Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26/03/2024, 16:43
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-26_968006a7839eef920c809d646613313b_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-03-26_968006a7839eef920c809d646613313b_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-26_968006a7839eef920c809d646613313b_mafia.exe
-
Size
487KB
-
MD5
968006a7839eef920c809d646613313b
-
SHA1
86047cf86c95b9029e61cdd0f2f5969b52444d2d
-
SHA256
d3e9af0660d82f00350871d2cb8bad400b19ab555043ae058295a118096dfa6e
-
SHA512
309c2de6c2519ade02c2bd2ce3713aedb47e8c115e1b75ff820c941f80fe07fa63d733748cea1aeac9212af1167f2d830307ce008de8d98a485c23471cec6373
-
SSDEEP
6144:zorf3lPvovsgZnqG2C7mOTeiLxDx8apfkmDKxmj9P3uzlkKUQZslV5944iQ8qVFR:yU5rCOTeiN5KxZR6bjgUHbZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3088 3C1E.tmp 5088 3CBB.tmp 1496 3D28.tmp 1088 3D95.tmp 4384 3DE4.tmp 2716 3E41.tmp 3356 3EAF.tmp 1944 3F0C.tmp 1456 3F6A.tmp 4428 3FE7.tmp 2464 4045.tmp 8 4093.tmp 384 40E1.tmp 3392 413F.tmp 996 418D.tmp 4760 41FA.tmp 4052 4258.tmp 4192 42A6.tmp 3972 42F4.tmp 1120 4343.tmp 1152 4391.tmp 2668 43DF.tmp 2672 442D.tmp 2824 448B.tmp 3240 44E8.tmp 3632 4556.tmp 1624 45A4.tmp 1376 4621.tmp 1892 466F.tmp 344 46BD.tmp 5084 474A.tmp 1576 47A8.tmp 3532 47F6.tmp 5080 4844.tmp 3556 48E0.tmp 4260 493E.tmp 3648 498C.tmp 1776 49DA.tmp 404 4A38.tmp 1088 4A96.tmp 1652 4AF3.tmp 3808 4B41.tmp 4612 4B90.tmp 4668 4BED.tmp 2660 4C3B.tmp 2512 4C8A.tmp 3676 4CE7.tmp 1456 4D45.tmp 4828 4D93.tmp 4888 4DE1.tmp 4084 4E2F.tmp 3752 4E7E.tmp 4844 4ECC.tmp 4072 4F29.tmp 4404 4F87.tmp 1612 4FD5.tmp 2596 5023.tmp 3220 5072.tmp 4052 50C0.tmp 2304 511D.tmp 2172 516C.tmp 452 51BA.tmp 4640 5208.tmp 1152 5266.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3556 wrote to memory of 3088 3556 2024-03-26_968006a7839eef920c809d646613313b_mafia.exe 89 PID 3556 wrote to memory of 3088 3556 2024-03-26_968006a7839eef920c809d646613313b_mafia.exe 89 PID 3556 wrote to memory of 3088 3556 2024-03-26_968006a7839eef920c809d646613313b_mafia.exe 89 PID 3088 wrote to memory of 5088 3088 3C1E.tmp 90 PID 3088 wrote to memory of 5088 3088 3C1E.tmp 90 PID 3088 wrote to memory of 5088 3088 3C1E.tmp 90 PID 5088 wrote to memory of 1496 5088 3CBB.tmp 92 PID 5088 wrote to memory of 1496 5088 3CBB.tmp 92 PID 5088 wrote to memory of 1496 5088 3CBB.tmp 92 PID 1496 wrote to memory of 1088 1496 3D28.tmp 94 PID 1496 wrote to memory of 1088 1496 3D28.tmp 94 PID 1496 wrote to memory of 1088 1496 3D28.tmp 94 PID 1088 wrote to memory of 4384 1088 3D95.tmp 95 PID 1088 wrote to memory of 4384 1088 3D95.tmp 95 PID 1088 wrote to memory of 4384 1088 3D95.tmp 95 PID 4384 wrote to memory of 2716 4384 3DE4.tmp 97 PID 4384 wrote to memory of 2716 4384 3DE4.tmp 97 PID 4384 wrote to memory of 2716 4384 3DE4.tmp 97 PID 2716 wrote to memory of 3356 2716 3E41.tmp 98 PID 2716 wrote to memory of 3356 2716 3E41.tmp 98 PID 2716 wrote to memory of 3356 2716 3E41.tmp 98 PID 3356 wrote to memory of 1944 3356 3EAF.tmp 99 PID 3356 wrote to memory of 1944 3356 3EAF.tmp 99 PID 3356 wrote to memory of 1944 3356 3EAF.tmp 99 PID 1944 wrote to memory of 1456 1944 3F0C.tmp 100 PID 1944 wrote to memory of 1456 1944 3F0C.tmp 100 PID 1944 wrote to memory of 1456 1944 3F0C.tmp 100 PID 1456 wrote to memory of 4428 1456 3F6A.tmp 101 PID 1456 wrote to memory of 4428 1456 3F6A.tmp 101 PID 1456 wrote to memory of 4428 1456 3F6A.tmp 101 PID 4428 wrote to memory of 2464 4428 3FE7.tmp 102 PID 4428 wrote to memory of 2464 4428 3FE7.tmp 102 PID 4428 wrote to memory of 2464 4428 3FE7.tmp 102 PID 2464 wrote to memory of 8 2464 4045.tmp 103 PID 2464 wrote to memory of 8 2464 4045.tmp 103 PID 2464 wrote to memory of 8 2464 4045.tmp 103 PID 8 wrote to memory of 384 8 4093.tmp 104 PID 8 wrote to memory of 384 8 4093.tmp 104 PID 8 wrote to memory of 384 8 4093.tmp 104 PID 384 wrote to memory of 3392 384 40E1.tmp 105 PID 384 wrote to memory of 3392 384 40E1.tmp 105 PID 384 wrote to memory of 3392 384 40E1.tmp 105 PID 3392 wrote to memory of 996 3392 413F.tmp 106 PID 3392 wrote to memory of 996 3392 413F.tmp 106 PID 3392 wrote to memory of 996 3392 413F.tmp 106 PID 996 wrote to memory of 4760 996 418D.tmp 107 PID 996 wrote to memory of 4760 996 418D.tmp 107 PID 996 wrote to memory of 4760 996 418D.tmp 107 PID 4760 wrote to memory of 4052 4760 41FA.tmp 108 PID 4760 wrote to memory of 4052 4760 41FA.tmp 108 PID 4760 wrote to memory of 4052 4760 41FA.tmp 108 PID 4052 wrote to memory of 4192 4052 4258.tmp 109 PID 4052 wrote to memory of 4192 4052 4258.tmp 109 PID 4052 wrote to memory of 4192 4052 4258.tmp 109 PID 4192 wrote to memory of 3972 4192 42A6.tmp 110 PID 4192 wrote to memory of 3972 4192 42A6.tmp 110 PID 4192 wrote to memory of 3972 4192 42A6.tmp 110 PID 3972 wrote to memory of 1120 3972 42F4.tmp 111 PID 3972 wrote to memory of 1120 3972 42F4.tmp 111 PID 3972 wrote to memory of 1120 3972 42F4.tmp 111 PID 1120 wrote to memory of 1152 1120 4343.tmp 112 PID 1120 wrote to memory of 1152 1120 4343.tmp 112 PID 1120 wrote to memory of 1152 1120 4343.tmp 112 PID 1152 wrote to memory of 2668 1152 4391.tmp 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-26_968006a7839eef920c809d646613313b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-26_968006a7839eef920c809d646613313b_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\3D28.tmp"C:\Users\Admin\AppData\Local\Temp\3D28.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\3D95.tmp"C:\Users\Admin\AppData\Local\Temp\3D95.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\3E41.tmp"C:\Users\Admin\AppData\Local\Temp\3E41.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\3EAF.tmp"C:\Users\Admin\AppData\Local\Temp\3EAF.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\4045.tmp"C:\Users\Admin\AppData\Local\Temp\4045.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\4093.tmp"C:\Users\Admin\AppData\Local\Temp\4093.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\40E1.tmp"C:\Users\Admin\AppData\Local\Temp\40E1.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\AppData\Local\Temp\413F.tmp"C:\Users\Admin\AppData\Local\Temp\413F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\418D.tmp"C:\Users\Admin\AppData\Local\Temp\418D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\4258.tmp"C:\Users\Admin\AppData\Local\Temp\4258.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\42A6.tmp"C:\Users\Admin\AppData\Local\Temp\42A6.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\42F4.tmp"C:\Users\Admin\AppData\Local\Temp\42F4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"23⤵
