Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
18/03/2024, 13:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-18_8e8385958034812bd7f8ff358d788a3e_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-03-18_8e8385958034812bd7f8ff358d788a3e_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-18_8e8385958034812bd7f8ff358d788a3e_mafia.exe
-
Size
520KB
-
MD5
8e8385958034812bd7f8ff358d788a3e
-
SHA1
70b91bf6ce07ddfad4bf25ade6a97985141855ad
-
SHA256
ffd16416288fa2be7ad7da8fbe39e042a4fd40c18095f163d3f7c20cf9e1b148
-
SHA512
599463276e2abb09e1bc01d66a6f296f350da9a7656250dee28876922567332e3c46e356df7e40ac295d9de95c847bf53295ed60b62f6b961856ae3c1dfeb966
-
SSDEEP
6144:lLvd/XzCjUIF1UuXLyQjmOH+JjLfDGdZHtqvGhZdr/HGepSlyv3Avy8WoqWrDajI:roRXOQjmOy0ZNpj/mep+yvdrkcUhNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5016 2F1E.tmp 4876 2F9B.tmp 1628 3009.tmp 1048 3076.tmp 2240 30D4.tmp 4476 3132.tmp 4092 319F.tmp 1036 31ED.tmp 2080 324B.tmp 2432 32A9.tmp 2492 32F7.tmp 2708 3345.tmp 1788 3393.tmp 4956 33F1.tmp 1400 344E.tmp 2188 34BC.tmp 4336 350A.tmp 3612 3568.tmp 1108 35D5.tmp 2860 3652.tmp 4776 36B0.tmp 1624 370E.tmp 2900 377B.tmp 2408 37C9.tmp 2336 3817.tmp 2032 3894.tmp 4628 38F2.tmp 4332 3950.tmp 4548 399E.tmp 3640 39FC.tmp 2556 3A79.tmp 3624 3AC7.tmp 1756 3B15.tmp 2776 3B63.tmp 1048 3BB1.tmp 2128 3BFF.tmp 1004 3C4D.tmp 3860 3CCA.tmp 4476 3D28.tmp 3004 3D76.tmp 4580 3DE4.tmp 2896 3E41.tmp 2432 3EBE.tmp 1276 3F1C.tmp 3368 3F7A.tmp 860 3FC8.tmp 4436 40F1.tmp 2496 415E.tmp 3652 41BC.tmp 4920 420A.tmp 468 4362.tmp 3740 4556.tmp 3348 45A4.tmp 3424 45F2.tmp 4228 4650.tmp 2552 46AE.tmp 4076 470B.tmp 2032 4759.tmp 964 47B7.tmp 4352 4815.tmp 1708 4863.tmp 2788 48C1.tmp 3008 491F.tmp 3456 497C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3916 wrote to memory of 5016 3916 2024-03-18_8e8385958034812bd7f8ff358d788a3e_mafia.exe 89 PID 3916 wrote to memory of 5016 3916 2024-03-18_8e8385958034812bd7f8ff358d788a3e_mafia.exe 89 PID 3916 wrote to memory of 5016 3916 2024-03-18_8e8385958034812bd7f8ff358d788a3e_mafia.exe 89 PID 5016 wrote to memory of 4876 5016 2F1E.tmp 91 PID 5016 wrote to memory of 4876 5016 2F1E.tmp 91 PID 5016 wrote to memory of 4876 5016 2F1E.tmp 91 PID 4876 wrote to memory of 1628 4876 2F9B.tmp 93 PID 4876 wrote to memory of 1628 4876 2F9B.tmp 93 PID 4876 wrote to memory of 1628 4876 2F9B.tmp 93 PID 1628 wrote to memory of 1048 1628 3009.tmp 127 PID 1628 wrote to memory of 1048 1628 3009.tmp 127 PID 1628 wrote to memory of 1048 1628 3009.tmp 127 PID 1048 wrote to memory of 2240 1048 3076.tmp 96 PID 1048 wrote to memory of 2240 1048 3076.tmp 96 PID 1048 wrote to memory of 2240 1048 3076.tmp 96 PID 2240 wrote to memory of 4476 2240 30D4.tmp 97 PID 2240 wrote to memory of 4476 2240 30D4.tmp 97 PID 2240 wrote to memory of 4476 2240 30D4.tmp 97 PID 4476 wrote to memory of 4092 4476 3132.tmp 98 PID 4476 wrote to memory of 4092 4476 3132.tmp 98 PID 4476 wrote to memory of 4092 4476 3132.tmp 98 PID 4092 wrote to memory of 1036 4092 319F.tmp 99 PID 4092 wrote to memory of 1036 4092 319F.tmp 99 PID 4092 wrote to memory of 1036 4092 319F.tmp 99 PID 1036 wrote to memory of 2080 1036 31ED.tmp 100 PID 1036 wrote to memory of 2080 1036 31ED.tmp 100 PID 1036 wrote to memory of 2080 1036 31ED.tmp 100 PID 2080 wrote to memory of 2432 2080 324B.tmp 101 PID 2080 wrote to memory of 2432 2080 324B.tmp 101 PID 2080 wrote to memory of 2432 2080 324B.tmp 101 PID 2432 wrote to memory of 2492 2432 32A9.tmp 102 PID 2432 wrote to memory of 2492 2432 32A9.tmp 102 PID 2432 wrote to memory of 2492 2432 32A9.tmp 102 PID 2492 wrote to memory of 2708 2492 32F7.tmp 103 PID 2492 wrote to memory of 2708 2492 32F7.tmp 103 PID 2492 wrote to memory of 2708 2492 32F7.tmp 103 PID 2708 wrote to memory of 1788 2708 3345.tmp 104 PID 2708 wrote to memory of 1788 2708 3345.tmp 104 PID 2708 wrote to memory of 1788 2708 3345.tmp 104 PID 1788 wrote to memory of 4956 1788 3393.tmp 105 PID 1788 wrote to memory of 4956 1788 3393.tmp 105 PID 1788 wrote to memory of 4956 1788 3393.tmp 105 PID 4956 wrote to memory of 1400 4956 33F1.tmp 106 PID 4956 wrote to memory of 1400 4956 33F1.tmp 106 PID 4956 wrote to memory of 1400 4956 33F1.tmp 106 PID 1400 wrote to memory of 2188 1400 344E.tmp 107 PID 1400 wrote to memory of 2188 1400 344E.tmp 107 PID 1400 wrote to memory of 2188 1400 344E.tmp 107 PID 2188 wrote to memory of 4336 2188 34BC.tmp 108 PID 2188 wrote to memory of 4336 2188 34BC.tmp 108 PID 2188 wrote to memory of 4336 2188 34BC.tmp 108 PID 4336 wrote to memory of 3612 4336 350A.tmp 109 PID 4336 wrote to memory of 3612 4336 350A.tmp 109 PID 4336 wrote to memory of 3612 4336 350A.tmp 109 PID 3612 wrote to memory of 1108 3612 3568.tmp 110 PID 3612 wrote to memory of 1108 3612 3568.tmp 110 PID 3612 wrote to memory of 1108 3612 3568.tmp 110 PID 1108 wrote to memory of 2860 1108 35D5.tmp 112 PID 1108 wrote to memory of 2860 1108 35D5.tmp 112 PID 1108 wrote to memory of 2860 1108 35D5.tmp 112 PID 2860 wrote to memory of 4776 2860 3652.tmp 113 PID 2860 wrote to memory of 4776 2860 3652.tmp 113 PID 2860 wrote to memory of 4776 2860 3652.tmp 113 PID 4776 wrote to memory of 1624 4776 36B0.tmp 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-18_8e8385958034812bd7f8ff358d788a3e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-18_8e8385958034812bd7f8ff358d788a3e_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\2F1E.tmp"C:\Users\Admin\AppData\Local\Temp\2F1E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\2F9B.tmp"C:\Users\Admin\AppData\Local\Temp\2F9B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\3009.tmp"C:\Users\Admin\AppData\Local\Temp\3009.