Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
01/07/2024, 06:51
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-01_3f4a8b52be6544d48d613d426b4dc7c3_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-07-01_3f4a8b52be6544d48d613d426b4dc7c3_mafia.exe
Resource
win10v2004-20240611-en
General
-
Target
2024-07-01_3f4a8b52be6544d48d613d426b4dc7c3_mafia.exe
-
Size
488KB
-
MD5
3f4a8b52be6544d48d613d426b4dc7c3
-
SHA1
5b998ee60ac2ba926f048186911468967eb2ee1f
-
SHA256
0a278c887eb3fd0c705c647e8ac5a5eaabbe8a1d4b6f60d0ff3546213157416a
-
SHA512
e58bfcf1d96b9ebfc552689358c02385befde2fbe019b8da5f48f0c7a83f444f0f8680aceec174b94aceac149966b535198cc8edaffdd788014afab68bc99ec7
-
SSDEEP
12288:/U5rCOTeiD9gg5HbQza/CZ+2F3UCQSAc5ANZ:/UQOJD9ggFbQ2vWNeN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3008 3326.tmp 776 33A3.tmp 1108 3400.tmp 760 347D.tmp 3740 34FA.tmp 4384 3558.tmp 3324 35C5.tmp 2420 3642.tmp 4552 36B0.tmp 1588 371D.tmp 4376 377B.tmp 3448 37E8.tmp 2224 3846.tmp 1056 38A4.tmp 4048 3902.tmp 2272 396F.tmp 1112 39EC.tmp 4516 3A4A.tmp 2588 3A98.tmp 4044 3AE6.tmp 1576 3B44.tmp 1660 3BA1.tmp 1016 3BFF.tmp 2652 3C5D.tmp 4744 3CDA.tmp 1176 3D28.tmp 2416 3D86.tmp 4248 3E03.tmp 4624 3E61.tmp 4168 3ECE.tmp 4740 3F3B.tmp 3124 3FA9.tmp 2836 4006.tmp 4472 4064.tmp 1464 40C2.tmp 1552 4110.tmp 3408 416E.tmp 4912 41FA.tmp 1380 4258.tmp 2492 42B6.tmp 3052 4314.tmp 2176 4381.tmp 760 43DF.tmp 4828 443D.tmp 1424 449A.tmp 4668 4527.tmp 5016 4585.tmp 3668 45E2.tmp 2404 4640.tmp 3344 469E.tmp 3084 46FC.tmp 4552 4759.tmp 1588 47B7.tmp 4536 4815.tmp 2656 4873.tmp 2464 48D0.tmp 3104 492E.tmp 392 498C.tmp 2672 49EA.tmp 2980 4A47.tmp 4932 4AA5.tmp 3964 4B03.tmp 932 4B51.tmp 2588 4BAF.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4724 wrote to memory of 3008 4724 2024-07-01_3f4a8b52be6544d48d613d426b4dc7c3_mafia.exe 82 PID 4724 wrote to memory of 3008 4724 2024-07-01_3f4a8b52be6544d48d613d426b4dc7c3_mafia.exe 82 PID 4724 wrote to memory of 3008 4724 2024-07-01_3f4a8b52be6544d48d613d426b4dc7c3_mafia.exe 82 PID 3008 wrote to memory of 776 3008 3326.tmp 83 PID 3008 wrote to memory of 776 3008 3326.tmp 83 PID 3008 wrote to memory of 776 3008 3326.tmp 83 PID 776 wrote to memory of 1108 776 33A3.tmp 84 PID 776 wrote to memory of 1108 776 33A3.tmp 84 PID 776 wrote to memory of 1108 776 33A3.tmp 84 PID 1108 wrote to memory of 760 1108 3400.tmp 85 PID 1108 wrote to memory of 760 1108 3400.tmp 85 PID 1108 wrote to memory of 760 1108 3400.tmp 85 PID 760 wrote to memory of 3740 760 347D.tmp 87 PID 760 wrote to memory of 3740 760 347D.tmp 87 PID 760 wrote to memory of 3740 760 347D.tmp 87 PID 3740 wrote to memory of 4384 3740 34FA.tmp 89 PID 3740 wrote to memory of 4384 3740 34FA.tmp 89 PID 3740 wrote to memory of 4384 3740 34FA.tmp 89 PID 4384 wrote to memory of 3324 4384 3558.tmp 90 PID 4384 wrote to memory of 3324 4384 3558.tmp 90 PID 4384 wrote to memory of 3324 4384 3558.tmp 90 PID 3324 wrote to memory of 2420 3324 35C5.tmp 92 PID 3324 wrote to memory of 2420 3324 35C5.tmp 92 PID 3324 wrote to memory of 2420 3324 35C5.tmp 92 PID 2420 wrote to memory of 4552 2420 3642.tmp 93 PID 2420 wrote to memory of 4552 2420 3642.tmp 93 PID 2420 wrote to memory of 4552 2420 3642.tmp 93 PID 4552 wrote to memory of 1588 4552 36B0.tmp 94 PID 4552 wrote to memory of 1588 4552 36B0.tmp 94 PID 4552 wrote to memory of 1588 4552 36B0.tmp 94 PID 1588 wrote to memory of 4376 1588 371D.tmp 95 PID 1588 wrote to memory of 4376 1588 371D.tmp 95 PID 1588 wrote to memory of 4376 1588 371D.tmp 95 PID 4376 wrote to memory of 3448 4376 377B.tmp 96 PID 4376 wrote to memory of 3448 4376 377B.tmp 96 PID 4376 wrote to memory of 3448 4376 377B.tmp 96 PID 3448 wrote to memory of 2224 3448 37E8.tmp 97 PID 3448 wrote to memory of 2224 3448 37E8.tmp 97 PID 3448 wrote to memory of 2224 3448 37E8.tmp 97 PID 2224 wrote to memory of 1056 2224 3846.tmp 98 PID 2224 wrote to memory of 1056 2224 3846.tmp 98 PID 2224 wrote to memory of 1056 2224 3846.tmp 98 PID 1056 wrote to memory of 4048 1056 38A4.tmp 99 PID 1056 wrote to memory of 4048 1056 38A4.tmp 99 PID 1056 wrote to memory of 4048 1056 38A4.tmp 99 PID 4048 wrote to memory of 2272 4048 3902.tmp 100 PID 4048 wrote to memory of 2272 4048 3902.tmp 100 PID 4048 wrote to memory of 2272 4048 3902.tmp 100 PID 2272 wrote to memory of 1112 2272 396F.tmp 101 PID 2272 wrote to memory of 1112 2272 396F.tmp 101 PID 2272 wrote to memory of 1112 2272 396F.tmp 101 PID 1112 wrote to memory of 4516 1112 39EC.tmp 102 PID 1112 wrote to memory of 4516 1112 39EC.tmp 102 PID 1112 wrote to memory of 4516 1112 39EC.tmp 102 PID 4516 wrote to memory of 2588 4516 3A4A.tmp 103 PID 4516 wrote to memory of 2588 4516 3A4A.tmp 103 PID 4516 wrote to memory of 2588 4516 3A4A.tmp 103 PID 2588 wrote to memory of 4044 2588 3A98.tmp 104 PID 2588 wrote to memory of 4044 2588 3A98.tmp 104 PID 2588 wrote to memory of 4044 2588 3A98.tmp 104 PID 4044 wrote to memory of 1576 4044 3AE6.tmp 107 PID 4044 wrote to memory of 1576 4044 3AE6.tmp 107 PID 4044 wrote to memory of 1576 4044 3AE6.tmp 107 PID 1576 wrote to memory of 1660 1576 3B44.