Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25/04/2024, 14:01
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-25_d6c55e9874b18c3bb38aa67bd0eff0f3_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-25_d6c55e9874b18c3bb38aa67bd0eff0f3_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-25_d6c55e9874b18c3bb38aa67bd0eff0f3_mafia.exe
-
Size
488KB
-
MD5
d6c55e9874b18c3bb38aa67bd0eff0f3
-
SHA1
2cb2dd58a6e434d535f7dae475770fb2bce683ee
-
SHA256
5363674b579b76bb9dce21ff46fc46b70bdc0a497ee7cf2f9d7bba21e11426c7
-
SHA512
53499937d757fcc18a56ec75676de512b7e1d92dac1fb9c8b7b8f6600ab117d7b44aa81d4b37c8d74d06763df89bd05d31242c78a25c5f341235a0fdc9fcbe61
-
SSDEEP
12288:/U5rCOTeiDTQcfChKSn9+jPogY9yR4E3NZ:/UQOJDZChKSn9Cw39yR4uN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4748 FFBD.tmp 4652 114.tmp 2128 1D0.tmp 3392 2AB.tmp 3996 366.tmp 5016 4BE.tmp 4740 5C7.tmp 4508 683.tmp 2072 73E.tmp 1252 7EA.tmp 4308 877.tmp 1636 961.tmp 2112 A8A.tmp 4704 B84.tmp 5012 C30.tmp 2520 D2A.tmp 1172 E05.tmp 496 EC0.tmp 436 F4D.tmp 2888 1008.tmp 3092 10A5.tmp 2144 1160.tmp 3544 125A.tmp 4636 12F6.tmp 924 1383.tmp 3628 1410.tmp 4892 14BC.tmp 2364 1613.tmp 2344 16A0.tmp 1232 174C.tmp 3844 1846.tmp 3420 18F2.tmp 4876 19CC.tmp 3288 1A59.tmp 4208 1B05.tmp 564 1B92.tmp 2172 1C5D.tmp 1068 1CF9.tmp 1360 1D95.tmp 2836 1E41.tmp 4368 1F0C.tmp 5104 1FB8.tmp 2100 2064.tmp 3516 2100.tmp 1700 218D.tmp 5036 2239.tmp 3564 22D5.tmp 5032 2381.tmp 2184 23FE.tmp 3996 24B9.tmp 488 2546.tmp 1132 25F2.tmp 4740 268E.tmp 2788 274A.tmp 2852 27B7.tmp 2732 2834.tmp 1688 28C1.tmp 1252 294D.tmp 2936 29CA.tmp 1852 2A57.tmp 1636 2AE3.tmp 3540 2B51.tmp 1376 2BFD.tmp 4704 2C6A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3732 wrote to memory of 4748 3732 2024-04-25_d6c55e9874b18c3bb38aa67bd0eff0f3_mafia.exe 90 PID 3732 wrote to memory of 4748 3732 2024-04-25_d6c55e9874b18c3bb38aa67bd0eff0f3_mafia.exe 90 PID 3732 wrote to memory of 4748 3732 2024-04-25_d6c55e9874b18c3bb38aa67bd0eff0f3_mafia.exe 90 PID 4748 wrote to memory of 4652 4748 FFBD.tmp 91 PID 4748 wrote to memory of 4652 4748 FFBD.tmp 91 PID 4748 wrote to memory of 4652 4748 FFBD.tmp 91 PID 4652 wrote to memory of 2128 4652 114.tmp 92 PID 4652 wrote to memory of 2128 4652 114.tmp 92 PID 4652 wrote to memory of 2128 4652 114.tmp 92 PID 2128 wrote to memory of 3392 2128 1D0.tmp 93 PID 2128 wrote to memory of 3392 2128 1D0.tmp 93 PID 2128 wrote to memory of 3392 2128 1D0.tmp 93 PID 3392 wrote to memory of 3996 3392 2AB.tmp 94 PID 3392 wrote to memory of 3996 3392 2AB.tmp 94 PID 3392 wrote to memory of 3996 3392 2AB.tmp 94 PID 3996 wrote to memory of 5016 3996 366.tmp 95 PID 3996 wrote to memory of 5016 3996 366.tmp 95 PID 3996 wrote to memory of 5016 3996 366.tmp 95 PID 5016 wrote to memory of 4740 5016 4BE.tmp 96 PID 5016 wrote to memory of 4740 5016 4BE.tmp 96 PID 5016 wrote to memory of 4740 5016 4BE.tmp 96 PID 4740 wrote to memory of 4508 4740 5C7.tmp 97 PID 4740 wrote to memory of 4508 4740 5C7.tmp 97 PID 4740 wrote to memory of 4508 4740 5C7.tmp 97 PID 4508 wrote to memory of 2072 4508 683.tmp 98 PID 4508 wrote to memory of 2072 4508 683.tmp 98 PID 4508 wrote to memory of 2072 4508 683.tmp 98 PID 2072 wrote to memory of 1252 2072 73E.tmp 99 PID 2072 wrote to memory of 1252 2072 73E.tmp 99 PID 2072 wrote to memory of 1252 2072 73E.tmp 99 PID 1252 wrote to memory of 4308 1252 7EA.tmp 100 PID 1252 wrote to memory of 4308 1252 7EA.tmp 100 PID 1252 wrote to memory of 4308 1252 7EA.tmp 100 PID 4308 wrote to memory of 1636 4308 877.tmp 101 PID 4308 wrote to memory of 1636 4308 877.tmp 101 PID 4308 wrote to