Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23/05/2024, 22:23
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-23_2545b753c4cfebe82bba961831ff72b4_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-23_2545b753c4cfebe82bba961831ff72b4_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-23_2545b753c4cfebe82bba961831ff72b4_mafia.exe
-
Size
527KB
-
MD5
2545b753c4cfebe82bba961831ff72b4
-
SHA1
ff993b5d4cb9c0c7753b1fb9e1e9787387a53c3d
-
SHA256
24189912da92d9fc092ffd18232dc9b9fd001ac16ef599aeb26b93422525b84a
-
SHA512
288b1257e69ab550abfd96ecc01807815fb19bfd3221ca9d6fe8332dd872f7728412375b4ffe9035b522f0f754e3ee0d117debbba6bcb62aa9840d01d16bd679
-
SSDEEP
12288:fU5rCOTeid3Vs9C/QmA835xWOJSpPaDZu:fUQOJd3Vb/S82bdaDo
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3380 DC56.tmp 4700 DCC3.tmp 540 DD31.tmp 4064 DDCD.tmp 4476 DE3A.tmp 3576 DEC7.tmp 1412 DF44.tmp 4492 DFC1.tmp 4996 E03E.tmp 4608 E08C.tmp 3632 E0FA.tmp 4288 E177.tmp 2964 E1C5.tmp 2304 E232.tmp 4928 E2AF.tmp 2156 E2FD.tmp 1016 E35B.tmp 4436 E3C8.tmp 4764 E416.tmp 2264 E465.tmp 1884 E4C2.tmp 1044 E54F.tmp 2176 E5CC.tmp 2672 E639.tmp 4432 E6B6.tmp 3240 E704.tmp 2428 E753.tmp 4788 E7D0.tmp 4372 E82D.tmp 540 E89B.tmp 4228 E8F8.tmp 4836 E966.tmp 444 E9D3.tmp 1412 EA21.tmp 3708 EA6F.tmp 2396 EACD.tmp 3268 EB2B.tmp 3348 EB89.tmp 2404 EBE6.tmp 2304 EC35.tmp 1440 EC92.tmp 1444 ECE0.tmp 3068 ED2F.tmp 2292 ED7D.tmp 4756 EDCB.tmp 4480 EE29.tmp 220 EE86.tmp 4448 EED4.tmp 4452 EF32.tmp 1456 EF90.tmp 1724 EFEE.tmp 2572 F03C.tmp 3956 F09A.tmp 2544 F0E8.tmp 1260 F136.tmp 4476 F194.tmp 3748 F1F1.tmp 1776 F23F.tmp 3876 F29D.tmp 1412 F2EB.tmp 3708 F339.tmp 2396 F388.tmp 3268 F3D6.tmp 4868 F424.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3612 wrote to memory of 3380 3612 2024-05-23_2545b753c4cfebe82bba961831ff72b4_mafia.exe 90 PID 3612 wrote to memory of 3380 3612 2024-05-23_2545b753c4cfebe82bba961831ff72b4_mafia.exe 90 PID 3612 wrote to memory of 3380 3612 2024-05-23_2545b753c4cfebe82bba961831ff72b4_mafia.exe 90 PID 3380 wrote to memory of 4700 3380 DC56.tmp 91 PID 3380 wrote to memory of 4700 3380 DC56.tmp 91 PID 3380 wrote to memory of 4700 3380 DC56.tmp 91 PID 4700 wrote to memory of 540 4700 DCC3.tmp 92 PID 4700 wrote to memory of 540 4700 DCC3.tmp 92 PID 4700 wrote to memory of 540 4700 DCC3.tmp 92 PID 540 wrote to memory of 4064 540 DD31.tmp 94 PID 540 wrote to memory of 4064 540 DD31.tmp 94 PID 540 wrote to memory of 4064 540 DD31.tmp 94 PID 4064 wrote to memory of 4476 4064 DDCD.tmp 96 PID 4064 wrote to memory of 4476 4064 DDCD.tmp 96 PID 4064 wrote to memory of 4476 4064 DDCD.tmp 96 PID 4476 wrote to memory of 3576 4476 DE3A.tmp 98 PID 4476 wrote to memory of 3576 4476 DE3A.tmp 98 PID 4476 wrote to memory of 3576 4476 DE3A.tmp 98 PID 3576 wrote to memory of 1412 3576 DEC7.tmp 99 PID 3576 wrote to memory of 1412 3576 DEC7.tmp 99 PID 3576 wrote to memory of 1412 3576 DEC7.tmp 99 PID 1412 wrote to memory of 4492 1412 DF44.tmp 100 PID 1412 wrote to memory of 4492 1412 DF44.tmp 100 PID 1412 wrote to memory of 4492 1412 DF44.tmp 100 PID 4492 wrote to memory of 4996 4492 DFC1.tmp 101 PID 4492 wrote to memory of 4996 4492 DFC1.tmp 101 PID 4492 wrote to memory of 4996 4492 DFC1.tmp 101 PID 4996 wrote to memory of 4608 4996 E03E.tmp 102 PID 4996 wrote to memory of 4608 4996 E03E.tmp 102 PID 4996 wrote to memory of 4608 4996 E03E.tmp 102 PID 4608 wrote to memory of 3632 4608 E08C.tmp 103 PID 4608 wrote to memory of 3632 4608 E08C.tmp 103 PID 4608 wrote to memory of 3632 4608 E08C.tmp 103 PID 3632 wrote to memory of 4288 3632 E0FA.tmp 104 PID 3632 wrote to memory of 4288 3632 E0FA.tmp 104 PID 3632 wrote to memory of 4288 3632 E0FA.tmp 104 PID 4288 wrote to memory of 2964 4288 E177.tmp 105 PID 4288 wrote to memory of 2964 4288 E177.tmp 105 PID 4288 wrote to memory of 2964 4288 E177.tmp 105 PID 2964 wrote to memory of 2304 2964 E1C5.tmp 106 PID 2964 wrote to memory of 2304 2964 E1C5.tmp 106 PID 2964 wrote to memory of 2304 2964 E1C5.tmp 106 PID 2304 wrote to memory of 4928 2304 E232.tmp 107 PID 2304 wrote to memory of 4928 2304 E232.tmp 107 PID 2304 wrote to memory of 4928 2304 E232.tmp 107 PID 4928 wrote to memory of 2156 4928 E2AF.tmp 108 PID 4928 wrote to memory of 2156 4928 E2AF.tmp 108 PID 4928 wrote to memory of 2156 4928 E2AF.tmp 108 PID 2156 wrote to memory of 1016 2156 E2FD.tmp 109 PID 2156 