Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19/03/2024, 09:51
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-19_a489034e8a54d22b648618952b1ae11e_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-19_a489034e8a54d22b648618952b1ae11e_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-19_a489034e8a54d22b648618952b1ae11e_mafia.exe
-
Size
765KB
-
MD5
a489034e8a54d22b648618952b1ae11e
-
SHA1
30cee42031d5a0785780ba3944264d4395ca1769
-
SHA256
552da0e27c404da8ba55ee6f6b4b5d0d23f0be4347f8c031923e229e7e5158f8
-
SHA512
8333f14ea44645e8e344d4fc99666c3e1a8c55ec33a4c356ae13be10c2f95c755572811d6cfa13dd98a12427a523e59979d60d75b74b78bae4aff340df21ca13
-
SSDEEP
12288:ZU5rCOTeiDQ7V/PLYMiSjjzyG83a0K9T6B3ZF5rn5rLOa54U5w5A:ZUQOJDQ5PsK9T6B3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4536 38F2.tmp 1560 39AD.tmp 940 3A3A.tmp 5060 3AC7.tmp 1600 3B24.tmp 4492 3B92.tmp 1128 3BFF.tmp 4068 3C5D.tmp 3276 3CAB.tmp 392 3D28.tmp 4996 3D86.tmp 1640 3DF3.tmp 4604 3E61.tmp 752 3EBE.tmp 2568 3F5B.tmp 3500 3FB8.tmp 4112 4006.tmp 1868 4074.tmp 2080 40C2.tmp 2244 4120.tmp 2328 417D.tmp 4692 41EB.tmp 1256 4249.tmp 412 4297.tmp 4116 42E5.tmp 3436 4343.tmp 1616 4391.tmp 4784 43EE.tmp 2504 443D.tmp 636 448B.tmp 1200 44F8.tmp 2372 4565.tmp 4284 45D3.tmp 3028 4650.tmp 5052 46AE.tmp 4160 46FC.tmp 3944 4759.tmp 900 47A8.tmp 5060 47F6.tmp 2444 4844.tmp 2632 4892.tmp 4360 48E0.tmp 4352 492E.tmp 4788 497C.tmp 1328 49CA.tmp 2184 4A19.tmp 2584 4A76.tmp 4252 4AC4.tmp 2840 4B13.tmp 4812 4B61.tmp 2460 4BAF.tmp 3432 4BFD.tmp 1680 4C4B.tmp 2068 4C99.tmp 3284 4CE7.tmp 4488 4D35.tmp 1352 4D93.tmp 5056 4DF1.tmp 3260 4E3F.tmp 4888 4E8D.tmp 2868 4EDB.tmp 216 4F29.tmp 2340 4F78.tmp 4664 4FC6.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4708 wrote to memory of 4536 4708 2024-03-19_a489034e8a54d22b648618952b1ae11e_mafia.exe 90 PID 4708 wrote to memory of 4536 4708 2024-03-19_a489034e8a54d22b648618952b1ae11e_mafia.exe 90 PID 4708 wrote to memory of 4536 4708 2024-03-19_a489034e8a54d22b648618952b1ae11e_mafia.exe 90 PID 4536 wrote to memory of 1560 4536 38F2.tmp 91 PID 4536 wrote to memory of 1560 4536 38F2.tmp 91 PID 4536 wrote to memory of 1560 4536 38F2.tmp 91 PID 1560 wrote to memory of 940 1560 39AD.tmp 93 PID 1560 wrote to memory of 940 1560 39AD.tmp 93 PID 1560 wrote to memory of 940 1560 39AD.tmp 93 PID 940 wrote to memory of 5060 940 3A3A.tmp 132 PID 940 wrote to memory of 5060 940 3A3A.tmp 132 PID 940 wrote to memory of 5060 940 3A3A.tmp 132 PID 5060 wrote to memory of 1600 5060 3AC7.tmp 96 PID 5060 wrote to memory of 1600 5060 3AC7.tmp 96 PID 5060 wrote to memory of 1600 5060 3AC7.tmp 96 PID 1600 wrote to memory of 4492 1600 3B24.tmp 97 PID 1600 wrote to memory of 4492 1600 3B24.tmp 97 PID 1600 wrote to memory of 4492 1600 3B24.tmp 97 PID 4492 wrote to memory of 1128 4492 3B92.tmp 98 PID 4492 wrote to memory of 1128 4492 3B92.tmp 98 PID 4492 wrote to memory of 1128 4492 3B92.tmp 98 PID 1128 wrote to memory of 4068 1128 3BFF.tmp 99 PID 1128 wrote to memory of 4068 1128 3BFF.tmp 99 PID 1128 wrote to memory of 4068 1128 3BFF.tmp 99 PID 4068 wrote to memory of 3276 4068 3C5D.tmp 100 PID 4068 wrote to memory of 3276 4068 3C5D.tmp 100 PID 4068 wrote to memory of 3276 4068 3C5D.tmp 100 PID 3276 wrote to memory of 392 3276 3CAB.tmp 101 PID 3276 wrote to memory of 392 3276 3CAB.tmp 101 PID 3276 wrote to memory of 392 3276 3CAB.tmp 101 PID 392 wrote to memory of 4996 392 3D28.tmp 102 PID 392 wrote to memory of 4996 392 3D28.tmp 102 PID 392 wrote to memory of 4996 392 3D28.tmp 102 PID 4996 wrote to memory of 1640 4996 3D86.tmp 103 PID 4996 wrote to memory of 1640 4996 3D86.tmp 103 PID 4996 wrote to memory of 1640 4996 3D86.tmp 103 PID 1640 wrote to memory of 4604 1640 3DF3.tmp 104 PID 1640 wrote to memory of 4604 1640 3DF3.tmp 104 PID 1640 wrote to memory of 4604 1640 3DF3.tmp 104 PID 4604 wrote to memory of 752 4604 3E61.tmp 105 PID 4604 wrote to memory of 752 4604 3E61.tmp 105 PID 4604 wrote to memory of 752 4604 3E61.tmp 105 PID 752 wrote to memory of 2568 752 3EBE.tmp 106 PID 752 wrote to memory of 2568 752 3EBE.tmp 106 PID 752 wrote to memory of 2568 752 3EBE.tmp 106 PID 2568 wrote to memory of 3500 2568 3F5B.tmp 107 PID 2568 wrote to memory of 3500 2568 3F5B.tmp 107 PID 2568 wrote to memory of 3500 2568 3F5B.tmp 107 PID 3500 wrote to memory of 4112 3500 3FB8.tmp 108 PID 3500 wrote to memory of 4112 3500 3FB8.tmp 108 PID 3500 wrote to memory of 4112 3500 3FB8.tmp 108 PID 4112 wrote to memory of 1868 4112 4006.tmp 109 PID 4112 wrote to memory of 1868 4112 4006.tmp 109 PID 4112 wrote to memory of 1868 4112 4006.tmp 109 PID 1868 wrote to memory of 2080 1868 4074.tmp 110 PID 1868 wrote to memory of 2080 1868 4074.tmp 110 PID 1868 wrote to memory of 2080 1868 4074.tmp 110 PID 2080 wrote to memory of 2244 2080 40C2.tmp 111 PID 2080 wrote to memory of 2244 2080 40C2.tmp 111 PID 2080 wrote to memory of 2244 2080 40C2.tmp 111 PID 2244 wrote to memory of 2328 2244 4120.tmp 112 PID 2244 wrote to memory of 2328 2244 4120.tmp 112 PID 2244 wrote to memory of 2328 2244 4120.tmp 112 PID 2328 wrote to memory of 4692 2328 417D.tmp 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_a489034e8a54d22b648618952b1ae11e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-19_a489034e8a54d22b648618952b1ae11e_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\38F2.tmp"C:\Users\Admin\AppData\Local\Temp\38F2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\39AD.tmp"C:\Users\Admin\AppData\Local\Temp\39AD.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\3B24.tmp"C:\Users\Admin\AppData\Local\Temp\3B24.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\3B92.tmp"C:\Users\Admin\AppData\Local\Temp\3B92.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\3CAB.tmp"C:\Users\Admin\AppData\Local\Temp\3CAB.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\3D28.tmp"C:\Users\Admin\AppData\Local\Temp\3D28.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\3D86.tmp"C:\Users\Admin\AppData\Local\Temp\3D86.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\3E61.tmp"C:\Users\Admin\AppData\Local\Temp\3E61.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\4006.tmp"C:\Users\Admin\AppData\Local\Temp\4006.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\4074.tmp"C:\Users\Admin\AppData\Local\Temp\4074.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\40C2.tmp"C:\Users\Admin\AppData\Local\Temp\40C2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\4120.tmp"C:\Users\Admin\AppData\Local\Temp\4120.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\41EB.tmp"C:\Users\Admin\AppData\Local\Temp\41EB.tmp"23⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"24⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"25⤵
