Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
21/02/2024, 14:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-21_a4d79b815f7f8ff3a0adc21bc6a07952_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-21_a4d79b815f7f8ff3a0adc21bc6a07952_mafia.exe
Resource
win10v2004-20240221-en
General
-
Target
2024-02-21_a4d79b815f7f8ff3a0adc21bc6a07952_mafia.exe
-
Size
541KB
-
MD5
a4d79b815f7f8ff3a0adc21bc6a07952
-
SHA1
7aed256251e6f60120cc8991268161528c47abf5
-
SHA256
0650ca21270eab42f5a3b2dddb00a744674a97f1337e68715b07fe270aa2ca01
-
SHA512
dc1caa588372a917d3fe63ae34cef71f523c57836971978da297be632fa01b6b7a3b810854994965568575595fe99ac016cb46381efd16c2e8e88219895882c7
-
SSDEEP
12288:UU5rCOTeifCstGaE2tyDjIEdKx7KH4q5OTrZa73ctO:UUQOJfWz4E0xeiTrU73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2452 5F37.tmp 2928 5FF2.tmp 3316 60CD.tmp 4464 61B7.tmp 4440 62A2.tmp 1860 637D.tmp 4568 6448.tmp 4784 6503.tmp 4856 6590.tmp 2760 663C.tmp 4280 66E8.tmp 1900 67A3.tmp 3556 683F.tmp 2460 690A.tmp 1932 6968.tmp 1116 6A04.tmp 1216 6AB0.tmp 1520 6B9B.tmp 1072 6C47.tmp 1716 6CC4.tmp 2240 6D60.tmp 2304 6E5A.tmp 3832 6F35.tmp 4808 6FB2.tmp 1616 707D.tmp 4880 7177.tmp 4188 7242.tmp 2492 72FD.tmp 4828 73E8.tmp 2752 74C2.tmp 2236 75AD.tmp 5052 7697.tmp 2528 7743.tmp 1420 77B0.tmp 1232 783D.tmp 4264 78AA.tmp 2484 7937.tmp 4756 79C4.tmp 1784 7A60.tmp 1084 7ADD.tmp 672 7B6A.tmp 4348 7C15.tmp 2724 7CC1.tmp 4552 7D3E.tmp 1888 7DDB.tmp 4408 7E67.tmp 208 7ED5.tmp 1668 7F80.tmp 2988 801D.tmp 228 809A.tmp 2408 8136.tmp 2256 81A3.tmp 4368 8220.tmp 4616 82AD.tmp 3204 831A.tmp 2680 8388.tmp 3620 8405.tmp 4536 8491.tmp 3420 84FF.tmp 2936 859B.tmp 2944 8628.tmp 4460 8695.tmp 3560 8722.tmp 4512 87AE.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3688 wrote to memory of 2452 3688 2024-02-21_a4d79b815f7f8ff3a0adc21bc6a07952_mafia.exe 84 PID 3688 wrote to memory of 2452 3688 2024-02-21_a4d79b815f7f8ff3a0adc21bc6a07952_mafia.exe 84 PID 3688 wrote to memory of 2452 3688 2024-02-21_a4d79b815f7f8ff3a0adc21bc6a07952_mafia.exe 84 PID 2452 wrote to memory of 2928 2452 5F37.tmp 86 PID 2452 wrote to memory of 2928 2452 5F37.tmp 86 PID 2452 wrote to memory of 2928 2452 5F37.tmp 86 PID 2928 wrote to memory of 3316 2928 5FF2.tmp 88 PID 2928 wrote to memory of 3316 2928 5FF2.tmp 88 PID 2928 wrote to memory of 3316 2928 5FF2.tmp 88 PID 3316 wrote to memory of 4464 3316 60CD.tmp 89 PID 3316 wrote to memory of 4464 3316 60CD.tmp 89 PID 3316 wrote to memory of 4464 3316 60CD.tmp 89 PID 4464 wrote to memory of 4440 4464 61B7.tmp 91 PID 4464 wrote to memory of 4440 4464 61B7.tmp 91 PID 4464 wrote to memory of 4440 4464 61B7.tmp 91 PID 4440 wrote to memory of 1860 4440 62A2.tmp 93 PID 4440 wrote to memory of 1860 4440 62A2.tmp 93 PID 4440 wrote to memory of 1860 4440 62A2.tmp 93 PID 1860 wrote to memory of 4568 1860 637D.tmp 94 PID 1860 wrote to memory of 4568 1860 637D.tmp 94 PID 1860 wrote to memory of 4568 1860 637D.tmp 94 PID 4568 wrote to memory of 4784 4568 6448.tmp 95 PID 4568 wrote to memory of 4784 4568 6448.tmp 95 PID 4568 wrote to memory of 4784 4568 6448.tmp 95 PID 4784 wrote to memory of 4856 4784 6503.tmp 96 PID 4784 wrote to memory of 4856 4784 6503.tmp 96 PID 4784 wrote to memory of 4856 4784 6503.tmp 96 PID 4856 wrote to memory of 2760 4856 6590.tmp 97 PID 4856 wrote to memory of 2760 4856 6590.tmp 97 PID 4856 wrote to memory of 2760 4856 6590.tmp 97 PID 2760 wrote to memory of 4280 2760 663C.tmp 98 PID 2760 wrote to memory of 4280 2760 663C.tmp 98 PID 2760 wrote to memory of 4280 2760 663C.tmp 98 PID 4280 wrote to memory of 1900 4280 66E8.tmp 100 PID 4280 wrote to memory of 1900 4280 66E8.tmp 100 PID 4280 wrote to memory of 1900 4280 66E8.tmp 100 PID 1900 wrote to memory of 3556 1900 67A3.tmp 101 PID 1900 wrote to memory of 3556 1900 67A3.tmp 101 PID 1900 wrote to memory of 3556 1900 67A3.tmp 101 PID 3556 wrote to memory of 2460 3556 683F.tmp 102 PID 3556 wrote to memory of 2460 3556 683F.tmp 102 PID 3556 wrote to memory of 2460 3556 683F.tmp 102 PID 2460 wrote to memory of 1932 2460 690A.tmp 103 PID 2460 wrote to memory of 1932 2460 690A.tmp 103 PID 2460 wrote to memory of 1932 2460 690A.tmp 103 PID 1932 wrote to memory of 1116 1932 6968.tmp 104 PID 1932 wrote to memory of 1116 1932 6968.tmp 104 PID 1932 wrote to memory of 1116 1932 6968.tmp 104 PID 1116 wrote to memory of 1216 1116 6A04.tmp 105 PID 1116 wrote to memory of 1216 1116 6A04.tmp 105 PID 1116 wrote to memory of 1216 1116 6A04.tmp 105 PID 1216 wrote to memory of 1520 1216 6AB0.tmp 106 PID 1216 wrote to memory of 1520 1216 6AB0.tmp 106 PID 1216 wrote to memory of 1520 1216 6AB0.tmp 106 PID 1520 wrote to memory of 1072 1520 6B9B.tmp 107 PID 1520 wrote to memory of 1072 1520 6B9B.tmp 107 PID 1520 wrote to memory of 1072 1520 6B9B.tmp 107 PID 1072 wrote to memory of 1716 1072 6C47.tmp 108 PID 1072 wrote to memory of 1716 1072 6C47.tmp 108 PID 1072 wrote to memory of 1716 1072 6C47.tmp 108 PID 1716 wrote to memory of 2240 1716 6CC4.tmp 109 PID 1716 wrote to memory of 2240 1716 6CC4.tmp 109 PID 1716 wrote to memory of 2240 1716 6CC4.tmp 109 PID 2240 wrote to memory of 2304 2240 6D60.