Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 02:51
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-02_5f1cfe0a372741d2e8bc2c1e36ef9115_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-02_5f1cfe0a372741d2e8bc2c1e36ef9115_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-06-02_5f1cfe0a372741d2e8bc2c1e36ef9115_mafia.exe
-
Size
487KB
-
MD5
5f1cfe0a372741d2e8bc2c1e36ef9115
-
SHA1
24d89fa856784d74c9a24f045b5e87b6cc914df9
-
SHA256
0a1822193a0bddd270ec8ab591b25a56d2a14975372ef1aa3ff26efd694044af
-
SHA512
bcb0fd530df44ae38d9786777f9a97ccac356a9114c5181565308d6bcda6ff116d14c1852bfbee145ef3b4b6bb4bb4afd3281d06c02f513aeac046733b2694b5
-
SSDEEP
12288:HU5rCOTeiJfMMYn58lpv+LZntwOvsC0HLNZ:HUQOJJfJi8laZ9t0HLN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2968 2971.tmp 5092 29DF.tmp 2688 2A5C.tmp 3452 2AD9.tmp 4312 2B46.tmp 1352 2BD3.tmp 1912 2C40.tmp 3996 2C9E.tmp 4820 2D0B.tmp 1684 2D88.tmp 1260 2DF5.tmp 1588 2E72.tmp 1672 2ED0.tmp 1356 2F3E.tmp 932 2F9B.tmp 4872 3009.tmp 4404 3066.tmp 3932 30B5.tmp 2936 3122.tmp 1484 318F.tmp 1888 31FD.tmp 3796 325A.tmp 2052 32D7.tmp 3176 3354.tmp 4220 33C2.tmp 2520 3410.tmp 3616 346E.tmp 3576 34BC.tmp 4536 350A.tmp 1340 3577.tmp 1840 35F4.tmp 3116 3652.tmp 1716 36B0.tmp 2296 36FE.tmp 1292 374C.tmp 3600 379A.tmp 1916 37F8.tmp 844 3865.tmp 3088 38B3.tmp 4608 3911.tmp 3840 396F.tmp 4436 39BD.tmp 3736 3A0B.tmp 1640 3A69.tmp 4168 3AB7.tmp 4880 3B05.tmp 1728 3B63.tmp 4772 3BB1.tmp 4460 3C0F.tmp 4720 3C5D.tmp 2620 3CAB.tmp 3776 3D09.tmp 392 3D67.tmp 2768 3DB5.tmp 2396 3E03.tmp 1168 3E51.tmp 1352 3E9F.tmp 2544 3EED.tmp 3788 3F4B.tmp 2428 3FA9.tmp 4820 3FF7.tmp 2576 4055.tmp 2728 40A3.tmp 2264 40F1.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4048 wrote to memory of 2968 4048 2024-06-02_5f1cfe0a372741d2e8bc2c1e36ef9115_mafia.exe 81 PID 4048 wrote to memory of 2968 4048 2024-06-02_5f1cfe0a372741d2e8bc2c1e36ef9115_mafia.exe 81 PID 4048 wrote to memory of 2968 4048 2024-06-02_5f1cfe0a372741d2e8bc2c1e36ef9115_mafia.exe 81 PID 2968 wrote to memory of 5092 2968 2971.tmp 82 PID 2968 wrote to memory of 5092 2968 2971.tmp 82 PID 2968 wrote to memory of 5092 2968 2971.tmp 82 PID 5092 wrote to memory of 2688 5092 29DF.tmp 83 PID 5092 wrote to memory of 2688 5092 29DF.tmp 83 PID 5092 wrote to memory of 2688 5092 29DF.tmp 83 PID 2688 wrote to memory of 3452 2688 2A5C.tmp 84 PID 2688 wrote to memory of 3452 2688 2A5C.tmp 84 PID 2688 wrote to memory of 3452 2688 2A5C.tmp 84 PID 3452 wrote to memory of 4312 3452 2AD9.tmp 85 PID 3452 wrote to memory of 4312 3452 2AD9.tmp 85 PID 3452 wrote to memory of 4312 3452 2AD9.tmp 85 PID 4312 wrote to memory of 1352 4312 2B46.tmp 86 PID 4312 wrote to memory of 1352 4312 2B46.tmp 86 PID 4312 wrote to memory of 1352 4312 2B46.tmp 86 PID 1352 wrote to memory of 1912 1352 2BD3.tmp 87 PID 1352 wrote to memory of 1912 1352 2BD3.tmp 87 PID 1352 wrote to memory of 1912 1352 2BD3.tmp 87 PID 1912 wrote to memory of 3996 1912 2C40.tmp 88 PID 1912 wrote to memory of 3996 1912 2C40.tmp 88 PID 1912 wrote to memory of 3996 1912 2C40.tmp 88 PID 3996 wrote to memory of 4820 3996 2C9E.tmp 89 PID 3996 wrote to memory of 4820 3996 2C9E.tmp 89 PID 3996 wrote to memory of 4820 3996 2C9E.tmp 89 PID 4820 wrote to memory of 1684 4820 2D0B.tmp 90 PID 4820 wrote to memory of 1684 4820 2D0B.tmp 90 PID 4820 wrote to memory of 1684 4820 2D0B.tmp 90 PID 1684 wrote to memory of 1260 1684 2D88.tmp 91 PID 1684 wrote to memory of 1260 1684 2D88.tmp 91 PID 1684 wrote to memory of 1260 1684 2D88.tmp 91 PID 1260 wrote to memory of 1588 1260 2DF5.tmp 92 PID 1260 wrote to memory of 1588 1260 2DF5.tmp 92 PID 1260 wrote to memory of 1588 1260 2DF5.tmp 92 PID 1588 wrote to memory of 1672 1588 2E72.tmp 93 PID 1588 wrote to memory of 1672 1588 2E72.tmp 93 PID 1588 wrote to memory of 1672 1588 2E72.tmp 93 PID 1672 wrote to memory of 1356 1672 2ED0.tmp 94 PID 1672 wrote to memory of 1356 1672 2ED0.tmp 94 PID 1672 wrote to memory of 1356 1672 2ED0.tmp 94 PID 1356 wrote to memory of 932 1356 2F3E.tmp 95 PID 1356 wrote to memory of 932 1356 2F3E.tmp 95 PID 1356 wrote to memory of 932 1356 2F3E.tmp 95 PID 932 wrote to memory of 4872 932 2F9B.tmp 96 PID 932 wrote to memory of 4872 932 2F9B.tmp 96 PID 932 wrote to memory of 4872 932 2F9B.tmp 96 PID 4872 wrote to memory of 4404 4872 3009.tmp 97 PID 4872 wrote to memory of 4404 4872 3009.tmp 97 PID 4872 wrote to memory of 4404 4872 3009.tmp 97 PID 4404 wrote to memory of 3932 4404 3066.tmp 98 PID 4404 wrote to memory of 3932 4404 3066.tmp 98 PID 4404 wrote to memory of 3932 4404 3066.tmp 98 PID 3932 wrote to memory of 2936 3932 30B5.tmp 99 PID 3932 wrote to memory of 2936 3932 30B5.tmp 99 PID 3932 wrote to memory of 2936 3932 30B5.tmp 99 PID 2936 wrote to memory of 1484 2936 3122.tmp 100 PID 2936 wrote to memory of 1484 2936 3122.tmp 100 PID 2936 wrote to memory of 1484 2936 3122.tmp 100 PID 1484 wrote to memory of 1888 1484 318F.tmp 101 PID 1484 wrote to memory of 1888 1484 318F.tmp 101 PID 1484 wrote to memory of 1888 1484 318F.tmp 101 PID 1888 wrote to memory of 3796 1888 31FD.