Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
21/04/2024, 13:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-21_65348a0360bcb6116620ddecd1036795_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-21_65348a0360bcb6116620ddecd1036795_mafia.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-21_65348a0360bcb6116620ddecd1036795_mafia.exe
-
Size
712KB
-
MD5
65348a0360bcb6116620ddecd1036795
-
SHA1
08de1a196f7452c12419a783c10c20aa3c857361
-
SHA256
933a94022aa3590ccde5d7e4eb1b8cc68be7c5ac15d4314cb6f36c49aad51eb8
-
SHA512
c346ab277c9506d4f52d8329dc5ff61715106214e18b6f192a92e8307a55359fb8ae3097d9b5f933c5d4672c0dd2923a0dccb36dccd1eec5f092b5cc1b814e02
-
SSDEEP
12288:FU5rCOTeiD4G0b2IYHGEzLh9qYvcW0xP3CvKNZdCvq5TJLCvY90D8/LVBlVk736j:FUQOJD43qbLfhEdW0xPyvKNnCvq5TJLT
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2892 31BE.tmp 1040 326A.tmp 1640 32F7.tmp 4780 3393.tmp 3384 3410.tmp 4988 347D.tmp 5100 34DB.tmp 1756 3548.tmp 4784 35A6.tmp 2592 3614.tmp 1980 3671.tmp 4904 36DF.tmp 2988 376B.tmp 2308 37D9.tmp 3544 3846.tmp 1320 38C3.tmp 5060 3911.tmp 884 396F.tmp 3584 39EC.tmp 3620 3A3A.tmp 1792 3AB7.tmp 4616 3B44.tmp 3352 3BB1.tmp 3760 3C0F.tmp 4460 3C8C.tmp 2568 3D09.tmp 4180 3D67.tmp 3128 3DE4.tmp 2436 3E51.tmp 1692 3ECE.tmp 2108 3F4B.tmp 232 3FC8.tmp 968 4045.tmp 4776 40A3.tmp 4516 40F1.tmp 3976 414F.tmp 2428 41AC.tmp 976 420A.tmp 964 4258.tmp 3228 42B6.tmp 1116 4314.tmp 4780 4381.tmp 2940 43DF.tmp 2904 443D.tmp 3480 44AA.tmp 3320 4508.tmp 1756 4556.tmp 2124 45A4.tmp 2400 45F2.tmp 60 4640.tmp 1468 469E.tmp 4816 46FC.tmp 4908 4759.tmp 2064 47A8.tmp 5016 47F6.tmp 1660 4844.tmp 1868 48A2.tmp 3700 48FF.tmp 4336 495D.tmp 4452 49BB.tmp 3764 4A28.tmp 1204 4A86.tmp 3352 4AF3.tmp 3760 4B51.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5104 wrote to memory of 2892 5104 2024-04-21_65348a0360bcb6116620ddecd1036795_mafia.exe 87 PID 5104 wrote to memory of 2892 5104 2024-04-21_65348a0360bcb6116620ddecd1036795_mafia.exe 87 PID 5104 wrote to memory of 2892 5104 2024-04-21_65348a0360bcb6116620ddecd1036795_mafia.exe 87 PID 2892 wrote to memory of 1040 2892 31BE.tmp 88 PID 2892 wrote to memory of 1040 2892 31BE.tmp 88 PID 2892 wrote to memory of 1040 2892 31BE.tmp 88 PID 1040 wrote to memory of 1640 1040 326A.tmp 90 PID 1040 wrote to memory of 1640 1040 326A.tmp 90 PID 1040 wrote to memory of 1640 1040 326A.tmp 90 PID 1640 wrote to memory of 4780 1640 32F7.tmp 92 PID 1640 wrote to memory of 4780 1640 32F7.tmp 92 PID 1640 wrote to memory of 4780 1640 32F7.tmp 92 PID 4780 wrote to memory of 3384 4780 3393.tmp 94 PID 4780 wrote to memory of 3384 4780 3393.tmp 94 PID 4780 wrote to memory of 3384 4780 3393.tmp 94 PID 3384 wrote to memory of 4988 3384 3410.tmp 95 PID 3384 wrote to memory of 4988 3384 3410.tmp 95 PID 3384 wrote to memory of 4988 3384 3410.tmp 95 PID 4988 wrote to memory of 5100 4988 347D.tmp 96 PID 4988 wrote to memory of 5100 4988 347D.tmp 96 PID 4988 wrote to memory of 5100 4988 347D.tmp 96 PID 5100 wrote to memory of 1756 5100 34DB.tmp 97 PID 5100 wrote to memory of 1756 5100 34DB.tmp 97 PID 5100 wrote to memory of 1756 5100 34DB.tmp 97 PID 1756 wrote to memory of 4784 1756 3548.tmp 98 PID 1756 wrote to memory of 4784 1756 3548.tmp 98 PID 1756 wrote to memory of 4784 1756 3548.tmp 98 PID 4784 wrote to memory of 2592 4784 35A6.tmp 99 PID 4784 wrote to memory of 2592 4784 35A6.tmp 99 PID 4784 wrote to memory of 2592 4784 35A6.tmp 99 PID 2592 wrote to memory of 1980 2592 3614.tmp 100 PID 2592 wrote to memory of 1980 2592 3614.tmp 100 PID 2592 wrote to memory of 1980 2592 3614.tmp 100 PID 1980 wrote to memory of 4904 1980 3671.tmp 101 PID 1980 wrote to memory of 4904 1980 3671.tmp 101 PID 1980 wrote to memory of 4904 1980 3671.tmp 101 PID 4904 wrote to memory of 2988 4904 36DF.tmp 102 PID 4904 wrote to memory of 2988 4904 36DF.tmp 102 PID 4904 wrote to memory of 2988 4904 36DF.tmp 102 PID 2988 wrote to memory of 2308 2988 376B.tmp 103 PID 2988 wrote to memory of 2308 2988 376B.tmp 103 PID 2988 wrote to memory of 2308 2988 376B.tmp 103 PID 2308 wrote to memory of 3544 2308 37D9.tmp 104 PID 2308 wrote to memory of 3544 2308 37D9.tmp 104 PID 2308 wrote to memory of 3544 2308 37D9.tmp 104 PID 3544 wrote to memory of 1320 3544 3846.tmp 105 PID 3544 wrote to memory of 1320 3544 3846.tmp 105 PID 3544 wrote to memory of 1320 3544 3846.tmp 105 PID 1320 wrote to memory of 5060 1320 38C3.tmp 106 PID 1320 wrote to memory of 5060 1320 38C3.tmp 106 PID 1320 wrote to memory of 5060 1320 38C3.tmp 106 PID 5060 wrote to memory of 884 5060 3911.tmp 107 PID 5060 wrote to memory of 884 5060 3911.tmp 107 PID 5060 wrote to memory of 884 5060 3911.tmp 107 PID 884 wrote to memory of 3584 884 396F.tmp 108 PID 884 wrote to memory of 3584 884 396F.tmp 108 PID 884 wrote to memory of 3584 884 396F.tmp 108 PID 3584 wrote to memory of 3620 3584 39EC.tmp 109 PID 3584 wrote to memory of 3620 3584 39EC.tmp 109 PID 3584 wrote to memory of 3620 3584 39EC.tmp 109 PID 3620 wrote to memory of 1792 3620 3A3A.tmp 110 PID 3620 wrote to memory of 1792 3620 3A3A.tmp 110 PID 3620 wrote to memory of 1792 3620 3A3A.tmp 110 PID 1792 wrote to memory of 4616 1792 3AB7.