Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/04/2024, 15:35
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-08_914b9c55d125f4f516230aa71c2fe370_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-08_914b9c55d125f4f516230aa71c2fe370_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-08_914b9c55d125f4f516230aa71c2fe370_mafia.exe
-
Size
488KB
-
MD5
914b9c55d125f4f516230aa71c2fe370
-
SHA1
b896386ca670438e3b0dea3a07271f5ffb1d5451
-
SHA256
bd2e42a592a583938b3f9caf42c505f1f2d0acdd4a1ff3308364d0bcba799115
-
SHA512
c4ca49a8109f8983ff1fcad40397dde1cf7ffbb3f54cbd19943d370e99f5347a24e0de353bdd79fb666a06936a2cafd0c6377f882b6a978fa8af2d3b8c8c741e
-
SSDEEP
12288:/U5rCOTeiDC6lbRGsQtMC0KYW5v5tjMRNZ:/UQOJD7O0XKYSzaN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3880 3846.tmp 4924 38C3.tmp 2268 3930.tmp 2040 39BD.tmp 1724 3A0B.tmp 976 3A79.tmp 5072 3AD6.tmp 5052 3B24.tmp 1796 3B92.tmp 544 3BFF.tmp 1236 3C5D.tmp 1112 3CCA.tmp 3828 3D18.tmp 4972 3D67.tmp 4628 3DD4.tmp 4788 3E32.tmp 3756 3E8F.tmp 4356 3EFD.tmp 2260 3F4B.tmp 3780 3FA9.tmp 2556 4006.tmp 2604 4074.tmp 4720 40F1.tmp 4040 414F.tmp 2440 41BC.tmp 3184 420A.tmp 2376 4258.tmp 4880 42B6.tmp 2460 4304.tmp 4556 4391.tmp 1424 43DF.tmp 4368 444C.tmp 5056 449A.tmp 3328 44E8.tmp 4616 4546.tmp 5036 45B4.tmp 4744 4602.tmp 220 465F.tmp 964 46BD.tmp 4856 470B.tmp 4892 4769.tmp 5008 47B7.tmp 1952 4805.tmp 1492 4853.tmp 4708 48A2.tmp 536 48F0.tmp 5112 494D.tmp 4684 49AB.tmp 992 49F9.tmp 1724 4A57.tmp 3876 4AA5.tmp 312 4AF3.tmp 3572 4B51.tmp 5072 4BAF.tmp 3052 4BFD.tmp 2212 4C5B.tmp 1020 4CB8.tmp 544 4D07.tmp 2912 4D55.tmp 3544 4DA3.tmp 2612 4E01.tmp 4516 4E5E.tmp 548 4EAC.tmp 808 4F0A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1548 wrote to memory of 3880 1548 2024-04-08_914b9c55d125f4f516230aa71c2fe370_mafia.exe 88 PID 1548 wrote to memory of 3880 1548 2024-04-08_914b9c55d125f4f516230aa71c2fe370_mafia.exe 88 PID 1548 wrote to memory of 3880 1548 2024-04-08_914b9c55d125f4f516230aa71c2fe370_mafia.exe 88 PID 3880 wrote to memory of 4924 3880 3846.tmp 89 PID 3880 wrote to memory of 4924 3880 3846.tmp 89 PID 3880 wrote to memory of 4924 3880 3846.tmp 89 PID 4924 wrote to memory of 2268 4924 38C3.tmp 91 PID 4924 wrote to memory of 2268 4924 38C3.tmp 91 PID 4924 wrote to memory of 2268 4924 38C3.tmp 91 PID 2268 wrote to memory of 2040 2268 3930.tmp 92 PID 2268 wrote to memory of 2040 2268 3930.tmp 92 PID 2268 wrote to memory of 2040 2268 3930.tmp 92 PID 2040 wrote to memory of 1724 2040 39BD.tmp 93 PID 2040 wrote to memory of 1724 2040 39BD.tmp 93 PID 2040 wrote to memory of 1724 2040 39BD.tmp 93 PID 1724 wrote to memory of 976 1724 3A0B.tmp 94 PID 1724 wrote to memory of 976 1724 3A0B.tmp 94 PID 1724 wrote to memory of 976 1724 3A0B.tmp 94 PID 976 wrote to memory of 5072 976 3A79.tmp 95 PID 976 wrote to memory of 5072 976 3A79.tmp 95 PID 976 wrote to memory of 5072 976 3A79.tmp 95 PID 5072 wrote to memory of 5052 5072 3AD6.tmp 96 PID 5072 wrote to memory of 5052 5072 3AD6.tmp 96 PID 5072 wrote to memory of 5052 5072 3AD6.tmp 96 PID 5052 wrote to memory of 1796 5052 3B24.tmp 97 PID 5052 wrote to memory of 1796 5052 3B24.tmp 97 PID 5052 wrote to memory of 1796 5052 3B24.tmp 97 PID 1796 wrote to memory of 544 1796 3B92.tmp 98 PID 1796 wrote to memory of 544 1796 3B92.tmp 98 PID 1796 wrote to memory of 544 1796 3B92.tmp 98 PID 544 wrote to memory of 1236 544 3BFF.tmp 99 PID 544 wrote to memory of 1236 544 3BFF.tmp 99 PID 544 wrote to memory of 1236 544 3BFF.tmp 99 PID 1236 wrote to memory of 1112 1236 3C5D.tmp 100 PID 1236 wrote to memory of 1112 1236 3C5D.tmp 100 PID 1236 wrote to memory of 1112 1236 3C5D.tmp 100 PID 1112 wrote to memory of 3828 1112 3CCA.tmp 101 PID 1112 wrote to memory of 3828 1112 3CCA.tmp 101 PID 1112 wrote to memory of 3828 1112 3CCA.tmp 101 PID 3828 wrote to memory of 4972 3828 3D18.tmp 102 PID 3828 wrote to memory of 4972 3828 3D18.tmp 102 PID 3828 wrote to memory of 4972 3828 3D18.tmp 102 PID 4972 wrote to memory of 4628 4972 3D67.tmp 103 PID 4972 wrote to memory of 4628 4972 3D67.tmp 103 PID 4972 wrote to memory of 4628 4972 3D67.tmp 103 PID 4628 wrote to memory of 4788 4628 3DD4.tmp 104 PID 4628 wrote to memory of 4788 4628 3DD4.tmp 104 PID 4628 wrote to memory of 4788 4628 3DD4.tmp 104 PID 4788 wrote to memory of 3756 4788 3E32.tmp 105 PID 4788 wrote to memory of 3756 4788 3E32.tmp 105 PID 4788 wrote to memory of 3756 4788 3E32.tmp 105 PID 3756 wrote to memory of 4356 3756 3E8F.tmp 106 PID 3756 wrote to memory of 4356 3756 3E8F.tmp 106 PID 3756 wrote to memory of 4356 3756 3E8F.tmp 106 PID 4356 wrote to memory of 2260 4356 3EFD.tmp 107 PID 4356 wrote to memory of 2260 4356 3EFD.tmp 107 PID 4356 wrote to memory of 2260 4356 3EFD.tmp 107 PID 2260 wrote to memory of 3780 2260 3F4B.tmp 108 PID 2260 wrote to memory of 3780 2260 3F4B.tmp 108 PID 2260 wrote to memory of 3780 2260 3F4B.tmp 108 PID 3780 wrote to memory of 2556 3780 3FA9.tmp 109 PID 3780 wrote to memory of 2556 3780 3FA9.tmp 109 PID 3780 wrote to memory of 2556 3780 3FA9.tmp 109 PID 2556 wrote to memory of 2604 2556 4006.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-08_914b9c55d125f4f516230aa71c2fe370_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-08_914b9c55d125f4f516230aa71c2fe370_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\3846.tmp"C:\Users\Admin\AppData\Local\Temp\3846.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\38C3.tmp"C:\Users\Admin\AppData\Local\Temp\38C3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\3930.tmp"C:\Users\Admin\AppData\Local\Temp\3930.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\39BD.tmp"C:\Users\Admin\AppData\Local\Temp\39BD.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\3A79.tmp"C:\Users\Admin\AppData\Local\Temp\3A79.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\3B24.tmp"C:\Users\Admin\AppData\Local\Temp\3B24.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\3B92.tmp"C:\Users\Admin\AppData\Local\Temp\3B92.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\3D18.tmp"C:\Users\Admin\AppData\Local\Temp\3D18.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\3D67.tmp"C:\Users\Admin\AppData\Local\Temp\3D67.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\3E32.tmp"C:\Users\Admin\AppData\Local\Temp\3E32.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\4006.tmp"C:\Users\Admin\AppData\Local\Temp\4006.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\4074.tmp"C:\Users\Admin\AppData\Local\Temp\4074.tmp"23⤵
