Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25/04/2024, 17:34
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-25_aea79abbf1322d44a36e5620dbca9e61_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-04-25_aea79abbf1322d44a36e5620dbca9e61_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-25_aea79abbf1322d44a36e5620dbca9e61_mafia.exe
-
Size
486KB
-
MD5
aea79abbf1322d44a36e5620dbca9e61
-
SHA1
13ea4858ac10857bbfbf0529ca035463f83be7d9
-
SHA256
f383c32c3eca1206f0080757bcb009524ab7148fcb23cbb2659025ba57caca21
-
SHA512
bffa77f96f3cf180167927640f5c85980cc990e0f4113d37fb94ddf0927eb92f9ae1ab3004f455b4a5356a0b48108c0079c60e8fb7b2e0e5c6d25dcde6b22c7b
-
SSDEEP
12288:UU5rCOTeiDk157cEVR0JBoR44Of/ol6RXdMUNZ:UUQOJDk7rLOgQN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 736 2093.tmp 2016 220A.tmp 1368 22C5.tmp 2872 23B0.tmp 2800 245C.tmp 3604 25A4.tmp 1904 266F.tmp 2540 2759.tmp 3020 2853.tmp 3912 293E.tmp 1136 2A09.tmp 1620 2B03.tmp 4084 2B9F.tmp 1124 2CD7.tmp 4496 2DD1.tmp 2908 2E5E.tmp 3968 2F58.tmp 2588 3052.tmp 4616 312D.tmp 1148 31C9.tmp 4556 3285.tmp 1092 3350.tmp 3984 341B.tmp 3324 3488.tmp 4620 3544.tmp 3964 362E.tmp 764 36EA.tmp 4776 37C4.tmp 4236 396A.tmp 368 3A55.tmp 4712 3B10.tmp 872 3BAC.tmp 3152 3C68.tmp 5004 3D62.tmp 3176 3DFE.tmp 1328 3EAA.tmp 3824 3F17.tmp 2316 3FC3.tmp 4880 4040.tmp 3252 413A.tmp 3080 41A8.tmp 4660 4234.tmp 4592 42A2.tmp 2016 432E.tmp 4348 438C.tmp 4424 4409.tmp 832 4486.tmp 2800 4503.tmp 3604 459F.tmp 4004 460D.tmp 4536 4699.tmp 1508 4726.tmp 1128 47D2.tmp 232 486E.tmp 2020 48EB.tmp 4796 4987.tmp 4532 4A14.tmp 876 4AA0.tmp 4724 4B3D.tmp 936 4BD9.tmp 1180 4C85.tmp 4228 4D11.tmp 1416 4D8E.tmp 1748 4E0B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4076 wrote to memory of 736 4076 2024-04-25_aea79abbf1322d44a36e5620dbca9e61_mafia.exe 91 PID 4076 wrote to memory of 736 4076 2024-04-25_aea79abbf1322d44a36e5620dbca9e61_mafia.exe 91 PID 4076 wrote to memory of 736 4076 2024-04-25_aea79abbf1322d44a36e5620dbca9e61_mafia.exe 91 PID 736 wrote to memory of 2016 736 2093.tmp 92 PID 736 wrote to memory of 2016 736 2093.tmp 92 PID 736 wrote to memory of 2016 736 2093.tmp 92 PID 2016 wrote to memory of 1368 2016 220A.tmp 93 PID 2016 wrote to memory of 1368 2016 220A.tmp 93 PID 2016 wrote to memory of 1368 2016 220A.tmp 93 PID 1368 wrote to memory of 2872 1368 22C5.tmp 94 PID 1368 wrote to memory of 2872 1368 22C5.tmp 94 PID 1368 wrote to memory of 2872 1368 22C5.tmp 94 PID 2872 wrote to memory of 2800 2872 23B0.tmp 95 PID 2872 wrote to memory of 2800 2872 23B0.tmp 95 PID 2872 wrote to memory of 2800 2872 23B0.tmp 95 PID 2800 wrote to memory of 3604 2800 245C.tmp 96 PID 2800 wrote to memory of 3604 2800 245C.tmp 96 PID 2800 wrote to memory of 3604 2800 245C.tmp 96 PID 3604 wrote to memory of 1904 3604 25A4.tmp 97 PID 3604 wrote to memory of 1904 3604 25A4.tmp 97 PID 3604 wrote to memory of 1904 3604 25A4.tmp 97 PID 1904 wrote to memory of 2540 1904 266F.tmp 98 PID 1904 wrote to memory of 2540 1904 266F.tmp 98 PID 1904 wrote to memory of 2540 1904 266F.tmp 98 PID 2540 wrote to memory of 3020 2540 2759.tmp 99 PID 2540 wrote to memory of 3020 2540 2759.tmp 99 PID 2540 wrote to memory of 3020 2540 2759.tmp 99 PID 3020 wrote to memory of 3912 3020 2853.tmp 100 PID 3020 wrote to memory of 3912 3020 2853.tmp 100 PID 3020 wrote to memory of 3912 3020 2853.tmp 100 PID 3912 wrote to memory of 1136 3912 293E.tmp 101 PID 3912 wrote to memory of 1136 3912 293E.tmp 101 PID 3912 wrote to memory of 1136 3912 293E.tmp 101 PID 1136 wrote to memory of 1620 1136 2A09.tmp 102 PID 1136 wrote to memory of 1620 1136 2A09.tmp 102 PID 1136 wrote to memory of 1620 1136 2A09.tmp 102 PID 