Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
29/04/2024, 15:55
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-29_31f781a44627331fa89ae3929b4b2fb3_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-29_31f781a44627331fa89ae3929b4b2fb3_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-04-29_31f781a44627331fa89ae3929b4b2fb3_mafia.exe
-
Size
487KB
-
MD5
31f781a44627331fa89ae3929b4b2fb3
-
SHA1
9fed567ca68c5a516b8393147054843e6699b0a7
-
SHA256
9e975564f992f8c5c2e741742ac1dccbc0668b196cd90f3d1f5084056266a334
-
SHA512
2500fe2eb61cb0b0dc7e53a2062c178ea71702a606f80429ceac84c6afbdf02dfdfa53a262c8e093871542ec8f2bf3ba9c8d4d46f3bd8c84e4e46b98c1cb5be4
-
SSDEEP
12288:yU5rCOTeiNAieTzjETYOAeKPz+yVG4bZ:yUQOJNAbTzjZzRzFVG4b
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 924 371D.tmp 1400 377B.tmp 4068 37C9.tmp 3516 3836.tmp 632 38B3.tmp 3600 3921.tmp 920 398E.tmp 4888 39FC.tmp 4912 3A4A.tmp 3740 3AB7.tmp 3220 3B05.tmp 1792 3B63.tmp 2708 3BC1.tmp 4628 3C2E.tmp 2244 3C7C.tmp 4648 3CCA.tmp 4524 3D18.tmp 1564 3D86.tmp 4460 3DD4.tmp 1336 3E32.tmp 3596 3E9F.tmp 3876 3F0C.tmp 1420 3F5B.tmp 520 3FA9.tmp 4248 3FF7.tmp 4092 4064.tmp 3160 40B2.tmp 2868 4110.tmp 3300 415E.tmp 2712 41BC.tmp 460 4229.tmp 3904 4277.tmp 220 42C6.tmp 740 4314.tmp 2316 4371.tmp 3352 43C0.tmp 3252 440E.tmp 4232 445C.tmp 2880 44AA.tmp 3164 44F8.tmp 1612 4556.tmp 1948 45B4.tmp 4780 4611.tmp 952 466F.tmp 596 470B.tmp 1952 4759.tmp 4860 47A8.tmp 1128 47F6.tmp 3956 4853.tmp 1204 48A2.tmp 4400 48F0.tmp 2232 493E.tmp 1132 499C.tmp 3516 49EA.tmp 888 4A38.tmp 2964 4A86.tmp 4864 4AD4.tmp 4612 4B22.tmp 3600 4B70.tmp 1872 4BBE.tmp 456 4C1C.tmp 4888 4C6A.tmp 1808 4CB8.tmp 2424 4D07.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1140 wrote to memory of 924 1140 2024-04-29_31f781a44627331fa89ae3929b4b2fb3_mafia.exe 82 PID 1140 wrote to memory of 924 1140 2024-04-29_31f781a44627331fa89ae3929b4b2fb3_mafia.exe 82 PID 1140 wrote to memory of 924 1140 2024-04-29_31f781a44627331fa89ae3929b4b2fb3_mafia.exe 82 PID 924 wrote to memory of 1400 924 371D.tmp 84 PID 924 wrote to memory of 1400 924 371D.tmp 84 PID 924 wrote to memory of 1400 924 371D.tmp 84 PID 1400 wrote to memory of 4068 1400 377B.tmp 85 PID 1400 wrote to memory of 4068 1400 377B.tmp 85 PID 1400 wrote to memory of 4068 1400 377B.tmp 85 PID 4068 wrote to memory of 3516 4068 37C9.tmp 87 PID 4068 wrote to memory of 3516 4068 37C9.tmp 87 PID 4068 wrote to memory of 3516 4068 37C9.tmp 87 PID 3516 wrote to memory of 632 3516 3836.tmp 89 PID 3516 wrote to memory of 632 3516 3836.tmp 89 PID 3516 wrote to memory of 632 3516 3836.tmp 89 PID 632 wrote to memory of 3600 632 38B3.tmp 90 PID 632 wrote to memory of 3600 632 38B3.tmp 90 PID 632 wrote to memory of 3600 632 38B3.tmp 90 PID 3600 wrote to memory of 920 3600 3921.tmp 91 PID 3600 wrote to memory of 920 3600 3921.tmp 91 PID 3600 wrote to memory of 920 3600 3921.tmp 91 PID 920 wrote to memory of 4888 920 398E.tmp 92 PID 920 wrote to memory of 4888 920 398E.tmp 92 PID 920 wrote to memory of 4888 920 398E.tmp 92 PID 4888 wrote to memory of 4912 4888 39FC.tmp 93 PID 4888 wrote to memory of 4912 4888 39FC.tmp 93 PID 4888 wrote to memory of 4912 4888 39FC.tmp 93 PID 4912 wrote to memory of 3740 4912 3A4A.tmp 94 PID 4912 wrote to memory of 3740 4912 3A4A.tmp 94 PID 4912 wrote to memory of 3740 4912 3A4A.tmp 94 PID 3740 wrote to memory of 3220 3740 3AB7.tmp 95 PID 3740 wrote to memory of 3220 3740 3AB7.tmp 95 PID 3740 wrote to memory of 3220 3740 3AB7.tmp 95 PID 3220 wrote to memory of 1792 3220 3B05.tmp 96 PID 3220 wrote to memory of 1792 3220 3B05.tmp 96 PID 3220 wrote to memory of 1792 3220 3B05.tmp 96 PID 1792 wrote to memory of 2708 1792 3B63.tmp 97 PID 1792 wrote to memory of 2708 1792 3B63.tmp 97 PID 1792 wrote to memory of 2708 1792 3B63.tmp 97 PID 2708 wrote to memory of 4628 2708 3BC1.tmp 98 PID 2708 wrote to memory of 4628 2708 3BC1.tmp 98 PID 2708 wrote to memory of 4628 2708 3BC1.tmp 98 PID 4628 wrote to memory of 2244 4628 3C2E.tmp 99 PID 4628 wrote to memory of 2244 4628 3C2E.tmp 99 PID 4628 wrote to memory of 2244 4628 3C2E.tmp 99 PID 2244 wrote to memory of 4648 2244 3C7C.tmp 100 PID 2244 wrote to memory of 4648 2244 3C7C.tmp 100 PID 2244 wrote to memory of 4648 2244 3C7C.tmp 100 PID 4648 wrote to memory of 4524 4648 3CCA.tmp 101 PID 4648 wrote to memory of 4524 4648 3CCA.tmp 101 PID 4648 wrote to memory of 4524 4648 3CCA.tmp 101 PID 4524 wrote to memory of 1564 4524 3D18.tmp 102 PID 4524 wrote to memory of 1564 4524 3D18.tmp 102 PID 4524 wrote to memory of 1564 4524 3D18.tmp 102 PID 1564 wrote to memory of 4460 1564 3D86.tmp 103 PID 1564 wrote to memory of 4460 1564 3D86.tmp 103 PID 1564 wrote to memory of 4460 1564 3D86.tmp 103 PID 4460 wrote to memory of 1336 4460 3DD4.tmp 104 PID 4460 wrote to memory of 1336 4460 3DD4.tmp 104 PID 4460 wrote to memory of 1336 4460 3DD4.tmp 104 PID 1336 wrote to memory of 3596 1336 3E32.tmp 105 PID 1336 wrote to memory of 3596 1336 3E32.tmp 105 PID 1336 wrote to memory of 3596 1336 3E32.tmp 105 PID 3596 wrote to memory of 3876 3596 3E9F.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-29_31f781a44627331fa89ae3929b4b2fb3_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-29_31f781a44627331fa89ae3929b4b2fb3_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\371D.tmp"C:\Users\Admin\AppData\Local\Temp\371D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\377B.tmp"C:\Users\Admin\AppData\Local\Temp\377B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\37C9.tmp"C:\Users\Admin\AppData\Local\Temp\37C9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\3836.tmp"C:\Users\Admin\AppData\Local\Temp\3836.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\38B3.tmp"C:\Users\Admin\AppData\Local\Temp\38B3.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\3921.tmp"C:\Users\Admin\AppData\Local\Temp\3921.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\398E.tmp"C:\Users\Admin\AppData\Local\Temp\398E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\39FC.tmp"C:\Users\Admin\AppData\Local\Temp\39FC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\3B05.tmp"C:\Users\Admin\AppData\Local\Temp\3B05.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\3B63.tmp"C:\Users\Admin\AppData\Local\Temp\3B63.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\3D18.tmp"C:\Users\Admin\AppData\Local\Temp\3D18.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\3D86.tmp"C:\Users\Admin\AppData\Local\Temp\3D86.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\3E32.tmp"C:\Users\Admin\AppData\Local\Temp\3E32.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"23⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"24⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"25⤵
