Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
23/01/2024, 22:43
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-23_02d5e86724988fd7e70380cc5e487ed5_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-23_02d5e86724988fd7e70380cc5e487ed5_mafia.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-01-23_02d5e86724988fd7e70380cc5e487ed5_mafia.exe
-
Size
488KB
-
MD5
02d5e86724988fd7e70380cc5e487ed5
-
SHA1
36760530949abfbe3b7d4006e6c50f377636461d
-
SHA256
e8c9fe00bfe8ffdde2697dad4f54d2b1526b8f2edec6e96c5136bfe1a3509f16
-
SHA512
4ec7a6e711f76e5d6afd76715ba069df5d12143ef68835c3d50eb94305b826ce95f041a28d336473ccbe6bc514a11207f6451a148b9b3155ace2f43095148635
-
SSDEEP
12288:/U5rCOTeiDLaYwr6kngNlzqky2UHx9FIlPG8NZ:/UQOJDOYt6gbb+Hv98N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3100 4602.tmp 5000 468E.tmp 3312 470B.tmp 1996 4788.tmp 3776 47E6.tmp 3240 4853.tmp 3316 48B1.tmp 1156 48FF.tmp 5028 495D.tmp 1936 49BB.tmp 5080 4A09.tmp 1396 4A57.tmp 1588 4AA5.tmp 4616 4AF3.tmp 1644 4B41.tmp 2108 4B9F.tmp 3408 4BED.tmp 868 4C4B.tmp 3176 4CA9.tmp 1564 4CF7.tmp 2896 4D55.tmp 3372 4DA3.tmp 812 4DF1.tmp 5084 4E3F.tmp 4400 4E9D.tmp 400 4EEB.tmp 4548 4F39.tmp 2428 4F97.tmp 1076 4FE5.tmp 516 5033.tmp 1404 5081.tmp 4336 50CF.tmp 2932 512D.tmp 4108 518B.tmp 2404 51D9.tmp 3952 5227.tmp 3284 5285.tmp 712 52D3.tmp 4404 5321.tmp 2940 536F.tmp 2656 53CD.tmp 3888 542B.tmp 1104 5479.tmp 3336 54C7.tmp 2000 5515.tmp 4700 5563.tmp 3180 55C1.tmp 2132 561F.tmp 5108 569C.tmp 2756 5728.tmp 3780 57B5.tmp 2232 5861.tmp 1568 58ED.tmp 1884 597A.tmp 1416 59D8.tmp 2424 5A45.tmp 2152 5AA3.tmp 2124 5B01.tmp 2512 5B4F.tmp 2604 5BAD.tmp 440 5C0A.tmp 4264 5C68.tmp 2768 5CC6.tmp 3108 5D24.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1896 wrote to memory of 3100 1896 2024-01-23_02d5e86724988fd7e70380cc5e487ed5_mafia.exe 87 PID 1896 wrote to memory of 3100 1896 2024-01-23_02d5e86724988fd7e70380cc5e487ed5_mafia.exe 87 PID 1896 wrote to memory of 3100 1896 2024-01-23_02d5e86724988fd7e70380cc5e487ed5_mafia.exe 87 PID 3100 wrote to memory of 5000 3100 4602.tmp 89 PID 3100 wrote to memory of 5000 3100 4602.tmp 89 PID 3100 wrote to memory of 5000 3100 4602.tmp 89 PID 5000 wrote to memory of 3312 5000 468E.tmp 90 PID 5000 wrote to memory of 3312 5000 468E.tmp 90 PID 5000 wrote to memory of 3312 5000 468E.tmp 90 PID 3312 wrote to memory of 1996 3312 470B.tmp 92 PID 3312 wrote to memory of 1996 3312 470B.tmp 92 PID 3312 wrote to memory of 1996 3312 470B.tmp 92 PID 1996 wrote to memory of 3776 1996 4788.tmp 93 PID 1996 wrote to memory of 3776 1996 4788.tmp 93 PID 1996 wrote to memory of 3776 1996 4788.tmp 93 PID 3776 wrote to memory of 3240 3776 47E6.tmp 94 PID 3776 wrote to memory of 3240 3776 47E6.tmp 94 PID 3776 wrote to memory of 3240 3776 47E6.tmp 94 PID 3240 wrote to memory of 3316 3240 4853.tmp 95 PID 3240 wrote to memory of 3316 3240 4853.tmp 95 PID 3240 wrote to memory of 3316 3240 4853.tmp 95 PID 3316 wrote to memory of 1156 3316 48B1.tmp 96 PID 3316 wrote to memory of 1156 3316 48B1.tmp 96 PID 3316 wrote to memory of 1156 3316 48B1.tmp 96 PID 1156 wrote to memory of 5028 1156 48FF.tmp 97 PID 1156 wrote to memory of 5028 1156 48FF.tmp 97 PID 1156 wrote to memory of 5028 1156 48FF.tmp 97 PID 5028 wrote to memory of 1936 5028 495D.tmp 98 PID 5028 wrote to memory of 1936 5028 495D.tmp 98 PID 5028 wrote to memory of 1936 5028 495D.tmp 98 PID 1936 wrote to memory of 5080 1936 49BB.tmp 99 PID 1936 wrote to memory of 5080 1936 49BB.tmp 99 PID 1936 wrote to memory of 5080 1936 49BB.tmp 99 PID 5080 wrote to memory of 1396 5080 4A09.tmp 100 PID 5080 wrote to memory of 1396 5080 4A09.tmp 100 PID 5080 wrote to memory of 1396 5080 4A09.tmp 100 PID 1396 wrote to memory of 1588 1396 4A57.tmp 101 PID 1396 wrote to memory of 1588 1396 4A57.tmp 101 PID 1396 wrote to memory of 1588 1396 4A57.tmp 101 PID 1588 wrote to memory of 4616 1588 4AA5.tmp 102 PID 1588 wrote to memory of 4616 1588 4AA5.tmp 102 PID 1588 wrote to memory of 4616 1588 4AA5.tmp 102 PID 4616 wrote to memory of 1644 4616 4AF3.tmp 103 PID 4616 wrote to memory of 1644 4616 4AF3.tmp 103 PID 4616 wrote to memory of 1644 4616 4AF3.tmp 103 PID 1644 wrote to memory of 2108 1644 4B41.tmp 104 PID 1644 wrote to memory of 2108 1644 4B41.tmp 104 PID 1644 wrote to memory of 2108 1644 4B41.tmp 104 PID 2108 wrote to memory of 3408 2108 4B9F.tmp 105 PID 2108 wrote to memory of 3408 2108 4B9F.tmp 105 PID 2108 wrote to memory of 3408 2108 4B9F.tmp 105 PID 3408 wrote to memory of 868 3408 4BED.tmp 106 PID 3408 wrote to memory of 868 3408 4BED.tmp 106 PID 3408 wrote to memory of 868 3408 4BED.tmp 106 PID 868 wrote to memory of 3176 868 4C4B.tmp 108 PID 868 wrote to memory of 3176 868 4C4B.tmp 108 PID 868 wrote to memory of 3176 868 4C4B.tmp 108 PID 3176 wrote to memory of 1564 3176 4CA9.tmp 107 PID 3176 wrote to memory of 1564 3176 4CA9.tmp 107 PID 3176 wrote to memory of 1564 3176 4CA9.tmp 107 PID 1564 wrote to memory of 2896 1564 4CF7.tmp 136 PID 1564 wrote to memory of 2896 1564 4CF7.tmp 136 PID 1564 wrote to memory of 2896 1564 4CF7.tmp 136 PID 2896 wrote to memory of 3372 2896 4D55.tmp 135
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-23_02d5e86724988fd7e70380cc5e487ed5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-23_02d5e86724988fd7e70380cc5e487ed5_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\4602.tmp"C:\Users\Admin\AppData\Local\Temp\4602.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\48B1.tmp"C:\Users\Admin\AppData\Local\Temp\48B1.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896
-
-
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"1⤵
- Executes dropped EXE
PID:812 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"2⤵
- Executes dropped EXE
PID:5084
-
-
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"1⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"2⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"3⤵
- Executes dropped EXE
PID:2428
-
-
-
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"1⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"2⤵
- Executes dropped EXE
PID:516
-
-
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"1⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"2⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"3⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"4⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"5⤵
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"6⤵
- Executes dropped EXE
PID:712 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"7⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"8⤵
- Executes dropped EXE
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"9⤵
- Executes dropped EXE
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"10⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"11⤵
- Executes dropped EXE
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"12⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"13⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"14⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"15⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"16⤵
