Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27/04/2024, 18:21
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-27_96707f62495cd668b69c1963ce2665f4_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-27_96707f62495cd668b69c1963ce2665f4_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-04-27_96707f62495cd668b69c1963ce2665f4_mafia.exe
-
Size
527KB
-
MD5
96707f62495cd668b69c1963ce2665f4
-
SHA1
7678747443dea1906c6eefc46d6248f6e64cc659
-
SHA256
07c903bfc27763f9c6ac5ccb491f4a50d2a18efc9c9a2306cf5480306c7f42d6
-
SHA512
3fbd29d923e9cda66b73c475c220480f06a29315408bf131ba8e4fd029d8bb370824e69451b82d02b85943456cc7f81322fead81365791469e377067bbcc3c4d
-
SSDEEP
12288:fU5rCOTeidP/ECnXgWES234Zez1GipKDZu:fUQOJdP6SQGezYIKDo
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5096 371D.tmp 2764 379A.tmp 3848 3808.tmp 3600 3875.tmp 748 38E2.tmp 4956 3940.tmp 1748 398E.tmp 3936 39DC.tmp 4392 3A2A.tmp 3692 3A79.tmp 4120 3AF6.tmp 3672 3B53.tmp 180 3BA1.tmp 232 3BFF.tmp 2300 3C5D.tmp 1604 3CBB.tmp 4356 3D18.tmp 1480 3D86.tmp 1572 3DD4.tmp 2096 3E22.tmp 2976 3E70.tmp 448 3ECE.tmp 2036 3F0C.tmp 4656 3F5B.tmp 3084 3FA9.tmp 4536 4006.tmp 4748 4055.tmp 3680 40C2.tmp 2308 4120.tmp 4944 418D.tmp 2560 41DB.tmp 1732 421A.tmp 1516 4268.tmp 4792 42D5.tmp 412 4323.tmp 116 4362.tmp 4040 43B0.tmp 4460 43FE.tmp 4364 444C.tmp 3948 449A.tmp 2200 44F8.tmp 1524 4556.tmp 3640 45B4.tmp 3280 4611.tmp 4132 466F.tmp 1744 46BD.tmp 2404 471B.tmp 776 4779.tmp 4204 47D6.tmp 4468 4825.tmp 2868 4873.tmp 4532 48C1.tmp 3860 490F.tmp 4500 495D.tmp 3296 49AB.tmp 4392 4A09.tmp 4032 4A57.tmp 1008 4AC4.tmp 3724 4B22.tmp 4552 4B70.tmp 216 4BBE.tmp 2808 4C0D.tmp 232 4C6A.tmp 3660 4CC8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1616 wrote to memory of 5096 1616 2024-04-27_96707f62495cd668b69c1963ce2665f4_mafia.exe 83 PID 1616 wrote to memory of 5096 1616 2024-04-27_96707f62495cd668b69c1963ce2665f4_mafia.exe 83 PID 1616 wrote to memory of 5096 1616 2024-04-27_96707f62495cd668b69c1963ce2665f4_mafia.exe 83 PID 5096 wrote to memory of 2764 5096 371D.tmp 84 PID 5096 wrote to memory of 2764 5096 371D.tmp 84 PID 5096 wrote to memory of 2764 5096 371D.tmp 84 PID 2764 wrote to memory of 3848 2764 379A.tmp 86 PID 2764 wrote to memory of 3848 2764 379A.tmp 86 PID 2764 wrote to memory of 3848 2764 379A.tmp 86 PID 3848 wrote to memory of 3600 3848 3808.tmp 87 PID 3848 wrote to memory of 3600 3848 3808.tmp 87 PID 3848 wrote to memory of 3600 3848 3808.tmp 87 PID 3600 wrote to memory of 748 3600 3875.tmp 88 PID 3600 wrote to memory of 748 3600 3875.tmp 88 PID 3600 wrote to memory of 748 3600 3875.tmp 88 PID 748 wrote to memory of 4956 748 38E2.tmp 89 PID 748 wrote to memory of 4956 748 38E2.tmp 89 PID 748 wrote to memory of 4956 748 38E2.tmp 89 PID 4956 wrote to memory of 1748 4956 3940.tmp 90 PID 4956 wrote to memory of 1748 4956 3940.tmp 90 PID 4956 wrote to memory of 1748 4956 3940.tmp 90 PID 1748 wrote to memory of 3936 1748 398E.tmp 91 PID 1748 wrote to memory of 3936 1748 398E.tmp 91 PID 1748 wrote to memory of 3936 1748 398E.tmp 91 PID 3936 wrote to memory of 4392 3936 39DC.tmp 92 PID 3936 wrote to memory of 4392 3936 39DC.tmp 92 PID 3936 wrote to memory of 4392 3936 39DC.tmp 92 PID 4392 wrote to memory of 3692 4392 3A2A.tmp 93 PID 4392 wrote to memory of 3692 4392 3A2A.tmp 93 PID 4392 wrote to memory of 3692 4392 3A2A.tmp 93 PID 3692 wrote to memory of 4120 3692 3A79.tmp 94 PID 3692 wrote to memory of 4120 3692 3A79.tmp 94 PID 3692 wrote to memory of 4120 3692 3A79.tmp 94 PID 4120 wrote to memory of 3672 4120 3AF6.tmp 95 PID 4120 wrote to memory of 3672 4120 3AF6.tmp 95 PID 4120 wrote to memory of 3672 4120 3AF6.tmp 95 PID 3672 wrote to memory of 180 3672 3B53.tmp 96 PID 3672 wrote to memory of 180 3672 3B53.tmp 96 PID 3672 wrote to memory of 180 3672 3B53.tmp 96 PID 180 wrote to memory of 232 180 3BA1.tmp 97 PID 180 wrote to memory of 232 180 3BA1.tmp 97 PID 180 wrote to memory of 232 180 3BA1.tmp 97 PID 232 wrote to memory of 2300 232 3BFF.tmp 98 PID 232 wrote to memory of 2300 232 3BFF.tmp 98 PID 232 wrote to memory of 2300 232 3BFF.tmp 98 PID 2300 wrote to memory of 1604 2300 3C5D.tmp 99 PID 2300 wrote to memory of 1604 2300 3C5D.tmp 99 PID 2300 wrote to memory of 1604 2300 3C5D.tmp 99 PID 1604 wrote to memory of 4356 1604 3CBB.tmp 100 PID 1604 wrote to memory of 4356 1604 3CBB.tmp 100 PID 1604 wrote to memory of 4356 1604 3CBB.tmp 100 PID 4356 wrote to memory of 1480 4356 3D18.tmp 101 PID 4356 wrote to memory of 1480 4356 3D18.tmp 101 PID 4356 wrote to memory of 1480 4356 3D18.tmp 101 PID 1480 wrote to memory of 1572 1480 3D86.tmp 102 PID 1480 wrote to memory of 1572 1480 3D86.tmp 102 PID 1480 wrote to memory of 1572 1480 3D86.tmp 102 PID 1572 wrote to memory of 2096 1572 3DD4.tmp 103 PID 1572 wrote to memory of 2096 1572 3DD4.tmp 103 PID 1572 wrote to memory of 2096 1572 3DD4.tmp 103 PID 2096 wrote to memory of 2976 2096 3E22.tmp 104 PID 2096 wrote to memory of 2976 2096 3E22.tmp 104 PID 2096 wrote to memory of 2976 2096 3E22.tmp 104 PID 2976 wrote to memory of 448 2976 3E70.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-27_96707f62495cd668b69c1963ce2665f4_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-27_96707f62495cd668b69c1963ce2665f4_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\371D.tmp"C:\Users\Admin\AppData\Local\Temp\371D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\379A.tmp"C:\Users\Admin\AppData\Local\Temp\379A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\3808.tmp"C:\Users\Admin\AppData\Local\Temp\3808.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\3875.tmp"C:\Users\Admin\AppData\Local\Temp\3875.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\38E2.tmp"C:\Users\Admin\AppData\Local\Temp\38E2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\3940.tmp"C:\Users\Admin\AppData\Local\Temp\3940.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\398E.tmp"C:\Users\Admin\AppData\Local\Temp\398E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\39DC.tmp"C:\Users\Admin\AppData\Local\Temp\39DC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\3A79.tmp"C:\Users\Admin\AppData\Local\Temp\3A79.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\3B53.tmp"C:\Users\Admin\AppData\Local\Temp\3B53.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:180 -
