Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02/05/2024, 19:50
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-02_47f7ff2df1c1bb629e876fc3dfa58d01_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-05-02_47f7ff2df1c1bb629e876fc3dfa58d01_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-02_47f7ff2df1c1bb629e876fc3dfa58d01_mafia.exe
-
Size
486KB
-
MD5
47f7ff2df1c1bb629e876fc3dfa58d01
-
SHA1
a784457c623f5f02251d23cf23c24ac584415c2f
-
SHA256
d134901d5eadbcd79ee1825d604c520811988deaf9d2cd7fe599bd05ce8064ec
-
SHA512
1ef52f0266e49724a2c3ae738041f14339f8fd47d826e7fa348c3b99c8d9714b368a0ea2b2a26a149010d8649540e803515a702ae8573c46461f399f4acfdd90
-
SSDEEP
12288:UU5rCOTeiDcNqBT1wFJoJhnIj1H0b+/NZ:UUQOJDciSFJAF20q/N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3164 3335.tmp 464 33C2.tmp 3556 3420.tmp 3124 346E.tmp 5004 34BC.tmp 3836 351A.tmp 1776 3587.tmp 1968 35E5.tmp 5036 3633.tmp 4876 3681.tmp 4844 36EE.tmp 1948 373C.tmp 5020 378B.tmp 3532 37E8.tmp 5000 3856.tmp 1988 38B3.tmp 1812 3911.tmp 4692 395F.tmp 3956 39AD.tmp 212 39FC.tmp 2908 3A4A.tmp 3704 3A98.tmp 5032 3AE6.tmp 4748 3B34.tmp 2848 3B82.tmp 4092 3BD0.tmp 896 3C1E.tmp 1740 3C7C.tmp 3772 3CEA.tmp 4544 3D38.tmp 4920 3D86.tmp 3252 3DE4.tmp 3524 3E32.tmp 1448 3E80.tmp 5108 3ECE.tmp 1960 3F1C.tmp 1808 3F6A.tmp 228 3FB8.tmp 3376 4016.tmp 3144 4064.tmp 3924 40B2.tmp 2316 4100.tmp 4432 414F.tmp 3824 419D.tmp 1524 41EB.tmp 3164 4239.tmp 4052 4287.tmp 4744 42E5.tmp 5012 4333.tmp 636 4381.tmp 876 43EE.tmp 916 446B.tmp 740 44D9.tmp 4020 4546.tmp 720 45B4.tmp 4148 4611.tmp 3136 469E.tmp 8 470B.tmp 1656 4779.tmp 652 4805.tmp 1732 4873.tmp 2088 48F0.tmp 1572 494D.tmp 1948 49AB.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2512 wrote to memory of 3164 2512 2024-05-02_47f7ff2df1c1bb629e876fc3dfa58d01_mafia.exe 81 PID 2512 wrote to memory of 3164 2512 2024-05-02_47f7ff2df1c1bb629e876fc3dfa58d01_mafia.exe 81 PID 2512 wrote to memory of 3164 2512 2024-05-02_47f7ff2df1c1bb629e876fc3dfa58d01_mafia.exe 81 PID 3164 wrote to memory of 464 3164 3335.tmp 83 PID 3164 wrote to memory of 464 3164 3335.tmp 83 PID 3164 wrote to memory of 464 3164 3335.tmp 83 PID 464 wrote to memory of 3556 464 33C2.tmp 85 PID 464 wrote to memory of 3556 464 33C2.tmp 85 PID 464 wrote to memory of 3556 464 33C2.tmp 85 PID 3556 wrote to memory of 3124 3556 3420.tmp 87 PID 3556 wrote to memory of 3124 3556 3420.tmp 87 PID 3556 wrote to memory of 3124 3556 3420.tmp 87 PID 3124 wrote to memory of 5004 3124 346E.tmp 88 PID 3124 wrote to memory of 5004 3124 346E.tmp 88 PID 3124 wrote to memory of 5004 3124 346E.tmp 88 PID 5004 wrote to memory of 3836 5004 34BC.tmp 89 PID 5004 wrote to memory of 3836 5004 34BC.tmp 89 PID 5004 wrote to memory of 3836 5004 34BC.tmp 89 PID 3836 wrote to memory of 1776 3836 351A.tmp 90 PID 3836 wrote to memory of 1776 3836 351A.tmp 90 PID 3836 wrote to memory of 1776 3836 351A.tmp 90 PID 1776 wrote to memory of 1968 1776 3587.tmp 91 PID 1776 wrote to memory of 1968 1776 3587.tmp 91 PID 1776 wrote to memory of 1968 1776 3587.tmp 91 PID 1968 wrote to memory of 5036 1968 35E5.tmp 92 PID 1968 wrote to memory of 5036 1968 35E5.tmp 92 PID 1968 wrote to memory of 5036 1968 35E5.tmp 92 PID 5036 wrote to memory of 4876 5036 3633.tmp 93 PID 5036 wrote to memory of 4876 5036 3633.tmp 93 PID 5036 wrote to memory of 4876 5036 3633.tmp 93 PID 4876 wrote to memory of 4844 4876 3681.tmp 94 PID 4876 wrote to memory of 4844 4876 3681.tmp 94 PID 4876 wrote to memory of 4844 4876 3681.tmp 94 PID 4844 wrote to memory of 1948 4844 36EE.tmp 95 PID 4844 wrote to memory of 1948 4844 36EE.tmp 95 PID 4844 wrote to memory of 1948 4844 36EE.tmp 95 PID 1948 wrote to memory of 5020 1948 373C.tmp 96 PID 1948 wrote to memory of 5020 1948 373C.tmp 96 PID 1948 wrote to memory of 5020 1948 373C.tmp 96 PID 5020 wrote to memory of 3532 5020 378B.tmp 97 PID 5020 wrote to memory of 3532 5020 378B.tmp 97 PID 5020 wrote to memory of 3532 5020 378B.tmp 97 PID 3532 wrote to memory of 5000 3532 37E8.tmp 98 PID 3532 wrote to memory of 5000 3532 37E8.tmp 98 PID 3532 wrote to memory of 5000 3532 37E8.tmp 98 PID 5000 wrote to memory of 1988 5000 3856.tmp 99 PID 5000 wrote to memory of 1988 5000 3856.tmp 99 PID 5000 wrote to memory of 1988 5000 3856.tmp 99 PID 1988 wrote to memory of 1812 1988 38B3.tmp 100 PID 1988 wrote to memory of 1812 1988 38B3.tmp 100 PID 1988 wrote to memory of 1812 1988 38B3.tmp 100 PID 1812 wrote to memory of 4692 1812 3911.tmp 101 PID 1812 wrote to memory of 4692 1812 3911.tmp 101 PID 1812 wrote to memory of 4692 1812 3911.tmp 101 PID 4692 wrote to memory of 3956 4692 395F.tmp 102 PID 4692 wrote to memory of 3956 4692 395F.tmp 102 PID 4692 wrote to memory of 3956 4692 395F.tmp 102 PID 3956 wrote to memory of 212 3956 39AD.tmp 103 PID 3956 wrote to memory of 212 3956 39AD.tmp 103 PID 3956 wrote to memory of 212 3956 39AD.tmp 103 PID 212 wrote to memory of 2908 212 39FC.tmp 104 PID 212 wrote to memory of 2908 212 39FC.tmp 104 PID 212 wrote to memory of 2908 212 39FC.tmp 104 PID 2908 wrote to memory of 3704 2908 3A4A.