Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/01/2024, 14:57
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-25_d512ed2fb3c65c8b0bff681a3fa2efe9_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-25_d512ed2fb3c65c8b0bff681a3fa2efe9_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-25_d512ed2fb3c65c8b0bff681a3fa2efe9_mafia.exe
-
Size
486KB
-
MD5
d512ed2fb3c65c8b0bff681a3fa2efe9
-
SHA1
3ea210c1780b9832b1642608c67abdf61c950e1d
-
SHA256
3761462e4928d469e76a087c188c1c2c9c1d0047e341a2922d32c002186d41bc
-
SHA512
f0331b1a6fe7190c1b584387c54b6cccff248dfff0dcad6b00dd79d10856e15d018fa185c306da8f78138d092ee41beb2dbdf4527b4841d987dd6038237b1e62
-
SSDEEP
12288:oU5rCOTeiDJK/o6zrrCrWT85AQi/b3INZ:oUQOJDJKtrrMi1P/8N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3720 AAA7.tmp 4288 ABFF.tmp 4904 B1AC.tmp 3284 B333.tmp 4640 B3FE.tmp 2096 B594.tmp 4444 B69E.tmp 3560 B788.tmp 4148 B853.tmp 524 B8F0.tmp 3128 B9AB.tmp 1348 BA67.tmp 1008 BB51.tmp 1708 BC2C.tmp 2108 BD16.tmp 3764 BDD2.tmp 3768 BECC.tmp 3480 BF87.tmp 4244 C062.tmp 844 C0FE.tmp 4876 C1BA.tmp 1528 C265.tmp 3216 C321.tmp 2808 C3CD.tmp 4992 C4A8.tmp 1356 C5F0.tmp 2320 C68C.tmp 1176 C747.tmp 1272 C822.tmp 4976 C8DE.tmp 4388 C9A9.tmp 4220 CA26.tmp 4164 CB20.tmp 1568 CBCC.tmp 2516 CC49.tmp 3088 CCC6.tmp 4256 CDFE.tmp 1632 CF56.tmp 4580 D040.tmp 1016 D0DD.tmp 2616 D169.tmp 3052 D205.tmp 4744 D2B1.tmp 3568 D34E.tmp 2968 D3EA.tmp 3952 D476.tmp 4620 D4E4.tmp 3544 D61C.tmp 4856 D6B9.tmp 3512 D736.tmp 4444 D7D2.tmp 1128 D84F.tmp 2592 D8DB.tmp 3540 D949.tmp 4148 D9B6.tmp 4928 DA62.tmp 2996 DAFE.tmp 652 DB8B.tmp 3084 DC08.tmp 5060 DC75.tmp 4632 DCF2.tmp 2192 DD8F.tmp 1708 DE1B.tmp 4476 DE89.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2184 wrote to memory of 3720 2184 2024-01-25_d512ed2fb3c65c8b0bff681a3fa2efe9_mafia.exe 85 PID 2184 wrote to memory of 3720 2184 2024-01-25_d512ed2fb3c65c8b0bff681a3fa2efe9_mafia.exe 85 PID 2184 wrote to memory of 3720 2184 2024-01-25_d512ed2fb3c65c8b0bff681a3fa2efe9_mafia.exe 85 PID 3720 wrote to memory of 4288 3720 AAA7.tmp 86 PID 3720 wrote to memory of 4288 3720 AAA7.tmp 86 PID 3720 wrote to memory of 4288 3720 AAA7.tmp 86 PID 4288 wrote to memory of 4904 4288 ABFF.tmp 88 PID 4288 wrote to memory of 4904 4288 ABFF.tmp 88 PID 4288 wrote to memory of 4904 4288 ABFF.tmp 88 PID 4904 wrote to memory of 3284 4904 B1AC.tmp 89 PID 4904 wrote to memory of 3284 4904 B1AC.tmp 89 PID 4904 wrote to memory of 3284 4904 B1AC.tmp 89 PID 3284 wrote to memory of 4640 3284 B333.tmp 90 PID 3284 wrote to memory of 4640 3284 B333.tmp 90 PID 3284 wrote to memory of 4640 3284 B333.tmp 90 PID 4640 wrote to memory of 2096 4640 B3FE.tmp 92 PID 4640 wrote to memory of 2096 4640 B3FE.tmp 92 PID 4640 wrote to memory of 2096 4640 B3FE.tmp 92 PID 2096 wrote to memory of 4444 2096 B594.tmp 93 PID 2096 wrote to memory of 4444 2096 B594.tmp 93 PID 2096 wrote to memory of 4444 2096 B594.tmp 93 PID 4444 wrote to memory of 3560 4444 B69E.tmp 94 PID 4444 wrote to memory of 3560 4444 B69E.tmp 94 PID 4444 wrote to memory of 3560 4444 B69E.tmp 94 PID 3560 wrote to memory of 4148 3560 B788.tmp 95 PID 3560 wrote to memory of 4148 3560 B788.tmp 95 PID 3560 wrote to memory of 4148 3560 B788.tmp 95 PID 4148 wrote to memory of 524 4148 B853.tmp 96 PID 4148 wrote to memory of 524 4148 B853.tmp 96 PID 4148 wrote to memory of 524 4148 B853.tmp 96 PID 524 wrote to memory of 3128 524 B8F0.tmp 97 PID 524 wrote to memory of 3128 524 B8F0.tmp 97 PID 524 wrote to memory of 3128 524 B8F0.tmp 97 PID 3128 wrote to memory of 1348 3128 B9AB.tmp 98 PID 3128 wrote to memory of 1348 3128 B9AB.tmp 98 PID 3128 wrote to memory of 1348 3128 B9AB.tmp 98 PID 1348 wrote to memory of 1008 1348 BA67.tmp 99 PID 1348 wrote to memory of 1008 1348 BA67.tmp 99 PID 1348 wrote to memory of 1008 1348 BA67.tmp 99 PID 1008 wrote to memory of 1708 1008 BB51.tmp 100 PID 1008 wrote to memory of 1708 1008 BB51.tmp 100 PID 1008 wrote to memory of 1708 1008 BB51.tmp 100 PID 1708 wrote to memory of 2108 1708 BC2C.tmp 101 PID 1708 wrote to memory of 2108 1708 BC2C.tmp 101 PID 1708 wrote to memory