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-01_3f4a8b52be6544d48d613d426b4dc7c3_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-01_3f4a8b52be6544d48d613d426b4dc7c3_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\3326.tmp"C:\Users\Admin\AppData\Local\Temp\3326.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\33A3.tmp"C:\Users\Admin\AppData\Local\Temp\33A3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Users\Admin\AppData\Local\Temp\3400.tmp"C:\Users\Admin\AppData\Local\Temp\3400.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\347D.tmp"C:\Users\Admin\AppData\Local\Temp\347D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\34FA.tmp"C:\Users\Admin\AppData\Local\Temp\34FA.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\3558.tmp"C:\Users\Admin\AppData\Local\Temp\3558.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\35C5.tmp"C:\Users\Admin\AppData\Local\Temp\35C5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\3642.tmp"C:\Users\Admin\AppData\Local\Temp\3642.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\36B0.tmp"C:\Users\Admin\AppData\Local\Temp\36B0.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\371D.tmp"C:\Users\Admin\AppData\Local\Temp\371D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\377B.tmp"C:\Users\Admin\AppData\Local\Temp\377B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\37E8.tmp"C:\Users\Admin\AppData\Local\Temp\37E8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\3846.tmp"C:\Users\Admin\AppData\Local\Temp\3846.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\38A4.tmp"C:\Users\Admin\AppData\Local\Temp\38A4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\3902.tmp"C:\Users\Admin\AppData\Local\Temp\3902.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\396F.tmp"C:\Users\Admin\AppData\Local\Temp\396F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\39EC.tmp"C:\Users\Admin\AppData\Local\Temp\39EC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\3A98.tmp"C:\Users\Admin\AppData\Local\Temp\3A98.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\3B44.tmp"C:\Users\Admin\AppData\Local\Temp\3B44.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"23⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"24⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"25⤵
- Executes dropped EXE
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"26⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\3D28.tmp"C:\Users\Admin\AppData\Local\Temp\3D28.tmp"27⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\3D86.tmp"C:\Users\Admin\AppData\Local\Temp\3D86.tmp"28⤵
- Executes dropped EXE
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\3E03.tmp"C:\Users\Admin\AppData\Local\Temp\3E03.tmp"29⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\3E61.tmp"C:\Users\Admin\AppData\Local\Temp\3E61.tmp"30⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"31⤵
- Executes dropped EXE
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\3F3B.tmp"C:\Users\Admin\AppData\Local\Temp\3F3B.tmp"32⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"33⤵
- Executes dropped EXE
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\4006.tmp"C:\Users\Admin\AppData\Local\Temp\4006.tmp"34⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\4064.tmp"C:\Users\Admin\AppData\Local\Temp\4064.tmp"35⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\40C2.tmp"C:\Users\Admin\AppData\Local\Temp\40C2.tmp"36⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\4110.tmp"C:\Users\Admin\AppData\Local\Temp\4110.tmp"37⤵
- Executes dropped EXE
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\416E.tmp"C:\Users\Admin\AppData\Local\Temp\416E.tmp"38⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"39⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\4258.tmp"C:\Users\Admin\AppData\Local\Temp\4258.tmp"40⤵
- Executes dropped EXE
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\42B6.tmp"C:\Users\Admin\AppData\Local\Temp\42B6.tmp"41⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\4314.tmp"C:\Users\Admin\AppData\Local\Temp\4314.tmp"42⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"43⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"44⤵
- Executes dropped EXE
PID:760 -
C:\Users\Admin\AppData\Local\Temp\443D.tmp"C:\Users\Admin\AppData\Local\Temp\443D.tmp"45⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"46⤵
- Executes dropped EXE
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"47⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"48⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"49⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"50⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"51⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"52⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"53⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"54⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"55⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"56⤵
- Executes dropped EXE
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"57⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"58⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"59⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"60⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"61⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"62⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"63⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"64⤵
- Executes dropped EXE
PID:932 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"65⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"66⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"67⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"68⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"69⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"70⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"71⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"72⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"73⤵PID:508
-
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"74⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"75⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"76⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"77⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"78⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"79⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"80⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"81⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"82⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"83⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"84⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"85⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"86⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"87⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"88⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"89⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"90⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"91⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"92⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"93⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"94⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"95⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"96⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"97⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"98⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"99⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"100⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"101⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"102⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"103⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"104⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"105⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"106⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"107⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"108⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"109⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"110⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"111⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"112⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"113⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"114⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"115⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"116⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"117⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"118⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"119⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"120⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"121⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"122⤵PID:3684
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-