1620 wrote to memory of 4084 1620 2B03.tmp 103 PID 1620 wrote to memory of 4084 1620 2B03.tmp 103 PID 1620 wrote to memory of 4084 1620 2B03.tmp 103 PID 4084 wrote to memory of 1124 4084 2B9F.tmp 104 PID 4084 wrote to memory of 1124 4084 2B9F.tmp 104 PID 4084 wrote to memory of 1124 4084 2B9F.tmp 104 PID 1124 wrote to memory of 4496 1124 2CD7.tmp 105 PID 1124 wrote to memory of 4496 1124 2CD7.tmp 105 PID 1124 wrote to memory of 4496 1124 2CD7.tmp 105 PID 4496 wrote to memory of 2908 4496 2DD1.tmp 106 PID 4496 wrote to memory of 2908 4496 2DD1.tmp 106 PID 4496 wrote to memory of 2908 4496 2DD1.tmp 106 PID 2908 wrote to memory of 3968 2908 2E5E.tmp 107 PID 2908 wrote to memory of 3968 2908 2E5E.tmp 107 PID 2908 wrote to memory of 3968 2908 2E5E.tmp 107 PID 3968 wrote to memory of 2588 3968 2F58.tmp 108 PID 3968 wrote to memory of 2588 3968 2F58.tmp 108 PID 3968 wrote to memory of 2588 3968 2F58.tmp 108 PID 2588 wrote to memory of 4616 2588 3052.tmp 109 PID 2588 wrote to memory of 4616 2588 3052.tmp 109 PID 2588 wrote to memory of 4616 2588 3052.tmp 109 PID 4616 wrote to memory of 1148 4616 312D.tmp 110 PID 4616 wrote to memory of 1148 4616 312D.tmp 110 PID 4616 wrote to memory of 1148 4616 312D.tmp 110 PID 1148 wrote to memory of 4556 1148 31C9.tmp 111 PID 1148 wrote to memory of 4556 1148 31C9.tmp 111 PID 1148 wrote to memory of 4556 1148 31C9.tmp 111 PID 4556 wrote to memory of 1092 4556 3285.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_aea79abbf1322d44a36e5620dbca9e61_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-25_aea79abbf1322d44a36e5620dbca9e61_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\2093.tmp"C:\Users\Admin\AppData\Local\Temp\2093.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Users\Admin\AppData\Local\Temp\220A.tmp"C:\Users\Admin\AppData\Local\Temp\220A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\22C5.tmp"C:\Users\Admin\AppData\Local\Temp\22C5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\23B0.tmp"C:\Users\Admin\AppData\Local\Temp\23B0.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\245C.tmp"C:\Users\Admin\AppData\Local\Temp\245C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\25A4.tmp"C:\Users\Admin\AppData\Local\Temp\25A4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\266F.tmp"C:\Users\Admin\AppData\Local\Temp\266F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\2759.tmp"C:\Users\Admin\AppData\Local\Temp\2759.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\2853.tmp"C:\Users\Admin\AppData\Local\Temp\2853.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\293E.tmp"C:\Users\Admin\AppData\Local\Temp\293E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\2A09.tmp"C:\Users\Admin\AppData\Local\Temp\2A09.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\2B03.tmp"C:\Users\Admin\AppData\Local\Temp\2B03.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\2B9F.tmp"C:\Users\Admin\AppData\Local\Temp\2B9F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\2CD7.tmp"C:\Users\Admin\AppData\Local\Temp\2CD7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\2DD1.tmp"C:\Users\Admin\AppData\Local\Temp\2DD1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\2E5E.tmp"C:\Users\Admin\AppData\Local\Temp\2E5E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\2F58.tmp"C:\Users\Admin\AppData\Local\Temp\2F58.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\3052.tmp"C:\Users\Admin\AppData\Local\Temp\3052.