Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11/06/2024, 02:56
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-11_5c338ad5abc324135217d39756705321_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-11_5c338ad5abc324135217d39756705321_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-06-11_5c338ad5abc324135217d39756705321_mafia.exe
-
Size
529KB
-
MD5
5c338ad5abc324135217d39756705321
-
SHA1
583f0ddebb163a2e0514950765b04494e967d71e
-
SHA256
2a1e02b307373d6a225adea8dbd9debb86a642ca9bb21d70e97414992a48ea14
-
SHA512
ad4dfeeffbbd7d64d3620233a4bd5069033e48dfd7fed3a1664f1d2188bbedb44fa656bb197567b30fde2ea9943209f3c4ee5a3e80989c188fdad8de5c8bc15d
-
SSDEEP
12288:NU5rCOTeijVz6zJgmFvXlRjd0dIcaWOMdOS/1iTZwlH4Hp:NUQOJj2hFvVRjmeWOMd9/ITSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4884 36DF.tmp 2516 377B.tmp 3720 37F8.tmp 1872 3875.tmp 2192 3A0B.tmp 4660 3A79.tmp 2120 3B05.tmp 5016 3B82.tmp 1972 3BD0.tmp 1976 3C2E.tmp 396 3C8C.tmp 2128 3CF9.tmp 4328 3D47.tmp 4456 3DC4.tmp 3140 3E32.tmp 1240 3EAF.tmp 3060 3F0C.tmp 3096 3F5B.tmp 2104 3FB8.tmp 692 4016.tmp 4736 4093.tmp 1960 4110.tmp 944 415E.tmp 2384 41BC.tmp 648 421A.tmp 2776 4268.tmp 228 42E5.tmp 3220 4352.tmp 2368 43B0.tmp 3420 440E.tmp 4220 446B.tmp 2028 44C9.tmp 4168 4546.tmp 2072 45C3.tmp 920 4621.tmp 4868 467F.tmp 2524 46CD.tmp 4980 471B.tmp 5116 4769.tmp 3492 47B7.tmp 2056 4805.tmp 4544 4853.tmp 4560 48A2.tmp 1364 48FF.tmp 1432 496D.tmp 1504 49CA.tmp 3284 4A28.tmp 4768 4A86.tmp 3940 4AE4.tmp 3524 4B32.tmp 4100 4B80.tmp 3992 4BDE.tmp 4432 4C2C.tmp 4448 4C7A.tmp 1784 4CD8.tmp 2204 4D26.tmp 532 4D74.tmp 4664 4DD2.tmp 5108 4E2F.tmp 5020 4E8D.tmp 1616 4EEB.tmp 2904 4F49.tmp 3148 4FA6.tmp 816 5004.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2880 wrote to memory of 4884 2880 2024-06-11_5c338ad5abc324135217d39756705321_mafia.exe 80 PID 2880 wrote to memory of 4884 2880 2024-06-11_5c338ad5abc324135217d39756705321_mafia.exe 80 PID 2880 wrote to memory of 4884 2880 2024-06-11_5c338ad5abc324135217d39756705321_mafia.exe 80 PID 4884 wrote to memory of 2516 4884 36DF.tmp 81 PID 4884 wrote to memory of 2516 4884 36DF.tmp 81 PID 4884 wrote to memory of 2516 4884 36DF.tmp 81 PID 2516 wrote to memory of 3720 2516 377B.tmp 82 PID 2516 wrote to memory of 3720 2516 377B.tmp 82 PID 2516 wrote to memory of 3720 2516 377B.tmp 82 PID 3720 wrote to memory of 1872 3720 37F8.tmp 83 PID 3720 wrote to memory of 1872 3720 37F8.tmp 83 PID 3720 wrote to memory of 1872 3720 37F8.tmp 83 PID 1872 wrote to memory of 2192 1872 3875.tmp 84 PID 1872 wrote to memory of 2192 1872 3875.tmp 84 PID 1872 wrote to memory of 2192 1872 3875.tmp 84 PID 2192 wrote to memory of 4660 2192 3A0B.tmp 85 PID 2192 wrote to memory of 4660 2192 3A0B.tmp 85 PID 2192 wrote to memory of 4660 2192 3A0B.tmp 85 PID 4660 wrote to memory of 2120 4660 3A79.tmp 86 PID 4660 wrote to memory of 2120 4660 3A79.tmp 86 PID 4660 wrote to memory of 2120 4660 3A79.tmp 86 PID 2120 wrote to memory of 5016 2120 3B05.tmp 87 PID 2120 wrote to memory of 5016 2120 3B05.tmp 87 PID 2120 wrote to memory of 5016 2120 3B05.tmp 87 PID 5016 wrote to memory of 1972 5016 3B82.tmp 88 PID 5016 wrote to memory of 1972 5016 3B82.tmp 88 PID 5016 wrote to memory of 1972 5016 3B82.tmp 88 PID 1972 wrote to memory of 1976 1972 3BD0.tmp 89 PID 1972 wrote to memory of 1976 1972 3BD0.tmp 89 PID 1972 wrote to memory of 1976 1972 3BD0.tmp 89 PID 1976 wrote to memory of 396 1976 3C2E.tmp 90 PID 1976 wrote to memory of 396 1976 3C2E.tmp 90 PID 1976 wrote to memory of 396 1976 3C2E.tmp 90 PID 396 wrote to memory of 2128 396 3C8C.tmp 91 PID 396 wrote to memory of 2128 396 3C8C.tmp 91 PID 396 wrote to memory of 2128 396 3C8C.tmp 91 PID 2128 wrote to memory of 4328 2128 3CF9.tmp 92 PID 2128 wrote to memory of 4328 2128 3CF9.tmp 92 PID 2128 wrote to memory of 4328 2128 3CF9.tmp 92 PID 4328 wrote to memory of 4456 4328 3D47.tmp 93 PID 4328 wrote to memory of 4456 4328 3D47.tmp 93 PID 4328 wrote to memory of 4456 4328 3D47.tmp 93 PID 4456 wrote to memory of 3140 4456 3DC4.tmp 94 PID 4456 wrote to memory of 3140 4456 3DC4.tmp 94 PID 4456 wrote to memory of 3140 4456 3DC4.tmp 94 PID 3140 wrote to memory of 1240 3140 3E32.tmp 95 PID 3140 wrote to memory of 1240 3140 3E32.tmp 95 PID 3140 wrote to memory of 1240 3140 3E32.tmp 95 PID 1240 wrote to memory of 3060 1240 3EAF.tmp 96 PID 1240 wrote to memory of 3060 1240 3EAF.tmp 96 PID 1240 wrote to memory of 3060 1240 3EAF.tmp 96 PID 3060 wrote to memory of 3096 3060 3F0C.tmp 97 PID 3060 wrote to memory of 3096 3060 3F0C.tmp 97 PID 3060 wrote to memory of 3096 3060 3F0C.tmp 97 PID 3096 wrote to memory of 2104 3096 3F5B.tmp 100 PID 3096 wrote to memory of 2104 3096 3F5B.tmp 100 PID 3096 wrote to memory of 2104 3096 3F5B.tmp 100 PID 2104 wrote to memory of 692 2104 3FB8.tmp 101 PID 2104 wrote to memory of 692 2104 3FB8.tmp 101 PID 2104 wrote to memory of 692 2104 3FB8.tmp 101 PID 692 wrote to memory of 4736 692 4016.tmp 102 PID 692 wrote to memory of 4736 692 4016.tmp 102 PID 692 wrote to memory of 4736 692 4016.tmp 102 PID 4736 wrote to memory of 1960 4736 4093.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_5c338ad5abc324135217d39756705321_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_5c338ad5abc324135217d39756705321_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\36DF.tmp"C:\Users\Admin\AppData\Local\Temp\36DF.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\377B.tmp"C:\Users\Admin\AppData\Local\Temp\377B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\37F8.tmp"C:\Users\Admin\AppData\Local\Temp\37F8.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\3875.tmp"C:\Users\Admin\AppData\Local\Temp\3875.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\3A79.tmp"C:\Users\Admin\AppData\Local\Temp\3A79.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\3B05.tmp"C:\Users\Admin\AppData\Local\Temp\3B05.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\3B82.tmp"C:\Users\Admin\AppData\Local\Temp\3B82.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\3BD0.tmp"C:\Users\Admin\AppData\Local\Temp\3BD0.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\3D47.tmp"C:\Users\Admin\AppData\Local\Temp\3D47.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\3E32.tmp"C:\Users\Admin\AppData\Local\Temp\3E32.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\3EAF.tmp"C:\Users\Admin\AppData\Local\Temp\3EAF.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\4016.tmp"C:\Users\Admin\AppData\Local\Temp\4016.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Users\Admin\AppData\Local\Temp\4093.tmp"C:\Users\Admin\AppData\Local\Temp\4093.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\4110.tmp"C:\Users\Admin\AppData\Local\Temp\4110.tmp"23⤵
