Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/04/2024, 11:47
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-09_c519862d29d991c54de6b9bf5e8d49dd_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-09_c519862d29d991c54de6b9bf5e8d49dd_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-09_c519862d29d991c54de6b9bf5e8d49dd_mafia.exe
-
Size
488KB
-
MD5
c519862d29d991c54de6b9bf5e8d49dd
-
SHA1
9f82b547d3ebe5827b4963ff9d0188b461336516
-
SHA256
e92f0565e3df6d51cafa548b53622b256613eb211e739a5c61370f45fd7a6afb
-
SHA512
9d766d0cc86673be30cf9b19374864b6175a068dc32d9535335d0bdf5ab108d8900e277f5a7464baca832fba0d0c786e7f6b3359806b8f5bbbaec0b952e78a88
-
SSDEEP
12288:/U5rCOTeiD5uqp6ugQ8AdTpSl6bYEEMNZ:/UQOJD5npb4AdJbFN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3392 2EFF.tmp 2548 2F5D.tmp 1612 2FCA.tmp 3692 3038.tmp 640 3086.tmp 3892 30D4.tmp 368 3122.tmp 3732 3170.tmp 4760 31BE.tmp 404 320C.tmp 3764 325A.tmp 4912 32B8.tmp 952 3316.tmp 696 3364.tmp 3676 33C2.tmp 4528 3420.tmp 2824 346E.tmp 5024 34BC.tmp 3832 350A.tmp 548 3568.tmp 4556 35B6.tmp 1816 3614.tmp 1320 3671.tmp 1964 36BF.tmp 3376 371D.tmp 2488 376B.tmp 1556 37C9.tmp 3252 3817.tmp 3700 3894.tmp 2060 38E2.tmp 3044 3940.tmp 2520 398E.tmp 4104 39EC.tmp 1776 3A3A.tmp 4656 3A88.tmp 4484 3AD6.tmp 3132 3B24.tmp 4440 3B82.tmp 2564 3BE0.tmp 3012 3C2E.tmp 4924 3C7C.tmp 3084 3CCA.tmp 116 3D18.tmp 3488 3D67.tmp 1092 3DD4.tmp 1604 3E41.tmp 4140 3EAF.tmp 3228 3F2C.tmp 2592 3F7A.tmp 5020 4026.tmp 4976 4074.tmp 3120 40C2.tmp 4848 4120.tmp 4884 416E.tmp 632 41BC.tmp 8 4229.tmp 3544 4287.tmp 1376 42D5.tmp 3236 4333.tmp 3100 4381.tmp 1296 43DF.tmp 4536 442D.tmp 2904 448B.tmp 1100 44D9.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3084 wrote to memory of 3392 3084 2024-04-09_c519862d29d991c54de6b9bf5e8d49dd_mafia.exe 87 PID 3084 wrote to memory of 3392 3084 2024-04-09_c519862d29d991c54de6b9bf5e8d49dd_mafia.exe 87 PID 3084 wrote to memory of 3392 3084 2024-04-09_c519862d29d991c54de6b9bf5e8d49dd_mafia.exe 87 PID 3392 wrote to memory of 2548 3392 2EFF.tmp 89 PID 3392 wrote to memory of 2548 3392 2EFF.tmp 89 PID 3392 wrote to memory of 2548 3392 2EFF.tmp 89 PID 2548 wrote to memory of 1612 2548 2F5D.tmp 90 PID 2548 wrote to memory of 1612 2548 2F5D.tmp 90 PID 2548 wrote to memory of 1612 2548 2F5D.tmp 90 PID 1612 wrote to memory of 3692 1612 2FCA.tmp 92 PID 1612 wrote to memory of 3692 1612 2FCA.tmp 92 PID 1612 wrote to memory of 3692 1612 2FCA.tmp 92 PID 3692 wrote to memory of 640 3692 3038.tmp 93 PID 3692 wrote to memory of 640 3692 3038.tmp 93 PID 3692 wrote to memory of 640 3692 3038.tmp 93 PID 640 wrote to memory of 3892 640 3086.tmp 94 PID 640 wrote to memory of 3892 640 3086.tmp 94 PID 640 wrote to memory of 3892 640 3086.tmp 94 PID 3892 wrote to memory of 368 3892 30D4.tmp 95 PID 3892 wrote to memory of 368 3892 30D4.tmp 95 PID 3892 wrote to memory of 368 3892 30D4.tmp 95 PID 368 wrote to memory of 3732 368 3122.tmp 96 PID 368 wrote to memory of 3732 368 3122.tmp 96 PID 368 wrote to memory of 3732 368 3122.tmp 96 PID 3732 wrote to memory of 4760 3732 3170.tmp 97 PID 3732 wrote to memory of 4760 3732 3170.tmp 97 PID 3732 wrote to memory of 4760 3732 3170.tmp 97 PID 4760 wrote to memory of 404 4760 31BE.tmp 98 PID 4760 wrote to memory of 404 4760 31BE.tmp 98 PID 4760 wrote to memory of 404 4760 31BE.tmp 98 PID 404 wrote to memory of 3764 404 320C.tmp 99 PID 404 wrote to memory of 3764 404 320C.tmp 99 PID 404 wrote to memory of 3764 404 320C.tmp 99 PID 3764 wrote to memory of 4912 3764 325A.tmp 100 PID 3764 wrote to memory of 4912 3764 325A.tmp 100 PID 3764 wrote to memory of 4912 3764 325A.tmp 100 PID 4912 wrote to memory of 952 4912 32B8.tmp 101 PID 4912 wrote to memory of 952 4912 32B8.tmp 101 PID 4912 wrote to memory of 952 4912 32B8.tmp 101 PID 952 wrote to memory of 696 952 3316.tmp 102 PID 952 wrote to memory of 696 952 3316.tmp 102 PID 952 wrote to memory of 696 952 3316.tmp 102 PID 696 wrote to memory of 3676 696 3364.tmp 103 PID 696 wrote to memory of 3676 696 3364.tmp 103 PID 696 wrote to memory of 3676 696 3364.tmp 103 PID 3676 wrote to memory of 4528 3676 33C2.tmp 104 PID 3676 wrote to memory of 4528 3676 33C2.tmp 104 PID 3676 wrote to memory of 4528 3676 33C2.tmp 104 PID 4528 wrote to memory of 2824 4528 3420.tmp 105 PID 4528 wrote to memory of 2824 4528 3420.tmp 105 PID 4528 wrote to memory of 2824 4528 3420.tmp 105 PID 2824 wrote to memory of 5024 2824 346E.tmp 106 PID 2824 wrote to memory of 5024 2824 346E.tmp 106 PID 2824 wrote to memory of 5024 2824 346E.tmp 106 PID 5024 wrote to memory of 3832 5024 34BC.tmp 107 PID 5024 wrote to memory of 3832 5024 34BC.tmp 107 PID 5024 wrote to memory of 3832 5024 34BC.tmp 107 PID 3832 wrote to memory of 548 3832 350A.tmp 108 PID 3832 wrote to memory of 548 3832 350A.tmp 108 PID 3832 wrote to memory of 548 3832 350A.tmp 108 PID 548 wrote to memory of 4556 548 3568.tmp 109 PID 548 wrote to memory of 4556 548 3568.tmp 109 PID 548 wrote to memory of 4556 548 3568.tmp 109 PID 4556 wrote to memory of 1816 4556 35B6.