Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/04/2024, 14:44
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-05_7d4ff9aa59fe129005e7068f368abdd0_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-05_7d4ff9aa59fe129005e7068f368abdd0_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-05_7d4ff9aa59fe129005e7068f368abdd0_mafia.exe
-
Size
488KB
-
MD5
7d4ff9aa59fe129005e7068f368abdd0
-
SHA1
c12d9e2c8ab81e439e3e5decef49430aaf8335f8
-
SHA256
995b77fddb28035e29e48e8417ac6298fde721e9a33e2abc61500d35363c3e42
-
SHA512
3e47a8265b94d78549228cf8a71ff80ae08a1f9ea0822fb8ca62cb3dfd018b3b462b1898b7c6766dd63a4667f36006797c9832561165fb1f1d60d2a1d8dd0ac1
-
SSDEEP
12288:/U5rCOTeiDBaUyGCdbZDi676eTVK4sUNZ:/UQOJDTyGCVMetsUN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1308 2E63.tmp 5072 2EC1.tmp 5112 2F0F.tmp 1196 2F5D.tmp 4240 2FDA.tmp 680 3028.tmp 4076 3076.tmp 4772 30C4.tmp 4436 3122.tmp 4908 3170.tmp 1640 31BE.tmp 4488 320C.tmp 3476 326A.tmp 2068 32C8.tmp 3000 3316.tmp 2872 3374.tmp 4152 3400.tmp 2504 347D.tmp 2904 34FA.tmp 1292 3558.tmp 1932 35D5.tmp 1000 3633.tmp 4888 3691.tmp 2544 36FE.tmp 3692 375C.tmp 4536 37AA.tmp 2696 3817.tmp 4500 3885.tmp 3584 38F2.tmp 3512 395F.tmp 3316 39BD.tmp 4180 3A2A.tmp 3704 3A79.tmp 876 3AC7.tmp 3620 3B24.tmp 4348 3B82.tmp 4288 3BE0.tmp 4872 3C2E.tmp 3744 3C8C.tmp 3700 3CEA.tmp 1992 3D38.tmp 4452 3D86.tmp 4940 3DE4.tmp 520 3E32.tmp 4676 3E80.tmp 4312 3ECE.tmp 1308 3F1C.tmp 5072 3F6A.tmp 1792 3FC8.tmp 3004 4016.tmp 3776 4074.tmp 1440 40C2.tmp 3312 4120.tmp 1816 416E.tmp 844 41BC.tmp 3340 41FA.tmp 4488 4249.tmp 3148 4297.tmp 448 42E5.tmp 2200 4343.tmp 3000 4391.tmp 1456 43DF.tmp 488 443D.tmp 384 448B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4676 wrote to memory of 1308 4676 2024-04-05_7d4ff9aa59fe129005e7068f368abdd0_mafia.exe 88 PID 4676 wrote to memory of 1308 4676 2024-04-05_7d4ff9aa59fe129005e7068f368abdd0_mafia.exe 88 PID 4676 wrote to memory of 1308 4676 2024-04-05_7d4ff9aa59fe129005e7068f368abdd0_mafia.exe 88 PID 1308 wrote to memory of 5072 1308 2E63.tmp 90 PID 1308 wrote to memory of 5072 1308 2E63.tmp 90 PID 1308 wrote to memory of 5072 1308 2E63.tmp 90 PID 5072 wrote to memory of 5112 5072 2EC1.tmp 91 PID 5072 wrote to memory of 5112 5072 2EC1.tmp 91 PID 5072 wrote to memory of 5112 5072 2EC1.tmp 91 PID 5112 wrote to memory of 1196 5112 2F0F.tmp 92 PID 5112 wrote to memory of 1196 5112 2F0F.tmp 92 PID 5112 wrote to memory of 1196 5112 2F0F.tmp 92 PID 1196 wrote to memory of 4240 1196 2F5D.tmp 93 PID 1196 wrote to memory of 4240 1196 2F5D.tmp 93 PID 1196 wrote to memory of 4240 1196 2F5D.tmp 93 PID 4240 wrote to memory of 680 4240 2FDA.tmp 94 PID 4240 wrote to memory of 680 4240 2FDA.tmp 94 PID 4240 wrote to memory of 680 4240 2FDA.tmp 94 PID 680 wrote to memory of 4076 680 3028.tmp 95 PID 680 wrote to memory of 4076 680 3028.tmp 95 PID 680 wrote to memory of 4076 680 3028.tmp 95 PID 4076 wrote to memory of 4772 4076 3076.tmp 96 PID 4076 wrote to memory of 4772 4076 3076.tmp 96 PID 4076 wrote to memory of 4772 4076 3076.tmp 96 PID 4772 wrote to memory of 4436 4772 30C4.tmp 97 PID 4772 wrote to memory of 4436 4772 30C4.tmp 97 PID 4772 wrote to memory of 4436 4772 30C4.tmp 97 PID 4436 wrote to memory of 4908 4436 3122.tmp 98 PID 4436 wrote to memory of 4908 4436 3122.tmp 98 PID 4436 wrote to memory of 4908 4436 3122.tmp 98 PID 4908 wrote to memory of 1640 4908 3170.tmp 99 PID 4908 wrote to memory of 1640 4908 3170.tmp 99 PID 4908 wrote to memory of 1640 4908 3170.tmp 99 PID 1640 wrote to memory of 4488 1640 31BE.tmp 100 PID 1640 wrote to memory of 4488 1640 31BE.tmp 100 PID 1640 wrote to memory of 4488 1640 31BE.tmp 100 PID 4488 wrote to memory of 3476 4488 320C.tmp 101 PID 4488 wrote to memory of 3476 4488 320C.tmp 101 PID 4488 wrote to memory of 3476 4488 320C.tmp 101 PID 3476 wrote to memory of 2068 3476 326A.tmp 102 PID 3476 wrote to memory of 2068 3476 326A.tmp 102 PID 3476 wrote to memory of 2068 3476 326A.tmp 102 PID 2068 wrote to memory of 3000 2068 32C8.tmp 103 PID 2068 wrote to memory of 3000 2068 32C8.tmp 103 PID 2068 wrote to memory of 3000 2068 32C8.tmp 103 PID 3000 wrote to memory of 2872 3000 3316.tmp 104 PID 3000 wrote to memory of 2872 3000 3316.tmp 104 PID 3000 wrote to memory of 2872 3000 3316.tmp 104 PID 2872 wrote to memory of 4152 2872 3374.tmp 105 PID 2872 wrote to memory of 4152 2872 3374.tmp 105 PID 2872 wrote to memory of 4152 2872 3374.tmp 105 PID 4152 wrote to memory of 2504 4152 3400.tmp 106 PID 4152 wrote to memory of 2504 4152 3400.tmp 106 PID 4152 wrote to memory of 2504 4152 3400.tmp 106 PID 2504 wrote to memory of 2904 2504 347D.tmp 107 PID 2504 wrote to memory of 2904 2504 347D.tmp 107 PID 2504 wrote to memory of 2904 2504 347D.tmp 107 PID 2904 wrote to memory of 1292 2904 34FA.tmp 108 PID 2904 wrote to memory of 1292 2904 34FA.tmp 108 PID 2904 wrote to memory of 1292 2904 34FA.tmp 108 PID 1292 wrote to memory of 1932 1292 3558.tmp 109 PID 1292 wrote to memory of 1932 1292 3558.tmp 109 PID 1292 wrote to memory of 1932 1292 3558.tmp 109 PID 1932 wrote to memory of 1000 1932 35D5.