of 2108 1708 BC2C.tmp 101 PID 2108 wrote to memory of 3764 2108 BD16.tmp 102 PID 2108 wrote to memory of 3764 2108 BD16.tmp 102 PID 2108 wrote to memory of 3764 2108 BD16.tmp 102 PID 3764 wrote to memory of 3768 3764 BDD2.tmp 103 PID 3764 wrote to memory of 3768 3764 BDD2.tmp 103 PID 3764 wrote to memory of 3768 3764 BDD2.tmp 103 PID 3768 wrote to memory of 3480 3768 BECC.tmp 104 PID 3768 wrote to memory of 3480 3768 BECC.tmp 104 PID 3768 wrote to memory of 3480 3768 BECC.tmp 104 PID 3480 wrote to memory of 4244 3480 BF87.tmp 105 PID 3480 wrote to memory of 4244 3480 BF87.tmp 105 PID 3480 wrote to memory of 4244 3480 BF87.tmp 105 PID 4244 wrote to memory of 844 4244 C062.tmp 106 PID 4244 wrote to memory of 844 4244 C062.tmp 106 PID 4244 wrote to memory of 844 4244 C062.tmp 106 PID 844 wrote to memory of 4876 844 C0FE.tmp 107 PID 844 wrote to memory of 4876 844 C0FE.tmp 107 PID 844 wrote to memory of 4876 844 C0FE.tmp 107 PID 4876 wrote to memory of 1528 4876 C1BA.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_d512ed2fb3c65c8b0bff681a3fa2efe9_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_d512ed2fb3c65c8b0bff681a3fa2efe9_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\B594.tmp"C:\Users\Admin\AppData\Local\Temp\B594.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\B69E.tmp"C:\Users\Admin\AppData\Local\Temp\B69E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\B788.tmp"C:\Users\Admin\AppData\Local\Temp\B788.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\B853.tmp"C:\Users\Admin\AppData\Local\Temp\B853.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:524 -
C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\BA67.tmp"C:\Users\Admin\AppData\Local\Temp\BA67.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\BD16.tmp"C:\Users\Admin\AppData\Local\Temp\BD16.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\BF87.tmp"C:\Users\Admin\AppData\Local\Temp\BF87.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\C062.tmp"C:\Users\Admin\AppData\Local\Temp\C062.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"23⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\C321.tmp"C:\Users\Admin\AppData\Local\Temp\C321.tmp"24⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"25⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"26⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\C5F0.tmp"C:\Users\Admin\AppData\Local\Temp\C5F0.tmp"27⤵
- Executes dropped EXE
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\C68C.tmp"C:\Users\Admin\AppData\Local\Temp\C68C.tmp"28⤵
- Executes dropped EXE
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\C747.tmp"C:\Users\Admin\AppData\Local\Temp\C747.tmp"29⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\C822.tmp"C:\Users\Admin\AppData\Local\Temp\C822.tmp"30⤵
- Executes dropped EXE
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"31⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"32⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\CA26.tmp"C:\Users\Admin\AppData\Local\Temp\CA26.tmp"33⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\CB20.tmp"C:\Users\Admin\AppData\Local\Temp\CB20.tmp"34⤵
- Executes dropped EXE
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"35⤵
- Executes dropped EXE
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\CC49.tmp"C:\Users\Admin\AppData\Local\Temp\CC49.tmp"36⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\CCC6.tmp"C:\Users\Admin\AppData\Local\Temp\CCC6.tmp"37⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"38⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\CF56.tmp"C:\Users\Admin\AppData\Local\Temp\CF56.tmp"39⤵
- Executes dropped EXE
