Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 20:10
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-02_7a61e92381c5be38c513c975de8472b9_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-02_7a61e92381c5be38c513c975de8472b9_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-06-02_7a61e92381c5be38c513c975de8472b9_mafia.exe
-
Size
487KB
-
MD5
7a61e92381c5be38c513c975de8472b9
-
SHA1
5bafee1da3fe11fe808fda866e6bafd19e3fb496
-
SHA256
337671a4885abc2dc1488f5b05cc46b445ff40244c4af59dd1857d4fbfbb0025
-
SHA512
1bef05a1aa2ee5fd149e50cb0a67d9394ba727628b7d276c0acfed99a44e0f45eef05d721e0e8430ff2c473d9f4e95aa07651a6150d4ce1dd45ba083659f09c7
-
SSDEEP
6144:qorf3lPvovsgZnqG2C7mOTeiL9DUvY1nNsn0mIDmdLsfUdMYmwWEmfY1G65j8GaF:HU5rCOTeiJXZFmytYmKwY8EwxDvTdNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4356 3299.tmp 464 3306.tmp 3956 3374.tmp 1480 342F.tmp 2208 348D.tmp 1340 34FA.tmp 3032 3568.tmp 2188 35C5.tmp 4800 3633.tmp 4736 3691.tmp 1408 370E.tmp 2924 375C.tmp 796 37B9.tmp 544 3808.tmp 2660 3856.tmp 3576 38D3.tmp 3108 3950.tmp 4076 39AD.tmp 2136 39FC.tmp 1152 3A59.tmp 4332 3AD6.tmp 4036 3B44.tmp 1444 3BB1.tmp 664 3C1E.tmp 4556 3C9B.tmp 1548 3D18.tmp 1676 3D86.tmp 4796 3DF3.tmp 1724 3E61.tmp 5012 4016.tmp 2376 4074.tmp 1856 40E1.tmp 1036 415E.tmp 3320 41AC.tmp 4456 41FA.tmp 540 4249.tmp 4932 4297.tmp 1632 42E5.tmp 4872 4343.tmp 4860 43A0.tmp 404 43EE.tmp 1884 445C.tmp 1388 44AA.tmp 556 44F8.tmp 3948 4556.tmp 2884 45B4.tmp 4144 4611.tmp 1980 466F.tmp 5068 46BD.tmp 3956 471B.tmp 4788 4779.tmp 4580 47D6.tmp 4760 4834.tmp 3044 4892.tmp 2436 48F0.tmp 652 494D.tmp 4528 49AB.tmp 3236 4A09.tmp 1680 4A67.tmp 2020 4AC4.tmp 1964 4B13.tmp 4440 4B70.tmp 3752 4BCE.tmp 4024 4C1C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2796 wrote to memory of 4356 2796 2024-06-02_7a61e92381c5be38c513c975de8472b9_mafia.exe 83 PID 2796 wrote to memory of 4356 2796 2024-06-02_7a61e92381c5be38c513c975de8472b9_mafia.exe 83 PID 2796 wrote to memory of 4356 2796 2024-06-02_7a61e92381c5be38c513c975de8472b9_mafia.exe 83 PID 4356 wrote to memory of 464 4356 3299.tmp 85 PID 4356 wrote to memory of 464 4356 3299.tmp 85 PID 4356 wrote to memory of 464 4356 3299.tmp 85 PID 464 wrote to memory of 3956 464 3306.tmp 86 PID 464 wrote to memory of 3956 464 3306.tmp 86 PID 464 wrote to memory of 3956 464 3306.tmp 86 PID 3956 wrote to memory of 1480 3956 3374.tmp 87 PID 3956 wrote to memory of 1480 3956 3374.tmp 87 PID 3956 wrote to memory of 1480 3956 3374.tmp 87 PID 1480 wrote to memory of 2208 1480 342F.tmp 89 PID 1480 wrote to memory of 2208 1480 342F.tmp 89 PID 1480 wrote to memory of 2208 1480 342F.tmp 89 PID 2208 wrote to memory of 1340 2208 348D.tmp 90 PID 2208 wrote to memory of 1340 2208 348D.tmp 90 PID 2208 wrote to memory of 1340 2208 348D.tmp 90 PID 1340 wrote to memory of 3032 1340 34FA.tmp 91 PID 1340 wrote to memory of 3032 1340 34FA.tmp 91 PID 1340 wrote to memory of 3032 1340 34FA.tmp 91 PID 3032 wrote to memory of 2188 3032 3568.tmp 92 PID 3032 wrote to memory of 2188 3032 3568.tmp 92 PID 3032 wrote to memory of 2188 3032 3568.tmp 92 PID 2188 wrote to memory of 4800 2188 35C5.tmp 93 PID 2188 wrote to memory of 4800 2188 35C5.tmp 93 PID 2188 wrote to memory of 4800 2188 35C5.tmp 93 PID 4800 wrote to memory of 4736 4800 3633.tmp 94 PID 4800 wrote to memory of 4736 4800 3633.tmp 94 PID 4800 wrote to memory of 4736 4800 3633.tmp 94 PID 4736 wrote to memory of 1408 4736 3691.tmp 95 PID 4736 wrote to memory of 1408 4736 3691.tmp 95 PID 4736 wrote to memory of 1408 4736 3691.tmp 95 PID 1408 wrote to memory of 2924 1408 370E.tmp 96 PID 1408 wrote to memory of 2924 1408 370E.tmp 96 PID 1408 wrote to memory of 2924 1408 370E.tmp 96 PID 2924 wrote to memory of 796 2924 375C.tmp 97 PID 2924 wrote to memory of 796 2924 375C.tmp 97 PID 2924 wrote to memory of 796 2924 375C.tmp 97 PID 796 wrote to memory of 544 796 37B9.tmp 98 PID 796 wrote to memory of 544 796 37B9.tmp 98 PID 796 wrote to memory of 544 796 37B9.tmp 98 PID 544 wrote to memory of 2660 544 3808.tmp 99 PID 544 wrote to memory of 2660 544 3808.tmp 99 PID 544 wrote to memory of 2660 544 3808.tmp 99 PID 2660 wrote to memory of 3576 2660 3856.tmp 100 PID 2660 wrote to memory of 3576 2660 3856.tmp 100 PID 2660 wrote to memory of 3576 2660 3856.tmp 100 PID 3576 wrote to memory of 3108 3576 38D3.tmp 101 PID 3576 wrote to memory of 3108 3576 38D3.tmp 101 PID 3576 wrote to memory of 3108 3576 38D3.tmp 101 PID 3108 wrote to memory of 4076 3108 3950.tmp 102 PID 3108 wrote to memory of 4076 3108 3950.tmp 102 PID 3108 wrote to memory of 4076 3108 3950.tmp 102 PID 4076 wrote to memory of 2136 4076 39AD.tmp 103 PID 4076 wrote to memory of 2136 4076 39AD.tmp 103 PID 4076 wrote to memory of 2136 4076 39AD.tmp 103 PID 2136 wrote to memory of 1152 2136 39FC.tmp 104 PID 2136 wrote to memory of 1152 2136 39FC.tmp 104 PID 2136 wrote to memory of 1152 2136 39FC.tmp 104 PID 1152 wrote to memory of 4332 1152 3A59.tmp 105 PID 1152 wrote to memory of 4332 1152 3A59.tmp 105 PID 1152 wrote to memory of 4332 1152 3A59.tmp 105 PID 4332 wrote to memory of 4036 4332 3AD6.