- Executes dropped EXE
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\40F1.tmp"C:\Users\Admin\AppData\Local\Temp\40F1.tmp"24⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\414F.tmp"C:\Users\Admin\AppData\Local\Temp\414F.tmp"25⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\41BC.tmp"C:\Users\Admin\AppData\Local\Temp\41BC.tmp"26⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\420A.tmp"C:\Users\Admin\AppData\Local\Temp\420A.tmp"27⤵
- Executes dropped EXE
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\4258.tmp"C:\Users\Admin\AppData\Local\Temp\4258.tmp"28⤵
- Executes dropped EXE
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\42B6.tmp"C:\Users\Admin\AppData\Local\Temp\42B6.tmp"29⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\4304.tmp"C:\Users\Admin\AppData\Local\Temp\4304.tmp"30⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"31⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"32⤵
- Executes dropped EXE
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"33⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"34⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"35⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"36⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"37⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\4602.tmp"C:\Users\Admin\AppData\Local\Temp\4602.tmp"38⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"39⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"40⤵
- Executes dropped EXE
PID:964 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"41⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"42⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"43⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"44⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"45⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"46⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"47⤵
- Executes dropped EXE
PID:536 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"48⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"49⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"50⤵
- Executes dropped EXE
PID:992 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"51⤵
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"52⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"53⤵
- Executes dropped EXE
PID:312 -
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"54⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"55⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"56⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"57⤵
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"58⤵
- Executes dropped EXE
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"59⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"60⤵
- Executes dropped EXE
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"61⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"62⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"63⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"64⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"65⤵
- Executes dropped EXE
PID:808 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"66⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"67⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"68⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"69⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"70⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"71⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"72⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"73⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"74⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"75⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"76⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"77⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"78⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"79⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"80⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"81⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"82⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"83⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"84⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"85⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"86⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"87⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"88⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"89⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"90⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"91⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"92⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"93⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"94⤵PID:660
-
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"95⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"96⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"97⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"98⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"99⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"100⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"101⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"102⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"103⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"104⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"105⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"106⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"107⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"108⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"109⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"110⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"111⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"112⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"113⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"114⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"115⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"116⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"117⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"118⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"119⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"120⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"121⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"122⤵PID:4648
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-