Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24/04/2024, 02:26
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-24_41051f0c0e888412b33f60ee1419a740_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-04-24_41051f0c0e888412b33f60ee1419a740_mafia.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-24_41051f0c0e888412b33f60ee1419a740_mafia.exe
-
Size
520KB
-
MD5
41051f0c0e888412b33f60ee1419a740
-
SHA1
8beffb8f2d885d8f27287b4a4a547ad33a32267c
-
SHA256
b849a41059959438e98203982ca12e1242011f4573fef5e724cb9f946a933dd3
-
SHA512
58abbc5882ede1dd67f2474e4e7311e45a1d6678beba849f980e0f295d80f592b969df77ede89a2855fca3e55c07146c578b6d654560b20aabb56d86dce29af6
-
SSDEEP
12288:gj8fuxR21t5i8fsnzWDSmJ/HVl9CBoXNTDu8vPmNZ:gj8fuK1GYsaDLJdl9CGXNTDjvPmN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4432 33E1.tmp 1084 344E.tmp 2208 34AC.tmp 4672 351A.tmp 316 3577.tmp 4196 35D5.tmp 3972 3623.tmp 4040 3681.tmp 4588 36DF.tmp 4916 375C.tmp 840 37B9.tmp 912 3817.tmp 748 3894.tmp 3268 38E2.tmp 808 3940.tmp 3260 399E.tmp 1688 3A0B.tmp 5008 3A69.tmp 1132 3AB7.tmp 968 3B24.tmp 556 3B92.tmp 4224 3BF0.tmp 4404 3C3E.tmp 3608 3CAB.tmp 2772 3CF9.tmp 2112 3D47.tmp 4952 3DC4.tmp 116 3E22.tmp 336 3E70.tmp 348 3EBE.tmp 2084 3F1C.tmp 1356 3F7A.tmp 3080 3FD8.tmp 2196 4045.tmp 3984 4093.tmp 3700 40F1.tmp 2596 414F.tmp 1284 419D.tmp 2584 41FA.tmp 4724 4249.tmp 4728 42A6.tmp 392 42F4.tmp 1400 4333.tmp 1580 4371.tmp 748 43C0.tmp 4584 441D.tmp 1352 447B.tmp 4064 44D9.tmp 3416 4537.tmp 3016 4594.tmp 2464 45E2.tmp 1616 4640.tmp 1092 469E.tmp 3684 46FC.tmp 968 474A.tmp 556 4798.tmp 1768 47F6.tmp 4224 4853.tmp 932 48B1.tmp 2280 490F.tmp 4832 496D.tmp 3012 49CA.tmp 2924 4A28.tmp 4048 4A86.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3532 wrote to memory of 4432 3532 2024-04-24_41051f0c0e888412b33f60ee1419a740_mafia.exe 87 PID 3532 wrote to memory of 4432 3532 2024-04-24_41051f0c0e888412b33f60ee1419a740_mafia.exe 87 PID 3532 wrote to memory of 4432 3532 2024-04-24_41051f0c0e888412b33f60ee1419a740_mafia.exe 87 PID 4432 wrote to memory of 1084 4432 33E1.tmp 88 PID 4432 wrote to memory of 1084 4432 33E1.tmp 88 PID 4432 wrote to memory of 1084 4432 33E1.tmp 88 PID 1084 wrote to memory of 2208 1084 344E.tmp 89 PID 1084 wrote to memory of 2208 1084 344E.tmp 89 PID 1084 wrote to memory of 2208 1084 344E.tmp 89 PID 2208 wrote to memory of 4672 2208 34AC.tmp 90 PID 2208 wrote to memory of 4672 2208 34AC.tmp 90 PID 2208 wrote to memory of 4672 2208 34AC.tmp 90 PID 4672 wrote to memory of 316 4672 351A.tmp 91 PID 4672 wrote to memory of 316 4672 351A.tmp 91 PID 4672 wrote to memory of 316 4672 351A.tmp 91 PID 316 wrote to memory of 4196 316 3577.tmp 92 PID 316 wrote to memory of 4196 316 3577.tmp 92 PID 316 wrote to memory of 4196 316 3577.tmp 92 PID 4196 wrote to memory of 3972 4196 35D5.tmp 94 PID 4196 wrote to memory of 3972 4196 35D5.tmp 94 PID 4196 wrote to memory of 3972 4196 35D5.tmp 94 PID 3972 wrote to memory of 4040 3972 3623.tmp 95 PID 3972 wrote to memory of 4040 3972 3623.tmp 95 PID 3972 wrote to memory of 4040 3972 3623.tmp 95 PID 4040 wrote to memory of 4588 4040 3681.tmp 97 PID 4040 wrote to memory of 4588 4040 3681.tmp 97 PID 4040 wrote to memory of 4588 4040 3681.tmp 97 PID 4588 wrote to memory of 4916 4588 36DF.tmp 99 PID 4588 wrote to memory of 4916 4588 36DF.tmp 99 PID 4588 wrote to memory of 4916 4588 36DF.tmp 99 PID 4916 wrote to memory of 840 4916 375C.tmp 100 PID 4916 wrote to memory of 840 4916 375C.tmp 100 PID 4916 wrote to memory of 840 4916 375C.tmp 100 PID 840 wrote to memory of 912 840 37B9.tmp 102 PID 840 wrote to memory of 912 840 37B9.tmp 102 PID 840 wrote to memory of 912 840 37B9.tmp 102 PID 912 wrote to memory of 748 912 3817.tmp 103 PID 912 wrote to memory of 748 912 3817.tmp 103 PID 912 wrote to memory of 748 912 3817.tmp 103 PID 748 wrote to memory of 3268 748 3894.tmp 104 PID 748 wrote to memory of 3268 748 3894.tmp 104 PID 748 wrote to memory of 3268 748 3894.tmp 104 PID 3268 wrote to memory of 808 3268 38E2.tmp 105 PID 3268 wrote to memory of 808 3268 38E2.tmp 105 PID 3268 wrote to memory of 808 3268 38E2.tmp 105 PID 808 wrote to memory of 3260 808 3940.tmp 106 PID 808 wrote to memory of 3260 808 3940.tmp 106 PID 808 wrote to memory of 3260 808 3940.tmp 106 PID 3260 wrote to memory of 1688 3260 399E.tmp 107 PID 3260 wrote to memory of 1688 3260 399E.tmp 107 PID 3260 wrote to memory of 1688 3260 399E.tmp 107 PID 1688 wrote to memory of 5008 1688 3A0B.tmp 108 PID 1688 wrote to memory of 5008 1688 3A0B.tmp 108 PID 1688 wrote to memory of 5008 1688 3A0B.tmp 108 PID 5008 wrote to memory of 1132 5008 3A69.tmp 109 PID 5008 wrote to memory of 1132 5008 3A69.tmp 109 PID 5008 wrote to memory of 1132 5008 3A69.tmp 109 PID 1132 wrote to memory of 968 1132 3AB7.tmp 110 PID 1132 wrote to memory of 968 1132 3AB7.tmp 110 PID 1132 wrote to memory of 968 1132 3AB7.tmp 110 PID 968 wrote to memory of 556 968 3B24.tmp 111 PID 968 wrote to memory of 556 968 3B24.tmp 111 PID 968 wrote to memory of 556 968 3B24.tmp 111 PID 556 wrote to memory of 4224 556 3B92.