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-02_7a61e92381c5be38c513c975de8472b9_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-02_7a61e92381c5be38c513c975de8472b9_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\3299.tmp"C:\Users\Admin\AppData\Local\Temp\3299.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\3306.tmp"C:\Users\Admin\AppData\Local\Temp\3306.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\3374.tmp"C:\Users\Admin\AppData\Local\Temp\3374.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\342F.tmp"C:\Users\Admin\AppData\Local\Temp\342F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\348D.tmp"C:\Users\Admin\AppData\Local\Temp\348D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\34FA.tmp"C:\Users\Admin\AppData\Local\Temp\34FA.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\3568.tmp"C:\Users\Admin\AppData\Local\Temp\3568.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\35C5.tmp"C:\Users\Admin\AppData\Local\Temp\35C5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\3633.tmp"C:\Users\Admin\AppData\Local\Temp\3633.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\3691.tmp"C:\Users\Admin\AppData\Local\Temp\3691.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\370E.tmp"C:\Users\Admin\AppData\Local\Temp\370E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\375C.tmp"C:\Users\Admin\AppData\Local\Temp\375C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\37B9.tmp"C:\Users\Admin\AppData\Local\Temp\37B9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\3808.tmp"C:\Users\Admin\AppData\Local\Temp\3808.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Users\Admin\AppData\Local\Temp\3856.tmp"C:\Users\Admin\AppData\Local\Temp\3856.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\38D3.tmp"C:\Users\Admin\AppData\Local\Temp\38D3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\3950.tmp"C:\Users\Admin\AppData\Local\Temp\3950.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\39AD.tmp"C:\Users\Admin\AppData\Local\Temp\39AD.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\39FC.tmp"C:\Users\Admin\AppData\Local\Temp\39FC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\3A59.tmp"C:\Users\Admin\AppData\Local\Temp\3A59.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\3B44.tmp"C:\Users\Admin\AppData\Local\Temp\3B44.tmp"23⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\3BB1.tmp"C:\Users\Admin\AppData\Local\Temp\3BB1.tmp"24⤵
- Executes dropped EXE
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"25⤵
- Executes dropped EXE
PID:664 -
C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"26⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\3D18.tmp"C:\Users\Admin\AppData\Local\Temp\3D18.tmp"27⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\3D86.tmp"C:\Users\Admin\AppData\Local\Temp\3D86.tmp"28⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"29⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\3E61.tmp"C:\Users\Admin\AppData\Local\Temp\3E61.tmp"30⤵
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\4016.tmp"C:\Users\Admin\AppData\Local\Temp\4016.tmp"31⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\4074.tmp"C:\Users\Admin\AppData\Local\Temp\4074.tmp"32⤵
- Executes dropped EXE
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\40E1.tmp"C:\Users\Admin\AppData\Local\Temp\40E1.tmp"33⤵
- Executes dropped EXE
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\415E.tmp"C:\Users\Admin\AppData\Local\Temp\415E.tmp"34⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\41AC.tmp"C:\Users\Admin\AppData\Local\Temp\41AC.tmp"35⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"36⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"37⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"38⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"39⤵
- Executes dropped EXE
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"40⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"41⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"42⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"43⤵
- Executes dropped EXE
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\44AA.tmp"C:\Users\Admin\AppData\Local\Temp\44AA.tmp"44⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"45⤵
- Executes dropped EXE
PID:556 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"46⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"47⤵
- Executes dropped EXE
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"48⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"49⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"50⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"51⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"52⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"53⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"54⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"55⤵
- Executes dropped EXE
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"56⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"57⤵
- Executes dropped EXE
PID:652 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"58⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"59⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"60⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"61⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"62⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"63⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"64⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"65⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"66⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"67⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"68⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"69⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"70⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"71⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"72⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"73⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"74⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"75⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"76⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"77⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"78⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"79⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"80⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"81⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"82⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"83⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"84⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"85⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"86⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"87⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"88⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"89⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"90⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"91⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"92⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"93⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"94⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"95⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"96⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"97⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"98⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"99⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"100⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"101⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"102⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"103⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"104⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"105⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"106⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"107⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"108⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"109⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"110⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"111⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"112⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"113⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"114⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"115⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"116⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"117⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"118⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"119⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"120⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"121⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"122⤵PID:4404
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-