Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2024, 12:53
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-22_5bd5904ab61550ea7351eab581051719_mafia.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2024-07-22_5bd5904ab61550ea7351eab581051719_mafia.exe
Resource
win10v2004-20240709-en
General
-
Target
2024-07-22_5bd5904ab61550ea7351eab581051719_mafia.exe
-
Size
488KB
-
MD5
5bd5904ab61550ea7351eab581051719
-
SHA1
6771d90c32b642740ddb7ad0db265a4b46ec32f7
-
SHA256
8a9d17a7a9652a57122368e532c10d0e52305b3ce13d8c5fcd41aa6ddc337a01
-
SHA512
8a01e7fdf3fed9e56201cd2e5f075b257db589a278359cee3b3a4eb1c8c37d1caec4c331835788460572e850205f806cd01adc6addef2eaf6ba240be9e7da40b
-
SSDEEP
12288:/U5rCOTeiDkbbQL0qBR/O8DZcDcWSbzNeyNZ:/UQOJDMQLfLOSbzrN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4976 8BD5.tmp 1740 8C52.tmp 4012 8CDE.tmp 1624 8D3C.tmp 1440 8DA9.tmp 4172 8DF8.tmp 4752 8E65.tmp 2184 8EC3.tmp 3120 8F30.tmp 3100 8FAD.tmp 4748 901A.tmp 4736 9088.tmp 2968 90F5.tmp 1416 9182.tmp 364 91FF.tmp 4552 927C.tmp 3280 92DA.tmp 5060 9357.tmp 1396 93C4.tmp 3024 9422.tmp 2448 9470.tmp 3376 94FC.tmp 3756 9589.tmp 1208 9606.tmp 948 9664.tmp 4056 96C2.tmp 4960 972F.tmp 3884 978D.tmp 212 980A.tmp 2408 9877.tmp 1764 98E4.tmp 1904 9933.tmp 4952 9981.tmp 4416 9A0D.tmp 420 9A5B.tmp 5116 9AAA.tmp 3584 9AF8.tmp 4292 9B46.tmp 4508 9B94.tmp 1156 9BE2.tmp 208 9C40.tmp 5000 9C8E.tmp 4540 9CEC.tmp 1440 9D49.tmp 5028 9D98.tmp 2252 9DE6.tmp 5084 9E34.tmp 3080 9E92.tmp 3028 9EEF.tmp 2196 9F4D.tmp 4104 9F9B.tmp 3004 9FF9.tmp 3204 A057.tmp 3508 A0B4.tmp 3496 A122.tmp 2656 A170.tmp 832 A1CE.tmp 4800 A22B.tmp 2968 A289.tmp 1116 A2E7.tmp 3136 A345.tmp 3736 A3A2.tmp 2372 A410.tmp 2636 A46E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3464 wrote to memory of 4976 3464 2024-07-22_5bd5904ab61550ea7351eab581051719_mafia.exe 84 PID 3464 wrote to memory of 4976 3464 2024-07-22_5bd5904ab61550ea7351eab581051719_mafia.exe 84 PID 3464 wrote to memory of 4976 3464 2024-07-22_5bd5904ab61550ea7351eab581051719_mafia.exe 84 PID 4976 wrote to memory of 1740 4976 8BD5.tmp 86 PID 4976 wrote to memory of 1740 4976 8BD5.tmp 86 PID 4976 wrote to memory of 1740 4976 8BD5.tmp 86 PID 1740 wrote to memory of 4012 1740 8C52.tmp 88 PID 1740 wrote to memory of 4012 1740 8C52.tmp 88 PID 1740 wrote to memory of 4012 1740 8C52.tmp 88 PID 4012 wrote to memory of 1624 4012 8CDE.tmp 89 PID 4012 wrote to memory of 1624 4012 8CDE.tmp 89 PID 4012 wrote to memory of 1624 4012 8CDE.tmp 89 PID 1624 wrote to memory of 1440 1624 8D3C.tmp 91 PID 1624 wrote to memory of 1440 1624 8D3C.tmp 91 PID 1624 wrote to memory of 1440 1624 8D3C.tmp 91 PID 1440 wrote to memory of 4172 1440 8DA9.tmp 92 PID 1440 wrote to memory of 4172 1440 8DA9.tmp 92 PID 1440 wrote to memory of 4172 1440 8DA9.tmp 92 PID 4172 wrote to memory of 4752 4172 8DF8.tmp 93 PID 4172 wrote to memory of 4752 4172 8DF8.tmp 93 PID 4172 wrote to memory of 4752 4172 8DF8.tmp 93 PID 4752 wrote to memory of 2184 4752 8E65.tmp 94 PID 4752 wrote to memory of 2184 4752 8E65.tmp 94 PID 4752 wrote to memory of 2184 4752 8E65.tmp 94 PID 2184 wrote to memory of 3120 2184 8EC3.tmp 95 PID 2184 wrote to memory of 3120 2184 8EC3.tmp 95 PID 2184 wrote to memory of 3120 2184 8EC3.tmp 95 PID 3120 wrote to memory of 3100 3120 8F30.tmp 96 PID 3120 wrote to memory of 3100 3120 8F30.tmp 96 PID 3120 wrote to memory of 3100 3120 8F30.tmp 96 PID 3100 wrote to memory of 4748 3100 8FAD.tmp 97 PID 3100 wrote to memory of 4748 3100 8FAD.tmp 97 PID 3100 wrote to memory of 4748 3100 8FAD.tmp 97 PID 4748 wrote to memory of 4736 4748 901A.tmp 98 PID 4748 wrote to memory of 4736 4748 901A.tmp 98 PID 4748 wrote to memory of 4736 4748 901A.tmp 98 PID 4736 wrote to memory of 2968 4736 9088.tmp 99 PID 4736 wrote to memory of 2968 4736 9088.tmp 99 PID 4736 wrote to memory of 2968 4736 9088.tmp 99 PID 2968 wrote to memory of 1416 2968 90F5.tmp 100 PID 2968 wrote to memory of 1416 2968 90F5.tmp 100 PID 2968 wrote to memory of 1416 2968 90F5.tmp 100 PID 1416 wrote to memory of 364 1416 9182.tmp 101 PID 1416 wrote to memory of 364 1416 9182.tmp 101 PID 1416 wrote to memory of 364 1416 9182.tmp 101 PID 364 wrote to memory of 4552 364 91FF.tmp 102 PID 364 wrote to memory of 4552 364 91FF.tmp 102 PID 364 wrote to memory of 4552 364 91FF.tmp 102 PID 4552 wrote to memory of 3280 4552 927C.tmp 103 PID 4552 wrote to memory of 3280 4552 927C.tmp 103 PID 4552 wrote to memory of 3280 4552 927C.tmp 103 PID 3280 wrote to memory of 5060 3280 92DA.tmp 104 PID 3280 wrote to memory of 5060 3280 92DA.tmp 104 PID 3280 wrote to memory of 5060 3280 92DA.tmp 104 PID 5060 wrote to memory of 1396 5060 9357.tmp 105 PID 5060 wrote to memory of 1396 5060 9357.tmp 105 PID 5060 wrote to memory of 1396 5060 9357.tmp 105 PID 1396 wrote to memory of 3024 1396 93C4.tmp 106 PID 1396 wrote to memory of 3024 1396 93C4.tmp 106 PID 1396 wrote to memory of 3024 1396 93C4.tmp 106 PID 3024 wrote to memory of 2448 3024 9422.tmp 107 PID 3024 wrote to memory of 2448 3024 9422.tmp 107 PID 3024 wrote to memory of 2448 3024 9422.tmp 107 PID 2448 wrote to memory of 3376 2448 9470.