Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24/04/2024, 13:52
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-24_83dfa1e7c946e8aa352f928898051bc5_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-24_83dfa1e7c946e8aa352f928898051bc5_mafia.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-24_83dfa1e7c946e8aa352f928898051bc5_mafia.exe
-
Size
488KB
-
MD5
83dfa1e7c946e8aa352f928898051bc5
-
SHA1
678b5d4b1c9134cb55f5bfe51075cf6076286020
-
SHA256
ca8830e92c6eccb81cd026ee4c2b23e3b0305cb135923f202e876fdd6f51b0a5
-
SHA512
daa8ec52501d50b8530ad7c7fa971f886462bcb22bf474c71acaf9528669e914d845cd1831858508d358489fd074bcc992b900f52cf57f88b127537c55b1e8f4
-
SSDEEP
12288:/U5rCOTeiD3IbUDArL7mhjxbXUDD0iiGESNZ:/UQOJD3cUW72ZU/0pLSN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1404 338E.tmp 4776 340B.tmp 3432 3479.tmp 2692 34C7.tmp 2004 3534.tmp 1460 3582.tmp 3792 35D0.tmp 4916 361E.tmp 4788 368C.tmp 1608 36F9.tmp 972 3767.tmp 3912 37D4.tmp 4596 3851.tmp 4580 38BE.tmp 2040 392C.tmp 4976 3989.tmp 4708 39E7.tmp 4728 3A35.tmp 3640 3A83.tmp 3768 3AF1.tmp 3980 3B5E.tmp 5040 3BCC.tmp 3372 3C39.tmp 4716 3C87.tmp 688 3CD5.tmp 3592 3D33.tmp 844 3D91.tmp 748 3DFE.tmp 1916 3E4C.tmp 940 3EAA.tmp 1224 3EF8.tmp 4276 3F56.tmp 2536 3FC3.tmp 3480 4011.tmp 4020 406F.tmp 3520 40BD.tmp 4380 410B.tmp 1208 4188.tmp 836 41E6.tmp 904 4244.tmp 1980 42A2.tmp 2044 42FF.tmp 2852 435D.tmp 384 43AB.tmp 4808 43F9.tmp 5000 4447.tmp 4004 4496.tmp 1624 44E4.tmp 2332 4532.tmp 3012 4580.tmp 4936 45CE.tmp 2788 462C.tmp 2716 467A.tmp 5076 46D8.tmp 4248 4735.tmp 4940 4784.tmp 3460 47E1.tmp 264 483F.tmp 4572 488D.tmp 736 48EB.tmp 4312 4939.tmp 4708 4987.tmp 212 49D5.tmp 3048 4A23.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 836 wrote to memory of 1404 836 2024-04-24_83dfa1e7c946e8aa352f928898051bc5_mafia.exe 88 PID 836 wrote to memory of 1404 836 2024-04-24_83dfa1e7c946e8aa352f928898051bc5_mafia.exe 88 PID 836 wrote to memory of 1404 836 2024-04-24_83dfa1e7c946e8aa352f928898051bc5_mafia.exe 88 PID 1404 wrote to memory of 4776 1404 338E.tmp 89 PID 1404 wrote to memory of 4776 1404 338E.tmp 89 PID 1404 wrote to memory of 4776 1404 338E.tmp 89 PID 4776 wrote to memory of 3432 4776 340B.tmp 90 PID 4776 wrote to memory of 3432 4776 340B.tmp 90 PID 4776 wrote to memory of 3432 4776 340B.tmp 90 PID 3432 wrote to memory of 2692 3432 3479.tmp 92 PID 3432 wrote to memory of 2692 3432 3479.tmp 92 PID 3432 wrote to memory of 2692 3432 3479.tmp 92 PID 2692 wrote to memory of 2004 2692 34C7.tmp 94 PID 2692 wrote to memory of 2004 2692 34C7.tmp 94 PID 2692 wrote to memory of 2004 2692 34C7.tmp 94 PID 2004 wrote to memory of 1460 2004 3534.tmp 96 PID 2004 wrote to memory of 1460 2004 3534.tmp 96 PID 2004 wrote to memory of 1460 2004 3534.tmp 96 PID 1460 wrote to memory of 3792 1460 3582.tmp 97 PID 1460 wrote to memory of 3792 1460 3582.tmp 97 PID 1460 wrote to memory of 3792 1460 3582.tmp 97 PID 3792 wrote to memory of 4916 3792 35D0.tmp 98 PID 3792 wrote to memory of 4916 3792 35D0.tmp 98 PID 3792 wrote to memory of 4916 3792 35D0.tmp 98 PID 4916 wrote to memory of 4788 4916 361E.tmp 99 PID 4916 wrote to memory of 4788 4916 361E.tmp 99 PID 4916 wrote to memory of 4788 4916 361E.tmp 99 PID 4788 wrote to memory of 1608 4788 368C.tmp 100 PID 4788 wrote to memory of 1608 4788 368C.tmp 100 PID 4788 wrote to memory of 1608 4788 368C.tmp 100 PID 1608 wrote to memory of 972 1608 36F9.tmp 101 PID 1608 wrote to memory of 972 1608 36F9.tmp 101 PID 1608 wrote to memory of 972 1608 36F9.tmp 101 PID 972 wrote to memory of 3912 972 3767.tmp 102 PID 972 wrote to memory of 3912 972 3767.tmp 102 PID 972 wrote to memory