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-24_41051f0c0e888412b33f60ee1419a740_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-24_41051f0c0e888412b33f60ee1419a740_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\33E1.tmp"C:\Users\Admin\AppData\Local\Temp\33E1.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\344E.tmp"C:\Users\Admin\AppData\Local\Temp\344E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\34AC.tmp"C:\Users\Admin\AppData\Local\Temp\34AC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\351A.tmp"C:\Users\Admin\AppData\Local\Temp\351A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\3577.tmp"C:\Users\Admin\AppData\Local\Temp\3577.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Users\Admin\AppData\Local\Temp\35D5.tmp"C:\Users\Admin\AppData\Local\Temp\35D5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\3623.tmp"C:\Users\Admin\AppData\Local\Temp\3623.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\3681.tmp"C:\Users\Admin\AppData\Local\Temp\3681.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\36DF.tmp"C:\Users\Admin\AppData\Local\Temp\36DF.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\375C.tmp"C:\Users\Admin\AppData\Local\Temp\375C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\37B9.tmp"C:\Users\Admin\AppData\Local\Temp\37B9.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\3817.tmp"C:\Users\Admin\AppData\Local\Temp\3817.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\3894.tmp"C:\Users\Admin\AppData\Local\Temp\3894.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\38E2.tmp"C:\Users\Admin\AppData\Local\Temp\38E2.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\3940.tmp"C:\Users\Admin\AppData\Local\Temp\3940.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\399E.tmp"C:\Users\Admin\AppData\Local\Temp\399E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\3A69.tmp"C:\Users\Admin\AppData\Local\Temp\3A69.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\3B24.tmp"C:\Users\Admin\AppData\Local\Temp\3B24.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\3B92.tmp"C:\Users\Admin\AppData\Local\Temp\3B92.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"23⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\3C3E.tmp"C:\Users\Admin\AppData\Local\Temp\3C3E.tmp"24⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\3CAB.tmp"C:\Users\Admin\AppData\Local\Temp\3CAB.tmp"25⤵
- Executes dropped EXE
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"26⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\3D47.tmp"C:\Users\Admin\AppData\Local\Temp\3D47.tmp"27⤵
- Executes dropped EXE
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"28⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\3E22.tmp"C:\Users\Admin\AppData\Local\Temp\3E22.tmp"29⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\3E70.tmp"C:\Users\Admin\AppData\Local\Temp\3E70.tmp"30⤵
- Executes dropped EXE
PID:336 -
C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"31⤵
- Executes dropped EXE
PID:348 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"32⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"33⤵
- Executes dropped EXE
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"34⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\4045.tmp"C:\Users\Admin\AppData\Local\Temp\4045.tmp"35⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\4093.tmp"C:\Users\Admin\AppData\Local\Temp\4093.tmp"36⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\40F1.tmp"C:\Users\Admin\AppData\Local\Temp\40F1.tmp"37⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\414F.tmp"C:\Users\Admin\AppData\Local\Temp\414F.tmp"38⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\419D.tmp"C:\Users\Admin\AppData\Local\Temp\419D.tmp"39⤵
- Executes dropped EXE
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"40⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"41⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\42A6.tmp"C:\Users\Admin\AppData\Local\Temp\42A6.tmp"42⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\42F4.tmp"C:\Users\Admin\AppData\Local\Temp\42F4.tmp"43⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"44⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\4371.tmp"C:\Users\Admin\AppData\Local\Temp\4371.tmp"45⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\43C0.tmp"C:\Users\Admin\AppData\Local\Temp\43C0.tmp"46⤵
- Executes dropped EXE
