Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
171s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
05/01/2024, 05:41
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-01_3bac51c6344de58b64937a9b6787cdf2_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-01_3bac51c6344de58b64937a9b6787cdf2_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-01_3bac51c6344de58b64937a9b6787cdf2_mafia.exe
-
Size
486KB
-
MD5
3bac51c6344de58b64937a9b6787cdf2
-
SHA1
d4b51ce1be37f24b8ca624e495a9538bba51de7d
-
SHA256
66bb67e9088ab9ef6f9406935d069c24bb211f57bd605784cf93b7e1e6b893b4
-
SHA512
f27e47c3237e32cc98f990e034bd6258e0d4bd72e39c74237d7e36756ab4fe0ba6bcf1410b66cf7113c6afcc7a3bde3971e08c17cc20c80da2ea8e51d8a864fd
-
SSDEEP
12288:oU5rCOTeiDn1xIqQbhQ804U8CJMozmSi3U3NZ:oUQOJDYqMhQ8l6J29WN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1832 81DD.tmp 2748 8940.tmp 1992 8BB1.tmp 3424 8C6C.tmp 3136 8DA5.tmp 4232 8E51.tmp 3192 8EED.tmp 1640 8FB8.tmp 1824 91CB.tmp 4864 9371.tmp 4000 98A1.tmp 3684 9AF3.tmp 1980 9D06.tmp 3476 9E8D.tmp 4352 9F29.tmp 3604 A0A0.tmp 4612 A1E8.tmp 1344 A39E.tmp 1392 A7E3.tmp 1148 A90C.tmp 496 A989.tmp 5020 AC87.tmp 4048 AFF2.tmp 1972 B1B7.tmp 1984 B2FF.tmp 3948 B551.tmp 2564 B5DE.tmp 3236 B6A9.tmp 1604 B86E.tmp 4440 BAA0.tmp 1644 BC75.tmp 1512 BD21.tmp 1732 BDAE.tmp 1412 BF15.tmp 3424 BF82.tmp 1796 C119.tmp 1936 C56E.tmp 3360 CA9E.tmp 660 CC73.tmp 5064 CDBB.tmp 1640 CFAF.tmp 1768 D02C.tmp 220 D136.tmp 5008 D1B3.tmp 884 D2BC.tmp 224 D358.tmp 4864 D6A4.tmp 4000 D76F.tmp 3968 D954.tmp 2348 D9C1.tmp 1944 DA3E.tmp 4504 DB96.tmp 3660 DC13.tmp 4400 DC71.tmp 3904 DE45.tmp 1960 E0D6.tmp 3604 E162.tmp 1268 E2CA.tmp 1072 E337.tmp 888 E46F.tmp 4736 E75D.tmp 2072 E7EA.tmp 4700 E867.tmp 3608 EB45.tmp -
Loads dropped DLL 1 IoCs
pid Process 2940 136A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3140 wrote to memory of 1832 3140 2024-01-01_3bac51c6344de58b64937a9b6787cdf2_mafia.exe 94 PID 3140 wrote to memory of 1832 3140 2024-01-01_3bac51c6344de58b64937a9b6787cdf2_mafia.exe 94 PID 3140 wrote to memory of 1832 3140 2024-01-01_3bac51c6344de58b64937a9b6787cdf2_mafia.exe 94 PID 1832 wrote to memory of 2748 1832 81DD.tmp 96 PID 1832 wrote to memory of 2748 1832 81DD.tmp 96 PID 1832 wrote to memory of 2748 1832 81DD.tmp 96 PID 2748 wrote to memory of 1992 2748 8940.tmp 97 PID 2748 wrote to memory of 1992 2748 8940.tmp 97 PID 2748 wrote to memory of 1992 2748 8940.tmp 97 PID 1992 wrote to memory of 3424 1992 8BB1.tmp 98 PID 1992 wrote to memory of 3424 1992 8BB1.tmp 98 PID 1992 wrote to memory of 3424 1992 8BB1.tmp 98 PID 3424 wrote to memory of 3136 3424 8C6C.tmp 99 PID 3424 wrote to memory of 3136 3424 8C6C.tmp 99 PID 3424 wrote to memory of 3136 3424 8C6C.tmp 99 PID 3136 wrote to memory of 4232 3136 8DA5.tmp 100 PID 3136 wrote to memory of 4232 3136 8DA5.tmp 100 PID 3136 wrote to memory of 4232 3136 8DA5.tmp 100 PID 4232 wrote to memory of 3192 4232 8E51.tmp 101 PID 4232 wrote to memory of 3192 4232 8E51.tmp 101 PID 4232 wrote to memory of 3192 4232 8E51.tmp 101 PID 3192 wrote to memory of 1640 3192 8EED.tmp 102 PID 3192 wrote to memory of 1640 3192 8EED.tmp 102 PID 3192 wrote to memory of 1640 3192 8EED.tmp 102 PID 1640 wrote to memory of 1824 1640 8FB8.tmp 103 PID 1640 wrote to memory of 1824 1640 8FB8.tmp 103 PID 1640 wrote to memory of 1824 1640 8FB8.tmp 103 PID 1824 wrote to memory of 4864 1824 91CB.tmp 105 PID 1824 wrote to memory of 4864 1824 91CB.tmp 105 PID 1824 wrote to memory of 4864 1824 91CB.tmp 105 PID 4864 wrote to memory of 4000 4864 9371.tmp 106 PID 4864 wrote to memory of 4000 4864 9371.tmp 106 PID 4864 wrote to memory of 4000 4864 9371.tmp 106 PID 4000 wrote to memory of 3684 4000 98A1.tmp 107 PID 4000 wrote to memory of 3684 4000 98A1.tmp 107 PID 4000 wrote to memory of 