Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
20/06/2024, 14:11
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-20_aa8e99f0f37fe2f71614ebdb4f1531f8_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-20_aa8e99f0f37fe2f71614ebdb4f1531f8_mafia.exe
Resource
win10v2004-20240611-en
General
-
Target
2024-06-20_aa8e99f0f37fe2f71614ebdb4f1531f8_mafia.exe
-
Size
536KB
-
MD5
aa8e99f0f37fe2f71614ebdb4f1531f8
-
SHA1
ae21e152258bd5d7c02a836154ea393baf8f4fda
-
SHA256
c01e8e35f3012205a537ee10a829e0ddb752739602892f8462950787ceded0c8
-
SHA512
b6a71d03c27fcd18741d013a536ff459e795645a19b4bc15c32261015eef9cb55c6e303a8686da93939bcafcd2243b09dbd64d5e770e2e3bd95f14ac1feb4efd
-
SSDEEP
12288:wU5rCOTeiUUp6YOxtmLSaMu0OhvspXEZVaIZxVJ0ZT9:wUQOJUW6vtEMxYvT+IRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2572 29DF.tmp 3924 2A8A.tmp 3432 2AF8.tmp 4488 2B84.tmp 5004 2C30.tmp 2092 2CAD.tmp 1864 2D3A.tmp 4220 2DB7.tmp 4352 2E24.tmp 4188 2E92.tmp 2088 2EEF.tmp 5072 2F7C.tmp 4704 3018.tmp 2784 30A5.tmp 4252 3141.tmp 4840 319F.tmp 5012 31FD.tmp 896 3289.tmp 1636 3306.tmp 4472 33A3.tmp 2928 3400.tmp 4864 349D.tmp 4292 350A.tmp 4008 3597.tmp 844 3604.tmp 1852 3691.tmp 4920 370E.tmp 1600 378B.tmp 2084 3808.tmp 2864 3885.tmp 2196 3911.tmp 1824 39FC.tmp 1696 3A88.tmp 680 3B24.tmp 4844 3B92.tmp 3976 3C1E.tmp 1316 3C8C.tmp 2516 3CEA.tmp 4220 3D67.tmp 5080 3DC4.tmp 3220 3E32.tmp 2244 3E9F.tmp 3104 3F0C.tmp 2216 3F7A.tmp 1168 3FF7.tmp 2488 4045.tmp 4232 40B2.tmp 1520 4100.tmp 1184 414F.tmp 2820 419D.tmp 1260 41EB.tmp 932 4239.tmp 4596 4297.tmp 2404 42E5.tmp 1860 4333.tmp 728 4381.tmp 2904 43CF.tmp 860 441D.tmp 4496 448B.tmp 4120 44D9.tmp 3256 4527.tmp 980 4575.tmp 1464 45C3.tmp 3224 4611.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3704 wrote to memory of 2572 3704 2024-06-20_aa8e99f0f37fe2f71614ebdb4f1531f8_mafia.exe 82 PID 3704 wrote to memory of 2572 3704 2024-06-20_aa8e99f0f37fe2f71614ebdb4f1531f8_mafia.exe 82 PID 3704 wrote to memory of 2572 3704 2024-06-20_aa8e99f0f37fe2f71614ebdb4f1531f8_mafia.exe 82 PID 2572 wrote to memory of 3924 2572 29DF.tmp 83 PID 2572 wrote to memory of 3924 2572 29DF.tmp 83 PID 2572 wrote to memory of 3924 2572 29DF.tmp 83 PID 3924 wrote to memory of 3432 3924 2A8A.tmp 84 PID 3924 wrote to memory of 3432 3924 2A8A.tmp 84 PID 3924 wrote to memory of 3432 3924 2A8A.tmp 84 PID 3432 wrote to memory of 4488 3432 2AF8.tmp 85 PID 3432 wrote to memory of 4488 3432 2AF8.tmp 85 PID 3432 wrote to memory of 4488 3432 2AF8.tmp 85 PID 4488 wrote to memory of 5004 4488 2B84.tmp 88 PID 4488 wrote to memory of 5004 4488 2B84.tmp 88 PID 4488 wrote to memory of 5004 4488 2B84.tmp 88 PID 5004 wrote to memory of 2092 5004 2C30.tmp 90 PID 5004 wrote to memory of 2092 5004 2C30.tmp 90 PID 5004 wrote to memory of 2092 5004 2C30.tmp 90 PID 2092 wrote to memory of 1864 2092 2CAD.tmp 91 PID 2092 wrote to memory of 1864 2092 2CAD.tmp 91 PID 2092 wrote to memory of 1864 2092 2CAD.tmp 91 PID 1864 wrote to memory of 4220 1864 2D3A.tmp 92 PID 1864 wrote to memory of 4220 1864 2D3A.tmp 92 PID 1864 wrote to memory of 4220 1864 2D3A.tmp 92 PID 4220 wrote to memory of 4352 4220 2DB7.tmp 93 PID 4220 wrote to memory of 4352 4220 2DB7.tmp 93 PID 4220 wrote to memory of 4352 4220 2DB7.tmp 93 PID 4352 wrote to memory of 4188 4352 2E24.tmp 94 PID 4352 wrote to memory of 4188 4352 2E24.tmp 94 PID 4352 wrote to memory of 4188 4352 2E24.tmp 94 PID 4188 wrote to memory of 2088 4188 2E92.tmp 95 PID 4188 wrote to memory of 2088 4188 2E92.tmp 95 PID 4188 wrote to memory of 2088 4188 2E92.tmp 95 PID 2088 wrote to memory of 5072 2088 2EEF.tmp 96 PID 2088 wrote to memory of 5072 2088 2EEF.tmp 96 PID 2088 wrote to memory of 5072 2088 2EEF.tmp 96 PID 5072 wrote to memory of 4704 5072 2F7C.tmp 97 PID 5072 wrote to memory of 4704 5072 2F7C.tmp 97 PID 5072 wrote to memory of 4704 5072 2F7C.tmp 97 PID 4704 wrote to memory of 2784 4704 3018.tmp 98 PID 4704 wrote to memory of 2784 4704 3018.tmp 98 PID 4704 wrote to memory of 2784 4704 3018.tmp 98 PID 2784 wrote to memory of 4252 2784 30A5.tmp 99 PID 2784 wrote to memory of 4252 2784 30A5.tmp 99 PID 2784 wrote to memory of 4252 2784 30A5.tmp 99 PID 4252 wrote to memory of 4840 4252 3141.tmp 100 PID 4252 wrote to memory of 4840 4252 3141.tmp 100 PID 4252 wrote to memory of 4840 4252 3141.tmp 100 PID 4840 wrote to memory of 5012 4840 319F.tmp 101 PID 4840 wrote to memory of 5012 4840 319F.tmp 101 PID 4840 wrote to memory of 5012 4840 319F.tmp 101 PID 5012 wrote to memory of 896 5012 31FD.tmp 102 PID 5012 wrote to memory of 896 5012 31FD.tmp 102 PID 5012 wrote to memory of 896 5012 31FD.tmp 102 PID 896 wrote to memory of 1636 896 3289.tmp 103 PID 896 wrote to memory of 1636 896 3289.tmp 103 PID 896 wrote to memory of 1636 896 3289.tmp 103 PID 1636 wrote to memory of 4472 1636 3306.tmp 104 PID 1636 wrote to memory of 4472 1636 3306.tmp 104 PID 1636 wrote to memory of 4472 1636 3306.tmp 104 PID 4472 wrote to memory of 2928 4472 33A3.tmp 105 PID 4472 wrote to memory of 2928 4472 33A3.tmp 105 PID 4472 wrote to memory of 2928 4472 33A3.tmp 105 PID 2928 wrote to memory of 4864 2928 3400.