Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/03/2024, 10:25
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-10_13d353f2f2469e73c60ac5e2050c6054_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-10_13d353f2f2469e73c60ac5e2050c6054_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-10_13d353f2f2469e73c60ac5e2050c6054_mafia.exe
-
Size
487KB
-
MD5
13d353f2f2469e73c60ac5e2050c6054
-
SHA1
2c58437944e395d36a6294c4efc068d802c8794e
-
SHA256
6bd795b7e9331f7a5864276be205602f1a40c953b6cae98ac8b1f6c31b238a94
-
SHA512
47371f804474d3d6e689a6d31aa32bbf23c9df3294775b1497bea9d07dc3a709e9b0c7eebb46b3369d419006efef9f68080e37b26e930cb5c6fd57ab7fa2b0e0
-
SSDEEP
12288:yU5rCOTeiN5zHvy8Oi/448N+nSVwTyyFbZ:yUQOJNRHK8nf8WVTyyFb
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4048 59.tmp 1008 21E.tmp 4104 347.tmp 2528 441.tmp 1900 5B8.tmp 1556 6E1.tmp 4636 7BB.tmp 1372 858.tmp 2432 A6B.tmp 3276 B55.tmp 2304 C11.tmp 4456 D0B.tmp 4592 DC6.tmp 4388 EB1.tmp 1488 FE9.tmp 3212 1095.tmp 532 1141.tmp 4340 122B.tmp 4280 12E7.tmp 4992 13C2.tmp 2104 148D.tmp 3852 15B6.tmp 2084 16DE.tmp 656 1875.tmp 788 1AE6.tmp 5112 1C6C.tmp 4112 1D95.tmp 3508 1E70.tmp 4060 1F1C.tmp 4628 1FC8.tmp 1484 2093.tmp 4332 214E.tmp 1812 21FA.tmp 4412 2287.tmp 4684 2323.tmp 4576 23BF.tmp 3992 246B.tmp 2984 2527.tmp 3712 25F2.tmp 3392 269E.tmp 4820 27E6.tmp 4460 28B1.tmp 4224 295D.tmp 5104 29F9.tmp 2520 2A86.tmp 2208 2B22.tmp 2104 2BAF.tmp 1188 2C2C.tmp 1336 2CC8.tmp 1172 2D64.tmp 5108 2E10.tmp 3360 2E9D.tmp 1256 2F29.tmp 1556 2FB6.tmp 4628 3052.tmp 4516 30EE.tmp 4332 318B.tmp 3420 3217.tmp 2212 3321.tmp 3208 33AD.tmp 564 343A.tmp 3140 34B7.tmp 5052 3582.tmp 1700 35F0.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 416 wrote to memory of 4048 416 2024-03-10_13d353f2f2469e73c60ac5e2050c6054_mafia.exe 95 PID 416 wrote to memory of 4048 416 2024-03-10_13d353f2f2469e73c60ac5e2050c6054_mafia.exe 95 PID 416 wrote to memory of 4048 416 2024-03-10_13d353f2f2469e73c60ac5e2050c6054_mafia.exe 95 PID 4048 wrote to memory of 1008 4048 59.tmp 97 PID 4048 wrote to memory of 1008 4048 59.tmp 97 PID 4048 wrote to memory of 1008 4048 59.tmp 97 PID 1008 wrote to memory of 4104 1008 21E.tmp 98 PID 1008 wrote to memory of 4104 1008 21E.tmp 98 PID 1008 wrote to memory of 4104 1008 21E.tmp 98 PID 4104 wrote to memory of 2528 4104 347.tmp 100 PID 4104 wrote to memory of 2528 4104 347.tmp 100 PID 4104 wrote to memory of 2528 4104 347.tmp 100 PID 2528 wrote to memory of 1900 2528 441.tmp 101 PID 2528 wrote to memory of 1900 2528 441.tmp 101 PID 2528 wrote to memory of 1900 2528 441.tmp 101 PID 1900 wrote to memory of 1556 1900 5B8.tmp 103 PID 1900 wrote to memory of 1556 1900 5B8.tmp 103 PID 1900 wrote to memory of 1556 1900 5B8.tmp 103 PID 1556 wrote to memory of 4636 1556 6E1.tmp 104 PID 1556 wrote to memory of 4636 1556 6E1.tmp 104 PID 1556 wrote to memory of 4636 1556 6E1.tmp 104 PID 4636 wrote to memory of 1372 4636 7BB.tmp 105 PID 4636 wrote to memory of 1372 4636 7BB.tmp 105 PID 4636 wrote to memory of 1372 4636 7BB.tmp 105 PID 1372 wrote to memory of 2432 1372 858.tmp 107 PID 1372 wrote to memory of 2432 1372 858.tmp 107 PID 1372 wrote to memory of 2432 1372 858.tmp 107 PID 2432 wrote to memory of 3276 2432 A6B.tmp 108 PID 2432 wrote to memory of 3276 2432 A6B.tmp 108 PID 2432 wrote to memory of 3276 2432 A6B.tmp 108 PID 3276 wrote to memory of 2304 3276 B55.tmp 109 PID 3276 wrote to memory of 2304 3276 B55.tmp 109 PID 3276 wrote to memory of 2304 3276 B55.tmp 109 PID 2304 wrote to memory of 4456 2304 C11.tmp 110 PID 2304 wrote to memory of 4456 2304 C11.tmp 110 PID 2304 wrote to memory of 4456 2304 C11.tmp 110 PID 4456 wrote to memory