Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2024, 00:44
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-24_38b3c49c511b916aae84963541b7d1fc_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-24_38b3c49c511b916aae84963541b7d1fc_mafia.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-01-24_38b3c49c511b916aae84963541b7d1fc_mafia.exe
-
Size
488KB
-
MD5
38b3c49c511b916aae84963541b7d1fc
-
SHA1
75a94603517038e811e2e9dcf6b10aef33fe78aa
-
SHA256
94d768e9e4c7808539ff8f0cf71953183db8e726e36ad2d38a79b4e342e39b46
-
SHA512
eed29dbbb5115bb111cb3b00b674747159748ac4be6e05228f5d35f46813620734ad2faf88fe0e533eb439f63e08c6019f4c501ad11cf911090e450346750c44
-
SSDEEP
12288:/U5rCOTeiD77KaLZzTIneLP6Nz0zz74jaBRtTVNZ:/UQOJDS2VTInemN+z7C8VN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 548 3D18.tmp 748 3D76.tmp 1176 3DE4.tmp 4948 3E32.tmp 2160 4D64.tmp 1036 3ECE.tmp 220 3F1C.tmp 3596 3F7A.tmp 4944 3FC8.tmp 5044 4016.tmp 5092 4064.tmp 4420 40B2.tmp 4904 4100.tmp 4264 414F.tmp 2368 419D.tmp 1440 41EB.tmp 1908 4249.tmp 3812 42A6.tmp 1124 42F4.tmp 3684 4352.tmp 4940 43A0.tmp 4188 440E.tmp 1612 446B.tmp 3512 44BA.tmp 3460 4517.tmp 2560 4575.tmp 3268 45D3.tmp 4828 4621.tmp 2744 466F.tmp 4516 46CD.tmp 4184 473A.tmp 464 4798.tmp 4720 4805.tmp 3080 4863.tmp 3028 48B1.tmp 2732 491F.tmp 3356 496D.tmp 1756 49BB.tmp 3312 4A09.tmp 1792 4A57.tmp 4492 4AA5.tmp 1556 4AF3.tmp 2260 4B41.tmp 920 4B90.tmp 3536 4BDE.tmp 4216 4C2C.tmp 3604 4C7A.tmp 2344 4CC8.tmp 2396 4D16.tmp 2160 4D64.tmp 212 4DB2.tmp 1148 4E01.tmp 3780 4E4F.tmp 4176 4E9D.tmp 4864 4EEB.tmp 3204 4F39.tmp 1420 4F87.tmp 4164 4FE5.tmp 2456 5033.tmp 3940 5072.tmp 3788 50C0.tmp 1480 510E.tmp 2612 515C.tmp 2920 519A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2260 wrote to memory of 548 2260 2024-01-24_38b3c49c511b916aae84963541b7d1fc_mafia.exe 84 PID 2260 wrote to memory of 548 2260 2024-01-24_38b3c49c511b916aae84963541b7d1fc_mafia.exe 84 PID 2260 wrote to memory of 548 2260 2024-01-24_38b3c49c511b916aae84963541b7d1fc_mafia.exe 84 PID 548 wrote to memory of 748 548 3D18.tmp 86 PID 548 wrote to memory of 748 548 3D18.tmp 86 PID 548 wrote to memory of 748 548 3D18.tmp 86 PID 748 wrote to memory of 1176 748 3D76.tmp 88 PID 748 wrote to memory of 1176 748 3D76.tmp 88 PID 748 wrote to memory of 1176 748 3D76.tmp 88 PID 1176 wrote to memory of 4948 1176 3DE4.tmp 90 PID 1176 wrote to memory of 4948 1176 3DE4.tmp 90 PID 1176 wrote to memory of 4948 1176 3DE4.tmp 90 PID 4948 wrote to memory of 2160 4948 3E32.tmp 128 PID 4948 wrote to memory of 2160 4948 3E32.tmp 128 PID 4948 wrote to memory of 2160 4948 3E32.tmp 128 PID 2160 wrote to memory of 1036 2160 4D64.tmp 91 PID 2160 wrote to memory of 1036 2160 4D64.tmp 91 PID 2160 wrote to memory of 1036 2160 4D64.tmp 91 PID 1036 wrote to memory of 220 1036 3ECE.tmp 157 PID 1036 wrote to memory of 220 1036 3ECE.tmp 157 PID 1036 wrote to memory of 220 1036 3ECE.tmp 157 PID 220 wrote to memory of 3596 220 3F1C.tmp 156 PID 220 wrote to memory of 3596 220 3F1C.tmp 156 PID 220 wrote to memory of 3596 220 3F1C.tmp 156 PID 3596 wrote to memory of 4944 3596 3F7A.tmp 93 PID 3596 wrote to memory of 4944 3596 3F7A.tmp 93 PID 3596 wrote to memory of 4944 3596 3F7A.tmp 93 PID 4944 wrote to memory of 5044 4944 3FC8.tmp 155 PID 4944 wrote to memory of 5044 4944 3FC8.tmp 155 PID 4944 wrote to memory of 5044 4944 3FC8.tmp 155 PID 5044 wrote to memory of 5092 5044 4016.tmp 154 PID 5044 wrote to memory of 5092 5044 4016.tmp 154 PID 5044 wrote to memory of 5092 5044 4016.tmp 154 PID 5092 wrote to memory of 4420 5092 4064.tmp 153 PID 5092 wrote to memory of 4420 5092 4064.tmp 153 PID 5092 wrote to memory of 4420 5092 4064.tmp 153 PID 4420 wrote to memory of 4904 4420 40B2.tmp 152 PID 4420 wrote to memory of 4904 4420 40B2.tmp 152 PID 4420 wrote to memory of 4904 4420 40B2.tmp 152 PID 4904 wrote to memory of 4264 4904 4100.tmp 151 PID 4904 wrote to memory of 4264 4904 4100.tmp 151 PID 4904 wrote to memory of 4264 4904 4100.tmp 151 PID 4264 wrote to memory of 2368 4264 414F.tmp 94 PID 4264 wrote to memory of 2368 4264 414F.tmp 94 PID 4264 wrote to memory of 2368 4264 414F.tmp 94 PID 2368 wrote to memory of 1440 2368 419D.tmp 150 PID 2368 wrote to memory of 1440 2368 419D.tmp 150 PID 2368 wrote to memory of 1440 2368 419D.tmp 150 PID 1440 wrote to memory of 1908 1440 41EB.tmp 98 PID 1440 wrote to memory of 1908 1440 41EB.tmp 98 PID 1440 wrote to memory of 1908 1440 41EB.tmp 98 PID 1908 wrote to memory of 3812 1908 4249.tmp 96 PID 1908 wrote to memory of 3812 1908 4249.tmp 96 PID 1908 wrote to memory of 3812 1908 4249.tmp 96 PID 3812 wrote to memory of 1124 3812 42A6.tmp 95 PID 3812 wrote to memory of 1124 3812 42A6.tmp 95 PID 3812 wrote to memory of 1124 3812 42A6.tmp 95 PID 1124 wrote to memory of 3684 1124 42F4.tmp 101 PID 1124 wrote to memory of 3684 1124 42F4.tmp 101 PID 1124 wrote to memory of 3684 1124 42F4.tmp 101 PID 3684 wrote to memory of 4940 3684 4352.tmp 99 PID 3684 wrote to memory of 4940 3684 4352.tmp 99 PID 3684 wrote to memory of 4940 3684 4352.tmp 99 PID 4940 wrote to memory of 4188 4940 43A0.tmp 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-24_38b3c49c511b916aae84963541b7d1fc_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-24_38b3c49c511b916aae84963541b7d1fc_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\3D18.tmp"C:\Users\Admin\AppData\Local\Temp\3D18.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\3D76.tmp"C:\Users\Admin\AppData\Local\Temp\3D76.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\3E32.tmp"C:\Users\Admin\AppData\Local\Temp\3E32.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\3E80.tmp"C:\Users\Admin\AppData\Local\Temp\3E80.tmp"6⤵PID:2160
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220
