Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15/03/2024, 03:37
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-15_cdb4bdaa283b56651504f304778c6c4e_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-15_cdb4bdaa283b56651504f304778c6c4e_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-15_cdb4bdaa283b56651504f304778c6c4e_mafia.exe
-
Size
486KB
-
MD5
cdb4bdaa283b56651504f304778c6c4e
-
SHA1
2174ce67d602f0ffc88e0b37d049b181eec3b2b1
-
SHA256
e404be145e54af6bc47e06d9fca4a8f6027373455dd054de31daa300dfa9b8c2
-
SHA512
52e4dd02b3a5a9802265bcd50444e3e9a033823177f56068a3110138f9175d7cf5aa079129e1058e884725c279250492d415b9dfdf61d9c4e3a3f106a2ce10bd
-
SSDEEP
12288:/U5rCOTeiDT86SYCJzsz5JTqR+z9D+1M38YuYNZ:/UQOJDT86rL5G+l1N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4860 32E7.tmp 2980 3345.tmp 1368 33A3.tmp 220 3400.tmp 4580 345E.tmp 2316 34AC.tmp 3520 351A.tmp 3036 3587.tmp 2412 35D5.tmp 4660 3633.tmp 1980 36A0.tmp 2248 36FE.tmp 1176 374C.tmp 1220 37AA.tmp 5000 3808.tmp 1600 3856.tmp 5028 38C3.tmp 2040 3921.tmp 1636 396F.tmp 2120 39DC.tmp 3976 3A4A.tmp 2560 3A98.tmp 1496 3AE6.tmp 3212 3B34.tmp 3628 3B92.tmp 3572 3BFF.tmp 4456 3C4D.tmp 5116 3C9B.tmp 2760 3CF9.tmp 1972 3D67.tmp 3988 3DD4.tmp 4420 3E22.tmp 4132 3E8F.tmp 3332 3EDE.tmp 4500 3F2C.tmp 3428 3F7A.tmp 2456 3FC8.tmp 2700 4016.tmp 2928 4074.tmp 808 40C2.tmp 4628 4120.tmp 4004 417D.tmp 4568 41CC.tmp 1160 421A.tmp 3848 4268.tmp 2248 42B6.tmp 4664 4304.tmp 1660 4352.tmp 2104 43A0.tmp 2792 43FE.tmp 3620 444C.tmp 1872 449A.tmp 1260 44E8.tmp 3856 4537.tmp 4520 4594.tmp 1636 45E2.tmp 1480 4631.tmp 4308 467F.tmp 3336 46CD.tmp 3180 472B.tmp 2608 4779.tmp 1568 47C7.tmp 3528 4815.tmp 1676 4873.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1860 wrote to memory of 4860 1860 2024-03-15_cdb4bdaa283b56651504f304778c6c4e_mafia.exe 89 PID 1860 wrote to memory of 4860 1860 2024-03-15_cdb4bdaa283b56651504f304778c6c4e_mafia.exe 89 PID 1860 wrote to memory of 4860 1860 2024-03-15_cdb4bdaa283b56651504f304778c6c4e_mafia.exe 89 PID 4860 wrote to memory of 2980 4860 32E7.tmp 90 PID 4860 wrote to memory of 2980 4860 32E7.tmp 90 PID 4860 wrote to memory of 2980 4860 32E7.tmp 90 PID 2980 wrote to memory of 1368 2980 3345.tmp 91 PID 2980 wrote to memory of 1368 2980 3345.tmp 91 PID 2980 wrote to memory of 1368 2980 3345.tmp 91 PID 1368 wrote to memory of 220 1368 33A3.tmp 92 PID 1368 wrote to memory of 220 1368 33A3.tmp 92 PID 1368 wrote to memory of 220 1368 33A3.tmp 92 PID 220 wrote to memory of 4580 220 3400.tmp 94 PID 220 wrote to memory of 4580 220 3400.tmp 94 PID 220 wrote to memory of 4580 220 3400.tmp 94 PID 4580 wrote to memory of 2316 4580 345E.tmp 96 PID 4580 wrote to memory of 2316 4580 345E.tmp 96 PID 4580 wrote to memory of 2316 4580 345E.tmp 96 PID 2316 wrote to memory of 3520 2316 34AC.tmp 98 PID 2316 wrote to memory of 3520 2316 34AC.tmp 98 PID 2316 wrote to memory of 3520 2316 34AC.tmp 98 PID 3520 wrote to memory of 3036 3520 351A.tmp 99 PID 3520 wrote to memory of 3036 3520 351A.tmp 99 PID 3520 wrote to memory of 3036 3520 351A.tmp 99 PID 3036 wrote to memory of 2412 3036 3587.tmp 100 PID 3036 wrote to memory of 2412 3036 3587.tmp 100 PID 3036 wrote to memory of 2412 3036 3587.tmp 100 PID 2412 wrote to memory of 4660 2412 35D5.tmp 101 PID 2412 wrote to memory of 4660 2412 35D5.tmp 101 PID 2412 wrote to memory of 4660 2412 35D5.tmp 101 PID 4660 wrote to memory of 1980 4660 3633.tmp 102 PID 4660 wrote to memory of 1980 4660 3633.tmp 102 PID 4660 wrote to memory of 1980 4660 3633.tmp 102 PID 1980 wrote to memory of 2248 1980 36A0.tmp 103 PID 1980 wrote to memory of 2248 1980 36A0.tmp 103 PID 1980 wrote to memory of 2248 1980 36A0.tmp 103 PID 2248 wrote to memory of 1176 2248 36FE.tmp 104 PID 2248 wrote to memory of 1176 2248 36FE.tmp 104 PID 2248 wrote to memory of 1176 2248 36FE.tmp 104 PID 1176 wrote to memory of 1220 1176 374C.tmp 105 PID 1176 wrote to memory of 1220 1176 374C.tmp 105 PID 1176 wrote to memory of 1220 1176 374C.tmp 105 PID 1220 wrote to memory of 5000 1220 37AA.tmp 106 PID 1220 wrote to memory of 5000 1220 37AA.tmp 106 PID 1220 wrote to memory of 5000 1220 37AA.tmp 106 PID 5000 wrote to memory of 1600 5000 3808.tmp 107 PID 5000 wrote to memory of 1600 5000 3808.tmp 107 PID 5000 wrote to memory of 1600 5000 3808.tmp 107 PID 1600 wrote to memory of 5028 1600 3856.tmp 108 PID 1600 wrote to memory of 5028 1600 3856.tmp 108 PID 1600 wrote to memory of 5028 1600 3856.tmp 108 PID 5028 wrote to memory of 2040 5028 38C3.tmp 109 PID 5028 wrote to memory of 2040 5028 38C3.tmp 109 PID 5028 wrote to memory of 2040 5028 38C3.tmp 109 PID 2040 wrote to memory of 1636 2040 3921.tmp 110 PID 2040 wrote to memory of 1636 2040 3921.tmp 110 PID 2040 wrote to memory of 1636 2040 3921.tmp 110 PID 