Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09/06/2024, 18:35
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-09_4c3055af3d76a7d01c0242a6fc8414c8_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-09_4c3055af3d76a7d01c0242a6fc8414c8_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-06-09_4c3055af3d76a7d01c0242a6fc8414c8_mafia.exe
-
Size
520KB
-
MD5
4c3055af3d76a7d01c0242a6fc8414c8
-
SHA1
b9f8bb446cda5a98363f3cef9be7e20f55a296fd
-
SHA256
50449675e4ec60160f84b62611e227931ccfd7e5f87a1eda9d0c08d333ff4d10
-
SHA512
e43b7dbff2f00bbb91d3a3bc7f9f62a2bd9d60f2dad4a8c02b3edcf83a4dbd1350d7c15ac5211a98b15b5a938ca89931688f8a91b0967361de314b6b37fa953c
-
SSDEEP
6144:lLvd/XzCjUIF1UuXLyQjmOH+JjLH+SmaZyrkycRoewvls/TxWN+JLeL/hDkOryv+:roRXOQjmOyDZyrLL0/9WcyLhosvnNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5056 2D2A.tmp 456 2D88.tmp 4820 2E05.tmp 4756 2E92.tmp 1532 2EEF.tmp 2116 2F3E.tmp 2860 2F8C.tmp 4616 2FDA.tmp 3648 3038.tmp 1156 3086.tmp 4300 30D4.tmp 4552 3122.tmp 4548 3180.tmp 3492 31DD.tmp 4068 324B.tmp 856 32B8.tmp 4160 3306.tmp 3652 3354.tmp 916 33C2.tmp 2808 3410.tmp 4468 347D.tmp 3264 34EB.tmp 2956 3548.tmp 2584 35B6.tmp 3836 3623.tmp 3384 36A0.tmp 840 36EE.tmp 4996 374C.tmp 4972 37AA.tmp 4372 37F8.tmp 3244 3846.tmp 4976 38A4.tmp 3496 38F2.tmp 728 3940.tmp 3268 399E.tmp 4044 39FC.tmp 2764 3A4A.tmp 2856 3A98.tmp 4404 3AE6.tmp 2208 3B34.tmp 4236 3B92.tmp 1560 3BF0.tmp 4288 3C4D.tmp 2204 3C9B.tmp 4764 3CEA.tmp 2344 3D47.tmp 1132 3D95.tmp 4788 3DF3.tmp 3880 3E51.tmp 1744 3E9F.tmp 4224 3EED.tmp 4344 3F4B.tmp 3216 3F99.tmp 4136 3FE7.tmp 5056 4035.tmp 4524 4093.tmp 4076 40F1.tmp 2348 413F.tmp 3716 418D.tmp 3696 41DB.tmp 4092 4239.tmp 4264 4287.tmp 3108 42D5.tmp 4680 4333.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 636 wrote to memory of 5056 636 2024-06-09_4c3055af3d76a7d01c0242a6fc8414c8_mafia.exe 81 PID 636 wrote to memory of 5056 636 2024-06-09_4c3055af3d76a7d01c0242a6fc8414c8_mafia.exe 81 PID 636 wrote to memory of 5056 636 2024-06-09_4c3055af3d76a7d01c0242a6fc8414c8_mafia.exe 81 PID 5056 wrote to memory of 456 5056 2D2A.tmp 82 PID 5056 wrote to memory of 456 5056 2D2A.tmp 82 PID 5056 wrote to memory of 456 5056 2D2A.tmp 82 PID 456 wrote to memory of 4820 456 2D88.tmp 83 PID 456 wrote to memory of 4820 456 2D88.tmp 83 PID 456 wrote to memory of 4820 456 2D88.tmp 83 PID 4820 wrote to memory of 4756 4820 2E05.tmp 84 PID 4820 wrote to memory of 4756 4820 2E05.tmp 84 PID 4820 wrote to memory of 4756 4820 2E05.tmp 84 PID 4756 wrote to memory of 1532 4756 2E92.tmp 85 PID 4756 wrote to memory of 1532 4756 2E92.tmp 85 PID 4756 wrote to memory of 1532 4756 2E92.tmp 85 PID 1532 wrote to memory of 2116 1532 2EEF.tmp 86 PID 1532 wrote to memory of 2116 1532 2EEF.tmp 86 PID 1532 wrote to memory of 2116 1532 2EEF.tmp 86 PID 2116 wrote to memory of 2860 2116 2F3E.tmp 87 PID 2116 wrote to memory of 2860 2116 2F3E.tmp 87 PID 2116 wrote to memory of 2860 2116 2F3E.tmp 87 PID 2860 wrote to memory of 4616 2860 2F8C.tmp 88 PID 2860 wrote to memory of 4616 2860 2F8C.tmp 88 PID 2860 wrote to memory of 4616 2860 2F8C.tmp 88 PID 4616 wrote to memory of 3648 4616 2FDA.tmp 89 PID 4616 wrote to memory of 3648 4616 2FDA.tmp 89 PID 4616 wrote to memory of 3648 4616 2FDA.tmp 89 PID 3648 wrote to memory of 1156 3648 3038.tmp 90 PID 3648 wrote to memory of 1156 3648 3038.tmp 90 PID 3648 wrote to memory of 1156 3648 3038.tmp 90 PID 1156 wrote to memory of 4300 1156 3086.tmp 91 PID 1156 wrote to memory of 4300 1156 3086.tmp 91 PID 1156 wrote to memory of 4300 1156 3086.tmp 91 PID 4300 wrote to memory of 4552 4300 30D4.tmp 92 PID 4300 wrote to memory of 4552 4300 30D4.tmp 92 PID 4300 wrote to memory of 4552 4300 30D4.tmp 92 PID 4552 wrote to memory of 4548 4552 3122.tmp 93 PID 4552 wrote to memory of 4548 4552 3122.tmp 93 PID 4552 wrote to memory of 4548 4552 3122.tmp 93 PID 4548 wrote to memory of 3492 4548 3180.tmp 94 PID 4548 wrote to memory of 3492 4548 3180.tmp 94 PID 4548 wrote to memory of 3492 4548 3180.tmp 94 PID 3492 wrote to memory of 4068 3492 31DD.tmp 95 PID 3492 wrote to memory of 4068 3492 31DD.tmp 95 PID 3492 wrote to memory of 4068 3492 31DD.tmp 95 PID 4068 wrote to memory of 856 4068 324B.tmp 96 PID 4068 wrote to memory of 856 4068 324B.tmp 96 PID 4068 wrote to memory of 856 4068 324B.tmp 96 PID 856 wrote to memory of 4160 856 32B8.tmp 97 PID 856 wrote to memory of 4160 856 32B8.tmp 97 PID 856 wrote to memory of 4160 856 32B8.tmp 97 PID 4160 wrote to memory of 3652 4160 3306.tmp 98 PID 4160 wrote to memory of 3652 4160 3306.tmp 98 PID 4160 wrote to memory of 3652 4160 3306.tmp 98 PID 3652 wrote to memory of 916 3652 3354.tmp 99 PID 3652 wrote to memory of 916 3652 3354.tmp 99 PID 3652 wrote to memory of 916 3652 3354.tmp 99 PID 916 wrote to memory of 2808 916 33C2.tmp 100 PID 916 wrote to memory of 2808 916 33C2.tmp 100 PID 916 wrote to memory of 2808 916 33C2.tmp 100 PID 2808 wrote to memory of 4468 2808 3410.tmp 101 PID 2808 wrote to memory of 4468 2808 3410.tmp 101 PID 2808 wrote to memory of 4468 2808 3410.tmp 101 PID 4468 wrote to memory of 3264 4468 347D.