Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
08/06/2024, 06:28
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-08_41040754db89ba683ca0b2799de1175f_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-08_41040754db89ba683ca0b2799de1175f_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-06-08_41040754db89ba683ca0b2799de1175f_mafia.exe
-
Size
536KB
-
MD5
41040754db89ba683ca0b2799de1175f
-
SHA1
c909f72437a3ae07352fda3b98ad05ed3485c910
-
SHA256
81a89c30a966a9bdb70c9d3afd361fca81f9a0775e81ce6e36b8c5c420d0bc1d
-
SHA512
8ce8db55fa2efeaf07bb347e3d95f71b9c52459a15cc64383eec88c54c4a6674864db4f7bbf5393aee6a6c338fc5958416e8c19c748e18cb1bf8ba06b2d38442
-
SSDEEP
12288:wU5rCOTeiU/EtEnUI+Edzp0jMqZSNl3+PIZxVJ0ZT9:wUQOJUcWnUWdF0jMqZIQIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1444 3151.tmp 2400 320C.tmp 1384 327A.tmp 3680 32E7.tmp 4376 3335.tmp 2560 3383.tmp 1424 33F1.tmp 4476 344E.tmp 2824 34AC.tmp 2248 350A.tmp 1744 3558.tmp 3872 35C5.tmp 3308 3623.tmp 3488 3681.tmp 2004 36DF.tmp 1656 373C.tmp 4620 378B.tmp 4508 37E8.tmp 4848 3846.tmp 1520 38A4.tmp 2348 38F2.tmp 4584 3950.tmp 1228 39AD.tmp 5012 3A0B.tmp 64 3A79.tmp 4552 3AC7.tmp 712 3B34.tmp 4612 3BE0.tmp 2728 3C3E.tmp 2288 3CAB.tmp 4736 3D18.tmp 3316 3D95.tmp 3352 3DE4.tmp 2676 3E32.tmp 4664 3E9F.tmp 3160 3EFD.tmp 448 3F4B.tmp 4436 3F99.tmp 4980 3FE7.tmp 5056 4045.tmp 4164 40B2.tmp 2576 4100.tmp 400 414F.tmp 3068 41AC.tmp 5040 420A.tmp 1304 42B6.tmp 668 4304.tmp 1424 4352.tmp 3964 43A0.tmp 2104 43EE.tmp 2244 443D.tmp 1880 449A.tmp 4944 44F8.tmp 3504 4546.tmp 2004 4594.tmp 2424 45F2.tmp 3676 4640.tmp 4176 469E.tmp 2332 46EC.tmp 4912 473A.tmp 1716 4788.tmp 2624 47D6.tmp 4908 4825.tmp 4552 4873.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4108 wrote to memory of 1444 4108 2024-06-08_41040754db89ba683ca0b2799de1175f_mafia.exe 82 PID 4108 wrote to memory of 1444 4108 2024-06-08_41040754db89ba683ca0b2799de1175f_mafia.exe 82 PID 4108 wrote to memory of 1444 4108 2024-06-08_41040754db89ba683ca0b2799de1175f_mafia.exe 82 PID 1444 wrote to memory of 2400 1444 3151.tmp 84 PID 1444 wrote to memory of 2400 1444 3151.tmp 84 PID 1444 wrote to memory of 2400 1444 3151.tmp 84 PID 2400 wrote to memory of 1384 2400 320C.tmp 86 PID 2400 wrote to memory of 1384 2400 320C.tmp 86 PID 2400 wrote to memory of 1384 2400 320C.tmp 86 PID 1384 wrote to memory of 3680 1384 327A.tmp 88 PID 1384 wrote to memory of 3680 1384 327A.tmp 88 PID 1384 wrote to memory of 3680 1384 327A.tmp 88 PID 3680 wrote to memory of 4376 3680 32E7.tmp 89 PID 3680 wrote to memory of 4376 3680 32E7.tmp 89 PID 3680 wrote to memory of 4376 3680 32E7.tmp 89 PID 4376 wrote to memory of 2560 4376 3335.tmp 90 PID 4376 wrote to memory of 2560 4376 3335.tmp 90 PID 4376 wrote to memory of 2560 4376 3335.tmp 90 PID 2560 wrote to memory of 1424 2560 3383.tmp 134 PID 2560 wrote to memory of 1424 2560 3383.tmp 134 PID 2560 wrote to memory of 1424 2560 3383.tmp 134 PID 1424 wrote to memory of 4476 1424 33F1.tmp 92 PID 1424 wrote to memory of 4476 1424 33F1.tmp 92 PID 1424 wrote to memory of 4476 1424 33F1.tmp 92 PID 4476 wrote to memory of 2824 4476 344E.tmp 180 PID 4476 wrote to memory of 2824 4476 344E.tmp 180 PID 4476 wrote to memory of 2824 4476 344E.tmp 180 PID 2824 wrote to memory of 2248 2824 34AC.tmp 181 PID 2824 wrote to memory of 2248 2824 34AC.tmp 181 PID 2824 wrote to memory of 2248 2824 34AC.tmp 181 PID 2248 wrote to memory of 1744 2248 350A.tmp 95 PID 2248 wrote to memory of 1744 2248 350A.tmp 95 PID 2248 wrote to memory of 1744 2248 350A.tmp 95 PID 1744 wrote to memory of 3872 1744 3558.tmp 96 PID 1744 wrote to memory of 3872 1744 3558.tmp 96 PID 1744 wrote to memory of 3872 1744 3558.tmp 96 PID 3872 wrote to memory of 3308 3872 35C5.tmp 97 PID 3872 wrote to memory of 3308 3872 35C5.tmp 97 PID 3872 wrote to memory of 3308 3872 35C5.tmp 97 PID 3308 wrote to memory of 3488 3308 3623.tmp 98 PID 3308 wrote to memory of 3488 3308 3623.tmp 98 PID 3308 wrote to memory of 3488 3308 3623.tmp 98 PID 3488 wrote to memory of 2004 3488 3681.tmp 99 PID 3488 wrote to memory of 2004 3488 3681.tmp 99 PID 3488 wrote to memory of 2004 3488 3681.tmp 99 PID 2004 wrote to memory of 1656 2004 36DF.tmp 100 PID 2004 wrote to memory of 1656 2004 36DF.tmp 100 PID 2004 wrote to memory of 1656 2004 36DF.tmp 100 PID 1656 wrote to memory of 4620 1656 373C.tmp 101 PID 1656 wrote to memory of 4620 1656 373C.tmp 101 PID 1656 wrote to memory of 4620 1656 373C.tmp 101 PID 4620 wrote to memory of 4508 4620 378B.tmp 102 PID 4620 wrote to memory of 4508 4620 378B.tmp 102 PID 4620 wrote to memory of 4508 4620 378B.tmp 102 PID 4508 wrote to memory of 4848 4508 37E8.tmp 103 PID 4508 wrote to memory of 4848 4508 37E8.tmp 103 PID 4508 wrote to memory of 4848 4508 37E8.tmp 103 PID 4848 wrote to memory of 1520 4848 3846.tmp 104 PID 4848 wrote to memory of 1520 4848 3846.tmp 104 PID 4848 wrote to memory of 1520 4848 3846.tmp 104 PID 1520 wrote to memory of 2348 1520 38A4.tmp 105 PID 1520 wrote to memory of 2348 1520 38A4.tmp 105 PID 1520 wrote to memory of 2348 1520 38A4.tmp 105 PID 2348 wrote to memory of 4584 2348 38F2.