Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/04/2024, 20:34
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-09_41a44c00650c48e08f0e574b27122358_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-09_41a44c00650c48e08f0e574b27122358_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-09_41a44c00650c48e08f0e574b27122358_mafia.exe
-
Size
486KB
-
MD5
41a44c00650c48e08f0e574b27122358
-
SHA1
4ae75869bd0a586e27108f41101fed598802c79f
-
SHA256
165a7028bd7f1dd437a54dccb709de7d3000fd5fb3f9b38c7ffaae369296a8dc
-
SHA512
cdf5b5e4c5b7ec13ceab33345ee93269b9f95638f17438ffa664378cc02be0671a3d19a29c46874ea6022d868014f73a579c09e8db9bf5353985c6b31dcb79c9
-
SSDEEP
12288:/U5rCOTeiDXXy5rZ2l3gVqZqESjz6cNZ:/UQOJDXXy5AiuujjN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2892 3028.tmp 4072 3095.tmp 3744 30E3.tmp 1664 3151.tmp 3036 31BE.tmp 2268 322C.tmp 4392 327A.tmp 1660 32D7.tmp 1412 3326.tmp 4952 3374.tmp 4532 33C2.tmp 2680 3410.tmp 4540 347D.tmp 468 34CB.tmp 980 351A.tmp 5056 3568.tmp 2852 35C5.tmp 892 3614.tmp 976 3671.tmp 4524 36BF.tmp 4608 370E.tmp 2100 377B.tmp 4720 37D9.tmp 3836 3836.tmp 1696 38B3.tmp 1004 3921.tmp 552 397F.tmp 1360 39CD.tmp 60 3A1B.tmp 3640 3A69.tmp 4020 3AB7.tmp 392 3B05.tmp 3588 3B63.tmp 4824 3BB1.tmp 2192 3BFF.tmp 3872 3C4D.tmp 4932 3C9B.tmp 4520 3CEA.tmp 1556 3D38.tmp 5104 3D86.tmp 3736 3DE4.tmp 4480 3E41.tmp 1508 3E8F.tmp 8 3EDE.tmp 4828 3F2C.tmp 1612 3F7A.tmp 3528 3FB8.tmp 1664 4006.tmp 5096 4045.tmp 4592 4093.tmp 2304 40E1.tmp 3676 412F.tmp 1660 417D.tmp 3632 41CC.tmp 1560 421A.tmp 3808 4268.tmp 1832 42B6.tmp 3692 4304.tmp 4724 4352.tmp 1332 43A0.tmp 3804 43EE.tmp 4888 443D.tmp 2780 448B.tmp 4792 44D9.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3268 wrote to memory of 2892 3268 2024-04-09_41a44c00650c48e08f0e574b27122358_mafia.exe 89 PID 3268 wrote to memory of 2892 3268 2024-04-09_41a44c00650c48e08f0e574b27122358_mafia.exe 89 PID 3268 wrote to memory of 2892 3268 2024-04-09_41a44c00650c48e08f0e574b27122358_mafia.exe 89 PID 2892 wrote to memory of 4072 2892 3028.tmp 90 PID 2892 wrote to memory of 4072 2892 3028.tmp 90 PID 2892 wrote to memory of 4072 2892 3028.tmp 90 PID 4072 wrote to memory of 3744 4072 3095.tmp 91 PID 4072 wrote to memory of 3744 4072 3095.tmp 91 PID 4072 wrote to memory of 3744 4072 3095.tmp 91 PID 3744 wrote to memory of 1664 3744 30E3.tmp 140 PID 3744 wrote to memory of 1664 3744 30E3.tmp 140 PID 3744 wrote to memory of 1664 3744 30E3.tmp 140 PID 1664 wrote to memory of 3036 1664 3151.tmp 93 PID 1664 wrote to memory of 3036 1664 3151.tmp 93 PID 1664 wrote to memory of 3036 1664 3151.tmp 93 PID 3036 wrote to memory of 2268 3036 31BE.tmp 94 PID 3036 wrote to memory of 2268 3036 31BE.tmp 94 PID 3036 wrote to memory of 2268 3036 31BE.tmp 94 PID 2268 wrote to memory of 4392 2268 322C.tmp 95 PID 2268 wrote to memory of 4392 2268 322C.tmp 95 PID 2268 wrote to memory of 4392 2268 322C.tmp 95 PID 4392 wrote to memory of 1660 4392 327A.tmp 145 PID 4392 wrote to memory of 1660 4392 327A.tmp 145 PID 4392 wrote to memory of 1660 4392 327A.tmp 145 PID 1660 wrote to memory of 1412 1660 32D7.tmp 97 PID 1660 wrote to memory of 1412 1660 32D7.tmp 97 PID 1660 wrote to memory of 1412 1660 32D7.tmp 97 PID 1412 wrote to memory of 4952 1412 3326.tmp 98 PID 1412 wrote to memory of 4952 1412 3326.tmp 98 PID 1412 wrote to memory of 4952 1412 3326.tmp 98 PID 4952 wrote to memory of 4532 4952 3374.tmp 99 PID 4952 wrote to memory of 4532 4952 3374.tmp 99 PID 4952 wrote to memory of 4532 4952 3374.tmp 99 PID 4532 wrote to memory of 2680 4532 33C2.tmp 100 PID 4532 wrote to memory of 2680 4532 33C2.tmp 100 PID 4532 wrote to memory of 2680 4532 33C2.tmp 100 PID 2680 wrote to memory of 4540 2680 3410.tmp 101 PID 2680 wrote to memory of 4540 2680 3410.tmp 101 PID 2680 wrote to memory of 4540 2680 3410.tmp 101 PID 4540 wrote to memory of 468 4540 347D.tmp 102 PID 4540 wrote to memory of 468 4540 347D.tmp 102 PID 4540 wrote to memory of 468 4540 347D.tmp 102 PID 468 wrote to memory of 980 468 34CB.tmp 103 PID 468 wrote to memory of 980 468 34CB.tmp 103 PID 468 wrote to memory of 980 468 34CB.tmp 103 PID 980 wrote to memory of 5056 980 351A.tmp 104 PID 980 wrote to memory of 5056 980 351A.tmp 104 PID 980 wrote to memory of 5056 980 351A.tmp 104 PID 5056 wrote to memory of 2852 5056 3568.tmp 157 PID 5056 wrote to memory of 2852 5056 3568.tmp 157 PID 5056 wrote to memory of 2852 5056 3568.tmp 157 PID 2852 wrote to memory of 892 2852 35C5.tmp 106 PID 2852 wrote to memory of 892 2852 35C5.tmp 106 PID 2852 wrote to memory of 892 2852 35C5.tmp 106 PID 892 wrote to memory of 976 892 3614.tmp 107 PID 892 wrote to memory of 976 892 3614.tmp 107 PID 892 wrote to memory of 976 892 3614.tmp 107 PID 976 wrote to memory of 4524 976 3671.tmp 108 PID 976 wrote to memory of 4524 976 3671.tmp 108 PID 976 wrote to memory of 4524 976 3671.tmp 108 PID 4524 wrote to memory of 4608 4524 36BF.tmp 162 PID 4524 wrote to memory of 4608 4524 36BF.tmp 162 PID 4524 wrote to memory of 4608 4524 36BF.tmp 162 PID 4608 wrote to memory of 2100 4608 370E.