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-09_c519862d29d991c54de6b9bf5e8d49dd_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-09_c519862d29d991c54de6b9bf5e8d49dd_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\2EFF.tmp"C:\Users\Admin\AppData\Local\Temp\2EFF.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\2F5D.tmp"C:\Users\Admin\AppData\Local\Temp\2F5D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\2FCA.tmp"C:\Users\Admin\AppData\Local\Temp\2FCA.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\3038.tmp"C:\Users\Admin\AppData\Local\Temp\3038.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\3086.tmp"C:\Users\Admin\AppData\Local\Temp\3086.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\30D4.tmp"C:\Users\Admin\AppData\Local\Temp\30D4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\3122.tmp"C:\Users\Admin\AppData\Local\Temp\3122.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\3170.tmp"C:\Users\Admin\AppData\Local\Temp\3170.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\31BE.tmp"C:\Users\Admin\AppData\Local\Temp\31BE.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\320C.tmp"C:\Users\Admin\AppData\Local\Temp\320C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\325A.tmp"C:\Users\Admin\AppData\Local\Temp\325A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\32B8.tmp"C:\Users\Admin\AppData\Local\Temp\32B8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\3316.tmp"C:\Users\Admin\AppData\Local\Temp\3316.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Temp\3364.tmp"C:\Users\Admin\AppData\Local\Temp\3364.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\AppData\Local\Temp\33C2.tmp"C:\Users\Admin\AppData\Local\Temp\33C2.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\3420.tmp"C:\Users\Admin\AppData\Local\Temp\3420.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\346E.tmp"C:\Users\Admin\AppData\Local\Temp\346E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\34BC.tmp"C:\Users\Admin\AppData\Local\Temp\34BC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\350A.tmp"C:\Users\Admin\AppData\Local\Temp\350A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\3568.tmp"C:\Users\Admin\AppData\Local\Temp\3568.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\35B6.tmp"C:\Users\Admin\AppData\Local\Temp\35B6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\3614.tmp"C:\Users\Admin\AppData\Local\Temp\3614.tmp"23⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\3671.tmp"C:\Users\Admin\AppData\Local\Temp\3671.tmp"24⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\36BF.tmp"C:\Users\Admin\AppData\Local\Temp\36BF.tmp"25⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\371D.tmp"C:\Users\Admin\AppData\Local\Temp\371D.tmp"26⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\376B.tmp"C:\Users\Admin\AppData\Local\Temp\376B.tmp"27⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\37C9.tmp"C:\Users\Admin\AppData\Local\Temp\37C9.tmp"28⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\3817.tmp"C:\Users\Admin\AppData\Local\Temp\3817.tmp"29⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\3894.tmp"C:\Users\Admin\AppData\Local\Temp\3894.tmp"30⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\38E2.tmp"C:\Users\Admin\AppData\Local\Temp\38E2.tmp"31⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\3940.tmp"C:\Users\Admin\AppData\Local\Temp\3940.tmp"32⤵
- Executes dropped EXE
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\398E.tmp"C:\Users\Admin\AppData\Local\Temp\398E.tmp"33⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\39EC.tmp"C:\Users\Admin\AppData\Local\Temp\39EC.tmp"34⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"35⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\3A88.tmp"C:\Users\Admin\AppData\Local\Temp\3A88.tmp"36⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"37⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\3B24.tmp"C:\Users\Admin\AppData\Local\Temp\3B24.tmp"38⤵
- Executes dropped EXE
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\3B82.tmp"C:\Users\Admin\AppData\Local\Temp\3B82.tmp"39⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"40⤵
- Executes dropped EXE
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"41⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"42⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"43⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\3D18.tmp"C:\Users\Admin\AppData\Local\Temp\3D18.tmp"44⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\3D67.tmp"C:\Users\Admin\AppData\Local\Temp\3D67.tmp"45⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"46⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\3E41.tmp"C:\Users\Admin\AppData\Local\Temp\3E41.tmp"47⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\3EAF.tmp"C:\Users\Admin\AppData\Local\Temp\3EAF.tmp"48⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"49⤵
