Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
21/04/2024, 19:40
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-21_a7f67d7b0de71fd48f3bbb11849c0dde_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-21_a7f67d7b0de71fd48f3bbb11849c0dde_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-21_a7f67d7b0de71fd48f3bbb11849c0dde_mafia.exe
-
Size
486KB
-
MD5
a7f67d7b0de71fd48f3bbb11849c0dde
-
SHA1
e3e6cf4c4ecb292508041cd24a847e9f83250e34
-
SHA256
0f517655cdd9f7dbbbeab927fd54b5c8a4cc83f343dcd83204cf430fbc92702d
-
SHA512
120e3e87243948a12d137e41c03502544c3d69cca9bc66cc58676c7b9267f0853f227c274f85a94b5f668c7a09a40adda32f1eb2ee41701ecf1305edbe4aee88
-
SSDEEP
12288:UU5rCOTeiD82xsXWe6DoupmeRIxZSj2uuhbAYNZ:UUQOJD8msm9iZc2MYN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2732 F5CA.tmp 3924 F6C4.tmp 460 F760.tmp 1900 F8A8.tmp 2064 F983.tmp 3304 FA6D.tmp 1408 FB38.tmp 1112 FBF4.tmp 1968 FCAF.tmp 3792 FD6B.tmp 4696 FE26.tmp 4068 FEF1.tmp 2088 FFEB.tmp 1936 A7.tmp 4760 134.tmp 1672 1C0.tmp 1864 2AB.tmp 3476 347.tmp 3880 402.tmp 1816 4ED.tmp 2244 579.tmp 3728 616.tmp 3632 6B2.tmp 4280 79C.tmp 4172 848.tmp 3904 8C5.tmp 1528 971.tmp 4092 A1D.tmp 4776 AE8.tmp 4048 BB3.tmp 364 C4F.tmp 1956 CCC.tmp 3188 DC6.tmp 3896 E43.tmp 4552 EC0.tmp 312 F8B.tmp 5028 1037.tmp 4476 10C4.tmp 4384 1151.tmp 3204 11DD.tmp 1564 126A.tmp 1392 1316.tmp 3168 13C2.tmp 4428 149C.tmp 3964 1539.tmp 4380 15D5.tmp 1096 1642.tmp 2656 16DE.tmp 4256 176B.tmp 3184 1807.tmp 3928 1894.tmp 2444 1921.tmp 1040 19AD.tmp 4708 1A2A.tmp 3004 1AA7.tmp 3792 1B15.tmp 3900 1B92.tmp 2036 1C2E.tmp 2524 1CDA.tmp 4068 1DA5.tmp 3036 1E12.tmp 4952 1EBE.tmp 3584 1F3B.tmp 4760 1FC8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4292 wrote to memory of 2732 4292 2024-04-21_a7f67d7b0de71fd48f3bbb11849c0dde_mafia.exe 90 PID 4292 wrote to memory of 2732 4292 2024-04-21_a7f67d7b0de71fd48f3bbb11849c0dde_mafia.exe 90 PID 4292 wrote to memory of 2732 4292 2024-04-21_a7f67d7b0de71fd48f3bbb11849c0dde_mafia.exe 90 PID 2732 wrote to memory of 3924 2732 F5CA.tmp 91 PID 2732 wrote to memory of 3924 2732 F5CA.tmp 91 PID 2732 wrote to memory of 3924 2732 F5CA.tmp 91 PID 3924 wrote to memory of 460 3924 F6C4.tmp 92 PID 3924 wrote to memory of 460 3924 F6C4.tmp 92 PID 3924 wrote to memory of 460 3924 F6C4.tmp 92 PID 460 wrote to memory of 1900 460 F760.tmp 93 PID 460 wrote to memory of 1900 460 F760.tmp 93 PID 460 wrote to memory of 1900 460 F760.tmp 93 PID 1900 wrote to memory of 2064 1900 F8A8.tmp 94 PID 1900 wrote to memory of 2064 1900 F8A8.tmp 94 PID 1900 wrote to memory of 2064 1900 F8A8.tmp 94 PID 2064 wrote to memory of 3304 2064 F983.tmp 95 PID 2064 wrote to memory of 3304 2064 F983.tmp 95 PID 2064 wrote to memory of 3304 2064 F983.tmp 95 PID 3304 wrote to memory of 1408 3304 FA6D.tmp 96 PID 3304 wrote to memory of 1408 3304 FA6D.tmp 96 PID 3304 wrote to memory of 1408 3304 FA6D.tmp 96 PID 1408 wrote to memory of 1112 1408 FB38.tmp 97 PID 1408 wrote to memory of 1112 1408 FB38.tmp 97 PID 1408 wrote to memory of 1112 1408 FB38.tmp 97 PID 1112 wrote to memory of 1968 1112 FBF4.tmp 98 PID 1112 wrote to memory of 1968 1112 FBF4.tmp 98 PID 1112 wrote to memory of 1968 1112 FBF4.tmp 98 PID 1968 wrote to memory of 3792 1968 FCAF.tmp 99 PID 1968 wrote to memory of 3792 1968 FCAF.tmp 99 PID 1968 wrote to memory of 3792 1968 FCAF.tmp 99 PID 3792 wrote to memory of 4696 3792 FD6B.tmp 100 PID 3792 wrote to memory of 4696 3792 FD6B.tmp 100 PID 3792 wrote to memory of 4696 3792 FD6B.tmp 100 PID 4696 wrote to memory of 4068 4696 FE26.tmp 