of 3912 972 3767.tmp 102 PID 3912 wrote to memory of 4596 3912 37D4.tmp 103 PID 3912 wrote to memory of 4596 3912 37D4.tmp 103 PID 3912 wrote to memory of 4596 3912 37D4.tmp 103 PID 4596 wrote to memory of 4580 4596 3851.tmp 104 PID 4596 wrote to memory of 4580 4596 3851.tmp 104 PID 4596 wrote to memory of 4580 4596 3851.tmp 104 PID 4580 wrote to memory of 2040 4580 38BE.tmp 105 PID 4580 wrote to memory of 2040 4580 38BE.tmp 105 PID 4580 wrote to memory of 2040 4580 38BE.tmp 105 PID 2040 wrote to memory of 4976 2040 392C.tmp 106 PID 2040 wrote to memory of 4976 2040 392C.tmp 106 PID 2040 wrote to memory of 4976 2040 392C.tmp 106 PID 4976 wrote to memory of 4708 4976 3989.tmp 107 PID 4976 wrote to memory of 4708 4976 3989.tmp 107 PID 4976 wrote to memory of 4708 4976 3989.tmp 107 PID 4708 wrote to memory of 4728 4708 39E7.tmp 108 PID 4708 wrote to memory of 4728 4708 39E7.tmp 108 PID 4708 wrote to memory of 4728 4708 39E7.tmp 108 PID 4728 wrote to memory of 3640 4728 3A35.tmp 109 PID 4728 wrote to memory of 3640 4728 3A35.tmp 109 PID 4728 wrote to memory of 3640 4728 3A35.tmp 109 PID 3640 wrote to memory of 3768 3640 3A83.tmp 110 PID 3640 wrote to memory of 3768 3640 3A83.tmp 110 PID 3640 wrote to memory of 3768 3640 3A83.tmp 110 PID 3768 wrote to memory of 3980 3768 3AF1.tmp 111 PID 3768 wrote to memory of 3980 3768 3AF1.tmp 111 PID 3768 wrote to memory of 3980 3768 3AF1.tmp 111 PID 3980 wrote to memory of 5040 3980 3B5E.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-24_83dfa1e7c946e8aa352f928898051bc5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-24_83dfa1e7c946e8aa352f928898051bc5_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\3479.tmp"C:\Users\Admin\AppData\Local\Temp\3479.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\34C7.tmp"C:\Users\Admin\AppData\Local\Temp\34C7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\35D0.tmp"C:\Users\Admin\AppData\Local\Temp\35D0.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\361E.tmp"C:\Users\Admin\AppData\Local\Temp\361E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\368C.tmp"C:\Users\Admin\AppData\Local\Temp\368C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\36F9.tmp"C:\Users\Admin\AppData\Local\Temp\36F9.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\3767.tmp"C:\Users\Admin\AppData\Local\Temp\3767.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\37D4.tmp"C:\Users\Admin\AppData\Local\Temp\37D4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\3851.tmp"C:\Users\Admin\AppData\Local\Temp\3851.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\38BE.tmp"C:\Users\Admin\AppData\Local\Temp\38BE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\392C.tmp"C:\Users\Admin\AppData\Local\Temp\392C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\3989.tmp"C:\Users\Admin\AppData\Local\Temp\3989.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\39E7.tmp"C:\Users\Admin\AppData\Local\Temp\39E7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\3A35.tmp"C:\Users\Admin\AppData\Local\Temp\3A35.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\3A83.tmp"C:\Users\Admin\AppData\Local\Temp\3A83.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\3AF1.tmp"C:\Users\Admin\AppData\Local\Temp\3AF1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\3B5E.tmp"C:\Users\Admin\AppData\Local\Temp\3B5E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\3BCC.tmp"C:\Users\Admin\AppData\Local\Temp\3BCC.tmp"23⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\3C39.tmp"C:\Users\Admin\AppData\Local\Temp\3C39.tmp"24⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\3C87.tmp"C:\Users\Admin\AppData\Local\Temp\3C87.tmp"25⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\3CD5.tmp"C:\Users\Admin\AppData\Local\Temp\3CD5.tmp"26⤵
