Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
30/04/2024, 10:12
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-30_b68b39158e7e4a2e152dffa7bb58594a_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-30_b68b39158e7e4a2e152dffa7bb58594a_mafia.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-04-30_b68b39158e7e4a2e152dffa7bb58594a_mafia.exe
-
Size
765KB
-
MD5
b68b39158e7e4a2e152dffa7bb58594a
-
SHA1
55ff50fb35fbde53923ac688c08b9ec44de7655d
-
SHA256
c25696491edab1a30d69b5b5042c9e34a09bf6896e194d8ffd4626fdd8b4ba29
-
SHA512
5f40828b086d574df994631ff880be607df35d937e73419f7ea94ba796b7af5e94de8ad1e35354cb432cc469af819f9940162eada268b7b044d77cfbb5c73f60
-
SSDEEP
12288:ZU5rCOTeiDRxYhIOv5uDBl8otxZk3nCE3ZF5rn5rLOa54U5w5A:ZUQOJDR2Iy5uDBldts3CE3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2944 36DF.tmp 3660 377B.tmp 4700 37F8.tmp 3744 3894.tmp 3188 3930.tmp 1208 39BD.tmp 2816 3A2A.tmp 3148 3A79.tmp 2104 3AE6.tmp 3144 3B82.tmp 2964 3BF0.tmp 3616 3C3E.tmp 4380 3CBB.tmp 1092 3D38.tmp 2884 3DC4.tmp 3840 3E41.tmp 1588 3E9F.tmp 1408 3F4B.tmp 4280 3FA9.tmp 4200 4055.tmp 4388 40D2.tmp 3412 414F.tmp 4004 41AC.tmp 3588 421A.tmp 4252 42B6.tmp 4660 4333.tmp 1300 43CF.tmp 4016 445C.tmp 4424 44BA.tmp 1924 4517.tmp 3152 45A4.tmp 3516 4631.tmp 2284 469E.tmp 1980 46EC.tmp 2912 474A.tmp 220 4798.tmp 3768 47F6.tmp 1816 4853.tmp 1464 48A2.tmp 4308 48F0.tmp 3320 494D.tmp 1820 499C.tmp 4528 49EA.tmp 5116 4A38.tmp 3752 4A86.tmp 5108 4AD4.tmp 1188 4B22.tmp 3884 4B80.tmp 3824 4BDE.tmp 4780 4C2C.tmp 4920 4C7A.tmp 3876 4CD8.tmp 3932 4D35.tmp 4060 4D84.tmp 3188 4DD2.tmp 2460 4E20.tmp 4716 4E7E.tmp 1988 4ECC.tmp 2688 4F1A.tmp 5036 4F68.tmp 5048 4FB6.tmp 4516 5014.tmp 2104 5062.tmp 1372 50B0.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3276 wrote to memory of 2944 3276 2024-04-30_b68b39158e7e4a2e152dffa7bb58594a_mafia.exe 83 PID 3276 wrote to memory of 2944 3276 2024-04-30_b68b39158e7e4a2e152dffa7bb58594a_mafia.exe 83 PID 3276 wrote to memory of 2944 3276 2024-04-30_b68b39158e7e4a2e152dffa7bb58594a_mafia.exe 83 PID 2944 wrote to memory of 3660 2944 36DF.tmp 84 PID 2944 wrote to memory of 3660 2944 36DF.tmp 84 PID 2944 wrote to memory of 3660 2944 36DF.tmp 84 PID 3660 wrote to memory of 4700 3660 377B.tmp 86 PID 3660 wrote to memory of 4700 3660 377B.tmp 86 PID 3660 wrote to memory of 4700 3660 377B.tmp 86 PID 4700 wrote to memory of 3744 4700 37F8.tmp 88 PID 4700 wrote to memory of 3744 4700 37F8.tmp 88 PID 4700 wrote to memory of 3744 4700 37F8.tmp 88 PID 3744 wrote to memory of 3188 3744 3894.tmp 89 PID 3744 wrote to memory of 3188 3744 3894.tmp 89 PID 3744 wrote to memory of 3188 3744 3894.tmp 89 PID 3188 wrote to memory of 1208 3188 3930.tmp 91 PID 3188 wrote to memory of 1208 3188 3930.tmp 91 PID 3188 wrote to memory of 1208 3188 3930.tmp 91 PID 1208 wrote to memory of 2816 1208 39BD.tmp 92 PID 1208 wrote to memory of 2816 1208 39BD.tmp 92 PID 1208 wrote to memory of 2816 1208 39BD.tmp 92 PID 2816 wrote to memory of 3148 2816 3A2A.tmp 94 PID 2816 wrote to memory of 3148 2816 3A2A.tmp 94 PID 2816 wrote to memory of 3148 2816 3A2A.tmp 94 PID 3148 wrote to memory of 2104 3148 3A79.tmp 95 PID 3148 wrote to memory of 2104 3148 3A79.tmp 95 PID 3148 wrote to memory of 2104 3148 3A79.tmp 95 PID 2104 wrote to memory of 3144 2104 3AE6.tmp 96 PID 2104 wrote to memory of 3144 2104 3AE6.tmp 96 PID 2104 wrote to memory of 3144 2104 3AE6.tmp 96 PID 3144 wrote to memory of 2964 3144 3B82.tmp 97 PID 3144 wrote to memory of 2964 3144 3B82.tmp 97 PID 3144 wrote to memory of 2964 3144 3B82.tmp 97 PID 2964 wrote to memory of 3616 2964 3BF0.tmp 98 PID 2964 wrote to memory of 3616 2964 3BF0.tmp 98 PID 2964 wrote to memory of 3616 2964 3BF0.tmp 98 PID 3616 wrote to memory of 4380 3616 3C3E.tmp 99 PID 3616 wrote to memory of 4380 3616 3C3E.tmp 99 PID 3616 wrote to memory of 4380 3616 3C3E.tmp 99 PID 4380 wrote to memory of 1092 4380 3CBB.tmp 100 PID 4380 wrote to memory of 1092 4380 3CBB.tmp 100 PID 4380 wrote to memory of 1092 4380 3CBB.tmp 100 PID 1092 wrote to memory of 2884 1092 3D38.tmp 101 PID 1092 wrote to memory of 2884 1092 3D38.tmp 101 PID 1092 wrote to memory of 2884 1092 3D38.tmp 101 PID 2884 wrote to memory of 3840 2884 3DC4.tmp 102 PID 2884 wrote to memory of 3840 2884 3DC4.tmp 102 PID 2884 wrote to memory of 3840 2884 3DC4.tmp 102 PID 3840 wrote to memory of 1588 3840 3E41.tmp 103 PID 3840 wrote to memory of 1588 3840 3E41.tmp 103 PID 3840 wrote to memory of 1588 3840 3E41.tmp 103 PID 1588 wrote to memory of 1408 1588 3E9F.tmp 104 PID 1588 wrote to memory of 1408 1588 3E9F.tmp 104 PID 1588 wrote to memory of 1408 1588 3E9F.tmp 104 PID 1408 wrote to memory of 4280 1408 3F4B.tmp 105 PID 1408 wrote to memory of 4280 1408 3F4B.tmp 105 PID 1408 wrote to memory of 4280 1408 3F4B.tmp 105 PID 4280 wrote to memory of 4200 4280 3FA9.tmp 106 PID 4280 wrote to memory of 4200 4280 3FA9.tmp 106 PID 4280 wrote to memory of 4200 4280 3FA9.tmp 106 PID 4200 wrote to memory of 4388 4200 4055.tmp 107 PID 4200 wrote to memory of 4388 4200 4055.tmp 107 PID 4200 wrote to memory of 4388 4200 4055.tmp 107 PID 4388 wrote to memory of 3412 4388 40D2.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-30_b68b39158e7e4a2e152dffa7bb58594a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-30_b68b39158e7e4a2e152dffa7bb58594a_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\36DF.tmp"C:\Users\Admin\AppData\Local\Temp\36DF.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\377B.tmp"C:\Users\Admin\AppData\Local\Temp\377B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\37F8.tmp"C:\Users\Admin\AppData\Local\Temp\37F8.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\3894.tmp"C:\Users\Admin\AppData\Local\Temp\3894.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\3930.tmp"C:\Users\Admin\AppData\Local\Temp\3930.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\39BD.tmp"C:\Users\Admin\AppData\Local\Temp\39BD.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\3A79.tmp"C:\Users\Admin\AppData\Local\Temp\3A79.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\3B82.tmp"C:\Users\Admin\AppData\Local\Temp\3B82.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\3C3E.tmp"C:\Users\Admin\AppData\Local\Temp\3C3E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\3D38.tmp"C:\Users\Admin\AppData\Local\Temp\3D38.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\3E41.tmp"C:\Users\Admin\AppData\Local\Temp\3E41.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\4055.tmp"C:\Users\Admin\AppData\Local\Temp\4055.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\40D2.tmp"C:\Users\Admin\AppData\Local\Temp\40D2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\414F.tmp"C:\Users\Admin\AppData\Local\Temp\414F.tmp"23⤵