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-09_4c3055af3d76a7d01c0242a6fc8414c8_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-09_4c3055af3d76a7d01c0242a6fc8414c8_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\2D2A.tmp"C:\Users\Admin\AppData\Local\Temp\2D2A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\2D88.tmp"C:\Users\Admin\AppData\Local\Temp\2D88.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\2E05.tmp"C:\Users\Admin\AppData\Local\Temp\2E05.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\2E92.tmp"C:\Users\Admin\AppData\Local\Temp\2E92.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\2EEF.tmp"C:\Users\Admin\AppData\Local\Temp\2EEF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\2F3E.tmp"C:\Users\Admin\AppData\Local\Temp\2F3E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\2F8C.tmp"C:\Users\Admin\AppData\Local\Temp\2F8C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\2FDA.tmp"C:\Users\Admin\AppData\Local\Temp\2FDA.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\3038.tmp"C:\Users\Admin\AppData\Local\Temp\3038.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\3086.tmp"C:\Users\Admin\AppData\Local\Temp\3086.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\30D4.tmp"C:\Users\Admin\AppData\Local\Temp\30D4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\3122.tmp"C:\Users\Admin\AppData\Local\Temp\3122.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\3180.tmp"C:\Users\Admin\AppData\Local\Temp\3180.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\31DD.tmp"C:\Users\Admin\AppData\Local\Temp\31DD.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\324B.tmp"C:\Users\Admin\AppData\Local\Temp\324B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\32B8.tmp"C:\Users\Admin\AppData\Local\Temp\32B8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\3306.tmp"C:\Users\Admin\AppData\Local\Temp\3306.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\3354.tmp"C:\Users\Admin\AppData\Local\Temp\3354.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\33C2.tmp"C:\Users\Admin\AppData\Local\Temp\33C2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\3410.tmp"C:\Users\Admin\AppData\Local\Temp\3410.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\347D.tmp"C:\Users\Admin\AppData\Local\Temp\347D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\34EB.tmp"C:\Users\Admin\AppData\Local\Temp\34EB.tmp"23⤵
- Executes dropped EXE
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\3548.tmp"C:\Users\Admin\AppData\Local\Temp\3548.tmp"24⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\35B6.tmp"C:\Users\Admin\AppData\Local\Temp\35B6.tmp"25⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\3623.tmp"C:\Users\Admin\AppData\Local\Temp\3623.tmp"26⤵
- Executes dropped EXE
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\36A0.tmp"C:\Users\Admin\AppData\Local\Temp\36A0.tmp"27⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\36EE.tmp"C:\Users\Admin\AppData\Local\Temp\36EE.tmp"28⤵
- Executes dropped EXE
PID:840 -
C:\Users\Admin\AppData\Local\Temp\374C.tmp"C:\Users\Admin\AppData\Local\Temp\374C.tmp"29⤵
- Executes dropped EXE
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\37AA.tmp"C:\Users\Admin\AppData\Local\Temp\37AA.tmp"30⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\37F8.tmp"C:\Users\Admin\AppData\Local\Temp\37F8.tmp"31⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\3846.tmp"C:\Users\Admin\AppData\Local\Temp\3846.tmp"32⤵
- Executes dropped EXE
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\38A4.tmp"C:\Users\Admin\AppData\Local\Temp\38A4.tmp"33⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\38F2.tmp"C:\Users\Admin\AppData\Local\Temp\38F2.tmp"34⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\3940.tmp"C:\Users\Admin\AppData\Local\Temp\3940.tmp"35⤵
- Executes dropped EXE
PID:728 -
C:\Users\Admin\AppData\Local\Temp\399E.tmp"C:\Users\Admin\AppData\Local\Temp\399E.tmp"36⤵
- Executes dropped EXE
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\39FC.tmp"C:\Users\Admin\AppData\Local\Temp\39FC.tmp"37⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"38⤵
- Executes dropped EXE
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\3A98.tmp"C:\Users\Admin\AppData\Local\Temp\3A98.tmp"39⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"40⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\3B34.tmp"C:\Users\Admin\AppData\Local\Temp\3B34.tmp"41⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\3B92.tmp"C:\Users\Admin\AppData\Local\Temp\3B92.tmp"42⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"43⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"44⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"45⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"46⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\3D47.tmp"C:\Users\Admin\AppData\Local\Temp\3D47.tmp"47⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\3D95.tmp"C:\Users\Admin\AppData\Local\Temp\3D95.tmp"48⤵
