Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
115s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30/04/2024, 11:21
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-30_565b676638011797460f5bcb33b9fa85_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-30_565b676638011797460f5bcb33b9fa85_mafia.exe
Resource
win10v2004-20240426-en
Errors
General
-
Target
2024-04-30_565b676638011797460f5bcb33b9fa85_mafia.exe
-
Size
527KB
-
MD5
565b676638011797460f5bcb33b9fa85
-
SHA1
50bfdafe8bfd857c4b66b7f28783c49cfb022ea1
-
SHA256
0999370f58413a15da9d907896355aa3ee68cd622174d9d1baec5b5f3d1ef0f0
-
SHA512
3f71d1d8930ca385baf9b4fa5f0a13b2af81225cc6f22a2941ada9c49e8b3ba2e8c11098aa7f664fd846867940c3f7f4d4553603d22c759983d0d3dc87cf5caa
-
SSDEEP
12288:fU5rCOTeid/q+ApsGBNFgdBDBT+YcumDZu:fUQOJd/q+ApsGZitB6lDo
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4004 39CD.tmp 528 3A1B.tmp 3500 3A79.tmp 1484 3AE6.tmp 1088 3B44.tmp 1364 3BB1.tmp 2672 3C0F.tmp 2744 3C7C.tmp 1900 3CF9.tmp 3504 3D67.tmp 4704 3DB5.tmp 1688 3E03.tmp 3696 3E70.tmp 4076 3EBE.tmp 4864 3F1C.tmp 1508 3F7A.tmp 1728 3FF7.tmp 3756 4064.tmp 2304 40B2.tmp 2240 4120.tmp 3060 419D.tmp 776 41FA.tmp 1152 4277.tmp 2824 42C6.tmp 3496 4333.tmp 3648 4381.tmp 3388 43DF.tmp 2012 444C.tmp 3612 449A.tmp 4720 44E8.tmp 1300 4546.tmp 1352 4594.tmp 1620 4602.tmp 2984 465F.tmp 4968 46BD.tmp 408 470B.tmp 3364 4759.tmp 2696 47A8.tmp 3420 47F6.tmp 1584 4853.tmp 4112 48B1.tmp 936 48FF.tmp 448 494D.tmp 4128 499C.tmp 3264 49F9.tmp 2756 4A47.tmp 1816 4A96.tmp 312 4AE4.tmp 3712 4B32.tmp 2348 4B70.tmp 1212 4BCE.tmp 5012 4C1C.tmp 2208 4C6A.tmp 4524 4CB8.tmp 4252 4D07.tmp 1436 4D74.tmp 4916 4DC2.tmp 528 4E20.tmp 4240 4E6E.tmp 3128 4ECC.tmp 4928 4F29.tmp 2592 4F87.tmp 1484 4FE5.tmp 4972 5033.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3112 wrote to memory of 4004 3112 2024-04-30_565b676638011797460f5bcb33b9fa85_mafia.exe 82 PID 3112 wrote to memory of 4004 3112 2024-04-30_565b676638011797460f5bcb33b9fa85_mafia.exe 82 PID 3112 wrote to memory of 4004 3112 2024-04-30_565b676638011797460f5bcb33b9fa85_mafia.exe 82 PID 4004 wrote to memory of 528 4004 39CD.tmp 83 PID 4004 wrote to memory of 528 4004 39CD.tmp 83 PID 4004 wrote to memory of 528 4004 39CD.tmp 83 PID 528 wrote to memory of 3500 528 3A1B.tmp 85 PID 528 wrote to memory of 3500 528 3A1B.tmp 85 PID 528 wrote to memory of 3500 528 3A1B.tmp 85 PID 3500 wrote to memory of 1484 3500 3A79.tmp 87 PID 3500 wrote to memory of 1484 3500 3A79.tmp 87 PID 3500 wrote to memory of 1484 3500 3A79.tmp 87 PID 1484 wrote to memory of 1088 1484 3AE6.tmp 88 PID 1484 wrote to memory of 1088 1484 3AE6.tmp 88 PID 1484 wrote to memory of 1088 1484 3AE6.tmp 88 PID 1088 wrote to memory of 1364 1088 3B44.tmp 90 PID 1088 wrote to memory of 1364 1088 3B44.tmp 90 PID 1088 wrote to memory of 1364 1088 3B44.tmp 90 PID 1364 wrote to memory of 2672 1364 3BB1.tmp 91 PID 1364 wrote to memory of 2672 1364 3BB1.tmp 91 PID 1364 wrote to memory of 2672 1364 3BB1.tmp 91 PID 2672 wrote to memory of 2744 2672 3C0F.tmp 92 PID 2672 wrote to memory of 2744 2672 3C0F.tmp 92 PID 2672 wrote to memory of 2744 2672 3C0F.tmp 92 PID 2744 wrote to memory of 1900 2744 3C7C.tmp 93 PID 2744 wrote to memory of 1900 2744 3C7C.tmp 93 PID 2744 wrote to memory of 1900 2744 3C7C.tmp 93 PID 1900 wrote to memory of 3504 1900 3CF9.tmp 94 PID 1900 wrote to memory of 3504 1900 3CF9.tmp 94 PID 1900 wrote to memory of 3504 1900 3CF9.tmp 94 PID 3504 wrote to memory of 4704 3504 3D67.tmp 95 PID 3504 wrote to memory of 4704 3504 3D67.tmp 95 PID 3504 wrote to memory of 4704 3504 3D67.tmp 95 PID 4704 wrote to memory of 1688 4704 3DB5.tmp 96 PID 4704 wrote to memory of 1688 4704 3DB5.tmp 96 PID 4704 wrote to memory of 1688 4704 3DB5.tmp 96 PID 1688 wrote to memory of 3696 1688 3E03.tmp 97 PID 1688 wrote to memory of 3696 1688 3E03.tmp 97 PID 1688 wrote to memory of 3696 1688 3E03.tmp 97 PID 3696 wrote to memory of 4076 3696 3E70.tmp 98 PID 3696 wrote to memory of 4076 3696 3E70.tmp 98 PID 3696 wrote to memory of 4076 3696 3E70.tmp 98 PID 4076 wrote to memory of 4864 4076 3EBE.tmp 99 PID 4076 wrote to memory of 4864 4076 3EBE.tmp 99 PID 4076 wrote to memory of 4864 4076 3EBE.tmp 99 PID 4864 wrote to memory of 1508 4864 3F1C.tmp 100 PID 4864 wrote to memory of 1508 4864 3F1C.tmp 100 PID 4864 wrote to memory of 1508 4864 3F1C.tmp 100 PID 1508 wrote to memory of 1728 1508 3F7A.tmp 101 PID 1508 wrote to memory of 1728 1508 3F7A.tmp 101 PID 1508 wrote to memory of 1728 1508 3F7A.tmp 101 PID 1728 wrote to memory of 3756 1728 3FF7.tmp 102 PID 1728 wrote to memory of 3756 1728 3FF7.tmp 102 PID 1728 wrote to memory of 3756 1728 3FF7.tmp 102 PID 3756 wrote to memory of 2304 3756 4064.tmp 103 PID 3756 wrote to memory of 2304 3756 4064.tmp 103 PID 3756 wrote to memory of 2304 3756 4064.tmp 103 PID 2304 wrote to memory of 2240 2304 40B2.tmp 104 PID 2304 wrote to memory of 2240 2304 40B2.tmp 104 PID 2304 wrote to memory of 2240 2304 40B2.tmp 104 PID 2240 wrote to memory of 3060 2240 4120.tmp 105 PID 2240 wrote to memory of 3060 2240 4120.tmp 105 PID 2240 wrote to memory of 3060 2240 4120.tmp 105 PID 3060 wrote to memory of 776 3060 419D.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-30_565b676638011797460f5bcb33b9fa85_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-30_565b676638011797460f5bcb33b9fa85_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\39CD.tmp"C:\Users\Admin\AppData\Local\Temp\39CD.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\3A1B.tmp"C:\Users\Admin\AppData\Local\Temp\3A1B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Users\Admin\AppData\Local\Temp\3A79.tmp"C:\Users\Admin\AppData\Local\Temp\3A79.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\3B44.tmp"C:\Users\Admin\AppData\Local\Temp\3B44.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\3BB1.tmp"C:\Users\Admin\AppData\Local\Temp\3BB1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\3C0F.tmp"C:\Users\Admin\AppData\Local\Temp\3C0F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\3D67.tmp"C:\Users\Admin\AppData\Local\Temp\3D67.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\3E03.tmp"C:\Users\Admin\AppData\Local\Temp\3E03.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\3E70.tmp"C:\Users\Admin\AppData\Local\Temp\3E70.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\4064.tmp"C:\Users\Admin\AppData\Local\Temp\4064.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\4120.tmp"C:\Users\Admin\AppData\Local\Temp\4120.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\419D.tmp"C:\Users\Admin\AppData\Local\Temp\419D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"23⤵
