Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25/04/2024, 07:53
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-25_eff8285a17d12d196e6f57b637b30af8_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-25_eff8285a17d12d196e6f57b637b30af8_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-25_eff8285a17d12d196e6f57b637b30af8_mafia.exe
-
Size
529KB
-
MD5
eff8285a17d12d196e6f57b637b30af8
-
SHA1
1ef444f006aff71675b44e1a798a435a01d5477b
-
SHA256
811cfadceb7401535be7193cea340bdb5aacbb210b95ade4cc150b2efb9bc555
-
SHA512
231e80acd14181a14bd63a56785dd65e72ef350b5a82a0d1e2c762e1fc1d591ca711ac9e0cb17886f1d0ab68405b7c542141337a06bb548fe91d4b23f54b0b33
-
SSDEEP
12288:NU5rCOTeijWvPVlq1Bv2LgyoaAiyKTZwlH4Hp:NUQOJjWvPy1F8bZ7TSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2812 FFFB.tmp 5004 F5.tmp 4280 1EF.tmp 2676 2CA.tmp 1992 395.tmp 4040 460.tmp 4260 54A.tmp 2568 683.tmp 4252 76D.tmp 5608 858.tmp 5392 932.tmp 5388 9EE.tmp 1644 A6B.tmp 2852 AD8.tmp 5356 B55.tmp 5516 BF2.tmp 4408 C9D.tmp 4872 D69.tmp 4360 E05.tmp 4544 EEF.tmp 5900 F5D.tmp 5932 FE9.tmp 5988 1066.tmp 5828 10E3.tmp 5504 119F.tmp 2188 126A.tmp 4020 12E7.tmp 5480 1400.tmp 2068 147D.tmp 2420 1519.tmp 1800 1596.tmp 5156 1623.tmp 4344 16BF.tmp 5800 175B.tmp 5816 17C9.tmp 2184 1846.tmp 5788 18D2.tmp 2120 194F.tmp 2160 19FB.tmp 2964 1A69.tmp 2164 1B15.tmp 4868 1BA1.tmp 6024 1C5D.tmp 3848 1CDA.tmp 1812 1D95.tmp 5208 1E41.tmp 1516 1EED.tmp 3976 1F99.tmp 2000 2016.tmp 4820 2083.tmp 3872 211F.tmp 2328 21EB.tmp 5176 2268.tmp 4824 2371.tmp 3316 23EE.tmp 4444 246B.tmp 3516 24E8.tmp 648 2575.tmp 5160 25E2.tmp 6136 266F.tmp 5056 270B.tmp 3800 2788.tmp 4884 27F5.tmp 2720 28C1.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3296 wrote to memory of 2812 3296 2024-04-25_eff8285a17d12d196e6f57b637b30af8_mafia.exe 91 PID 3296 wrote to memory of 2812 3296 2024-04-25_eff8285a17d12d196e6f57b637b30af8_mafia.exe 91 PID 3296 wrote to memory of 2812 3296 2024-04-25_eff8285a17d12d196e6f57b637b30af8_mafia.exe 91 PID 2812 wrote to memory of 5004 2812 FFFB.tmp 92 PID 2812 wrote to memory of 5004 2812 FFFB.tmp 92 PID 2812 wrote to memory of 5004 2812 FFFB.tmp 92 PID 5004 wrote to memory of 4280 5004 F5.tmp 93 PID 5004 wrote to memory of 4280 5004 F5.tmp 93 PID 5004 wrote to memory of 4280 5004 F5.tmp 93 PID 4280 wrote to memory of 2676 4280 1EF.tmp 94 PID 4280 wrote to memory of 2676 4280 1EF.tmp 94 PID 4280 wrote to memory of 2676 4280 1EF.tmp 94 PID 2676 wrote to memory of 1992 2676 2CA.tmp 95 PID 2676 wrote to memory of 1992 2676 2CA.tmp 95 PID 2676 wrote to memory of 1992 2676 2CA.tmp 95 PID 1992 wrote to memory of 4040 1992 395.tmp 96 PID 1992 wrote to memory of 4040 1992 395.tmp 96 PID 1992 wrote to memory of 4040 1992 395.tmp 96 PID 4040 wrote to memory of 4260 4040 460.tmp 97 PID 4040 wrote to memory of 4260 4040 460.tmp 97 PID 4040 wrote to memory of 4260 4040 460.tmp 97 PID 4260 wrote to memory of 2568 4260 54A.tmp 98 PID 4260 wrote to memory of 2568 4260 54A.tmp 98 PID 4260 wrote to memory of 2568 4260 54A.tmp 98 PID 2568 wrote to memory of 4252 2568 683.tmp 99 PID 2568 wrote to memory of 4252 2568 683.tmp 99 PID 2568 wrote to memory of 4252 2568 683.tmp 99 PID 4252 wrote to memory of 5608 4252 76D.tmp 100 PID 4252 wrote to memory of 5608 4252 76D.tmp 100 PID 4252 wrote to memory of 5608 4252 76D.tmp 100 PID 5608 wrote to memory of 5392 5608 858.tmp 101 PID 5608 wrote to memory of 5392 5608 858.tmp 101 PID 5608 wrote to memory of 5392 5608 858.tmp 101 PID 5392 wrote to memory of 5388 5392 932.tmp 102 PID 5392 wrote to memory of 5388 5392 932.tmp 102 PID 5392 wrote to memory of 5388 5392 932.tmp 102 PID 5388 