Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
22/04/2024, 02:17
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-22_9de1a7b6409ce7cb8f92f553f8314b7d_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-22_9de1a7b6409ce7cb8f92f553f8314b7d_mafia.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-22_9de1a7b6409ce7cb8f92f553f8314b7d_mafia.exe
-
Size
486KB
-
MD5
9de1a7b6409ce7cb8f92f553f8314b7d
-
SHA1
30930f61cc8e6fe393d4e814664b858ad9584dcb
-
SHA256
d1ecdd6767588b5e2451cd827d594ea8e9c7efaebf0b54fdc9309b0d6d2c7d7a
-
SHA512
3746a49f655f184b58644b829060338dffc649794a7afbabf2980cc45bc125cffc63f6ec6e21f1a8b5b9ec285e6764d58b0640c9f1331bc5c8e8d93bb3198c23
-
SSDEEP
12288:/U5rCOTeiDDahyL8kt0v/OS5U+c6lnEJ:/UQOJDD8kt0eS5xA
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2688 33A3.tmp 744 3420.tmp 4448 347D.tmp 692 350A.tmp 916 3587.tmp 3020 35F4.tmp 5112 3652.tmp 3116 36A0.tmp 3704 36FE.tmp 5060 375C.tmp 4504 37B9.tmp 4908 3836.tmp 1388 38A4.tmp 3768 3902.tmp 1036 3950.tmp 4864 39BD.tmp 3744 3A0B.tmp 2500 3A79.tmp 2532 3AE6.tmp 3924 3B44.tmp 1960 3BB1.tmp 2748 3C0F.tmp 5076 3C8C.tmp 1056 3D09.tmp 4032 3D57.tmp 1032 3DC4.tmp 2392 3E32.tmp 808 3EAF.tmp 4460 3F1C.tmp 2768 3F7A.tmp 3148 3FC8.tmp 4060 4026.tmp 4340 40B2.tmp 4496 4110.tmp 4972 416E.tmp 4704 41CC.tmp 1812 4229.tmp 744 4287.tmp 180 42D5.tmp 4448 4333.tmp 692 4381.tmp 5064 43DF.tmp 4268 442D.tmp 2000 447B.tmp 4272 44D9.tmp 3320 4527.tmp 3568 4585.tmp 2060 45E2.tmp 2976 4631.tmp 1452 468E.tmp 728 46EC.tmp 1864 474A.tmp 3004 47A8.tmp 4888 4805.tmp 1548 4853.tmp 3488 48B1.tmp 2508 48FF.tmp 1388 494D.tmp 2012 49AB.tmp 4028 49F9.tmp 1656 4A57.tmp 1920 4AA5.tmp 1124 4AF3.tmp 3208 4B51.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4616 wrote to memory of 2688 4616 2024-04-22_9de1a7b6409ce7cb8f92f553f8314b7d_mafia.exe 84 PID 4616 wrote to memory of 2688 4616 2024-04-22_9de1a7b6409ce7cb8f92f553f8314b7d_mafia.exe 84 PID 4616 wrote to memory of 2688 4616 2024-04-22_9de1a7b6409ce7cb8f92f553f8314b7d_mafia.exe 84 PID 2688 wrote to memory of 744 2688 33A3.tmp 85 PID 2688 wrote to memory of 744 2688 33A3.tmp 85 PID 2688 wrote to memory of 744 2688 33A3.tmp 85 PID 744 wrote to memory of 4448 744 3420.tmp 86 PID 744 wrote to memory of 4448 744 3420.tmp 86 PID 744 wrote to memory of 4448 744 3420.tmp 86 PID 4448 wrote to memory of 692 4448 347D.tmp 87 PID 4448 wrote to memory of 692 4448 347D.tmp 87 PID 4448 wrote to memory of 692 4448 347D.tmp 87 PID 692 wrote to memory of 916 692 350A.tmp 90 PID 692 wrote to memory of 916 692 350A.tmp 90 PID 692 wrote to memory of 916 692 350A.tmp 90 PID 916 wrote to memory of 3020 916 3587.tmp 92 PID 916 wrote to memory of 3020 916 3587.tmp 92 PID 916 wrote to memory of 3020 916 3587.tmp 92 PID 3020 wrote to memory of 5112 3020 35F4.tmp 93 PID 3020 wrote to memory of 5112 3020 35F4.tmp 93 PID 3020 wrote to memory of 5112 3020 35F4.tmp 93 PID 5112 wrote to memory of 3116 5112 3652.tmp 94 PID 5112 wrote to memory of 3116 5112 3652.tmp 94 PID 5112 wrote to memory of 3116 5112 3652.tmp 94 PID 3116 wrote to memory of 3704 3116 36A0.tmp 96 PID 3116 wrote to memory of 3704 3116 36A0.tmp 96 PID 3116 wrote to memory of 3704 3116 36A0.tmp 96 PID 3704 wrote to memory of 5060 3704 36FE.tmp 97 PID 3704 wrote to memory of 5060 3704 36FE.tmp 97 PID 3704 wrote to memory of 5060 3704 36FE.tmp 97 PID 5060 wrote to memory of 4504 5060 375C.tmp 98 PID 5060 wrote to memory of 4504 5060 375C.tmp 98 PID 5060 wrote to memory of 4504 5060 375C.tmp 98 PID 4504 wrote to memory of 4908 4504 37B9.tmp 99 PID 4504 wrote to memory of 4908 4504 37B9.tmp 99 PID 4504 wrote to memory of 4908 4504 37B9.tmp 99 PID 4908 wrote to memory of 1388 4908 3836.tmp 100 PID 4908 wrote to memory of 1388 4908 3836.tmp 100 PID 4908 wrote to memory of 1388 4908 3836.tmp 100 PID 1388 wrote to memory of 3768 1388 38A4.tmp 101 PID 1388 wrote to memory of 3768 1388 38A4.tmp 101 PID 1388 wrote to memory of 3768 1388 38A4.tmp 101 PID 3768 wrote to memory of 1036 3768 3902.tmp 102 PID 3768 wrote to memory of 1036 3768 3902.tmp 102 PID 3768 wrote to memory of 1036 3768 3902.tmp 102 PID 1036 wrote to memory of 4864 1036 3950.tmp 103 PID 1036 wrote to memory of 4864 1036 3950.tmp 103 PID 1036 wrote to memory of 4864 1036 3950.tmp 103 PID 4864 wrote to memory of 3744 4864 39BD.tmp 104 PID 4864 wrote to memory of 3744 4864 39BD.tmp 104 PID 4864 wrote to memory of 3744 4864 39BD.tmp 104 PID 3744 wrote to memory of 2500 3744 3A0B.tmp 105 PID 3744 wrote to memory of 2500 3744 3A0B.tmp 105 PID 3744 wrote to memory of 2500 3744 3A0B.tmp 105 PID 2500 wrote to memory of 2532 2500 3A79.tmp 106 PID 2500 wrote to memory of 2532 2500 3A79.tmp 106 PID 2500 wrote to memory of 2532 2500 3A79.tmp 106 PID 2532 wrote to memory of 3924 2532 3AE6.tmp 107 PID 2532 wrote to memory of 3924 2532 3AE6.tmp 107 PID 2532 wrote to memory of 3924 2532 3AE6.tmp 107 PID 3924 wrote to memory of 1960 3924 3B44.tmp 108 PID 3924 wrote to memory of 1960 3924 3B44.tmp 108 PID 3924 wrote to memory of 1960 3924 3B44.tmp 108 PID 1960 wrote to memory of 2748 1960 3BB1.