Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/07/2024, 10:53
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-01_3fa5a8d0e534805091dabf321e09aa7d_mafia.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2024-07-01_3fa5a8d0e534805091dabf321e09aa7d_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-07-01_3fa5a8d0e534805091dabf321e09aa7d_mafia.exe
-
Size
487KB
-
MD5
3fa5a8d0e534805091dabf321e09aa7d
-
SHA1
44e51b2dc73f2bd41ae1721911c29ecea784e240
-
SHA256
b0dd2ca2b252a9695c8b3cc0060bf965bc34e722a80087e0be480d69abc2384c
-
SHA512
7e7d64db942dace083d163ef58de75dde1e2dccd4c5408ded40375533ca3791f72bd82ebfb8a0915b9e605bb9ab8567b71098ff0ad9454b65cab3e5f72b156dc
-
SSDEEP
6144:qorf3lPvovsgZnqG2C7mOTeiL9DUBcyKDdpIzJ6N5xeOn/J0IHCFBIOkYXcPsH3j:HU5rCOTeiJEuQzJKneOnGIHCFiP0NZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1656 4BCE.tmp 4792 4C5B.tmp 3872 4CC8.tmp 220 4D55.tmp 1108 4DC2.tmp 2844 4E20.tmp 3036 4E8D.tmp 208 4EDB.tmp 224 4F39.tmp 4564 4F97.tmp 2964 4FF5.tmp 4732 5052.tmp 2028 50A0.tmp 3716 510E.tmp 2956 515C.tmp 4828 51AA.tmp 5012 5227.tmp 4736 5285.tmp 5004 52E3.tmp 2108 5340.tmp 1876 538E.tmp 920 541B.tmp 3728 5479.tmp 4900 54D7.tmp 1832 5544.tmp 4536 5592.tmp 4104 55E0.tmp 2092 563E.tmp 2556 568C.tmp 400 56DA.tmp 1408 5728.tmp 544 57A5.tmp 1536 5803.tmp 4404 5851.tmp 4384 58BF.tmp 1472 590D.tmp 2708 595B.tmp 5044 59A9.tmp 2812 5A36.tmp 2516 5A84.tmp 2372 5AE1.tmp 2772 5B6E.tmp 2748 5BFB.tmp 3464 5CB6.tmp 2324 5D14.tmp 2828 5D81.tmp 3032 5DEF.tmp 3408 5E5C.tmp 1492 5EF8.tmp 4768 5F66.tmp 2392 5FC3.tmp 5096 6031.tmp 3480 607F.tmp 1524 60DD.tmp 1692 614A.tmp 4392 61C7.tmp 2608 6225.tmp 4872 6273.tmp 4512 62D1.tmp 2308 631F.tmp 4284 636D.tmp 4808 63CB.tmp 2968 6419.tmp 4560 6467.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1340 wrote to memory of 1656 1340 2024-07-01_3fa5a8d0e534805091dabf321e09aa7d_mafia.exe 81 PID 1340 wrote to memory of 1656 1340 2024-07-01_3fa5a8d0e534805091dabf321e09aa7d_mafia.exe 81 PID 1340 wrote to memory of 1656 1340 2024-07-01_3fa5a8d0e534805091dabf321e09aa7d_mafia.exe 81 PID 1656 wrote to memory of 4792 1656 4BCE.tmp 82 PID 1656 wrote to memory of 4792 1656 4BCE.tmp 82 PID 1656 wrote to memory of 4792 1656 4BCE.tmp 82 PID 4792 wrote to memory of 3872 4792 4C5B.tmp 83 PID 4792 wrote to memory of 3872 4792 4C5B.tmp 83 PID 4792 wrote to memory of 3872 4792 4C5B.tmp 83 PID 3872 wrote to memory of 220 3872 4CC8.tmp 84 PID 3872 wrote to memory of 220 3872 4CC8.tmp 84 PID 3872 wrote to memory of 220 3872 4CC8.tmp 84 PID 220 wrote to memory of 1108 220 4D55.tmp 85 PID 220 wrote to memory of 1108 220 4D55.tmp 85 PID 220 wrote to memory of 1108 220 4D55.tmp 85 PID 1108 wrote to memory of 2844 1108 4DC2.tmp 86 PID 1108 wrote to memory of 2844 1108 4DC2.tmp 86 PID 1108 wrote to memory of 2844 1108 4DC2.tmp 86 PID 2844 wrote to memory of 3036 2844 4E20.tmp 87 PID 2844 wrote to memory of 3036 2844 4E20.tmp 87 PID 2844 wrote to memory of 3036 2844 4E20.tmp 87 PID 3036 wrote to memory of 208 3036 4E8D.tmp 88 PID 3036 wrote to memory of 208 3036 4E8D.tmp 88 PID 3036 wrote to memory of 208 3036 4E8D.tmp 88 PID 208 wrote to memory of 224 208 4EDB.tmp 89 PID 208 wrote to memory of 224 208 4EDB.tmp 89 PID 208 wrote to memory of 224 208 4EDB.tmp 89 PID 224 wrote to memory of 4564 224 4F39.tmp 90 PID 224 wrote to memory of 4564 224 4F39.tmp 90 PID 224 wrote to memory of 4564 224 4F39.tmp 90 PID 4564 wrote to memory of 2964 4564 4F97.tmp 91 PID 4564 wrote to memory of 2964 4564 4F97.tmp 91 PID 4564 wrote to memory of 2964 4564 4F97.tmp 91 PID 2964 wrote to memory of 4732 2964 4FF5.tmp 92 PID 2964 wrote to memory of 4732 2964 4FF5.tmp 92 PID 2964 wrote to memory of 4732 2964 4FF5.tmp 92 PID 4732 wrote to memory of 2028 4732 5052.tmp 93 PID 4732 wrote to memory of 2028 4732 5052.tmp 93 PID 4732 wrote to memory of 2028 4732 5052.tmp 93 PID 2028 wrote to memory of 3716 2028 50A0.tmp 94 PID 2028 wrote to memory of 3716 2028 50A0.tmp 94 PID 2028 wrote to memory of 3716 2028 50A0.tmp 94 PID 3716 wrote to memory of 2956 3716 510E.tmp 95 PID 3716 wrote to memory of 2956 3716 510E.tmp 95 PID 3716 wrote to memory of 2956 3716 510E.tmp 95 PID 2956 wrote to memory of 4828 2956 515C.tmp 96 PID 2956 wrote to memory of 4828 2956 515C.tmp 96 PID 2956 wrote to memory of 4828 2956 515C.tmp 96 PID 4828 wrote to memory of 5012 4828 51AA.tmp 97 PID 4828 wrote to memory of 5012 4828 51AA.tmp 97 PID 4828 wrote to memory of 5012 4828 51AA.tmp 97 PID 5012 wrote to memory of 4736 5012 5227.tmp 98 PID 5012 wrote to memory of 4736 5012 5227.tmp 98 PID 5012 wrote to memory of 4736 5012 5227.tmp 98 PID 4736 wrote to memory of 5004 4736 5285.tmp 99 PID 4736 wrote to memory of 5004 4736 5285.tmp 99 PID 4736 wrote to memory of 5004 4736 5285.tmp 99 PID 5004 wrote to memory of 2108 5004 52E3.tmp 100 PID 5004 wrote to memory of 2108 5004 52E3.tmp 100 PID 5004 wrote to memory of 2108 5004 52E3.tmp 100 PID 2108 wrote to memory of 1876 2108 5340.tmp 101 PID 2108 wrote to memory of 1876 2108 5340.tmp 101 PID 2108 wrote to memory of 1876 2108 5340.tmp 101 PID 1876 wrote to memory of 920 1876 538E.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-01_3fa5a8d0e534805091dabf321e09aa7d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-01_3fa5a8d0e534805091dabf321e09aa7d_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"23⤵
- Executes dropped EXE
PID:920 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"24⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"25⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"26⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"27⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"28⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"29⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"30⤵