memory of 1636 4308 877.tmp 101 PID 1636 wrote to memory of 2112 1636 961.tmp 102 PID 1636 wrote to memory of 2112 1636 961.tmp 102 PID 1636 wrote to memory of 2112 1636 961.tmp 102 PID 2112 wrote to memory of 4704 2112 A8A.tmp 103 PID 2112 wrote to memory of 4704 2112 A8A.tmp 103 PID 2112 wrote to memory of 4704 2112 A8A.tmp 103 PID 4704 wrote to memory of 5012 4704 B84.tmp 104 PID 4704 wrote to memory of 5012 4704 B84.tmp 104 PID 4704 wrote to memory of 5012 4704 B84.tmp 104 PID 5012 wrote to memory of 2520 5012 C30.tmp 105 PID 5012 wrote to memory of 2520 5012 C30.tmp 105 PID 5012 wrote to memory of 2520 5012 C30.tmp 105 PID 2520 wrote to memory of 1172 2520 D2A.tmp 106 PID 2520 wrote to memory of 1172 2520 D2A.tmp 106 PID 2520 wrote to memory of 1172 2520 D2A.tmp 106 PID 1172 wrote to memory of 496 1172 E05.tmp 107 PID 1172 wrote to memory of 496 1172 E05.tmp 107 PID 1172 wrote to memory of 496 1172 E05.tmp 107 PID 496 wrote to memory of 436 496 EC0.tmp 108 PID 496 wrote to memory of 436 496 EC0.tmp 108 PID 496 wrote to memory of 436 496 EC0.tmp 108 PID 436 wrote to memory of 2888 436 F4D.tmp 109 PID 436 wrote to memory of 2888 436 F4D.tmp 109 PID 436 wrote to memory of 2888 436 F4D.tmp 109 PID 2888 wrote to memory of 3092 2888 1008.tmp 110 PID 2888 wrote to memory of 3092 2888 1008.tmp 110 PID 2888 wrote to memory of 3092 2888 1008.tmp 110 PID 3092 wrote to memory of 2144 3092 10A5.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_d6c55e9874b18c3bb38aa67bd0eff0f3_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-25_d6c55e9874b18c3bb38aa67bd0eff0f3_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\114.tmp"C:\Users\Admin\AppData\Local\Temp\114.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\1D0.tmp"C:\Users\Admin\AppData\Local\Temp\1D0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\2AB.tmp"C:\Users\Admin\AppData\Local\Temp\2AB.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\366.tmp"C:\Users\Admin\AppData\Local\Temp\366.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\4BE.tmp"C:\Users\Admin\AppData\Local\Temp\4BE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\5C7.tmp"C:\Users\Admin\AppData\Local\Temp\5C7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\683.tmp"C:\Users\Admin\AppData\Local\Temp\683.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\73E.tmp"C:\Users\Admin\AppData\Local\Temp\73E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\7EA.tmp"C:\Users\Admin\AppData\Local\Temp\7EA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\877.tmp"C:\Users\Admin\AppData\Local\Temp\877.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\961.tmp"C:\Users\Admin\AppData\Local\Temp\961.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\A8A.tmp"C:\Users\Admin\AppData\Local\Temp\A8A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\B84.tmp"C:\Users\Admin\AppData\Local\Temp\B84.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\C30.tmp"C:\Users\Admin\AppData\Local\Temp\C30.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\D2A.tmp"C:\Users\Admin\AppData\Local\Temp\D2A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\E05.tmp"C:\Users\Admin\AppData\Local\Temp\E05.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\EC0.tmp"C:\Users\Admin\AppData\Local\Temp\EC0.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:496 -