of 4592 4456 D0B.tmp 111 PID 4456 wrote to memory of 4592 4456 D0B.tmp 111 PID 4456 wrote to memory of 4592 4456 D0B.tmp 111 PID 4592 wrote to memory of 4388 4592 DC6.tmp 112 PID 4592 wrote to memory of 4388 4592 DC6.tmp 112 PID 4592 wrote to memory of 4388 4592 DC6.tmp 112 PID 4388 wrote to memory of 1488 4388 EB1.tmp 113 PID 4388 wrote to memory of 1488 4388 EB1.tmp 113 PID 4388 wrote to memory of 1488 4388 EB1.tmp 113 PID 1488 wrote to memory of 3212 1488 FE9.tmp 114 PID 1488 wrote to memory of 3212 1488 FE9.tmp 114 PID 1488 wrote to memory of 3212 1488 FE9.tmp 114 PID 3212 wrote to memory of 532 3212 1095.tmp 115 PID 3212 wrote to memory of 532 3212 1095.tmp 115 PID 3212 wrote to memory of 532 3212 1095.tmp 115 PID 532 wrote to memory of 4340 532 1141.tmp 116 PID 532 wrote to memory of 4340 532 1141.tmp 116 PID 532 wrote to memory of 4340 532 1141.tmp 116 PID 4340 wrote to memory of 4280 4340 122B.tmp 117 PID 4340 wrote to memory of 4280 4340 122B.tmp 117 PID 4340 wrote to memory of 4280 4340 122B.tmp 117 PID 4280 wrote to memory of 4992 4280 12E7.tmp 118 PID 4280 wrote to memory of 4992 4280 12E7.tmp 118 PID 4280 wrote to memory of 4992 4280 12E7.tmp 118 PID 4992 wrote to memory of 2104 4992 13C2.tmp 119 PID 4992 wrote to memory of 2104 4992 13C2.tmp 119 PID 4992 wrote to memory of 2104 4992 13C2.tmp 119 PID 2104 wrote to memory of 3852 2104 148D.tmp 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-10_13d353f2f2469e73c60ac5e2050c6054_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-10_13d353f2f2469e73c60ac5e2050c6054_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Users\Admin\AppData\Local\Temp\59.tmp"C:\Users\Admin\AppData\Local\Temp\59.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\21E.tmp"C:\Users\Admin\AppData\Local\Temp\21E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\347.tmp"C:\Users\Admin\AppData\Local\Temp\347.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\441.tmp"C:\Users\Admin\AppData\Local\Temp\441.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\5B8.tmp"C:\Users\Admin\AppData\Local\Temp\5B8.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\6E1.tmp"C:\Users\Admin\AppData\Local\Temp\6E1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\7BB.tmp"C:\Users\Admin\AppData\Local\Temp\7BB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\858.tmp"C:\Users\Admin\AppData\Local\Temp\858.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\A6B.tmp"C:\Users\Admin\AppData\Local\Temp\A6B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\B55.tmp"C:\Users\Admin\AppData\Local\Temp\B55.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\C11.tmp"C:\Users\Admin\AppData\Local\Temp\C11.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\D0B.tmp"C:\Users\Admin\AppData\Local\Temp\D0B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\DC6.tmp"C:\Users\Admin\AppData\Local\Temp\DC6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\EB1.tmp"C:\Users\Admin\AppData\Local\Temp\EB1.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\FE9.tmp"C:\Users\Admin\AppData\Local\Temp\FE9.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\1095.tmp"C:\Users\Admin\AppData\Local\Temp\1095.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\1141.tmp"C:\Users\Admin\AppData\Local\Temp\1141.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Users\Admin\AppData\Local\Temp\122B.tmp"C:\Users\Admin\AppData\Local\Temp\122B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\12E7.tmp"C:\Users\Admin\AppData\Local\Temp\12E7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\13C2.tmp"C:\Users\Admin\AppData\Local\Temp\13C2.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\148D.tmp"C:\Users\Admin\AppData\Local\Temp\148D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\15B6.tmp"C:\Users\Admin\AppData\Local\Temp\15B6.tmp"23⤵
