Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/06/2024, 10:28
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-10_6514fc86f28c4ef4746fe914f0559088_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-10_6514fc86f28c4ef4746fe914f0559088_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-10_6514fc86f28c4ef4746fe914f0559088_mafia.exe
-
Size
520KB
-
MD5
6514fc86f28c4ef4746fe914f0559088
-
SHA1
29ac21d27c3abd5713dfe7abec0966b4df8ef9e8
-
SHA256
f0cf2ab26b88a386920fd77c776e59b6b9808a0924cb99e904ba17c463cea028
-
SHA512
99306b8f3a1e32af68afbaa17af34940e1de5a5e0ebe6ee4bdf23516d34b864a07c3ae195ccc0e3a555cb99c65c321f957e3edd5bbb3c318e20ef40483d9d07d
-
SSDEEP
12288:gj8fuxR21t5i8fvcB+I4aet5ABudbGfJMdNZ:gj8fuK1GYLIeteMSJoN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4460 88E7.tmp 4872 8944.tmp 1636 8993.tmp 2916 89E1.tmp 1608 8A3E.tmp 3820 8A9C.tmp 1464 8AEA.tmp 3864 8B38.tmp 1088 8B87.tmp 4380 8BD5.tmp 1760 8C23.tmp 4612 8C71.tmp 3924 8CBF.tmp 4812 8D0D.tmp 2628 8D5B.tmp 4988 8DA9.tmp 4788 8DF8.tmp 2560 8E84.tmp 1376 8ED2.tmp 3964 8F40.tmp 1708 8F9D.tmp 4688 8FFB.tmp 1612 9059.tmp 1952 90A7.tmp 1976 90F5.tmp 2096 9143.tmp 2624 9191.tmp 3516 91E0.tmp 4720 922E.tmp 1092 927C.tmp 3980 92CA.tmp 4704 9318.tmp 3668 9366.tmp 3084 93A5.tmp 448 93E3.tmp 3908 9460.tmp 2488 94AE.tmp 2220 94FC.tmp 3248 955A.tmp 3128 95C8.tmp 3624 9616.tmp 4112 9664.tmp 3664 96A2.tmp 4740 96F0.tmp 3408 972F.tmp 4592 976D.tmp 3356 97BC.tmp 1496 980A.tmp 60 9858.tmp 2196 98A6.tmp 2640 98F4.tmp 316 9942.tmp 4204 9990.tmp 4616 99DE.tmp 4160 9A2D.tmp 2604 9A7B.tmp 4628 9AC9.tmp 3244 9B27.tmp 4252 9B75.tmp 3252 9BC3.tmp 808 9C11.tmp 2672 9C5F.tmp 4816 9C9E.tmp 3712 9CEC.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4892 wrote to memory of 4460 4892 2024-06-10_6514fc86f28c4ef4746fe914f0559088_mafia.exe 82 PID 4892 wrote to memory of 4460 4892 2024-06-10_6514fc86f28c4ef4746fe914f0559088_mafia.exe 82 PID 4892 wrote to memory of 4460 4892 2024-06-10_6514fc86f28c4ef4746fe914f0559088_mafia.exe 82 PID 4460 wrote to memory of 4872 4460 88E7.tmp 83 PID 4460 wrote to memory of 4872 4460 88E7.tmp 83 PID 4460 wrote to memory of 4872 4460 88E7.tmp 83 PID 4872 wrote to memory of 1636 4872 8944.tmp 86 PID 4872 wrote to memory of 1636 4872 8944.tmp 86 PID 4872 wrote to memory of 1636 4872 8944.tmp 86 PID 1636 wrote to memory of 2916 1636 8993.tmp 88 PID 1636 wrote to memory of 2916 1636 8993.tmp 88 PID 1636 wrote to memory of 2916 1636 8993.tmp 88 PID 2916 wrote to memory of 1608 2916 89E1.tmp 89 PID 2916 wrote to memory of 1608 2916 89E1.tmp 89 PID 2916 wrote to memory of 1608 2916 89E1.tmp 89 PID 1608 wrote to memory of 3820 1608 8A3E.tmp 90 PID 1608 wrote to memory of 3820 1608 8A3E.tmp 90 PID 1608 wrote to memory of 3820 1608 8A3E.tmp 90 PID 3820 wrote to memory of 1464 3820 8A9C.tmp 91 PID 3820 wrote to memory of 1464 3820 8A9C.tmp 91 PID 3820 wrote to memory of 1464 3820 8A9C.tmp 91 PID 1464 wrote to memory of 3864 1464 8AEA.tmp 92 PID 1464 wrote to memory of 3864 1464 8AEA.tmp 92 PID 1464 wrote to memory of 3864 1464 8AEA.tmp 92 PID 3864 wrote to memory of 1088 3864 8B38.tmp 93 PID 3864 wrote to memory of 1088 3864 8B38.tmp 93 PID 3864 wrote to memory of 1088 3864 8B38.tmp 93 PID 1088 wrote to memory of 4380 1088 8B87.tmp 94 PID 1088 wrote to memory of 4380 1088 8B87.tmp 94 PID 1088 wrote to memory of 4380 1088 8B87.tmp 94 PID 4380 wrote to memory of 1760 4380 8BD5.tmp 95 PID 4380 wrote to memory of 1760 4380 8BD5.tmp 95 PID 4380 wrote to memory of 1760 4380 8BD5.tmp 95 PID 1760 wrote to memory of 4612 1760 8C23.tmp 96 PID 1760 wrote to memory of 4612 1760 8C23.tmp 96 PID 1760 wrote to memory of 4612 1760 8C23.tmp 96 PID 4612 wrote to memory of 3924 4612 8C71.tmp 97 PID 4612 wrote to memory of 3924 4612 8C71.tmp 97 PID 4612 wrote to memory of 3924 4612 8C71.tmp 97 PID 3924 wrote to memory of 4812 3924 8CBF.tmp 98 PID 3924 wrote to memory of 4812 3924 8CBF.tmp 98 PID 3924 wrote to memory of 4812 3924 8CBF.tmp 98 PID 4812 wrote to memory of 2628 4812 8D0D.tmp 99 PID 4812 wrote to memory of 2628 4812 8D0D.tmp 99 PID 4812 wrote to memory of 2628 4812 8D0D.tmp 99 PID 2628 wrote to memory of 4988 2628 8D5B.tmp 100 PID 2628 wrote to memory of 4988 2628 8D5B.tmp 100 PID 2628 wrote to memory of 4988 2628 8D5B.tmp 100 PID 4988 wrote to memory of 4788 4988 8DA9.tmp 101 PID 4988 wrote to memory of 4788 4988 8DA9.tmp 101 PID 4988 wrote to memory of 4788 4988 8DA9.tmp 101 PID 4788 wrote to memory of 2560 4788 8DF8.tmp 102 PID 4788 wrote to memory of 2560 4788 8DF8.tmp 102 PID 4788 wrote to memory of 2560 4788 8DF8.tmp 102 PID 2560 wrote to memory of 1376 2560 8E84.tmp 103 PID 2560 wrote to memory of 1376 2560 8E84.tmp 103 PID 2560 wrote to memory of 1376 2560 8E84.tmp 103 PID 1376 wrote to memory of 3964 1376 8ED2.tmp 105 PID 1376 wrote to memory of 3964 1376 8ED2.tmp 105 PID 1376 wrote to memory of 3964 1376 8ED2.tmp 105 PID 3964 wrote to memory of 1708 3964 8F40.tmp 106 PID 3964 wrote to memory of 1708 3964 8F40.tmp 106 PID 3964 wrote to memory of 1708 3964 8F40.tmp 106 PID 1708 wrote to memory of 4688 1708 8F9D.