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-09_41a44c00650c48e08f0e574b27122358_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-09_41a44c00650c48e08f0e574b27122358_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\3028.tmp"C:\Users\Admin\AppData\Local\Temp\3028.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\3095.tmp"C:\Users\Admin\AppData\Local\Temp\3095.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\30E3.tmp"C:\Users\Admin\AppData\Local\Temp\30E3.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\3151.tmp"C:\Users\Admin\AppData\Local\Temp\3151.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\31BE.tmp"C:\Users\Admin\AppData\Local\Temp\31BE.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\322C.tmp"C:\Users\Admin\AppData\Local\Temp\322C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\327A.tmp"C:\Users\Admin\AppData\Local\Temp\327A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\32D7.tmp"C:\Users\Admin\AppData\Local\Temp\32D7.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\3326.tmp"C:\Users\Admin\AppData\Local\Temp\3326.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\3374.tmp"C:\Users\Admin\AppData\Local\Temp\3374.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\33C2.tmp"C:\Users\Admin\AppData\Local\Temp\33C2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\3410.tmp"C:\Users\Admin\AppData\Local\Temp\3410.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\347D.tmp"C:\Users\Admin\AppData\Local\Temp\347D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\34CB.tmp"C:\Users\Admin\AppData\Local\Temp\34CB.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\351A.tmp"C:\Users\Admin\AppData\Local\Temp\351A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\3568.tmp"C:\Users\Admin\AppData\Local\Temp\3568.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\35C5.tmp"C:\Users\Admin\AppData\Local\Temp\35C5.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\3614.tmp"C:\Users\Admin\AppData\Local\Temp\3614.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Users\Admin\AppData\Local\Temp\3671.tmp"C:\Users\Admin\AppData\Local\Temp\3671.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Local\Temp\36BF.tmp"C:\Users\Admin\AppData\Local\Temp\36BF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\370E.tmp"C:\Users\Admin\AppData\Local\Temp\370E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\377B.tmp"C:\Users\Admin\AppData\Local\Temp\377B.tmp"23⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\37D9.tmp"C:\Users\Admin\AppData\Local\Temp\37D9.tmp"24⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\3836.tmp"C:\Users\Admin\AppData\Local\Temp\3836.tmp"25⤵
- Executes dropped EXE
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\38B3.tmp"C:\Users\Admin\AppData\Local\Temp\38B3.tmp"26⤵
- Executes dropped EXE
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\3921.tmp"C:\Users\Admin\AppData\Local\Temp\3921.tmp"27⤵
- Executes dropped EXE
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\397F.tmp"C:\Users\Admin\AppData\Local\Temp\397F.tmp"28⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\39CD.tmp"C:\Users\Admin\AppData\Local\Temp\39CD.tmp"29⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\3A1B.tmp"C:\Users\Admin\AppData\Local\Temp\3A1B.tmp"30⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\3A69.tmp"C:\Users\Admin\AppData\Local\Temp\3A69.tmp"31⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"32⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\3B05.tmp"C:\Users\Admin\AppData\Local\Temp\3B05.tmp"33⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\3B63.tmp"C:\Users\Admin\AppData\Local\Temp\3B63.tmp"34⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\3BB1.tmp"C:\Users\Admin\AppData\Local\Temp\3BB1.tmp"35⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"36⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"37⤵
- Executes dropped EXE
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"38⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"39⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\3D38.tmp"C:\Users\Admin\AppData\Local\Temp\3D38.tmp"40⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\3D86.tmp"C:\Users\Admin\AppData\Local\Temp\3D86.tmp"41⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"42⤵
- Executes dropped EXE
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\3E41.tmp"C:\Users\Admin\AppData\Local\Temp\3E41.tmp"43⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"44⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"45⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"46⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"47⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"48⤵
- Executes dropped EXE