1636 wrote to memory of 2120 1636 396F.tmp 111 PID 1636 wrote to memory of 2120 1636 396F.tmp 111 PID 1636 wrote to memory of 2120 1636 396F.tmp 111 PID 2120 wrote to memory of 3976 2120 39DC.tmp 112 PID 2120 wrote to memory of 3976 2120 39DC.tmp 112 PID 2120 wrote to memory of 3976 2120 39DC.tmp 112 PID 3976 wrote to memory of 2560 3976 3A4A.tmp 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-15_cdb4bdaa283b56651504f304778c6c4e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-15_cdb4bdaa283b56651504f304778c6c4e_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\32E7.tmp"C:\Users\Admin\AppData\Local\Temp\32E7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\3345.tmp"C:\Users\Admin\AppData\Local\Temp\3345.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\33A3.tmp"C:\Users\Admin\AppData\Local\Temp\33A3.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\3400.tmp"C:\Users\Admin\AppData\Local\Temp\3400.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\345E.tmp"C:\Users\Admin\AppData\Local\Temp\345E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\34AC.tmp"C:\Users\Admin\AppData\Local\Temp\34AC.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\351A.tmp"C:\Users\Admin\AppData\Local\Temp\351A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\3587.tmp"C:\Users\Admin\AppData\Local\Temp\3587.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\35D5.tmp"C:\Users\Admin\AppData\Local\Temp\35D5.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\3633.tmp"C:\Users\Admin\AppData\Local\Temp\3633.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\36A0.tmp"C:\Users\Admin\AppData\Local\Temp\36A0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\36FE.tmp"C:\Users\Admin\AppData\Local\Temp\36FE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\374C.tmp"C:\Users\Admin\AppData\Local\Temp\374C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\37AA.tmp"C:\Users\Admin\AppData\Local\Temp\37AA.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\3808.tmp"C:\Users\Admin\AppData\Local\Temp\3808.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\3856.tmp"C:\Users\Admin\AppData\Local\Temp\3856.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\38C3.tmp"C:\Users\Admin\AppData\Local\Temp\38C3.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\3921.tmp"C:\Users\Admin\AppData\Local\Temp\3921.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\396F.tmp"C:\Users\Admin\AppData\Local\Temp\396F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\39DC.tmp"C:\Users\Admin\AppData\Local\Temp\39DC.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\3A98.tmp"C:\Users\Admin\AppData\Local\Temp\3A98.tmp"23⤵
- Executes dropped EXE
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"24⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\3B34.tmp"C:\Users\Admin\AppData\Local\Temp\3B34.tmp"25⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\3B92.tmp"C:\Users\Admin\AppData\Local\Temp\3B92.tmp"26⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"27⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"28⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"29⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"30⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\3D67.tmp"C:\Users\Admin\AppData\Local\Temp\3D67.tmp"31⤵
- Executes dropped EXE
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"32⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\3E22.tmp"C:\Users\Admin\AppData\Local\Temp\3E22.tmp"33⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"34⤵
- Executes dropped EXE
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"35⤵
- Executes dropped EXE
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"36⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"37⤵
- Executes dropped EXE
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"38⤵
- Executes dropped EXE
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\4016.tmp"C:\Users\Admin\AppData\Local\Temp\4016.tmp"39⤵
- Executes dropped EXE
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\4074.tmp"C:\Users\Admin\AppData\Local\Temp\4074.tmp"40⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\40C2.tmp"C:\Users\Admin\AppData\Local\Temp\40C2.tmp"41⤵
- Executes dropped EXE
PID:808 -
C:\Users\Admin\AppData\Local\Temp\4120.tmp"C:\Users\Admin\AppData\Local\Temp\4120.tmp"42⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"43⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"44⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\421A.tmp"C:\Users\Admin\AppData\Local\Temp\421A.tmp"45⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\4268.tmp"C:\Users\Admin\AppData\Local\Temp\4268.tmp"46⤵
- Executes dropped EXE