- Executes dropped EXE
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\16DE.tmp"C:\Users\Admin\AppData\Local\Temp\16DE.tmp"24⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\1875.tmp"C:\Users\Admin\AppData\Local\Temp\1875.tmp"25⤵
- Executes dropped EXE
PID:656 -
C:\Users\Admin\AppData\Local\Temp\1AE6.tmp"C:\Users\Admin\AppData\Local\Temp\1AE6.tmp"26⤵
- Executes dropped EXE
PID:788 -
C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"27⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\1D95.tmp"C:\Users\Admin\AppData\Local\Temp\1D95.tmp"28⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\1E70.tmp"C:\Users\Admin\AppData\Local\Temp\1E70.tmp"29⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\1F1C.tmp"C:\Users\Admin\AppData\Local\Temp\1F1C.tmp"30⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\1FC8.tmp"C:\Users\Admin\AppData\Local\Temp\1FC8.tmp"31⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\2093.tmp"C:\Users\Admin\AppData\Local\Temp\2093.tmp"32⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\214E.tmp"C:\Users\Admin\AppData\Local\Temp\214E.tmp"33⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\21FA.tmp"C:\Users\Admin\AppData\Local\Temp\21FA.tmp"34⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\2287.tmp"C:\Users\Admin\AppData\Local\Temp\2287.tmp"35⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\2323.tmp"C:\Users\Admin\AppData\Local\Temp\2323.tmp"36⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\23BF.tmp"C:\Users\Admin\AppData\Local\Temp\23BF.tmp"37⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\246B.tmp"C:\Users\Admin\AppData\Local\Temp\246B.tmp"38⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\2527.tmp"C:\Users\Admin\AppData\Local\Temp\2527.tmp"39⤵
- Executes dropped EXE
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\25F2.tmp"C:\Users\Admin\AppData\Local\Temp\25F2.tmp"40⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\269E.tmp"C:\Users\Admin\AppData\Local\Temp\269E.tmp"41⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\27E6.tmp"C:\Users\Admin\AppData\Local\Temp\27E6.tmp"42⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\28B1.tmp"C:\Users\Admin\AppData\Local\Temp\28B1.tmp"43⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\295D.tmp"C:\Users\Admin\AppData\Local\Temp\295D.tmp"44⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\29F9.tmp"C:\Users\Admin\AppData\Local\Temp\29F9.tmp"45⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\2A86.tmp"C:\Users\Admin\AppData\Local\Temp\2A86.tmp"46⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\2B22.tmp"C:\Users\Admin\AppData\Local\Temp\2B22.tmp"47⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\2BAF.tmp"C:\Users\Admin\AppData\Local\Temp\2BAF.tmp"48⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\2C2C.tmp"C:\Users\Admin\AppData\Local\Temp\2C2C.tmp"49⤵
- Executes dropped EXE
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"50⤵
- Executes dropped EXE
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\2D64.tmp"C:\Users\Admin\AppData\Local\Temp\2D64.tmp"51⤵
- Executes dropped EXE
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\2E10.tmp"C:\Users\Admin\AppData\Local\Temp\2E10.tmp"52⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\2E9D.tmp"C:\Users\Admin\AppData\Local\Temp\2E9D.tmp"53⤵
- Executes dropped EXE