-
-
C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\4016.tmp"C:\Users\Admin\AppData\Local\Temp\4016.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044
-
-
C:\Users\Admin\AppData\Local\Temp\419D.tmp"C:\Users\Admin\AppData\Local\Temp\419D.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\41EB.tmp"C:\Users\Admin\AppData\Local\Temp\41EB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440
-
-
C:\Users\Admin\AppData\Local\Temp\42F4.tmp"C:\Users\Admin\AppData\Local\Temp\42F4.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\4352.tmp"C:\Users\Admin\AppData\Local\Temp\4352.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684
-
-
C:\Users\Admin\AppData\Local\Temp\42A6.tmp"C:\Users\Admin\AppData\Local\Temp\42A6.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812
-
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908
-
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"2⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"3⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"4⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"5⤵
- Executes dropped EXE
PID:3460
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"1⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"2⤵
- Executes dropped EXE
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"3⤵
- Executes dropped EXE
PID:4516
-
-
-
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"1⤵
- Executes dropped EXE
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"2⤵
- Executes dropped EXE
PID:464
-
-
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"1⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"2⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\48B1.tmp"C:\Users\Admin\AppData\Local\Temp\48B1.tmp"3⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"4⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"5⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"6⤵
- Executes dropped EXE
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"7⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"8⤵
- Executes dropped EXE
PID:1792
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"1⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"2⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"3⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"4⤵
- Executes dropped EXE
PID:920
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"1⤵
- Executes dropped EXE
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"2⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"3⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"4⤵
- Executes dropped EXE
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"6⤵
- Executes dropped EXE
PID:212 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"7⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"8⤵
- Executes dropped EXE
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"9⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"10⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"11⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"12⤵
- Executes dropped EXE
PID:1420
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"1⤵
- Executes dropped EXE
PID:3536
-
C:\Users\Admin\AppData\Local\Temp\45D3.tmp"C:\Users\Admin\AppData\Local\Temp\45D3.tmp"1⤵
- Executes dropped EXE
PID:3268
-
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"1⤵
- Executes dropped EXE
PID:2560
-
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"1⤵
- Executes dropped EXE
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"2⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"3⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"4⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"5⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"6⤵
- Executes dropped EXE
PID:2920
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"1⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"2⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"3⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"4⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"5⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"6⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"7⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"8⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"9⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"10⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"11⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"12⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"13⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"14⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"15⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"16⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"17⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"18⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"19⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"20⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"21⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"22⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"23⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"24⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"25⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"26⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"27⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"28⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"29⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"30⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"31⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"32⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"33⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