Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
06/06/2024, 18:08
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-06_3886df99444d2109b6a2b3e4bf2bb1c6_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-06_3886df99444d2109b6a2b3e4bf2bb1c6_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-06-06_3886df99444d2109b6a2b3e4bf2bb1c6_mafia.exe
-
Size
536KB
-
MD5
3886df99444d2109b6a2b3e4bf2bb1c6
-
SHA1
7360800fba41cfa736b86e520ef26f7fb0b5d906
-
SHA256
d023d24dfb138718702242f8effa0bcc5684dc3700ef36fc067b6b414efef303
-
SHA512
7b778785c226e19be344a195d780d0a67e9f8ae90c86097ea21b847386d546988c6b5872c54f730fd827c79ff5735f1d3cb25d5095abea2016e0534603309a83
-
SSDEEP
12288:wU5rCOTeiU+ydWbS2ykR7fYgVbKyIZxVJ0ZT9:wUQOJU1WbSo8gVeyIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2668 7AFC.tmp 4564 7BB8.tmp 1016 7C25.tmp 1056 7CC1.tmp 4652 7D3E.tmp 912 7DCB.tmp 856 7E38.tmp 2520 7EB5.tmp 5032 7F42.tmp 4732 7FAF.tmp 1996 804C.tmp 3304 80A9.tmp 2484 8136.tmp 540 81B3.tmp 4736 824F.tmp 3164 82EB.tmp 4948 8359.tmp 5056 83E5.tmp 1968 8482.tmp 4460 84FF.tmp 1132 859B.tmp 664 8618.tmp 3320 86D3.tmp 1632 8750.tmp 3740 87BE.tmp 4588 881C.tmp 1240 88A8.tmp 1956 8925.tmp 1080 8B58.tmp 4600 8BC5.tmp 4512 8C52.tmp 5080 8CCF.tmp 2400 8D4C.tmp 5116 8DC9.tmp 1016 8E46.tmp 3228 8E94.tmp 4000 8EE2.tmp 3128 8F6F.tmp 2848 8FDC.tmp 2076 902A.tmp 4024 9088.tmp 4732 90F5.tmp 1092 9172.tmp 1028 91D0.tmp 2556 924D.tmp 3208 92AB.tmp 848 9318.tmp 1588 9376.tmp 1456 93C4.tmp 2916 9412.tmp 4108 9460.tmp 4572 94AE.tmp 4332 950C.tmp 988 955A.tmp 3884 95A8.tmp 4996 95F6.tmp 4140 9645.tmp 212 96A2.tmp 3016 9700.tmp 2588 974E.tmp 3320 979C.tmp 516 97FA.tmp 1632 9848.tmp 1828 9896.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3684 wrote to memory of 2668 3684 2024-06-06_3886df99444d2109b6a2b3e4bf2bb1c6_mafia.exe 86 PID 3684 wrote to memory of 2668 3684 2024-06-06_3886df99444d2109b6a2b3e4bf2bb1c6_mafia.exe 86 PID 3684 wrote to memory of 2668 3684 2024-06-06_3886df99444d2109b6a2b3e4bf2bb1c6_mafia.exe 86 PID 2668 wrote to memory of 4564 2668 7AFC.tmp 87 PID 2668 wrote to memory of 4564 2668 7AFC.tmp 87 PID 2668 wrote to memory of 4564 2668 7AFC.tmp 87 PID 4564 wrote to memory of 1016 4564 7BB8.tmp 88 PID 4564 wrote to memory of 1016 4564 7BB8.tmp 88 PID 4564 wrote to memory of 1016 4564 7BB8.tmp 88 PID 1016 wrote to memory of 1056 1016 7C25.tmp 91 PID 1016 wrote to memory of 1056 1016 7C25.tmp 91 PID 1016 wrote to memory of 1056 1016 7C25.tmp 91 PID 1056 wrote to memory of 4652 1056 7CC1.tmp 92 PID 1056 wrote to memory of 4652 1056 7CC1.tmp 92 PID 1056 wrote to memory of 4652 1056 7CC1.tmp 92 PID 4652 wrote to memory of 912 4652 7D3E.tmp 94 PID 4652 wrote to memory of 912 4652 7D3E.tmp 94 PID 4652 wrote to memory of 912 4652 7D3E.tmp 94 PID 912 wrote to memory of 856 912 7DCB.tmp 95 PID 912 wrote to memory of 856 912 7DCB.tmp 95 PID 912 wrote to memory of 856 912 7DCB.tmp 95 PID 856 wrote to memory of 2520 856 7E38.tmp 96 PID 856 wrote to memory of 2520 856 7E38.tmp 96 PID 856 wrote to memory of 2520 856 7E38.tmp 96 PID 2520 wrote to memory of 5032 2520 7EB5.tmp 97 PID 2520 wrote to memory of 5032 2520 7EB5.tmp 97 PID 2520 wrote to memory of 5032 2520 7EB5.tmp 97 PID 5032 wrote to memory of 4732 5032 7F42.tmp 98 PID 5032 wrote to memory of 4732 5032 7F42.tmp 98 PID 5032 wrote to memory of 4732 5032 7F42.tmp 98 PID 4732 wrote to memory of 1996 4732 7FAF.tmp 99 PID 4732 wrote to memory of 1996 4732 7FAF.tmp 99 PID 4732 wrote to memory of 1996 4732 7FAF.tmp 99 PID 1996 wrote to memory of 3304 1996 804C.tmp 100 PID 1996 wrote to memory of 3304 1996 804C.tmp 100 PID 1996 wrote to memory of 3304 1996 804C.tmp 100 PID 3304 wrote to memory of 2484 3304 80A9.tmp 101 PID 3304 wrote to memory of 2484 3304 80A9.tmp 101 PID 3304 wrote to memory of 2484 3304 80A9.tmp 101 PID 2484 wrote to memory of 540 2484 8136.tmp 102 PID 2484 wrote to memory of 540 2484 8136.tmp 102 PID 2484 wrote to memory of 540 2484 8136.tmp 102 PID 540 wrote to memory of 4736 540 81B3.tmp 103 PID 540 wrote to memory of 4736 540 81B3.tmp 103 PID 540 wrote to memory of 4736 540 81B3.tmp 103 PID 4736 wrote to memory of 3164 4736 824F.tmp 104 PID 4736 wrote to memory of 3164 4736 824F.tmp 104 PID 4736 wrote to memory of 3164 4736 824F.tmp 104 PID 3164 wrote to memory of 4948 3164 82EB.tmp 105 PID 3164 wrote to memory of 4948 3164 82EB.tmp 105 PID 3164 wrote to memory of 4948 3164 82EB.tmp 105 PID 4948 wrote to memory of 5056 4948 8359.tmp 106 PID 4948 wrote to memory of 5056 4948 8359.tmp 106 PID 4948 wrote to memory of 5056 4948 8359.tmp 106 PID 5056 wrote to memory of 1968 5056 83E5.tmp 107 PID 5056 wrote to memory of 1968 5056 83E5.tmp 107 PID 5056 wrote to memory of 1968 5056 83E5.tmp 107 PID 1968 wrote to memory of 4460 1968 8482.tmp 108 PID 1968 wrote to memory of 4460 1968 8482.tmp 108 PID 1968 wrote to memory of 4460 1968 8482.tmp 108 PID 4460 wrote to memory of 1132 4460 84FF.tmp 109 PID 4460 wrote to memory of 1132 4460 84FF.tmp 109 PID 4460 wrote to memory of 1132 4460 84FF.tmp 109 PID 1132 wrote to memory of 664 1132 859B.