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\D040.tmp"C:\Users\Admin\AppData\Local\Temp\D040.tmp"40⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\D0DD.tmp"C:\Users\Admin\AppData\Local\Temp\D0DD.tmp"41⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\D169.tmp"C:\Users\Admin\AppData\Local\Temp\D169.tmp"42⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\D205.tmp"C:\Users\Admin\AppData\Local\Temp\D205.tmp"43⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\D2B1.tmp"C:\Users\Admin\AppData\Local\Temp\D2B1.tmp"44⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\D34E.tmp"C:\Users\Admin\AppData\Local\Temp\D34E.tmp"45⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\D3EA.tmp"C:\Users\Admin\AppData\Local\Temp\D3EA.tmp"46⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\D476.tmp"C:\Users\Admin\AppData\Local\Temp\D476.tmp"47⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"48⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\D61C.tmp"C:\Users\Admin\AppData\Local\Temp\D61C.tmp"49⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\D6B9.tmp"C:\Users\Admin\AppData\Local\Temp\D6B9.tmp"50⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\D736.tmp"C:\Users\Admin\AppData\Local\Temp\D736.tmp"51⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"52⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\D84F.tmp"C:\Users\Admin\AppData\Local\Temp\D84F.tmp"53⤵
- Executes dropped EXE
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"54⤵
- Executes dropped EXE
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\D949.tmp"C:\Users\Admin\AppData\Local\Temp\D949.tmp"55⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"56⤵
- Executes dropped EXE
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\DA62.tmp"C:\Users\Admin\AppData\Local\Temp\DA62.tmp"57⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\DAFE.tmp"C:\Users\Admin\AppData\Local\Temp\DAFE.tmp"58⤵
- Executes dropped EXE
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\DB8B.tmp"C:\Users\Admin\AppData\Local\Temp\DB8B.tmp"59⤵
- Executes dropped EXE
PID:652 -
C:\Users\Admin\AppData\Local\Temp\DC08.tmp"C:\Users\Admin\AppData\Local\Temp\DC08.tmp"60⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\DC75.tmp"C:\Users\Admin\AppData\Local\Temp\DC75.tmp"61⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\DCF2.tmp"C:\Users\Admin\AppData\Local\Temp\DCF2.tmp"62⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\DD8F.tmp"C:\Users\Admin\AppData\Local\Temp\DD8F.tmp"63⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"64⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\DE89.tmp"C:\Users\Admin\AppData\Local\Temp\DE89.tmp"65⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\DF06.tmp"C:\Users\Admin\AppData\Local\Temp\DF06.tmp"66⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\DF73.tmp"C:\Users\Admin\AppData\Local\Temp\DF73.tmp"67⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\DFE0.tmp"C:\Users\Admin\AppData\Local\Temp\DFE0.tmp"68⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\E07D.tmp"C:\Users\Admin\AppData\Local\Temp\E07D.tmp"69⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\E119.tmp"C:\Users\Admin\AppData\Local\Temp\E119.tmp"70⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\E1A5.tmp"C:\Users\Admin\AppData\Local\Temp\E1A5.tmp"71⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\E213.tmp"C:\Users\Admin\AppData\Local\Temp\E213.tmp"72⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\E280.tmp"C:\Users\Admin\AppData\Local\Temp\E280.tmp"73⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\E2EE.tmp"C:\Users\Admin\AppData\Local\Temp\E2EE.tmp"74⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\E37A.tmp"C:\Users\Admin\AppData\Local\Temp\E37A.tmp"75⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\E416.tmp"C:\Users\Admin\AppData\Local\Temp\E416.tmp"76⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\E4B3.tmp"C:\Users\Admin\AppData\Local\Temp\E4B3.tmp"77⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\E530.tmp"C:\Users\Admin\AppData\Local\Temp\E530.tmp"78⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\E59D.tmp"C:\Users\Admin\AppData\Local\Temp\E59D.tmp"79⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\E60A.tmp"C:\Users\Admin\AppData\Local\Temp\E60A.tmp"80⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\E697.tmp"C:\Users\Admin\AppData\Local\Temp\E697.tmp"81⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\E733.tmp