3684 4000 98A1.tmp 107 PID 3684 wrote to memory of 1980 3684 9AF3.tmp 108 PID 3684 wrote to memory of 1980 3684 9AF3.tmp 108 PID 3684 wrote to memory of 1980 3684 9AF3.tmp 108 PID 1980 wrote to memory of 3476 1980 9D06.tmp 109 PID 1980 wrote to memory of 3476 1980 9D06.tmp 109 PID 1980 wrote to memory of 3476 1980 9D06.tmp 109 PID 3476 wrote to memory of 4352 3476 9E8D.tmp 110 PID 3476 wrote to memory of 4352 3476 9E8D.tmp 110 PID 3476 wrote to memory of 4352 3476 9E8D.tmp 110 PID 4352 wrote to memory of 3604 4352 9F29.tmp 111 PID 4352 wrote to memory of 3604 4352 9F29.tmp 111 PID 4352 wrote to memory of 3604 4352 9F29.tmp 111 PID 3604 wrote to memory of 4612 3604 A0A0.tmp 112 PID 3604 wrote to memory of 4612 3604 A0A0.tmp 112 PID 3604 wrote to memory of 4612 3604 A0A0.tmp 112 PID 4612 wrote to memory of 1344 4612 A1E8.tmp 113 PID 4612 wrote to memory of 1344 4612 A1E8.tmp 113 PID 4612 wrote to memory of 1344 4612 A1E8.tmp 113 PID 1344 wrote to memory of 1392 1344 A39E.tmp 114 PID 1344 wrote to memory of 1392 1344 A39E.tmp 114 PID 1344 wrote to memory of 1392 1344 A39E.tmp 114 PID 1392 wrote to memory of 1148 1392 A7E3.tmp 115 PID 1392 wrote to memory of 1148 1392 A7E3.tmp 115 PID 1392 wrote to memory of 1148 1392 A7E3.tmp 115 PID 1148 wrote to memory of 496 1148 A90C.tmp 116 PID 1148 wrote to memory of 496 1148 A90C.tmp 116 PID 1148 wrote to memory of 496 1148 A90C.tmp 116 PID 496 wrote to memory of 5020 496 A989.tmp 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-01_3bac51c6344de58b64937a9b6787cdf2_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-01_3bac51c6344de58b64937a9b6787cdf2_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\81DD.tmp"C:\Users\Admin\AppData\Local\Temp\81DD.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\8940.tmp"C:\Users\Admin\AppData\Local\Temp\8940.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\8BB1.tmp"C:\Users\Admin\AppData\Local\Temp\8BB1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\8C6C.tmp"C:\Users\Admin\AppData\Local\Temp\8C6C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\8DA5.tmp"C:\Users\Admin\AppData\Local\Temp\8DA5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\8E51.tmp"C:\Users\Admin\AppData\Local\Temp\8E51.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\8EED.tmp"C:\Users\Admin\AppData\Local\Temp\8EED.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\8FB8.tmp"C:\Users\Admin\AppData\Local\Temp\8FB8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\91CB.tmp"C:\Users\Admin\AppData\Local\Temp\91CB.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\9371.tmp"C:\Users\Admin\AppData\Local\Temp\9371.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\98A1.tmp"C:\Users\Admin\AppData\Local\Temp\98A1.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\9AF3.tmp"C:\Users\Admin\AppData\Local\Temp\9AF3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\9D06.tmp"C:\Users\Admin\AppData\Local\Temp\9D06.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\9E8D.tmp"C:\Users\Admin\AppData\Local\Temp\9E8D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\9F29.tmp"C:\Users\Admin\AppData\Local\Temp\9F29.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\A0A0.tmp"C:\Users\Admin\AppData\Local\Temp\A0A0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\A1E8.tmp"C:\Users\Admin\AppData\Local\Temp\A1E8.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\A39E.tmp"C:\Users\Admin\AppData\Local\Temp\A39E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\A7E3.tmp"C:\Users\Admin\AppData\Local\Temp\A7E3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\A90C.tmp"C:\Users\Admin\AppData\Local\Temp\A90C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\A989.tmp"C:\Users\Admin\AppData\Local\Temp\A989.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:496 -
