Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07/03/2024, 06:42
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-07_a95863f82c450264ba572a3e813c8007_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-07_a95863f82c450264ba572a3e813c8007_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-07_a95863f82c450264ba572a3e813c8007_mafia.exe
-
Size
486KB
-
MD5
a95863f82c450264ba572a3e813c8007
-
SHA1
9ad8c0a79507057cc5808995485d3bbcb45934eb
-
SHA256
a21aef189049c13b1d3b8b79600f178eca6edc478d5c50eaf5dfd74d64f64747
-
SHA512
4a7792af5036fb1ee7dbde9bce4918db17fed5a0f1162fee4e34ffc3f974ffdcc6a88e09c82dcbdda66b0987c984a007e9fb271c0b6d4b3c339d5e8f347dfdcd
-
SSDEEP
12288:/U5rCOTeiD2VJ34sUphj1Cw0ei+yYUne1hhjNZ:/UQOJD2ssMhj1hyYzN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4356 3132.tmp 4928 318F.tmp 508 31ED.tmp 3772 324B.tmp 3624 32B8.tmp 228 3316.tmp 2896 3364.tmp 4876 33C2.tmp 3232 3420.tmp 4640 349D.tmp 3456 350A.tmp 4004 3587.tmp 4864 35F4.tmp 460 3652.tmp 1084 36B0.tmp 5064 370E.tmp 1784 375C.tmp 3036 37AA.tmp 2508 3808.tmp 3240 3856.tmp 4176 38B3.tmp 1228 3902.tmp 716 395F.tmp 3256 39BD.tmp 1292 3A3A.tmp 4868 3A98.tmp 3292 3AE6.tmp 3220 3B34.tmp 2388 3B82.tmp 1620 3BD0.tmp 3492 3C1E.tmp 512 3C8C.tmp 1996 3CF9.tmp 1704 3D47.tmp 3204 3D95.tmp 1800 3DF3.tmp 4320 3E41.tmp 4768 3E8F.tmp 4700 3EDE.tmp 2008 3F3B.tmp 1560 3F89.tmp 2556 3FD8.tmp 2936 4026.tmp 3088 4083.tmp 1028 40D2.tmp 2584 412F.tmp 3624 417D.tmp 4504 41CC.tmp 1428 421A.tmp 764 4268.tmp 2680 42B6.tmp 4192 4314.tmp 4332 4362.tmp 60 43B0.tmp 4820 43FE.tmp 4364 444C.tmp 3784 449A.tmp 4004 44F8.tmp 832 4546.tmp 908 4594.tmp 2376 45E2.tmp 2184 4640.tmp 5064 468E.tmp 2932 46DC.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 668 wrote to memory of 4356 668 2024-03-07_a95863f82c450264ba572a3e813c8007_mafia.exe 89 PID 668 wrote to memory of 4356 668 2024-03-07_a95863f82c450264ba572a3e813c8007_mafia.exe 89 PID 668 wrote to memory of 4356 668 2024-03-07_a95863f82c450264ba572a3e813c8007_mafia.exe 89 PID 4356 wrote to memory of 4928 4356 3132.tmp 90 PID 4356 wrote to memory of 4928 4356 3132.tmp 90 PID 4356 wrote to memory of 4928 4356 3132.tmp 90 PID 4928 wrote to memory of 508 4928 318F.tmp 91 PID 4928 wrote to memory of 508 4928 318F.tmp 91 PID 4928 wrote to memory of 508 4928 318F.tmp 91 PID 508 wrote to memory of 3772 508 31ED.tmp 93 PID 508 wrote to memory of 3772 508 31ED.tmp 93 PID 508 wrote to memory of 3772 508 31ED.tmp 93 PID 3772 wrote to memory of 3624 3772 324B.tmp 95 PID 3772 wrote to memory of 3624 3772 324B.tmp 95 PID 3772 wrote to memory of 3624 3772 324B.tmp 95 PID 3624 wrote to memory of 228 3624 32B8.tmp 97 PID 3624 wrote to memory of 228 3624 32B8.tmp 97 PID 3624 wrote to memory of 228 3624 32B8.tmp 97 PID 228 wrote to memory of 2896 228 3316.tmp 98 PID 228 wrote to memory of 2896 228 3316.tmp 98 PID 228 wrote to memory of 2896 228 3316.tmp 98 PID 2896 wrote to memory of 4876 2896 3364.tmp 99 PID 2896 wrote to memory of 4876 2896 3364.tmp 99 PID 2896 wrote to memory of 4876 2896 3364.tmp 99 PID 4876 wrote to memory of 3232 4876 33C2.tmp 100 PID 4876 wrote to memory of 3232 4876 33C2.tmp 100 PID 4876 wrote to memory of 3232 4876 33C2.tmp 100 PID 3232 wrote to memory of 4640 3232 3420.tmp 101 PID 3232 wrote to memory of 4640 3232 3420.tmp 101 PID 3232 wrote to memory of 4640 3232 3420.tmp 101 PID 4640 wrote to memory of 3456 4640 349D.tmp 102 PID 4640 wrote to memory of 3456 4640 349D.tmp 102 PID 4640 wrote to memory of 3456 4640 349D.tmp 102 PID 3456 wrote to memory of 4004 3456 350A.tmp 103 PID 3456 wrote to memory of 4004 3456 350A.tmp 103 PID 3456 wrote to memory of 4004 3456 350A.tmp 103 PID 4004 wrote to memory of 4864 4004 3587.tmp 104 PID 4004 wrote to memory of 4864 4004 3587.tmp 104 PID 4004 wrote to memory of 4864 4004 3587.tmp 104 PID 4864 wrote to memory of 460 4864 35F4.tmp 105 PID 4864 wrote to memory of 460 4864 35F4.tmp 105 PID 4864 wrote to memory of 460 4864 35F4.tmp 105 PID 460 wrote to memory of 1084 460 3652.tmp 106 PID 460 wrote to memory of 1084 460 3652.tmp 106 PID 460 wrote to memory of 1084 460 3652.tmp 106 PID 1084 wrote to memory of 5064 1084 36B0.tmp 107 PID 1084 wrote to memory of 5064 1084 36B0.tmp 107 PID 1084 wrote to memory of 5064 1084 36B0.tmp 107 PID 5064 wrote to memory of 1784 5064 370E.tmp 108 PID 5064 wrote to memory of 1784 5064 370E.tmp 108 PID 5064 wrote to memory of 1784 5064 370E.tmp 108 PID 1784 wrote to memory of 3036 1784 375C.tmp 109 PID 1784 wrote to memory of 3036 1784 375C.tmp 109 PID 1784 wrote to memory of 3036 1784 375C.tmp 109 PID 3036 wrote to memory of 2508 3036 37AA.tmp 110 PID 3036 wrote to memory of 2508 3036 37AA.tmp 110 PID 3036 wrote to memory of 2508 3036 37AA.tmp 110 PID 2508 wrote to memory of 3240 2508 3808.tmp 111 PID 2508 wrote to memory of 3240 2508 3808.tmp 111 PID 2508 wrote to memory of 3240 2508 3808.tmp 111 PID 3240 wrote to memory of 4176 3240 3856.tmp 112 PID 3240 wrote to memory of 4176 3240 3856.tmp 112 PID 3240 wrote to memory of 4176 3240 3856.tmp 112 PID 4176 wrote to memory of 1228 4176 38B3.tmp 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-07_a95863f82c450264ba572a3e813c8007_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-07_a95863f82c450264ba572a3e813c8007_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Users\Admin\AppData\Local\Temp\3132.tmp"C:\Users\Admin\AppData\Local\Temp\3132.