Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 13:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-25_ce5eff8254dc01a29d78c413d2c39633_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-25_ce5eff8254dc01a29d78c413d2c39633_mafia.exe
Resource
win10v2004-20240611-en
General
-
Target
2024-06-25_ce5eff8254dc01a29d78c413d2c39633_mafia.exe
-
Size
527KB
-
MD5
ce5eff8254dc01a29d78c413d2c39633
-
SHA1
adf21f26607f8ccfc71992ae35c07f14752f6610
-
SHA256
28555ab13233641b7bdb2160fdc399ca0b136ba5aebe48d38ebd9ac7ca4c8354
-
SHA512
77c0a04a1a1dc6c1c4bb780c16cefbefd42dfb7c7c38084279a3cea5cf807ae539b2f174f3e128bd4d6c6adfdfb3ec910c82ac1ed4f9cd391fb46ee58440279b
-
SSDEEP
12288:fU5rCOTeidfytT/KG1HBmpGb3pKV/6DZu:fUQOJdaj1hsGMJ6Do
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4384 3057.tmp 656 30B5.tmp 2844 3132.tmp 1464 319F.tmp 3592 322C.tmp 4496 3289.tmp 2740 32E7.tmp 3980 3345.tmp 4748 33B2.tmp 1920 344E.tmp 2860 349D.tmp 400 34FA.tmp 3252 3548.tmp 1400 35B6.tmp 3796 3614.tmp 1232 3681.tmp 2352 370E.tmp 4520 379A.tmp 1428 3827.tmp 4788 38A4.tmp 3232 3902.tmp 4856 3950.tmp 4236 39AD.tmp 1928 3A1B.tmp 4916 3A69.tmp 1084 3AC7.tmp 3912 3B24.tmp 752 3B82.tmp 2272 3BE0.tmp 3404 3C4D.tmp 1888 3CBB.tmp 1260 3D18.tmp 4432 3D95.tmp 3840 3DE4.tmp 1072 3E41.tmp 2176 3E8F.tmp 1880 3EDE.tmp 4608 3F5B.tmp 1540 3FB8.tmp 4296 4006.tmp 1748 4064.tmp 4404 40B2.tmp 4492 4100.tmp 3784 414F.tmp 4356 41AC.tmp 1800 41FA.tmp 2464 4249.tmp 1440 42A6.tmp 2220 4304.tmp 2032 4352.tmp 2608 43DF.tmp 3188 443D.tmp 3628 449A.tmp 4408 44E8.tmp 792 4537.tmp 2612 4585.tmp 3068 45E2.tmp 4696 4631.tmp 3164 468E.tmp 2388 46EC.tmp 4316 474A.tmp 3796 47A8.tmp 4452 4805.tmp 2496 4863.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3008 wrote to memory of 4384 3008 2024-06-25_ce5eff8254dc01a29d78c413d2c39633_mafia.exe 83 PID 3008 wrote to memory of 4384 3008 2024-06-25_ce5eff8254dc01a29d78c413d2c39633_mafia.exe 83 PID 3008 wrote to memory of 4384 3008 2024-06-25_ce5eff8254dc01a29d78c413d2c39633_mafia.exe 83 PID 4384 wrote to memory of 656 4384 3057.tmp 84 PID 4384 wrote to memory of 656 4384 3057.tmp 84 PID 4384 wrote to memory of 656 4384 3057.tmp 84 PID 656 wrote to memory of 2844 656 30B5.tmp 85 PID 656 wrote to memory of 2844 656 30B5.tmp 85 PID 656 wrote to memory of 2844 656 30B5.tmp 85 PID 2844 wrote to memory of 1464 2844 3132.tmp 87 PID 2844 wrote to memory of 1464 2844 3132.tmp 87 PID 2844 wrote to memory of 1464 2844 3132.tmp 87 PID 1464 wrote to memory of 3592 1464 319F.tmp 89 PID 1464 wrote to memory of 3592 1464 319F.tmp 89 PID 1464 wrote to memory of 3592 1464 319F.tmp 89 PID 3592 wrote to memory of 4496 3592 322C.tmp 91 PID 3592 wrote to memory of 4496 3592 322C.tmp 91 PID 3592 wrote to memory of 4496 3592 322C.tmp 91 PID 4496 wrote to memory of 2740 4496 3289.tmp 92 PID 4496 wrote to memory of 2740 4496 3289.tmp 92 PID 4496 wrote to memory of 2740 4496 3289.tmp 92 PID 2740 wrote to memory of 3980 2740 32E7.tmp 93 PID 2740 wrote to memory of 3980 2740 32E7.tmp 93 PID 2740 wrote to memory of 3980 2740 32E7.tmp 93 PID 3980 wrote to memory of 4748 3980 3345.tmp 94 PID 3980 wrote to memory of 4748 3980 3345.tmp 94 PID 3980 wrote to memory of 4748 3980 3345.tmp 94 PID 4748 wrote to memory of 1920 4748 33B2.tmp 95 PID 4748 wrote to memory of 1920 4748 33B2.tmp 95 PID 4748 wrote to memory of 1920 4748 33B2.tmp 95 PID 1920 wrote to memory of 2860 1920 344E.tmp 96 PID 1920 wrote to memory of 2860 1920 344E.tmp 96 PID 1920 wrote to memory of 2860 1920 344E.tmp 96 PID 2860 wrote to memory of 400 2860 349D.tmp 97 PID 2860 wrote to memory of 400 2860 349D.tmp 97 PID 2860 wrote to memory of 400 2860 349D.tmp 97 PID 400 wrote to memory of 3252 400 34FA.tmp 98 PID 400 wrote to memory of 3252 400 34FA.tmp 98 PID 400 wrote to memory of 3252 400 34FA.tmp 98 PID 3252 wrote to memory of 1400 3252 3548.tmp 99 PID 3252 wrote to memory of 1400 3252 3548.tmp 99 PID 3252 wrote to memory of 1400 3252 3548.tmp 99 PID 1400 wrote to memory of 3796 1400 35B6.tmp 100 PID 1400 wrote to memory of 3796 1400 35B6.tmp 100 PID 1400 wrote to memory of 3796 1400 35B6.tmp 100 PID 3796 wrote to memory of 1232 3796 3614.tmp 101 PID 3796 wrote to memory of 1232 3796 3614.tmp 101 PID 3796 wrote to memory of 1232 3796 3614.tmp 101 PID 1232 wrote to memory of 2352 1232 3681.tmp 102 PID 1232 wrote to memory of 2352 1232 3681.tmp 102 PID 1232 wrote to memory of 2352 1232 3681.tmp 102 PID 2352 wrote to memory of 4520 2352 370E.tmp 103 PID 2352 wrote to memory of 4520 2352 370E.tmp 103 PID 2352 wrote to memory of 4520 2352 370E.tmp 103 PID 4520 wrote to memory of 1428 4520 379A.tmp 104 PID 4520 wrote to memory of 1428 4520 379A.tmp 104 PID 4520 wrote to memory of 1428 4520 379A.tmp 104 PID 1428 wrote to memory of 4788 1428 3827.tmp 105 PID 1428 wrote to memory of 4788 1428 3827.tmp 105 PID 1428 wrote to memory of 4788 1428 3827.tmp 105 PID 4788 wrote to memory of 3232 4788 38A4.tmp 106 PID 4788 wrote to memory of 3232 4788 38A4.tmp 106 PID 4788 wrote to memory of 3232 4788 38A4.tmp 106 PID 3232 wrote to memory of 4856 3232 3902.