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-02_47f7ff2df1c1bb629e876fc3dfa58d01_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-02_47f7ff2df1c1bb629e876fc3dfa58d01_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\3335.tmp"C:\Users\Admin\AppData\Local\Temp\3335.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\33C2.tmp"C:\Users\Admin\AppData\Local\Temp\33C2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\3420.tmp"C:\Users\Admin\AppData\Local\Temp\3420.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\346E.tmp"C:\Users\Admin\AppData\Local\Temp\346E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\34BC.tmp"C:\Users\Admin\AppData\Local\Temp\34BC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\351A.tmp"C:\Users\Admin\AppData\Local\Temp\351A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\3587.tmp"C:\Users\Admin\AppData\Local\Temp\3587.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\35E5.tmp"C:\Users\Admin\AppData\Local\Temp\35E5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\3633.tmp"C:\Users\Admin\AppData\Local\Temp\3633.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\3681.tmp"C:\Users\Admin\AppData\Local\Temp\3681.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\36EE.tmp"C:\Users\Admin\AppData\Local\Temp\36EE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\373C.tmp"C:\Users\Admin\AppData\Local\Temp\373C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\378B.tmp"C:\Users\Admin\AppData\Local\Temp\378B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\37E8.tmp"C:\Users\Admin\AppData\Local\Temp\37E8.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\3856.tmp"C:\Users\Admin\AppData\Local\Temp\3856.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\38B3.tmp"C:\Users\Admin\AppData\Local\Temp\38B3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\3911.tmp"C:\Users\Admin\AppData\Local\Temp\3911.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\395F.tmp"C:\Users\Admin\AppData\Local\Temp\395F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\39AD.tmp"C:\Users\Admin\AppData\Local\Temp\39AD.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\39FC.tmp"C:\Users\Admin\AppData\Local\Temp\39FC.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\3A98.tmp"C:\Users\Admin\AppData\Local\Temp\3A98.tmp"23⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"24⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\3B34.tmp"C:\Users\Admin\AppData\Local\Temp\3B34.tmp"25⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\3B82.tmp"C:\Users\Admin\AppData\Local\Temp\3B82.tmp"26⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\3BD0.tmp"C:\Users\Admin\AppData\Local\Temp\3BD0.tmp"27⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"28⤵
- Executes dropped EXE
PID:896 -
C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"29⤵
- Executes dropped EXE
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"30⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\3D38.tmp"C:\Users\Admin\AppData\Local\Temp\3D38.tmp"31⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\3D86.tmp"C:\Users\Admin\AppData\Local\Temp\3D86.tmp"32⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"33⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\3E32.tmp"C:\Users\Admin\AppData\Local\Temp\3E32.tmp"34⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\3E80.tmp"C:\Users\Admin\AppData\Local\Temp\3E80.tmp"35⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"36⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"37⤵
- Executes dropped EXE
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"38⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"39⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\4016.tmp"C:\Users\Admin\AppData\Local\Temp\4016.tmp"40⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\4064.tmp"C:\Users\Admin\AppData\Local\Temp\4064.tmp"41⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"42⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\4100.tmp"C:\Users\Admin\AppData\Local\Temp\4100.tmp"43⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\414F.tmp"C:\Users\Admin\AppData\Local\Temp\414F.tmp"44⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\419D.tmp"C:\Users\Admin\AppData\Local\Temp\419D.tmp"45⤵
- Executes dropped EXE
