Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
26/01/2024, 11:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-26_3723b0737c23ce23e307623c3d111cdb_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-26_3723b0737c23ce23e307623c3d111cdb_mafia.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-01-26_3723b0737c23ce23e307623c3d111cdb_mafia.exe
-
Size
486KB
-
MD5
3723b0737c23ce23e307623c3d111cdb
-
SHA1
734f632f9a67357568e3dfa7e77a2e4f5dd43821
-
SHA256
dcc85459ed6deca10ce0712cc041188bd760b7a2da527613c8e05fe6cbd0da2d
-
SHA512
50a00f299a538aef3a9bcfd2a41a7e11e4c3c9d28b5a9dae71522eafe08cef15a8f33fa0f772629d25db4bda6809be6caf6762273469ba18695a314123c86de3
-
SSDEEP
12288:/U5rCOTeiDnr3O+O0jub8xIlmXtlSZNZ:/UQOJDnr38SubvsXuZN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5088 4D93.tmp 980 4E01.tmp 1628 4E5E.tmp 2396 4ECC.tmp 2864 4F39.tmp 3804 4F87.tmp 3552 4FD5.tmp 4476 5033.tmp 2020 5091.tmp 4712 50DF.tmp 3580 513D.tmp 4200 51C9.tmp 2640 5217.tmp 4432 5285.tmp 3720 52D3.tmp 3724 5331.tmp 2264 538E.tmp 372 53DD.tmp 2356 542B.tmp 4632 5498.tmp 4388 54F6.tmp 2456 5554.tmp 1020 55A2.tmp 3136 55F0.tmp 2812 563E.tmp 4132 568C.tmp 4196 56DA.tmp 964 5738.tmp 3168 5786.tmp 3300 57E4.tmp 5064 593C.tmp 664 5999.tmp 3504 59E7.tmp 1092 5A36.tmp 2552 5A84.tmp 4940 5AD2.tmp 3288 5B20.tmp 4928 5B6E.tmp 2076 5C2A.tmp 3768 5CA7.tmp 1692 5D33.tmp 1672 5D91.tmp 3632 5DDF.tmp 4412 5E2D.tmp 4308 5E8B.tmp 4088 5EE9.tmp 1684 5F46.tmp 852 5FA4.tmp 3532 5FF2.tmp 1780 6050.tmp 556 60AE.tmp 4456 610C.tmp 2652 6169.tmp 4120 61C7.tmp 4820 6225.tmp 3712 6273.tmp 3960 62D1.tmp 3580 632E.tmp 2252 638C.tmp 1240 63EA.tmp 5116 6457.tmp 4512 64A5.tmp 3684 6503.tmp 2004 6561.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4416 wrote to memory of 5088 4416 2024-01-26_3723b0737c23ce23e307623c3d111cdb_mafia.exe 85 PID 4416 wrote to memory of 5088 4416 2024-01-26_3723b0737c23ce23e307623c3d111cdb_mafia.exe 85 PID 4416 wrote to memory of 5088 4416 2024-01-26_3723b0737c23ce23e307623c3d111cdb_mafia.exe 85 PID 5088 wrote to memory of 980 5088 4D93.tmp 87 PID 5088 wrote to memory of 980 5088 4D93.tmp 87 PID 5088 wrote to memory of 980 5088 4D93.tmp 87 PID 980 wrote to memory of 1628 980 4E01.tmp 88 PID 980 wrote to memory of 1628 980 4E01.tmp 88 PID 980 wrote to memory of 1628 980 4E01.tmp 88 PID 1628 wrote to memory of 2396 1628 4E5E.tmp 90 PID 1628 wrote to memory of 2396 1628 4E5E.tmp 90 PID 1628 wrote to memory of 2396 1628 4E5E.tmp 90 PID 2396 wrote to memory of 2864 2396 4ECC.tmp 92 PID 2396 wrote to memory of 2864 2396 4ECC.tmp 92 PID 2396 wrote to memory of 2864 2396 4ECC.tmp 92 PID 2864 wrote to memory of 3804 2864 4F39.tmp 93 PID 2864 wrote to memory of 3804 2864 4F39.tmp 93 PID 2864 wrote to memory of 3804 2864 4F39.tmp 93 PID 3804 wrote to memory of 3552 3804 4F87.tmp 94 PID 3804 wrote to memory of 3552 3804 4F87.tmp 94 PID 3804 wrote to memory of 3552 3804 4F87.tmp 94 PID 3552 wrote to memory of 4476 3552 4FD5.tmp 95 PID 3552 wrote to memory of 4476 3552 4FD5.tmp 95 PID 3552 wrote to memory of 4476 3552 4FD5.tmp 95 PID 4476 wrote to memory of 2020 4476 5033.tmp 96 PID 4476 wrote to memory of 2020 4476 5033.tmp 96 PID 4476 wrote to memory of 2020 4476 5033.tmp 96 PID 2020 wrote to memory of 4712 2020 5091.tmp 97 PID 2020 wrote to memory of 4712 2020 5091.tmp 97 PID 2020 wrote to memory of 4712 2020 5091.tmp 97 PID 4712 wrote to memory of 3580 4712 50DF.tmp 98 PID 4712 wrote to memory of 3580 4712 50DF.tmp 98 PID 4712 wrote to memory of 3580 4712 50DF.tmp 98 PID 3580 wrote to memory of 4200 3580 513D.tmp 99 PID 3580 wrote to memory of 4200 3580 513D.tmp 99 PID 3580 wrote to memory of 4200 3580 513D.tmp 99 PID 4200 wrote to memory of 2640 4200 51C9.tmp 100 PID 4200 wrote to memory of 2640 4200 51C9.tmp 100 PID 4200 wrote to memory of 2640 4200 51C9.tmp 100 PID 2640 wrote to memory of 4432 2640 5217.tmp 101 PID 2640 wrote to memory of 4432 2640 5217.tmp 101 PID 2640 wrote to memory of 4432 2640 5217.tmp 101 PID 4432 wrote to memory of 3720 4432 5285.tmp 102 PID 4432 wrote to memory of 3720 4432 5285.tmp 102 PID 4432 wrote to memory of 3720 4432 5285.tmp 102 PID 3720 wrote to memory of 3724 3720 52D3.tmp 103 PID 3720 wrote to memory of 3724 3720 52D3.tmp 103 PID 3720 wrote to memory of 3724 3720 52D3.tmp 103 PID 3724 wrote to memory of 2264 3724 5331.tmp 104 PID 3724 wrote to memory of 2264 3724 5331.tmp 104 PID 3724 wrote to memory of 2264 3724 5331.tmp 104 PID 2264 wrote to memory of 372 2264 538E.tmp 105 PID 2264 wrote to memory of 372 2264 538E.tmp 105 PID 2264 wrote to memory of 372 2264 538E.tmp 105 PID 372 wrote to memory of 2356 372 53DD.tmp 106 PID 372 wrote to memory of 2356 372 53DD.tmp 106 PID 372 wrote to memory of 2356 372 53DD.tmp 106 PID 2356 wrote to memory of 4632 2356 542B.tmp 107 PID 2356 wrote to memory of 4632 2356 542B.tmp 107 PID 2356 wrote to memory of 4632 2356 542B.tmp 107 PID 4632 wrote to memory of 4388 4632 5498.tmp 108 PID 4632 wrote to memory of 4388 4632 5498.tmp 108 PID 4632 wrote to memory of 4388 4632 5498.tmp 108 PID 4388 wrote to memory of 2456 4388 54F6.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_3723b0737c23ce23e307623c3d111cdb_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-26_3723b0737c23ce23e307623c3d111cdb_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"23⤵
- Executes dropped EXE
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"24⤵
- Executes dropped EXE
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"25⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"26⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"27⤵
- Executes dropped EXE
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"28⤵
- Executes dropped EXE
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"29⤵
- Executes dropped EXE
PID:964 -
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"30⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"31⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"32⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"33⤵
