Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
22/04/2024, 21:44
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-22_4a2ba5a28ed61c086461ba8cf6f65fa8_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-04-22_4a2ba5a28ed61c086461ba8cf6f65fa8_mafia.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-22_4a2ba5a28ed61c086461ba8cf6f65fa8_mafia.exe
-
Size
486KB
-
MD5
4a2ba5a28ed61c086461ba8cf6f65fa8
-
SHA1
cbd587650a68d6fb991b4466979da907fbfa1c18
-
SHA256
bb5a26ad69413bc09c83fe533b42d0a02c2d48c077e7d802a7c44722d6adf175
-
SHA512
bef994cf2cf0ad36751757727e33254fd3277fe2f7234e872d4ce0b5b226236533fa2a3f1d3eeae91ed72e10ade6fb3c1198140cce26769b9269f4ad9036c212
-
SSDEEP
6144:Forf3lPvovsgZnqG2C7mOTeiLfD7himHD5dyoja9lIOUsUb7WcAnrJqb2FDbxTLa:UU5rCOTeiDsOHyt6Oe7Rb2F5sNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4540 6997.tmp 4548 6A04.tmp 4984 6A81.tmp 4380 6ADF.tmp 2440 6B4D.tmp 3280 6B9B.tmp 3880 6BE9.tmp 2764 6C37.tmp 4928 6C85.tmp 4724 6D02.tmp 3392 6D50.tmp 4476 6DAE.tmp 3384 6E1B.tmp 3320 6E89.tmp 2468 6EF6.tmp 924 6F54.tmp 1664 7109.tmp 3964 7186.tmp 4964 71F4.tmp 4624 7242.tmp 4792 72AF.tmp 3932 72FD.tmp 1000 734B.tmp 1096 73B9.tmp 4200 7426.tmp 3276 7484.tmp 2832 74D2.tmp 516 753F.tmp 864 758E.tmp 1752 75EB.tmp 4756 7639.tmp 2904 7688.tmp 3552 76D6.tmp 3592 7733.tmp 5092 7782.tmp 2944 77D0.tmp 4988 782D.tmp 2848 788B.tmp 3584 78E9.tmp 1864 7937.tmp 4924 7995.tmp 3648 79E3.tmp 624 7A31.tmp 432 7A7F.tmp 1292 7ACD.tmp 4928 7B2B.tmp 4724 7B79.tmp 4164 7BD7.tmp 2756 7C25.tmp 5068 7C83.tmp 4832 7CD1.tmp 4784 7D4E.tmp 4484 7D9C.tmp 4460 7DEA.tmp 3996 7E38.tmp 3012 7E96.tmp 2408 7EE4.tmp 4792 7F42.tmp 1892 7F90.tmp 1888 7FDE.tmp 3456 803C.tmp 2144 808A.tmp 2808 80E8.tmp 516 8146.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2912 wrote to memory of 4540 2912 2024-04-22_4a2ba5a28ed61c086461ba8cf6f65fa8_mafia.exe 88 PID 2912 wrote to memory of 4540 2912 2024-04-22_4a2ba5a28ed61c086461ba8cf6f65fa8_mafia.exe 88 PID 2912 wrote to memory of 4540 2912 2024-04-22_4a2ba5a28ed61c086461ba8cf6f65fa8_mafia.exe 88 PID 4540 wrote to memory of 4548 4540 6997.tmp 89 PID 4540 wrote to memory of 4548 4540 6997.tmp 89 PID 4540 wrote to memory of 4548 4540 6997.tmp 89 PID 4548 wrote to memory of 4984 4548 6A04.tmp 90 PID 4548 wrote to memory of 4984 4548 6A04.tmp 90 PID 4548 wrote to memory of 4984 4548 6A04.tmp 90 PID 4984 wrote to memory of 4380 4984 6A81.tmp 91 PID 4984 wrote to memory of 4380 4984 6A81.tmp 91 PID 4984 wrote to memory of 4380 4984 6A81.tmp 91 PID 4380 wrote to memory of 2440 4380 6ADF.tmp 93 PID 4380 wrote to memory of 2440 4380 6ADF.tmp 93 PID 4380 wrote to memory of 2440 4380 6ADF.tmp 93 PID 2440 wrote to memory of 3280 2440 6B4D.tmp 95 PID 2440 wrote to memory of 3280 2440 6B4D.tmp 95 PID 2440 wrote to memory of 3280 2440 6B4D.tmp 95 PID 3280 wrote to memory of 3880 3280 6B9B.tmp 96 PID 3280 wrote to memory of 3880 3280 6B9B.tmp 96 PID 3280 wrote to memory of 3880 3280 6B9B.tmp 96 PID 3880 wrote to memory of 2764 3880 6BE9.tmp 98 PID 3880 wrote to memory of 2764 3880 6BE9.tmp 98 PID 3880 wrote to memory of 2764 3880 6BE9.tmp 98 PID 2764 wrote to memory of 4928 2764 6C37.tmp 99 PID 2764 wrote to memory of 4928 2764 6C37.tmp 99 PID 2764 wrote to memory of 4928 2764 6C37.tmp 99 PID 4928 wrote to memory of 4724 4928 6C85.tmp 100 PID 4928 wrote to memory of 4724 4928 6C85.tmp 100 PID 4928 wrote to memory of 4724 4928 6C85.tmp 100 PID 4724 wrote to memory of 3392 4724 6D02.tmp 101 PID 4724 wrote to memory of 3392 4724 6D02.tmp 101 PID 4724 wrote to memory of 3392 4724 6D02.tmp 101 PID 3392 wrote to memory of 4476 3392 6D50.tmp 102 PID 3392 wrote to memory of 4476 3392 6D50.tmp 102 PID 3392 wrote to memory of 4476 3392 6D50.tmp 102 PID 4476 wrote to memory of 3384 4476 6DAE.tmp 103 PID 4476 wrote to memory of 3384 4476 6DAE.tmp 103 PID 4476 wrote to memory of 3384 4476 6DAE.tmp 103 PID 3384 wrote to memory of 3320 3384 6E1B.tmp 104 PID 3384 wrote to memory of 3320 3384 6E1B.tmp 104 PID 3384 wrote to memory of 3320 3384 6E1B.tmp 104 PID 3320 wrote to memory of 2468 3320 6E89.tmp 105 PID 3320 wrote to memory of 2468 3320 6E89.tmp 105 PID 3320 wrote to memory of 2468 3320 6E89.tmp 105 PID 2468 wrote to memory of 924 2468 6EF6.tmp 106 PID 2468 wrote to memory of 924 2468 6EF6.tmp 106 PID 2468 wrote to memory of 924 2468 6EF6.tmp 106 PID 924 wrote to memory of 1664 924 6F54.tmp 107 PID 924 wrote to memory of 1664 924 6F54.tmp 107 PID 924 wrote to memory of 1664 924 6F54.tmp 107 PID 1664 wrote to memory of 3964 1664 7109.tmp 108 PID 1664 wrote to memory of 3964 1664 7109.tmp 108 PID 1664 wrote to memory of 3964 1664 7109.tmp 108 PID 3964 wrote to memory of 4964 3964 7186.tmp 109 PID 3964 wrote to memory of 4964 3964 7186.tmp 109 PID 3964 wrote to memory of 4964 3964 7186.tmp 109 PID 4964 wrote to memory of 4624 4964 71F4.tmp 110 PID 4964 wrote to memory of 4624 4964 71F4.tmp 110 PID 4964 wrote to memory of 4624 4964 71F4.tmp 110 PID 4624 wrote to memory of 4792 4624 7242.tmp 111 PID 4624 wrote to memory of 4792 4624 7242.tmp 111 PID 4624 wrote to memory of 4792 4624 7242.tmp 111 PID 4792 wrote to memory of 3932 4792 72AF.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-22_4a2ba5a28ed61c086461ba8cf6f65fa8_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-22_4a2ba5a28ed61c086461ba8cf6f65fa8_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"23⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"24⤵
