Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
30/04/2024, 02:46
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-30_7ceeef03458fe478c00782e70b35d1a3_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-04-30_7ceeef03458fe478c00782e70b35d1a3_mafia.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-04-30_7ceeef03458fe478c00782e70b35d1a3_mafia.exe
-
Size
487KB
-
MD5
7ceeef03458fe478c00782e70b35d1a3
-
SHA1
0b9c4697a60d27fc422074a35d6549fe412e99a2
-
SHA256
3655288dbdef24e99d5e718c376739abdbe1d08c4b8ced7e1658afb428fa982a
-
SHA512
1ff6285996ec5b067f0dcd8157c2fd86feff52c1c19a4cf0178a49b8d7dcc49e7899477b25380829e216cdeba3900d035a8b26eda4235d6601b8f8817701eff2
-
SSDEEP
6144:qorf3lPvovsgZnqG2C7mOTeiL9DU5PfIoRTR5iGNd1vFBsykVWa8golnMTk2NRS3:HU5rCOTeiJKLTLdT1kh8golASLPfPNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3368 33A3.tmp 3804 343F.tmp 4280 34BC.tmp 5020 3558.tmp 1000 35D5.tmp 3364 3652.tmp 1152 36B0.tmp 3528 371D.tmp 4924 377B.tmp 4404 37D9.tmp 228 3856.tmp 4168 38B3.tmp 4920 3940.tmp 1964 39BD.tmp 5112 3A0B.tmp 3168 3A79.tmp 392 3AD6.tmp 4528 3B34.tmp 408 3B92.tmp 1712 3BF0.tmp 2024 3C3E.tmp 4884 3C9B.tmp 1760 3CEA.tmp 1164 3D47.tmp 4044 3D95.tmp 2328 3E03.tmp 2060 3E51.tmp 2856 3EAF.tmp 2092 3F1C.tmp 3404 3F99.tmp 2324 3FE7.tmp 3432 4064.tmp 4532 40C2.tmp 720 4110.tmp 2148 415E.tmp 1768 41AC.tmp 4520 4249.tmp 4484 4297.tmp 3048 42E5.tmp 1608 4333.tmp 3260 4381.tmp 3848 43DF.tmp 4916 442D.tmp 4220 448B.tmp 3684 44E8.tmp 2768 4546.tmp 3448 4594.tmp 3688 45E2.tmp 4452 4631.tmp 4820 468E.tmp 4672 46EC.tmp 1272 474A.tmp 4696 47A8.tmp 1888 47F6.tmp 3464 4844.tmp 2780 48A2.tmp 2660 48F0.tmp 4744 494D.tmp 3280 499C.tmp 408 49F9.tmp 2724 4A47.tmp 1892 4AA5.tmp 1208 4B03.tmp 1880 4B61.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5032 wrote to memory of 3368 5032 2024-04-30_7ceeef03458fe478c00782e70b35d1a3_mafia.exe 83 PID 5032 wrote to memory of 3368 5032 2024-04-30_7ceeef03458fe478c00782e70b35d1a3_mafia.exe 83 PID 5032 wrote to memory of 3368 5032 2024-04-30_7ceeef03458fe478c00782e70b35d1a3_mafia.exe 83 PID 3368 wrote to memory of 3804 3368 33A3.tmp 84 PID 3368 wrote to memory of 3804 3368 33A3.tmp 84 PID 3368 wrote to memory of 3804 3368 33A3.tmp 84 PID 3804 wrote to memory of 4280 3804 343F.tmp 86 PID 3804 wrote to memory of 4280 3804 343F.tmp 86 PID 3804 wrote to memory of 4280 3804 343F.tmp 86 PID 4280 wrote to memory of 5020 4280 34BC.tmp 88 PID 4280 wrote to memory of 5020 4280 34BC.tmp 88 PID 4280 wrote to memory of 5020 4280 34BC.tmp 88 PID 5020 wrote to memory of 1000 5020 3558.tmp 89 PID 5020 wrote to memory of 1000 5020 3558.tmp 89 PID 5020 wrote to memory of 1000 5020 3558.tmp 89 PID 1000 wrote to memory of 3364 1000 35D5.tmp 91 PID 1000 wrote to memory of 3364 1000 35D5.tmp 91 PID 1000 wrote to memory of 3364 1000 35D5.tmp 91 PID 3364 wrote to memory of 1152 3364 3652.tmp 92 PID 3364 wrote to memory of 1152 3364 3652.tmp 92 PID 3364 wrote to memory of 1152 3364 3652.tmp 92 PID 1152 wrote to memory of 3528 1152 36B0.tmp 93 PID 1152 wrote to memory of 3528 1152 36B0.tmp 93 PID 1152 wrote to memory of 3528 1152 36B0.tmp 93 PID 3528 wrote to memory of 4924 3528 371D.tmp 94 PID 3528 wrote to memory of 4924 3528 371D.tmp 94 PID 3528 wrote to memory of 4924 3528 371D.tmp 94 PID 4924 wrote to memory of 4404 4924 377B.tmp 95 PID 4924 wrote to memory of 4404 4924 377B.tmp 95 PID 4924 wrote to memory of 4404 4924 377B.tmp 95 PID 4404 wrote to memory of 228 4404 37D9.tmp 96 PID 4404 wrote to memory of 228 4404 37D9.tmp 96 PID 4404 wrote to memory of 228 4404 37D9.tmp 96 PID 228 wrote to memory of 4168 228 3856.tmp 97 PID 228 wrote to memory of 4168 228 3856.tmp 97 PID 228 wrote to memory of 4168 228 3856.tmp 97 PID 4168 wrote to memory of 4920 4168 38B3.tmp 98 PID 4168 wrote to memory of 4920 4168 38B3.tmp 98 PID 4168 wrote to memory of 4920 4168 38B3.tmp 98 PID 4920 wrote to memory of 1964 4920 3940.tmp 99 PID 4920 wrote to memory of 1964 4920 3940.tmp 99 PID 4920 wrote to memory of 1964 4920 3940.tmp 99 PID 1964 wrote to memory of 5112 1964 39BD.tmp 100 PID 1964 wrote to memory of 5112 1964 39BD.tmp 100 PID 1964 wrote to memory of 5112 1964 39BD.tmp 100 PID 5112 wrote to memory of 3168 5112 3A0B.tmp 101 PID 5112 wrote to memory of 3168 5112 3A0B.tmp 101 PID 5112 wrote to memory of 3168 5112 3A0B.tmp 101 PID 3168 wrote to memory of 392 3168 3A79.tmp 102 PID 3168 wrote to memory of 392 3168 3A79.tmp 102 PID 3168 wrote to memory of 392 3168 3A79.tmp 102 PID 392 wrote to memory of 4528 392 3AD6.tmp 103 PID 392 wrote to memory of 4528 392 3AD6.tmp 103 PID 392 wrote to memory of 4528 392 3AD6.tmp 103 PID 4528 wrote to memory of 408 4528 3B34.tmp 104 PID 4528 wrote to memory of 408 4528 3B34.tmp 104 PID 4528 wrote to memory of 408 4528 3B34.tmp 104 PID 408 wrote to memory of 1712 408 3B92.tmp 105 PID 408 wrote to memory of 1712 408 3B92.tmp 105 PID 408 wrote to memory of 1712 408 3B92.tmp 105 PID 1712 wrote to memory of 2024 1712 3BF0.tmp 106 PID 1712 wrote to memory of 2024 1712 3BF0.tmp 106 PID 1712 wrote to memory of 2024 1712 3BF0.tmp 106 PID 2024 wrote to memory of 4884 2024 3C3E.