Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
25/04/2024, 04:28
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-25_ac7475ad2c16c8a488d4ca797fbbdd58_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-25_ac7475ad2c16c8a488d4ca797fbbdd58_mafia.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-25_ac7475ad2c16c8a488d4ca797fbbdd58_mafia.exe
-
Size
520KB
-
MD5
ac7475ad2c16c8a488d4ca797fbbdd58
-
SHA1
e5e320a4790051326603272d6e3c26c4c4883356
-
SHA256
8f1dfbc57ed2a3c9f497eb0e31760f2146cc414b8c05cf212953abb7c6530655
-
SHA512
87298bcea204477592e72adbf03c37e1a67ab862a41af9f0be4b8824f4071a4194914bda4dbd0e6d730f7e9a8146615e2166f6a0604dd410ce6f777ee1b95913
-
SSDEEP
12288:gj8fuxR21t5i8fJo3z2uj50nVGKzU5VdXkjeP6YNZ:gj8fuK1GYJoj2m0VzgkKSYN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4600 37B9.tmp 1076 3827.tmp 3896 3894.tmp 2524 3902.tmp 4516 395F.tmp 4980 39BD.tmp 2380 3A1B.tmp 2272 3A79.tmp 2608 3AD6.tmp 4232 3B24.tmp 1736 3B73.tmp 1008 3BC1.tmp 3928 3C1E.tmp 2612 3C7C.tmp 2956 3CDA.tmp 2460 3D28.tmp 4320 3D76.tmp 2128 3DB5.tmp 2480 3E22.tmp 2432 3E80.tmp 4972 3ECE.tmp 1640 3F1C.tmp 4744 3F7A.tmp 1864 3FC8.tmp 2988 4016.tmp 4668 4064.tmp 2692 40B2.tmp 3172 4110.tmp 4044 418D.tmp 4640 41DB.tmp 2772 4229.tmp 4788 4287.tmp 3484 42D5.tmp 224 4323.tmp 1960 4371.tmp 4040 43C0.tmp 2760 440E.tmp 4060 445C.tmp 216 44AA.tmp 2028 44E8.tmp 5100 4537.tmp 3580 4585.tmp 1468 45D3.tmp 4176 4621.tmp 3512 466F.tmp 4872 46BD.tmp 5048 471B.tmp 4536 4769.tmp 2384 47B7.tmp 2380 4805.tmp 2560 4863.tmp 3076 48B1.tmp 1736 491F.tmp 3956 497C.tmp 1088 49DA.tmp 3928 4A28.tmp 5076 4A96.tmp 2600 4AF3.tmp 2604 4B51.tmp 3932 4B9F.tmp 1208 4C0D.tmp 1508 4C5B.tmp 2936 4CA9.tmp 3544 4CF7.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4852 wrote to memory of 4600 4852 2024-04-25_ac7475ad2c16c8a488d4ca797fbbdd58_mafia.exe 84 PID 4852 wrote to memory of 4600 4852 2024-04-25_ac7475ad2c16c8a488d4ca797fbbdd58_mafia.exe 84 PID 4852 wrote to memory of 4600 4852 2024-04-25_ac7475ad2c16c8a488d4ca797fbbdd58_mafia.exe 84 PID 4600 wrote to memory of 1076 4600 37B9.tmp 85 PID 4600 wrote to memory of 1076 4600 37B9.tmp 85 PID 4600 wrote to memory of 1076 4600 37B9.tmp 85 PID 1076 wrote to memory of 3896 1076 3827.tmp 89 PID 1076 wrote to memory of 3896 1076 3827.tmp 89 PID 1076 wrote to memory of 3896 1076 3827.tmp 89 PID 3896 wrote to memory of 2524 3896 3894.tmp 90 PID 3896 wrote to memory of 2524 3896 3894.tmp 90 PID 3896 wrote to memory of 2524 3896 3894.tmp 90 PID 2524 wrote to memory of 4516 2524 3902.tmp 91 PID 2524 wrote to memory of 4516 2524 3902.tmp 91 PID 2524 wrote to memory of 4516 2524 3902.tmp 91 PID 4516 wrote to memory of 4980 4516 395F.tmp 92 PID 4516 wrote to memory of 4980 4516 395F.tmp 92 PID 4516 wrote to memory of 4980 4516 395F.tmp 92 PID 4980 wrote to memory of 2380 4980 39BD.tmp 93 PID 4980 wrote to memory of 2380 4980 39BD.tmp 93 PID 4980 wrote to memory of 2380 4980 39BD.tmp 93 PID 2380 wrote to memory of 2272 2380 3A1B.tmp 94 PID 2380 wrote to memory of 2272 2380 3A1B.tmp 94 PID 2380 wrote to memory of 2272 2380 3A1B.tmp 94 PID 2272 wrote to memory of 2608 2272 3A79.tmp 95 PID 2272 wrote to memory of 2608 2272 3A79.tmp 95 PID 2272 wrote to memory of 2608 2272 3A79.tmp 95 PID 2608 wrote to memory of 4232 2608 3AD6.tmp 96 PID 2608 wrote to memory of 4232 2608 3AD6.tmp 96 PID 2608 wrote to memory of 4232 2608 3AD6.tmp 96 PID 4232 wrote to memory of 1736 4232 3B24.tmp 97 PID 4232 wrote to memory of 1736 4232 3B24.tmp 97 PID 4232 wrote to memory of 1736 4232 3B24.tmp 97 PID 1736 wrote to memory of 1008 1736 3B73.tmp 98 PID 1736 wrote to memory of 1008 1736 3B73.tmp 98 PID 1736 wrote to memory of 1008 1736 3B73.tmp 98 PID 1008 wrote to memory of 3928 1008 3BC1.tmp 99 PID 1008 wrote to memory of 3928 1008 3BC1.tmp 99 PID 1008 wrote to memory of 3928 1008 3BC1.tmp 99 PID 3928 wrote to memory of 2612 3928 3C1E.tmp 100 PID 3928 wrote to memory of 2612 3928 3C1E.tmp 100 PID 3928 wrote to memory of 2612 3928 3C1E.tmp 100 PID 2612 wrote to memory of 2956 2612 3C7C.tmp 101 PID 2612 wrote to memory of 2956 2612 3C7C.tmp 101 PID 2612 wrote to memory of 2956 2612 3C7C.tmp 101 PID 2956 wrote to memory of 2460 2956 3CDA.tmp 102 PID 2956 wrote to memory of 2460 2956 3CDA.tmp 102 PID 2956 wrote to memory of 2460 2956 3CDA.tmp 102 PID 2460 wrote to memory of 4320 2460 3D28.tmp 103 PID 2460 wrote to memory of 4320 2460 3D28.tmp 103 PID 2460 wrote to memory of 4320 2460 3D28.tmp 103 PID 4320 wrote to memory of 2128 4320 3D76.tmp 104 PID 4320 wrote to memory of 2128 4320 3D76.tmp 104 PID 4320 wrote to memory of 2128 4320 3D76.tmp 104 PID 2128 wrote to memory of 2480 2128 3DB5.tmp 105 PID 2128 wrote to memory of 2480 2128 3DB5.tmp 105 PID 2128 wrote to memory of 2480 2128 3DB5.tmp 105 PID 2480 wrote to memory of 2432 2480 3E22.tmp 106 PID 2480 wrote to memory of 2432 2480 3E22.tmp 106 PID 2480 wrote to memory of 2432 2480 3E22.tmp 106 PID 2432 wrote to memory of 4972 2432 3E80.tmp 107 PID 2432 wrote to memory of 4972 2432 3E80.tmp 107 PID 2432 wrote to memory of 4972 2432 3E80.tmp 107 PID 4972 wrote to memory of 1640 4972 3ECE.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_ac7475ad2c16c8a488d4ca797fbbdd58_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-25_ac7475ad2c16c8a488d4ca797fbbdd58_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\37B9.tmp"C:\Users\Admin\AppData\Local\Temp\37B9.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\3827.tmp"C:\Users\Admin\AppData\Local\Temp\3827.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\3894.tmp"C:\Users\Admin\AppData\Local\Temp\3894.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\3902.tmp"C:\Users\Admin\AppData\Local\Temp\3902.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\395F.tmp"C:\Users\Admin\AppData\Local\Temp\395F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\39BD.tmp"C:\Users\Admin\AppData\Local\Temp\39BD.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\3A1B.tmp"C:\Users\Admin\AppData\Local\Temp\3A1B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\3A79.tmp"C:\Users\Admin\AppData\Local\Temp\3A79.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\3B24.tmp"C:\Users\Admin\AppData\Local\Temp\3B24.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\3B73.tmp"C:\Users\Admin\AppData\Local\Temp\3B73.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\3D28.tmp"C:\Users\Admin\AppData\Local\Temp\3D28.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\3D76.tmp"C:\Users\Admin\AppData\Local\Temp\3D76.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\3E22.tmp"C:\Users\Admin\AppData\Local\Temp\3E22.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\3E80.tmp"C:\Users\Admin\AppData\Local\Temp\3E80.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"23⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"24⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"25⤵