- Executes dropped EXE
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"25⤵
- Executes dropped EXE
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"26⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"27⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"28⤵
- Executes dropped EXE
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"29⤵
- Executes dropped EXE
PID:516 -
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"30⤵
- Executes dropped EXE
PID:864 -
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"31⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"32⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"33⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"34⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"35⤵
- Executes dropped EXE
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"36⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"37⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\782D.tmp"C:\Users\Admin\AppData\Local\Temp\782D.tmp"38⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\788B.tmp"C:\Users\Admin\AppData\Local\Temp\788B.tmp"39⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"40⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\7937.tmp"C:\Users\Admin\AppData\Local\Temp\7937.tmp"41⤵
- Executes dropped EXE
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\7995.tmp"C:\Users\Admin\AppData\Local\Temp\7995.tmp"42⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"43⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"44⤵
- Executes dropped EXE
PID:624 -
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"45⤵
- Executes dropped EXE
PID:432 -
C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"46⤵
- Executes dropped EXE
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"47⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\7B79.tmp"C:\Users\Admin\AppData\Local\Temp\7B79.tmp"48⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"49⤵
- Executes dropped EXE
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"50⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\7C83.tmp"C:\Users\Admin\AppData\Local\Temp\7C83.tmp"51⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"52⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"53⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"54⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"55⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\7E38.tmp"C:\Users\Admin\AppData\Local\Temp\7E38.tmp"56⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\7E96.tmp"C:\Users\Admin\AppData\Local\Temp\7E96.tmp"57⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"58⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\7F42.tmp"C:\Users\Admin\AppData\Local\Temp\7F42.tmp"59⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\7F90.tmp"C:\Users\Admin\AppData\Local\Temp\7F90.tmp"60⤵
- Executes dropped EXE
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"61⤵
- Executes dropped EXE
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\803C.tmp"C:\Users\Admin\AppData\Local\Temp\803C.tmp"62⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\808A.tmp"C:\Users\Admin\AppData\Local\Temp\808A.tmp"63⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\80E8.tmp"C:\Users\Admin\AppData\Local\Temp\80E8.tmp"64⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\8146.tmp"C:\Users\Admin\AppData\Local\Temp\8146.tmp"65⤵
- Executes dropped EXE
PID:516 -