101 PID 4696 wrote to memory of 4068 4696 FE26.tmp 101 PID 4696 wrote to memory of 4068 4696 FE26.tmp 101 PID 4068 wrote to memory of 2088 4068 FEF1.tmp 102 PID 4068 wrote to memory of 2088 4068 FEF1.tmp 102 PID 4068 wrote to memory of 2088 4068 FEF1.tmp 102 PID 2088 wrote to memory of 1936 2088 FFEB.tmp 103 PID 2088 wrote to memory of 1936 2088 FFEB.tmp 103 PID 2088 wrote to memory of 1936 2088 FFEB.tmp 103 PID 1936 wrote to memory of 4760 1936 A7.tmp 104 PID 1936 wrote to memory of 4760 1936 A7.tmp 104 PID 1936 wrote to memory of 4760 1936 A7.tmp 104 PID 4760 wrote to memory of 1672 4760 134.tmp 105 PID 4760 wrote to memory of 1672 4760 134.tmp 105 PID 4760 wrote to memory of 1672 4760 134.tmp 105 PID 1672 wrote to memory of 1864 1672 1C0.tmp 106 PID 1672 wrote to memory of 1864 1672 1C0.tmp 106 PID 1672 wrote to memory of 1864 1672 1C0.tmp 106 PID 1864 wrote to memory of 3476 1864 2AB.tmp 107 PID 1864 wrote to memory of 3476 1864 2AB.tmp 107 PID 1864 wrote to memory of 3476 1864 2AB.tmp 107 PID 3476 wrote to memory of 3880 3476 347.tmp 108 PID 3476 wrote to memory of 3880 3476 347.tmp 108 PID 3476 wrote to memory of 3880 3476 347.tmp 108 PID 3880 wrote to memory of 1816 3880 402.tmp 109 PID 3880 wrote to memory of 1816 3880 402.tmp 109 PID 3880 wrote to memory of 1816 3880 402.tmp 109 PID 1816 wrote to memory of 2244 1816 4ED.tmp 110 PID 1816 wrote to memory of 2244 1816 4ED.tmp 110 PID 1816 wrote to memory of 2244 1816 4ED.tmp 110 PID 2244 wrote to memory of 3728 2244 579.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-21_a7f67d7b0de71fd48f3bbb11849c0dde_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-21_a7f67d7b0de71fd48f3bbb11849c0dde_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\F6C4.tmp"C:\Users\Admin\AppData\Local\Temp\F6C4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\F760.tmp"C:\Users\Admin\AppData\Local\Temp\F760.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\F983.tmp"C:\Users\Admin\AppData\Local\Temp\F983.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\FB38.tmp"C:\Users\Admin\AppData\Local\Temp\FB38.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\FD6B.tmp"C:\Users\Admin\AppData\Local\Temp\FD6B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\FE26.tmp"C:\Users\Admin\AppData\Local\Temp\FE26.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\FFEB.tmp"C:\Users\Admin\AppData\Local\Temp\FFEB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\A7.tmp"C:\Users\Admin\AppData\Local\Temp\A7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\134.tmp"C:\Users\Admin\AppData\Local\Temp\134.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\1C0.tmp"C:\Users\Admin\AppData\Local\Temp\1C0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\2AB.tmp"C:\Users\Admin\AppData\Local\Temp\2AB.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\347.tmp"C:\Users\Admin\AppData\Local\Temp\347.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\402.tmp"C:\Users\Admin\AppData\Local\Temp\402.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\4ED.tmp"C:\Users\Admin\AppData\Local\Temp\4ED.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\579.tmp"C:\Users\Admin\AppData\Local\Temp\579.