- Executes dropped EXE
PID:520 -
C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"26⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\4064.tmp"C:\Users\Admin\AppData\Local\Temp\4064.tmp"27⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"28⤵
- Executes dropped EXE
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\4110.tmp"C:\Users\Admin\AppData\Local\Temp\4110.tmp"29⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\415E.tmp"C:\Users\Admin\AppData\Local\Temp\415E.tmp"30⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\41BC.tmp"C:\Users\Admin\AppData\Local\Temp\41BC.tmp"31⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\4229.tmp"C:\Users\Admin\AppData\Local\Temp\4229.tmp"32⤵
- Executes dropped EXE
PID:460 -
C:\Users\Admin\AppData\Local\Temp\4277.tmp"C:\Users\Admin\AppData\Local\Temp\4277.tmp"33⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\42C6.tmp"C:\Users\Admin\AppData\Local\Temp\42C6.tmp"34⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\4314.tmp"C:\Users\Admin\AppData\Local\Temp\4314.tmp"35⤵
- Executes dropped EXE
PID:740 -
C:\Users\Admin\AppData\Local\Temp\4371.tmp"C:\Users\Admin\AppData\Local\Temp\4371.tmp"36⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\43C0.tmp"C:\Users\Admin\AppData\Local\Temp\43C0.tmp"37⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"38⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"39⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\44AA.tmp"C:\Users\Admin\AppData\Local\Temp\44AA.tmp"40⤵
- Executes dropped EXE
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"41⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"42⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"43⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"44⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"45⤵
- Executes dropped EXE
PID:952 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"46⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"47⤵
- Executes dropped EXE
PID:596 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"48⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"49⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"50⤵
- Executes dropped EXE
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"51⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"52⤵
- Executes dropped EXE
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"53⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"54⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"55⤵
- Executes dropped EXE
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"56⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"57⤵
- Executes dropped EXE
PID:888 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"58⤵
- Executes dropped EXE
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"59⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"60⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"61⤵
- Executes dropped EXE
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"62⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"63⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"64⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"65⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"66⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"67⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"68⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"69⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"70⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"71⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"72⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"73⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"74⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"75⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"76⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"77⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"78⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"79⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"80⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"81⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"82⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"83⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"84⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"85⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"86⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"87⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"88⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"89⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"90⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"91⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"92⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"93⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"94⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"95⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"96⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"97⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"98⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"99⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"100⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"101⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"102⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"103⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"104⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"105⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"106⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"107⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"108⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"109⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"110⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"111⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"112⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"113⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"114⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"115⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"116⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"117⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"118⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"119⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"120⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"121⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"122⤵PID:3588
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-