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-06_3886df99444d2109b6a2b3e4bf2bb1c6_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-06_3886df99444d2109b6a2b3e4bf2bb1c6_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\7E38.tmp"C:\Users\Admin\AppData\Local\Temp\7E38.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\7F42.tmp"C:\Users\Admin\AppData\Local\Temp\7F42.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\804C.tmp"C:\Users\Admin\AppData\Local\Temp\804C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\80A9.tmp"C:\Users\Admin\AppData\Local\Temp\80A9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\8136.tmp"C:\Users\Admin\AppData\Local\Temp\8136.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\81B3.tmp"C:\Users\Admin\AppData\Local\Temp\81B3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\824F.tmp"C:\Users\Admin\AppData\Local\Temp\824F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\82EB.tmp"C:\Users\Admin\AppData\Local\Temp\82EB.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\8359.tmp"C:\Users\Admin\AppData\Local\Temp\8359.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\83E5.tmp"C:\Users\Admin\AppData\Local\Temp\83E5.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\8482.tmp"C:\Users\Admin\AppData\Local\Temp\8482.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\84FF.tmp"C:\Users\Admin\AppData\Local\Temp\84FF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\859B.tmp"C:\Users\Admin\AppData\Local\Temp\859B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\8618.tmp"C:\Users\Admin\AppData\Local\Temp\8618.tmp"23⤵
- Executes dropped EXE
PID:664 -
C:\Users\Admin\AppData\Local\Temp\86D3.tmp"C:\Users\Admin\AppData\Local\Temp\86D3.tmp"24⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\8750.tmp"C:\Users\Admin\AppData\Local\Temp\8750.tmp"25⤵
- Executes dropped EXE
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\87BE.tmp"C:\Users\Admin\AppData\Local\Temp\87BE.tmp"26⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\881C.tmp"C:\Users\Admin\AppData\Local\Temp\881C.tmp"27⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\88A8.tmp"C:\Users\Admin\AppData\Local\Temp\88A8.tmp"28⤵
- Executes dropped EXE
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\8925.tmp"C:\Users\Admin\AppData\Local\Temp\8925.tmp"29⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\8B58.tmp"C:\Users\Admin\AppData\Local\Temp\8B58.tmp"30⤵
- Executes dropped EXE
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"31⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"32⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"33⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"34⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"35⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\8E46.tmp"C:\Users\Admin\AppData\Local\Temp\8E46.tmp"36⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\8E94.tmp"C:\Users\Admin\AppData\Local\Temp\8E94.tmp"37⤵
- Executes dropped EXE
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"38⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"39⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"40⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\902A.tmp"C:\Users\Admin\AppData\Local\Temp\902A.tmp"41⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"42⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"43⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp"44⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\91D0.tmp"C:\Users\Admin\AppData\Local\Temp\91D0.tmp"45⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\924D.tmp"C:\Users\Admin\AppData\Local\Temp\924D.tmp"46⤵
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\92AB.tmp"C:\Users\Admin\AppData\Local\Temp\92AB.tmp"47⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"48⤵
- Executes dropped EXE
PID:848 -
C:\Users\Admin\AppData\Local\Temp\9376.tmp"C:\Users\Admin\AppData\Local\Temp\9376.tmp"49⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"50⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\9412.tmp"C:\Users\Admin\AppData\Local\Temp\9412.tmp"51⤵
- Executes dropped EXE
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\9460.tmp"C:\Users\Admin\AppData\Local\Temp\9460.tmp"52⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\94AE.tmp"C:\Users\Admin\AppData\Local\Temp\94AE.tmp"53⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\950C.tmp"C:\Users\Admin\AppData\Local\Temp\950C.tmp"54⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"55⤵
- Executes dropped EXE
PID:988 -
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"56⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\95F6.tmp"C:\Users\Admin\AppData\Local\Temp\95F6.tmp"57⤵
- Executes dropped EXE
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"58⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"59⤵
