Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22/05/2024, 18:04
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-22_55c8461a0b2b7f76aab683f68512ff4b_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-22_55c8461a0b2b7f76aab683f68512ff4b_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-22_55c8461a0b2b7f76aab683f68512ff4b_mafia.exe
-
Size
520KB
-
MD5
55c8461a0b2b7f76aab683f68512ff4b
-
SHA1
8bd5f2a08a10940bc53fe9d38c2d4fbf836aaeb3
-
SHA256
4eb9d2b79fc52b5511aeaccee1dfb16b60c544d9a0ded454f510ff300169e603
-
SHA512
1a3452bfba88cfc0c62bcfc5e911b9aa814e113d61cf398f64127c524c17b7de0213892844718eac7ba2dbc7b097db32274436f53ad62e94689a8a20071eab63
-
SSDEEP
12288:roRXOQjmOyqlc1L8dEAdYCDCXQD1m8zL8fuuXNZ:rogQ9yDL8dE+YONR82uXN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1680 7A9E.tmp 4160 7B0C.tmp 4424 7B6A.tmp 2380 7BF6.tmp 2848 7C73.tmp 3952 7CF0.tmp 4184 7D5E.tmp 880 7DAC.tmp 3916 7E19.tmp 1996 7E77.tmp 3104 7EE4.tmp 1716 7F42.tmp 1104 7FAF.tmp 2444 7FFD.tmp 848 807A.tmp 2040 80C9.tmp 4948 8117.tmp 740 8184.tmp 4900 81D2.tmp 3884 824F.tmp 2368 82AD.tmp 1888 831A.tmp 4196 8397.tmp 3988 83F5.tmp 3740 8443.tmp 1844 84A1.tmp 448 850E.tmp 2716 856C.tmp 4016 85E9.tmp 64 8666.tmp 5080 86B4.tmp 2448 8722.tmp 1284 878F.tmp 5092 87ED.tmp 2016 883B.tmp 2892 8899.tmp 1936 88F6.tmp 4856 8A9C.tmp 2520 8AEA.tmp 2488 8B38.tmp 2032 8B87.tmp 2292 8BD5.tmp 2284 8C32.tmp 2984 8C90.tmp 4924 8CEE.tmp 4872 8D4C.tmp 1532 8DA9.tmp 1232 8E07.tmp 4360 8E65.tmp 4412 8EB3.tmp 5024 8F01.tmp 2924 8F5F.tmp 1448 8FBD.tmp 4996 901A.tmp 1184 9069.tmp 1456 90C6.tmp 4548 9124.tmp 3032 9182.tmp 3016 91D0.tmp 5044 921E.tmp 3752 926C.tmp 2216 92CA.tmp 2440 9328.tmp 4768 9385.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3308 wrote to memory of 1680 3308 2024-05-22_55c8461a0b2b7f76aab683f68512ff4b_mafia.exe 85 PID 3308 wrote to memory of 1680 3308 2024-05-22_55c8461a0b2b7f76aab683f68512ff4b_mafia.exe 85 PID 3308 wrote to memory of 1680 3308 2024-05-22_55c8461a0b2b7f76aab683f68512ff4b_mafia.exe 85 PID 1680 wrote to memory of 4160 1680 7A9E.tmp 86 PID 1680 wrote to memory of 4160 1680 7A9E.tmp 86 PID 1680 wrote to memory of 4160 1680 7A9E.tmp 86 PID 4160 wrote to memory of 4424 4160 7B0C.tmp 87 PID 4160 wrote to memory of 4424 4160 7B0C.tmp 87 PID 4160 wrote to memory of 4424 4160 7B0C.tmp 87 PID 4424 wrote to memory of 2380 4424 7B6A.tmp 89 PID 4424 wrote to memory of 2380 4424 7B6A.tmp 89 PID 4424 wrote to memory of 2380 4424 7B6A.tmp 89 PID 2380 wrote to memory of 2848 2380 7BF6.tmp 91 PID 2380 wrote to memory of 2848 2380 7BF6.tmp 91 PID 2380 wrote to memory of 2848 2380 7BF6.tmp 91 PID 2848 wrote to memory of 3952 2848 7C73.tmp 93 PID 2848 wrote to memory of 3952 2848 7C73.tmp 93 PID 2848 wrote to memory of 3952 2848 7C73.tmp 93 PID 3952 wrote to memory of 4184 3952 7CF0.tmp 94 PID 3952 wrote to memory of 4184 3952 7CF0.tmp 94 PID 3952 wrote to memory of 4184 3952 7CF0.tmp 94 PID 4184 wrote to memory of 880 4184 7D5E.tmp 95 PID 4184 wrote to memory of 880 4184 7D5E.tmp 95 PID 4184 wrote to memory of 880 4184 7D5E.tmp 95 PID 880 wrote to memory of 3916 880 7DAC.tmp 96 PID 880 wrote to memory of 3916 880 7DAC.tmp 96 PID 880 wrote to memory of 3916 880 7DAC.tmp 96 PID 3916 wrote to memory of 1996 3916 7E19.tmp 97 PID 3916 wrote to memory of 1996 3916 7E19.tmp 97 PID 3916 wrote to memory of 1996 3916 7E19.tmp 97 PID 1996 wrote to memory of 3104 1996 7E77.tmp 98 PID 1996 wrote to memory of 3104 1996 7E77.tmp 98 PID 1996 wrote to memory of 3104 1996 7E77.tmp 98 PID 3104 wrote to memory of 1716 3104 7EE4.tmp 99 PID 3104 wrote to memory of 1716 3104 7EE4.tmp 99 PID 3104 wrote to memory of 1716 3104 7EE4.tmp 99 PID 1716 wrote to memory of 1104 1716 7F42.tmp 100 PID 1716 wrote to memory of 1104 1716 7F42.tmp 100 PID 1716 wrote to memory of 1104 1716 7F42.tmp 100 PID 1104 wrote to memory of 2444 1104 7FAF.tmp 101 PID 1104 wrote to memory of 2444 1104 7FAF.tmp 101 PID 1104 wrote to memory of 2444 1104 7FAF.tmp 101 PID 2444 wrote to memory of 848 2444 7FFD.tmp 102 PID 2444 wrote to memory of 848 2444 7FFD.tmp 102 PID 2444 wrote to memory of 848 2444 7FFD.tmp 102 PID 848 wrote to memory of 2040 848 807A.tmp 103 PID 848 wrote to memory of 2040 848 807A.tmp 103 PID 848 wrote to memory of 2040 848 807A.tmp 103 PID 2040 wrote to memory of 4948 2040 80C9.tmp 104 PID 2040 wrote to memory of 4948 2040 80C9.tmp 104 PID 2040 wrote to memory of 4948 2040 80C9.tmp 104 PID 4948 wrote to memory of 740 4948 8117.tmp 105 PID 4948 wrote to memory of 740 4948 8117.tmp 105 PID 4948 wrote to memory of 740 4948 8117.tmp 105 PID 740 wrote to memory of 4900 740 8184.tmp 106 PID 740 wrote to memory of 4900 740 8184.tmp 106 PID 740 wrote to memory of 4900 740 8184.tmp 106 PID 4900 wrote to memory of 3884 4900 81D2.tmp 107 PID 4900 wrote to memory of 3884 4900 81D2.tmp 107 PID 4900 wrote to memory of 3884 4900 81D2.tmp 107 PID 3884 wrote to memory of 2368 3884 824F.tmp 108 PID 3884 wrote to memory of 2368 3884 824F.tmp 108 PID 3884 wrote to memory of 2368 3884 824F.tmp 108 PID 2368 wrote to memory of 1888 2368 82AD.