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-30_7ceeef03458fe478c00782e70b35d1a3_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-30_7ceeef03458fe478c00782e70b35d1a3_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\33A3.tmp"C:\Users\Admin\AppData\Local\Temp\33A3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\343F.tmp"C:\Users\Admin\AppData\Local\Temp\343F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\34BC.tmp"C:\Users\Admin\AppData\Local\Temp\34BC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\3558.tmp"C:\Users\Admin\AppData\Local\Temp\3558.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\35D5.tmp"C:\Users\Admin\AppData\Local\Temp\35D5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\3652.tmp"C:\Users\Admin\AppData\Local\Temp\3652.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\36B0.tmp"C:\Users\Admin\AppData\Local\Temp\36B0.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\371D.tmp"C:\Users\Admin\AppData\Local\Temp\371D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\377B.tmp"C:\Users\Admin\AppData\Local\Temp\377B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\37D9.tmp"C:\Users\Admin\AppData\Local\Temp\37D9.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\3856.tmp"C:\Users\Admin\AppData\Local\Temp\3856.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\38B3.tmp"C:\Users\Admin\AppData\Local\Temp\38B3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\3940.tmp"C:\Users\Admin\AppData\Local\Temp\3940.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\39BD.tmp"C:\Users\Admin\AppData\Local\Temp\39BD.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\3A79.tmp"C:\Users\Admin\AppData\Local\Temp\3A79.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\3B34.tmp"C:\Users\Admin\AppData\Local\Temp\3B34.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\3B92.tmp"C:\Users\Admin\AppData\Local\Temp\3B92.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\3C3E.tmp"C:\Users\Admin\AppData\Local\Temp\3C3E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"23⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"24⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\3D47.tmp"C:\Users\Admin\AppData\Local\Temp\3D47.tmp"25⤵
- Executes dropped EXE
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\3D95.tmp"C:\Users\Admin\AppData\Local\Temp\3D95.tmp"26⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\3E03.tmp"C:\Users\Admin\AppData\Local\Temp\3E03.tmp"27⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\3E51.tmp"C:\Users\Admin\AppData\Local\Temp\3E51.tmp"28⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\3EAF.tmp"C:\Users\Admin\AppData\Local\Temp\3EAF.tmp"29⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"30⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\3F99.tmp"C:\Users\Admin\AppData\Local\Temp\3F99.tmp"31⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"32⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\4064.tmp"C:\Users\Admin\AppData\Local\Temp\4064.tmp"33⤵
- Executes dropped EXE
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\40C2.tmp"C:\Users\Admin\AppData\Local\Temp\40C2.tmp"34⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\4110.tmp"C:\Users\Admin\AppData\Local\Temp\4110.tmp"35⤵
- Executes dropped EXE
PID:720 -
C:\Users\Admin\AppData\Local\Temp\415E.tmp"C:\Users\Admin\AppData\Local\Temp\415E.tmp"36⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\41AC.tmp"C:\Users\Admin\AppData\Local\Temp\41AC.tmp"37⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"38⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"39⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"40⤵
- Executes dropped EXE
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"41⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"42⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"43⤵
- Executes dropped EXE
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"44⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\448B.tmp"C:\Users\Admin\AppData\Local\Temp\448B.tmp"45⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"46⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"47⤵
- Executes dropped EXE
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"48⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"49⤵
- Executes dropped EXE
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"50⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"51⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\46EC.tmp"C:\Users\Admin\AppData\Local\Temp\46EC.tmp"52⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"53⤵
- Executes dropped EXE
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"54⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"55⤵
- Executes dropped EXE
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"56⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"57⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"58⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"59⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"60⤵
- Executes dropped EXE
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"61⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"62⤵
- Executes dropped EXE
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"63⤵
- Executes dropped EXE
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"64⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"65⤵
- Executes dropped EXE
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"66⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"67⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"68⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"69⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"70⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"71⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"72⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"73⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"74⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"75⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"76⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"77⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"78⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"79⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"80⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"81⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"82⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"83⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"84⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"85⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"86⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"87⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"88⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"89⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"90⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"91⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"92⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"93⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"94⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"95⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"96⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"97⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"98⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"99⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"100⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"101⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"102⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"103⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"104⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"105⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"106⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"107⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"108⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"109⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"110⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"111⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"112⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"113⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"114⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"115⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"116⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"117⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"118⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"119⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"120⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"121⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"122⤵PID:2708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-