wrote to memory of 1644 5388 9EE.tmp 103 PID 5388 wrote to memory of 1644 5388 9EE.tmp 103 PID 5388 wrote to memory of 1644 5388 9EE.tmp 103 PID 1644 wrote to memory of 2852 1644 A6B.tmp 104 PID 1644 wrote to memory of 2852 1644 A6B.tmp 104 PID 1644 wrote to memory of 2852 1644 A6B.tmp 104 PID 2852 wrote to memory of 5356 2852 AD8.tmp 105 PID 2852 wrote to memory of 5356 2852 AD8.tmp 105 PID 2852 wrote to memory of 5356 2852 AD8.tmp 105 PID 5356 wrote to memory of 5516 5356 B55.tmp 106 PID 5356 wrote to memory of 5516 5356 B55.tmp 106 PID 5356 wrote to memory of 5516 5356 B55.tmp 106 PID 5516 wrote to memory of 4408 5516 BF2.tmp 107 PID 5516 wrote to memory of 4408 5516 BF2.tmp 107 PID 5516 wrote to memory of 4408 5516 BF2.tmp 107 PID 4408 wrote to memory of 4872 4408 C9D.tmp 108 PID 4408 wrote to memory of 4872 4408 C9D.tmp 108 PID 4408 wrote to memory of 4872 4408 C9D.tmp 108 PID 4872 wrote to memory of 4360 4872 D69.tmp 109 PID 4872 wrote to memory of 4360 4872 D69.tmp 109 PID 4872 wrote to memory of 4360 4872 D69.tmp 109 PID 4360 wrote to memory of 4544 4360 E05.tmp 110 PID 4360 wrote to memory of 4544 4360 E05.tmp 110 PID 4360 wrote to memory of 4544 4360 E05.tmp 110 PID 4544 wrote to memory of 5900 4544 EEF.tmp 111 PID 4544 wrote to memory of 5900 4544 EEF.tmp 111 PID 4544 wrote to memory of 5900 4544 EEF.tmp 111 PID 5900 wrote to memory of 5932 5900 F5D.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_eff8285a17d12d196e6f57b637b30af8_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-25_eff8285a17d12d196e6f57b637b30af8_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\FFFB.tmp"C:\Users\Admin\AppData\Local\Temp\FFFB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\F5.tmp"C:\Users\Admin\AppData\Local\Temp\F5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\1EF.tmp"C:\Users\Admin\AppData\Local\Temp\1EF.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\2CA.tmp"C:\Users\Admin\AppData\Local\Temp\2CA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\395.tmp"C:\Users\Admin\AppData\Local\Temp\395.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\460.tmp"C:\Users\Admin\AppData\Local\Temp\460.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\54A.tmp"C:\Users\Admin\AppData\Local\Temp\54A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\683.tmp"C:\Users\Admin\AppData\Local\Temp\683.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\76D.tmp"C:\Users\Admin\AppData\Local\Temp\76D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\858.tmp"C:\Users\Admin\AppData\Local\Temp\858.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5608 -
C:\Users\Admin\AppData\Local\Temp\932.tmp"C:\Users\Admin\AppData\Local\Temp\932.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\9EE.tmp"C:\Users\Admin\AppData\Local\Temp\9EE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Users\Admin\AppData\Local\Temp\A6B.tmp"C:\Users\Admin\AppData\Local\Temp\A6B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\AD8.tmp"C:\Users\Admin\AppData\Local\Temp\AD8.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\B55.tmp"C:\Users\Admin\AppData\Local\Temp\B55.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Users\Admin\AppData\Local\Temp\C9D.tmp"C:\Users\Admin\AppData\Local\Temp\C9D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\D69.tmp"C:\Users\Admin\AppData\Local\Temp\D69.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\E05.tmp"C:\Users\Admin\AppData\Local\Temp\E05.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\EEF.tmp"C:\Users\Admin\AppData\Local\Temp\EEF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\F5D.tmp"C:\Users\Admin\AppData\Local\Temp\F5D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Users\Admin\AppData\Local\Temp\FE9.tmp"C:\Users\Admin\AppData\Local\Temp\FE9.tmp"23⤵
