Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
15/04/2024, 10:15
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-15_d5cd8d5d38de0c1dc43c7eeb87813dea_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-15_d5cd8d5d38de0c1dc43c7eeb87813dea_mafia.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-15_d5cd8d5d38de0c1dc43c7eeb87813dea_mafia.exe
-
Size
487KB
-
MD5
d5cd8d5d38de0c1dc43c7eeb87813dea
-
SHA1
9f3ea091169ab425f2f0b0dd2ceff85216be88e0
-
SHA256
ab60ba9992ae9d86bc8b4c5b81cb057bdd64961ba3fc91f9c6c59a9faae6fe15
-
SHA512
71999530d881b0d99359c4beb29aa575e09cb18e0ea7efd521372f86a7fbe7de208db12c1feb2d89d22dd22eccbabbff3c36286ab12d95d74a5529eff0efa0a1
-
SSDEEP
6144:qorf3lPvovsgZnqG2C7mOTeiL9DUFdA4AVp2jc6XeJNXWAFoxte/bFTDzr1qlkzB:HU5rCOTeiJqA5VYBOfnAsWyNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3000 3662.tmp 1220 36BF.tmp 944 373C.tmp 4848 37B9.tmp 1292 3808.tmp 2312 3856.tmp 4776 38A4.tmp 4640 38F2.tmp 4168 3950.tmp 2936 39BD.tmp 2032 3A1B.tmp 1680 3A88.tmp 1624 3AD6.tmp 3316 3B24.tmp 2280 3B73.tmp 3352 3BC1.tmp 5036 3C1E.tmp 1836 3C7C.tmp 1156 3CCA.tmp 4568 3D18.tmp 3464 3D76.tmp 4320 3DD4.tmp 4284 3E32.tmp 1520 3E8F.tmp 4016 3EFD.tmp 4488 3F4B.tmp 4944 3FC8.tmp 3692 4035.tmp 4228 40A3.tmp 3952 4100.tmp 4992 416E.tmp 4344 41DB.tmp 2760 4249.tmp 3796 4297.tmp 4012 42F4.tmp 3408 4352.tmp 4220 43B0.tmp 2848 440E.tmp 1220 445C.tmp 876 44AA.tmp 3188 4517.tmp 3672 4575.tmp 4504 45C3.tmp 2712 4621.tmp 4844 467F.tmp 4536 46DC.tmp 4756 472B.tmp 4972 4779.tmp 2940 47D6.tmp 4776 4825.tmp 1964 4882.tmp 620 48E0.tmp 4168 493E.tmp 1592 498C.tmp 4516 49DA.tmp 2580 4A38.tmp 676 4A96.tmp 2080 4AF3.tmp 1588 4B51.tmp 4364 4B9F.tmp 4508 4BFD.tmp 624 4C4B.tmp 1040 4C99.tmp 1224 4CF7.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3428 wrote to memory of 3000 3428 2024-04-15_d5cd8d5d38de0c1dc43c7eeb87813dea_mafia.exe 84 PID 3428 wrote to memory of 3000 3428 2024-04-15_d5cd8d5d38de0c1dc43c7eeb87813dea_mafia.exe 84 PID 3428 wrote to memory of 3000 3428 2024-04-15_d5cd8d5d38de0c1dc43c7eeb87813dea_mafia.exe 84 PID 3000 wrote to memory of 1220 3000 3662.tmp 85 PID 3000 wrote to memory of 1220 3000 3662.tmp 85 PID 3000 wrote to memory of 1220 3000 3662.tmp 85 PID 1220 wrote to memory of 944 1220 36BF.tmp 87 PID 1220 wrote to memory of 944 1220 36BF.tmp 87 PID 1220 wrote to memory of 944 1220 36BF.tmp 87 PID 944 wrote to memory of 4848 944 373C.tmp 89 PID 944 wrote to memory of 4848 944 373C.tmp 89 PID 944 wrote to memory of 4848 944 373C.tmp 89 PID 4848 wrote to memory of 1292 4848 37B9.tmp 91 PID 4848 wrote to memory of 1292 4848 37B9.tmp 91 PID 4848 wrote to memory of 1292 4848 37B9.tmp 91 PID 1292 wrote to memory of 2312 1292 3808.tmp 92 PID 1292 wrote to memory of 2312 1292 3808.tmp 92 PID 1292 wrote to memory of 2312 1292 3808.tmp 92 PID 2312 wrote to memory of 4776 2312 3856.tmp 93 PID 2312 wrote to memory of 4776 2312 3856.tmp 93 PID 2312 wrote to memory of 4776 2312 3856.tmp 93 PID 4776 wrote to memory of 4640 4776 38A4.tmp 94 PID 4776 wrote to memory of 4640 4776 38A4.tmp 94 PID 4776 wrote to memory of 4640 4776 38A4.tmp 94 PID 4640 wrote to memory of 4168 4640 38F2.tmp 95 PID 4640 wrote to memory of 4168 4640 38F2.tmp 95 PID 4640 wrote to memory of 4168 4640 38F2.tmp 95 PID 4168 wrote to memory of 2936 4168 3950.tmp 96 PID 4168 wrote to memory of 2936 4168 3950.tmp 96 PID 4168 wrote to memory of 2936 4168 3950.tmp 96 PID 2936 wrote to memory of 2032 2936 39BD.tmp 98 PID 2936 wrote to memory of 2032 2936 39BD.tmp 98 PID 2936 wrote to memory of 2032 2936 39BD.tmp 98 PID 2032 wrote to memory of 1680 2032 3A1B.tmp 99 PID 2032 wrote to memory of 1680 2032 3A1B.tmp 99 PID 2032 wrote to memory of 1680 2032 3A1B.tmp 99 PID 1680 wrote to memory of 1624 1680 3A88.tmp 100 PID 1680 wrote to memory of 1624 1680 3A88.tmp 100 PID 1680 wrote to memory of 1624 1680 3A88.tmp 100 PID 1624 wrote to memory of 3316 1624 3AD6.tmp 101 PID 1624 wrote to memory of 3316 1624 3AD6.tmp 101 PID 1624 wrote to memory of 3316 1624 3AD6.tmp 101 PID 3316 wrote to memory of 2280 3316 3B24.tmp 102 PID 3316 wrote to memory of 2280 3316 3B24.tmp 102 PID 3316 wrote to memory of 2280 3316 3B24.tmp 102 PID 2280 wrote to memory of 3352 2280 3B73.tmp 103 PID 2280 wrote to memory of 3352 2280 3B73.tmp 103 PID 2280 wrote to memory of 3352 2280 3B73.tmp 103 PID 3352 wrote to memory of 5036 3352 3BC1.tmp 104 PID 3352 wrote to memory of 5036 3352 3BC1.tmp 104 PID 3352 wrote to memory of 5036 3352 3BC1.tmp 104 PID 5036 wrote to memory of 1836 5036 3C1E.tmp 105 PID 5036 wrote to memory of 1836 5036 3C1E.tmp 105 PID 5036 wrote to memory of 1836 5036 3C1E.tmp 105 PID 1836 wrote to memory of 1156 1836 3C7C.tmp 106 PID 1836 wrote to memory of 1156 1836 3C7C.tmp 106 PID 1836 wrote to memory of 1156 1836 3C7C.tmp 106 PID 1156 wrote to memory of 4568 1156 3CCA.tmp 107 PID 1156 wrote to memory of 4568 1156 3CCA.tmp 107 PID 1156 wrote to memory of 4568 1156 3CCA.tmp 107 PID 4568 wrote to memory of 3464 4568 3D18.tmp 108 PID 4568 wrote to memory of 3464 4568 3D18.tmp 108 PID 4568 wrote to memory of 3464 4568 3D18.tmp 108 PID 3464 wrote to memory of 4320 3464 3D76.