Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 16:51
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-14_177b7ba5259fb9539800386813cdb13f_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-14_177b7ba5259fb9539800386813cdb13f_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-14_177b7ba5259fb9539800386813cdb13f_mafia.exe
-
Size
520KB
-
MD5
177b7ba5259fb9539800386813cdb13f
-
SHA1
b7e2e3a31c3be27db244e5c7612cf431acaf2863
-
SHA256
f90646eb5f210c3158a5d6ef8d88debce441f57b6e6199615dbddfc6623d7b75
-
SHA512
f199a1df64d315e38bf1e433a1cca021389dc875c2cd161b35ceb106bb3e136ad8a2c817e3c81852ff48196e8a6b78312ca58da82829a6775dcad43e761cdd25
-
SSDEEP
12288:gj8fuxR21t5i8fO5PwWLBncW5tXIZa6FNZ:gj8fuK1GYO5ZcxFN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4496 3364.tmp 3160 33D1.tmp 916 343F.tmp 452 34DB.tmp 1936 3539.tmp 3680 35A6.tmp 3592 35F4.tmp 2020 3642.tmp 4524 36BF.tmp 3256 371D.tmp 5020 377B.tmp 3724 37E8.tmp 3508 3846.tmp 1988 3894.tmp 5044 3911.tmp 2148 397F.tmp 1856 39CD.tmp 2960 3A4A.tmp 620 3A98.tmp 1804 3AE6.tmp 2848 3B73.tmp 4220 3BE0.tmp 896 3C4D.tmp 3772 3CBB.tmp 552 3D28.tmp 4116 3D76.tmp 1608 3DC4.tmp 1580 3E32.tmp 2720 3E8F.tmp 4208 3EED.tmp 4752 3F4B.tmp 3080 3FC8.tmp 1792 4035.tmp 948 4093.tmp 4436 40E1.tmp 1748 413F.tmp 464 418D.tmp 3908 41EB.tmp 5028 4249.tmp 3792 4297.tmp 452 42E5.tmp 4020 4333.tmp 5016 4381.tmp 4524 43DF.tmp 2384 442D.tmp 3724 447B.tmp 1464 44C9.tmp 4636 4517.tmp 3852 4575.tmp 3704 45D3.tmp 4712 4621.tmp 4956 467F.tmp 836 46DC.tmp 1332 473A.tmp 2152 4788.tmp 4252 47E6.tmp 4092 4834.tmp 4948 4882.tmp 2700 48E0.tmp 3740 493E.tmp 3772 498C.tmp 3060 49EA.tmp 3524 4A47.tmp 2216 4AA5.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3164 wrote to memory of 4496 3164 2024-05-14_177b7ba5259fb9539800386813cdb13f_mafia.exe 82 PID 3164 wrote to memory of 4496 3164 2024-05-14_177b7ba5259fb9539800386813cdb13f_mafia.exe 82 PID 3164 wrote to memory of 4496 3164 2024-05-14_177b7ba5259fb9539800386813cdb13f_mafia.exe 82 PID 4496 wrote to memory of 3160 4496 3364.tmp 83 PID 4496 wrote to memory of 3160 4496 3364.tmp 83 PID 4496 wrote to memory of 3160 4496 3364.tmp 83 PID 3160 wrote to memory of 916 3160 33D1.tmp 84 PID 3160 wrote to memory of 916 3160 33D1.tmp 84 PID 3160 wrote to memory of 916 3160 33D1.tmp 84 PID 916 wrote to memory of 452 916 343F.tmp 85 PID 916 wrote to memory of 452 916 343F.tmp 85 PID 916 wrote to memory of 452 916 343F.tmp 85 PID 452 wrote to memory of 1936 452 34DB.tmp 86 PID 452 wrote to memory of 1936 452 34DB.tmp 86 PID 452 wrote to memory of 1936 452 34DB.tmp 86 PID 1936 wrote to memory of 3680 1936 3539.tmp 89 PID 1936 wrote to memory of 3680 1936 3539.tmp 89 PID 1936 wrote to memory of 3680 1936 3539.tmp 89 PID 3680 wrote to memory of 3592 3680 35A6.tmp 90 PID 3680 wrote to memory of 3592 3680 35A6.tmp 90 PID 3680 wrote to memory of 3592 3680 35A6.tmp 90 PID 3592 wrote to memory of 2020 3592 35F4.tmp 92 PID 3592 wrote to memory of 2020 3592 35F4.tmp 92 PID 3592 wrote to memory of 2020 3592 35F4.tmp 92 PID 2020 wrote to memory of 4524 2020 3642.tmp 93 PID 2020 wrote to memory of 4524 2020 3642.tmp 93 PID 2020 wrote to memory of 4524 2020 3642.tmp 93 PID 4524 wrote to memory of 3256 4524 36BF.tmp 94 PID 4524 wrote to memory of 3256 4524 36BF.tmp 94 PID 4524 wrote to memory of 3256 4524 36BF.tmp 94 PID 3256 wrote to memory of 5020 3256 371D.tmp 95 PID 3256 wrote to memory of 5020 3256 371D.tmp 95 PID 3256 wrote to memory of 5020 3256 371D.tmp 95 PID 5020 wrote to memory of 3724 5020 377B.tmp 96 PID 5020 wrote to memory of 3724 5020 377B.tmp 96 PID 5020 wrote to memory of 3724 5020 377B.tmp 96 PID 3724 wrote to memory of 3508 3724 37E8.tmp 97 PID 3724 wrote to memory of 3508 3724 37E8.tmp 97 PID 3724 wrote to memory of 3508 3724 37E8.tmp 97 PID 3508 wrote to memory of 1988 3508 3846.tmp 98 PID 3508 wrote to memory of 1988 3508 3846.tmp 98 PID 3508 wrote to memory of 1988 3508 3846.tmp 98 PID 1988 wrote to memory of 5044 1988 3894.tmp 99 PID 1988 wrote to memory of 5044 1988 3894.tmp 99 PID 1988 wrote to memory of 5044 1988 3894.tmp 99 PID 5044 wrote to memory of 2148 5044 3911.tmp 100 PID 5044 wrote to memory of 2148 5044 3911.tmp 100 PID 5044 wrote to memory of 2148 5044 3911.tmp 100 PID 2148 wrote to memory of 1856 2148 397F.tmp 101 PID 2148 wrote to memory of 1856 2148 397F.tmp 101 PID 2148 wrote to memory of 1856 2148 397F.tmp 101 PID 1856 wrote to memory of 2960 1856 39CD.tmp 102 PID 1856 wrote to memory of 2960 1856 39CD.tmp 102 PID 1856 wrote to memory of 2960 1856 39CD.tmp 102 PID 2960 wrote to memory of 620 2960 3A4A.tmp 103 PID 2960 wrote to memory of 620 2960 3A4A.tmp 103 PID 2960 wrote to memory of 620 2960 3A4A.tmp 103 PID 620 wrote to memory of 1804 620 3A98.tmp 104 PID 620 wrote to memory of 1804 620 3A98.tmp 104 PID 620 wrote to memory of 1804 620 3A98.tmp 104 PID 1804 wrote to memory of 2848 1804 3AE6.tmp 105 PID 1804 wrote to memory of 2848 1804 3AE6.tmp 105 PID 1804 wrote to memory of 2848 1804 3AE6.tmp 105 PID 2848 wrote to memory of 4220 2848 3B73.