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-21_65348a0360bcb6116620ddecd1036795_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-21_65348a0360bcb6116620ddecd1036795_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\31BE.tmp"C:\Users\Admin\AppData\Local\Temp\31BE.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\326A.tmp"C:\Users\Admin\AppData\Local\Temp\326A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\32F7.tmp"C:\Users\Admin\AppData\Local\Temp\32F7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\3393.tmp"C:\Users\Admin\AppData\Local\Temp\3393.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\3410.tmp"C:\Users\Admin\AppData\Local\Temp\3410.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\347D.tmp"C:\Users\Admin\AppData\Local\Temp\347D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\34DB.tmp"C:\Users\Admin\AppData\Local\Temp\34DB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\3548.tmp"C:\Users\Admin\AppData\Local\Temp\3548.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\35A6.tmp"C:\Users\Admin\AppData\Local\Temp\35A6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\3614.tmp"C:\Users\Admin\AppData\Local\Temp\3614.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\3671.tmp"C:\Users\Admin\AppData\Local\Temp\3671.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\36DF.tmp"C:\Users\Admin\AppData\Local\Temp\36DF.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\376B.tmp"C:\Users\Admin\AppData\Local\Temp\376B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\37D9.tmp"C:\Users\Admin\AppData\Local\Temp\37D9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\3846.tmp"C:\Users\Admin\AppData\Local\Temp\3846.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\38C3.tmp"C:\Users\Admin\AppData\Local\Temp\38C3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\3911.tmp"C:\Users\Admin\AppData\Local\Temp\3911.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\396F.tmp"C:\Users\Admin\AppData\Local\Temp\396F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\39EC.tmp"C:\Users\Admin\AppData\Local\Temp\39EC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\3B44.tmp"C:\Users\Admin\AppData\Local\Temp\3B44.tmp"23⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\3BB1.tmp"C:\Users\Admin\AppData\Local\Temp\3BB1.tmp"24⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\3C0F.tmp"C:\Users\Admin\AppData\Local\Temp\3C0F.tmp"25⤵
- Executes dropped EXE
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"26⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\3D09.tmp"C:\Users\Admin\AppData\Local\Temp\3D09.tmp"27⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\3D67.tmp"C:\Users\Admin\AppData\Local\Temp\3D67.tmp"28⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"29⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\3E51.tmp"C:\Users\Admin\AppData\Local\Temp\3E51.tmp"30⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"31⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"32⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"33⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\4045.tmp"C:\Users\Admin\AppData\Local\Temp\4045.tmp"34⤵
- Executes dropped EXE
PID:968 -
C:\Users\Admin\AppData\Local\Temp\40A3.tmp"C:\Users\Admin\AppData\Local\Temp\40A3.tmp"35⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\40F1.tmp"C:\Users\Admin\AppData\Local\Temp\40F1.tmp"36⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\414F.tmp"C:\Users\Admin\AppData\Local\Temp\414F.tmp"37⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\41AC.tmp"C:\Users\Admin\AppData\Local\Temp\41AC.tmp"38⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\420A.tmp"C:\Users\Admin\AppData\Local\Temp\420A.tmp"39⤵
- Executes dropped EXE
PID:976 -
C:\Users\Admin\AppData\Local\Temp\4258.tmp"C:\Users\Admin\AppData\Local\Temp\4258.tmp"40⤵
- Executes dropped EXE
PID:964 -
C:\Users\Admin\AppData\Local\Temp\42B6.tmp"C:\Users\Admin\AppData\Local\Temp\42B6.tmp"41⤵
- Executes dropped EXE
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\4314.tmp"C:\Users\Admin\AppData\Local\Temp\4314.tmp"42⤵
- Executes dropped EXE
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"43⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"44⤵
- Executes dropped EXE
