Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
23/02/2024, 09:57
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-23_c592a0fe416aa18ffd672a7dfd8e3d57_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-02-23_c592a0fe416aa18ffd672a7dfd8e3d57_mafia.exe
Resource
win10v2004-20240221-en
General
-
Target
2024-02-23_c592a0fe416aa18ffd672a7dfd8e3d57_mafia.exe
-
Size
486KB
-
MD5
c592a0fe416aa18ffd672a7dfd8e3d57
-
SHA1
1c4939f0e93498c6c339fa1830a0f03fc036a316
-
SHA256
dc96bac1aff1d53cfc7f43c16b2b75a9b198532aa8c5da0d25d9752862152fc3
-
SHA512
ae8cbe2580b130bba26019fa0c3ebb91ccbdaaaf81c2e07ce8d1eec7bfb64d51980dd94fedc713599d73791bbf21bb985e9a12222dcafcd6801b01b582342998
-
SSDEEP
12288:UU5rCOTeiD8abBGPES+LGadrCzfTF6h3Zl5NZ:UUQOJDWEZGad2ghpzN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3508 374C.tmp 4872 37B9.tmp 4124 3817.tmp 1904 3894.tmp 3056 38F2.tmp 1028 3950.tmp 1000 399E.tmp 3288 39EC.tmp 636 3A3A.tmp 2404 3AA7.tmp 2376 3AF6.tmp 1376 3B44.tmp 4972 3CAB.tmp 100 3D09.tmp 1900 3D67.tmp 744 3DC4.tmp 4264 3E32.tmp 1992 3E80.tmp 640 3EDE.tmp 2120 3F5B.tmp 1280 3FB8.tmp 4544 4016.tmp 3224 4083.tmp 4592 40D2.tmp 3416 412F.tmp 4260 417D.tmp 5092 41CC.tmp 2244 4239.tmp 3204 4297.tmp 3424 42F4.tmp 3956 4343.tmp 4996 43A0.tmp 2856 43FE.tmp 3064 445C.tmp 664 44BA.tmp 4388 4527.tmp 4600 4575.tmp 2104 45D3.tmp 1196 4631.tmp 1300 468E.tmp 940 46EC.tmp 3476 473A.tmp 4396 4788.tmp 4620 47E6.tmp 2976 4834.tmp 4432 4882.tmp 4692 48D0.tmp 4608 491F.tmp 2444 497C.tmp 1612 49DA.tmp 2232 4A38.tmp 3688 4A86.tmp 376 4AD4.tmp 4468 4B32.tmp 1516 4B80.tmp 4868 4BCE.tmp 2052 4C1C.tmp 1000 4C7A.tmp 3784 4CC8.tmp 4940 4D16.tmp 2272 4D74.tmp 2968 4DC2.tmp 4160 4E10.tmp 3680 4E5E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3792 wrote to memory of 3508 3792 2024-02-23_c592a0fe416aa18ffd672a7dfd8e3d57_mafia.exe 86 PID 3792 wrote to memory of 3508 3792 2024-02-23_c592a0fe416aa18ffd672a7dfd8e3d57_mafia.exe 86 PID 3792 wrote to memory of 3508 3792 2024-02-23_c592a0fe416aa18ffd672a7dfd8e3d57_mafia.exe 86 PID 3508 wrote to memory of 4872 3508 374C.tmp 87 PID 3508 wrote to memory of 4872 3508 374C.tmp 87 PID 3508 wrote to memory of 4872 3508 374C.tmp 87 PID 4872 wrote to memory of 4124 4872 37B9.tmp 89 PID 4872 wrote to memory of 4124 4872 37B9.tmp 89 PID 4872 wrote to memory of 4124 4872 37B9.tmp 89 PID 4124 wrote to memory of 1904 4124 3817.tmp 91 PID 4124 wrote to memory of 1904 4124 3817.tmp 91 PID 4124 wrote to memory of 1904 4124 3817.tmp 91 PID 1904 wrote to memory of 3056 1904 3894.tmp 92 PID 1904 wrote to memory of 3056 1904 3894.tmp 92 PID 1904 wrote to memory of 3056 1904 3894.tmp 92 PID 3056 wrote to memory of 1028 3056 38F2.tmp 93 PID 3056 wrote to memory of 1028 3056 38F2.tmp 93 PID 3056 wrote to memory of 1028 3056 38F2.tmp 93 PID 1028 wrote to memory of 1000 1028 3950.tmp 94 PID 1028 wrote to memory of 1000 1028 3950.tmp 94 PID 1028 wrote to memory of 1000 1028 3950.tmp 94 PID 1000 wrote to memory of 3288 1000 399E.tmp 95 PID 1000 wrote to memory of 3288 1000 399E.tmp 95 PID 1000 wrote to memory of 3288 1000 399E.tmp 95 PID 3288 wrote to memory of 636 3288 39EC.tmp 96 PID 3288 wrote to memory of 636 3288 39EC.tmp 96 PID 3288 wrote to memory of 636 3288 39EC.tmp 96 PID 636 wrote to memory of 2404 636 3A3A.tmp 97 PID 636 wrote to memory of 2404 636 3A3A.tmp 97 PID 636 wrote to memory of 2404 636 3A3A.tmp 97 PID 2404 wrote to memory of 2376 2404 3AA7.tmp 98 PID 2404 wrote to memory of 2376 2404 3AA7.tmp 98 PID 2404 wrote to memory of 2376 2404 3AA7.tmp 98 PID 2376 wrote to memory of 1376 2376 3AF6.tmp 99 PID 2376 wrote to memory of 1376 2376 3AF6.tmp 99 PID 2376 wrote to memory of 1376 2376 3AF6.tmp 99 PID 1376 wrote to memory of 4972 1376 3B44.tmp 100 PID 1376 wrote to memory of 4972 1376 3B44.tmp 100 PID 1376 wrote to memory of 4972 1376 3B44.tmp 100 PID 4972 wrote to memory of 100 4972 3CAB.tmp 101 PID 4972 wrote to memory of 100 4972 3CAB.tmp 101 PID 4972 wrote to memory of 100 4972 3CAB.tmp 101 PID 100 wrote to memory of 1900 100 3D09.tmp 102 PID 100 wrote to memory of 1900 100 3D09.tmp 102 PID 100 wrote to memory of 1900 100 3D09.tmp 102 PID 1900 wrote to memory of 744 1900 3D67.tmp 103 PID 1900 wrote to memory of 744 1900 3D67.tmp 103 PID 1900 wrote to memory of 744 1900 3D67.tmp 103 PID 744 wrote to memory of 4264 744 3DC4.tmp 104 PID 744 wrote to memory of 4264 744 3DC4.tmp 104 PID 744 wrote to memory of 4264 744 3DC4.tmp 104 PID 4264 wrote to memory of 1992 4264 3E32.tmp 105 PID 4264 wrote to memory of 1992 4264 3E32.tmp 105 PID 4264 wrote to memory of 1992 4264 3E32.tmp 105 PID 1992 wrote to memory of 640 1992 3E80.tmp 106 PID 1992 wrote to memory of 640 1992 3E80.tmp 106 PID 1992 wrote to memory of 640 1992 3E80.tmp 106 PID 640 wrote to memory of 2120 640 3EDE.tmp 107 PID 640 wrote to memory of 2120 640 3EDE.tmp 107 PID 640 wrote to memory of 2120 640 3EDE.tmp 107 PID 2120 wrote to memory of 1280 2120 3F5B.tmp 108 PID 2120 wrote to memory of 1280 2120 3F5B.tmp 108 PID 2120 wrote to memory of 1280 2120 3F5B.tmp 108 PID 1280 wrote to memory of 4544 1280 3FB8.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_c592a0fe416aa18ffd672a7dfd8e3d57_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-23_c592a0fe416aa18ffd672a7dfd8e3d57_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\374C.tmp"C:\Users\Admin\AppData\Local\Temp\374C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\37B9.tmp"C:\Users\Admin\AppData\Local\Temp\37B9.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\3817.tmp"C:\Users\Admin\AppData\Local\Temp\3817.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\3894.tmp"C:\Users\Admin\AppData\Local\Temp\3894.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\38F2.tmp"C:\Users\Admin\AppData\Local\Temp\38F2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\3950.tmp"C:\Users\Admin\AppData\Local\Temp\3950.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\399E.tmp"C:\Users\Admin\AppData\Local\Temp\399E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\39EC.tmp"C:\Users\Admin\AppData\Local\Temp\39EC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\3AA7.tmp"C:\Users\Admin\AppData\Local\Temp\3AA7.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\3B44.tmp"C:\Users\Admin\AppData\Local\Temp\3B44.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\3CAB.tmp"C:\Users\Admin\AppData\Local\Temp\3CAB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\3D09.tmp"C:\Users\Admin\AppData\Local\Temp\3D09.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100 -
