Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
26/04/2024, 07:42
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-26_175ffacb5d226acabfc047a663e8b1df_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-26_175ffacb5d226acabfc047a663e8b1df_mafia.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-26_175ffacb5d226acabfc047a663e8b1df_mafia.exe
-
Size
530KB
-
MD5
175ffacb5d226acabfc047a663e8b1df
-
SHA1
01df7aa5dddd3de7a2659dee9430de92253cccfe
-
SHA256
4f4c44a8a61be69933dab487f3a40cdbf38d092861dd3f0aa90d33b754044d72
-
SHA512
aba34607f95e08f75f6403e5602c2bdfe6c9736ff63115779f559cc8d4fe0a7b04263e81c4b127fe94f17db794bc23634f1141ee8c42b74376effcab42b94a4f
-
SSDEEP
12288:AU5rCOTeio9lxpw6hp6Ehw17dXlfNZulFVg0M1:AUQOJobfwMglfNclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4612 323B.tmp 4456 32A9.tmp 2788 3316.tmp 3372 33B2.tmp 2616 3420.tmp 4424 349D.tmp 3840 34EB.tmp 3484 3558.tmp 1192 35D5.tmp 3672 3642.tmp 3184 36BF.tmp 4048 372D.tmp 1872 379A.tmp 2656 37E8.tmp 5084 3856.tmp 3604 38A4.tmp 3860 38F2.tmp 1616 395F.tmp 5080 39CD.tmp 4028 3A2A.tmp 2676 3AA7.tmp 392 3B34.tmp 1520 3BA1.tmp 4124 3C1E.tmp 1480 3C7C.tmp 2636 3CEA.tmp 2704 3D67.tmp 448 3DB5.tmp 4804 3E12.tmp 4108 3E80.tmp 1844 3EFD.tmp 2276 3F6A.tmp 2856 3FC8.tmp 396 4026.tmp 2568 4083.tmp 4524 40D2.tmp 4964 4120.tmp 1036 417D.tmp 4056 42E5.tmp 4276 4333.tmp 1508 4381.tmp 1576 43CF.tmp 1472 442D.tmp 1448 447B.tmp 4456 44D9.tmp 4060 4537.tmp 2100 4594.tmp 2604 45F2.tmp 4452 4640.tmp 3092 469E.tmp 3448 46FC.tmp 4876 474A.tmp 2504 4798.tmp 1048 47E6.tmp 4444 4834.tmp 2556 4892.tmp 1772 48F0.tmp 3960 494D.tmp 5088 49AB.tmp 3428 49F9.tmp 4184 4A57.tmp 4204 4AB5.tmp 864 4B13.tmp 4404 4B61.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3432 wrote to memory of 4612 3432 2024-04-26_175ffacb5d226acabfc047a663e8b1df_mafia.exe 85 PID 3432 wrote to memory of 4612 3432 2024-04-26_175ffacb5d226acabfc047a663e8b1df_mafia.exe 85 PID 3432 wrote to memory of 4612 3432 2024-04-26_175ffacb5d226acabfc047a663e8b1df_mafia.exe 85 PID 4612 wrote to memory of 4456 4612 323B.tmp 86 PID 4612 wrote to memory of 4456 4612 323B.tmp 86 PID 4612 wrote to memory of 4456 4612 323B.tmp 86 PID 4456 wrote to memory of 2788 4456 32A9.tmp 87 PID 4456 wrote to memory of 2788 4456 32A9.tmp 87 PID 4456 wrote to memory of 2788 4456 32A9.tmp 87 PID 2788 wrote to memory of 3372 2788 3316.tmp 88 PID 2788 wrote to memory of 3372 2788 3316.tmp 88 PID 2788 wrote to memory of 3372 2788 3316.tmp 88 PID 3372 wrote to memory of 2616 3372 33B2.tmp 91 PID 3372 wrote to memory of 2616 3372 33B2.tmp 91 PID 3372 wrote to memory of 2616 3372 33B2.tmp 91 PID 2616 wrote to memory of 4424 2616 3420.tmp 93 PID 2616 wrote to memory of 4424 2616 3420.tmp 93 PID 2616 wrote to memory of 4424 2616 3420.tmp 93 PID 4424 wrote to memory of 3840 4424 349D.tmp 94 PID 4424 wrote to memory of 3840 4424 349D.tmp 94 PID 4424 wrote to memory of 3840 4424 349D.tmp 94 PID 3840 wrote to memory of 3484 3840 34EB.tmp 95 PID 3840 wrote to memory of 3484 3840 34EB.tmp 95 PID 3840 wrote to memory of 3484 3840 34EB.tmp 95 PID 3484 wrote to memory of 1192 3484 3558.tmp 96 PID 3484 wrote to memory of 1192 3484 3558.tmp 96 PID 3484 wrote to memory of 1192 3484 3558.tmp 96 PID 1192 wrote to memory of 3672 1192 35D5.tmp 97 PID 1192 wrote to memory of 3672 1192 35D5.tmp 97 PID 1192 wrote to memory of 3672 1192 35D5.tmp 97 PID 3672 wrote to memory of 3184 3672 3642.tmp 98 PID 3672 wrote to memory of 3184 3672 3642.tmp 98 PID 3672 wrote to memory of 3184 3672 3642.tmp 98 PID 3184 wrote to memory of 4048 3184 36BF.tmp 99 PID 3184 wrote to memory of 4048 3184 36BF.tmp 99 PID 3184 wrote to memory of 4048 3184 36BF.tmp 99 PID 4048 wrote to memory of 1872 4048 372D.tmp 100 PID 4048 wrote to memory of 1872 4048 372D.tmp 100 PID 4048 wrote to memory of 1872 4048 372D.tmp 100 PID 1872 wrote to memory of 2656 1872 379A.tmp 101 PID 1872 wrote to memory of 2656 1872 379A.tmp 101 PID 1872 wrote to memory of 2656 1872 379A.tmp 101 PID 2656 wrote to memory of 5084 2656 37E8.tmp 102 PID 2656 wrote to memory of 5084 2656 37E8.tmp 102 PID 2656 wrote to memory of 5084 2656 37E8.tmp 102 PID 5084 wrote to memory of 3604 5084 3856.tmp 103 PID 5084 wrote to memory of 3604 5084 3856.tmp 103 PID 5084 wrote to memory of 3604 5084 3856.tmp 103 PID 3604 wrote to memory of 3860 3604 38A4.tmp 104 PID 3604 wrote to memory of 3860 3604 38A4.tmp 104 PID 3604 wrote to memory of 3860 3604 38A4.tmp 104 PID 3860 wrote to memory of 1616 3860 38F2.tmp 105 PID 3860 wrote to memory of 1616 3860 38F2.tmp 105 PID 3860 wrote to memory of 1616 3860 38F2.tmp 105 PID 1616 wrote to memory of 5080 1616 395F.tmp 106 PID 1616 wrote to memory of 5080 1616 395F.tmp 106 PID 1616 wrote to memory of 5080 1616 395F.tmp 106 PID 5080 wrote to memory of 4028 5080 39CD.tmp 107 PID 5080 wrote to memory of 4028 5080 39CD.tmp 107 PID 5080 wrote to memory of 4028 5080 39CD.tmp 107 PID 4028 wrote to memory of 2676 4028 3A2A.tmp 108 PID 4028 wrote to memory of 2676 4028 3A2A.tmp 108 PID 4028 wrote to memory of 2676 4028 3A2A.tmp 108 PID 2676 wrote to memory of 392 2676 3AA7.