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\312D.tmp"C:\Users\Admin\AppData\Local\Temp\312D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\31C9.tmp"C:\Users\Admin\AppData\Local\Temp\31C9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"23⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"24⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"25⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\3544.tmp"C:\Users\Admin\AppData\Local\Temp\3544.tmp"26⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\362E.tmp"C:\Users\Admin\AppData\Local\Temp\362E.tmp"27⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\36EA.tmp"C:\Users\Admin\AppData\Local\Temp\36EA.tmp"28⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\37C4.tmp"C:\Users\Admin\AppData\Local\Temp\37C4.tmp"29⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\396A.tmp"C:\Users\Admin\AppData\Local\Temp\396A.tmp"30⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\3A55.tmp"C:\Users\Admin\AppData\Local\Temp\3A55.tmp"31⤵
- Executes dropped EXE
PID:368 -
C:\Users\Admin\AppData\Local\Temp\3B10.tmp"C:\Users\Admin\AppData\Local\Temp\3B10.tmp"32⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\3BAC.tmp"C:\Users\Admin\AppData\Local\Temp\3BAC.tmp"33⤵
- Executes dropped EXE
PID:872 -
C:\Users\Admin\AppData\Local\Temp\3C68.tmp"C:\Users\Admin\AppData\Local\Temp\3C68.tmp"34⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\3D62.tmp"C:\Users\Admin\AppData\Local\Temp\3D62.tmp"35⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\3DFE.tmp"C:\Users\Admin\AppData\Local\Temp\3DFE.tmp"36⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"37⤵
- Executes dropped EXE
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\3F17.tmp"C:\Users\Admin\AppData\Local\Temp\3F17.tmp"38⤵
- Executes dropped EXE
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\3FC3.tmp"C:\Users\Admin\AppData\Local\Temp\3FC3.tmp"39⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\4040.tmp"C:\Users\Admin\AppData\Local\Temp\4040.tmp"40⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\40BD.tmp"C:\Users\Admin\AppData\Local\Temp\40BD.tmp"41⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\413A.tmp"C:\Users\Admin\AppData\Local\Temp\413A.tmp"42⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\41A8.tmp"C:\Users\Admin\AppData\Local\Temp\41A8.tmp"43⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\4234.tmp"C:\Users\Admin\AppData\Local\Temp\4234.tmp"44⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\42A2.tmp"C:\Users\Admin\AppData\Local\Temp\42A2.tmp"45⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\432E.tmp"C:\Users\Admin\AppData\Local\Temp\432E.tmp"46⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\438C.tmp"C:\Users\Admin\AppData\Local\Temp\438C.tmp"47⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\4409.tmp"C:\Users\Admin\AppData\Local\Temp\4409.tmp"48⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\4486.tmp"C:\Users\Admin\AppData\Local\Temp\4486.tmp"49⤵
- Executes dropped EXE
PID:832 -
C:\Users\Admin\AppData\Local\Temp\4503.tmp"C:\Users\Admin\AppData\Local\Temp\4503.tmp"50⤵
- Executes dropped EXE
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\459F.tmp"C:\Users\Admin\AppData\Local\Temp\459F.tmp"51⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\460D.tmp"C:\Users\Admin\AppData\Local\Temp\460D.tmp"52⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\4699.tmp"C:\Users\Admin\AppData\Local\Temp\4699.tmp"53⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\4726.tmp"C:\Users\Admin\AppData\Local\Temp\4726.tmp"54⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\47D2.tmp"C:\Users\Admin\AppData\Local\Temp\47D2.tmp"55⤵
- Executes dropped EXE