C:\Users\Admin\AppData\Local\Temp\F4D.tmp"C:\Users\Admin\AppData\Local\Temp\F4D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\10A5.tmp"C:\Users\Admin\AppData\Local\Temp\10A5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\1160.tmp"C:\Users\Admin\AppData\Local\Temp\1160.tmp"23⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\125A.tmp"C:\Users\Admin\AppData\Local\Temp\125A.tmp"24⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\12F6.tmp"C:\Users\Admin\AppData\Local\Temp\12F6.tmp"25⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\1383.tmp"C:\Users\Admin\AppData\Local\Temp\1383.tmp"26⤵
- Executes dropped EXE
PID:924 -
C:\Users\Admin\AppData\Local\Temp\1410.tmp"C:\Users\Admin\AppData\Local\Temp\1410.tmp"27⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\14BC.tmp"C:\Users\Admin\AppData\Local\Temp\14BC.tmp"28⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\1613.tmp"C:\Users\Admin\AppData\Local\Temp\1613.tmp"29⤵
- Executes dropped EXE
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\16A0.tmp"C:\Users\Admin\AppData\Local\Temp\16A0.tmp"30⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\174C.tmp"C:\Users\Admin\AppData\Local\Temp\174C.tmp"31⤵
- Executes dropped EXE
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\1846.tmp"C:\Users\Admin\AppData\Local\Temp\1846.tmp"32⤵
- Executes dropped EXE
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\18F2.tmp"C:\Users\Admin\AppData\Local\Temp\18F2.tmp"33⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\19CC.tmp"C:\Users\Admin\AppData\Local\Temp\19CC.tmp"34⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\1A59.tmp"C:\Users\Admin\AppData\Local\Temp\1A59.tmp"35⤵
- Executes dropped EXE
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\1B05.tmp"C:\Users\Admin\AppData\Local\Temp\1B05.tmp"36⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\1B92.tmp"C:\Users\Admin\AppData\Local\Temp\1B92.tmp"37⤵
- Executes dropped EXE
PID:564 -
C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"38⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"39⤵
- Executes dropped EXE
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\1D95.tmp"C:\Users\Admin\AppData\Local\Temp\1D95.tmp"40⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\1E41.tmp"C:\Users\Admin\AppData\Local\Temp\1E41.tmp"41⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"42⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\1FB8.tmp"C:\Users\Admin\AppData\Local\Temp\1FB8.tmp"43⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\2064.tmp"C:\Users\Admin\AppData\Local\Temp\2064.tmp"44⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\2100.tmp"C:\Users\Admin\AppData\Local\Temp\2100.tmp"45⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\218D.tmp"C:\Users\Admin\AppData\Local\Temp\218D.tmp"46⤵
- Executes dropped EXE
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\2239.tmp"C:\Users\Admin\AppData\Local\Temp\2239.tmp"47⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\22D5.tmp"C:\Users\Admin\AppData\Local\Temp\22D5.tmp"48⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\2381.tmp"C:\Users\Admin\AppData\Local\Temp\2381.tmp"49⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\23FE.tmp"C:\Users\Admin\AppData\Local\Temp\23FE.tmp"50⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\24B9.tmp"C:\Users\Admin\AppData\Local\Temp\24B9.tmp"51⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\2546.tmp"C:\Users\Admin\AppData\Local\Temp\2546.tmp"52⤵
- Executes dropped EXE
PID:488 -
C:\Users\Admin\AppData\Local\Temp\25F2.tmp"C:\Users\Admin\AppData\Local\Temp\25F2.tmp"53⤵
- Executes dropped EXE