wrote to memory of 1016 2156 E2FD.tmp 109 PID 2156 wrote to memory of 1016 2156 E2FD.tmp 109 PID 1016 wrote to memory of 4436 1016 E35B.tmp 110 PID 1016 wrote to memory of 4436 1016 E35B.tmp 110 PID 1016 wrote to memory of 4436 1016 E35B.tmp 110 PID 4436 wrote to memory of 4764 4436 E3C8.tmp 111 PID 4436 wrote to memory of 4764 4436 E3C8.tmp 111 PID 4436 wrote to memory of 4764 4436 E3C8.tmp 111 PID 4764 wrote to memory of 2264 4764 E416.tmp 112 PID 4764 wrote to memory of 2264 4764 E416.tmp 112 PID 4764 wrote to memory of 2264 4764 E416.tmp 112 PID 2264 wrote to memory of 1884 2264 E465.tmp 113 PID 2264 wrote to memory of 1884 2264 E465.tmp 113 PID 2264 wrote to memory of 1884 2264 E465.tmp 113 PID 1884 wrote to memory of 1044 1884 E4C2.tmp 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_2545b753c4cfebe82bba961831ff72b4_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_2545b753c4cfebe82bba961831ff72b4_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\DC56.tmp"C:\Users\Admin\AppData\Local\Temp\DC56.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\DCC3.tmp"C:\Users\Admin\AppData\Local\Temp\DCC3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\DD31.tmp"C:\Users\Admin\AppData\Local\Temp\DD31.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\DE3A.tmp"C:\Users\Admin\AppData\Local\Temp\DE3A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\DEC7.tmp"C:\Users\Admin\AppData\Local\Temp\DEC7.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\DF44.tmp"C:\Users\Admin\AppData\Local\Temp\DF44.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\DFC1.tmp"C:\Users\Admin\AppData\Local\Temp\DFC1.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\E03E.tmp"C:\Users\Admin\AppData\Local\Temp\E03E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\E08C.tmp"C:\Users\Admin\AppData\Local\Temp\E08C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\E177.tmp"C:\Users\Admin\AppData\Local\Temp\E177.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\E232.tmp"C:\Users\Admin\AppData\Local\Temp\E232.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\E2AF.tmp"C:\Users\Admin\AppData\Local\Temp\E2AF.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\E2FD.tmp"C:\Users\Admin\AppData\Local\Temp\E2FD.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\E35B.tmp"C:\Users\Admin\AppData\Local\Temp\E35B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\E416.tmp"C:\Users\Admin\AppData\Local\Temp\E416.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\E465.tmp"C:\Users\Admin\AppData\Local\Temp\E465.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\E4C2.tmp"C:\Users\Admin\AppData\Local\Temp\E4C2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\E54F.tmp"C:\Users\Admin\AppData\Local\Temp\E54F.tmp"23⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\E5CC.tmp"C:\Users\Admin\AppData\Local\Temp\E5CC.tmp"24⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\E639.tmp"C:\Users\Admin\AppData\Local\Temp\E639.tmp"25⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"26⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\E704.tmp"C:\Users\Admin\AppData\Local\Temp\E704.tmp"27⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\E753.tmp"C:\Users\Admin\AppData\Local\Temp\E753.tmp"28⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"29⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\E82D.tmp"C:\Users\Admin\AppData\Local\Temp\E82D.tmp"30⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\E89B.tmp"C:\Users\Admin\AppData\Local\Temp\E89B.tmp"31⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"32⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\E966.tmp"C:\Users\Admin\AppData\Local\Temp\E966.tmp"33⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"34⤵
- Executes dropped EXE
PID:444 -
C:\Users\Admin\AppData\Local\Temp\EA21.tmp"C:\Users\Admin\AppData\Local\Temp\EA21.tmp"35⤵
- Executes dropped EXE
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"36⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\EACD.tmp"C:\Users\Admin\AppData\Local\Temp\EACD.tmp"37⤵
- Executes dropped EXE
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\EB2B.tmp"C:\Users\Admin\AppData\Local\Temp\EB2B.tmp"38⤵
- Executes dropped EXE