"C:\Users\Admin\AppData\Local\Temp\E733.tmp"82⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"83⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\E82D.tmp"C:\Users\Admin\AppData\Local\Temp\E82D.tmp"84⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\E8CA.tmp"C:\Users\Admin\AppData\Local\Temp\E8CA.tmp"85⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\E947.tmp"C:\Users\Admin\AppData\Local\Temp\E947.tmp"86⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"87⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\EA41.tmp"C:\Users\Admin\AppData\Local\Temp\EA41.tmp"88⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\EACD.tmp"C:\Users\Admin\AppData\Local\Temp\EACD.tmp"89⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\EB79.tmp"C:\Users\Admin\AppData\Local\Temp\EB79.tmp"90⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\EC06.tmp"C:\Users\Admin\AppData\Local\Temp\EC06.tmp"91⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\EC73.tmp"C:\Users\Admin\AppData\Local\Temp\EC73.tmp"92⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"93⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"94⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\EDFA.tmp"C:\Users\Admin\AppData\Local\Temp\EDFA.tmp"95⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\EE96.tmp"C:\Users\Admin\AppData\Local\Temp\EE96.tmp"96⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\EF23.tmp"C:\Users\Admin\AppData\Local\Temp\EF23.tmp"97⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\EF90.tmp"C:\Users\Admin\AppData\Local\Temp\EF90.tmp"98⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"99⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\F06B.tmp"C:\Users\Admin\AppData\Local\Temp\F06B.tmp"100⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\F0E8.tmp"C:\Users\Admin\AppData\Local\Temp\F0E8.tmp"101⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\F155.tmp"C:\Users\Admin\AppData\Local\Temp\F155.tmp"102⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\F24F.tmp"C:\Users\Admin\AppData\Local\Temp\F24F.tmp"103⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"104⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\F32A.tmp"C:\Users\Admin\AppData\Local\Temp\F32A.tmp"105⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\F3A7.tmp"C:\Users\Admin\AppData\Local\Temp\F3A7.tmp"106⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\F414.tmp"C:\Users\Admin\AppData\Local\Temp\F414.tmp"107⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"108⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\F51E.tmp"C:\Users\Admin\AppData\Local\Temp\F51E.tmp"109⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\F58B.tmp"C:\Users\Admin\AppData\Local\Temp\F58B.tmp"110⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\F5F9.tmp"C:\Users\Admin\AppData\Local\Temp\F5F9.tmp"111⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\F666.tmp"C:\Users\Admin\AppData\Local\Temp\F666.tmp"112⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\F712.tmp"C:\Users\Admin\AppData\Local\Temp\F712.tmp"113⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\F79E.tmp"C:\Users\Admin\AppData\Local\Temp\F79E.tmp"114⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\F80C.tmp"C:\Users\Admin\AppData\Local\Temp\F80C.tmp"115⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\F906.tmp"C:\Users\Admin\AppData\Local\Temp\F906.tmp"116⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\F973.tmp"C:\Users\Admin\AppData\Local\Temp\F973.tmp"117⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\FA00.tmp"C:\Users\Admin\AppData\Local\Temp\FA00.tmp"118⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"119⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\FB09.tmp"C:\Users\Admin\AppData\Local\Temp\FB09.tmp"120⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\FB96.tmp"C:\Users\Admin\AppData\Local\Temp\FB96.tmp"121⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\FC13.tmp"C:\Users\Admin\AppData\Local\Temp\FC13.tmp"122⤵PID:1084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-