- Executes dropped EXE
PID:688 -
C:\Users\Admin\AppData\Local\Temp\3D33.tmp"C:\Users\Admin\AppData\Local\Temp\3D33.tmp"27⤵
- Executes dropped EXE
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\3D91.tmp"C:\Users\Admin\AppData\Local\Temp\3D91.tmp"28⤵
- Executes dropped EXE
PID:844 -
C:\Users\Admin\AppData\Local\Temp\3DFE.tmp"C:\Users\Admin\AppData\Local\Temp\3DFE.tmp"29⤵
- Executes dropped EXE
PID:748 -
C:\Users\Admin\AppData\Local\Temp\3E4C.tmp"C:\Users\Admin\AppData\Local\Temp\3E4C.tmp"30⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"31⤵
- Executes dropped EXE
PID:940 -
C:\Users\Admin\AppData\Local\Temp\3EF8.tmp"C:\Users\Admin\AppData\Local\Temp\3EF8.tmp"32⤵
- Executes dropped EXE
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\3F56.tmp"C:\Users\Admin\AppData\Local\Temp\3F56.tmp"33⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\3FC3.tmp"C:\Users\Admin\AppData\Local\Temp\3FC3.tmp"34⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\4011.tmp"C:\Users\Admin\AppData\Local\Temp\4011.tmp"35⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\406F.tmp"C:\Users\Admin\AppData\Local\Temp\406F.tmp"36⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\40BD.tmp"C:\Users\Admin\AppData\Local\Temp\40BD.tmp"37⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\410B.tmp"C:\Users\Admin\AppData\Local\Temp\410B.tmp"38⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\4188.tmp"C:\Users\Admin\AppData\Local\Temp\4188.tmp"39⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\41E6.tmp"C:\Users\Admin\AppData\Local\Temp\41E6.tmp"40⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\4244.tmp"C:\Users\Admin\AppData\Local\Temp\4244.tmp"41⤵
- Executes dropped EXE
PID:904 -
C:\Users\Admin\AppData\Local\Temp\42A2.tmp"C:\Users\Admin\AppData\Local\Temp\42A2.tmp"42⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\42FF.tmp"C:\Users\Admin\AppData\Local\Temp\42FF.tmp"43⤵
- Executes dropped EXE
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\435D.tmp"C:\Users\Admin\AppData\Local\Temp\435D.tmp"44⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\43AB.tmp"C:\Users\Admin\AppData\Local\Temp\43AB.tmp"45⤵
- Executes dropped EXE
PID:384 -
C:\Users\Admin\AppData\Local\Temp\43F9.tmp"C:\Users\Admin\AppData\Local\Temp\43F9.tmp"46⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\4447.tmp"C:\Users\Admin\AppData\Local\Temp\4447.tmp"47⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\4496.tmp"C:\Users\Admin\AppData\Local\Temp\4496.tmp"48⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\44E4.tmp"C:\Users\Admin\AppData\Local\Temp\44E4.tmp"49⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\4532.tmp"C:\Users\Admin\AppData\Local\Temp\4532.tmp"50⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\4580.tmp"C:\Users\Admin\AppData\Local\Temp\4580.tmp"51⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\45CE.tmp"C:\Users\Admin\AppData\Local\Temp\45CE.tmp"52⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\462C.tmp"C:\Users\Admin\AppData\Local\Temp\462C.tmp"53⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\467A.tmp"C:\Users\Admin\AppData\Local\Temp\467A.tmp"54⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\46D8.tmp"C:\Users\Admin\AppData\Local\Temp\46D8.tmp"55⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\4735.tmp"C:\Users\Admin\AppData\Local\Temp\4735.tmp"56⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\4784.tmp"C:\Users\Admin\AppData\Local\Temp\4784.tmp"57⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\47E1.tmp"C:\Users\Admin\AppData\Local\Temp\47E1.tmp"58⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\483F.tmp"C:\Users\Admin\AppData\Local\Temp\483F.tmp"59⤵