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-25_ce5eff8254dc01a29d78c413d2c39633_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-25_ce5eff8254dc01a29d78c413d2c39633_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\3057.tmp"C:\Users\Admin\AppData\Local\Temp\3057.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\30B5.tmp"C:\Users\Admin\AppData\Local\Temp\30B5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Users\Admin\AppData\Local\Temp\3132.tmp"C:\Users\Admin\AppData\Local\Temp\3132.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\319F.tmp"C:\Users\Admin\AppData\Local\Temp\319F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\322C.tmp"C:\Users\Admin\AppData\Local\Temp\322C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\3289.tmp"C:\Users\Admin\AppData\Local\Temp\3289.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\32E7.tmp"C:\Users\Admin\AppData\Local\Temp\32E7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\3345.tmp"C:\Users\Admin\AppData\Local\Temp\3345.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\33B2.tmp"C:\Users\Admin\AppData\Local\Temp\33B2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\344E.tmp"C:\Users\Admin\AppData\Local\Temp\344E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\349D.tmp"C:\Users\Admin\AppData\Local\Temp\349D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\34FA.tmp"C:\Users\Admin\AppData\Local\Temp\34FA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\3548.tmp"C:\Users\Admin\AppData\Local\Temp\3548.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\35B6.tmp"C:\Users\Admin\AppData\Local\Temp\35B6.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\3614.tmp"C:\Users\Admin\AppData\Local\Temp\3614.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\3681.tmp"C:\Users\Admin\AppData\Local\Temp\3681.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\370E.tmp"C:\Users\Admin\AppData\Local\Temp\370E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\379A.tmp"C:\Users\Admin\AppData\Local\Temp\379A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\3827.tmp"C:\Users\Admin\AppData\Local\Temp\3827.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\38A4.tmp"C:\Users\Admin\AppData\Local\Temp\38A4.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\3902.tmp"C:\Users\Admin\AppData\Local\Temp\3902.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\3950.tmp"C:\Users\Admin\AppData\Local\Temp\3950.tmp"23⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\39AD.tmp"C:\Users\Admin\AppData\Local\Temp\39AD.tmp"24⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\3A1B.tmp"C:\Users\Admin\AppData\Local\Temp\3A1B.tmp"25⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\3A69.tmp"C:\Users\Admin\AppData\Local\Temp\3A69.tmp"26⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"27⤵
- Executes dropped EXE
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\3B24.tmp"C:\Users\Admin\AppData\Local\Temp\3B24.tmp"28⤵
- Executes dropped EXE
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\3B82.tmp"C:\Users\Admin\AppData\Local\Temp\3B82.tmp"29⤵
- Executes dropped EXE
PID:752 -
C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"30⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"31⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"32⤵
- Executes dropped EXE
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\3D18.tmp"C:\Users\Admin\AppData\Local\Temp\3D18.tmp"33⤵
- Executes dropped EXE
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\3D95.tmp"C:\Users\Admin\AppData\Local\Temp\3D95.tmp"34⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"35⤵
- Executes dropped EXE
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\3E41.tmp"C:\Users\Admin\AppData\Local\Temp\3E41.tmp"36⤵
- Executes dropped EXE
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"37⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"38⤵
- Executes dropped EXE
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"39⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"40⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\4006.tmp"C:\Users\Admin\AppData\Local\Temp\4006.tmp"41⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\4064.tmp"C:\Users\Admin\AppData\Local\Temp\4064.tmp"42⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"43⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\4100.tmp"C:\Users\Admin\AppData\Local\Temp\4100.tmp"44⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\414F.tmp"C:\Users\Admin\AppData\Local\Temp\414F.tmp"45⤵
- Executes dropped EXE