- Executes dropped EXE
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\41AC.tmp"C:\Users\Admin\AppData\Local\Temp\41AC.tmp"24⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\421A.tmp"C:\Users\Admin\AppData\Local\Temp\421A.tmp"25⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\42B6.tmp"C:\Users\Admin\AppData\Local\Temp\42B6.tmp"26⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"27⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\43CF.tmp"C:\Users\Admin\AppData\Local\Temp\43CF.tmp"28⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"29⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"30⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"31⤵
- Executes dropped EXE
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"32⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"33⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"34⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\46EC.tmp"C:\Users\Admin\AppData\Local\Temp\46EC.tmp"35⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"36⤵
- Executes dropped EXE
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"37⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"38⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"39⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"40⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"41⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"42⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"43⤵
- Executes dropped EXE
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"44⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"45⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"46⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"47⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"48⤵
- Executes dropped EXE
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"49⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"50⤵
- Executes dropped EXE
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"51⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"52⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"53⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"54⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"55⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"56⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"57⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"58⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"59⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"60⤵
- Executes dropped EXE
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"61⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"62⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"63⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"64⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"65⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"66⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"67⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"68⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"69⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"70⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"71⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"72⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"73⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"74⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"75⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"76⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"77⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"78⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"79⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"80⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"81⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"82⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"83⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"84⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"85⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"86⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"87⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"88⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"89⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"90⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"91⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"92⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"93⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"94⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"95⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"96⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"97⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"98⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"99⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"100⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"101⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"102⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"103⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"104⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"105⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"106⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"107⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"108⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"109⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"110⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"111⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"112⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"113⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"114⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"115⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"116⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"117⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"118⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"119⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"120⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"121⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"122⤵PID:2688
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-