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-21_a4d79b815f7f8ff3a0adc21bc6a07952_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-21_a4d79b815f7f8ff3a0adc21bc6a07952_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"23⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"24⤵
- Executes dropped EXE
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"25⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"26⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\7177.tmp"C:\Users\Admin\AppData\Local\Temp\7177.tmp"27⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"28⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"29⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\73E8.tmp"C:\Users\Admin\AppData\Local\Temp\73E8.tmp"30⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\74C2.tmp"C:\Users\Admin\AppData\Local\Temp\74C2.tmp"31⤵
- Executes dropped EXE
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"32⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"33⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\7743.tmp"C:\Users\Admin\AppData\Local\Temp\7743.tmp"34⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\77B0.tmp"C:\Users\Admin\AppData\Local\Temp\77B0.tmp"35⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\783D.tmp"C:\Users\Admin\AppData\Local\Temp\783D.tmp"36⤵
- Executes dropped EXE
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"37⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\7937.tmp"C:\Users\Admin\AppData\Local\Temp\7937.tmp"38⤵
- Executes dropped EXE
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\79C4.tmp"C:\Users\Admin\AppData\Local\Temp\79C4.tmp"39⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\7A60.tmp"C:\Users\Admin\AppData\Local\Temp\7A60.tmp"40⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"41⤵
- Executes dropped EXE
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"42⤵
- Executes dropped EXE
PID:672 -
C:\Users\Admin\AppData\Local\Temp\7C15.tmp"C:\Users\Admin\AppData\Local\Temp\7C15.tmp"43⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"44⤵
- Executes dropped EXE
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"45⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"46⤵
- Executes dropped EXE
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\7E67.tmp"C:\Users\Admin\AppData\Local\Temp\7E67.tmp"47⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"48⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\7F80.tmp"C:\Users\Admin\AppData\Local\Temp\7F80.tmp"49⤵
- Executes dropped EXE
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\801D.tmp"C:\Users\Admin\AppData\Local\Temp\801D.tmp"50⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\809A.tmp"C:\Users\Admin\AppData\Local\Temp\809A.tmp"51⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\8136.tmp"C:\Users\Admin\AppData\Local\Temp\8136.tmp"52⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\81A3.tmp"C:\Users\Admin\AppData\Local\Temp\81A3.tmp"53⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\8220.tmp"C:\Users\Admin\AppData\Local\Temp\8220.tmp"54⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\82AD.tmp"C:\Users\Admin\AppData\Local\Temp\82AD.tmp"55⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"56⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\8388.tmp"C:\Users\Admin\AppData\Local\Temp\8388.tmp"57⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\8405.tmp"C:\Users\Admin\AppData\Local\Temp\8405.tmp"58⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\8491.tmp"C:\Users\Admin\AppData\Local\Temp\8491.tmp"59⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\84FF.tmp"C:\Users\Admin\AppData\Local\Temp\84FF.tmp"60⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\859B.tmp"C:\Users\Admin\AppData\Local\Temp\859B.tmp"61⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\8628.tmp"C:\Users\Admin\AppData\Local\Temp\8628.tmp"62⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\8695.tmp"C:\Users\Admin\AppData\Local\Temp\8695.tmp"63⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\8722.tmp"C:\Users\Admin\AppData\Local\Temp\8722.tmp"64⤵