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\EB89.tmp"C:\Users\Admin\AppData\Local\Temp\EB89.tmp"39⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\EBE6.tmp"C:\Users\Admin\AppData\Local\Temp\EBE6.tmp"40⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\EC35.tmp"C:\Users\Admin\AppData\Local\Temp\EC35.tmp"41⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\EC92.tmp"C:\Users\Admin\AppData\Local\Temp\EC92.tmp"42⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\ECE0.tmp"C:\Users\Admin\AppData\Local\Temp\ECE0.tmp"43⤵
- Executes dropped EXE
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"44⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\ED7D.tmp"C:\Users\Admin\AppData\Local\Temp\ED7D.tmp"45⤵
- Executes dropped EXE
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\EDCB.tmp"C:\Users\Admin\AppData\Local\Temp\EDCB.tmp"46⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\EE29.tmp"C:\Users\Admin\AppData\Local\Temp\EE29.tmp"47⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\EE86.tmp"C:\Users\Admin\AppData\Local\Temp\EE86.tmp"48⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\EED4.tmp"C:\Users\Admin\AppData\Local\Temp\EED4.tmp"49⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\EF32.tmp"C:\Users\Admin\AppData\Local\Temp\EF32.tmp"50⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\EF90.tmp"C:\Users\Admin\AppData\Local\Temp\EF90.tmp"51⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\EFEE.tmp"C:\Users\Admin\AppData\Local\Temp\EFEE.tmp"52⤵
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\F03C.tmp"C:\Users\Admin\AppData\Local\Temp\F03C.tmp"53⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\F09A.tmp"C:\Users\Admin\AppData\Local\Temp\F09A.tmp"54⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\F0E8.tmp"C:\Users\Admin\AppData\Local\Temp\F0E8.tmp"55⤵
- Executes dropped EXE
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\F136.tmp"C:\Users\Admin\AppData\Local\Temp\F136.tmp"56⤵
- Executes dropped EXE
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\F194.tmp"C:\Users\Admin\AppData\Local\Temp\F194.tmp"57⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\F1F1.tmp"C:\Users\Admin\AppData\Local\Temp\F1F1.tmp"58⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\F23F.tmp"C:\Users\Admin\AppData\Local\Temp\F23F.tmp"59⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\F29D.tmp"C:\Users\Admin\AppData\Local\Temp\F29D.tmp"60⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\F2EB.tmp"C:\Users\Admin\AppData\Local\Temp\F2EB.tmp"61⤵
- Executes dropped EXE
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\F339.tmp"C:\Users\Admin\AppData\Local\Temp\F339.tmp"62⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\F388.tmp"C:\Users\Admin\AppData\Local\Temp\F388.tmp"63⤵
- Executes dropped EXE
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\F3D6.tmp"C:\Users\Admin\AppData\Local\Temp\F3D6.tmp"64⤵
- Executes dropped EXE
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\F424.tmp"C:\Users\Admin\AppData\Local\Temp\F424.tmp"65⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\F482.tmp"C:\Users\Admin\AppData\Local\Temp\F482.tmp"66⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"67⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\F51E.tmp"C:\Users\Admin\AppData\Local\Temp\F51E.tmp"68⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\F56C.tmp"C:\Users\Admin\AppData\Local\Temp\F56C.tmp"69⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"70⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\F618.tmp"C:\Users\Admin\AppData\Local\Temp\F618.tmp"71⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\F676.tmp"C:\Users\Admin\AppData\Local\Temp\F676.tmp"72⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"73⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\F721.tmp"C:\Users\Admin\AppData\Local\Temp\F721.tmp"74⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\F77F.tmp"C:\Users\Admin\AppData\Local\Temp\F77F.tmp"75⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"76⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\F82B.tmp"C:\Users\Admin\AppData\Local\Temp\F82B.tmp"77⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\F889.tmp"C:\Users\Admin\AppData\Local\Temp\F889.tmp"78⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\F8D7.tmp"C:\Users\Admin\AppData\Local\Temp\F8D7.tmp"79⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\F935.tmp"C:\Users\