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\2F29.tmp"C:\Users\Admin\AppData\Local\Temp\2F29.tmp"54⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\2FB6.tmp"C:\Users\Admin\AppData\Local\Temp\2FB6.tmp"55⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\3052.tmp"C:\Users\Admin\AppData\Local\Temp\3052.tmp"56⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\30EE.tmp"C:\Users\Admin\AppData\Local\Temp\30EE.tmp"57⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\318B.tmp"C:\Users\Admin\AppData\Local\Temp\318B.tmp"58⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\3217.tmp"C:\Users\Admin\AppData\Local\Temp\3217.tmp"59⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"60⤵
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\33AD.tmp"C:\Users\Admin\AppData\Local\Temp\33AD.tmp"61⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"62⤵
- Executes dropped EXE
PID:564 -
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"63⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"64⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\35F0.tmp"C:\Users\Admin\AppData\Local\Temp\35F0.tmp"65⤵
- Executes dropped EXE
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\367C.tmp"C:\Users\Admin\AppData\Local\Temp\367C.tmp"66⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\3728.tmp"C:\Users\Admin\AppData\Local\Temp\3728.tmp"67⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\37C4.tmp"C:\Users\Admin\AppData\Local\Temp\37C4.tmp"68⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\3841.tmp"C:\Users\Admin\AppData\Local\Temp\3841.tmp"69⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\38DE.tmp"C:\Users\Admin\AppData\Local\Temp\38DE.tmp"70⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\397A.tmp"C:\Users\Admin\AppData\Local\Temp\397A.tmp"71⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\3A06.tmp"C:\Users\Admin\AppData\Local\Temp\3A06.tmp"72⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\3A93.tmp"C:\Users\Admin\AppData\Local\Temp\3A93.tmp"73⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\3B20.tmp"C:\Users\Admin\AppData\Local\Temp\3B20.tmp"74⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\3B9D.tmp"C:\Users\Admin\AppData\Local\Temp\3B9D.tmp"75⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\3C68.tmp"C:\Users\Admin\AppData\Local\Temp\3C68.tmp"76⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\3D04.tmp"C:\Users\Admin\AppData\Local\Temp\3D04.tmp"77⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\3D91.tmp"C:\Users\Admin\AppData\Local\Temp\3D91.tmp"78⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\3E2D.tmp"C:\Users\Admin\AppData\Local\Temp\3E2D.tmp"79⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\3EC9.tmp"C:\Users\Admin\AppData\Local\Temp\3EC9.tmp"80⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\3F46.tmp"C:\Users\Admin\AppData\Local\Temp\3F46.tmp"81⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"82⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\4040.tmp"C:\Users\Admin\AppData\Local\Temp\4040.tmp"83⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\40AE.tmp"C:\Users\Admin\AppData\Local\Temp\40AE.tmp"84⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\413A.tmp"C:\Users\Admin\AppData\Local\Temp\413A.tmp"85⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\41C7.tmp"C:\Users\Admin\AppData\Local\Temp\41C7.tmp"86⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\4244.tmp"C:\Users\Admin\AppData\Local\Temp\4244.tmp"87⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\42D0.tmp"C:\Users\Admin\AppData\Local\Temp\42D0.tmp"88⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\436D.tmp"C:\Users\Admin\AppData\Local\Temp\436D.tmp"89⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