Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/03/2024, 15:56
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-06_f461c370159eadb91c39cc5b942fe1b5_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-03-06_f461c370159eadb91c39cc5b942fe1b5_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-06_f461c370159eadb91c39cc5b942fe1b5_mafia.exe
-
Size
487KB
-
MD5
f461c370159eadb91c39cc5b942fe1b5
-
SHA1
ee2c4ce668445efe8d94c211c70876121a434f1a
-
SHA256
d675e0d7ee58dd3020c236e323a97d4472dd1add0483f4a227639337c987a10e
-
SHA512
aa00fac36936d46dccf8dd3a9b91c6d4ba94b5c23fe31798576804e425860eb946553c6176c21dbec2b96203e7e86caac0cdfaa747879aa37c3be68dbd2945aa
-
SSDEEP
6144:zorf3lPvovsgZnqG2C7mOTeiLxDxR6XnZbElL39CkdXN7lfrZcz9XsUF6Ajn8iN:yU5rCOTeiNf6XnV8LNCSX7tw5jn8DbZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1984 F84A.tmp 1668 D6.tmp 3880 460.tmp 4188 55A.tmp 3472 5E7.tmp 5060 700.tmp 1084 7FA.tmp 380 904.tmp 4868 A1D.tmp 1088 B46.tmp 3964 D1A.tmp 4156 DC6.tmp 3392 E82.tmp 4924 F4D.tmp 3716 FE9.tmp 916 120C.tmp 4488 1316.tmp 4216 141F.tmp 4172 14DB.tmp 5036 1623.tmp 3780 174C.tmp 3884 1884.tmp 2680 19CC.tmp 1984 1A98.tmp 4540 1BB1.tmp 3880 1C9B.tmp 3308 1D86.tmp 3056 1E60.tmp 2976 1F3B.tmp 1508 2025.tmp 3432 217D.tmp 2264 2296.tmp 4868 2362.tmp 1376 240D.tmp 1224 24C9.tmp 3248 2565.tmp 1880 25F2.tmp 3392 26BD.tmp 2916 2759.tmp 3236 27E6.tmp 1692 2882.tmp 3300 28FF.tmp 2060 297C.tmp 4428 29F9.tmp 404 2A66.tmp 4056 2B51.tmp 1388 2BCE.tmp 2808 2C6A.tmp 4240 2CE7.tmp 3884 2D74.tmp 4932 2E10.tmp 3404 2EAC.tmp 2432 2F29.tmp 1800 2FC5.tmp 4536 3062.tmp 3104 311D.tmp 4040 319A.tmp 3664 3236.tmp 4264 32E2.tmp 3552 335F.tmp 2796 33EC.tmp 1084 3479.tmp 1508 34F6.tmp 3636 3573.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2800 wrote to memory of 1984 2800 2024-03-06_f461c370159eadb91c39cc5b942fe1b5_mafia.exe 96 PID 2800 wrote to memory of 1984 2800 2024-03-06_f461c370159eadb91c39cc5b942fe1b5_mafia.exe 96 PID 2800 wrote to memory of 1984 2800 2024-03-06_f461c370159eadb91c39cc5b942fe1b5_mafia.exe 96 PID 1984 wrote to memory of 1668 1984 F84A.tmp 98 PID 1984 wrote to memory of 1668 1984 F84A.tmp 98 PID 1984 wrote to memory of 1668 1984 F84A.tmp 98 PID 1668 wrote to memory of 3880 1668 D6.tmp 99 PID 1668 wrote to memory of 3880 1668 D6.tmp 99 PID 1668 wrote to memory of 3880 1668 D6.tmp 99 PID 3880 wrote to memory of 4188 3880 460.tmp 100 PID 3880 wrote to memory of 4188 3880 460.tmp 100 PID 3880 wrote to memory of 4188 3880 460.tmp 100 PID 4188 wrote to memory of 3472 4188 55A.tmp 101 PID 4188 wrote to memory of 3472 4188 55A.tmp 101 PID 4188 wrote to memory of 3472 4188 55A.tmp 101 PID 3472 wrote to memory of 5060 3472 5E7.tmp 102 PID 3472 wrote to memory of 5060 3472 5E7.tmp 102 PID 3472 wrote to memory of 5060 3472 5E7.tmp 102 PID 5060 wrote to memory of 1084 5060 700.tmp 103 PID 5060 wrote to memory of 1084 5060 700.tmp 103 PID 5060 wrote to memory of 1084 5060 700.tmp 103 PID 1084 wrote to memory of 380 1084 7FA.tmp 104 PID 1084 wrote to memory of 380 1084 7FA.tmp 104 PID 1084 wrote to memory of 380 1084 7FA.tmp 104 PID 380 wrote to memory of 4868 380 904.tmp 105 PID 380 wrote to memory of 4868 380 904.tmp 105 PID 380 wrote to memory of 4868 380 904.tmp 105 PID 4868 wrote to memory of 1088 4868 A1D.tmp 106 PID 4868 wrote to memory of 1088 4868 A1D.tmp 106 PID 4868 wrote to memory of 1088 4868 A1D.tmp 106 PID 1088 wrote to memory of 3964 1088 B46.tmp 108 PID 1088 wrote to memory of 3964 1088 B46.tmp 108 PID 1088 wrote to memory of 3964 1088 B46.tmp 108 PID 3964 wrote to memory of 4156 3964 D1A.tmp 109 PID 3964 wrote to memory of 4156 3964 D1A.tmp 109 PID 3964 wrote to memory of 4156 3964 D1A.tmp 109 PID 