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\268E.tmp"C:\Users\Admin\AppData\Local\Temp\268E.tmp"54⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\274A.tmp"C:\Users\Admin\AppData\Local\Temp\274A.tmp"55⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\27B7.tmp"C:\Users\Admin\AppData\Local\Temp\27B7.tmp"56⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\2834.tmp"C:\Users\Admin\AppData\Local\Temp\2834.tmp"57⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\28C1.tmp"C:\Users\Admin\AppData\Local\Temp\28C1.tmp"58⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\294D.tmp"C:\Users\Admin\AppData\Local\Temp\294D.tmp"59⤵
- Executes dropped EXE
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\29CA.tmp"C:\Users\Admin\AppData\Local\Temp\29CA.tmp"60⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\2A57.tmp"C:\Users\Admin\AppData\Local\Temp\2A57.tmp"61⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\2AE3.tmp"C:\Users\Admin\AppData\Local\Temp\2AE3.tmp"62⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\2B51.tmp"C:\Users\Admin\AppData\Local\Temp\2B51.tmp"63⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\2BFD.tmp"C:\Users\Admin\AppData\Local\Temp\2BFD.tmp"64⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\2C6A.tmp"C:\Users\Admin\AppData\Local\Temp\2C6A.tmp"65⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\2D45.tmp"C:\Users\Admin\AppData\Local\Temp\2D45.tmp"66⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\2DB2.tmp"C:\Users\Admin\AppData\Local\Temp\2DB2.tmp"67⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"68⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\2ECB.tmp"C:\Users\Admin\AppData\Local\Temp\2ECB.tmp"69⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\2F77.tmp"C:\Users\Admin\AppData\Local\Temp\2F77.tmp"70⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\2FE5.tmp"C:\Users\Admin\AppData\Local\Temp\2FE5.tmp"71⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\3081.tmp"C:\Users\Admin\AppData\Local\Temp\3081.tmp"72⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\30FE.tmp"C:\Users\Admin\AppData\Local\Temp\30FE.tmp"73⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\318B.tmp"C:\Users\Admin\AppData\Local\Temp\318B.tmp"74⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\3236.tmp"C:\Users\Admin\AppData\Local\Temp\3236.tmp"75⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\3294.tmp"C:\Users\Admin\AppData\Local\Temp\3294.tmp"76⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"77⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"78⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\342A.tmp"C:\Users\Admin\AppData\Local\Temp\342A.tmp"79⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"80⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\3524.tmp"C:\Users\Admin\AppData\Local\Temp\3524.tmp"81⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\35B1.tmp"C:\Users\Admin\AppData\Local\Temp\35B1.tmp"82⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\362E.tmp"C:\Users\Admin\AppData\Local\Temp\362E.tmp"83⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\36CA.tmp"C:\Users\Admin\AppData\Local\Temp\36CA.tmp"84⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\3738.tmp"C:\Users\Admin\AppData\Local\Temp\3738.tmp"85⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\37C4.tmp"C:\Users\Admin\AppData\Local\Temp\37C4.tmp"86⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\3841.tmp"C:\Users\Admin\AppData\Local\Temp\3841.tmp"87⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\38CE.tmp"C:\Users\Admin\AppData\Local\Temp\38CE.tmp"88⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\393B.tmp"C:\Users\Admin\AppData\Local\Temp\393B.tmp"89⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