Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 07:03
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-02_e932c6703b8fb89074ae1f550975077d_mafia.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2024-06-02_e932c6703b8fb89074ae1f550975077d_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-02_e932c6703b8fb89074ae1f550975077d_mafia.exe
-
Size
530KB
-
MD5
e932c6703b8fb89074ae1f550975077d
-
SHA1
5af2e62679ca057dd64202a056f461511394a9b6
-
SHA256
d415b785a340979b22d973daed1dee2121d63381be3c990bc96dd0c5adc7d440
-
SHA512
5b0307131d5d3958f75f02e37ae568ce11f4120269bc45c0f4e8822a0d69d42d4ee64b07549ac027f440822bc1a637bd5d4fa2da0340ff46997ab7a39364bdeb
-
SSDEEP
12288:AU5rCOTeio8SarHCUgKgUI+W/d7J9CNZulFVg0M1:AUQOJogrHCUgKaJ9CNclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1176 4343.tmp 2348 43A0.tmp 1452 442D.tmp 3084 44AA.tmp 1912 4527.tmp 2968 4594.tmp 4132 4621.tmp 1028 46BD.tmp 4076 472B.tmp 448 47B7.tmp 3404 4834.tmp 4000 48C1.tmp 3320 491F.tmp 1972 498C.tmp 1468 4A09.tmp 1608 4A76.tmp 3768 4B03.tmp 3740 4B80.tmp 3568 4BCE.tmp 3196 4C2C.tmp 2252 4CD8.tmp 4880 4D55.tmp 2896 4DC2.tmp 2752 4E20.tmp 4712 4E6E.tmp 3796 4EBC.tmp 1988 4F29.tmp 3552 4F87.tmp 3916 4FD5.tmp 4260 5043.tmp 5000 50C0.tmp 1984 511D.tmp 2652 518B.tmp 3340 51D9.tmp 4204 5237.tmp 1580 5285.tmp 1144 52D3.tmp 4596 5331.tmp 4504 537F.tmp 1832 53CD.tmp 4180 541B.tmp 2344 5479.tmp 3824 54D7.tmp 2276 5534.tmp 4528 5582.tmp 892 55E0.tmp 3792 563E.tmp 2852 569C.tmp 1028 56F9.tmp 4676 5757.tmp 4496 57A5.tmp 2080 5803.tmp 2540 5861.tmp 3512 58BF.tmp 220 591C.tmp 3320 598A.tmp 972 59D8.tmp 2964 5A36.tmp 2136 5A93.tmp 1608 5B01.tmp 3956 5B5E.tmp 3444 5BBC.tmp 1084 5C1A.tmp 4652 5C78.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4180 wrote to memory of 1176 4180 2024-06-02_e932c6703b8fb89074ae1f550975077d_mafia.exe 83 PID 4180 wrote to memory of 1176 4180 2024-06-02_e932c6703b8fb89074ae1f550975077d_mafia.exe 83 PID 4180 wrote to memory of 1176 4180 2024-06-02_e932c6703b8fb89074ae1f550975077d_mafia.exe 83 PID 1176 wrote to memory of 2348 1176 4343.tmp 84 PID 1176 wrote to memory of 2348 1176 4343.tmp 84 PID 1176 wrote to memory of 2348 1176 4343.tmp 84 PID 2348 wrote to memory of 1452 2348 43A0.tmp 85 PID 2348 wrote to memory of 1452 2348 43A0.tmp 85 PID 2348 wrote to memory of 1452 2348 43A0.tmp 85 PID 1452 wrote to memory of 3084 1452 442D.tmp 86 PID 1452 wrote to memory of 3084 1452 442D.tmp 86 PID 1452 wrote to memory of 3084 1452 442D.tmp 86 PID 3084 wrote to memory of 1912 3084 44AA.tmp 88 PID 3084 wrote to memory of 1912 3084 44AA.tmp 88 PID 3084 wrote to memory of 1912 3084 44AA.tmp 88 PID 1912 wrote to memory of 2968 1912 4527.tmp 89 PID 1912 wrote to memory of 2968 1912 4527.tmp 89 PID 1912 wrote to memory of 2968 1912 4527.tmp 89 PID 2968 wrote to memory of 4132 2968 4594.tmp 90 PID 2968 wrote to memory of 4132 2968 4594.tmp 90 PID 2968 wrote to memory of 4132 2968 4594.tmp 90 PID 4132 wrote to memory of 1028 4132 4621.tmp 92 PID 4132 wrote to memory of 1028 4132 4621.tmp 92 PID 4132 wrote to memory of 1028 4132 4621.tmp 92 PID 1028 wrote to memory of 4076 1028 46BD.tmp 93 PID 1028 wrote to memory of 4076 1028 46BD.tmp 93 PID 1028 wrote to memory of 4076 1028 46BD.tmp 93 PID 4076 wrote to memory of 448 4076 472B.tmp 95 PID 4076 wrote to memory of 448 4076 472B.tmp 95 PID 4076 wrote to memory of 448 4076 472B.tmp 95 PID 448 wrote to memory of 3404 448 47B7.tmp 96 PID 448 wrote to memory of 3404 448 47B7.tmp 96 PID 448 wrote to memory of 3404 448 47B7.tmp 96 PID 3404 wrote to memory of 4000 3404 4834.tmp 97 PID 3404 wrote to memory of 4000 3404 4834.tmp 97 PID 3404 wrote to memory of 4000 3404 4834.tmp 97 PID 4000 wrote to memory of 3320 4000 48C1.tmp 98 PID 4000 wrote to memory of 3320 4000 48C1.tmp 98 PID 4000 wrote to memory of 3320 4000 48C1.tmp 98 PID 3320 wrote to memory of 1972 3320 491F.tmp 99 PID 3320 wrote to memory of 1972 3320 491F.tmp 99 PID 3320 wrote to memory of 1972 3320 491F.tmp 99 PID 1972 wrote to memory of 1468 1972 498C.tmp 100 PID 1972 wrote to memory of 1468 1972 498C.tmp 100 PID 1972 wrote to memory of 1468 1972 498C.tmp 100 PID 1468 wrote to memory of 1608 1468 4A09.tmp 101 PID 1468 wrote to memory of 1608 1468 4A09.tmp 101 PID 1468 wrote to memory of 1608 1468 4A09.tmp 101 PID 1608 wrote to memory of 3768 1608 4A76.tmp 102 PID 1608 wrote to memory of 3768 1608 4A76.tmp 102 PID 1608 wrote to memory of 3768 1608 4A76.tmp 102 PID 3768 wrote to memory of 3740 3768 4B03.tmp 103 PID 3768 wrote to memory of 3740 3768 4B03.tmp 103 PID 3768 wrote to memory of 3740 3768 4B03.tmp 103 PID 3740 wrote to memory of 3568 3740 4B80.tmp 104 PID 3740 wrote to memory of 3568 3740 4B80.tmp 104 PID 3740 wrote to memory of 3568 3740 4B80.tmp 104 PID 3568 wrote to memory of 3196 3568 4BCE.tmp 105 PID 3568 wrote to memory of 3196 3568 4BCE.tmp 105 PID 3568 wrote to memory of 3196 3568 4BCE.tmp 105 PID 3196 wrote to memory of 2252 3196 4C2C.tmp 106 PID 3196 wrote to memory of 2252 3196 4C2C.tmp 106 PID 3196 wrote to memory of 2252 3196 4C2C.tmp 106 PID 2252 wrote to memory of 4880 2252 4CD8.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-02_e932c6703b8fb89074ae1f550975077d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-02_e932c6703b8fb89074ae1f550975077d_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\44AA.tmp"C:\Users\Admin\AppData\Local\Temp\44AA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"23⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"24⤵
- Executes dropped EXE
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"25⤵
- Executes dropped EXE
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"26⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"27⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"28⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"29⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"30⤵
