Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23/05/2024, 13:57
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-23_57dc330e449c7df4fbdcd7b427bbabbc_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-23_57dc330e449c7df4fbdcd7b427bbabbc_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-23_57dc330e449c7df4fbdcd7b427bbabbc_mafia.exe
-
Size
487KB
-
MD5
57dc330e449c7df4fbdcd7b427bbabbc
-
SHA1
0793382d4ecf89e7436240bd1fa1eb41145c1ca0
-
SHA256
cc9e9357826673ec13067eae2d1f84c6c9cb0fdf17da2b0431077fb3a729185b
-
SHA512
baafe3b1a157026258e0ad3d35b0e3f04ef19c0322f155b099c27bac3740224bc957528f3ca7d73a8094b8b3721ee9cb8d067f017ed8e66bd9c5171c11136003
-
SSDEEP
12288:yU5rCOTeiNWLKYAt2th/XT221bhJCfBbZ:yUQOJNrYAt2r/jN1bgb
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3500 38A4.tmp 4272 3940.tmp 1188 39BD.tmp 384 3A2A.tmp 1668 3AA7.tmp 872 3B24.tmp 2652 3B92.tmp 2876 3BF0.tmp 1860 3C5D.tmp 2068 3D09.tmp 3168 3D86.tmp 1828 3DE4.tmp 4484 3E51.tmp 2492 3EBE.tmp 2908 3F3B.tmp 1528 3FA9.tmp 2380 4016.tmp 3924 4093.tmp 4268 4100.tmp 760 415E.tmp 1972 41CC.tmp 1660 4229.tmp 2468 4287.tmp 2268 4304.tmp 1912 4362.tmp 4148 43C0.tmp 4308 440E.tmp 2940 445C.tmp 5072 44D9.tmp 1792 4556.tmp 4860 45E2.tmp 216 4650.tmp 1052 46BD.tmp 4584 471B.tmp 996 4769.tmp 1044 47B7.tmp 4460 4815.tmp 4356 4873.tmp 4452 48C1.tmp 824 490F.tmp 4192 495D.tmp 432 49AB.tmp 4032 49F9.tmp 3364 4A57.tmp 4088 4AB5.tmp 1684 4B13.tmp 4024 4B70.tmp 1252 4BBE.tmp 1860 4C1C.tmp 2344 4C6A.tmp 428 4CB8.tmp 4548 4D26.tmp 5036 4D84.tmp 1872 4DE1.tmp 4540 4E3F.tmp 2380 4E9D.tmp 1852 4EFB.tmp 3820 4F58.tmp 2464 4FA6.tmp 1608 5004.tmp 2460 5062.tmp 1236 50C0.tmp 4636 510E.tmp 2040 515C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1028 wrote to memory of 3500 1028 2024-05-23_57dc330e449c7df4fbdcd7b427bbabbc_mafia.exe 84 PID 1028 wrote to memory of 3500 1028 2024-05-23_57dc330e449c7df4fbdcd7b427bbabbc_mafia.exe 84 PID 1028 wrote to memory of 3500 1028 2024-05-23_57dc330e449c7df4fbdcd7b427bbabbc_mafia.exe 84 PID 3500 wrote to memory of 4272 3500 38A4.tmp 85 PID 3500 wrote to memory of 4272 3500 38A4.tmp 85 PID 3500 wrote to memory of 4272 3500 38A4.tmp 85 PID 4272 wrote to memory of 1188 4272 3940.tmp 86 PID 4272 wrote to memory of 1188 4272 3940.tmp 86 PID 4272 wrote to memory of 1188 4272 3940.tmp 86 PID 1188 wrote to memory of 384 1188 39BD.tmp 87 PID 1188 wrote to memory of 384 1188 39BD.tmp 87 PID 1188 wrote to memory of 384 1188 39BD.tmp 87 PID 384 wrote to memory of 1668 384 3A2A.tmp 88 PID 384 wrote to memory of 1668 384 3A2A.tmp 88 PID 384 wrote to memory of 1668 384 3A2A.tmp 88 PID 1668 wrote to memory of 872 1668 3AA7.tmp 89 PID 1668 wrote to memory of 872 1668 3AA7.tmp 89 PID 1668 wrote to memory of 872 1668 3AA7.tmp 89 PID 872 wrote to memory of 2652 872 3B24.tmp 91 PID 872 wrote to memory of 2652 872 3B24.tmp 91 PID 872 wrote to memory of 2652 872 3B24.tmp 91 PID 2652 wrote to memory of 2876 2652 3B92.tmp 92 PID 2652 wrote to memory of 2876 2652 3B92.tmp 92 PID 2652 wrote to memory of 2876 2652 3B92.tmp 92 PID 2876 wrote to memory of 1860 2876 3BF0.tmp 93 PID 2876 wrote to memory of 1860 2876 3BF0.tmp 93 PID 2876 wrote to memory of 1860 2876 3BF0.tmp 93 PID 1860 wrote to memory of 2068 1860 3C5D.tmp 94 PID 1860 wrote to memory of 2068 1860 3C5D.tmp 94 PID 1860 wrote to memory of 2068 1860 3C5D.tmp 94 PID 2068 wrote to memory of 3168 2068 3D09.tmp 95 PID 2068 wrote to memory of 3168 2068 3D09.tmp 95 PID 2068 wrote to memory of 3168 2068 3D09.tmp 95 PID 3168 wrote to memory of 1828 3168 3D86.tmp 96 PID 3168 wrote to memory of 1828 3168 3D86.tmp 96 PID 3168 wrote to memory of 1828 3168 3D86.tmp 96 PID 1828 wrote to memory of 4484 1828 3DE4.tmp 97 PID 1828 wrote to memory of 4484 1828 3DE4.tmp 97 PID 1828 wrote to memory of 4484 1828 3DE4.tmp 97 PID 4484 wrote to memory of 2492 4484 3E51.tmp 98 PID 4484 wrote to memory of 2492 4484 3E51.tmp 98 PID 4484 wrote to memory of 2492 4484 3E51.tmp 98 PID 2492 wrote to memory of 2908 2492 3EBE.tmp 99 PID 2492 wrote to memory of 2908 2492 3EBE.tmp 99 PID 2492 wrote to memory of 2908 2492 3EBE.tmp 99 PID 2908 wrote to memory of 1528 2908 3F3B.tmp 100 PID 2908 wrote to memory of 1528 2908 3F3B.tmp 100 PID 2908 wrote to memory of 1528 2908 3F3B.tmp 100 PID 1528 wrote to memory of 2380 1528 3FA9.tmp 101 PID 1528 wrote to memory of 2380 1528 3FA9.tmp 101 PID 1528 wrote to memory of 2380 1528 3FA9.tmp 101 PID 2380 wrote to memory of 3924 2380 4016.tmp 102 PID 2380 wrote to memory of 3924 2380 4016.tmp 102 PID 2380 wrote to memory of 3924 2380 4016.tmp 102 PID 3924 wrote to memory of 4268 3924 4093.tmp 103 PID 3924 wrote to memory of 4268 3924 4093.tmp 103 PID 3924 wrote to memory of 4268 3924 4093.tmp 103 PID 4268 wrote to memory of 760 4268 4100.tmp 104 PID 4268 wrote to memory of 760 4268 4100.tmp 104 PID 4268 wrote to memory of 760 4268 4100.tmp 104 PID 760 wrote to memory of 1972 760 415E.tmp 105 PID 760 wrote to memory of 1972 760 415E.tmp 105 PID 760 wrote to memory of 1972 760 415E.tmp 105 PID 1972 wrote to memory of 1660 1972 41CC.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_57dc330e449c7df4fbdcd7b427bbabbc_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_57dc330e449c7df4fbdcd7b427bbabbc_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\38A4.tmp"C:\Users\Admin\AppData\Local\Temp\38A4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\3940.tmp"C:\Users\Admin\AppData\Local\Temp\3940.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\39BD.tmp"C:\Users\Admin\AppData\Local\Temp\39BD.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\AppData\Local\Temp\3AA7.tmp"C:\Users\Admin\AppData\Local\Temp\3AA7.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\3B24.tmp"C:\Users\Admin\AppData\Local\Temp\3B24.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\3B92.tmp"C:\Users\Admin\AppData\Local\Temp\3B92.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\3D09.tmp"C:\Users\Admin\AppData\Local\Temp\3D09.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\3D86.tmp"C:\Users\Admin\AppData\Local\Temp\3D86.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\3E51.tmp"C:\Users\Admin\AppData\Local\Temp\3E51.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\3F3B.tmp"C:\Users\Admin\AppData\Local\Temp\3F3B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\4016.tmp"C:\Users\Admin\AppData\Local\Temp\4016.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\4093.tmp"C:\Users\Admin\AppData\Local\Temp\4093.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\4100.tmp"C:\Users\Admin\AppData\Local\Temp\4100.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\415E.tmp"C:\Users\Admin\AppData\Local\Temp\415E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\4229.tmp"C:\Users\Admin\AppData\Local\Temp\4229.tmp"23⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\4287.tmp"C:\Users\Admin\AppData\Local\Temp\4287.tmp"24⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\4304.tmp"C:\Users\Admin\AppData\Local\Temp\4304.tmp"25⤵