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\616.tmp"C:\Users\Admin\AppData\Local\Temp\616.tmp"23⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\6B2.tmp"C:\Users\Admin\AppData\Local\Temp\6B2.tmp"24⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\79C.tmp"C:\Users\Admin\AppData\Local\Temp\79C.tmp"25⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\848.tmp"C:\Users\Admin\AppData\Local\Temp\848.tmp"26⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\8C5.tmp"C:\Users\Admin\AppData\Local\Temp\8C5.tmp"27⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\971.tmp"C:\Users\Admin\AppData\Local\Temp\971.tmp"28⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\A1D.tmp"C:\Users\Admin\AppData\Local\Temp\A1D.tmp"29⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\AE8.tmp"C:\Users\Admin\AppData\Local\Temp\AE8.tmp"30⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\BB3.tmp"C:\Users\Admin\AppData\Local\Temp\BB3.tmp"31⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\C4F.tmp"C:\Users\Admin\AppData\Local\Temp\C4F.tmp"32⤵
- Executes dropped EXE
PID:364 -
C:\Users\Admin\AppData\Local\Temp\CCC.tmp"C:\Users\Admin\AppData\Local\Temp\CCC.tmp"33⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\DC6.tmp"C:\Users\Admin\AppData\Local\Temp\DC6.tmp"34⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\E43.tmp"C:\Users\Admin\AppData\Local\Temp\E43.tmp"35⤵
- Executes dropped EXE
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\EC0.tmp"C:\Users\Admin\AppData\Local\Temp\EC0.tmp"36⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"37⤵
- Executes dropped EXE
PID:312 -
C:\Users\Admin\AppData\Local\Temp\1037.tmp"C:\Users\Admin\AppData\Local\Temp\1037.tmp"38⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\10C4.tmp"C:\Users\Admin\AppData\Local\Temp\10C4.tmp"39⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\1151.tmp"C:\Users\Admin\AppData\Local\Temp\1151.tmp"40⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\11DD.tmp"C:\Users\Admin\AppData\Local\Temp\11DD.tmp"41⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\126A.tmp"C:\Users\Admin\AppData\Local\Temp\126A.tmp"42⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\1316.tmp"C:\Users\Admin\AppData\Local\Temp\1316.tmp"43⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\13C2.tmp"C:\Users\Admin\AppData\Local\Temp\13C2.tmp"44⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\149C.tmp"C:\Users\Admin\AppData\Local\Temp\149C.tmp"45⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\1539.tmp"C:\Users\Admin\AppData\Local\Temp\1539.tmp"46⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\15D5.tmp"C:\Users\Admin\AppData\Local\Temp\15D5.tmp"47⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\1642.tmp"C:\Users\Admin\AppData\Local\Temp\1642.tmp"48⤵
- Executes dropped EXE
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\16DE.tmp"C:\Users\Admin\AppData\Local\Temp\16DE.tmp"49⤵
- Executes dropped EXE
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\176B.tmp"C:\Users\Admin\AppData\Local\Temp\176B.tmp"50⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\1807.tmp"C:\Users\Admin\AppData\Local\Temp\1807.tmp"51⤵
- Executes dropped EXE
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\1894.tmp"C:\Users\Admin\AppData\Local\Temp\1894.tmp"52⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\1921.tmp"C:\Users\Admin\AppData\Local\Temp\1921.tmp"53⤵
- Executes dropped EXE
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\19AD.tmp"C:\Users\Admin\AppData\Local\Temp\19AD.tmp"54⤵
- Executes dropped EXE
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\1A2A.tmp"C:\Users\Admin\AppData\Local\Temp\1A2A.tmp"55⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\1AA7.tmp"C:\Users\Admin\AppData\Local\Temp\1AA7.tmp"56⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\1B15.tmp"C:\Users\Admin\AppData\Local\Temp\1B15.tmp"57⤵