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\4006.tmp"C:\Users\Admin\AppData\Local\Temp\4006.tmp"49⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\4045.tmp"C:\Users\Admin\AppData\Local\Temp\4045.tmp"50⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\4093.tmp"C:\Users\Admin\AppData\Local\Temp\4093.tmp"51⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\40E1.tmp"C:\Users\Admin\AppData\Local\Temp\40E1.tmp"52⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\412F.tmp"C:\Users\Admin\AppData\Local\Temp\412F.tmp"53⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"54⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"55⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\421A.tmp"C:\Users\Admin\AppData\Local\Temp\421A.tmp"56⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\4268.tmp"C:\Users\Admin\AppData\Local\Temp\4268.tmp"57⤵
- Executes dropped EXE
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\42B6.tmp"C:\Users\Admin\AppData\Local\Temp\42B6.tmp"58⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\4304.tmp"C:\Users\Admin\AppData\Local\Temp\4304.tmp"59⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\4352.tmp"C:\Users\Admin\AppData\Local\Temp\4352.tmp"60⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"61⤵
- Executes dropped EXE
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"62⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\443D.tmp"C:\Users\Admin\AppData\Local\Temp\443D.tmp"63⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\448B.tmp"C:\Users\Admin\AppData\Local\Temp\448B.tmp"64⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"65⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"66⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"67⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\4602.tmp"C:\Users\Admin\AppData\Local\Temp\4602.tmp"68⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"69⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"70⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"71⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"72⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"73⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"74⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"75⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"76⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"77⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"78⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"79⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"80⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"81⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"82⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"83⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"84⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"85⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"86⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"87⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"88⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"89⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"90⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"91⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"92⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"93⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"94⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"95⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"96⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"97⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"98⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"99⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"100⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"101⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"102⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"103⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"104⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"105⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"106⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"107⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"108⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"109⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"110⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"111⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"112⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"113⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"114⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"115⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"116⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"117⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"118⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"119⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"120⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"121⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"122⤵PID:1520
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-