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-15_d5cd8d5d38de0c1dc43c7eeb87813dea_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-15_d5cd8d5d38de0c1dc43c7eeb87813dea_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\3662.tmp"C:\Users\Admin\AppData\Local\Temp\3662.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\36BF.tmp"C:\Users\Admin\AppData\Local\Temp\36BF.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\373C.tmp"C:\Users\Admin\AppData\Local\Temp\373C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\37B9.tmp"C:\Users\Admin\AppData\Local\Temp\37B9.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\3808.tmp"C:\Users\Admin\AppData\Local\Temp\3808.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\3856.tmp"C:\Users\Admin\AppData\Local\Temp\3856.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\38A4.tmp"C:\Users\Admin\AppData\Local\Temp\38A4.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\38F2.tmp"C:\Users\Admin\AppData\Local\Temp\38F2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\3950.tmp"C:\Users\Admin\AppData\Local\Temp\3950.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\39BD.tmp"C:\Users\Admin\AppData\Local\Temp\39BD.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\3A1B.tmp"C:\Users\Admin\AppData\Local\Temp\3A1B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\3A88.tmp"C:\Users\Admin\AppData\Local\Temp\3A88.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\3B24.tmp"C:\Users\Admin\AppData\Local\Temp\3B24.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\3B73.tmp"C:\Users\Admin\AppData\Local\Temp\3B73.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\3D18.tmp"C:\Users\Admin\AppData\Local\Temp\3D18.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\3D76.tmp"C:\Users\Admin\AppData\Local\Temp\3D76.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"23⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\3E32.tmp"C:\Users\Admin\AppData\Local\Temp\3E32.tmp"24⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"25⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"26⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"27⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"28⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\4035.tmp"C:\Users\Admin\AppData\Local\Temp\4035.tmp"29⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\40A3.tmp"C:\Users\Admin\AppData\Local\Temp\40A3.tmp"30⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\4100.tmp"C:\Users\Admin\AppData\Local\Temp\4100.tmp"31⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\416E.tmp"C:\Users\Admin\AppData\Local\Temp\416E.tmp"32⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\41DB.tmp"C:\Users\Admin\AppData\Local\Temp\41DB.tmp"33⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"34⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"35⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\42F4.tmp"C:\Users\Admin\AppData\Local\Temp\42F4.tmp"36⤵
- Executes dropped EXE
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\4352.tmp"C:\Users\Admin\AppData\Local\Temp\4352.tmp"37⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\43B0.tmp"C:\Users\Admin\AppData\Local\Temp\43B0.tmp"38⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"39⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"40⤵
- Executes dropped EXE
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\44AA.tmp"C:\Users\Admin\AppData\Local\Temp\44AA.tmp"41⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"42⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"43⤵
- Executes dropped EXE
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"44⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"45⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"46⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"47⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"48⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"49⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"50⤵
- Executes dropped EXE
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"51⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"52⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"53⤵
- Executes dropped EXE
PID:620 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"54⤵
- Executes dropped EXE
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"55⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"56⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"57⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"58⤵
- Executes dropped EXE
PID:676 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"59⤵
- Executes dropped EXE
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"60⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"61⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"62⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"63⤵
- Executes dropped EXE
PID:624 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"64⤵
- Executes dropped EXE
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"65⤵
- Executes dropped EXE
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"66⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"67⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"68⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"69⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"70⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"71⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"72⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"73⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"74⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"75⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"76⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"77⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"78⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"79⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"80⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"81⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"82⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"83⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"84⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"85⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"86⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"87⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"88⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"89⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"90⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"91⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"92⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"93⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"94⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"95⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"96⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"97⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"98⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"99⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"100⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"101⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"102⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"103⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"104⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"105⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"106⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"107⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"108⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"109⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"110⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"111⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"112⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"113⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"114⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"115⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"116⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"117⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"118⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"119⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"120⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"121⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"122⤵PID:4600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-