- Executes dropped EXE
PID:264 -
C:\Users\Admin\AppData\Local\Temp\488D.tmp"C:\Users\Admin\AppData\Local\Temp\488D.tmp"60⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\48EB.tmp"C:\Users\Admin\AppData\Local\Temp\48EB.tmp"61⤵
- Executes dropped EXE
PID:736 -
C:\Users\Admin\AppData\Local\Temp\4939.tmp"C:\Users\Admin\AppData\Local\Temp\4939.tmp"62⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\4987.tmp"C:\Users\Admin\AppData\Local\Temp\4987.tmp"63⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\49D5.tmp"C:\Users\Admin\AppData\Local\Temp\49D5.tmp"64⤵
- Executes dropped EXE
PID:212 -
C:\Users\Admin\AppData\Local\Temp\4A23.tmp"C:\Users\Admin\AppData\Local\Temp\4A23.tmp"65⤵
- Executes dropped EXE
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\4A81.tmp"C:\Users\Admin\AppData\Local\Temp\4A81.tmp"66⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\4ACF.tmp"C:\Users\Admin\AppData\Local\Temp\4ACF.tmp"67⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\4B1D.tmp"C:\Users\Admin\AppData\Local\Temp\4B1D.tmp"68⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\4B7B.tmp"C:\Users\Admin\AppData\Local\Temp\4B7B.tmp"69⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\4BC9.tmp"C:\Users\Admin\AppData\Local\Temp\4BC9.tmp"70⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\4C17.tmp"C:\Users\Admin\AppData\Local\Temp\4C17.tmp"71⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\4C66.tmp"C:\Users\Admin\AppData\Local\Temp\4C66.tmp"72⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\4CC3.tmp"C:\Users\Admin\AppData\Local\Temp\4CC3.tmp"73⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\4D21.tmp"C:\Users\Admin\AppData\Local\Temp\4D21.tmp"74⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\4D6F.tmp"C:\Users\Admin\AppData\Local\Temp\4D6F.tmp"75⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\4DBD.tmp"C:\Users\Admin\AppData\Local\Temp\4DBD.tmp"76⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\4E0B.tmp"C:\Users\Admin\AppData\Local\Temp\4E0B.tmp"77⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\4E5A.tmp"C:\Users\Admin\AppData\Local\Temp\4E5A.tmp"78⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\4EA8.tmp"C:\Users\Admin\AppData\Local\Temp\4EA8.tmp"79⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\4EF6.tmp"C:\Users\Admin\AppData\Local\Temp\4EF6.tmp"80⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\4F54.tmp"C:\Users\Admin\AppData\Local\Temp\4F54.tmp"81⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\4FB1.tmp"C:\Users\Admin\AppData\Local\Temp\4FB1.tmp"82⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\4FFF.tmp"C:\Users\Admin\AppData\Local\Temp\4FFF.tmp"83⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\504E.tmp"C:\Users\Admin\AppData\Local\Temp\504E.tmp"84⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\508C.tmp"C:\Users\Admin\AppData\Local\Temp\508C.tmp"85⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\50DA.tmp"C:\Users\Admin\AppData\Local\Temp\50DA.tmp"86⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\5128.tmp"C:\Users\Admin\AppData\Local\Temp\5128.tmp"87⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\5176.tmp"C:\Users\Admin\AppData\Local\Temp\5176.tmp"88⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\51D4.tmp"C:\Users\Admin\AppData\Local\Temp\51D4.tmp"89⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\5222