- Executes dropped EXE
PID:5932 -
C:\Users\Admin\AppData\Local\Temp\1066.tmp"C:\Users\Admin\AppData\Local\Temp\1066.tmp"24⤵
- Executes dropped EXE
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\10E3.tmp"C:\Users\Admin\AppData\Local\Temp\10E3.tmp"25⤵
- Executes dropped EXE
PID:5828 -
C:\Users\Admin\AppData\Local\Temp\119F.tmp"C:\Users\Admin\AppData\Local\Temp\119F.tmp"26⤵
- Executes dropped EXE
PID:5504 -
C:\Users\Admin\AppData\Local\Temp\126A.tmp"C:\Users\Admin\AppData\Local\Temp\126A.tmp"27⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\12E7.tmp"C:\Users\Admin\AppData\Local\Temp\12E7.tmp"28⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\1400.tmp"C:\Users\Admin\AppData\Local\Temp\1400.tmp"29⤵
- Executes dropped EXE
PID:5480 -
C:\Users\Admin\AppData\Local\Temp\147D.tmp"C:\Users\Admin\AppData\Local\Temp\147D.tmp"30⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\1519.tmp"C:\Users\Admin\AppData\Local\Temp\1519.tmp"31⤵
- Executes dropped EXE
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\1596.tmp"C:\Users\Admin\AppData\Local\Temp\1596.tmp"32⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\1623.tmp"C:\Users\Admin\AppData\Local\Temp\1623.tmp"33⤵
- Executes dropped EXE
PID:5156 -
C:\Users\Admin\AppData\Local\Temp\16BF.tmp"C:\Users\Admin\AppData\Local\Temp\16BF.tmp"34⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\175B.tmp"C:\Users\Admin\AppData\Local\Temp\175B.tmp"35⤵
- Executes dropped EXE
PID:5800 -
C:\Users\Admin\AppData\Local\Temp\17C9.tmp"C:\Users\Admin\AppData\Local\Temp\17C9.tmp"36⤵
- Executes dropped EXE
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\1846.tmp"C:\Users\Admin\AppData\Local\Temp\1846.tmp"37⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\18D2.tmp"C:\Users\Admin\AppData\Local\Temp\18D2.tmp"38⤵
- Executes dropped EXE
PID:5788 -
C:\Users\Admin\AppData\Local\Temp\194F.tmp"C:\Users\Admin\AppData\Local\Temp\194F.tmp"39⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\19FB.tmp"C:\Users\Admin\AppData\Local\Temp\19FB.tmp"40⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\1A69.tmp"C:\Users\Admin\AppData\Local\Temp\1A69.tmp"41⤵
- Executes dropped EXE
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\1B15.tmp"C:\Users\Admin\AppData\Local\Temp\1B15.tmp"42⤵
- Executes dropped EXE
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"43⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"44⤵
- Executes dropped EXE
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"45⤵
- Executes dropped EXE
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\1D95.tmp"C:\Users\Admin\AppData\Local\Temp\1D95.tmp"46⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\1E41.tmp"C:\Users\Admin\AppData\Local\Temp\1E41.tmp"47⤵
- Executes dropped EXE
PID:5208 -
C:\Users\Admin\AppData\Local\Temp\1EED.tmp"C:\Users\Admin\AppData\Local\Temp\1EED.tmp"48⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\1F99.tmp"C:\Users\Admin\AppData\Local\Temp\1F99.tmp"49⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\2016.tmp"C:\Users\Admin\AppData\Local\Temp\2016.tmp"50⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\2083.tmp"C:\Users\Admin\AppData\Local\Temp\2083.tmp"51⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\211F.tmp"C:\Users\Admin\AppData\Local\Temp\211F.tmp"52⤵
- Executes dropped EXE
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\21EB.tmp"C:\Users\Admin\AppData\Local\Temp\21EB.tmp"53⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\2268.tmp"C:\Users\Admin\AppData\Local\Temp\2268.tmp"54⤵