PID:748 -
C:\Users\Admin\AppData\Local\Temp\441D.tmp"C:\Users\Admin\AppData\Local\Temp\441D.tmp"47⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\447B.tmp"C:\Users\Admin\AppData\Local\Temp\447B.tmp"48⤵
- Executes dropped EXE
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"49⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"50⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"51⤵
- Executes dropped EXE
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"52⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"53⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"54⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"55⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"56⤵
- Executes dropped EXE
PID:968 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"57⤵
- Executes dropped EXE
PID:556 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"58⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"59⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\48B1.tmp"C:\Users\Admin\AppData\Local\Temp\48B1.tmp"60⤵
- Executes dropped EXE
PID:932 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"61⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"62⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"63⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"64⤵
- Executes dropped EXE
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"65⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"66⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"67⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"68⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"69⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"70⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"71⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"72⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"73⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"74⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"75⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"76⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"77⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"78⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"79⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"80⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"81⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"82⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"83⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"84⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"85⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"86⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"87⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"88⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"89⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"90⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"91⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"92⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"93⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"94⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"95⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"96⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"97⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"98⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"99⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"100⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"101⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"102⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"103⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"104⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"105⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"106⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"107⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"108⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"109⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"110⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"111⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"112⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"113⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"114⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"115⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"116⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"117⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"118⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"119⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"120⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"121⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"122⤵PID:3612
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-