- Executes dropped EXE
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\87AE.tmp"C:\Users\Admin\AppData\Local\Temp\87AE.tmp"65⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\881C.tmp"C:\Users\Admin\AppData\Local\Temp\881C.tmp"66⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\88C7.tmp"C:\Users\Admin\AppData\Local\Temp\88C7.tmp"67⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\89A2.tmp"C:\Users\Admin\AppData\Local\Temp\89A2.tmp"68⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"69⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"70⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\8B48.tmp"C:\Users\Admin\AppData\Local\Temp\8B48.tmp"71⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"72⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\8C61.tmp"C:\Users\Admin\AppData\Local\Temp\8C61.tmp"73⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"74⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"75⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\8E07.tmp"C:\Users\Admin\AppData\Local\Temp\8E07.tmp"76⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"77⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\8F30.tmp"C:\Users\Admin\AppData\Local\Temp\8F30.tmp"78⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"79⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"80⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"81⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\9163.tmp"C:\Users\Admin\AppData\Local\Temp\9163.tmp"82⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\91D0.tmp"C:\Users\Admin\AppData\Local\Temp\91D0.tmp"83⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\923D.tmp"C:\Users\Admin\AppData\Local\Temp\923D.tmp"84⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"85⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"86⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"87⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\947F.tmp"C:\Users\Admin\AppData\Local\Temp\947F.tmp"88⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\950C.tmp"C:\Users\Admin\AppData\Local\Temp\950C.tmp"89⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"90⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\9606.tmp"C:\Users\Admin\AppData\Local\Temp\9606.tmp"91⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"92⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\9710.tmp"C:\Users\Admin\AppData\Local\Temp\9710.tmp"93⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\978D.tmp"C:\Users\Admin\AppData\Local\Temp\978D.tmp"94⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\9839.tmp"C:\Users\Admin\AppData\Local\Temp\9839.tmp"95⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\98D5.tmp"C:\Users\Admin\AppData\Local\Temp\98D5.tmp"96⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\9952.tmp"C:\Users\Admin\AppData\Local\Temp\9952.tmp"97⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"98⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"99⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"100⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"101⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"102⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"103⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"104⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"105⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"106⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"107⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"108⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\A028.tmp"C:\Users\Admin\AppData\Local\Temp\A028.tmp"109⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"110⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"111⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"112⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"113⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"114⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"115⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"116⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"117⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"118⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"119⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"120⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"121⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"122⤵PID:908
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-