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\42B6.tmp"C:\Users\Admin\AppData\Local\Temp\42B6.tmp"47⤵
- Executes dropped EXE
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\4304.tmp"C:\Users\Admin\AppData\Local\Temp\4304.tmp"48⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\4352.tmp"C:\Users\Admin\AppData\Local\Temp\4352.tmp"49⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"50⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\43FE.tmp"C:\Users\Admin\AppData\Local\Temp\43FE.tmp"51⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"52⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"53⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"54⤵
- Executes dropped EXE
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"55⤵
- Executes dropped EXE
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"56⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"57⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"58⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"59⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"60⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"61⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"62⤵
- Executes dropped EXE
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"63⤵
- Executes dropped EXE
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"64⤵
- Executes dropped EXE
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"65⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"66⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"67⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"68⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"69⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"70⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"71⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"72⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"73⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"74⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"75⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"76⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"77⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"78⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"79⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"80⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"81⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"82⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"83⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"84⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"85⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"86⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"87⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"88⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"89⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"90⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"91⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"92⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"93⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"94⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"95⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"96⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"97⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"98⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"99⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"100⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"101⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"102⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"103⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"104⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"105⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"106⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"107⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"108⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"109⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"110⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"111⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"112⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"113⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"114⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"115⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"116⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"117⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"118⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"119⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"120⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"121⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"122⤵PID:3724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-