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-14_177b7ba5259fb9539800386813cdb13f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-14_177b7ba5259fb9539800386813cdb13f_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\3364.tmp"C:\Users\Admin\AppData\Local\Temp\3364.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\33D1.tmp"C:\Users\Admin\AppData\Local\Temp\33D1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\343F.tmp"C:\Users\Admin\AppData\Local\Temp\343F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\34DB.tmp"C:\Users\Admin\AppData\Local\Temp\34DB.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\3539.tmp"C:\Users\Admin\AppData\Local\Temp\3539.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\35A6.tmp"C:\Users\Admin\AppData\Local\Temp\35A6.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\35F4.tmp"C:\Users\Admin\AppData\Local\Temp\35F4.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\3642.tmp"C:\Users\Admin\AppData\Local\Temp\3642.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\36BF.tmp"C:\Users\Admin\AppData\Local\Temp\36BF.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\371D.tmp"C:\Users\Admin\AppData\Local\Temp\371D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\377B.tmp"C:\Users\Admin\AppData\Local\Temp\377B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\37E8.tmp"C:\Users\Admin\AppData\Local\Temp\37E8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\3846.tmp"C:\Users\Admin\AppData\Local\Temp\3846.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\3894.tmp"C:\Users\Admin\AppData\Local\Temp\3894.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\3911.tmp"C:\Users\Admin\AppData\Local\Temp\3911.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\397F.tmp"C:\Users\Admin\AppData\Local\Temp\397F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\39CD.tmp"C:\Users\Admin\AppData\Local\Temp\39CD.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\3A98.tmp"C:\Users\Admin\AppData\Local\Temp\3A98.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\3B73.tmp"C:\Users\Admin\AppData\Local\Temp\3B73.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"23⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"24⤵
- Executes dropped EXE
PID:896 -
C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"25⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\3D28.tmp"C:\Users\Admin\AppData\Local\Temp\3D28.tmp"26⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\3D76.tmp"C:\Users\Admin\AppData\Local\Temp\3D76.tmp"27⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"28⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\3E32.tmp"C:\Users\Admin\AppData\Local\Temp\3E32.tmp"29⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"30⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\3EED.tmp"C:\Users\Admin\AppData\Local\Temp\3EED.tmp"31⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"32⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"33⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\4035.tmp"C:\Users\Admin\AppData\Local\Temp\4035.tmp"34⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\4093.tmp"C:\Users\Admin\AppData\Local\Temp\4093.tmp"35⤵
- Executes dropped EXE
PID:948 -
C:\Users\Admin\AppData\Local\Temp\40E1.tmp"C:\Users\Admin\AppData\Local\Temp\40E1.tmp"36⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\413F.tmp"C:\Users\Admin\AppData\Local\Temp\413F.tmp"37⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\418D.tmp"C:\Users\Admin\AppData\Local\Temp\418D.tmp"38⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\41EB.tmp"C:\Users\Admin\AppData\Local\Temp\41EB.tmp"39⤵
- Executes dropped EXE
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"40⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"41⤵
- Executes dropped EXE
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"42⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"43⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"44⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"45⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"46⤵
- Executes dropped EXE
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\447B.tmp"C:\Users\Admin\AppData\Local\Temp\447B.tmp"47⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"48⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"49⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"50⤵
- Executes dropped EXE
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\45D3.tmp"C:\Users\Admin\AppData\Local\Temp\45D3.tmp"51⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"52⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"53⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"54⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"55⤵
- Executes dropped EXE
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"56⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"57⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"58⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"59⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"60⤵
- Executes dropped EXE
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"61⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"62⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"63⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"64⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"65⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"66⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"67⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"68⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"69⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"70⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"71⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"72⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"73⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"74⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"75⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"76⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"77⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"78⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"79⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"80⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"81⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"82⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"83⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"84⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"85⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"86⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"87⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"88⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"89⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"90⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"91⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"92⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"93⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"94⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"95⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"96⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"97⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"98⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"99⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"100⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"101⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"102⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"103⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"104⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"105⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"106⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"107⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"108⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"109⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"110⤵PID:424
-
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"111⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"112⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"113⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"114⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"115⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"116⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"117⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"118⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"119⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"120⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"121⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"122⤵PID:3432
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-