- Executes dropped EXE
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"17⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"18⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"19⤵
- Executes dropped EXE
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"20⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"21⤵
- Executes dropped EXE
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"22⤵
- Executes dropped EXE
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"23⤵
- Executes dropped EXE
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"24⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"25⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"26⤵
- Executes dropped EXE
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"27⤵
- Executes dropped EXE
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"28⤵
- Executes dropped EXE
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"29⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"30⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"31⤵
- Executes dropped EXE
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"32⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"33⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"34⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"35⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"36⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"37⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"38⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"39⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"40⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"41⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"42⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"43⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"44⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"45⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"46⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"47⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"48⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"49⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"50⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"51⤵PID:524
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"52⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"53⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"54⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"55⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"56⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"57⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"58⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"59⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"60⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"61⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"62⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"63⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"64⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"65⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"66⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"67⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"68⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"69⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"70⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"71⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"72⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"73⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"74⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"75⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"76⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"77⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"78⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"79⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"80⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"81⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"82⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"83⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"84⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"85⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"86⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"87⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"88⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\70DA.tmp"C:\Users\Admin\AppData\Local\Temp\70DA.tmp"89⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"90⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"91⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"92⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"93⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"94⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\72BF.tmp"C:\Users\Admin\AppData\Local\Temp\72BF.tmp"95⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"96⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"97⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"98⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"99⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"100⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"101⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"102⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"103⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"104⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"105⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"106⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"107⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\7705.tmp"C:\Users\Admin\AppData\Local\Temp\7705.tmp"108⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\7762.tmp"C:\Users\Admin\AppData\Local\Temp\7762.tmp"109⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\77B0.tmp"C:\Users\Admin\AppData\Local\Temp\77B0.tmp"110⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\77FF.tmp"C:\Users\Admin\AppData\Local\Temp\77FF.tmp"111⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"112⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\789B.tmp"C:\Users\Admin\AppData\Local\Temp\789B.tmp"113⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"114⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\7937.tmp"C:\Users\Admin\AppData\Local\Temp\7937.tmp"115⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"116⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"117⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"118⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"119⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"120⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"121⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\7B98.tmp"C:\Users\Admin\AppData\Local\Temp\7B98.tmp"122⤵PID:3564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-