C:\Users\Admin\AppData\Local\Temp\AC87.tmp"C:\Users\Admin\AppData\Local\Temp\AC87.tmp"23⤵
- Executes dropped EXE
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\AFF2.tmp"C:\Users\Admin\AppData\Local\Temp\AFF2.tmp"24⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\B1B7.tmp"C:\Users\Admin\AppData\Local\Temp\B1B7.tmp"25⤵
- Executes dropped EXE
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\B2FF.tmp"C:\Users\Admin\AppData\Local\Temp\B2FF.tmp"26⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\B551.tmp"C:\Users\Admin\AppData\Local\Temp\B551.tmp"27⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\B5DE.tmp"C:\Users\Admin\AppData\Local\Temp\B5DE.tmp"28⤵
- Executes dropped EXE
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\B6A9.tmp"C:\Users\Admin\AppData\Local\Temp\B6A9.tmp"29⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\B86E.tmp"C:\Users\Admin\AppData\Local\Temp\B86E.tmp"30⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\BAA0.tmp"C:\Users\Admin\AppData\Local\Temp\BAA0.tmp"31⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\BC75.tmp"C:\Users\Admin\AppData\Local\Temp\BC75.tmp"32⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\BD21.tmp"C:\Users\Admin\AppData\Local\Temp\BD21.tmp"33⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\BDAE.tmp"C:\Users\Admin\AppData\Local\Temp\BDAE.tmp"34⤵
- Executes dropped EXE
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\BF15.tmp"C:\Users\Admin\AppData\Local\Temp\BF15.tmp"35⤵
- Executes dropped EXE
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\BF82.tmp"C:\Users\Admin\AppData\Local\Temp\BF82.tmp"36⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\C119.tmp"C:\Users\Admin\AppData\Local\Temp\C119.tmp"37⤵
- Executes dropped EXE
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\C56E.tmp"C:\Users\Admin\AppData\Local\Temp\C56E.tmp"38⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\CA9E.tmp"C:\Users\Admin\AppData\Local\Temp\CA9E.tmp"39⤵
- Executes dropped EXE
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\CC73.tmp"C:\Users\Admin\AppData\Local\Temp\CC73.tmp"40⤵
- Executes dropped EXE
PID:660 -
C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"41⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\CFAF.tmp"C:\Users\Admin\AppData\Local\Temp\CFAF.tmp"42⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\D02C.tmp"C:\Users\Admin\AppData\Local\Temp\D02C.tmp"43⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\D136.tmp"C:\Users\Admin\AppData\Local\Temp\D136.tmp"44⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\D1B3.tmp"C:\Users\Admin\AppData\Local\Temp\D1B3.tmp"45⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\D2BC.tmp"C:\Users\Admin\AppData\Local\Temp\D2BC.tmp"46⤵
- Executes dropped EXE
PID:884 -
C:\Users\Admin\AppData\Local\Temp\D358.tmp"C:\Users\Admin\AppData\Local\Temp\D358.tmp"47⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\D6A4.tmp"C:\Users\Admin\AppData\Local\Temp\D6A4.tmp"48⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\D76F.tmp"C:\Users\Admin\AppData\Local\Temp\D76F.tmp"49⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\D954.tmp"C:\Users\Admin\AppData\Local\Temp\D954.tmp"50⤵
- Executes dropped EXE
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\D9C1.tmp"C:\Users\Admin\AppData\Local\Temp\D9C1.tmp"51⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\DA3E.tmp"C:\Users\Admin\AppData\Local\Temp\DA3E.tmp"52⤵
- Executes dropped EXE