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\41EB.tmp"C:\Users\Admin\AppData\Local\Temp\41EB.tmp"46⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"47⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\4287.tmp"C:\Users\Admin\AppData\Local\Temp\4287.tmp"48⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"49⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"50⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"51⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"52⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"53⤵
- Executes dropped EXE
PID:916 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"54⤵
- Executes dropped EXE
PID:740 -
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"55⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"56⤵
- Executes dropped EXE
PID:720 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"57⤵
- Executes dropped EXE
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"58⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"59⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"60⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"61⤵
- Executes dropped EXE
PID:652 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"62⤵
- Executes dropped EXE
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"63⤵
- Executes dropped EXE
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"64⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"65⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"66⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"67⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"68⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"69⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"70⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"71⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"72⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"73⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"74⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"75⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"76⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"77⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"78⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"79⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"80⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"81⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"82⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"83⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"84⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"85⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"86⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"87⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"88⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"89⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"90⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"91⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"92⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"93⤵PID:424
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"94⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"95⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"96⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"97⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"98⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"99⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"100⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"101⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"102⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"103⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"104⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"105⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"106⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"107⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"108⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"109⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"110⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"111⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"112⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"113⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"114⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"115⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"116⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"117⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"118⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"119⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"120⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"121⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"122⤵PID:3984
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-