C:\Users\Admin\AppData\Local\Temp\3D67.tmp"C:\Users\Admin\AppData\Local\Temp\3D67.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\3E32.tmp"C:\Users\Admin\AppData\Local\Temp\3E32.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\3E80.tmp"C:\Users\Admin\AppData\Local\Temp\3E80.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\4016.tmp"C:\Users\Admin\AppData\Local\Temp\4016.tmp"23⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\4083.tmp"C:\Users\Admin\AppData\Local\Temp\4083.tmp"24⤵
- Executes dropped EXE
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\40D2.tmp"C:\Users\Admin\AppData\Local\Temp\40D2.tmp"25⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\412F.tmp"C:\Users\Admin\AppData\Local\Temp\412F.tmp"26⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"27⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"28⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"29⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"30⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\42F4.tmp"C:\Users\Admin\AppData\Local\Temp\42F4.tmp"31⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"32⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"33⤵
- Executes dropped EXE
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\43FE.tmp"C:\Users\Admin\AppData\Local\Temp\43FE.tmp"34⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"35⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"36⤵
- Executes dropped EXE
PID:664 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"37⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"38⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\45D3.tmp"C:\Users\Admin\AppData\Local\Temp\45D3.tmp"39⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"40⤵
- Executes dropped EXE
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"41⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\46EC.tmp"C:\Users\Admin\AppData\Local\Temp\46EC.tmp"42⤵
- Executes dropped EXE
PID:940 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"43⤵
- Executes dropped EXE
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"44⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"45⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"46⤵
- Executes dropped EXE
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"47⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"48⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"49⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"50⤵
- Executes dropped EXE
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"51⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"52⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"53⤵
- Executes dropped EXE
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"54⤵
- Executes dropped EXE
PID:376 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"55⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"56⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"57⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"58⤵
- Executes dropped EXE
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"59⤵
- Executes dropped EXE
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"60⤵
- Executes dropped EXE
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"61⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"62⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"63⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"64⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"65⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"66⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"67⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"68⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"69⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"70⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"71⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"72⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"73⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"74⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"75⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"76⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"77⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"78⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"79⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"80⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"81⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"82⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"83⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"84⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"85⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"86⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"87⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"88⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"89⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"90⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"91⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"92⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"93⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"94⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"95⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"96⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"97⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"98⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"99⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"100⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"101⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"102⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"103⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"104⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"105⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"106⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"107⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"108⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"109⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"110⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"111⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"112⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"113⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"114⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"115⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"116⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"117⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"118⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"119⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"120⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"121⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"122⤵PID:4484
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-