\4428.tmp"C:\Users\Admin\AppData\Local\Temp\4428.tmp"90⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\4496.tmp"C:\Users\Admin\AppData\Local\Temp\4496.tmp"91⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\4532.tmp"C:\Users\Admin\AppData\Local\Temp\4532.tmp"92⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\45AF.tmp"C:\Users\Admin\AppData\Local\Temp\45AF.tmp"93⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\463B.tmp"C:\Users\Admin\AppData\Local\Temp\463B.tmp"94⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\46D8.tmp"C:\Users\Admin\AppData\Local\Temp\46D8.tmp"95⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\4784.tmp"C:\Users\Admin\AppData\Local\Temp\4784.tmp"96⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\484F.tmp"C:\Users\Admin\AppData\Local\Temp\484F.tmp"97⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\48EB.tmp"C:\Users\Admin\AppData\Local\Temp\48EB.tmp"98⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\4958.tmp"C:\Users\Admin\AppData\Local\Temp\4958.tmp"99⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\49C6.tmp"C:\Users\Admin\AppData\Local\Temp\49C6.tmp"100⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\4A72.tmp"C:\Users\Admin\AppData\Local\Temp\4A72.tmp"101⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\4AEF.tmp"C:\Users\Admin\AppData\Local\Temp\4AEF.tmp"102⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\4B5C.tmp"C:\Users\Admin\AppData\Local\Temp\4B5C.tmp"103⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\4BC9.tmp"C:\Users\Admin\AppData\Local\Temp\4BC9.tmp"104⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\4C75.tmp"C:\Users\Admin\AppData\Local\Temp\4C75.tmp"105⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\4D11.tmp"C:\Users\Admin\AppData\Local\Temp\4D11.tmp"106⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\4DBD.tmp"C:\Users\Admin\AppData\Local\Temp\4DBD.tmp"107⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\4E3A.tmp"C:\Users\Admin\AppData\Local\Temp\4E3A.tmp"108⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\4EE6.tmp"C:\Users\Admin\AppData\Local\Temp\4EE6.tmp"109⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\4F82.tmp"C:\Users\Admin\AppData\Local\Temp\4F82.tmp"110⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\4FF0.tmp"C:\Users\Admin\AppData\Local\Temp\4FF0.tmp"111⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\506D.tmp"C:\Users\Admin\AppData\Local\Temp\506D.tmp"112⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\5109.tmp"C:\Users\Admin\AppData\Local\Temp\5109.tmp"113⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\51A5.tmp"C:\Users\Admin\AppData\Local\Temp\51A5.tmp"114⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\5213.tmp"C:\Users\Admin\AppData\Local\Temp\5213.tmp"115⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\52AF.tmp"C:\Users\Admin\AppData\Local\Temp\52AF.tmp"116⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\531C.tmp"C:\Users\Admin\AppData\Local\Temp\531C.tmp"117⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\5399.tmp"C:\Users\Admin\AppData\Local\Temp\5399.tmp"118⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\5436.tmp"C:\Users\Admin\AppData\Local\Temp\5436.tmp"119⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\54C2.tmp"C:\Users\Admin\AppData\Local\Temp\54C2.tmp"120⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\554F.tmp"C:\Users\Admin\AppData\Local\Temp\554F.tmp"121⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\55DB.tmp"C:\Users\Admin\AppData\Local\Temp\55DB.tmp"122⤵PID:2292
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-