- Executes dropped EXE
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\1B92.tmp"C:\Users\Admin\AppData\Local\Temp\1B92.tmp"58⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\1C2E.tmp"C:\Users\Admin\AppData\Local\Temp\1C2E.tmp"59⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"60⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\1DA5.tmp"C:\Users\Admin\AppData\Local\Temp\1DA5.tmp"61⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\1E12.tmp"C:\Users\Admin\AppData\Local\Temp\1E12.tmp"62⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\1EBE.tmp"C:\Users\Admin\AppData\Local\Temp\1EBE.tmp"63⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\1F3B.tmp"C:\Users\Admin\AppData\Local\Temp\1F3B.tmp"64⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\1FC8.tmp"C:\Users\Admin\AppData\Local\Temp\1FC8.tmp"65⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\2035.tmp"C:\Users\Admin\AppData\Local\Temp\2035.tmp"66⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\20A2.tmp"C:\Users\Admin\AppData\Local\Temp\20A2.tmp"67⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\211F.tmp"C:\Users\Admin\AppData\Local\Temp\211F.tmp"68⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\21AC.tmp"C:\Users\Admin\AppData\Local\Temp\21AC.tmp"69⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\2277.tmp"C:\Users\Admin\AppData\Local\Temp\2277.tmp"70⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\2304.tmp"C:\Users\Admin\AppData\Local\Temp\2304.tmp"71⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\23A0.tmp"C:\Users\Admin\AppData\Local\Temp\23A0.tmp"72⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\23FE.tmp"C:\Users\Admin\AppData\Local\Temp\23FE.tmp"73⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\24C9.tmp"C:\Users\Admin\AppData\Local\Temp\24C9.tmp"74⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\2556.tmp"C:\Users\Admin\AppData\Local\Temp\2556.tmp"75⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\25F2.tmp"C:\Users\Admin\AppData\Local\Temp\25F2.tmp"76⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\26CD.tmp"C:\Users\Admin\AppData\Local\Temp\26CD.tmp"77⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\2769.tmp"C:\Users\Admin\AppData\Local\Temp\2769.tmp"78⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\27D6.tmp"C:\Users\Admin\AppData\Local\Temp\27D6.tmp"79⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\2882.tmp"C:\Users\Admin\AppData\Local\Temp\2882.tmp"80⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\28FF.tmp"C:\Users\Admin\AppData\Local\Temp\28FF.tmp"81⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\299B.tmp"C:\Users\Admin\AppData\Local\Temp\299B.tmp"82⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\2A18.tmp"C:\Users\Admin\AppData\Local\Temp\2A18.tmp"83⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\2AB5.tmp"C:\Users\Admin\AppData\Local\Temp\2AB5.tmp"84⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\2B51.tmp"C:\Users\Admin\AppData\Local\Temp\2B51.tmp"85⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\2BED.tmp"C:\Users\Admin\AppData\Local\Temp\2BED.tmp"86⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\2CB8.tmp"C:\Users\Admin\AppData\Local\Temp\2CB8.tmp"87⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\2D35.tmp"C:\Users\Admin\AppData\Local\Temp\2D35.tmp"88⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\2DA3.tmp"C:\Users\Admin\AppData\Local\Temp\2DA3.tmp"89⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\2E10.tmp"C:\Users\Admin\AppData\Local\Temp\2E10.tmp"90⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\2ECB.tmp"C:\Users\Admin\AppData\Local\Temp\2ECB.tmp"91⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\2F58.tmp"C:\Users\Admin\AppData\Local\Temp\2F58.tmp"92⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\2FE5.tmp"C:\Users\Admin\AppData\Local\Temp\2FE5.tmp"93⤵PID:32
