Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29/01/2024, 10:41
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-29_f41bbfc75449e702d73d585aa4cb6927_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-29_f41bbfc75449e702d73d585aa4cb6927_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-29_f41bbfc75449e702d73d585aa4cb6927_mafia.exe
-
Size
527KB
-
MD5
f41bbfc75449e702d73d585aa4cb6927
-
SHA1
d891b58798dbd63dc722c4c852393c5220fd9992
-
SHA256
2f82d2680398508fd2a88d4c7a87a32a5bc2ff939ca0db58163eae82c9504289
-
SHA512
afec81966ad64ac8998d0819cb790b70bda0f05a4ea96f0c28bdd4f113ea6baaef730a81718b77fc763697001fa53234d0551b81b565a4abc2ed2d34a1fa22a1
-
SSDEEP
12288:fU5rCOTeidTi2YFSPz+2AvXizizof+E23nm/hDwDZu:fUQOJdxwuzb3zd2znm/hDwDo
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2400 EF23.tmp 4460 F09A.tmp 1580 F1D2.tmp 1620 F8A8.tmp 3472 FA0F.tmp 4476 FAEA.tmp 4160 FC42.tmp 944 FD5B.tmp 4296 FEA3.tmp 4844 FF8E.tmp 3180 78.tmp 3004 153.tmp 4936 29B.tmp 692 385.tmp 3592 460.tmp 4280 55A.tmp 1844 6A2.tmp 2560 72F.tmp 4732 80A.tmp 960 8C5.tmp 3576 961.tmp 1504 9EE.tmp 1204 A9A.tmp 4896 B46.tmp 1276 C30.tmp 1736 CCC.tmp 4816 DF5.tmp 1652 E91.tmp 1248 F2E.tmp 3876 1047.tmp 1192 10E3.tmp 1088 118F.tmp 3416 121C.tmp 1624 12B8.tmp 4024 1345.tmp 4244 13C2.tmp 1664 142F.tmp 1520 149C.tmp 2992 1529.tmp 2956 15B6.tmp 1136 1623.tmp 5064 16B0.tmp 1400 174C.tmp 4984 17D8.tmp 1036 1875.tmp 2752 18F2.tmp 4124 198E.tmp 4776 1A2A.tmp 4520 1AC6.tmp 4972 1B53.tmp 4980 1BE0.tmp 4608 1C7C.tmp 1492 1D09.tmp 4376 1D76.tmp 4820 1DF3.tmp 2756 1E60.tmp 4740 1EFD.tmp 4756 1FA8.tmp 1980 2045.tmp 3108 214E.tmp 4476 21CB.tmp 4160 2268.tmp 1920 2304.tmp 4760 23B0.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4852 wrote to memory of 2400 4852 2024-01-29_f41bbfc75449e702d73d585aa4cb6927_mafia.exe 83 PID 4852 wrote to memory of 2400 4852 2024-01-29_f41bbfc75449e702d73d585aa4cb6927_mafia.exe 83 PID 4852 wrote to memory of 2400 4852 2024-01-29_f41bbfc75449e702d73d585aa4cb6927_mafia.exe 83 PID 2400 wrote to memory of 4460 2400 EF23.tmp 84 PID 2400 wrote to memory of 4460 2400 EF23.tmp 84 PID 2400 wrote to memory of 4460 2400 EF23.tmp 84 PID 4460 wrote to memory of 1580 4460 F09A.tmp 85 PID 4460 wrote to memory of 1580 4460 F09A.tmp 85 PID 4460 wrote to memory of 1580 4460 F09A.tmp 85 PID 1580 wrote to memory of 1620 1580 F1D2.tmp 86 PID 1580 wrote to memory of 1620 1580 F1D2.tmp 86 PID 1580 wrote to memory of 1620 1580 F1D2.tmp 86 PID 1620 wrote to memory of 3472 1620 F8A8.tmp 87 PID 1620 wrote to memory of 3472 1620 F8A8.tmp 87 PID 1620 wrote to memory of 3472 1620 F8A8.tmp 87 PID 3472 wrote to memory of 4476 3472 FA0F.tmp 88 PID 3472 wrote to memory of 4476 3472 FA0F.tmp 88 PID 3472 wrote to memory of 4476 3472 FA0F.tmp 88 PID 4476 wrote to memory of 4160 4476 FAEA.tmp 89 PID 4476 wrote to memory of 4160 4476 FAEA.tmp 89 PID 4476 wrote to memory of 4160 4476 FAEA.tmp 89 PID 4160 wrote to memory of 944 4160 FC42.tmp 90 PID 4160 wrote to memory of 944 4160 FC42.tmp 90 PID 4160 wrote to memory of 944 4160 FC42.tmp 90 PID 944 wrote to memory of 4296 944 FD5B.tmp 91 PID 944 wrote to memory of 4296 944 FD5B.tmp 91 PID 944 wrote to memory of 4296 944 FD5B.tmp 91 PID 4296 wrote to memory of 4844 4296 FEA3.tmp 92 PID 4296 wrote to memory of 4844 4296 FEA3.tmp 92 PID 4296 wrote to memory of 4844 4296 FEA3.tmp 92 PID 4844 wrote to memory of 3180 4844 FF8E.tmp 93 PID 4844 wrote to memory of 3180 4844 FF8E.tmp 93 PID 4844 wrote to memory of 3180 4844 FF8E.tmp 93 PID 3180 wrote to memory of 3004 3180 78.tmp 94 PID 3180 wrote to memory of 3004 3180 78.tmp 94 PID 3180 wrote to memory of 3004 3180 78.tmp 94 PID 3004 wrote to memory of 4936 3004 153.tmp 95 PID 3004 wrote to memory of 4936 3004 153.tmp 95 PID 3004 wrote to memory of 4936 3004 153.tmp 95 PID 4936 wrote to memory of 692 4936 29B.tmp 96 PID 4936 wrote to memory of 692 4936 29B.tmp 96 PID 4936 wrote to memory of 692 4936 29B.tmp 96 PID 692 wrote to memory of 3592 692 385.tmp 97 PID 692 wrote to memory of 3592 692 385.tmp 97 PID 692 wrote to memory of 3592 692 385.tmp 97 PID 3592 wrote to memory of 4280 3592 460.tmp 98 PID 3592 wrote to memory of 4280 3592 460.tmp 98 PID 3592 wrote to memory of 4280 3592 460.tmp 98 PID 4280 wrote to memory of 1844 4280 55A.tmp 99 PID 4280 wrote to memory of 1844 4280 55A.tmp 99 PID 4280 wrote to memory of 1844 4280 55A.tmp 99 PID 1844 wrote to memory of 2560 1844 6A2.tmp 100 PID 1844 wrote to memory of 2560 1844 6A2.tmp 100 PID 1844 wrote to memory of 2560 1844 6A2.tmp 100 PID 2560 wrote to memory of 4732 2560 72F.tmp 101 PID 2560 wrote to memory of 4732 2560 72F.tmp 101 PID 2560 wrote to memory of 4732 2560 72F.tmp 101 PID 4732 wrote to memory of 960 4732 80A.tmp 102 PID 4732 wrote to memory of 960 4732 80A.tmp 102 PID 4732 wrote to memory of 960 4732 80A.tmp 102 PID 960 wrote to memory of 3576 960 8C5.tmp 103 PID 960 wrote to memory of 3576 960 8C5.tmp 103 PID 960 wrote to memory of 3576 960 8C5.tmp 103 PID 3576 wrote to memory of 1504 3576 961.