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\318F.tmp"C:\Users\Admin\AppData\Local\Temp\318F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\31ED.tmp"C:\Users\Admin\AppData\Local\Temp\31ED.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Users\Admin\AppData\Local\Temp\324B.tmp"C:\Users\Admin\AppData\Local\Temp\324B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\32B8.tmp"C:\Users\Admin\AppData\Local\Temp\32B8.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\3316.tmp"C:\Users\Admin\AppData\Local\Temp\3316.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\3364.tmp"C:\Users\Admin\AppData\Local\Temp\3364.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\33C2.tmp"C:\Users\Admin\AppData\Local\Temp\33C2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\3420.tmp"C:\Users\Admin\AppData\Local\Temp\3420.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\349D.tmp"C:\Users\Admin\AppData\Local\Temp\349D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\350A.tmp"C:\Users\Admin\AppData\Local\Temp\350A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\3587.tmp"C:\Users\Admin\AppData\Local\Temp\3587.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\35F4.tmp"C:\Users\Admin\AppData\Local\Temp\35F4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\3652.tmp"C:\Users\Admin\AppData\Local\Temp\3652.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Users\Admin\AppData\Local\Temp\36B0.tmp"C:\Users\Admin\AppData\Local\Temp\36B0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\370E.tmp"C:\Users\Admin\AppData\Local\Temp\370E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\375C.tmp"C:\Users\Admin\AppData\Local\Temp\375C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\37AA.tmp"C:\Users\Admin\AppData\Local\Temp\37AA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\3808.tmp"C:\Users\Admin\AppData\Local\Temp\3808.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\3856.tmp"C:\Users\Admin\AppData\Local\Temp\3856.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\38B3.tmp"C:\Users\Admin\AppData\Local\Temp\38B3.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\3902.tmp"C:\Users\Admin\AppData\Local\Temp\3902.tmp"23⤵
- Executes dropped EXE
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\395F.tmp"C:\Users\Admin\AppData\Local\Temp\395F.tmp"24⤵
- Executes dropped EXE
PID:716 -
C:\Users\Admin\AppData\Local\Temp\39BD.tmp"C:\Users\Admin\AppData\Local\Temp\39BD.tmp"25⤵
- Executes dropped EXE
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"26⤵
- Executes dropped EXE
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\3A98.tmp"C:\Users\Admin\AppData\Local\Temp\3A98.tmp"27⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"28⤵
- Executes dropped EXE
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\3B34.tmp"C:\Users\Admin\AppData\Local\Temp\3B34.tmp"29⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\3B82.tmp"C:\Users\Admin\AppData\Local\Temp\3B82.tmp"30⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\3BD0.tmp"C:\Users\Admin\AppData\Local\Temp\3BD0.tmp"31⤵
- Executes dropped EXE
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"32⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"33⤵
- Executes dropped EXE
PID:512 -
C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"34⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\3D47.tmp"C:\Users\Admin\AppData\Local\Temp\3D47.tmp"35⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\3D95.tmp"C:\Users\Admin\AppData\Local\Temp\3D95.tmp"36⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"37⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\3E41.tmp"C:\Users\Admin\AppData\Local\Temp\3E41.tmp"38⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"39⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"40⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\3F3B.tmp"C:\Users\Admin\AppData\Local\Temp\3F3B.tmp"41⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\3F89.tmp"C:\Users\Admin\AppData\Local\Temp\3F89.tmp"42⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"43⤵