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-20_aa8e99f0f37fe2f71614ebdb4f1531f8_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-20_aa8e99f0f37fe2f71614ebdb4f1531f8_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\29DF.tmp"C:\Users\Admin\AppData\Local\Temp\29DF.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\2AF8.tmp"C:\Users\Admin\AppData\Local\Temp\2AF8.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\2B84.tmp"C:\Users\Admin\AppData\Local\Temp\2B84.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\2C30.tmp"C:\Users\Admin\AppData\Local\Temp\2C30.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\2CAD.tmp"C:\Users\Admin\AppData\Local\Temp\2CAD.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\2D3A.tmp"C:\Users\Admin\AppData\Local\Temp\2D3A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\2DB7.tmp"C:\Users\Admin\AppData\Local\Temp\2DB7.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\2E24.tmp"C:\Users\Admin\AppData\Local\Temp\2E24.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\2E92.tmp"C:\Users\Admin\AppData\Local\Temp\2E92.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\2EEF.tmp"C:\Users\Admin\AppData\Local\Temp\2EEF.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\2F7C.tmp"C:\Users\Admin\AppData\Local\Temp\2F7C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\3018.tmp"C:\Users\Admin\AppData\Local\Temp\3018.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\30A5.tmp"C:\Users\Admin\AppData\Local\Temp\30A5.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\3141.tmp"C:\Users\Admin\AppData\Local\Temp\3141.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\319F.tmp"C:\Users\Admin\AppData\Local\Temp\319F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\31FD.tmp"C:\Users\Admin\AppData\Local\Temp\31FD.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\3289.tmp"C:\Users\Admin\AppData\Local\Temp\3289.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\AppData\Local\Temp\3306.tmp"C:\Users\Admin\AppData\Local\Temp\3306.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\33A3.tmp"C:\Users\Admin\AppData\Local\Temp\33A3.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\3400.tmp"C:\Users\Admin\AppData\Local\Temp\3400.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\349D.tmp"C:\Users\Admin\AppData\Local\Temp\349D.tmp"23⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\350A.tmp"C:\Users\Admin\AppData\Local\Temp\350A.tmp"24⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\3597.tmp"C:\Users\Admin\AppData\Local\Temp\3597.tmp"25⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\3604.tmp"C:\Users\Admin\AppData\Local\Temp\3604.tmp"26⤵
- Executes dropped EXE
PID:844 -
C:\Users\Admin\AppData\Local\Temp\3691.tmp"C:\Users\Admin\AppData\Local\Temp\3691.tmp"27⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\370E.tmp"C:\Users\Admin\AppData\Local\Temp\370E.tmp"28⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\378B.tmp"C:\Users\Admin\AppData\Local\Temp\378B.tmp"29⤵
- Executes dropped EXE
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\3808.tmp"C:\Users\Admin\AppData\Local\Temp\3808.tmp"30⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\3885.tmp"C:\Users\Admin\AppData\Local\Temp\3885.tmp"31⤵
- Executes dropped EXE
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\3911.tmp"C:\Users\Admin\AppData\Local\Temp\3911.tmp"32⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\399E.tmp"C:\Users\Admin\AppData\Local\Temp\399E.tmp"33⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\39FC.tmp"C:\Users\Admin\AppData\Local\Temp\39FC.tmp"34⤵
- Executes dropped EXE
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\3A88.tmp"C:\Users\Admin\AppData\Local\Temp\3A88.tmp"35⤵
- Executes dropped EXE
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\3B24.tmp"C:\Users\Admin\AppData\Local\Temp\3B24.tmp"36⤵
- Executes dropped EXE
PID:680 -
C:\Users\Admin\AppData\Local\Temp\3B92.tmp"C:\Users\Admin\AppData\Local\Temp\3B92.tmp"37⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"38⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"39⤵
- Executes dropped EXE
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"40⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\3D67.tmp"C:\Users\Admin\AppData\Local\Temp\3D67.tmp"41⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"42⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\3E32.tmp"C:\Users\Admin\AppData\Local\Temp\3E32.tmp"43⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"44⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"45⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"46⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"47⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\4045.tmp"C:\Users\Admin\AppData\Local\Temp\4045.tmp"48⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"49⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\4100.tmp"C:\Users\Admin\AppData\Local\Temp\4100.tmp"50⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\414F.tmp"C:\Users\Admin\AppData\Local\Temp\414F.tmp"51⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\419D.tmp"C:\Users\Admin\AppData\Local\Temp\419D.tmp"52⤵