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-10_6514fc86f28c4ef4746fe914f0559088_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-10_6514fc86f28c4ef4746fe914f0559088_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\88E7.tmp"C:\Users\Admin\AppData\Local\Temp\88E7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\8993.tmp"C:\Users\Admin\AppData\Local\Temp\8993.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\89E1.tmp"C:\Users\Admin\AppData\Local\Temp\89E1.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\8B38.tmp"C:\Users\Admin\AppData\Local\Temp\8B38.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\8B87.tmp"C:\Users\Admin\AppData\Local\Temp\8B87.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\8C23.tmp"C:\Users\Admin\AppData\Local\Temp\8C23.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\8C71.tmp"C:\Users\Admin\AppData\Local\Temp\8C71.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\8E84.tmp"C:\Users\Admin\AppData\Local\Temp\8E84.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\8F40.tmp"C:\Users\Admin\AppData\Local\Temp\8F40.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"23⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"24⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\90A7.tmp"C:\Users\Admin\AppData\Local\Temp\90A7.tmp"25⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"26⤵
- Executes dropped EXE
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\9143.tmp"C:\Users\Admin\AppData\Local\Temp\9143.tmp"27⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\9191.tmp"C:\Users\Admin\AppData\Local\Temp\9191.tmp"28⤵
- Executes dropped EXE
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\91E0.tmp"C:\Users\Admin\AppData\Local\Temp\91E0.tmp"29⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\922E.tmp"C:\Users\Admin\AppData\Local\Temp\922E.tmp"30⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\927C.tmp"C:\Users\Admin\AppData\Local\Temp\927C.tmp"31⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\92CA.tmp"C:\Users\Admin\AppData\Local\Temp\92CA.tmp"32⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"33⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\9366.tmp"C:\Users\Admin\AppData\Local\Temp\9366.tmp"34⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\93A5.tmp"C:\Users\Admin\AppData\Local\Temp\93A5.tmp"35⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"36⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\9460.tmp"C:\Users\Admin\AppData\Local\Temp\9460.tmp"37⤵
- Executes dropped EXE
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\94AE.tmp"C:\Users\Admin\AppData\Local\Temp\94AE.tmp"38⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\94FC.tmp"C:\Users\Admin\AppData\Local\Temp\94FC.tmp"39⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"40⤵
- Executes dropped EXE
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\95C8.tmp"C:\Users\Admin\AppData\Local\Temp\95C8.tmp"41⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"42⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\9664.tmp"C:\Users\Admin\AppData\Local\Temp\9664.tmp"43⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"44⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\96F0.tmp"C:\Users\Admin\AppData\Local\Temp\96F0.tmp"45⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\972F.tmp"C:\Users\Admin\AppData\Local\Temp\972F.tmp"46⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\976D.tmp"C:\Users\Admin\AppData\Local\Temp\976D.tmp"47⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\97BC.tmp"C:\Users\Admin\AppData\Local\Temp\97BC.tmp"48⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"49⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"50⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\98A6.tmp"C:\Users\Admin\AppData\Local\Temp\98A6.tmp"51⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\98F4.tmp"C:\Users\Admin\AppData\Local\Temp\98F4.tmp"52⤵
- Executes dropped EXE
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\9942.tmp"C:\Users\Admin\AppData\Local\Temp\9942.tmp"53⤵
- Executes dropped EXE
PID:316 -