C:\Users\Admin\AppData\Local\Temp\81A3.tmp"C:\Users\Admin\AppData\Local\Temp\81A3.tmp"66⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\81F1.tmp"C:\Users\Admin\AppData\Local\Temp\81F1.tmp"67⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\8240.tmp"C:\Users\Admin\AppData\Local\Temp\8240.tmp"68⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\828E.tmp"C:\Users\Admin\AppData\Local\Temp\828E.tmp"69⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\82EB.tmp"C:\Users\Admin\AppData\Local\Temp\82EB.tmp"70⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\8349.tmp"C:\Users\Admin\AppData\Local\Temp\8349.tmp"71⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\83A7.tmp"C:\Users\Admin\AppData\Local\Temp\83A7.tmp"72⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\8405.tmp"C:\Users\Admin\AppData\Local\Temp\8405.tmp"73⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\8453.tmp"C:\Users\Admin\AppData\Local\Temp\8453.tmp"74⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\84A1.tmp"C:\Users\Admin\AppData\Local\Temp\84A1.tmp"75⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\84FF.tmp"C:\Users\Admin\AppData\Local\Temp\84FF.tmp"76⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\854D.tmp"C:\Users\Admin\AppData\Local\Temp\854D.tmp"77⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\859B.tmp"C:\Users\Admin\AppData\Local\Temp\859B.tmp"78⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"79⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\8647.tmp"C:\Users\Admin\AppData\Local\Temp\8647.tmp"80⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\86A5.tmp"C:\Users\Admin\AppData\Local\Temp\86A5.tmp"81⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\8702.tmp"C:\Users\Admin\AppData\Local\Temp\8702.tmp"82⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\8760.tmp"C:\Users\Admin\AppData\Local\Temp\8760.tmp"83⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\87BE.tmp"C:\Users\Admin\AppData\Local\Temp\87BE.tmp"84⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\880C.tmp"C:\Users\Admin\AppData\Local\Temp\880C.tmp"85⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\886A.tmp"C:\Users\Admin\AppData\Local\Temp\886A.tmp"86⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\88C7.tmp"C:\Users\Admin\AppData\Local\Temp\88C7.tmp"87⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\8916.tmp"C:\Users\Admin\AppData\Local\Temp\8916.tmp"88⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\8964.tmp"C:\Users\Admin\AppData\Local\Temp\8964.tmp"89⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\89C1.tmp"C:\Users\Admin\AppData\Local\Temp\89C1.tmp"90⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\8A10.tmp"C:\Users\Admin\AppData\Local\Temp\8A10.tmp"91⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"92⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"93⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"94⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\8B58.tmp"C:\Users\Admin\AppData\Local\Temp\8B58.tmp"95⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"96⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\8C04.tmp"C:\Users\Admin\AppData\Local\Temp\8C04.tmp"97⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"98⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"99⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"100⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"101⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"102⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"103⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\8E55.tmp"C:\Users\Admin\AppData\Local\Temp\8E55.tmp"104⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"105⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"106⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"107⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"108⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\901A.tmp"C:\Users\Admin\AppData\Local\Temp\901A.tmp"109⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"110⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"111⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"112⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\9182.tmp"C:\Users\Admin\AppData\Local\Temp\9182.tmp"113⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\91E0.tmp"C:\Users\Admin\AppData\Local\Temp\91E0.tmp"114⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\922E.tmp"C:\Users\Admin\AppData\Local\Temp\922E.tmp"115⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\927C.tmp"C:\Users\Admin\AppData\Local\Temp\927C.tmp"116⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\92CA.tmp"C:\Users\Admin\AppData\Local\Temp\92CA.tmp"117⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"118⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\9366.tmp"C:\Users\Admin\AppData\Local\Temp\9366.tmp"119⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\93B4.tmp"C:\Users\Admin\AppData\Local\Temp\93B4.tmp"120⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\9402.tmp"C:\Users\Admin\AppData\Local\Temp\9402.tmp"121⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\9451.tmp"C:\Users\Admin\AppData\Local\Temp\9451.tmp"122⤵PID:4692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-