.tmp"C:\Users\Admin\AppData\Local\Temp\5222.tmp"90⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\5280.tmp"C:\Users\Admin\AppData\Local\Temp\5280.tmp"91⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\52CE.tmp"C:\Users\Admin\AppData\Local\Temp\52CE.tmp"92⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\532C.tmp"C:\Users\Admin\AppData\Local\Temp\532C.tmp"93⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\538A.tmp"C:\Users\Admin\AppData\Local\Temp\538A.tmp"94⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\53E7.tmp"C:\Users\Admin\AppData\Local\Temp\53E7.tmp"95⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\5445.tmp"C:\Users\Admin\AppData\Local\Temp\5445.tmp"96⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\54A3.tmp"C:\Users\Admin\AppData\Local\Temp\54A3.tmp"97⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\54F1.tmp"C:\Users\Admin\AppData\Local\Temp\54F1.tmp"98⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\554F.tmp"C:\Users\Admin\AppData\Local\Temp\554F.tmp"99⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\559D.tmp"C:\Users\Admin\AppData\Local\Temp\559D.tmp"100⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\55EB.tmp"C:\Users\Admin\AppData\Local\Temp\55EB.tmp"101⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\5649.tmp"C:\Users\Admin\AppData\Local\Temp\5649.tmp"102⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\5697.tmp"C:\Users\Admin\AppData\Local\Temp\5697.tmp"103⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\56F5.tmp"C:\Users\Admin\AppData\Local\Temp\56F5.tmp"104⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\5752.tmp"C:\Users\Admin\AppData\Local\Temp\5752.tmp"105⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\57B0.tmp"C:\Users\Admin\AppData\Local\Temp\57B0.tmp"106⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\580E.tmp"C:\Users\Admin\AppData\Local\Temp\580E.tmp"107⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\586C.tmp"C:\Users\Admin\AppData\Local\Temp\586C.tmp"108⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\58C9.tmp"C:\Users\Admin\AppData\Local\Temp\58C9.tmp"109⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\5918.tmp"C:\Users\Admin\AppData\Local\Temp\5918.tmp"110⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\5966.tmp"C:\Users\Admin\AppData\Local\Temp\5966.tmp"111⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\59B4.tmp"C:\Users\Admin\AppData\Local\Temp\59B4.tmp"112⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\5A02.tmp"C:\Users\Admin\AppData\Local\Temp\5A02.tmp"113⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\5A60.tmp"C:\Users\Admin\AppData\Local\Temp\5A60.tmp"114⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\5AAE.tmp"C:\Users\Admin\AppData\Local\Temp\5AAE.tmp"115⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\5B0C.tmp"C:\Users\Admin\AppData\Local\Temp\5B0C.tmp"116⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\5B5A.tmp"C:\Users\Admin\AppData\Local\Temp\5B5A.tmp"117⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\5BB7.tmp"C:\Users\Admin\AppData\Local\Temp\5BB7.tmp"118⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\5C15.tmp"C:\Users\Admin\AppData\Local\Temp\5C15.tmp"119⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\5C63.tmp"C:\Users\Admin\AppData\Local\Temp\5C63.tmp"120⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\5CB1.tmp"C:\Users\Admin\AppData\Local\Temp\5CB1.tmp"121⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\5D00.tmp"C:\Users\Admin\AppData\Local\Temp\5D00.tmp"122⤵PID:4024
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-