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"54⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"55⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"56⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"57⤵
- Executes dropped EXE
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"58⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"59⤵
- Executes dropped EXE
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"60⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"61⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"62⤵
- Executes dropped EXE
PID:808 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"63⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"64⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"65⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"66⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\9D78.tmp"C:\Users\Admin\AppData\Local\Temp\9D78.tmp"67⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"68⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"69⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"70⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"71⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"72⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"73⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"74⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"75⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"76⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"77⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"78⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"79⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"80⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"81⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\A180.tmp"C:\Users\Admin\AppData\Local\Temp\A180.tmp"82⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"83⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\A21C.tmp"C:\Users\Admin\AppData\Local\Temp\A21C.tmp"84⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"85⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\A299.tmp"C:\Users\Admin\AppData\Local\Temp\A299.tmp"86⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"87⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"88⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\A374.tmp"C:\Users\Admin\AppData\Local\Temp\A374.tmp"89⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"90⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"91⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\A43F.tmp"C:\Users\Admin\AppData\Local\Temp\A43F.tmp"92⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"93⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"94⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\A50A.tmp"C:\Users\Admin\AppData\Local\Temp\A50A.tmp"95⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"96⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"97⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"98⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\A642.tmp"C:\Users\Admin\AppData\Local\Temp\A642.tmp"99⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"100⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"101⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\A74C.tmp"C:\Users\Admin\AppData\Local\Temp\A74C.tmp"102⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"103⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"104⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"105⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"106⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"107⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"108⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"109⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"110⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"111⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\AB72.tmp"C:\Users\Admin\AppData\Local\Temp\AB72.tmp"112⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"113⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"114⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"115⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\AD18.tmp"C:\Users\Admin\AppData\Local\Temp\AD18.tmp"116⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"117⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"118⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\AE51.tmp"C:\Users\Admin\AppData\Local\Temp\AE51.tmp"119⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"120⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"121⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"122⤵PID:1116
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-