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\4362.tmp"C:\Users\Admin\AppData\Local\Temp\4362.tmp"26⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\43C0.tmp"C:\Users\Admin\AppData\Local\Temp\43C0.tmp"27⤵
- Executes dropped EXE
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"28⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"29⤵
- Executes dropped EXE
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"30⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"31⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"32⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"33⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"34⤵
- Executes dropped EXE
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"35⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"36⤵
- Executes dropped EXE
PID:996 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"37⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"38⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"39⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"40⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"41⤵
- Executes dropped EXE
PID:824 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"42⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"43⤵
- Executes dropped EXE
PID:432 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"44⤵
- Executes dropped EXE
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"45⤵
- Executes dropped EXE
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"46⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"47⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"48⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"49⤵
- Executes dropped EXE
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"50⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"51⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"52⤵
- Executes dropped EXE
PID:428 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"53⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"54⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"55⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"56⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"57⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"58⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"59⤵
- Executes dropped EXE
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"60⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"61⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"62⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"63⤵
- Executes dropped EXE
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"64⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"65⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"66⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"67⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"68⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"69⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"70⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"71⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"72⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"73⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"74⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"75⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"76⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"77⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"78⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"79⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"80⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"81⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"82⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"83⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"84⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"85⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"86⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"87⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"88⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"89⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"90⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"91⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"92⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"93⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"94⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"95⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"96⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"97⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"98⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"99⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"100⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"101⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"102⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"103⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"104⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"105⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"106⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"107⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"108⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"109⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"110⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"111⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"112⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"113⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"114⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"115⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"116⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"117⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"118⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"119⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"120⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"121⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"122⤵PID:564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-