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_55c8461a0b2b7f76aab683f68512ff4b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_55c8461a0b2b7f76aab683f68512ff4b_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\7C73.tmp"C:\Users\Admin\AppData\Local\Temp\7C73.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\7E77.tmp"C:\Users\Admin\AppData\Local\Temp\7E77.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\7F42.tmp"C:\Users\Admin\AppData\Local\Temp\7F42.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\807A.tmp"C:\Users\Admin\AppData\Local\Temp\807A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\80C9.tmp"C:\Users\Admin\AppData\Local\Temp\80C9.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\8117.tmp"C:\Users\Admin\AppData\Local\Temp\8117.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\8184.tmp"C:\Users\Admin\AppData\Local\Temp\8184.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\81D2.tmp"C:\Users\Admin\AppData\Local\Temp\81D2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\824F.tmp"C:\Users\Admin\AppData\Local\Temp\824F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\82AD.tmp"C:\Users\Admin\AppData\Local\Temp\82AD.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"23⤵
- Executes dropped EXE
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"24⤵
- Executes dropped EXE
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\83F5.tmp"C:\Users\Admin\AppData\Local\Temp\83F5.tmp"25⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"26⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\84A1.tmp"C:\Users\Admin\AppData\Local\Temp\84A1.tmp"27⤵
- Executes dropped EXE
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\850E.tmp"C:\Users\Admin\AppData\Local\Temp\850E.tmp"28⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\856C.tmp"C:\Users\Admin\AppData\Local\Temp\856C.tmp"29⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"30⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\8666.tmp"C:\Users\Admin\AppData\Local\Temp\8666.tmp"31⤵
- Executes dropped EXE
PID:64 -
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"32⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\8722.tmp"C:\Users\Admin\AppData\Local\Temp\8722.tmp"33⤵
- Executes dropped EXE
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\878F.tmp"C:\Users\Admin\AppData\Local\Temp\878F.tmp"34⤵
- Executes dropped EXE
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"35⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\883B.tmp"C:\Users\Admin\AppData\Local\Temp\883B.tmp"36⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\8899.tmp"C:\Users\Admin\AppData\Local\Temp\8899.tmp"37⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\88F6.tmp"C:\Users\Admin\AppData\Local\Temp\88F6.tmp"38⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"39⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"40⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\8B38.tmp"C:\Users\Admin\AppData\Local\Temp\8B38.tmp"41⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\8B87.tmp"C:\Users\Admin\AppData\Local\Temp\8B87.tmp"42⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"43⤵
- Executes dropped EXE
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\8C32.tmp"C:\Users\Admin\AppData\Local\Temp\8C32.tmp"44⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"45⤵
- Executes dropped EXE
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"46⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"47⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"48⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\8E07.tmp"C:\Users\Admin\AppData\Local\Temp\8E07.tmp"49⤵
- Executes dropped EXE
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"50⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"51⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\8F01.tmp"C:\Users\Admin\AppData\Local\Temp\8F01.tmp"52⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"53⤵
- Executes dropped EXE
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"54⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\901A.tmp"C:\Users\Admin\AppData\Local\Temp\901A.tmp"55⤵
- Executes dropped EXE
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"56⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"57⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"58⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\9182.tmp"C:\Users\Admin\AppData\Local\Temp\9182.tmp"59⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\91D0.tmp"C:\Users\Admin\AppData\Local\Temp\91D0.tmp"60⤵
- Executes dropped EXE