- Executes dropped EXE
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"49⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\3E51.tmp"C:\Users\Admin\AppData\Local\Temp\3E51.tmp"50⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"51⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\3EED.tmp"C:\Users\Admin\AppData\Local\Temp\3EED.tmp"52⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"53⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\3F99.tmp"C:\Users\Admin\AppData\Local\Temp\3F99.tmp"54⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"55⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\4035.tmp"C:\Users\Admin\AppData\Local\Temp\4035.tmp"56⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\4093.tmp"C:\Users\Admin\AppData\Local\Temp\4093.tmp"57⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\40F1.tmp"C:\Users\Admin\AppData\Local\Temp\40F1.tmp"58⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\413F.tmp"C:\Users\Admin\AppData\Local\Temp\413F.tmp"59⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\418D.tmp"C:\Users\Admin\AppData\Local\Temp\418D.tmp"60⤵
- Executes dropped EXE
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\41DB.tmp"C:\Users\Admin\AppData\Local\Temp\41DB.tmp"61⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"62⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\4287.tmp"C:\Users\Admin\AppData\Local\Temp\4287.tmp"63⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"64⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"65⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"66⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"67⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\443D.tmp"C:\Users\Admin\AppData\Local\Temp\443D.tmp"68⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"69⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"70⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"71⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"72⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\45D3.tmp"C:\Users\Admin\AppData\Local\Temp\45D3.tmp"73⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"74⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"75⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"76⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"77⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"78⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"79⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"80⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"81⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"82⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"83⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"84⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"85⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"86⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"87⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"88⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"89⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"90⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"91⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"92⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"93⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"94⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"95⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"96⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"97⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"98⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"99⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"100⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"101⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"102⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"103⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"104⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"105⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"106⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"107⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"108⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"109⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"110⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"111⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"112⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"113⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"114⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"115⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"116⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"117⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"118⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"119⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"120⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"121⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"122⤵PID:452
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-