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_7d4ff9aa59fe129005e7068f368abdd0_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-05_7d4ff9aa59fe129005e7068f368abdd0_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\2E63.tmp"C:\Users\Admin\AppData\Local\Temp\2E63.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\2EC1.tmp"C:\Users\Admin\AppData\Local\Temp\2EC1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\2F0F.tmp"C:\Users\Admin\AppData\Local\Temp\2F0F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\2F5D.tmp"C:\Users\Admin\AppData\Local\Temp\2F5D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\2FDA.tmp"C:\Users\Admin\AppData\Local\Temp\2FDA.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\3028.tmp"C:\Users\Admin\AppData\Local\Temp\3028.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\3076.tmp"C:\Users\Admin\AppData\Local\Temp\3076.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\30C4.tmp"C:\Users\Admin\AppData\Local\Temp\30C4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\3122.tmp"C:\Users\Admin\AppData\Local\Temp\3122.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\3170.tmp"C:\Users\Admin\AppData\Local\Temp\3170.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\31BE.tmp"C:\Users\Admin\AppData\Local\Temp\31BE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\320C.tmp"C:\Users\Admin\AppData\Local\Temp\320C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\326A.tmp"C:\Users\Admin\AppData\Local\Temp\326A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\32C8.tmp"C:\Users\Admin\AppData\Local\Temp\32C8.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\3316.tmp"C:\Users\Admin\AppData\Local\Temp\3316.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\3374.tmp"C:\Users\Admin\AppData\Local\Temp\3374.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\3400.tmp"C:\Users\Admin\AppData\Local\Temp\3400.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\347D.tmp"C:\Users\Admin\AppData\Local\Temp\347D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\34FA.tmp"C:\Users\Admin\AppData\Local\Temp\34FA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\3558.tmp"C:\Users\Admin\AppData\Local\Temp\3558.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\35D5.tmp"C:\Users\Admin\AppData\Local\Temp\35D5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\3633.tmp"C:\Users\Admin\AppData\Local\Temp\3633.tmp"23⤵
- Executes dropped EXE
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\3691.tmp"C:\Users\Admin\AppData\Local\Temp\3691.tmp"24⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\36FE.tmp"C:\Users\Admin\AppData\Local\Temp\36FE.tmp"25⤵
- Executes dropped EXE
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\375C.tmp"C:\Users\Admin\AppData\Local\Temp\375C.tmp"26⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\37AA.tmp"C:\Users\Admin\AppData\Local\Temp\37AA.tmp"27⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\3817.tmp"C:\Users\Admin\AppData\Local\Temp\3817.tmp"28⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\3885.tmp"C:\Users\Admin\AppData\Local\Temp\3885.tmp"29⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\38F2.tmp"C:\Users\Admin\AppData\Local\Temp\38F2.tmp"30⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\395F.tmp"C:\Users\Admin\AppData\Local\Temp\395F.tmp"31⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\39BD.tmp"C:\Users\Admin\AppData\Local\Temp\39BD.tmp"32⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"33⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\3A79.tmp"C:\Users\Admin\AppData\Local\Temp\3A79.tmp"34⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"35⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\3B24.tmp"C:\Users\Admin\AppData\Local\Temp\3B24.tmp"36⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\3B82.tmp"C:\Users\Admin\AppData\Local\Temp\3B82.tmp"37⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"38⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"39⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"40⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"41⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\3D38.tmp"C:\Users\Admin\AppData\Local\Temp\3D38.tmp"42⤵
- Executes dropped EXE
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\3D86.tmp"C:\Users\Admin\AppData\Local\Temp\3D86.tmp"43⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"44⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\3E32.tmp"C:\Users\Admin\AppData\Local\Temp\3E32.tmp"45⤵
- Executes dropped EXE
PID:520 -
C:\Users\Admin\AppData\Local\Temp\3E80.tmp"C:\Users\Admin\AppData\Local\Temp\3E80.tmp"46⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"47⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"48⤵