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-22_5bd5904ab61550ea7351eab581051719_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-22_5bd5904ab61550ea7351eab581051719_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\8F30.tmp"C:\Users\Admin\AppData\Local\Temp\8F30.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\901A.tmp"C:\Users\Admin\AppData\Local\Temp\901A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\9182.tmp"C:\Users\Admin\AppData\Local\Temp\9182.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\AppData\Local\Temp\927C.tmp"C:\Users\Admin\AppData\Local\Temp\927C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\92DA.tmp"C:\Users\Admin\AppData\Local\Temp\92DA.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\9422.tmp"C:\Users\Admin\AppData\Local\Temp\9422.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\9470.tmp"C:\Users\Admin\AppData\Local\Temp\9470.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\94FC.tmp"C:\Users\Admin\AppData\Local\Temp\94FC.tmp"23⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"24⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\9606.tmp"C:\Users\Admin\AppData\Local\Temp\9606.tmp"25⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\9664.tmp"C:\Users\Admin\AppData\Local\Temp\9664.tmp"26⤵
- Executes dropped EXE
PID:948 -
C:\Users\Admin\AppData\Local\Temp\96C2.tmp"C:\Users\Admin\AppData\Local\Temp\96C2.tmp"27⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\972F.tmp"C:\Users\Admin\AppData\Local\Temp\972F.tmp"28⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\978D.tmp"C:\Users\Admin\AppData\Local\Temp\978D.tmp"29⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"30⤵
- Executes dropped EXE
PID:212 -
C:\Users\Admin\AppData\Local\Temp\9877.tmp"C:\Users\Admin\AppData\Local\Temp\9877.tmp"31⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\98E4.tmp"C:\Users\Admin\AppData\Local\Temp\98E4.tmp"32⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"33⤵
- Executes dropped EXE
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"34⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"35⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"36⤵
- Executes dropped EXE
PID:420 -
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"37⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"38⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"39⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"40⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"41⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"42⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"43⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"44⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"45⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"46⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"47⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"48⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"49⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"50⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"51⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"52⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"53⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"54⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"55⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"56⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"57⤵
- Executes dropped EXE
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"58⤵
- Executes dropped EXE
PID:832 -
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"59⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"60⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"61⤵
- Executes dropped EXE
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"62⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"63⤵
- Executes dropped EXE