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\3076.tmp"C:\Users\Admin\AppData\Local\Temp\3076.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\30D4.tmp"C:\Users\Admin\AppData\Local\Temp\30D4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\3132.tmp"C:\Users\Admin\AppData\Local\Temp\3132.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\319F.tmp"C:\Users\Admin\AppData\Local\Temp\319F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\31ED.tmp"C:\Users\Admin\AppData\Local\Temp\31ED.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\324B.tmp"C:\Users\Admin\AppData\Local\Temp\324B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\32A9.tmp"C:\Users\Admin\AppData\Local\Temp\32A9.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\32F7.tmp"C:\Users\Admin\AppData\Local\Temp\32F7.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\3345.tmp"C:\Users\Admin\AppData\Local\Temp\3345.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\3393.tmp"C:\Users\Admin\AppData\Local\Temp\3393.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\33F1.tmp"C:\Users\Admin\AppData\Local\Temp\33F1.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\344E.tmp"C:\Users\Admin\AppData\Local\Temp\344E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\34BC.tmp"C:\Users\Admin\AppData\Local\Temp\34BC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\350A.tmp"C:\Users\Admin\AppData\Local\Temp\350A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\3568.tmp"C:\Users\Admin\AppData\Local\Temp\3568.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\35D5.tmp"C:\Users\Admin\AppData\Local\Temp\35D5.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\3652.tmp"C:\Users\Admin\AppData\Local\Temp\3652.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\36B0.tmp"C:\Users\Admin\AppData\Local\Temp\36B0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\370E.tmp"C:\Users\Admin\AppData\Local\Temp\370E.tmp"23⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\377B.tmp"C:\Users\Admin\AppData\Local\Temp\377B.tmp"24⤵
- Executes dropped EXE
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\37C9.tmp"C:\Users\Admin\AppData\Local\Temp\37C9.tmp"25⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\3817.tmp"C:\Users\Admin\AppData\Local\Temp\3817.tmp"26⤵
- Executes dropped EXE
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\3894.tmp"C:\Users\Admin\AppData\Local\Temp\3894.tmp"27⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\38F2.tmp"C:\Users\Admin\AppData\Local\Temp\38F2.tmp"28⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\3950.tmp"C:\Users\Admin\AppData\Local\Temp\3950.tmp"29⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\399E.tmp"C:\Users\Admin\AppData\Local\Temp\399E.tmp"30⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\39FC.tmp"C:\Users\Admin\AppData\Local\Temp\39FC.tmp"31⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\3A79.tmp"C:\Users\Admin\AppData\Local\Temp\3A79.tmp"32⤵
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"33⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\3B15.tmp"C:\Users\Admin\AppData\Local\Temp\3B15.tmp"34⤵
- Executes dropped EXE
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\3B63.tmp"C:\Users\Admin\AppData\Local\Temp\3B63.tmp"35⤵
- Executes dropped EXE
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\3BB1.tmp"C:\Users\Admin\AppData\Local\Temp\3BB1.tmp"36⤵
- Executes dropped EXE
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"37⤵
- Executes dropped EXE
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"38⤵
- Executes dropped EXE
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"39⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\3D28.tmp"C:\Users\Admin\AppData\Local\Temp\3D28.tmp"40⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\3D76.tmp"C:\Users\Admin\AppData\Local\Temp\3D76.tmp"41⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"42⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\3E41.tmp"C:\Users\Admin\AppData\Local\Temp\3E41.tmp"43⤵
- Executes dropped EXE
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"44⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"45⤵
- Executes dropped EXE