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\4026.tmp"C:\Users\Admin\AppData\Local\Temp\4026.tmp"44⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\4083.tmp"C:\Users\Admin\AppData\Local\Temp\4083.tmp"45⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\40D2.tmp"C:\Users\Admin\AppData\Local\Temp\40D2.tmp"46⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\412F.tmp"C:\Users\Admin\AppData\Local\Temp\412F.tmp"47⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"48⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"49⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\421A.tmp"C:\Users\Admin\AppData\Local\Temp\421A.tmp"50⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\4268.tmp"C:\Users\Admin\AppData\Local\Temp\4268.tmp"51⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\42B6.tmp"C:\Users\Admin\AppData\Local\Temp\42B6.tmp"52⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\4314.tmp"C:\Users\Admin\AppData\Local\Temp\4314.tmp"53⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\4362.tmp"C:\Users\Admin\AppData\Local\Temp\4362.tmp"54⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\43B0.tmp"C:\Users\Admin\AppData\Local\Temp\43B0.tmp"55⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\43FE.tmp"C:\Users\Admin\AppData\Local\Temp\43FE.tmp"56⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"57⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"58⤵
- Executes dropped EXE
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"59⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"60⤵
- Executes dropped EXE
PID:832 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"61⤵
- Executes dropped EXE
PID:908 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"62⤵
- Executes dropped EXE
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"63⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"64⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"65⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"66⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"67⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"68⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"69⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"70⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"71⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"72⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"73⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"74⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\4A19.tmp"C:\Users\Admin\AppData\Local\Temp\4A19.tmp"75⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"76⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"77⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"78⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"79⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"80⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"81⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"82⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"83⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"84⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"85⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"86⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"87⤵PID:508
-
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"88⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"89⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"90⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"91⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"92⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"93⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"94⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"95⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"96⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"97⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"98⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"99⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"100⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"101⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"102⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"103⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"104⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"105⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"106⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"107⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"108⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"109⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"110⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"111⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"112⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"113⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"114⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"115⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"116⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"117⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"118⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"119⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"120⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"121⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"122⤵PID:3352
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-