C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\3D18.tmp"C:\Users\Admin\AppData\Local\Temp\3D18.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\3D86.tmp"C:\Users\Admin\AppData\Local\Temp\3D86.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\3E22.tmp"C:\Users\Admin\AppData\Local\Temp\3E22.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\3E70.tmp"C:\Users\Admin\AppData\Local\Temp\3E70.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"23⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"24⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"25⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"26⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\4006.tmp"C:\Users\Admin\AppData\Local\Temp\4006.tmp"27⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\4055.tmp"C:\Users\Admin\AppData\Local\Temp\4055.tmp"28⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\40C2.tmp"C:\Users\Admin\AppData\Local\Temp\40C2.tmp"29⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\4120.tmp"C:\Users\Admin\AppData\Local\Temp\4120.tmp"30⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\418D.tmp"C:\Users\Admin\AppData\Local\Temp\418D.tmp"31⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\41DB.tmp"C:\Users\Admin\AppData\Local\Temp\41DB.tmp"32⤵
- Executes dropped EXE
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\421A.tmp"C:\Users\Admin\AppData\Local\Temp\421A.tmp"33⤵
- Executes dropped EXE
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\4268.tmp"C:\Users\Admin\AppData\Local\Temp\4268.tmp"34⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"35⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"36⤵
- Executes dropped EXE
PID:412 -
C:\Users\Admin\AppData\Local\Temp\4362.tmp"C:\Users\Admin\AppData\Local\Temp\4362.tmp"37⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\43B0.tmp"C:\Users\Admin\AppData\Local\Temp\43B0.tmp"38⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\43FE.tmp"C:\Users\Admin\AppData\Local\Temp\43FE.tmp"39⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"40⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"41⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"42⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"43⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"44⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"45⤵
- Executes dropped EXE
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"46⤵
- Executes dropped EXE
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"47⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"48⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"49⤵
- Executes dropped EXE
PID:776 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"50⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"51⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"52⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"53⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"54⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"55⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"56⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"57⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"58⤵
- Executes dropped EXE
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"59⤵
- Executes dropped EXE
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"60⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"61⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"62⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"63⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"64⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"65⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"66⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"67⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"68⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"69⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"70⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"71⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"72⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"73⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"74⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"75⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"76⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"77⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"78⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"79⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"80⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"81⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"82⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"83⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"84⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"85⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"86⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"87⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"88⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"89⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"90⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"91⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"92⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"93⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"94⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"95⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"96⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"97⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"98⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"99⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"100⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"101⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"102⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"103⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"104⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"105⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"106⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"107⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"108⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"109⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"110⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"111⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"112⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"113⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"114⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"115⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"116⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"117⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"118⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"119⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"120⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"121⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"122⤵PID:2152
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-