- Executes dropped EXE
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"49⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"50⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\4016.tmp"C:\Users\Admin\AppData\Local\Temp\4016.tmp"51⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\4074.tmp"C:\Users\Admin\AppData\Local\Temp\4074.tmp"52⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\40C2.tmp"C:\Users\Admin\AppData\Local\Temp\40C2.tmp"53⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\4120.tmp"C:\Users\Admin\AppData\Local\Temp\4120.tmp"54⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\416E.tmp"C:\Users\Admin\AppData\Local\Temp\416E.tmp"55⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\41BC.tmp"C:\Users\Admin\AppData\Local\Temp\41BC.tmp"56⤵
- Executes dropped EXE
PID:844 -
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"57⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"58⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"59⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"60⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"61⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"62⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"63⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\443D.tmp"C:\Users\Admin\AppData\Local\Temp\443D.tmp"64⤵
- Executes dropped EXE
PID:488 -
C:\Users\Admin\AppData\Local\Temp\448B.tmp"C:\Users\Admin\AppData\Local\Temp\448B.tmp"65⤵
- Executes dropped EXE
PID:384 -
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"66⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"67⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"68⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"69⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"70⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"71⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"72⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"73⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"74⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"75⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"76⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"77⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"78⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"79⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"80⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"81⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"82⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"83⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"84⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"85⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"86⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"87⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"88⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"89⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"90⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"91⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"92⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"93⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"94⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"95⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"96⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"97⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"98⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"99⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"100⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"101⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"102⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"103⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"104⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"105⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"106⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"107⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"108⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"109⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"110⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"111⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"112⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"113⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"114⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"115⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"116⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"117⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"118⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"119⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"120⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"121⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"122⤵PID:4624
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-