- Executes dropped EXE
PID:664 -
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"34⤵
- Executes dropped EXE
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"35⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"36⤵
- Executes dropped EXE
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"37⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"38⤵
- Executes dropped EXE
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"39⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"40⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"41⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"42⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"43⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"44⤵
- Executes dropped EXE
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"45⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"46⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"47⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"48⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"49⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"50⤵
- Executes dropped EXE
PID:852 -
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"51⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"52⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"53⤵
- Executes dropped EXE
PID:556 -
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"54⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"55⤵
- Executes dropped EXE
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"56⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"57⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"58⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"59⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"60⤵
- Executes dropped EXE
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"61⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"62⤵
- Executes dropped EXE
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"63⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"64⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"65⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"66⤵
- Executes dropped EXE
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"67⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"68⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"69⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"70⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"71⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"72⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"73⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"74⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"75⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"76⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"77⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"78⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"79⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"80⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"81⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"82⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"83⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"84⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"85⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"86⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"87⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"88⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"89⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"90⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"91⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"92⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"93⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"94⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"95⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"96⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"97⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"98⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\7148.tmp"C:\Users\Admin\AppData\Local\Temp\7148.tmp"99⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"100⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"101⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"102⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\72A0.tmp"C:\Users\Admin\AppData\Local\Temp\72A0.tmp"103⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"104⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"105⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"106⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"107⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"108⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"109⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"110⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"111⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"112⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"113⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"114⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"115⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\7714.tmp"C:\Users\Admin\AppData\Local\Temp\7714.tmp"116⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\7762.tmp"C:\Users\Admin\AppData\Local\Temp\7762.tmp"117⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\77B0.tmp"C:\Users\Admin\AppData\Local\Temp\77B0.tmp"118⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\77FF.tmp"C:\Users\Admin\AppData\Local\Temp\77FF.tmp"119⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"120⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\789B.tmp"C:\Users\Admin\AppData\Local\Temp\789B.tmp"121⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\78F9.tmp"C:\Users\Admin\AppData\Local\Temp\78F9.tmp"122⤵PID:4632
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-