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-29_f41bbfc75449e702d73d585aa4cb6927_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-29_f41bbfc75449e702d73d585aa4cb6927_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\EF23.tmp"C:\Users\Admin\AppData\Local\Temp\EF23.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\F09A.tmp"C:\Users\Admin\AppData\Local\Temp\F09A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\F1D2.tmp"C:\Users\Admin\AppData\Local\Temp\F1D2.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\FA0F.tmp"C:\Users\Admin\AppData\Local\Temp\FA0F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\FC42.tmp"C:\Users\Admin\AppData\Local\Temp\FC42.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\FF8E.tmp"C:\Users\Admin\AppData\Local\Temp\FF8E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\78.tmp"C:\Users\Admin\AppData\Local\Temp\78.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\153.tmp"C:\Users\Admin\AppData\Local\Temp\153.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\29B.tmp"C:\Users\Admin\AppData\Local\Temp\29B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\385.tmp"C:\Users\Admin\AppData\Local\Temp\385.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Users\Admin\AppData\Local\Temp\460.tmp"C:\Users\Admin\AppData\Local\Temp\460.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\55A.tmp"C:\Users\Admin\AppData\Local\Temp\55A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\6A2.tmp"C:\Users\Admin\AppData\Local\Temp\6A2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\72F.tmp"C:\Users\Admin\AppData\Local\Temp\72F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\80A.tmp"C:\Users\Admin\AppData\Local\Temp\80A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\8C5.tmp"C:\Users\Admin\AppData\Local\Temp\8C5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\961.tmp"C:\Users\Admin\AppData\Local\Temp\961.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\9EE.tmp"C:\Users\Admin\AppData\Local\Temp\9EE.tmp"23⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\A9A.tmp"C:\Users\Admin\AppData\Local\Temp\A9A.tmp"24⤵
- Executes dropped EXE
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\B46.tmp"C:\Users\Admin\AppData\Local\Temp\B46.tmp"25⤵
- Executes dropped EXE
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\C30.tmp"C:\Users\Admin\AppData\Local\Temp\C30.tmp"26⤵
- Executes dropped EXE
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\CCC.tmp"C:\Users\Admin\AppData\Local\Temp\CCC.tmp"27⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\DF5.tmp"C:\Users\Admin\AppData\Local\Temp\DF5.tmp"28⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\E91.tmp"C:\Users\Admin\AppData\Local\Temp\E91.tmp"29⤵
- Executes dropped EXE
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\F2E.tmp"C:\Users\Admin\AppData\Local\Temp\F2E.tmp"30⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\1047.tmp"C:\Users\Admin\AppData\Local\Temp\1047.tmp"31⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\10E3.tmp"C:\Users\Admin\AppData\Local\Temp\10E3.tmp"32⤵
- Executes dropped EXE
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\118F.tmp"C:\Users\Admin\AppData\Local\Temp\118F.tmp"33⤵
- Executes dropped EXE
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\121C.tmp"C:\Users\Admin\AppData\Local\Temp\121C.tmp"34⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\12B8.tmp"C:\Users\Admin\AppData\Local\Temp\12B8.tmp"35⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\1345.tmp"C:\Users\Admin\AppData\Local\Temp\1345.tmp"36⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\13C2.tmp"C:\Users\Admin\AppData\Local\Temp\13C2.tmp"37⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\142F.tmp"C:\Users\Admin\AppData\Local\Temp\142F.tmp"38⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\149C.tmp"C:\Users\Admin\AppData\Local\Temp\149C.tmp"39⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\1529.tmp"C:\Users\Admin\AppData\Local\Temp\1529.tmp"40⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\15B6.tmp"C:\Users\Admin\AppData\Local\Temp\15B6.tmp"41⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\1623.tmp"C:\Users\Admin\AppData\Local\Temp\1623.tmp"42⤵