- Executes dropped EXE
PID:212 -
C:\Users\Admin\AppData\Local\Temp\9700.tmp"C:\Users\Admin\AppData\Local\Temp\9700.tmp"60⤵
- Executes dropped EXE
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"61⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"62⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\97FA.tmp"C:\Users\Admin\AppData\Local\Temp\97FA.tmp"63⤵
- Executes dropped EXE
PID:516 -
C:\Users\Admin\AppData\Local\Temp\9848.tmp"C:\Users\Admin\AppData\Local\Temp\9848.tmp"64⤵
- Executes dropped EXE
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\9896.tmp"C:\Users\Admin\AppData\Local\Temp\9896.tmp"65⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\98F4.tmp"C:\Users\Admin\AppData\Local\Temp\98F4.tmp"66⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\9942.tmp"C:\Users\Admin\AppData\Local\Temp\9942.tmp"67⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"68⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"69⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"70⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"71⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"72⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"73⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"74⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"75⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"76⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"77⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"78⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\9D59.tmp"C:\Users\Admin\AppData\Local\Temp\9D59.tmp"79⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"80⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\9E15.tmp"C:\Users\Admin\AppData\Local\Temp\9E15.tmp"81⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\9E63.tmp"C:\Users\Admin\AppData\Local\Temp\9E63.tmp"82⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"83⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"84⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"85⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"86⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"87⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"88⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"89⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"90⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\A141.tmp"C:\Users\Admin\AppData\Local\Temp\A141.tmp"91⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\A19F.tmp"C:\Users\Admin\AppData\Local\Temp\A19F.tmp"92⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"93⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\A23B.tmp"C:\Users\Admin\AppData\Local\Temp\A23B.tmp"94⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"95⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"96⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\A325.tmp"C:\Users\Admin\AppData\Local\Temp\A325.tmp"97⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\A374.tmp"C:\Users\Admin\AppData\Local\Temp\A374.tmp"98⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"99⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\A41F.tmp"C:\Users\Admin\AppData\Local\Temp\A41F.tmp"100⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\A47D.tmp"C:\Users\Admin\AppData\Local\Temp\A47D.tmp"101⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"102⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\A519.tmp"C:\Users\Admin\AppData\Local\Temp\A519.tmp"103⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\A577.tmp"C:\Users\Admin\AppData\Local\Temp\A577.tmp"104⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"105⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\A613.tmp"C:\Users\Admin\AppData\Local\Temp\A613.tmp"106⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\A662.tmp"C:\Users\Admin\AppData\Local\Temp\A662.tmp"107⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"108⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"109⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"110⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"111⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"112⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\A856.tmp"C:\Users\Admin\AppData\Local\Temp\A856.tmp"113⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"114⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"115⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\A940.tmp"C:\Users\Admin\AppData\Local\Temp\A940.tmp"116⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"117⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"118⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"119⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\AA88.tmp"C:\Users\Admin\AppData\Local\Temp\AA88.tmp"120⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"121⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"122⤵PID:4160
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-