4156 wrote to memory of 3392 4156 DC6.tmp 110 PID 4156 wrote to memory of 3392 4156 DC6.tmp 110 PID 4156 wrote to memory of 3392 4156 DC6.tmp 110 PID 3392 wrote to memory of 4924 3392 E82.tmp 111 PID 3392 wrote to memory of 4924 3392 E82.tmp 111 PID 3392 wrote to memory of 4924 3392 E82.tmp 111 PID 4924 wrote to memory of 3716 4924 F4D.tmp 112 PID 4924 wrote to memory of 3716 4924 F4D.tmp 112 PID 4924 wrote to memory of 3716 4924 F4D.tmp 112 PID 3716 wrote to memory of 916 3716 FE9.tmp 113 PID 3716 wrote to memory of 916 3716 FE9.tmp 113 PID 3716 wrote to memory of 916 3716 FE9.tmp 113 PID 916 wrote to memory of 4488 916 120C.tmp 114 PID 916 wrote to memory of 4488 916 120C.tmp 114 PID 916 wrote to memory of 4488 916 120C.tmp 114 PID 4488 wrote to memory of 4216 4488 1316.tmp 115 PID 4488 wrote to memory of 4216 4488 1316.tmp 115 PID 4488 wrote to memory of 4216 4488 1316.tmp 115 PID 4216 wrote to memory of 4172 4216 141F.tmp 117 PID 4216 wrote to memory of 4172 4216 141F.tmp 117 PID 4216 wrote to memory of 4172 4216 141F.tmp 117 PID 4172 wrote to memory of 5036 4172 14DB.tmp 118 PID 4172 wrote to memory of 5036 4172 14DB.tmp 118 PID 4172 wrote to memory of 5036 4172 14DB.tmp 118 PID 5036 wrote to memory of 3780 5036 1623.tmp 119 PID 5036 wrote to memory of 3780 5036 1623.tmp 119 PID 5036 wrote to memory of 3780 5036 1623.tmp 119 PID 3780 wrote to memory of 3884 3780 174C.tmp 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-06_f461c370159eadb91c39cc5b942fe1b5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-06_f461c370159eadb91c39cc5b942fe1b5_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\F84A.tmp"C:\Users\Admin\AppData\Local\Temp\F84A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\D6.tmp"C:\Users\Admin\AppData\Local\Temp\D6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\460.tmp"C:\Users\Admin\AppData\Local\Temp\460.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\55A.tmp"C:\Users\Admin\AppData\Local\Temp\55A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\5E7.tmp"C:\Users\Admin\AppData\Local\Temp\5E7.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\700.tmp"C:\Users\Admin\AppData\Local\Temp\700.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\7FA.tmp"C:\Users\Admin\AppData\Local\Temp\7FA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\904.tmp"C:\Users\Admin\AppData\Local\Temp\904.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\A1D.tmp"C:\Users\Admin\AppData\Local\Temp\A1D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\B46.tmp"C:\Users\Admin\AppData\Local\Temp\B46.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\D1A.tmp"C:\Users\Admin\AppData\Local\Temp\D1A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\DC6.tmp"C:\Users\Admin\AppData\Local\Temp\DC6.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\E82.tmp"C:\Users\Admin\AppData\Local\Temp\E82.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\F4D.tmp"C:\Users\Admin\AppData\Local\Temp\F4D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\FE9.tmp"C:\Users\Admin\AppData\Local\Temp\FE9.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\120C.tmp"C:\Users\Admin\AppData\Local\Temp\120C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\1316.tmp"C:\Users\Admin\AppData\Local\Temp\1316.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\141F.tmp"C:\Users\Admin\AppData\Local\Temp\141F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\14DB.tmp"C:\Users\Admin\AppData\Local\Temp\14DB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\1623.tmp"C:\Users\Admin\AppData\Local\Temp\1623.