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\DB96.tmp"C:\Users\Admin\AppData\Local\Temp\DB96.tmp"53⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\DC13.tmp"C:\Users\Admin\AppData\Local\Temp\DC13.tmp"54⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\DC71.tmp"C:\Users\Admin\AppData\Local\Temp\DC71.tmp"55⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\DE45.tmp"C:\Users\Admin\AppData\Local\Temp\DE45.tmp"56⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\E0D6.tmp"C:\Users\Admin\AppData\Local\Temp\E0D6.tmp"57⤵
- Executes dropped EXE
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\E162.tmp"C:\Users\Admin\AppData\Local\Temp\E162.tmp"58⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\E2CA.tmp"C:\Users\Admin\AppData\Local\Temp\E2CA.tmp"59⤵
- Executes dropped EXE
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\E337.tmp"C:\Users\Admin\AppData\Local\Temp\E337.tmp"60⤵
- Executes dropped EXE
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\E46F.tmp"C:\Users\Admin\AppData\Local\Temp\E46F.tmp"61⤵
- Executes dropped EXE
PID:888 -
C:\Users\Admin\AppData\Local\Temp\E75D.tmp"C:\Users\Admin\AppData\Local\Temp\E75D.tmp"62⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\E7EA.tmp"C:\Users\Admin\AppData\Local\Temp\E7EA.tmp"63⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\E867.tmp"C:\Users\Admin\AppData\Local\Temp\E867.tmp"64⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\EB45.tmp"C:\Users\Admin\AppData\Local\Temp\EB45.tmp"65⤵
- Executes dropped EXE
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\EBD2.tmp"C:\Users\Admin\AppData\Local\Temp\EBD2.tmp"66⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\EC4F.tmp"C:\Users\Admin\AppData\Local\Temp\EC4F.tmp"67⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\ECDC.tmp"C:\Users\Admin\AppData\Local\Temp\ECDC.tmp"68⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\EF0E.tmp"C:\Users\Admin\AppData\Local\Temp\EF0E.tmp"69⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\F1ED.tmp"C:\Users\Admin\AppData\Local\Temp\F1ED.tmp"70⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\F25A.tmp"C:\Users\Admin\AppData\Local\Temp\F25A.tmp"71⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\F2D7.tmp"C:\Users\Admin\AppData\Local\Temp\F2D7.tmp"72⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\F4BB.tmp"C:\Users\Admin\AppData\Local\Temp\F4BB.tmp"73⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\F586.tmp"C:\Users\Admin\AppData\Local\Temp\F586.tmp"74⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\F71D.tmp"C:\Users\Admin\AppData\Local\Temp\F71D.tmp"75⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\F77A.tmp"C:\Users\Admin\AppData\Local\Temp\F77A.tmp"76⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\F874.tmp"C:\Users\Admin\AppData\Local\Temp\F874.tmp"77⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\F8E2.tmp"C:\Users\Admin\AppData\Local\Temp\F8E2.tmp"78⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\F95F.tmp"C:\Users\Admin\AppData\Local\Temp\F95F.tmp"79⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\FA1A.tmp"C:\Users\Admin\AppData\Local\Temp\FA1A.tmp"80⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\FCD9.tmp"C:\Users\Admin\AppData\Local\Temp\FCD9.tmp"81⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\14E.tmp"C:\Users\Admin\AppData\Local\Temp\14E.tmp"82⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\1EA.tmp"C:\Users\Admin\AppData\Local\Temp\1EA.tmp"83⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\267.tmp"C:\Users\Admin\AppData\Local\Temp\267.tmp"84⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\47B.tmp"C:\Users\Admin\AppData\Local\Temp\47B.tmp"85⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\4F8.tmp"C:\Users\Admin\AppData\Local\Temp\4F8.tmp"86⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\555.tmp"C:\Users\Admin\AppData\Local\Temp\555.tmp"87⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\620.tmp"C:\Users\Admin\AppData\Local\Temp\620.tmp"88⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