- Executes dropped EXE
PID:5176 -
C:\Users\Admin\AppData\Local\Temp\2371.tmp"C:\Users\Admin\AppData\Local\Temp\2371.tmp"55⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\23EE.tmp"C:\Users\Admin\AppData\Local\Temp\23EE.tmp"56⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\246B.tmp"C:\Users\Admin\AppData\Local\Temp\246B.tmp"57⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\24E8.tmp"C:\Users\Admin\AppData\Local\Temp\24E8.tmp"58⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\2575.tmp"C:\Users\Admin\AppData\Local\Temp\2575.tmp"59⤵
- Executes dropped EXE
PID:648 -
C:\Users\Admin\AppData\Local\Temp\25E2.tmp"C:\Users\Admin\AppData\Local\Temp\25E2.tmp"60⤵
- Executes dropped EXE
PID:5160 -
C:\Users\Admin\AppData\Local\Temp\266F.tmp"C:\Users\Admin\AppData\Local\Temp\266F.tmp"61⤵
- Executes dropped EXE
PID:6136 -
C:\Users\Admin\AppData\Local\Temp\270B.tmp"C:\Users\Admin\AppData\Local\Temp\270B.tmp"62⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\2788.tmp"C:\Users\Admin\AppData\Local\Temp\2788.tmp"63⤵
- Executes dropped EXE
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\27F5.tmp"C:\Users\Admin\AppData\Local\Temp\27F5.tmp"64⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\28C1.tmp"C:\Users\Admin\AppData\Local\Temp\28C1.tmp"65⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\294D.tmp"C:\Users\Admin\AppData\Local\Temp\294D.tmp"66⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\2A38.tmp"C:\Users\Admin\AppData\Local\Temp\2A38.tmp"67⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\2B41.tmp"C:\Users\Admin\AppData\Local\Temp\2B41.tmp"68⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\2BCE.tmp"C:\Users\Admin\AppData\Local\Temp\2BCE.tmp"69⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"70⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\2CF7.tmp"C:\Users\Admin\AppData\Local\Temp\2CF7.tmp"71⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\2D83.tmp"C:\Users\Admin\AppData\Local\Temp\2D83.tmp"72⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\2E20.tmp"C:\Users\Admin\AppData\Local\Temp\2E20.tmp"73⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\2F29.tmp"C:\Users\Admin\AppData\Local\Temp\2F29.tmp"74⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\2FC5.tmp"C:\Users\Admin\AppData\Local\Temp\2FC5.tmp"75⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\3062.tmp"C:\Users\Admin\AppData\Local\Temp\3062.tmp"76⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\312D.tmp"C:\Users\Admin\AppData\Local\Temp\312D.tmp"77⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\31AA.tmp"C:\Users\Admin\AppData\Local\Temp\31AA.tmp"78⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\3236.tmp"C:\Users\Admin\AppData\Local\Temp\3236.tmp"79⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\32D3.tmp"C:\Users\Admin\AppData\Local\Temp\32D3.tmp"80⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\3340.tmp"C:\Users\Admin\AppData\Local\Temp\3340.tmp"81⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"82⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"83⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\34C7.tmp"C:\Users\Admin\AppData\Local\Temp\34C7.tmp"84⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"85⤵PID:5604
-
C:\Users\Admin\AppData\Local\Temp\35C1.tmp"C:\Users\Admin\AppData\Local\Temp\35C1.tmp"86⤵PID:5584
-
C:\Users\Admin\AppData\Local\Temp\362E.tmp"C:\Users\Admin\AppData\Local\Temp\362E.tmp"87⤵PID:5432
-
C:\Users\Admin\AppData\Local\Temp\36DA.tmp"C:\Users\Admin\AppData\Local\Temp\36DA.tmp"88⤵PID:5440