Admin\AppData\Local\Temp\F935.tmp"80⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\F983.tmp"C:\Users\Admin\AppData\Local\Temp\F983.tmp"81⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\F9E1.tmp"C:\Users\Admin\AppData\Local\Temp\F9E1.tmp"82⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\FA3E.tmp"C:\Users\Admin\AppData\Local\Temp\FA3E.tmp"83⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"84⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"85⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\FB58.tmp"C:\Users\Admin\AppData\Local\Temp\FB58.tmp"86⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"87⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\FC03.tmp"C:\Users\Admin\AppData\Local\Temp\FC03.tmp"88⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\FC52.tmp"C:\Users\Admin\AppData\Local\Temp\FC52.tmp"89⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"90⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"91⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\FD6B.tmp"C:\Users\Admin\AppData\Local\Temp\FD6B.tmp"92⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"93⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\FE26.tmp"C:\Users\Admin\AppData\Local\Temp\FE26.tmp"94⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\FE84.tmp"C:\Users\Admin\AppData\Local\Temp\FE84.tmp"95⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\FEE2.tmp"C:\Users\Admin\AppData\Local\Temp\FEE2.tmp"96⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\FF30.tmp"C:\Users\Admin\AppData\Local\Temp\FF30.tmp"97⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\FF8E.tmp"C:\Users\Admin\AppData\Local\Temp\FF8E.tmp"98⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\FFEB.tmp"C:\Users\Admin\AppData\Local\Temp\FFEB.tmp"99⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\49.tmp"C:\Users\Admin\AppData\Local\Temp\49.tmp"100⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\97.tmp"C:\Users\Admin\AppData\Local\Temp\97.tmp"101⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\F5.tmp"C:\Users\Admin\AppData\Local\Temp\F5.tmp"102⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\153.tmp"C:\Users\Admin\AppData\Local\Temp\153.tmp"103⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\1B1.tmp"C:\Users\Admin\AppData\Local\Temp\1B1.tmp"104⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\20E.tmp"C:\Users\Admin\AppData\Local\Temp\20E.tmp"105⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\26C.tmp"C:\Users\Admin\AppData\Local\Temp\26C.tmp"106⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\2BA.tmp"C:\Users\Admin\AppData\Local\Temp\2BA.tmp"107⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\308.tmp"C:\Users\Admin\AppData\Local\Temp\308.tmp"108⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\366.tmp"C:\Users\Admin\AppData\Local\Temp\366.tmp"109⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\3B4.tmp"C:\Users\Admin\AppData\Local\Temp\3B4.tmp"110⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\402.tmp"C:\Users\Admin\AppData\Local\Temp\402.tmp"111⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\460.tmp"C:\Users\Admin\AppData\Local\Temp\460.tmp"112⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\4AE.tmp"C:\Users\Admin\AppData\Local\Temp\4AE.tmp"113⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\50C.tmp"C:\Users\Admin\AppData\Local\Temp\50C.tmp"114⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\55A.tmp"C:\Users\Admin\AppData\Local\Temp\55A.tmp"115⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\5A8.tmp"C:\Users\Admin\AppData\Local\Temp\5A8.tmp"116⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\606.tmp"C:\Users\Admin\AppData\Local\Temp\606.tmp"117⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\654.tmp"C:\Users\Admin\AppData\Local\Temp\654.tmp"118⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\6A2.tmp"C:\Users\Admin\AppData\Local\Temp\6A2.tmp"119⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\6F0.tmp"C:\Users\Admin\AppData\Local\Temp\6F0.tmp"120⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\74E.tmp"C:\Users\Admin\AppData\Local\Temp\74E.tmp"121⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\7AC.tmp"C:\Users\Admin\AppData\Local\Temp\7AC.tmp"122⤵PID:2760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-