Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
06/07/2024, 06:28
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-06_a05688b01b06d69b33e6161ca9d42553_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-07-06_a05688b01b06d69b33e6161ca9d42553_mafia.exe
Resource
win10v2004-20240704-en
General
-
Target
2024-07-06_a05688b01b06d69b33e6161ca9d42553_mafia.exe
-
Size
520KB
-
MD5
a05688b01b06d69b33e6161ca9d42553
-
SHA1
7c50dd97bf316ee9e7b420ceec2f717fee9bbefa
-
SHA256
8ca7397202919bb6e93b461725b572e727c779ce5b5e9631cd56476995f1fcc2
-
SHA512
a2d430e436814f7acbc62f4169e5036dbd53692167988786dc202373fc543556b7935ee2acea48a192d0d399c50fb33f004cb8bb1dfa287cd6baae63ee533fcf
-
SSDEEP
12288:gj8fuxR21t5i8fXYnSoijdwARCgdh8FTGkUO1wNZ:gj8fuK1GYonSDG+CgPMTVwN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1792 C081.tmp 1928 C0DF.tmp 4220 C15C.tmp 2608 C1C9.tmp 1368 C227.tmp 3248 C2A4.tmp 3944 C331.tmp 2732 C38E.tmp 696 C41B.tmp 4992 C488.tmp 1468 C4D6.tmp 2396 C544.tmp 4308 C5B1.tmp 1504 C61F.tmp 3920 C68C.tmp 900 C6EA.tmp 1060 C767.tmp 3708 C7C4.tmp 2808 C813.tmp 2880 C870.tmp 324 C8DE.tmp 400 C95B.tmp 1980 C9B8.tmp 412 CA07.tmp 208 CA64.tmp 4684 CAC2.tmp 2256 CB3F.tmp 1228 CBCC.tmp 1684 CC29.tmp 1512 CC97.tmp 4348 CCF5.tmp 4860 CD62.tmp 2504 CDB0.tmp 872 CDFE.tmp 3928 CE4C.tmp 2712 CE9A.tmp 3716 CEF8.tmp 4532 CF46.tmp 4564 CF94.tmp 3188 CFF2.tmp 1788 D050.tmp 5016 D0AE.tmp 3044 D0FC.tmp 4692 D15A.tmp 3432 D1A8.tmp 1484 D205.tmp 2240 D263.tmp 2408 D2B1.tmp 4452 D2FF.tmp 4424 D35D.tmp 4952 D3BB.tmp 2616 D409.tmp 4304 D467.tmp 5064 D4B5.tmp 2992 D513.tmp 3848 D570.tmp 1180 D5CE.tmp 2696 D61C.tmp 2812 D66A.tmp 2624 D6C8.tmp 4624 D726.tmp 4804 D774.tmp 2924 D7C2.tmp 2036 D810.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4952 wrote to memory of 1792 4952 2024-07-06_a05688b01b06d69b33e6161ca9d42553_mafia.exe 83 PID 4952 wrote to memory of 1792 4952 2024-07-06_a05688b01b06d69b33e6161ca9d42553_mafia.exe 83 PID 4952 wrote to memory of 1792 4952 2024-07-06_a05688b01b06d69b33e6161ca9d42553_mafia.exe 83 PID 1792 wrote to memory of 1928 1792 C081.tmp 85 PID 1792 wrote to memory of 1928 1792 C081.tmp 85 PID 1792 wrote to memory of 1928 1792 C081.tmp 85 PID 1928 wrote to memory of 4220 1928 C0DF.tmp 86 PID 1928 wrote to memory of 4220 1928 C0DF.tmp 86 PID 1928 wrote to memory of 4220 1928 C0DF.tmp 86 PID 4220 wrote to memory of 2608 4220 C15C.tmp 88 PID 4220 wrote to memory of 2608 4220 C15C.tmp 88 PID 4220 wrote to memory of 2608 4220 C15C.tmp 88 PID 2608 wrote to memory of 1368 2608 C1C9.tmp 89 PID 2608 wrote to memory of 1368 2608 C1C9.tmp 89 PID 2608 wrote to memory of 1368 2608 C1C9.tmp 89 PID 1368 wrote to memory of 3248 1368 C227.tmp 90 PID 1368 wrote to memory of 3248 1368 C227.tmp 90 PID 1368 wrote to memory of 3248 1368 C227.tmp 90 PID 3248 wrote to memory of 3944 3248 C2A4.tmp 91 PID 3248 wrote to memory of 3944 3248 C2A4.tmp 91 PID 3248 wrote to memory of 3944 3248 C2A4.tmp 91 PID 3944 wrote to memory of 2732 3944 C331.tmp 92 PID 3944 wrote to memory of 2732 3944 C331.tmp 92 PID 3944 wrote to memory of 2732 3944 C331.tmp 92 PID 2732 wrote to memory of 696 2732 C38E.tmp 93 PID 2732 wrote to memory of 696 2732 C38E.tmp 93 PID 2732 wrote to memory of 696 2732 C38E.tmp 93 PID 696 wrote to memory of 4992 696 C41B.tmp 94 PID 696 wrote to memory of 4992 696 C41B.tmp 94 PID 696 wrote to memory of 4992 696 C41B.tmp 94 PID 4992 wrote to memory of 1468 4992 C488.tmp 95 PID 4992 wrote to memory of 1468 4992 C488.tmp 95 PID 4992 wrote to memory of 1468 4992 C488.tmp 95 PID 1468 wrote to memory of 2396 1468 C4D6.tmp 96 PID 1468 wrote to memory of 2396 1468 C4D6.tmp 96 PID 1468 wrote to memory of 2396 1468 C4D6.tmp 96 PID 2396 wrote to memory of 4308 2396 C544.tmp 97 PID 2396 wrote to memory of 4308 2396 C544.tmp 97 PID 2396 wrote to memory of 4308 2396 C544.tmp 97 PID 4308 wrote to memory of 1504 4308 C5B1.tmp 98 PID 4308 wrote to memory of 1504 4308 C5B1.tmp 98 PID 4308 wrote to memory of 1504 4308 C5B1.tmp 98 PID 1504 wrote to memory of 3920 1504 C61F.tmp 99 PID 1504 wrote to memory of 3920 1504 C61F.tmp 99 PID 1504 wrote to memory of 3920 1504 C61F.tmp 99 PID 3920 