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-22_9de1a7b6409ce7cb8f92f553f8314b7d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-22_9de1a7b6409ce7cb8f92f553f8314b7d_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\33A3.tmp"C:\Users\Admin\AppData\Local\Temp\33A3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\3420.tmp"C:\Users\Admin\AppData\Local\Temp\3420.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\347D.tmp"C:\Users\Admin\AppData\Local\Temp\347D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\350A.tmp"C:\Users\Admin\AppData\Local\Temp\350A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Users\Admin\AppData\Local\Temp\3587.tmp"C:\Users\Admin\AppData\Local\Temp\3587.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\35F4.tmp"C:\Users\Admin\AppData\Local\Temp\35F4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\3652.tmp"C:\Users\Admin\AppData\Local\Temp\3652.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\36A0.tmp"C:\Users\Admin\AppData\Local\Temp\36A0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\36FE.tmp"C:\Users\Admin\AppData\Local\Temp\36FE.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\375C.tmp"C:\Users\Admin\AppData\Local\Temp\375C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\37B9.tmp"C:\Users\Admin\AppData\Local\Temp\37B9.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\3836.tmp"C:\Users\Admin\AppData\Local\Temp\3836.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\38A4.tmp"C:\Users\Admin\AppData\Local\Temp\38A4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\3902.tmp"C:\Users\Admin\AppData\Local\Temp\3902.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\3950.tmp"C:\Users\Admin\AppData\Local\Temp\3950.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\39BD.tmp"C:\Users\Admin\AppData\Local\Temp\39BD.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\3A79.tmp"C:\Users\Admin\AppData\Local\Temp\3A79.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\3B44.tmp"C:\Users\Admin\AppData\Local\Temp\3B44.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\3BB1.tmp"C:\Users\Admin\AppData\Local\Temp\3BB1.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\3C0F.tmp"C:\Users\Admin\AppData\Local\Temp\3C0F.tmp"23⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"24⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\3D09.tmp"C:\Users\Admin\AppData\Local\Temp\3D09.tmp"25⤵
- Executes dropped EXE
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\3D57.tmp"C:\Users\Admin\AppData\Local\Temp\3D57.tmp"26⤵
- Executes dropped EXE
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"27⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\3E32.tmp"C:\Users\Admin\AppData\Local\Temp\3E32.tmp"28⤵
- Executes dropped EXE
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\3EAF.tmp"C:\Users\Admin\AppData\Local\Temp\3EAF.tmp"29⤵
- Executes dropped EXE
PID:808 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"30⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"31⤵
- Executes dropped EXE
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"32⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\4026.tmp"C:\Users\Admin\AppData\Local\Temp\4026.tmp"33⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"34⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\4110.tmp"C:\Users\Admin\AppData\Local\Temp\4110.tmp"35⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\416E.tmp"C:\Users\Admin\AppData\Local\Temp\416E.tmp"36⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"37⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\4229.tmp"C:\Users\Admin\AppData\Local\Temp\4229.tmp"38⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\4287.tmp"C:\Users\Admin\AppData\Local\Temp\4287.tmp"39⤵
- Executes dropped EXE
PID:744 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"40⤵
- Executes dropped EXE
PID:180 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"41⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"42⤵
- Executes dropped EXE
PID:692 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"43⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"44⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\447B.tmp"C:\Users\Admin\AppData\Local\Temp\447B.tmp"45⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"46⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"47⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"48⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"49⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"50⤵
- Executes dropped EXE
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"51⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\46EC.tmp"C:\Users\Admin\AppData\Local\Temp\46EC.tmp"52⤵
- Executes dropped EXE
PID:728 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"53⤵
- Executes dropped EXE
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"54⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"55⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"56⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\48B1.tmp"C:\Users\Admin\AppData\Local\Temp\48B1.tmp"57⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"58⤵
- Executes dropped EXE
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"59⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"60⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"61⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"62⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"63⤵
- Executes dropped EXE
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"64⤵
- Executes dropped EXE
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"65⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"66⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"67⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"68⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"69⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"70⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"71⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"72⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"73⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"74⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"75⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"76⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"77⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"78⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"79⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"80⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"81⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"82⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"83⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"84⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"85⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"86⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"87⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"88⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"89⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"90⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"91⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"92⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"93⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"94⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"95⤵PID:180
-
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"96⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"97⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"98⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"99⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"100⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"101⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"102⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"103⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"104⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"105⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"106⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"107⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"108⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"109⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"110⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"111⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"112⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"113⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"114⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"115⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"116⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"117⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"118⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"119⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"120⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"121⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"122⤵PID:3924
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-