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"46⤵
- Executes dropped EXE
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"47⤵
- Executes dropped EXE
PID:860 -
C:\Users\Admin\AppData\Local\Temp\40F1.tmp"C:\Users\Admin\AppData\Local\Temp\40F1.tmp"48⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\415E.tmp"C:\Users\Admin\AppData\Local\Temp\415E.tmp"49⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\41BC.tmp"C:\Users\Admin\AppData\Local\Temp\41BC.tmp"50⤵
- Executes dropped EXE
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\420A.tmp"C:\Users\Admin\AppData\Local\Temp\420A.tmp"51⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\4362.tmp"C:\Users\Admin\AppData\Local\Temp\4362.tmp"52⤵
- Executes dropped EXE
PID:468 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"53⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"54⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\45F2.tmp"C:\Users\Admin\AppData\Local\Temp\45F2.tmp"55⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"56⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"57⤵
- Executes dropped EXE
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"58⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"59⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"60⤵
- Executes dropped EXE
PID:964 -
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"61⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"62⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"63⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"64⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"65⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"66⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"67⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"68⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"69⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"70⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"71⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"72⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"73⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"74⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"75⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"76⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"77⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"78⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"79⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"80⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"81⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"82⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"83⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"84⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"85⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"86⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"87⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"88⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"89⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"90⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"91⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"92⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"93⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"94⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"95⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"96⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"97⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"98⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"99⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"100⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"101⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"102⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"103⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"104⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"105⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"106⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"107⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"108⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"109⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"110⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"111⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"112⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"113⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"114⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"115⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"116⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"117⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"118⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"119⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"120⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"121⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"122⤵PID:4680
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-