-
C:\Users\Admin\AppData\Local\Temp\3786.tmp"C:\Users\Admin\AppData\Local\Temp\3786.tmp"89⤵PID:5768
-
C:\Users\Admin\AppData\Local\Temp\3822.tmp"C:\Users\Admin\AppData\Local\Temp\3822.tmp"90⤵PID:5340
-
C:\Users\Admin\AppData\Local\Temp\38AF.tmp"C:\Users\Admin\AppData\Local\Temp\38AF.tmp"91⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\394B.tmp"C:\Users\Admin\AppData\Local\Temp\394B.tmp"92⤵PID:5332
-
C:\Users\Admin\AppData\Local\Temp\39D8.tmp"C:\Users\Admin\AppData\Local\Temp\39D8.tmp"93⤵PID:5372
-
C:\Users\Admin\AppData\Local\Temp\3A64.tmp"C:\Users\Admin\AppData\Local\Temp\3A64.tmp"94⤵PID:5568
-
C:\Users\Admin\AppData\Local\Temp\3B10.tmp"C:\Users\Admin\AppData\Local\Temp\3B10.tmp"95⤵PID:5316
-
C:\Users\Admin\AppData\Local\Temp\3B9D.tmp"C:\Users\Admin\AppData\Local\Temp\3B9D.tmp"96⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\3C49.tmp"C:\Users\Admin\AppData\Local\Temp\3C49.tmp"97⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\3CF4.tmp"C:\Users\Admin\AppData\Local\Temp\3CF4.tmp"98⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\3D62.tmp"C:\Users\Admin\AppData\Local\Temp\3D62.tmp"99⤵PID:5984
-
C:\Users\Admin\AppData\Local\Temp\3DEE.tmp"C:\Users\Admin\AppData\Local\Temp\3DEE.tmp"100⤵PID:5872
-
C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"101⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\3F17.tmp"C:\Users\Admin\AppData\Local\Temp\3F17.tmp"102⤵PID:5512
-
C:\Users\Admin\AppData\Local\Temp\3F94.tmp"C:\Users\Admin\AppData\Local\Temp\3F94.tmp"103⤵PID:5536
-
C:\Users\Admin\AppData\Local\Temp\4050.tmp"C:\Users\Admin\AppData\Local\Temp\4050.tmp"104⤵PID:5476
-
C:\Users\Admin\AppData\Local\Temp\40BD.tmp"C:\Users\Admin\AppData\Local\Temp\40BD.tmp"105⤵PID:5480
-
C:\Users\Admin\AppData\Local\Temp\414A.tmp"C:\Users\Admin\AppData\Local\Temp\414A.tmp"106⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\41B7.tmp"C:\Users\Admin\AppData\Local\Temp\41B7.tmp"107⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\4234.tmp"C:\Users\Admin\AppData\Local\Temp\4234.tmp"108⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\42D0.tmp"C:\Users\Admin\AppData\Local\Temp\42D0.tmp"109⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\437C.tmp"C:\Users\Admin\AppData\Local\Temp\437C.tmp"110⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\4419.tmp"C:\Users\Admin\AppData\Local\Temp\4419.tmp"111⤵PID:5256
-
C:\Users\Admin\AppData\Local\Temp\44B5.tmp"C:\Users\Admin\AppData\Local\Temp\44B5.tmp"112⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\4551.tmp"C:\Users\Admin\AppData\Local\Temp\4551.tmp"113⤵PID:5188
-
C:\Users\Admin\AppData\Local\Temp\45BE.tmp"C:\Users\Admin\AppData\Local\Temp\45BE.tmp"114⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\465B.tmp"C:\Users\Admin\AppData\Local\Temp\465B.tmp"115⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\46D8.tmp"C:\Users\Admin\AppData\Local\Temp\46D8.tmp"116⤵PID:5848
-
C:\Users\Admin\AppData\Local\Temp\4745.tmp"C:\Users\Admin\AppData\Local\Temp\4745.tmp"117⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\47B2.tmp"C:\Users\Admin\AppData\Local\Temp\47B2.tmp"118⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\482F.tmp"C:\Users\Admin\AppData\Local\Temp\482F.tmp"119⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\48CC.tmp"C:\Users\Admin\AppData\Local\Temp\48CC.tmp"120⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\4958.tmp"C:\Users\Admin\AppData\Local\Temp\4958.tmp"121⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\49C6.tmp"C:\Users\Admin\AppData\Local\Temp\49C6.tmp"122⤵PID:1280
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-