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-26_175ffacb5d226acabfc047a663e8b1df_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-26_175ffacb5d226acabfc047a663e8b1df_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\323B.tmp"C:\Users\Admin\AppData\Local\Temp\323B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\32A9.tmp"C:\Users\Admin\AppData\Local\Temp\32A9.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\3316.tmp"C:\Users\Admin\AppData\Local\Temp\3316.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\33B2.tmp"C:\Users\Admin\AppData\Local\Temp\33B2.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\3420.tmp"C:\Users\Admin\AppData\Local\Temp\3420.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\349D.tmp"C:\Users\Admin\AppData\Local\Temp\349D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\34EB.tmp"C:\Users\Admin\AppData\Local\Temp\34EB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\3558.tmp"C:\Users\Admin\AppData\Local\Temp\3558.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\35D5.tmp"C:\Users\Admin\AppData\Local\Temp\35D5.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\3642.tmp"C:\Users\Admin\AppData\Local\Temp\3642.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\36BF.tmp"C:\Users\Admin\AppData\Local\Temp\36BF.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\372D.tmp"C:\Users\Admin\AppData\Local\Temp\372D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\379A.tmp"C:\Users\Admin\AppData\Local\Temp\379A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\37E8.tmp"C:\Users\Admin\AppData\Local\Temp\37E8.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\3856.tmp"C:\Users\Admin\AppData\Local\Temp\3856.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\38A4.tmp"C:\Users\Admin\AppData\Local\Temp\38A4.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\38F2.tmp"C:\Users\Admin\AppData\Local\Temp\38F2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\395F.tmp"C:\Users\Admin\AppData\Local\Temp\395F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\39CD.tmp"C:\Users\Admin\AppData\Local\Temp\39CD.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\3AA7.tmp"C:\Users\Admin\AppData\Local\Temp\3AA7.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\3B34.tmp"C:\Users\Admin\AppData\Local\Temp\3B34.tmp"23⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"24⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"25⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"26⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"27⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\3D67.tmp"C:\Users\Admin\AppData\Local\Temp\3D67.tmp"28⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"29⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\3E12.tmp"C:\Users\Admin\AppData\Local\Temp\3E12.tmp"30⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\3E80.tmp"C:\Users\Admin\AppData\Local\Temp\3E80.tmp"31⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"32⤵
- Executes dropped EXE
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"33⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"34⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\4026.tmp"C:\Users\Admin\AppData\Local\Temp\4026.tmp"35⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\4083.tmp"C:\Users\Admin\AppData\Local\Temp\4083.tmp"36⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\40D2.tmp"C:\Users\Admin\AppData\Local\Temp\40D2.tmp"37⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\4120.tmp"C:\Users\Admin\AppData\Local\Temp\4120.tmp"38⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"39⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"40⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"41⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"42⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\43CF.tmp"C:\Users\Admin\AppData\Local\Temp\43CF.tmp"43⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"44⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\447B.tmp"C:\Users\Admin\AppData\Local\Temp\447B.tmp"45⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"46⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"47⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"48⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\45F2.tmp"C:\Users\Admin\AppData\Local\Temp\45F2.tmp"49⤵
- Executes dropped EXE
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"50⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"51⤵
- Executes dropped EXE
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"52⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"53⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"54⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"55⤵
- Executes dropped EXE
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"56⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"57⤵
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"58⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"59⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"60⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"61⤵
- Executes dropped EXE
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"62⤵
- Executes dropped EXE
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"63⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"64⤵
- Executes dropped EXE
PID:864 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"65⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"66⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"67⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"68⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"69⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"70⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"71⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"72⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"73⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"74⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"75⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"76⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"77⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"78⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"79⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"80⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"81⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"82⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"83⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"84⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"85⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"86⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"87⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"88⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"89⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"90⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"91⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"92⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"93⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"94⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"95⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"96⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"97⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"98⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"99⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"100⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"101⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"102⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"103⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"104⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"105⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"106⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"107⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"108⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"109⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"110⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"111⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"112⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"113⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"114⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"115⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"116⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"117⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"118⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"119⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"120⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"121⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"122⤵PID:2856
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-