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\486E.tmp"C:\Users\Admin\AppData\Local\Temp\486E.tmp"56⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\48EB.tmp"C:\Users\Admin\AppData\Local\Temp\48EB.tmp"57⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\4987.tmp"C:\Users\Admin\AppData\Local\Temp\4987.tmp"58⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\4A14.tmp"C:\Users\Admin\AppData\Local\Temp\4A14.tmp"59⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\4AA0.tmp"C:\Users\Admin\AppData\Local\Temp\4AA0.tmp"60⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\4B3D.tmp"C:\Users\Admin\AppData\Local\Temp\4B3D.tmp"61⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\4BD9.tmp"C:\Users\Admin\AppData\Local\Temp\4BD9.tmp"62⤵
- Executes dropped EXE
PID:936 -
C:\Users\Admin\AppData\Local\Temp\4C85.tmp"C:\Users\Admin\AppData\Local\Temp\4C85.tmp"63⤵
- Executes dropped EXE
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\4D11.tmp"C:\Users\Admin\AppData\Local\Temp\4D11.tmp"64⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\4D8E.tmp"C:\Users\Admin\AppData\Local\Temp\4D8E.tmp"65⤵
- Executes dropped EXE
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\4E0B.tmp"C:\Users\Admin\AppData\Local\Temp\4E0B.tmp"66⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\4E88.tmp"C:\Users\Admin\AppData\Local\Temp\4E88.tmp"67⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\4F05.tmp"C:\Users\Admin\AppData\Local\Temp\4F05.tmp"68⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\4F82.tmp"C:\Users\Admin\AppData\Local\Temp\4F82.tmp"69⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\500F.tmp"C:\Users\Admin\AppData\Local\Temp\500F.tmp"70⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\509C.tmp"C:\Users\Admin\AppData\Local\Temp\509C.tmp"71⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\5128.tmp"C:\Users\Admin\AppData\Local\Temp\5128.tmp"72⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\51B5.tmp"C:\Users\Admin\AppData\Local\Temp\51B5.tmp"73⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\5242.tmp"C:\Users\Admin\AppData\Local\Temp\5242.tmp"74⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\52DE.tmp"C:\Users\Admin\AppData\Local\Temp\52DE.tmp"75⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\536A.tmp"C:\Users\Admin\AppData\Local\Temp\536A.tmp"76⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\53E7.tmp"C:\Users\Admin\AppData\Local\Temp\53E7.tmp"77⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\5464.tmp"C:\Users\Admin\AppData\Local\Temp\5464.tmp"78⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\5501.tmp"C:\Users\Admin\AppData\Local\Temp\5501.tmp"79⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\557E.tmp"C:\Users\Admin\AppData\Local\Temp\557E.tmp"80⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\562A.tmp"C:\Users\Admin\AppData\Local\Temp\562A.tmp"81⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\56C6.tmp"C:\Users\Admin\AppData\Local\Temp\56C6.tmp"82⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\5772.tmp"C:\Users\Admin\AppData\Local\Temp\5772.tmp"83⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\57DF.tmp"C:\Users\Admin\AppData\Local\Temp\57DF.tmp"84⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\585C.tmp"C:\Users\Admin\AppData\Local\Temp\585C.tmp"85⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\58C9.tmp"C:\Users\Admin\AppData\Local\Temp\58C9.tmp"86⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\5966.tmp"C:\Users\Admin\AppData\Local\Temp\5966.tmp"87⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\59E3.tmp"C:\Users\Admin\AppData\Local\Temp\59E3.tmp"88⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\5A7F.tmp"C:\Users\Admin\AppData\Local\Temp\5A7F.tmp"89⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