- Executes dropped EXE
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\16B0.tmp"C:\Users\Admin\AppData\Local\Temp\16B0.tmp"43⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\174C.tmp"C:\Users\Admin\AppData\Local\Temp\174C.tmp"44⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\17D8.tmp"C:\Users\Admin\AppData\Local\Temp\17D8.tmp"45⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\1875.tmp"C:\Users\Admin\AppData\Local\Temp\1875.tmp"46⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\18F2.tmp"C:\Users\Admin\AppData\Local\Temp\18F2.tmp"47⤵
- Executes dropped EXE
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\198E.tmp"C:\Users\Admin\AppData\Local\Temp\198E.tmp"48⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\1A2A.tmp"C:\Users\Admin\AppData\Local\Temp\1A2A.tmp"49⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"50⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\1B53.tmp"C:\Users\Admin\AppData\Local\Temp\1B53.tmp"51⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"52⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\1C7C.tmp"C:\Users\Admin\AppData\Local\Temp\1C7C.tmp"53⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\1D09.tmp"C:\Users\Admin\AppData\Local\Temp\1D09.tmp"54⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\1D76.tmp"C:\Users\Admin\AppData\Local\Temp\1D76.tmp"55⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\1DF3.tmp"C:\Users\Admin\AppData\Local\Temp\1DF3.tmp"56⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\1E60.tmp"C:\Users\Admin\AppData\Local\Temp\1E60.tmp"57⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"58⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"59⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\2045.tmp"C:\Users\Admin\AppData\Local\Temp\2045.tmp"60⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\214E.tmp"C:\Users\Admin\AppData\Local\Temp\214E.tmp"61⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\21CB.tmp"C:\Users\Admin\AppData\Local\Temp\21CB.tmp"62⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\2268.tmp"C:\Users\Admin\AppData\Local\Temp\2268.tmp"63⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\2304.tmp"C:\Users\Admin\AppData\Local\Temp\2304.tmp"64⤵
- Executes dropped EXE
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\23B0.tmp"C:\Users\Admin\AppData\Local\Temp\23B0.tmp"65⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\241D.tmp"C:\Users\Admin\AppData\Local\Temp\241D.tmp"66⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\24B9.tmp"C:\Users\Admin\AppData\Local\Temp\24B9.tmp"67⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\2546.tmp"C:\Users\Admin\AppData\Local\Temp\2546.tmp"68⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\25E2.tmp"C:\Users\Admin\AppData\Local\Temp\25E2.tmp"69⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\266F.tmp"C:\Users\Admin\AppData\Local\Temp\266F.tmp"70⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\270B.tmp"C:\Users\Admin\AppData\Local\Temp\270B.tmp"71⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\2788.tmp"C:\Users\Admin\AppData\Local\Temp\2788.tmp"72⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\27F5.tmp"C:\Users\Admin\AppData\Local\Temp\27F5.tmp"73⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\28A1.tmp"C:\Users\Admin\AppData\Local\Temp\28A1.tmp"74⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\290F.tmp"C:\Users\Admin\AppData\Local\Temp\290F.tmp"75⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\299B.tmp"C:\Users\Admin\AppData\Local\Temp\299B.tmp"76⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\2A38.tmp"C:\Users\Admin\AppData\Local\Temp\2A38.tmp"77⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\2AA5.tmp"C:\Users\Admin\AppData\Local\Temp\2AA5.tmp"78⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\2B22.tmp"C:\Users\Admin\AppData\Local\Temp\2B22.tmp"79⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\2BAF.tmp"C:\Users\Admin\AppData\Local\Temp\2BAF.tmp"80⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\2C2C.tmp"C:\Users\Admin\AppData\Local\Temp\2C2C.tmp"81⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