\90E.tmp"C:\Users\Admin\AppData\Local\Temp\90E.tmp"89⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\A76.tmp"C:\Users\Admin\AppData\Local\Temp\A76.tmp"90⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\AE3.tmp"C:\Users\Admin\AppData\Local\Temp\AE3.tmp"91⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\B51.tmp"C:\Users\Admin\AppData\Local\Temp\B51.tmp"92⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\C1C.tmp"C:\Users\Admin\AppData\Local\Temp\C1C.tmp"93⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\C89.tmp"C:\Users\Admin\AppData\Local\Temp\C89.tmp"94⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\EFA.tmp"C:\Users\Admin\AppData\Local\Temp\EFA.tmp"95⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\F67.tmp"C:\Users\Admin\AppData\Local\Temp\F67.tmp"96⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\1042.tmp"C:\Users\Admin\AppData\Local\Temp\1042.tmp"97⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\10B0.tmp"C:\Users\Admin\AppData\Local\Temp\10B0.tmp"98⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\112D.tmp"C:\Users\Admin\AppData\Local\Temp\112D.tmp"99⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\13BD.tmp"C:\Users\Admin\AppData\Local\Temp\13BD.tmp"100⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\1449.tmp"C:\Users\Admin\AppData\Local\Temp\1449.tmp"101⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\14B7.tmp"C:\Users\Admin\AppData\Local\Temp\14B7.tmp"102⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\163D.tmp"C:\Users\Admin\AppData\Local\Temp\163D.tmp"103⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\16CA.tmp"C:\Users\Admin\AppData\Local\Temp\16CA.tmp"104⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\1766.tmp"C:\Users\Admin\AppData\Local\Temp\1766.tmp"105⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\1A16.tmp"C:\Users\Admin\AppData\Local\Temp\1A16.tmp"106⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\1BAC.tmp"C:\Users\Admin\AppData\Local\Temp\1BAC.tmp"107⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\1C29.tmp"C:\Users\Admin\AppData\Local\Temp\1C29.tmp"108⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\1C96.tmp"C:\Users\Admin\AppData\Local\Temp\1C96.tmp"109⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\1D13.tmp"C:\Users\Admin\AppData\Local\Temp\1D13.tmp"110⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\1DEE.tmp"C:\Users\Admin\AppData\Local\Temp\1DEE.tmp"111⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\2159.tmp"C:\Users\Admin\AppData\Local\Temp\2159.tmp"112⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\21D6.tmp"C:\Users\Admin\AppData\Local\Temp\21D6.tmp"113⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\2263.tmp"C:\Users\Admin\AppData\Local\Temp\2263.tmp"114⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\22C1.tmp"C:\Users\Admin\AppData\Local\Temp\22C1.tmp"115⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\24B5.tmp"C:\Users\Admin\AppData\Local\Temp\24B5.tmp"116⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\2522.tmp"C:\Users\Admin\AppData\Local\Temp\2522.tmp"117⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\2689.tmp"C:\Users\Admin\AppData\Local\Temp\2689.tmp"118⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\28EB.tmp"C:\Users\Admin\AppData\Local\Temp\28EB.tmp"119⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\2A42.tmp"C:\Users\Admin\AppData\Local\Temp\2A42.tmp"120⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\2AB0.tmp"C:\Users\Admin\AppData\Local\Temp\2AB0.tmp"121⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\2B1D.tmp"C:\Users\Admin\AppData\Local\Temp\2B1D.tmp"122⤵PID:408
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-