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-08_41040754db89ba683ca0b2799de1175f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-08_41040754db89ba683ca0b2799de1175f_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\3151.tmp"C:\Users\Admin\AppData\Local\Temp\3151.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\320C.tmp"C:\Users\Admin\AppData\Local\Temp\320C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\327A.tmp"C:\Users\Admin\AppData\Local\Temp\327A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\32E7.tmp"C:\Users\Admin\AppData\Local\Temp\32E7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\3335.tmp"C:\Users\Admin\AppData\Local\Temp\3335.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\3383.tmp"C:\Users\Admin\AppData\Local\Temp\3383.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\33F1.tmp"C:\Users\Admin\AppData\Local\Temp\33F1.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\344E.tmp"C:\Users\Admin\AppData\Local\Temp\344E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\34AC.tmp"C:\Users\Admin\AppData\Local\Temp\34AC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\350A.tmp"C:\Users\Admin\AppData\Local\Temp\350A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\3558.tmp"C:\Users\Admin\AppData\Local\Temp\3558.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\35C5.tmp"C:\Users\Admin\AppData\Local\Temp\35C5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\3623.tmp"C:\Users\Admin\AppData\Local\Temp\3623.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\3681.tmp"C:\Users\Admin\AppData\Local\Temp\3681.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\36DF.tmp"C:\Users\Admin\AppData\Local\Temp\36DF.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\373C.tmp"C:\Users\Admin\AppData\Local\Temp\373C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\378B.tmp"C:\Users\Admin\AppData\Local\Temp\378B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\37E8.tmp"C:\Users\Admin\AppData\Local\Temp\37E8.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\3846.tmp"C:\Users\Admin\AppData\Local\Temp\3846.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\38A4.tmp"C:\Users\Admin\AppData\Local\Temp\38A4.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\38F2.tmp"C:\Users\Admin\AppData\Local\Temp\38F2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\3950.tmp"C:\Users\Admin\AppData\Local\Temp\3950.tmp"23⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\39AD.tmp"C:\Users\Admin\AppData\Local\Temp\39AD.tmp"24⤵
- Executes dropped EXE
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"25⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\3A79.tmp"C:\Users\Admin\AppData\Local\Temp\3A79.tmp"26⤵
- Executes dropped EXE
PID:64 -
C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"27⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\3B34.tmp"C:\Users\Admin\AppData\Local\Temp\3B34.tmp"28⤵
- Executes dropped EXE
PID:712 -
C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"29⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\3C3E.tmp"C:\Users\Admin\AppData\Local\Temp\3C3E.tmp"30⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\3CAB.tmp"C:\Users\Admin\AppData\Local\Temp\3CAB.tmp"31⤵
- Executes dropped EXE
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\3D18.tmp"C:\Users\Admin\AppData\Local\Temp\3D18.tmp"32⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\3D95.tmp"C:\Users\Admin\AppData\Local\Temp\3D95.tmp"33⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"34⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\3E32.tmp"C:\Users\Admin\AppData\Local\Temp\3E32.tmp"35⤵
- Executes dropped EXE
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"36⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"37⤵
- Executes dropped EXE
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"38⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\3F99.tmp"C:\Users\Admin\AppData\Local\Temp\3F99.tmp"39⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"40⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\4045.tmp"C:\Users\Admin\AppData\Local\Temp\4045.tmp"41⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"42⤵
- Executes dropped EXE
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\4100.tmp"C:\Users\Admin\AppData\Local\Temp\4100.tmp"43⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\414F.tmp"C:\Users\Admin\AppData\Local\Temp\414F.tmp"44⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\41AC.tmp"C:\Users\Admin\AppData\Local\Temp\41AC.tmp"45⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\420A.tmp"C:\Users\Admin\AppData\Local\Temp\420A.tmp"46⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\42B6.tmp"C:\Users\Admin\AppData\Local\Temp\42B6.tmp"47⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\4304.tmp"C:\Users\Admin\AppData\Local\Temp\4304.tmp"48⤵