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"31⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"32⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"33⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"34⤵
- Executes dropped EXE
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"35⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"36⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"37⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"38⤵
- Executes dropped EXE
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"39⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"40⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"41⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"42⤵
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"43⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"44⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"45⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"46⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"47⤵
- Executes dropped EXE
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"48⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"49⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"50⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"51⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"52⤵
- Executes dropped EXE
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"53⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"54⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"55⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"56⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"57⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"58⤵
- Executes dropped EXE
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"59⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"60⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"61⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"62⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"63⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"64⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"65⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"66⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"67⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"68⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"69⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"70⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"71⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"72⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"73⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\6745.tmp"C:\Users\Admin\AppData\Local\Temp\6745.tmp"74⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"75⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"76⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"77⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"78⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"79⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"80⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"81⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"82⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"83⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"84⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"85⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"86⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"87⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"88⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"89⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"90⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"91⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"92⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"93⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"94⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"95⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"96⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"97⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"98⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"99⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"100⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"101⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\70DA.tmp"C:\Users\Admin\AppData\Local\Temp\70DA.tmp"102⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"103⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"104⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"105⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\7232.tmp"C:\Users\Admin\AppData\Local\Temp\7232.tmp"106⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"107⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"108⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"109⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"110⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"111⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\7445.tmp"C:\Users\Admin\AppData\Local\Temp\7445.tmp"112⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"113⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\74F1.tmp"C:\Users\Admin\AppData\Local\Temp\74F1.tmp"114⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\754F.tmp"C:\Users\Admin\AppData\Local\Temp\754F.tmp"115⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"116⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"117⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\7659.tmp"C:\Users\Admin\AppData\Local\Temp\7659.tmp"118⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"119⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\7705.tmp"C:\Users\Admin\AppData\Local\Temp\7705.tmp"120⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\7753.tmp"C:\Users\Admin\AppData\Local\Temp\7753.tmp"121⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\77B0.tmp"C:\Users\Admin\AppData\Local\Temp\77B0.tmp"122⤵PID:2912
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-