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\41AC.tmp"C:\Users\Admin\AppData\Local\Temp\41AC.tmp"46⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"47⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"48⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\42A6.tmp"C:\Users\Admin\AppData\Local\Temp\42A6.tmp"49⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\4304.tmp"C:\Users\Admin\AppData\Local\Temp\4304.tmp"50⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\4352.tmp"C:\Users\Admin\AppData\Local\Temp\4352.tmp"51⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"52⤵
- Executes dropped EXE
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\443D.tmp"C:\Users\Admin\AppData\Local\Temp\443D.tmp"53⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"54⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"55⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"56⤵
- Executes dropped EXE
PID:792 -
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"57⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"58⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"59⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"60⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\46EC.tmp"C:\Users\Admin\AppData\Local\Temp\46EC.tmp"61⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"62⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"63⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"64⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"65⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"66⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"67⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"68⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"69⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"70⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"71⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"72⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"73⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"74⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"75⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"76⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"77⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"78⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"79⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"80⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"81⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"82⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"83⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"84⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"85⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"86⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"87⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"88⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"89⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"90⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"91⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"92⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"93⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"94⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"95⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"96⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"97⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"98⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"99⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"100⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"101⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"102⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"103⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"104⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"105⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"106⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"107⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"108⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"109⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"110⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"111⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"112⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"113⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"114⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"115⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"116⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"117⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"118⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"119⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"120⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"121⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"122⤵PID:3692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-