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\174C.tmp"C:\Users\Admin\AppData\Local\Temp\174C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\1884.tmp"C:\Users\Admin\AppData\Local\Temp\1884.tmp"23⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\19CC.tmp"C:\Users\Admin\AppData\Local\Temp\19CC.tmp"24⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\1A98.tmp"C:\Users\Admin\AppData\Local\Temp\1A98.tmp"25⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"26⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\1C9B.tmp"C:\Users\Admin\AppData\Local\Temp\1C9B.tmp"27⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\1D86.tmp"C:\Users\Admin\AppData\Local\Temp\1D86.tmp"28⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\1E60.tmp"C:\Users\Admin\AppData\Local\Temp\1E60.tmp"29⤵
- Executes dropped EXE
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\1F3B.tmp"C:\Users\Admin\AppData\Local\Temp\1F3B.tmp"30⤵
- Executes dropped EXE
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\2025.tmp"C:\Users\Admin\AppData\Local\Temp\2025.tmp"31⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\217D.tmp"C:\Users\Admin\AppData\Local\Temp\217D.tmp"32⤵
- Executes dropped EXE
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\2296.tmp"C:\Users\Admin\AppData\Local\Temp\2296.tmp"33⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\2362.tmp"C:\Users\Admin\AppData\Local\Temp\2362.tmp"34⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\240D.tmp"C:\Users\Admin\AppData\Local\Temp\240D.tmp"35⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\24C9.tmp"C:\Users\Admin\AppData\Local\Temp\24C9.tmp"36⤵
- Executes dropped EXE
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\2565.tmp"C:\Users\Admin\AppData\Local\Temp\2565.tmp"37⤵
- Executes dropped EXE
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\25F2.tmp"C:\Users\Admin\AppData\Local\Temp\25F2.tmp"38⤵
- Executes dropped EXE
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\26BD.tmp"C:\Users\Admin\AppData\Local\Temp\26BD.tmp"39⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\2759.tmp"C:\Users\Admin\AppData\Local\Temp\2759.tmp"40⤵
- Executes dropped EXE
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\27E6.tmp"C:\Users\Admin\AppData\Local\Temp\27E6.tmp"41⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\2882.tmp"C:\Users\Admin\AppData\Local\Temp\2882.tmp"42⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\28FF.tmp"C:\Users\Admin\AppData\Local\Temp\28FF.tmp"43⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\297C.tmp"C:\Users\Admin\AppData\Local\Temp\297C.tmp"44⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\29F9.tmp"C:\Users\Admin\AppData\Local\Temp\29F9.tmp"45⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\2A66.tmp"C:\Users\Admin\AppData\Local\Temp\2A66.tmp"46⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\2B51.tmp"C:\Users\Admin\AppData\Local\Temp\2B51.tmp"47⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\2BCE.tmp"C:\Users\Admin\AppData\Local\Temp\2BCE.tmp"48⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\2C6A.tmp"C:\Users\Admin\AppData\Local\Temp\2C6A.tmp"49⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"50⤵
- Executes dropped EXE
