Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 20:12
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-14_d1230f16348cd8180f106270d9cd2526_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-05-14_d1230f16348cd8180f106270d9cd2526_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-14_d1230f16348cd8180f106270d9cd2526_mafia.exe
-
Size
486KB
-
MD5
d1230f16348cd8180f106270d9cd2526
-
SHA1
5b3c2afde21df77fac0ae119cf0bd147514b4022
-
SHA256
b4489daaae9fae5f9e5f5fd11c0ef0abc36a65c844e5d20a5500c83d6a37eda8
-
SHA512
620e30a9af41fbd1b120466afd4b217e96f276992a94fa1ac7d728b637b96e742b5913252bed71f2ac9d216dddec6070e8d9b9f8e5b22fbed927a00ec7e2d97a
-
SSDEEP
6144:Forf3lPvovsgZnqG2C7mOTeiLfD79SXDsn+DTbtGd+uDuCCYwDtHs1uRinsH3dZ:UU5rCOTeiDMXA+zu1utcsNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3444 3577.tmp 2012 35E5.tmp 220 3633.tmp 1276 3691.tmp 3596 36DF.tmp 1612 373C.tmp 676 37AA.tmp 768 3817.tmp 2976 3865.tmp 372 38B3.tmp 4140 3930.tmp 4592 398E.tmp 2220 39DC.tmp 2672 3A3A.tmp 4392 3A88.tmp 1588 3AE6.tmp 5116 3B34.tmp 820 3B82.tmp 2504 3BE0.tmp 1980 3C2E.tmp 2872 3CAB.tmp 3164 3CF9.tmp 552 3D47.tmp 3524 3D95.tmp 1828 3DE4.tmp 1972 3E51.tmp 2324 3EAF.tmp 1608 3EFD.tmp 2200 3F5B.tmp 2764 3FC8.tmp 3152 4026.tmp 4396 4074.tmp 3000 40D2.tmp 1028 4120.tmp 1192 416E.tmp 4792 41EB.tmp 2148 4239.tmp 2040 4287.tmp 2156 42D5.tmp 3784 4323.tmp 1968 4371.tmp 2984 43C0.tmp 4592 441D.tmp 4044 447B.tmp 4900 44C9.tmp 884 4517.tmp 1640 4565.tmp 2152 45B4.tmp 2088 4611.tmp 2408 465F.tmp 3400 46AE.tmp 4876 46FC.tmp 4008 4788.tmp 4508 4844.tmp 1924 48E0.tmp 4628 496D.tmp 552 4A19.tmp 3972 4A96.tmp 2744 4B61.tmp 4844 4BFD.tmp 1972 4C7A.tmp 1660 4CE7.tmp 4744 4D45.tmp 3624 4DA3.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2044 wrote to memory of 3444 2044 2024-05-14_d1230f16348cd8180f106270d9cd2526_mafia.exe 82 PID 2044 wrote to memory of 3444 2044 2024-05-14_d1230f16348cd8180f106270d9cd2526_mafia.exe 82 PID 2044 wrote to memory of 3444 2044 2024-05-14_d1230f16348cd8180f106270d9cd2526_mafia.exe 82 PID 3444 wrote to memory of 2012 3444 3577.tmp 84 PID 3444 wrote to memory of 2012 3444 3577.tmp 84 PID 3444 wrote to memory of 2012 3444 3577.tmp 84 PID 2012 wrote to memory of 220 2012 35E5.tmp 86 PID 2012 wrote to memory of 220 2012 35E5.tmp 86 PID 2012 wrote to memory of 220 2012 35E5.tmp 86 PID 220 wrote to memory of 1276 220 3633.tmp 87 PID 220 wrote to memory of 1276 220 3633.tmp 87 PID 220 wrote to memory of 1276 220 3633.tmp 87 PID 1276 wrote to memory of 3596 1276 3691.tmp 89 PID 1276 wrote to memory of 3596 1276 3691.tmp 89 PID 1276 wrote to memory of 3596 1276 3691.tmp 89 PID 3596 wrote to memory of 1612 3596 36DF.tmp 91 PID 3596 wrote to memory of 1612 3596 36DF.tmp 91 PID 3596 wrote to memory of 1612 3596 36DF.tmp 91 PID 1612 wrote to memory of 676 1612 373C.tmp 92 PID 1612 wrote to memory of 676 1612 373C.tmp 92 PID 1612 wrote to memory of 676 1612 373C.tmp 92 PID 676 wrote to memory of 768 676 37AA.tmp 93 PID 676 wrote to memory of 768 676 37AA.tmp 93 PID 676 wrote to memory of 768 676 37AA.tmp 93 PID 768 wrote to memory of 2976 768 3817.tmp 132 PID 768 wrote to memory of 2976 768 3817.tmp 132 PID 768 wrote to memory of 2976 768 3817.tmp 132 PID 2976 wrote to memory of 372 2976 3865.tmp 95 PID 2976 wrote to memory of 372 2976 3865.tmp 95 PID 2976 wrote to memory of 372 2976 3865.tmp 95 PID 372 wrote to memory of 4140 372 38B3.tmp 96 PID 372 wrote to memory of 4140 372 38B3.tmp 96 PID 372 wrote to memory of 4140 372 38B3.tmp 96 PID 4140 wrote to memory of 4592 4140 3930.tmp 135 PID 4140 wrote to memory of 4592 4140 3930.tmp 135 PID 4140 wrote to memory of 4592 4140 3930.tmp 135 PID 4592 wrote to memory of 2220 4592 398E.tmp 98 PID 4592 wrote to memory of 2220 4592 398E.tmp 98 PID 4592 wrote to memory of 2220 4592 398E.tmp 98 PID 2220 wrote to memory of 2672 2220 39DC.tmp 99 PID 2220 wrote to memory of 2672 2220 39DC.tmp 99 PID 2220 wrote to memory of 2672 2220 39DC.tmp 99 PID 2672 wrote to memory of 4392 2672 3A3A.tmp 100 PID 2672 wrote to memory of 4392 2672 3A3A.tmp 100 PID 2672 wrote to memory of 4392 2672 3A3A.tmp 100 PID 4392 wrote to memory of 1588 4392 3A88.tmp 101 PID 4392 wrote to memory of 1588 4392 3A88.tmp 101 PID 4392 wrote to memory of 1588 4392 3A88.tmp 101 PID 1588 wrote to memory of 5116 1588 3AE6.tmp 102 PID 1588 wrote to memory of 5116 1588 3AE6.tmp 102 PID 1588 wrote to memory of 5116 1588 3AE6.tmp 102 PID 5116 wrote to memory of 820 5116 3B34.tmp 103 PID 5116 wrote to memory of 820 5116 3B34.tmp 103 PID 5116 wrote to memory of 820 5116 3B34.tmp 103 PID 820 wrote to memory of 2504 820 3B82.tmp 104 PID 820 wrote to memory of 2504 820 3B82.tmp 104 PID 820 wrote to memory of 2504 820 3B82.tmp 104 PID 2504 wrote to memory of 1980 2504 3BE0.tmp 105 PID 2504 wrote to memory of 1980 2504 3BE0.tmp 105 PID 2504 wrote to memory of 1980 2504 3BE0.tmp 105 PID 1980 wrote to memory of 2872 1980 3C2E.tmp 107 PID 1980 wrote to memory of 2872 1980 3C2E.tmp 107 PID 1980 wrote to memory of 2872 1980 3C2E.tmp 107 PID 2872 wrote to memory of 3164 2872 3CAB.