-
C:\Users\Admin\AppData\Local\Temp\3052.tmp"C:\Users\Admin\AppData\Local\Temp\3052.tmp"94⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\30DF.tmp"C:\Users\Admin\AppData\Local\Temp\30DF.tmp"95⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\318B.tmp"C:\Users\Admin\AppData\Local\Temp\318B.tmp"96⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\31F8.tmp"C:\Users\Admin\AppData\Local\Temp\31F8.tmp"97⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\3275.tmp"C:\Users\Admin\AppData\Local\Temp\3275.tmp"98⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"99⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\33BD.tmp"C:\Users\Admin\AppData\Local\Temp\33BD.tmp"100⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"101⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\3563.tmp"C:\Users\Admin\AppData\Local\Temp\3563.tmp"102⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\35E0.tmp"C:\Users\Admin\AppData\Local\Temp\35E0.tmp"103⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\367C.tmp"C:\Users\Admin\AppData\Local\Temp\367C.tmp"104⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\36EA.tmp"C:\Users\Admin\AppData\Local\Temp\36EA.tmp"105⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\3757.tmp"C:\Users\Admin\AppData\Local\Temp\3757.tmp"106⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\37C4.tmp"C:\Users\Admin\AppData\Local\Temp\37C4.tmp"107⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\3841.tmp"C:\Users\Admin\AppData\Local\Temp\3841.tmp"108⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\392C.tmp"C:\Users\Admin\AppData\Local\Temp\392C.tmp"109⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\39B8.tmp"C:\Users\Admin\AppData\Local\Temp\39B8.tmp"110⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\3A26.tmp"C:\Users\Admin\AppData\Local\Temp\3A26.tmp"111⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\3AB2.tmp"C:\Users\Admin\AppData\Local\Temp\3AB2.tmp"112⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\3B5E.tmp"C:\Users\Admin\AppData\Local\Temp\3B5E.tmp"113⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\3BEB.tmp"C:\Users\Admin\AppData\Local\Temp\3BEB.tmp"114⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\3C58.tmp"C:\Users\Admin\AppData\Local\Temp\3C58.tmp"115⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\3CC6.tmp"C:\Users\Admin\AppData\Local\Temp\3CC6.tmp"116⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\3DB0.tmp"C:\Users\Admin\AppData\Local\Temp\3DB0.tmp"117⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\3E1D.tmp"C:\Users\Admin\AppData\Local\Temp\3E1D.tmp"118⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\3EC9.tmp"C:\Users\Admin\AppData\Local\Temp\3EC9.tmp"119⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\3F37.tmp"C:\Users\Admin\AppData\Local\Temp\3F37.tmp"120⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\40AE.tmp"C:\Users\Admin\AppData\Local\Temp\40AE.tmp"121⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\4159.tmp"C:\Users\Admin\AppData\Local\Temp\4159.tmp"122⤵PID:4280
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-