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\921E.tmp"C:\Users\Admin\AppData\Local\Temp\921E.tmp"61⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\926C.tmp"C:\Users\Admin\AppData\Local\Temp\926C.tmp"62⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\92CA.tmp"C:\Users\Admin\AppData\Local\Temp\92CA.tmp"63⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\9328.tmp"C:\Users\Admin\AppData\Local\Temp\9328.tmp"64⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\9385.tmp"C:\Users\Admin\AppData\Local\Temp\9385.tmp"65⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"66⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\9422.tmp"C:\Users\Admin\AppData\Local\Temp\9422.tmp"67⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\947F.tmp"C:\Users\Admin\AppData\Local\Temp\947F.tmp"68⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\94CE.tmp"C:\Users\Admin\AppData\Local\Temp\94CE.tmp"69⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"70⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"71⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\95D7.tmp"C:\Users\Admin\AppData\Local\Temp\95D7.tmp"72⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\9625.tmp"C:\Users\Admin\AppData\Local\Temp\9625.tmp"73⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"74⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\96D1.tmp"C:\Users\Admin\AppData\Local\Temp\96D1.tmp"75⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\972F.tmp"C:\Users\Admin\AppData\Local\Temp\972F.tmp"76⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\978D.tmp"C:\Users\Admin\AppData\Local\Temp\978D.tmp"77⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\97EA.tmp"C:\Users\Admin\AppData\Local\Temp\97EA.tmp"78⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\9839.tmp"C:\Users\Admin\AppData\Local\Temp\9839.tmp"79⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\98B6.tmp"C:\Users\Admin\AppData\Local\Temp\98B6.tmp"80⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"81⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"82⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"83⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"84⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"85⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"86⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"87⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"88⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"89⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\9C21.tmp"C:\Users\Admin\AppData\Local\Temp\9C21.tmp"90⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"91⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"92⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"93⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\9D69.tmp"C:\Users\Admin\AppData\Local\Temp\9D69.tmp"94⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"95⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\9E15.tmp"C:\Users\Admin\AppData\Local\Temp\9E15.tmp"96⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\9E72.tmp"C:\Users\Admin\AppData\Local\Temp\9E72.tmp"97⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"98⤵PID:100
-
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"99⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"100⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"101⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"102⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\A076.tmp"C:\Users\Admin\AppData\Local\Temp\A076.tmp"103⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"104⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"105⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"106⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"107⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\A21C.tmp"C:\Users\Admin\AppData\Local\Temp\A21C.tmp"108⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\A26A.tmp"C:\Users\Admin\AppData\Local\Temp\A26A.tmp"109⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"110⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\A306.tmp"C:\Users\Admin\AppData\Local\Temp\A306.tmp"111⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\A354.tmp"C:\Users\Admin\AppData\Local\Temp\A354.tmp"112⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"113⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"114⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"115⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"116⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"117⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\A539.tmp"C:\Users\Admin\AppData\Local\Temp\A539.tmp"118⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"119⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"120⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\A642.tmp"C:\Users\Admin\AppData\Local\Temp\A642.tmp"121⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"122⤵PID:4100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-