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\A410.tmp"C:\Users\Admin\AppData\Local\Temp\A410.tmp"64⤵
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\A46E.tmp"C:\Users\Admin\AppData\Local\Temp\A46E.tmp"65⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"66⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"67⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"68⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"69⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\A642.tmp"C:\Users\Admin\AppData\Local\Temp\A642.tmp"70⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"71⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"72⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\A74C.tmp"C:\Users\Admin\AppData\Local\Temp\A74C.tmp"73⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"74⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"75⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"76⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"77⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"78⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"79⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"80⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"81⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\AA88.tmp"C:\Users\Admin\AppData\Local\Temp\AA88.tmp"82⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"83⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\AB44.tmp"C:\Users\Admin\AppData\Local\Temp\AB44.tmp"84⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"85⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"86⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"87⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"88⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"89⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"90⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"91⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\AE41.tmp"C:\Users\Admin\AppData\Local\Temp\AE41.tmp"92⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"93⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"94⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"95⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"96⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\B016.tmp"C:\Users\Admin\AppData\Local\Temp\B016.tmp"97⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\B074.tmp"C:\Users\Admin\AppData\Local\Temp\B074.tmp"98⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"99⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\B12F.tmp"C:\Users\Admin\AppData\Local\Temp\B12F.tmp"100⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\B18D.tmp"C:\Users\Admin\AppData\Local\Temp\B18D.tmp"101⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"102⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"103⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"104⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"105⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"106⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\B381.tmp"C:\Users\Admin\AppData\Local\Temp\B381.tmp"107⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"108⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\B43C.tmp"C:\Users\Admin\AppData\Local\Temp\B43C.tmp"109⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\B48B.tmp"C:\Users\Admin\AppData\Local\Temp\B48B.tmp"110⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"111⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\B546.tmp"C:\Users\Admin\AppData\Local\Temp\B546.tmp"112⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\B594.tmp"C:\Users\Admin\AppData\Local\Temp\B594.tmp"113⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"114⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"115⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"116⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\B70B.tmp"C:\Users\Admin\AppData\Local\Temp\B70B.tmp"117⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\B759.tmp"C:\Users\Admin\AppData\Local\Temp\B759.tmp"118⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"119⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\B815.tmp"C:\Users\Admin\AppData\Local\Temp\B815.tmp"120⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\B863.tmp"C:\Users\Admin\AppData\Local\Temp\B863.tmp"121⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"122⤵PID:2352
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-