes dropped EXE
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\AB15.tmp"C:\Users\Admin\AppData\Local\Temp\AB15.tmp"49⤵
- Executes dropped EXE
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"50⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"51⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"52⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"53⤵
- Executes dropped EXE
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"54⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\AD09.tmp"C:\Users\Admin\AppData\Local\Temp\AD09.tmp"55⤵
- Executes dropped EXE
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\AD57.tmp"C:\Users\Admin\AppData\Local\Temp\AD57.tmp"56⤵
- Executes dropped EXE
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"57⤵
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"58⤵
- Executes dropped EXE
PID:872 -
C:\Users\Admin\AppData\Local\Temp\AE41.tmp"C:\Users\Admin\AppData\Local\Temp\AE41.tmp"59⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"60⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"61⤵
- Executes dropped EXE
PID:368 -
C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"62⤵
- Executes dropped EXE
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"63⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"64⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\B035.tmp"C:\Users\Admin\AppData\Local\Temp\B035.tmp"65⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\B083.tmp"C:\Users\Admin\AppData\Local\Temp\B083.tmp"66⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"67⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\B120.tmp"C:\Users\Admin\AppData\Local\Temp\B120.tmp"68⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\B17D.tmp"C:\Users\Admin\AppData\Local\Temp\B17D.tmp"69⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"70⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\B229.tmp"C:\Users\Admin\AppData\Local\Temp\B229.tmp"71⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\B287.tmp"C:\Users\Admin\AppData\Local\Temp\B287.tmp"72⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"73⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\B323.tmp"C:\Users\Admin\AppData\Local\Temp\B323.tmp"74⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\B371.tmp"C:\Users\Admin\AppData\Local\Temp\B371.tmp"75⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"76⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\B40E.tmp"C:\Users\Admin\AppData\Local\Temp\B40E.tmp"77⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\B45C.tmp"C:\Users\Admin\AppData\Local\Temp\B45C.tmp"78⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"79⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\B517.tmp"C:\Users\Admin\AppData\Local\Temp\B517.tmp"80⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\B575.tmp"C:\Users\Admin\AppData\Local\Temp\B575.tmp"81⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"82⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\B611.tmp"C:\Users\Admin\AppData\Local\Temp\B611.tmp"83⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\B66F.tmp"C:\Users\Admin\AppData\Local\Temp\B66F.tmp"84⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"85⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\B71B.tmp"C:\Users\Admin\AppData\Local\Temp\B71B.tmp"86⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\B769.tmp"C:\Users\Admin\AppData\Local\Temp\B769.tmp"87⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"88⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\B805.tmp"C:\Users\Admin\AppData\Local\Temp\B805.tmp"89⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\B853.tmp"C:\Users\Admin\AppData\Local\Temp\B853.tmp"90⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"91⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"92⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\B96D.tmp"C:\Users\Admin\AppData\Local\Temp\B96D.tmp"93⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"94⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\BA28.tmp"C:\Users\Admin\AppData\Local\Temp\BA28.tmp"95⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\BA76.tmp"C:\Users\Admin\AppData\Local\Temp\BA76.tmp"96⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"97⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\BB22.tmp"C:\Users\Admin\AppData\Local\Temp\BB22.tmp"98⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\BB70.tmp"C:\Users\Admin\AppData\Local\Temp\BB70.tmp"99⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"100⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"101⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"102⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"103⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\BD16.tmp"C:\Users\Admin\AppData\Local\Temp\BD16.tmp"104⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\BD74.tmp"C:\Users\Admin\AppData\Local\Temp\BD74.tmp"105⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"106⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"107⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"108⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"109⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\BF29.tmp"C:\Users\Admin\AppData\Local\Temp\BF29.tmp"110⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\BF87.tmp"C:\Users\Admin\AppData\Local\Temp\BF87.tmp"111⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"112⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\C023.tmp"C:\Users\Admin\AppData\Local\Temp\C023.tmp"113⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\C071.tmp"C:\Users\Admin\AppData\Local\Temp\C071.tmp"114⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"115⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"116⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\C17B.tmp"C:\Users\Admin\AppData\Local\Temp\C17B.tmp"117⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"118⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"119⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\C275.tmp"C:\Users\Admin\AppData\Local\Temp\C275.tmp"120⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"121⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\C331.tmp"C:\Users\Admin\AppData\Local\Temp\C331.tmp"122⤵PID:2684
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-