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\2D74.tmp"C:\Users\Admin\AppData\Local\Temp\2D74.tmp"51⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\2E10.tmp"C:\Users\Admin\AppData\Local\Temp\2E10.tmp"52⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\2EAC.tmp"C:\Users\Admin\AppData\Local\Temp\2EAC.tmp"53⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\2F29.tmp"C:\Users\Admin\AppData\Local\Temp\2F29.tmp"54⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\2FC5.tmp"C:\Users\Admin\AppData\Local\Temp\2FC5.tmp"55⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\3062.tmp"C:\Users\Admin\AppData\Local\Temp\3062.tmp"56⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\311D.tmp"C:\Users\Admin\AppData\Local\Temp\311D.tmp"57⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\319A.tmp"C:\Users\Admin\AppData\Local\Temp\319A.tmp"58⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\3236.tmp"C:\Users\Admin\AppData\Local\Temp\3236.tmp"59⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\32E2.tmp"C:\Users\Admin\AppData\Local\Temp\32E2.tmp"60⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\335F.tmp"C:\Users\Admin\AppData\Local\Temp\335F.tmp"61⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"62⤵
- Executes dropped EXE
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\3479.tmp"C:\Users\Admin\AppData\Local\Temp\3479.tmp"63⤵
- Executes dropped EXE
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\34F6.tmp"C:\Users\Admin\AppData\Local\Temp\34F6.tmp"64⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\3573.tmp"C:\Users\Admin\AppData\Local\Temp\3573.tmp"65⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\35F0.tmp"C:\Users\Admin\AppData\Local\Temp\35F0.tmp"66⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\367C.tmp"C:\Users\Admin\AppData\Local\Temp\367C.tmp"67⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\3718.tmp"C:\Users\Admin\AppData\Local\Temp\3718.tmp"68⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\37B5.tmp"C:\Users\Admin\AppData\Local\Temp\37B5.tmp"69⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\3841.tmp"C:\Users\Admin\AppData\Local\Temp\3841.tmp"70⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\38DE.tmp"C:\Users\Admin\AppData\Local\Temp\38DE.tmp"71⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\397A.tmp"C:\Users\Admin\AppData\Local\Temp\397A.tmp"72⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\3A06.tmp"C:\Users\Admin\AppData\Local\Temp\3A06.tmp"73⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\3A93.tmp"C:\Users\Admin\AppData\Local\Temp\3A93.tmp"74⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\3B8D.tmp"C:\Users\Admin\AppData\Local\Temp\3B8D.tmp"75⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\3BFA.tmp"C:\Users\Admin\AppData\Local\Temp\3BFA.tmp"76⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\3C77.tmp"C:\Users\Admin\AppData\Local\Temp\3C77.tmp"77⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\3D71.tmp"C:\Users\Admin\AppData\Local\Temp\3D71.tmp"78⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\3DEE.tmp"C:\Users\Admin\AppData\Local\Temp\3DEE.tmp"79⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\3E6B.tmp"C:\Users\Admin\AppData\Local\Temp\3E6B.tmp"80⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\3F75.tmp"C:\Users\Admin\AppData\Local\Temp\3F75.tmp"81⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\4011.tmp"C:\Users\Admin\AppData\Local\Temp\4011.tmp"82⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\408E.tmp"C:\Users\Admin\AppData\Local\Temp\408E.tmp"83⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\412B.tmp"C:\Users\Admin\AppData\Local\Temp\412B.tmp"84⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\41C7.tmp"C:\Users\Admin\AppData\Local\Temp\41C7.tmp"85⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\4282.tmp"C:\Users\Admin\AppData\Local\Temp\4282.tmp"86⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\42FF.tmp"C:\Users\Admin\AppData\Local\Temp\42FF.tmp"87⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\439C.tmp"C:\Users\Admin\AppData\Local\Temp\439C.tmp"88⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\4438.tmp"C:\Users\Admin\AppData\Local\Temp\4438.tmp"89⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\44E4.tmp"C:\Users\Admin\AppData\Local\Temp\44E4.tmp"90⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\4570.tmp"C:\Users\Admin\AppData\Local\Temp\4570.tmp"91⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\45FD.tmp"C:\Users\Admin\AppData\Local\Temp\45FD.tmp"92⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\467A.tmp"C:\Users\Admin\AppData\Local\Temp\467A.tmp"93⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\4764.tmp"C:\Users\Admin\AppData\Local\Temp\4764.tmp"94⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\4810.tmp"C:\Users\Admin\AppData\Local\Temp\4810.tmp"95⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\488D.tmp"C:\Users\Admin\AppData\Local\Temp\488D.tmp"96⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\4939.tmp"C:\Users\Admin\AppData\Local\Temp\4939.tmp"97⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\4A52.tmp"C:\Users\Admin\AppData\Local\Temp\4A52.tmp"98⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\4D11.tmp"C:\Users\Admin\AppData\Local\Temp\4D11.tmp"99⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\4D7F.tmp"C:\Users\Admin\AppData\Local\Temp\4D7F.tmp"100⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\4E1B.tmp"C:\Users\Admin\AppData\Local\Temp\4E1B.tmp"101⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\4EC7.tmp"C:\Users\Admin\AppData\Local\Temp\4EC7.tmp"102⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\505D.tmp"C:\Users\Admin\AppData\Local\Temp\505D.tmp"103⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\50DA.tmp"C:\Users\Admin\AppData\Local\Temp\50DA.tmp"104⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\5148.tmp"C:\Users\Admin\AppData\Local\Temp\5148.tmp"105⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\51D4.tmp"C:\Users\Admin\AppData\Local\Temp\51D4.tmp"106⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\529F.tmp"C:\Users\Admin\AppData\Local\Temp\529F.tmp"107⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\530D.tmp"C:\Users\Admin\AppData\Local\Temp\530D.tmp"108⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\53A9.tmp"C:\Users\Admin\AppData\Local\Temp\53A9.tmp"109⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\5416.tmp"C:\Users\Admin\AppData\Local\Temp\5416.tmp"110⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\5484.tmp"C:\Users\Admin\AppData\Local\Temp\5484.tmp"111⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\560A.tmp"C:\Users\Admin\AppData\Local\Temp\560A.tmp"112⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\5687.tmp"C:\Users\Admin\AppData\Local\Temp\5687.tmp"113⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\56F5.tmp"C:\Users\Admin\AppData\Local\Temp\56F5.tmp"114⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\5791.tmp"C:\Users\Admin\AppData\Local\Temp\5791.tmp"115⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\589B.tmp"C:\Users\Admin\AppData\Local\Temp\589B.tmp"116⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\5946.tmp"C:\Users\Admin\AppData\Local\Temp\5946.tmp"117⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\5A02.tmp"C:\Users\Admin\AppData\Local\Temp\5A02.tmp"118⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"119⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\5C63.tmp"C:\Users\Admin\AppData\Local\Temp\5C63.tmp"120⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\5D1F.tmp"C:\Users\Admin\AppData\Local\Temp\5D1F.tmp"121⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\5D9C.tmp"C:\Users\Admin\AppData\Local\Temp\5D9C.tmp"122⤵PID:2100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-