wrote to memory of 900 3920 C68C.tmp 100 PID 3920 wrote to memory of 900 3920 C68C.tmp 100 PID 3920 wrote to memory of 900 3920 C68C.tmp 100 PID 900 wrote to memory of 1060 900 C6EA.tmp 101 PID 900 wrote to memory of 1060 900 C6EA.tmp 101 PID 900 wrote to memory of 1060 900 C6EA.tmp 101 PID 1060 wrote to memory of 3708 1060 C767.tmp 102 PID 1060 wrote to memory of 3708 1060 C767.tmp 102 PID 1060 wrote to memory of 3708 1060 C767.tmp 102 PID 3708 wrote to memory of 2808 3708 C7C4.tmp 103 PID 3708 wrote to memory of 2808 3708 C7C4.tmp 103 PID 3708 wrote to memory of 2808 3708 C7C4.tmp 103 PID 2808 wrote to memory of 2880 2808 C813.tmp 104 PID 2808 wrote to memory of 2880 2808 C813.tmp 104 PID 2808 wrote to memory of 2880 2808 C813.tmp 104 PID 2880 wrote to memory of 324 2880 C870.tmp 105 PID 2880 wrote to memory of 324 2880 C870.tmp 105 PID 2880 wrote to memory of 324 2880 C870.tmp 105 PID 324 wrote to memory of 400 324 C8DE.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_a05688b01b06d69b33e6161ca9d42553_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-06_a05688b01b06d69b33e6161ca9d42553_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\C331.tmp"C:\Users\Admin\AppData\Local\Temp\C331.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\C38E.tmp"C:\Users\Admin\AppData\Local\Temp\C38E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\C41B.tmp"C:\Users\Admin\AppData\Local\Temp\C41B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\AppData\Local\Temp\C488.tmp"C:\Users\Admin\AppData\Local\Temp\C488.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\C544.tmp"C:\Users\Admin\AppData\Local\Temp\C544.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\C61F.tmp"C:\Users\Admin\AppData\Local\Temp\C61F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\C68C.tmp"C:\Users\Admin\AppData\Local\Temp\C68C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\C6EA.tmp"C:\Users\Admin\AppData\Local\Temp\C6EA.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\C767.tmp"C:\Users\Admin\AppData\Local\Temp\C767.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\C813.tmp"C:\Users\Admin\AppData\Local\Temp\C813.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\C870.tmp"C:\Users\Admin\AppData\Local\Temp\C870.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Users\Admin\AppData\Local\Temp\C95B.tmp"C:\Users\Admin\AppData\Local\Temp\C95B.tmp"23⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"24⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\CA07.tmp"C:\Users\Admin\AppData\Local\Temp\CA07.tmp"25⤵
- Executes dropped EXE
PID:412 -
C:\Users\Admin\AppData\Local\Temp\CA64.tmp"C:\Users\Admin\AppData\Local\Temp\CA64.tmp"26⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\CAC2.tmp"C:\Users\Admin\AppData\Local\Temp\CAC2.tmp"27⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\CB3F.tmp"C:\Users\Admin\AppData\Local\Temp\CB3F.tmp"28⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"29⤵
- Executes dropped EXE
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\CC29.tmp"C:\Users\Admin\AppData\Local\Temp\CC29.tmp"30⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\CC97.tmp"C:\Users\Admin\AppData\Local\Temp\CC97.tmp"31⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"32⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\CD62.tmp"C:\Users\Admin\AppData\Local\Temp\CD62.tmp"33⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"34⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"35⤵
- Executes dropped EXE
PID:872 -
C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"36⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"37⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\CEF8.tmp"C:\Users\Admin\AppData\Local\Temp\CEF8.tmp"38⤵
- Executes dropped EXE
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\CF46.tmp"C:\Users\Admin\AppData\Local\Temp\CF46.tmp"39⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\CF94.tmp"C:\Users\Admin\AppData\Local\Temp\CF94.tmp"40⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\CFF2.tmp"C:\Users\Admin\AppData\Local\Temp\CFF2.tmp"41⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\D050.tmp"C:\Users\Admin\AppData\Local\Temp\D050.tmp"42⤵