- Executes dropped EXE
PID:776 -
C:\Users\Admin\AppData\Local\Temp\4277.tmp"C:\Users\Admin\AppData\Local\Temp\4277.tmp"24⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\42C6.tmp"C:\Users\Admin\AppData\Local\Temp\42C6.tmp"25⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"26⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"27⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"28⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"29⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"30⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"31⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"32⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"33⤵
- Executes dropped EXE
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\4602.tmp"C:\Users\Admin\AppData\Local\Temp\4602.tmp"34⤵
- Executes dropped EXE
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"35⤵
- Executes dropped EXE
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"36⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"37⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"38⤵
- Executes dropped EXE
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"39⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"40⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"41⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\48B1.tmp"C:\Users\Admin\AppData\Local\Temp\48B1.tmp"42⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"43⤵
- Executes dropped EXE
PID:936 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"44⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"45⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"46⤵
- Executes dropped EXE
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"47⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"48⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"49⤵
- Executes dropped EXE
PID:312 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"50⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"51⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"52⤵
- Executes dropped EXE
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"53⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"54⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"55⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"56⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"57⤵
- Executes dropped EXE
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"58⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"59⤵
- Executes dropped EXE
PID:528 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"60⤵
- Executes dropped EXE
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"61⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"62⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"63⤵
- Executes dropped EXE
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"64⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"65⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"66⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"67⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"68⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"69⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"70⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"71⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"72⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"73⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"74⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"75⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"76⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"77⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"78⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"79⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"80⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"81⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"82⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"83⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"84⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"85⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"86⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"87⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"88⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"89⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"90⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"91⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"92⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"93⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"94⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"95⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"96⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"97⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"98⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"99⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"100⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"101⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"102⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"103⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"104⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"105⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"106⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"107⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"108⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"109⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"110⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"111⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"112⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"113⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"114⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"115⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"116⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"117⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"118⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"119⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"120⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"121⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"122⤵PID:4688
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-