- Executes dropped EXE
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"31⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"32⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"33⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"34⤵
- Executes dropped EXE
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"35⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"36⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"37⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"38⤵
- Executes dropped EXE
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"39⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"40⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"41⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"42⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"43⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"44⤵
- Executes dropped EXE
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"45⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"46⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"47⤵
- Executes dropped EXE
PID:892 -
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"48⤵
- Executes dropped EXE
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"49⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"50⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"51⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"52⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"53⤵
- Executes dropped EXE
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"54⤵
- Executes dropped EXE
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"55⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"56⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"57⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"58⤵
- Executes dropped EXE
PID:972 -
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"59⤵
- Executes dropped EXE
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"60⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"61⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"62⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"63⤵
- Executes dropped EXE
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"64⤵
- Executes dropped EXE
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"65⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"66⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"67⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"68⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"69⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"70⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"71⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"72⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"73⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"74⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"75⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"76⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"77⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"78⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"79⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"80⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"81⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"82⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"83⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"84⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"85⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"86⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"87⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"88⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"89⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"90⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"91⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"92⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"93⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"94⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"95⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"96⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"97⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"98⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"99⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"100⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"101⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"102⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"103⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"104⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"105⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"106⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"107⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"108⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"109⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"110⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"111⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"112⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"113⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"114⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"115⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"116⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"117⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"118⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"119⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"120⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"121⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"122⤵PID:4068
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-