- Executes dropped EXE
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\41EB.tmp"C:\Users\Admin\AppData\Local\Temp\41EB.tmp"53⤵
- Executes dropped EXE
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"54⤵
- Executes dropped EXE
PID:932 -
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"55⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"56⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"57⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"58⤵
- Executes dropped EXE
PID:728 -
C:\Users\Admin\AppData\Local\Temp\43CF.tmp"C:\Users\Admin\AppData\Local\Temp\43CF.tmp"59⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\441D.tmp"C:\Users\Admin\AppData\Local\Temp\441D.tmp"60⤵
- Executes dropped EXE
PID:860 -
C:\Users\Admin\AppData\Local\Temp\448B.tmp"C:\Users\Admin\AppData\Local\Temp\448B.tmp"61⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"62⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"63⤵
- Executes dropped EXE
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"64⤵
- Executes dropped EXE
PID:980 -
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"65⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"66⤵
- Executes dropped EXE
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"67⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"68⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"69⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"70⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"71⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"72⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"73⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"74⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"75⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"76⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"77⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"78⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"79⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"80⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"81⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"82⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"83⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"84⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"85⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"86⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"87⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"88⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"89⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"90⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"91⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"92⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"93⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"94⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"95⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"96⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"97⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"98⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"99⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"100⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"101⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"102⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"103⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"104⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"105⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"106⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"107⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"108⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"109⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"110⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"111⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"112⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"113⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"114⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"115⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"116⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"117⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"118⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"119⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"120⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"121⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"122⤵PID:3424
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-