- Executes dropped EXE
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"50⤵
- Executes dropped EXE
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\4026.tmp"C:\Users\Admin\AppData\Local\Temp\4026.tmp"51⤵
- Executes dropped EXE
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\4074.tmp"C:\Users\Admin\AppData\Local\Temp\4074.tmp"52⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\40C2.tmp"C:\Users\Admin\AppData\Local\Temp\40C2.tmp"53⤵
- Executes dropped EXE
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\4120.tmp"C:\Users\Admin\AppData\Local\Temp\4120.tmp"54⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\416E.tmp"C:\Users\Admin\AppData\Local\Temp\416E.tmp"55⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\41BC.tmp"C:\Users\Admin\AppData\Local\Temp\41BC.tmp"56⤵
- Executes dropped EXE
PID:632 -
C:\Users\Admin\AppData\Local\Temp\4229.tmp"C:\Users\Admin\AppData\Local\Temp\4229.tmp"57⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\4287.tmp"C:\Users\Admin\AppData\Local\Temp\4287.tmp"58⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"59⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"60⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"61⤵
- Executes dropped EXE
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"62⤵
- Executes dropped EXE
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"63⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\448B.tmp"C:\Users\Admin\AppData\Local\Temp\448B.tmp"64⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"65⤵
- Executes dropped EXE
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"66⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"67⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"68⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"69⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"70⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"71⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"72⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"73⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"74⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"75⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"76⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"77⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"78⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"79⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"80⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"81⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"82⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"83⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"84⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"85⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"86⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"87⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"88⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"89⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"90⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"91⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"92⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"93⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"94⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"95⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"96⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"97⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"98⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"99⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"100⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"101⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"102⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"103⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"104⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"105⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"106⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"107⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"108⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"109⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"110⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"111⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"112⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"113⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"114⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"115⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"116⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"117⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"118⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"119⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"120⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"121⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"122⤵PID:4728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-