- Executes dropped EXE
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"43⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\D0FC.tmp"C:\Users\Admin\AppData\Local\Temp\D0FC.tmp"44⤵
- Executes dropped EXE
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\D15A.tmp"C:\Users\Admin\AppData\Local\Temp\D15A.tmp"45⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\D1A8.tmp"C:\Users\Admin\AppData\Local\Temp\D1A8.tmp"46⤵
- Executes dropped EXE
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\D205.tmp"C:\Users\Admin\AppData\Local\Temp\D205.tmp"47⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\D263.tmp"C:\Users\Admin\AppData\Local\Temp\D263.tmp"48⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\D2B1.tmp"C:\Users\Admin\AppData\Local\Temp\D2B1.tmp"49⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\D2FF.tmp"C:\Users\Admin\AppData\Local\Temp\D2FF.tmp"50⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\D35D.tmp"C:\Users\Admin\AppData\Local\Temp\D35D.tmp"51⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"52⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\D409.tmp"C:\Users\Admin\AppData\Local\Temp\D409.tmp"53⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\D467.tmp"C:\Users\Admin\AppData\Local\Temp\D467.tmp"54⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\D4B5.tmp"C:\Users\Admin\AppData\Local\Temp\D4B5.tmp"55⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\D513.tmp"C:\Users\Admin\AppData\Local\Temp\D513.tmp"56⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\D570.tmp"C:\Users\Admin\AppData\Local\Temp\D570.tmp"57⤵
- Executes dropped EXE
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\D5CE.tmp"C:\Users\Admin\AppData\Local\Temp\D5CE.tmp"58⤵
- Executes dropped EXE
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\D61C.tmp"C:\Users\Admin\AppData\Local\Temp\D61C.tmp"59⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\D66A.tmp"C:\Users\Admin\AppData\Local\Temp\D66A.tmp"60⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"61⤵
- Executes dropped EXE
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\D726.tmp"C:\Users\Admin\AppData\Local\Temp\D726.tmp"62⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\D774.tmp"C:\Users\Admin\AppData\Local\Temp\D774.tmp"63⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\D7C2.tmp"C:\Users\Admin\AppData\Local\Temp\D7C2.tmp"64⤵
- Executes dropped EXE
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\D810.tmp"C:\Users\Admin\AppData\Local\Temp\D810.tmp"65⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\D85E.tmp"C:\Users\Admin\AppData\Local\Temp\D85E.tmp"66⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\D8AD.tmp"C:\Users\Admin\AppData\Local\Temp\D8AD.tmp"67⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\D90A.tmp"C:\Users\Admin\AppData\Local\Temp\D90A.tmp"68⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\D968.tmp"C:\Users\Admin\AppData\Local\Temp\D968.tmp"69⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"70⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\DA14.tmp"C:\Users\Admin\AppData\Local\Temp\DA14.tmp"71⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\DA72.tmp"C:\Users\Admin\AppData\Local\Temp\DA72.tmp"72⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\DACF.tmp"C:\Users\Admin\AppData\Local\Temp\DACF.tmp"73⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"74⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\DB7B.tmp"C:\Users\Admin\AppData\Local\Temp\DB7B.tmp"75⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\DBD9.tmp"C:\Users\Admin\AppData\Local\Temp\DBD9.tmp"76⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\DC37.tmp"C:\Users\Admin\AppData\Local\Temp\DC37.tmp"77⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\DC95.tmp"C:\Users\Admin\AppData\Local\Temp\DC95.tmp"78⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\DCE3.tmp"C:\Users\Admin\AppData\Local\Temp\DCE3.tmp"79⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\DD40.tmp"C:\Users\Admin\AppData\Local\Temp\DD40.tmp"80⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