Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
21/04/2024, 16:39
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-21_bccff4e29b641f45aa2060d5c15678f6_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-04-21_bccff4e29b641f45aa2060d5c15678f6_mafia.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-21_bccff4e29b641f45aa2060d5c15678f6_mafia.exe
-
Size
486KB
-
MD5
bccff4e29b641f45aa2060d5c15678f6
-
SHA1
3d834a9138bb08379766daa45e633479b6519f10
-
SHA256
cd282413f3f017e1a8f404df0d88ef03c8e5fdcf64721b9a48fc8f90f295a5b0
-
SHA512
340fda8bda8e4bea57f56743d635a1b31de0ffdffd514da606f3b1c7f71ce0c6611de3826493ae56af3a7558745b7c3daa51e87ac495b6ff9d16139711c23d84
-
SSDEEP
12288:/U5rCOTeiDkBJeyxdIWBzNpOW3kPC59yEuHggcn:/UQOJDQJe6NBzNUPC59ycgcn
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1776 2FBB.tmp 928 3018.tmp 4784 3066.tmp 1580 30E3.tmp 3020 3160.tmp 216 31DD.tmp 5104 323B.tmp 3584 32B8.tmp 4060 3326.tmp 1944 3374.tmp 3344 33C2.tmp 4400 342F.tmp 4680 348D.tmp 548 34FA.tmp 5036 3577.tmp 3844 35D5.tmp 2164 3633.tmp 3748 3691.tmp 3032 36EE.tmp 4812 374C.tmp 1412 37B9.tmp 2044 3817.tmp 2584 3865.tmp 208 38C3.tmp 4664 3911.tmp 660 396F.tmp 3124 39CD.tmp 1184 3A2A.tmp 5000 3A98.tmp 1504 3B05.tmp 3668 3B73.tmp 1548 3BE0.tmp 5020 3C3E.tmp 3648 3C9B.tmp 3900 3CF9.tmp 4388 3D57.tmp 4964 3DA5.tmp 3688 3E03.tmp 4144 3E51.tmp 3232 3E9F.tmp 552 3EFD.tmp 5080 3F4B.tmp 1824 3F99.tmp 2280 3FE7.tmp 1908 4035.tmp 2848 4083.tmp 928 40E1.tmp 3104 412F.tmp 4636 417D.tmp 4344 41DB.tmp 1580 4229.tmp 3628 4277.tmp 3452 42D5.tmp 2140 4323.tmp 1096 4381.tmp 4672 43DF.tmp 3220 443D.tmp 2144 44AA.tmp 5072 44F8.tmp 3248 4546.tmp 3972 45A4.tmp 2692 4602.tmp 3136 4650.tmp 3300 469E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2724 wrote to memory of 1776 2724 2024-04-21_bccff4e29b641f45aa2060d5c15678f6_mafia.exe 82 PID 2724 wrote to memory of 1776 2724 2024-04-21_bccff4e29b641f45aa2060d5c15678f6_mafia.exe 82 PID 2724 wrote to memory of 1776 2724 2024-04-21_bccff4e29b641f45aa2060d5c15678f6_mafia.exe 82 PID 1776 wrote to memory of 928 1776 2FBB.tmp 83 PID 1776 wrote to memory of 928 1776 2FBB.tmp 83 PID 1776 wrote to memory of 928 1776 2FBB.tmp 83 PID 928 wrote to memory of 4784 928 3018.tmp 84 PID 928 wrote to memory of 4784 928 3018.tmp 84 PID 928 wrote to memory of 4784 928 3018.tmp 84 PID 4784 wrote to memory of 1580 4784 3066.tmp 86 PID 4784 wrote to memory of 1580 4784 3066.tmp 86 PID 4784 wrote to memory of 1580 4784 3066.tmp 86 PID 1580 wrote to memory of 3020 1580 30E3.tmp 88 PID 1580 wrote to memory of 3020 1580 30E3.tmp 88 PID 1580 wrote to memory of 3020 1580 30E3.tmp 88 PID 3020 wrote to memory of 216 3020 3160.tmp 90 PID 3020 wrote to memory of 216 3020 3160.tmp 90 PID 3020 wrote to memory of 216 3020 3160.tmp 90 PID 216 wrote to memory of 5104 216 31DD.tmp 91 PID 216 wrote to memory of 5104 216 31DD.tmp 91 PID 216 wrote to memory of 5104 216 31DD.tmp 91 PID 5104 wrote to memory of 3584 5104 323B.tmp 92 PID 5104 wrote to memory of 3584 5104 323B.tmp 92 PID 5104 wrote to memory of 3584 5104 323B.tmp 92 PID 3584 wrote to memory of 4060 3584 32B8.tmp 93 PID 3584 wrote to memory of 4060 3584 32B8.tmp 93 PID 3584 wrote to memory of 4060 3584 32B8.tmp 93 PID 4060 wrote to memory of 1944 4060 3326.tmp 94 PID 4060 wrote to memory of 1944 4060 3326.tmp 94 PID 4060 wrote to memory of 1944 4060 3326.tmp 94 PID 1944 wrote to memory of 3344 1944 3374.tmp 95 PID 1944 wrote to memory of 3344 1944 3374.tmp 95 PID 1944 wrote to memory of 3344 1944 3374.tmp 95 PID 3344 wrote to memory of 4400 3344 33C2.tmp 96 PID 3344 wrote to memory of 4400 3344 33C2.tmp 96 PID 3344 wrote to memory of 4400 3344 33C2.tmp 96 PID 4400 wrote to memory of 4680 4400 342F.tmp 97 PID 4400 wrote to memory of 4680 4400 342F.tmp 97 PID 4400 wrote to memory of 4680 4400 342F.tmp 97 PID 4680 wrote to memory of 548 4680 348D.tmp 98 PID 4680 wrote to memory of 548 4680 348D.tmp 98 PID 4680 wrote to memory of 548 4680 348D.tmp 98 PID 548 wrote to memory of 5036 548 34FA.tmp 99 PID 548 wrote to memory of 5036 548 34FA.tmp 99 PID 548 wrote to memory of 5036 548 34FA.tmp 99 PID 5036 wrote to memory of 3844 5036 3577.tmp 100 PID 5036 wrote to memory of 3844 5036 3577.tmp 100 PID 5036 wrote to memory of 3844 5036 3577.tmp 100 PID 3844 wrote to memory of 2164 3844 35D5.tmp 101 PID 3844 wrote to memory of 2164 3844 35D5.tmp 101 PID 3844 wrote to memory of 2164 3844 35D5.tmp 101 PID 2164 wrote to memory of 3748 2164 3633.tmp 102 PID 2164 wrote to memory of 3748 2164 3633.tmp 102 PID 2164 wrote to memory of 3748 2164 3633.tmp 102 PID 3748 wrote to memory of 3032 3748 3691.tmp 103 PID 3748 wrote to memory of 3032 3748 3691.tmp 103 PID 3748 wrote to memory of 3032 3748 3691.tmp 103 PID 3032 wrote to memory of 4812 3032 36EE.tmp 104 PID 3032 wrote to memory of 4812 3032 36EE.tmp 104 PID 3032 wrote to memory of 4812 3032 36EE.tmp 104 PID 4812 wrote to memory of 1412 4812 374C.tmp 105 PID 4812 wrote to memory of 1412 4812 374C.tmp 105 PID 4812 wrote to memory of 1412 4812 374C.tmp 105 PID 1412 wrote to memory of 2044 1412 37B9.