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-02_5f1cfe0a372741d2e8bc2c1e36ef9115_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-02_5f1cfe0a372741d2e8bc2c1e36ef9115_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\29DF.tmp"C:\Users\Admin\AppData\Local\Temp\29DF.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\2A5C.tmp"C:\Users\Admin\AppData\Local\Temp\2A5C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\2AD9.tmp"C:\Users\Admin\AppData\Local\Temp\2AD9.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\2B46.tmp"C:\Users\Admin\AppData\Local\Temp\2B46.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\2BD3.tmp"C:\Users\Admin\AppData\Local\Temp\2BD3.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\2C40.tmp"C:\Users\Admin\AppData\Local\Temp\2C40.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\2C9E.tmp"C:\Users\Admin\AppData\Local\Temp\2C9E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\2D0B.tmp"C:\Users\Admin\AppData\Local\Temp\2D0B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\2D88.tmp"C:\Users\Admin\AppData\Local\Temp\2D88.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\2DF5.tmp"C:\Users\Admin\AppData\Local\Temp\2DF5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\2E72.tmp"C:\Users\Admin\AppData\Local\Temp\2E72.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\2ED0.tmp"C:\Users\Admin\AppData\Local\Temp\2ED0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\2F3E.tmp"C:\Users\Admin\AppData\Local\Temp\2F3E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\2F9B.tmp"C:\Users\Admin\AppData\Local\Temp\2F9B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\3009.tmp"C:\Users\Admin\AppData\Local\Temp\3009.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\3066.tmp"C:\Users\Admin\AppData\Local\Temp\3066.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\30B5.tmp"C:\Users\Admin\AppData\Local\Temp\30B5.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\3122.tmp"C:\Users\Admin\AppData\Local\Temp\3122.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\318F.tmp"C:\Users\Admin\AppData\Local\Temp\318F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\31FD.tmp"C:\Users\Admin\AppData\Local\Temp\31FD.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\325A.tmp"C:\Users\Admin\AppData\Local\Temp\325A.tmp"23⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\32D7.tmp"C:\Users\Admin\AppData\Local\Temp\32D7.tmp"24⤵
- Executes dropped EXE
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\3354.tmp"C:\Users\Admin\AppData\Local\Temp\3354.tmp"25⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\33C2.tmp"C:\Users\Admin\AppData\Local\Temp\33C2.tmp"26⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\3410.tmp"C:\Users\Admin\AppData\Local\Temp\3410.tmp"27⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\346E.tmp"C:\Users\Admin\AppData\Local\Temp\346E.tmp"28⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\34BC.tmp"C:\Users\Admin\AppData\Local\Temp\34BC.tmp"29⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\350A.tmp"C:\Users\Admin\AppData\Local\Temp\350A.tmp"30⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\3577.tmp"C:\Users\Admin\AppData\Local\Temp\3577.tmp"31⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\35F4.tmp"C:\Users\Admin\AppData\Local\Temp\35F4.tmp"32⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\3652.tmp"C:\Users\Admin\AppData\Local\Temp\3652.tmp"33⤵
- Executes dropped EXE
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\36B0.tmp"C:\Users\Admin\AppData\Local\Temp\36B0.tmp"34⤵
- Executes dropped EXE
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\36FE.tmp"C:\Users\Admin\AppData\Local\Temp\36FE.tmp"35⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\374C.tmp"C:\Users\Admin\AppData\Local\Temp\374C.tmp"36⤵
- Executes dropped EXE
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\379A.tmp"C:\Users\Admin\AppData\Local\Temp\379A.tmp"37⤵
- Executes dropped EXE
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\37F8.tmp"C:\Users\Admin\AppData\Local\Temp\37F8.tmp"38⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\3865.tmp"C:\Users\Admin\AppData\Local\Temp\3865.tmp"39⤵
- Executes dropped EXE
PID:844 -
C:\Users\Admin\AppData\Local\Temp\38B3.tmp"C:\Users\Admin\AppData\Local\Temp\38B3.tmp"40⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\3911.tmp"C:\Users\Admin\AppData\Local\Temp\3911.tmp"41⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\396F.tmp"C:\Users\Admin\AppData\Local\Temp\396F.tmp"42⤵
- Executes dropped EXE
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\39BD.tmp"C:\Users\Admin\AppData\Local\Temp\39BD.tmp"43⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"44⤵
- Executes dropped EXE
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\3A69.tmp"C:\Users\Admin\AppData\Local\Temp\3A69.tmp"45⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"46⤵
- Executes dropped EXE