\DD9E.tmp"C:\Users\Admin\AppData\Local\Temp\DD9E.tmp"81⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"82⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\DE4A.tmp"C:\Users\Admin\AppData\Local\Temp\DE4A.tmp"83⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"84⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\DEF6.tmp"C:\Users\Admin\AppData\Local\Temp\DEF6.tmp"85⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\DF54.tmp"C:\Users\Admin\AppData\Local\Temp\DF54.tmp"86⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\DFA2.tmp"C:\Users\Admin\AppData\Local\Temp\DFA2.tmp"87⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"88⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\E03E.tmp"C:\Users\Admin\AppData\Local\Temp\E03E.tmp"89⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\E08C.tmp"C:\Users\Admin\AppData\Local\Temp\E08C.tmp"90⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"91⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\E138.tmp"C:\Users\Admin\AppData\Local\Temp\E138.tmp"92⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\E186.tmp"C:\Users\Admin\AppData\Local\Temp\E186.tmp"93⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\E1D4.tmp"C:\Users\Admin\AppData\Local\Temp\E1D4.tmp"94⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\E222.tmp"C:\Users\Admin\AppData\Local\Temp\E222.tmp"95⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\E271.tmp"C:\Users\Admin\AppData\Local\Temp\E271.tmp"96⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"97⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\E31C.tmp"C:\Users\Admin\AppData\Local\Temp\E31C.tmp"98⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\E37A.tmp"C:\Users\Admin\AppData\Local\Temp\E37A.tmp"99⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\E3D8.tmp"C:\Users\Admin\AppData\Local\Temp\E3D8.tmp"100⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\E436.tmp"C:\Users\Admin\AppData\Local\Temp\E436.tmp"101⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\E493.tmp"C:\Users\Admin\AppData\Local\Temp\E493.tmp"102⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\E4E2.tmp"C:\Users\Admin\AppData\Local\Temp\E4E2.tmp"103⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\E530.tmp"C:\Users\Admin\AppData\Local\Temp\E530.tmp"104⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\E57E.tmp"C:\Users\Admin\AppData\Local\Temp\E57E.tmp"105⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"106⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\E62A.tmp"C:\Users\Admin\AppData\Local\Temp\E62A.tmp"107⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\E678.tmp"C:\Users\Admin\AppData\Local\Temp\E678.tmp"108⤵PID:244
-
C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"109⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\E733.tmp"C:\Users\Admin\AppData\Local\Temp\E733.tmp"110⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\E791.tmp"C:\Users\Admin\AppData\Local\Temp\E791.tmp"111⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"112⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\E83D.tmp"C:\Users\Admin\AppData\Local\Temp\E83D.tmp"113⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\E89B.tmp"C:\Users\Admin\AppData\Local\Temp\E89B.tmp"114⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"115⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\E947.tmp"C:\Users\Admin\AppData\Local\Temp\E947.tmp"116⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\E995.tmp"C:\Users\Admin\AppData\Local\Temp\E995.tmp"117⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"118⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\EA50.tmp"C:\Users\Admin\AppData\Local\Temp\EA50.tmp"119⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\EA9E.tmp"C:\Users\Admin\AppData\Local\Temp\EA9E.tmp"120⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\EAFC.tmp"C:\Users\Admin\AppData\Local\Temp\EAFC.tmp"121⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\EB69.tmp"C:\Users\Admin\AppData\Local\Temp\EB69.tmp"122⤵PID:3220
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-