Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2024, 14:01
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-05_154f8ef84ce430887eaa45f62fa87f1d_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-05_154f8ef84ce430887eaa45f62fa87f1d_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-05_154f8ef84ce430887eaa45f62fa87f1d_mafia.exe
-
Size
520KB
-
MD5
154f8ef84ce430887eaa45f62fa87f1d
-
SHA1
92f0ff3f04460c821c337309470ddb11cb3ebf33
-
SHA256
cac75e0af9ac55db1344b261962b7a809f269b17c75f94513f636f4c1f73546f
-
SHA512
52475970f8d37c81bc45b5ea203cdd7fd95e1203da6a3c41af2eff07cb27bce75a0047c606334178e034c65e234894339cdb9c7806c7517925302258af41a4f6
-
SSDEEP
12288:roRXOQjmOyw9k9ogtTzHtIFp9zg3UfcpVv8aEf7MgNZ:rogQ9yB9ogBYgEEp18pMgN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4112 3C5D.tmp 4032 3CDA.tmp 1276 3D47.tmp 1920 3DB5.tmp 1800 3E12.tmp 1988 3E80.tmp 3172 3ECE.tmp 5032 3F2C.tmp 2228 3F89.tmp 3728 3FE7.tmp 1536 4055.tmp 4916 40C2.tmp 3420 4110.tmp 4440 417D.tmp 3236 41EB.tmp 3024 4249.tmp 1932 4297.tmp 2460 42F4.tmp 3964 4362.tmp 4960 43C0.tmp 3732 441D.tmp 3316 447B.tmp 4356 44D9.tmp 3740 4527.tmp 4236 4585.tmp 4588 45F2.tmp 3372 465F.tmp 4116 46CD.tmp 2924 474A.tmp 3720 47B7.tmp 5016 4815.tmp 220 4873.tmp 1232 48C1.tmp 3552 490F.tmp 5088 49AB.tmp 4644 49F9.tmp 5076 4A47.tmp 1800 4AA5.tmp 5080 4B13.tmp 988 4B61.tmp 3172 4BAF.tmp 5032 4BFD.tmp 3924 4C5B.tmp 2884 4CA9.tmp 5012 4D07.tmp 3916 4D55.tmp 4568 4DA3.tmp 388 4E01.tmp 2068 4E5E.tmp 4836 4EAC.tmp 2156 4F0A.tmp 2140 4F58.tmp 752 4FB6.tmp 3308 5014.tmp 1932 5062.tmp 2168 50B0.tmp 4552 510E.tmp 4028 516C.tmp 4960 51C9.tmp 744 5227.tmp 2704 5275.tmp 4652 52D3.tmp 3272 5331.tmp 3740 538E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4296 wrote to memory of 4112 4296 2024-05-05_154f8ef84ce430887eaa45f62fa87f1d_mafia.exe 83 PID 4296 wrote to memory of 4112 4296 2024-05-05_154f8ef84ce430887eaa45f62fa87f1d_mafia.exe 83 PID 4296 wrote to memory of 4112 4296 2024-05-05_154f8ef84ce430887eaa45f62fa87f1d_mafia.exe 83 PID 4112 wrote to memory of 4032 4112 3C5D.tmp 84 PID 4112 wrote to memory of 4032 4112 3C5D.tmp 84 PID 4112 wrote to memory of 4032 4112 3C5D.tmp 84 PID 4032 wrote to memory of 1276 4032 3CDA.tmp 85 PID 4032 wrote to memory of 1276 4032 3CDA.tmp 85 PID 4032 wrote to memory of 1276 4032 3CDA.tmp 85 PID 1276 wrote to memory of 1920 1276 3D47.tmp 87 PID 1276 wrote to memory of 1920 1276 3D47.tmp 87 PID 1276 wrote to memory of 1920 1276 3D47.tmp 87 PID 1920 wrote to memory of 1800 1920 3DB5.tmp 89 PID 1920 wrote to memory of 1800 1920 3DB5.tmp 89 PID 1920 wrote to memory of 1800 1920 3DB5.tmp 89 PID 1800 wrote to memory of 1988 1800 3E12.tmp 91 PID 1800 wrote to memory of 1988 1800 3E12.tmp 91 PID 1800 wrote to memory of 1988 1800 3E12.tmp 91 PID 1988 wrote to memory of 3172 1988 3E80.tmp 92 PID 1988 wrote to memory of 3172 1988 3E80.tmp 92 PID 1988 wrote to memory of 3172 1988 3E80.tmp 92 PID 3172 wrote to memory of 5032 3172 3ECE.tmp 93 PID 3172 wrote to memory of 5032 3172 3ECE.tmp 93 PID 3172 wrote to memory of 5032 3172 3ECE.tmp 93 PID 5032 wrote to memory of 2228 5032 3F2C.tmp 94 PID 5032 wrote to memory of 2228 5032 3F2C.tmp 94 PID 5032 wrote to memory of 2228 5032 3F2C.tmp 94 PID 2228 wrote to memory of 3728 2228 3F89.tmp 95 PID 2228 wrote to memory of 3728 2228 3F89.tmp 95 PID 2228 wrote to memory of 3728 2228 3F89.tmp 95 PID 3728 wrote to memory of 1536 3728 3FE7.tmp 96 PID 3728 wrote to memory of 1536 3728 3FE7.tmp 96 PID 3728 wrote to memory of 1536 3728 3FE7.tmp 96 PID 1536 wrote to memory of 4916 1536 4055.tmp 97 PID 1536 wrote to memory of 4916 1536 4055.tmp 97 PID 1536 wrote to memory of 4916 1536 4055.tmp 97 PID 4916 wrote to memory of 3420 4916 40C2.tmp 98 PID 4916 wrote to memory of 3420 4916 40C2.tmp 98 PID 4916 wrote to memory of 3420 4916 40C2.tmp 98 PID 3420 wrote to memory of 4440 3420 4110.tmp 99 PID 3420 wrote to memory of 4440 3420 4110.tmp 99 PID 3420 wrote to memory of 4440 3420 4110.tmp 99 PID 4440 wrote to memory of 3236 4440 417D.tmp 100 PID 4440 wrote to memory of 3236 4440 417D.tmp 100 PID 4440 wrote to memory of 3236 4440 417D.tmp 100 PID 3236 wrote to memory of 3024 3236 41EB.tmp 101 PID 3236 wrote to memory of 3024 3236 41EB.tmp 101 PID 3236 wrote to memory of 3024 3236 41EB.tmp 101 PID 3024 wrote to memory of 1932 3024 4249.tmp 102 PID 3024 wrote to memory of 1932 3024 4249.tmp 102 PID 3024 wrote to memory of 1932 3024 4249.tmp 102 PID 1932 wrote to memory of 2460 1932 4297.tmp 103 PID 1932 wrote to memory of 2460 1932 4297.tmp 103 PID 1932 wrote to memory of 2460 1932 4297.tmp 103 PID 2460 wrote to memory of 3964 2460 42F4.tmp 104 PID 2460 wrote to memory of 3964 2460 42F4.tmp 104 PID 2460 wrote to memory of 3964 2460 42F4.tmp 104 PID 3964 wrote to memory of 4960 3964 4362.tmp 105 PID 3964 wrote to memory of 4960 3964 4362.tmp 105 PID 3964 wrote to memory of 4960 3964 4362.tmp 105 PID 4960 wrote to memory of 3732 4960 43C0.tmp 106 PID 4960 wrote to memory of 3732 4960 43C0.tmp 106 PID 4960 wrote to memory of 3732 4960 43C0.tmp 106 PID 3732 wrote to memory of 3316 3732 441D.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-05_154f8ef84ce430887eaa45f62fa87f1d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-05_154f8ef84ce430887eaa45f62fa87f1d_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\3D47.tmp"C:\Users\Admin\AppData\Local\Temp\3D47.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\3E12.tmp"C:\Users\Admin\AppData\Local\Temp\3E12.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\3E80.tmp"C:\Users\Admin\AppData\Local\Temp\3E80.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\3F89.tmp"C:\Users\Admin\AppData\Local\Temp\3F89.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\4055.tmp"C:\Users\Admin\AppData\Local\Temp\4055.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\40C2.tmp"C:\Users\Admin\AppData\Local\Temp\40C2.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\4110.tmp"C:\Users\Admin\AppData\Local\Temp\4110.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\41EB.tmp"C:\Users\Admin\AppData\Local\Temp\41EB.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\42F4.tmp"C:\Users\Admin\AppData\Local\Temp\42F4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\4362.tmp"C:\Users\Admin\AppData\Local\Temp\4362.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\43C0.tmp"C:\Users\Admin\AppData\Local\Temp\43C0.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\441D.tmp"C:\Users\Admin\AppData\Local\Temp\441D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\447B.tmp"C:\Users\Admin\AppData\Local\Temp\447B.tmp"23⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"24⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"25⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"26⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\45F2.tmp"C:\Users\Admin\AppData\Local\Temp\45F2.tmp"27⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"28⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"29⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"30⤵
- Executes dropped EXE
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"31⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"32⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"33⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"34⤵
- Executes dropped EXE
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"35⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"36⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"37⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"38⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"39⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"40⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"41⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"42⤵
- Executes dropped EXE
PID:988 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"43⤵
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"44⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"45⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"46⤵
- Executes dropped EXE
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"47⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"48⤵
- Executes dropped EXE
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"49⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"50⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"51⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"52⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"53⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"54⤵
- Executes dropped EXE
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"55⤵
- Executes dropped EXE
PID:752 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"56⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"57⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"58⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"59⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"60⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"61⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"62⤵
- Executes dropped EXE
PID:744 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"63⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"64⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"65⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"66⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"67⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"68⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"69⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"70⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"71⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"72⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"73⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"74⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"75⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"76⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"77⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"78⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"79⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"80⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"81⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"82⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"83⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"84⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"85⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"86⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"87⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"88⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"89⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"90⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"91⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"92⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"93⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"94⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"95⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"96⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"97⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"98⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"99⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"100⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"101⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"102⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"103⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"104⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"105⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"106⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"107⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"108⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"109⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"110⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"111⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"112⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"113⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"114⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"115⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"116⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"117⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"118⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"119⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"120⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"121⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"122⤵PID:624
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-