- Executes dropped EXE
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"24⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\448B.tmp"C:\Users\Admin\AppData\Local\Temp\448B.tmp"25⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"26⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"27⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"28⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"29⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"30⤵
- Executes dropped EXE
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"31⤵
- Executes dropped EXE
PID:344 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"32⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"33⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"34⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"35⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"36⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"37⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"38⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"39⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"40⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"41⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"42⤵
- Executes dropped EXE
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"43⤵
- Executes dropped EXE
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"44⤵
- Executes dropped EXE
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"45⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"46⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"47⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"48⤵
- Executes dropped EXE
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"49⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"50⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"51⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"52⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"53⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"54⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"55⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"56⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"57⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"58⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"59⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"60⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"61⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"62⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"63⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"64⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"65⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"66⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"67⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"68⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"69⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"70⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"71⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"72⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"73⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"74⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"75⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"76⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"77⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"78⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"79⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"80⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"81⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"82⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"83⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"84⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"85⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"86⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"87⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"88⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"89⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"90⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"91⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"92⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"93⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"94⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"95⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"96⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"97⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"98⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"99⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"100⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"101⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"102⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"103⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"104⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"105⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"106⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"107⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"108⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"109⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"110⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"111⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"112⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"113⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"114⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"115⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"116⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"117⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"118⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"119⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"120⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"121⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"122⤵PID:1676
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-