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\443D.tmp"C:\Users\Admin\AppData\Local\Temp\443D.tmp"45⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\44AA.tmp"C:\Users\Admin\AppData\Local\Temp\44AA.tmp"46⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"47⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"48⤵
- Executes dropped EXE
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"49⤵
- Executes dropped EXE
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\45F2.tmp"C:\Users\Admin\AppData\Local\Temp\45F2.tmp"50⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"51⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"52⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"53⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"54⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"55⤵
- Executes dropped EXE
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"56⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"57⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"58⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"59⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"60⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"61⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"62⤵
- Executes dropped EXE
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"63⤵
- Executes dropped EXE
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"64⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"65⤵
- Executes dropped EXE
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"66⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"67⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"68⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"69⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"70⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"71⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"72⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"73⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"74⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"75⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"76⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"77⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"78⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"79⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"80⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"81⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"82⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"83⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"84⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"85⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"86⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"87⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"88⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"89⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"90⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"91⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"92⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"93⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"94⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"95⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"96⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"97⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"98⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"99⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"100⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"101⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"102⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"103⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"104⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"105⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"106⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"107⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"108⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"109⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"110⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"111⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"112⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"113⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"114⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"115⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"116⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"117⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"118⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"119⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"120⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"121⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"122⤵PID:5112
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-