\5B1B.tmp"C:\Users\Admin\AppData\Local\Temp\5B1B.tmp"90⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\5B98.tmp"C:\Users\Admin\AppData\Local\Temp\5B98.tmp"91⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\5C15.tmp"C:\Users\Admin\AppData\Local\Temp\5C15.tmp"92⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\5CC1.tmp"C:\Users\Admin\AppData\Local\Temp\5CC1.tmp"93⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\5D4E.tmp"C:\Users\Admin\AppData\Local\Temp\5D4E.tmp"94⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\5DCB.tmp"C:\Users\Admin\AppData\Local\Temp\5DCB.tmp"95⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\5E48.tmp"C:\Users\Admin\AppData\Local\Temp\5E48.tmp"96⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\5ED4.tmp"C:\Users\Admin\AppData\Local\Temp\5ED4.tmp"97⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\5F42.tmp"C:\Users\Admin\AppData\Local\Temp\5F42.tmp"98⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\5FDE.tmp"C:\Users\Admin\AppData\Local\Temp\5FDE.tmp"99⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\606B.tmp"C:\Users\Admin\AppData\Local\Temp\606B.tmp"100⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\60F7.tmp"C:\Users\Admin\AppData\Local\Temp\60F7.tmp"101⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\6174.tmp"C:\Users\Admin\AppData\Local\Temp\6174.tmp"102⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\61E2.tmp"C:\Users\Admin\AppData\Local\Temp\61E2.tmp"103⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\627E.tmp"C:\Users\Admin\AppData\Local\Temp\627E.tmp"104⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\630A.tmp"C:\Users\Admin\AppData\Local\Temp\630A.tmp"105⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\6387.tmp"C:\Users\Admin\AppData\Local\Temp\6387.tmp"106⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\6414.tmp"C:\Users\Admin\AppData\Local\Temp\6414.tmp"107⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\6491.tmp"C:\Users\Admin\AppData\Local\Temp\6491.tmp"108⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\651E.tmp"C:\Users\Admin\AppData\Local\Temp\651E.tmp"109⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\65AA.tmp"C:\Users\Admin\AppData\Local\Temp\65AA.tmp"110⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\6627.tmp"C:\Users\Admin\AppData\Local\Temp\6627.tmp"111⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\6695.tmp"C:\Users\Admin\AppData\Local\Temp\6695.tmp"112⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\6712.tmp"C:\Users\Admin\AppData\Local\Temp\6712.tmp"113⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\677F.tmp"C:\Users\Admin\AppData\Local\Temp\677F.tmp"114⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\680C.tmp"C:\Users\Admin\AppData\Local\Temp\680C.tmp"115⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\6889.tmp"C:\Users\Admin\AppData\Local\Temp\6889.tmp"116⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\6906.tmp"C:\Users\Admin\AppData\Local\Temp\6906.tmp"117⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\69A2.tmp"C:\Users\Admin\AppData\Local\Temp\69A2.tmp"118⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\6A0F.tmp"C:\Users\Admin\AppData\Local\Temp\6A0F.tmp"119⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\6A9C.tmp"C:\Users\Admin\AppData\Local\Temp\6A9C.tmp"120⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\6B19.tmp"C:\Users\Admin\AppData\Local\Temp\6B19.tmp"121⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\6BA6.tmp"C:\Users\Admin\AppData\Local\Temp\6BA6.tmp"122⤵PID:2688
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-