- Executes dropped EXE
PID:412 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"26⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"27⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"28⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"29⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\443D.tmp"C:\Users\Admin\AppData\Local\Temp\443D.tmp"30⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\448B.tmp"C:\Users\Admin\AppData\Local\Temp\448B.tmp"31⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"32⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\4565.tmp"C:\Users\Admin\AppData\Local\Temp\4565.tmp"33⤵
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\45D3.tmp"C:\Users\Admin\AppData\Local\Temp\45D3.tmp"34⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"35⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"36⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"37⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"38⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"39⤵
- Executes dropped EXE
PID:900 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"40⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"41⤵
- Executes dropped EXE
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"42⤵
- Executes dropped EXE
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"43⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"44⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"45⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"46⤵
- Executes dropped EXE
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\4A19.tmp"C:\Users\Admin\AppData\Local\Temp\4A19.tmp"47⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"48⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"49⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"50⤵
- Executes dropped EXE
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"51⤵
- Executes dropped EXE
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"52⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"53⤵
- Executes dropped EXE
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"54⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"55⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"56⤵
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"57⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"58⤵
- Executes dropped EXE
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"59⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"60⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"61⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"62⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"63⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"64⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"65⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"66⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"67⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"68⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"69⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"70⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"71⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"72⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"73⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"74⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"75⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"76⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"77⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"78⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"79⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"80⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"81⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"82⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"83⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"84⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"85⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"86⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"87⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"88⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"89⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"90⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"91⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"92⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"93⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"94⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"95⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"96⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"97⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"98⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"99⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"100⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"101⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"102⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"103⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"104⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"105⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"106⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"107⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"108⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"109⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"110⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"111⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"112⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"113⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"114⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"115⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"116⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"117⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"118⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"119⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"120⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"121⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"122⤵PID:4248
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-