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-21_bccff4e29b641f45aa2060d5c15678f6_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-21_bccff4e29b641f45aa2060d5c15678f6_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\2FBB.tmp"C:\Users\Admin\AppData\Local\Temp\2FBB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\3018.tmp"C:\Users\Admin\AppData\Local\Temp\3018.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Users\Admin\AppData\Local\Temp\3066.tmp"C:\Users\Admin\AppData\Local\Temp\3066.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\30E3.tmp"C:\Users\Admin\AppData\Local\Temp\30E3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\3160.tmp"C:\Users\Admin\AppData\Local\Temp\3160.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\31DD.tmp"C:\Users\Admin\AppData\Local\Temp\31DD.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\323B.tmp"C:\Users\Admin\AppData\Local\Temp\323B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\32B8.tmp"C:\Users\Admin\AppData\Local\Temp\32B8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\3326.tmp"C:\Users\Admin\AppData\Local\Temp\3326.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\3374.tmp"C:\Users\Admin\AppData\Local\Temp\3374.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\33C2.tmp"C:\Users\Admin\AppData\Local\Temp\33C2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\342F.tmp"C:\Users\Admin\AppData\Local\Temp\342F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\348D.tmp"C:\Users\Admin\AppData\Local\Temp\348D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\34FA.tmp"C:\Users\Admin\AppData\Local\Temp\34FA.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\3577.tmp"C:\Users\Admin\AppData\Local\Temp\3577.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\35D5.tmp"C:\Users\Admin\AppData\Local\Temp\35D5.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\3633.tmp"C:\Users\Admin\AppData\Local\Temp\3633.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\3691.tmp"C:\Users\Admin\AppData\Local\Temp\3691.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\36EE.tmp"C:\Users\Admin\AppData\Local\Temp\36EE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\374C.tmp"C:\Users\Admin\AppData\Local\Temp\374C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\37B9.tmp"C:\Users\Admin\AppData\Local\Temp\37B9.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\3817.tmp"C:\Users\Admin\AppData\Local\Temp\3817.tmp"23⤵
- Executes dropped EXE
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\3865.tmp"C:\Users\Admin\AppData\Local\Temp\3865.tmp"24⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\38C3.tmp"C:\Users\Admin\AppData\Local\Temp\38C3.tmp"25⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\3911.tmp"C:\Users\Admin\AppData\Local\Temp\3911.tmp"26⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\396F.tmp"C:\Users\Admin\AppData\Local\Temp\396F.tmp"27⤵
- Executes dropped EXE
PID:660 -
C:\Users\Admin\AppData\Local\Temp\39CD.tmp"C:\Users\Admin\AppData\Local\Temp\39CD.tmp"28⤵
- Executes dropped EXE
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"29⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\3A98.tmp"C:\Users\Admin\AppData\Local\Temp\3A98.tmp"30⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\3B05.tmp"C:\Users\Admin\AppData\Local\Temp\3B05.tmp"31⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\3B73.tmp"C:\Users\Admin\AppData\Local\Temp\3B73.tmp"32⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"33⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\3C3E.tmp"C:\Users\Admin\AppData\Local\Temp\3C3E.tmp"34⤵
- Executes dropped EXE
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"35⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"36⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\3D57.tmp"C:\Users\Admin\AppData\Local\Temp\3D57.tmp"37⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\3DA5.tmp"C:\Users\Admin\AppData\Local\Temp\3DA5.tmp"38⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\3E03.tmp"C:\Users\Admin\AppData\Local\Temp\3E03.tmp"39⤵
- Executes dropped EXE
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\3E51.tmp"C:\Users\Admin\AppData\Local\Temp\3E51.tmp"40⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"41⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"42⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"43⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\3F99.tmp"C:\Users\Admin\AppData\Local\Temp\3F99.tmp"44⤵
- Executes dropped EXE
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"45⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\4035.tmp"C:\Users\Admin\AppData\Local\Temp\4035.tmp"46⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\4083.tmp"C:\Users\Admin\AppData\Local\Temp\4083.tmp"47⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\40E1.tmp"C:\Users\Admin\AppData\Local\Temp\40E1.tmp"48⤵