- Executes dropped EXE
PID:668 -
C:\Users\Admin\AppData\Local\Temp\4352.tmp"C:\Users\Admin\AppData\Local\Temp\4352.tmp"49⤵
- Executes dropped EXE
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"50⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"51⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\443D.tmp"C:\Users\Admin\AppData\Local\Temp\443D.tmp"52⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"53⤵
- Executes dropped EXE
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"54⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"55⤵
- Executes dropped EXE
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"56⤵
- Executes dropped EXE
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\45F2.tmp"C:\Users\Admin\AppData\Local\Temp\45F2.tmp"57⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"58⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"59⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\46EC.tmp"C:\Users\Admin\AppData\Local\Temp\46EC.tmp"60⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"61⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"62⤵
- Executes dropped EXE
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"63⤵
- Executes dropped EXE
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"64⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"65⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"66⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"67⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"68⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"69⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"70⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"71⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"72⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"73⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"74⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"75⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"76⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"77⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"78⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"79⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"80⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"81⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"82⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"83⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"84⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"85⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"86⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"87⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"88⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"89⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"90⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"91⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"92⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"93⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"94⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"95⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"96⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"97⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"98⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"99⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"100⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"101⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"102⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"103⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"104⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"105⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"106⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"107⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"108⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"109⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"110⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"111⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"112⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"113⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"114⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"115⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"116⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"117⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"118⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"119⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"120⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"121⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"122⤵PID:2352
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-