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-14_d1230f16348cd8180f106270d9cd2526_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-14_d1230f16348cd8180f106270d9cd2526_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\3577.tmp"C:\Users\Admin\AppData\Local\Temp\3577.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\35E5.tmp"C:\Users\Admin\AppData\Local\Temp\35E5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\3633.tmp"C:\Users\Admin\AppData\Local\Temp\3633.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\3691.tmp"C:\Users\Admin\AppData\Local\Temp\3691.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\36DF.tmp"C:\Users\Admin\AppData\Local\Temp\36DF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\373C.tmp"C:\Users\Admin\AppData\Local\Temp\373C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\37AA.tmp"C:\Users\Admin\AppData\Local\Temp\37AA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Users\Admin\AppData\Local\Temp\3817.tmp"C:\Users\Admin\AppData\Local\Temp\3817.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\3865.tmp"C:\Users\Admin\AppData\Local\Temp\3865.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\38B3.tmp"C:\Users\Admin\AppData\Local\Temp\38B3.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Users\Admin\AppData\Local\Temp\3930.tmp"C:\Users\Admin\AppData\Local\Temp\3930.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\398E.tmp"C:\Users\Admin\AppData\Local\Temp\398E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\39DC.tmp"C:\Users\Admin\AppData\Local\Temp\39DC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\3A88.tmp"C:\Users\Admin\AppData\Local\Temp\3A88.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\3B34.tmp"C:\Users\Admin\AppData\Local\Temp\3B34.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\3B82.tmp"C:\Users\Admin\AppData\Local\Temp\3B82.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\3CAB.tmp"C:\Users\Admin\AppData\Local\Temp\3CAB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"23⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\3D47.tmp"C:\Users\Admin\AppData\Local\Temp\3D47.tmp"24⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\3D95.tmp"C:\Users\Admin\AppData\Local\Temp\3D95.tmp"25⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"26⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\3E51.tmp"C:\Users\Admin\AppData\Local\Temp\3E51.tmp"27⤵
- Executes dropped EXE
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\3EAF.tmp"C:\Users\Admin\AppData\Local\Temp\3EAF.tmp"28⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"29⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"30⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"31⤵
- Executes dropped EXE
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\4026.tmp"C:\Users\Admin\AppData\Local\Temp\4026.tmp"32⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\4074.tmp"C:\Users\Admin\AppData\Local\Temp\4074.tmp"33⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\40D2.tmp"C:\Users\Admin\AppData\Local\Temp\40D2.tmp"34⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\4120.tmp"C:\Users\Admin\AppData\Local\Temp\4120.tmp"35⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\416E.tmp"C:\Users\Admin\AppData\Local\Temp\416E.tmp"36⤵
- Executes dropped EXE
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\41EB.tmp"C:\Users\Admin\AppData\Local\Temp\41EB.tmp"37⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"38⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\4287.tmp"C:\Users\Admin\AppData\Local\Temp\4287.tmp"39⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"40⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"41⤵
- Executes dropped EXE
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\4371.tmp"C:\Users\Admin\AppData\Local\Temp\4371.tmp"42⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\43C0.tmp"C:\Users\Admin\AppData\Local\Temp\43C0.tmp"43⤵
- Executes dropped EXE
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\441D.tmp"C:\Users\Admin\AppData\Local\Temp\441D.tmp"44⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\447B.tmp"C:\Users\Admin\AppData\Local\Temp\447B.tmp"45⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"46⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"47⤵
- Executes dropped EXE
PID:884 -
C:\Users\Admin\AppData\Local\Temp\4565.tmp"C:\Users\Admin\AppData\Local\Temp\4565.tmp"48⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"49⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"50⤵
- Executes dropped EXE
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"51⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"52⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"53⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"54⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"55⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"56⤵
- Executes dropped EXE
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"57⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\4A19.tmp"C:\Users\Admin\AppData\Local\Temp\4A19.tmp"58⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"59⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"60⤵
- Executes dropped EXE
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"61⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"62⤵
- Executes dropped EXE
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"63⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"64⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"65⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"66⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"67⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"68⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"69⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"70⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"71⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"72⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"73⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"74⤵PID:424
-
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"75⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"76⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"77⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"78⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"79⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"80⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"81⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"82⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"83⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"84⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"85⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"86⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"87⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"88⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"89⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"90⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"91⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"92⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"93⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"94⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"95⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"96⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"97⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"98⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"99⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"100⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"101⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"102⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"103⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"104⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"105⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"106⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"107⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"108⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"109⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"110⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"111⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"112⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"113⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"114⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"115⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"116⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"117⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"118⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"119⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"120⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"121⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"122⤵PID:2948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-