- Executes dropped EXE
PID:928 -
C:\Users\Admin\AppData\Local\Temp\412F.tmp"C:\Users\Admin\AppData\Local\Temp\412F.tmp"49⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"50⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\41DB.tmp"C:\Users\Admin\AppData\Local\Temp\41DB.tmp"51⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\4229.tmp"C:\Users\Admin\AppData\Local\Temp\4229.tmp"52⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\4277.tmp"C:\Users\Admin\AppData\Local\Temp\4277.tmp"53⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"54⤵
- Executes dropped EXE
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"55⤵
- Executes dropped EXE
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"56⤵
- Executes dropped EXE
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"57⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\443D.tmp"C:\Users\Admin\AppData\Local\Temp\443D.tmp"58⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\44AA.tmp"C:\Users\Admin\AppData\Local\Temp\44AA.tmp"59⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"60⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"61⤵
- Executes dropped EXE
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"62⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\4602.tmp"C:\Users\Admin\AppData\Local\Temp\4602.tmp"63⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"64⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"65⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\46EC.tmp"C:\Users\Admin\AppData\Local\Temp\46EC.tmp"66⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"67⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"68⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"69⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"70⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"71⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"72⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"73⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"74⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\4A19.tmp"C:\Users\Admin\AppData\Local\Temp\4A19.tmp"75⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"76⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"77⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"78⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"79⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"80⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"81⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"82⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"83⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"84⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"85⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"86⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"87⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"88⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"89⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"90⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"91⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"92⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"93⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"94⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"95⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"96⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"97⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"98⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"99⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"100⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"101⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"102⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"103⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"104⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"105⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"106⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"107⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"108⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"109⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"110⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"111⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"112⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"113⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"114⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"115⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"116⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"117⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"118⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"119⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"120⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"121⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"122⤵PID:908
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-