\39C8.tmp"C:\Users\Admin\AppData\Local\Temp\39C8.tmp"90⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\3A35.tmp"C:\Users\Admin\AppData\Local\Temp\3A35.tmp"91⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\3AC2.tmp"C:\Users\Admin\AppData\Local\Temp\3AC2.tmp"92⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"93⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\3BBC.tmp"C:\Users\Admin\AppData\Local\Temp\3BBC.tmp"94⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\3C29.tmp"C:\Users\Admin\AppData\Local\Temp\3C29.tmp"95⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\3CB6.tmp"C:\Users\Admin\AppData\Local\Temp\3CB6.tmp"96⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\3D62.tmp"C:\Users\Admin\AppData\Local\Temp\3D62.tmp"97⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\3DEE.tmp"C:\Users\Admin\AppData\Local\Temp\3DEE.tmp"98⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\3E5C.tmp"C:\Users\Admin\AppData\Local\Temp\3E5C.tmp"99⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\3ED9.tmp"C:\Users\Admin\AppData\Local\Temp\3ED9.tmp"100⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\3F56.tmp"C:\Users\Admin\AppData\Local\Temp\3F56.tmp"101⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\3FD3.tmp"C:\Users\Admin\AppData\Local\Temp\3FD3.tmp"102⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\406F.tmp"C:\Users\Admin\AppData\Local\Temp\406F.tmp"103⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\410B.tmp"C:\Users\Admin\AppData\Local\Temp\410B.tmp"104⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\41A8.tmp"C:\Users\Admin\AppData\Local\Temp\41A8.tmp"105⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\4234.tmp"C:\Users\Admin\AppData\Local\Temp\4234.tmp"106⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\42C1.tmp"C:\Users\Admin\AppData\Local\Temp\42C1.tmp"107⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\431F.tmp"C:\Users\Admin\AppData\Local\Temp\431F.tmp"108⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\438C.tmp"C:\Users\Admin\AppData\Local\Temp\438C.tmp"109⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\43F9.tmp"C:\Users\Admin\AppData\Local\Temp\43F9.tmp"110⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\4486.tmp"C:\Users\Admin\AppData\Local\Temp\4486.tmp"111⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\4522.tmp"C:\Users\Admin\AppData\Local\Temp\4522.tmp"112⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\459F.tmp"C:\Users\Admin\AppData\Local\Temp\459F.tmp"113⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\461C.tmp"C:\Users\Admin\AppData\Local\Temp\461C.tmp"114⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\468A.tmp"C:\Users\Admin\AppData\Local\Temp\468A.tmp"115⤵PID:496
-
C:\Users\Admin\AppData\Local\Temp\46F7.tmp"C:\Users\Admin\AppData\Local\Temp\46F7.tmp"116⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\4793.tmp"C:\Users\Admin\AppData\Local\Temp\4793.tmp"117⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\4801.tmp"C:\Users\Admin\AppData\Local\Temp\4801.tmp"118⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\488D.tmp"C:\Users\Admin\AppData\Local\Temp\488D.tmp"119⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\4939.tmp"C:\Users\Admin\AppData\Local\Temp\4939.tmp"120⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\49D5.tmp"C:\Users\Admin\AppData\Local\Temp\49D5.tmp"121⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\4A43.tmp"C:\Users\Admin\AppData\Local\Temp\4A43.tmp"122⤵PID:404
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-