- Executes dropped EXE
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\4016.tmp"C:\Users\Admin\AppData\Local\Temp\4016.tmp"26⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\4064.tmp"C:\Users\Admin\AppData\Local\Temp\4064.tmp"27⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"28⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\4110.tmp"C:\Users\Admin\AppData\Local\Temp\4110.tmp"29⤵
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\418D.tmp"C:\Users\Admin\AppData\Local\Temp\418D.tmp"30⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\41DB.tmp"C:\Users\Admin\AppData\Local\Temp\41DB.tmp"31⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\4229.tmp"C:\Users\Admin\AppData\Local\Temp\4229.tmp"32⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\4287.tmp"C:\Users\Admin\AppData\Local\Temp\4287.tmp"33⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"34⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"35⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\4371.tmp"C:\Users\Admin\AppData\Local\Temp\4371.tmp"36⤵
- Executes dropped EXE
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\43C0.tmp"C:\Users\Admin\AppData\Local\Temp\43C0.tmp"37⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"38⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"39⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\44AA.tmp"C:\Users\Admin\AppData\Local\Temp\44AA.tmp"40⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"41⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"42⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"43⤵
- Executes dropped EXE
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\45D3.tmp"C:\Users\Admin\AppData\Local\Temp\45D3.tmp"44⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"45⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"46⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"47⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"48⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"49⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"50⤵
- Executes dropped EXE
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"51⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"52⤵
- Executes dropped EXE
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\48B1.tmp"C:\Users\Admin\AppData\Local\Temp\48B1.tmp"53⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"54⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"55⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"56⤵
- Executes dropped EXE
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"57⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"58⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"59⤵
- Executes dropped EXE
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"60⤵
- Executes dropped EXE
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"61⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"62⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"63⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"64⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"65⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"66⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"67⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"68⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"69⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"70⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"71⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"72⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"73⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"74⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"75⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"76⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"77⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"78⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"79⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"80⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"81⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"82⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"83⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"84⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"85⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"86⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"87⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"88⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"89⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"90⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"91⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"92⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"93⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"94⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"95⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"96⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"97⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"98⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"99⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"100⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"101⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"102⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"103⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"104⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"105⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"106⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"107⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"108⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"109⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"110⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"111⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"112⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"113⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"114⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"115⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"116⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"117⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"118⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"119⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"120⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"121⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"122⤵PID:4852
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-