\2CA9.tmp"C:\Users\Admin\AppData\Local\Temp\2CA9.tmp"82⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\2D74.tmp"C:\Users\Admin\AppData\Local\Temp\2D74.tmp"83⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\2E10.tmp"C:\Users\Admin\AppData\Local\Temp\2E10.tmp"84⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\2E8D.tmp"C:\Users\Admin\AppData\Local\Temp\2E8D.tmp"85⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\2EFA.tmp"C:\Users\Admin\AppData\Local\Temp\2EFA.tmp"86⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\2F87.tmp"C:\Users\Admin\AppData\Local\Temp\2F87.tmp"87⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\3042.tmp"C:\Users\Admin\AppData\Local\Temp\3042.tmp"88⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\30CF.tmp"C:\Users\Admin\AppData\Local\Temp\30CF.tmp"89⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\314C.tmp"C:\Users\Admin\AppData\Local\Temp\314C.tmp"90⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\31B9.tmp"C:\Users\Admin\AppData\Local\Temp\31B9.tmp"91⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\3275.tmp"C:\Users\Admin\AppData\Local\Temp\3275.tmp"92⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\32E2.tmp"C:\Users\Admin\AppData\Local\Temp\32E2.tmp"93⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"94⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"95⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\3479.tmp"C:\Users\Admin\AppData\Local\Temp\3479.tmp"96⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\3515.tmp"C:\Users\Admin\AppData\Local\Temp\3515.tmp"97⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\35A1.tmp"C:\Users\Admin\AppData\Local\Temp\35A1.tmp"98⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\362E.tmp"C:\Users\Admin\AppData\Local\Temp\362E.tmp"99⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\36BB.tmp"C:\Users\Admin\AppData\Local\Temp\36BB.tmp"100⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\3718.tmp"C:\Users\Admin\AppData\Local\Temp\3718.tmp"101⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\3776.tmp"C:\Users\Admin\AppData\Local\Temp\3776.tmp"102⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\3822.tmp"C:\Users\Admin\AppData\Local\Temp\3822.tmp"103⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\38BE.tmp"C:\Users\Admin\AppData\Local\Temp\38BE.tmp"104⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\393B.tmp"C:\Users\Admin\AppData\Local\Temp\393B.tmp"105⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\39D8.tmp"C:\Users\Admin\AppData\Local\Temp\39D8.tmp"106⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\3A55.tmp"C:\Users\Admin\AppData\Local\Temp\3A55.tmp"107⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\3AF1.tmp"C:\Users\Admin\AppData\Local\Temp\3AF1.tmp"108⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\3B9D.tmp"C:\Users\Admin\AppData\Local\Temp\3B9D.tmp"109⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\3C1A.tmp"C:\Users\Admin\AppData\Local\Temp\3C1A.tmp"110⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\3C97.tmp"C:\Users\Admin\AppData\Local\Temp\3C97.tmp"111⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\3D14.tmp"C:\Users\Admin\AppData\Local\Temp\3D14.tmp"112⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\3D81.tmp"C:\Users\Admin\AppData\Local\Temp\3D81.tmp"113⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\3E0E.tmp"C:\Users\Admin\AppData\Local\Temp\3E0E.tmp"114⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\3E7B.tmp"C:\Users\Admin\AppData\Local\Temp\3E7B.tmp"115⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\3F08.tmp"C:\Users\Admin\AppData\Local\Temp\3F08.tmp"116⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\3F75.tmp"C:\Users\Admin\AppData\Local\Temp\3F75.tmp"117⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\4040.tmp"C:\Users\Admin\AppData\Local\Temp\4040.tmp"118⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\40AE.tmp"C:\Users\Admin\AppData\Local\Temp\40AE.tmp"119⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\413A.tmp"C:\Users\Admin\AppData\Local\Temp\413A.tmp"120⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\41C7.tmp"C:\Users\Admin\AppData\Local\Temp\41C7.tmp"121⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\4263.tmp"C:\Users\Admin\AppData\Local\Temp\4263.tmp"122⤵PID:2436
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-