- Executes dropped EXE
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\415E.tmp"C:\Users\Admin\AppData\Local\Temp\415E.tmp"24⤵
- Executes dropped EXE
PID:944 -
C:\Users\Admin\AppData\Local\Temp\41BC.tmp"C:\Users\Admin\AppData\Local\Temp\41BC.tmp"25⤵
- Executes dropped EXE
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\421A.tmp"C:\Users\Admin\AppData\Local\Temp\421A.tmp"26⤵
- Executes dropped EXE
PID:648 -
C:\Users\Admin\AppData\Local\Temp\4268.tmp"C:\Users\Admin\AppData\Local\Temp\4268.tmp"27⤵
- Executes dropped EXE
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"28⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\4352.tmp"C:\Users\Admin\AppData\Local\Temp\4352.tmp"29⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\43B0.tmp"C:\Users\Admin\AppData\Local\Temp\43B0.tmp"30⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"31⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"32⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"33⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"34⤵
- Executes dropped EXE
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"35⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"36⤵
- Executes dropped EXE
PID:920 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"37⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"38⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"39⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"40⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"41⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"42⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"43⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"44⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"45⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"46⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"47⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"48⤵
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"49⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"50⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"51⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"52⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"53⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"54⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"55⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"56⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"57⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"58⤵
- Executes dropped EXE
PID:532 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"59⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"60⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"61⤵
- Executes dropped EXE
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"62⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"63⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"64⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"65⤵
- Executes dropped EXE
PID:816 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"66⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"67⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"68⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"69⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"70⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"71⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"72⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"73⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"74⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"75⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"76⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"77⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"78⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"79⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"80⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"81⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"82⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"83⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"84⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"85⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"86⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"87⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"88⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"89⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"90⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"91⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"92⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"93⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"94⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"95⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"96⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"97⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"98⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"99⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"100⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"101⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"102⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"103⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"104⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"105⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"106⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"107⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"108⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"109⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"110⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"111⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"112⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"113⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"114⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"115⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"116⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"117⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"118⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"119⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"120⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"121⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"122⤵PID:5084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-