"34⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"35⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"36⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"37⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"38⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"39⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"40⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"41⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"42⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"43⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"44⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"45⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"46⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"47⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"48⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"49⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"50⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"51⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"52⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"53⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"54⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"55⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"56⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"57⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"58⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"59⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"60⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"61⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"62⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"63⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"64⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"65⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"66⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"67⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"68⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"69⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"70⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"71⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"72⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"73⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"74⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"75⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"76⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"77⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"78⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"79⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"80⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"81⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"82⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"83⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\6F63.tmp"C:\Users\Admin\AppData\Local\Temp\6F63.tmp"84⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"85⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"86⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"87⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"88⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\7148.tmp"C:\Users\Admin\AppData\Local\Temp\7148.tmp"89⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"90⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"91⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\7232.tmp"C:\Users\Admin\AppData\Local\Temp\7232.tmp"92⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"93⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\72EE.tmp"C:\Users\Admin\AppData\Local\Temp\72EE.tmp"94⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"95⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"96⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"97⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"98⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\74C2.tmp"C:\Users\Admin\AppData\Local\Temp\74C2.tmp"99⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"100⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"101⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"102⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"103⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"104⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"105⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"106⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"107⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\77FF.tmp"C:\Users\Admin\AppData\Local\Temp\77FF.tmp"108⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\785C.tmp"C:\Users\Admin\AppData\Local\Temp\785C.tmp"109⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"110⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\78F9.tmp"C:\Users\Admin\AppData\Local\Temp\78F9.tmp"111⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"112⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\7995.tmp"C:\Users\Admin\AppData\Local\Temp\7995.tmp"113⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"114⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"115⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"116⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"117⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"118⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"119⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"120⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\7C44.tmp"C:\Users\Admin\AppData\Local\Temp\7C44.tmp"121⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\7C92.tmp"C:\Users\Admin\AppData\Local\Temp\7C92.tmp"122⤵PID:3768
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-