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\3B05.tmp"C:\Users\Admin\AppData\Local\Temp\3B05.tmp"47⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\3B63.tmp"C:\Users\Admin\AppData\Local\Temp\3B63.tmp"48⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\3BB1.tmp"C:\Users\Admin\AppData\Local\Temp\3BB1.tmp"49⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\3C0F.tmp"C:\Users\Admin\AppData\Local\Temp\3C0F.tmp"50⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"51⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\3CAB.tmp"C:\Users\Admin\AppData\Local\Temp\3CAB.tmp"52⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\3D09.tmp"C:\Users\Admin\AppData\Local\Temp\3D09.tmp"53⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\3D67.tmp"C:\Users\Admin\AppData\Local\Temp\3D67.tmp"54⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"55⤵
- Executes dropped EXE
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\3E03.tmp"C:\Users\Admin\AppData\Local\Temp\3E03.tmp"56⤵
- Executes dropped EXE
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\3E51.tmp"C:\Users\Admin\AppData\Local\Temp\3E51.tmp"57⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"58⤵
- Executes dropped EXE
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\3EED.tmp"C:\Users\Admin\AppData\Local\Temp\3EED.tmp"59⤵
- Executes dropped EXE
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"60⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"61⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"62⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\4055.tmp"C:\Users\Admin\AppData\Local\Temp\4055.tmp"63⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\40A3.tmp"C:\Users\Admin\AppData\Local\Temp\40A3.tmp"64⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\40F1.tmp"C:\Users\Admin\AppData\Local\Temp\40F1.tmp"65⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\413F.tmp"C:\Users\Admin\AppData\Local\Temp\413F.tmp"66⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\419D.tmp"C:\Users\Admin\AppData\Local\Temp\419D.tmp"67⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"68⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"69⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"70⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\42F4.tmp"C:\Users\Admin\AppData\Local\Temp\42F4.tmp"71⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"72⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"73⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\43FE.tmp"C:\Users\Admin\AppData\Local\Temp\43FE.tmp"74⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"75⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"76⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"77⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\4565.tmp"C:\Users\Admin\AppData\Local\Temp\4565.tmp"78⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"79⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"80⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"81⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"82⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"83⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"84⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"85⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"86⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"87⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"88⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"89⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"90⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"91⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"92⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"93⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"94⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"95⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"96⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"97⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"98⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"99⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"100⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"101⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"102⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"103⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"104⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"105⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"106⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"107⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"108⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"109⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"110⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"111⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"112⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"113⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"114⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"115⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"116⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"117⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"118⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"119⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"120⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"121⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"122⤵PID:4960
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-