Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
14/02/2024, 02:04
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-14_31cf0491d1cf9aebc1f0a4028bcd1a30_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-14_31cf0491d1cf9aebc1f0a4028bcd1a30_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-14_31cf0491d1cf9aebc1f0a4028bcd1a30_mafia.exe
-
Size
530KB
-
MD5
31cf0491d1cf9aebc1f0a4028bcd1a30
-
SHA1
20f1292e63a463d15fda4fd3f3de9b7ba3f6fc2e
-
SHA256
25096299545042e715d869db198ec1c49b50ff6b4f8cf265a10b5f3e826f2137
-
SHA512
c429ac20950766804b8ea4411a6a3adac3f57c49884a8207243c7e6032fc72c066d72bdea8dbf5ff9c24657ae3e40e2772b3e16ab3814673d8f95bbd285a211c
-
SSDEEP
12288:AU5rCOTeioebBPX3htLeOQCG+9bzJj4NZulFVg0M1:AUQOJoYvvaOHtJJ4NclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4076 4A09.tmp 2888 4A76.tmp 4988 4AF3.tmp 2020 4B61.tmp 5008 4BBE.tmp 2264 4C1C.tmp 3800 4C6A.tmp 2968 4CD8.tmp 3336 4D55.tmp 2368 4DB2.tmp 2108 4E01.tmp 1104 4E6E.tmp 2104 4ECC.tmp 1852 4F39.tmp 4524 4F97.tmp 5020 5004.tmp 2260 5062.tmp 3900 50B0.tmp 3652 511D.tmp 4088 518B.tmp 3932 51F8.tmp 3468 5266.tmp 4592 52D3.tmp 528 5321.tmp 64 538E.tmp 760 540B.tmp 3112 5469.tmp 1388 54B7.tmp 2516 5505.tmp 4852 5554.tmp 2024 55B1.tmp 4264 55FF.tmp 4784 565D.tmp 1172 56AB.tmp 4604 56F9.tmp 4664 5748.tmp 1708 5796.tmp 4584 57E4.tmp 2116 5832.tmp 3812 58AF.tmp 880 58FD.tmp 4716 594B.tmp 568 5999.tmp 3692 59E7.tmp 2148 5A36.tmp 1648 5A84.tmp 3080 5AD2.tmp 368 5B20.tmp 3456 5B6E.tmp 964 5BBC.tmp 3176 5C0A.tmp 1896 5C58.tmp 984 5CC6.tmp 4764 5D24.tmp 4872 5D81.tmp 4448 5DCF.tmp 4356 5E1E.tmp 4800 5E6C.tmp 1200 5EBA.tmp 1408 5F08.tmp 1856 5F56.tmp 3356 5FA4.tmp 2180 5FF2.tmp 4052 6040.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1200 wrote to memory of 4076 1200 2024-02-14_31cf0491d1cf9aebc1f0a4028bcd1a30_mafia.exe 85 PID 1200 wrote to memory of 4076 1200 2024-02-14_31cf0491d1cf9aebc1f0a4028bcd1a30_mafia.exe 85 PID 1200 wrote to memory of 4076 1200 2024-02-14_31cf0491d1cf9aebc1f0a4028bcd1a30_mafia.exe 85 PID 4076 wrote to memory of 2888 4076 4A09.tmp 86 PID 4076 wrote to memory of 2888 4076 4A09.tmp 86 PID 4076 wrote to memory of 2888 4076 4A09.tmp 86 PID 2888 wrote to memory of 4988 2888 4A76.tmp 87 PID 2888 wrote to memory of 4988 2888 4A76.tmp 87 PID 2888 wrote to memory of 4988 2888 4A76.tmp 87 PID 4988 wrote to memory of 2020 4988 4AF3.tmp 88 PID 4988 wrote to memory of 2020 4988 4AF3.tmp 88 PID 4988 wrote to memory of 2020 4988 4AF3.tmp 88 PID 2020 wrote to memory of 5008 2020 4B61.tmp 89 PID 2020 wrote to memory of 5008 2020 4B61.tmp 89 PID 2020 wrote to memory of 5008 2020 4B61.tmp 89 PID 5008 wrote to memory of 2264 5008 4BBE.tmp 90 PID 5008 wrote to memory of 2264 5008 4BBE.tmp 90 PID 5008 wrote to memory of 2264 5008 4BBE.tmp 90 PID 2264 wrote to memory of 3800 2264 4C1C.tmp 91 PID 2264 wrote to memory of 3800 2264 4C1C.tmp 91 PID 2264 wrote to memory of 3800 2264 4C1C.tmp 91 PID 3800 wrote to memory of 2968 3800 4C6A.tmp 92 PID 3800 wrote to memory of 2968 3800 4C6A.tmp 92 PID 3800 wrote to memory of 2968 3800 4C6A.tmp 92 PID 2968 wrote to memory of 3336 2968 4CD8.tmp 93 PID 2968 wrote to memory of 3336 2968 4CD8.tmp 93 PID 2968 wrote to memory of 3336 2968 4CD8.tmp 93 PID 3336 wrote to memory of 2368 3336 4D55.tmp 94 PID 3336 wrote to memory of 2368 3336 4D55.tmp 94 PID 3336 wrote to memory of 2368 3336 4D55.tmp 94 PID 2368 wrote to memory of 2108 2368 4DB2.tmp 95 PID 2368 wrote to memory of 2108 2368 4DB2.tmp 95 PID 2368 wrote to memory of 2108 2368 4DB2.tmp 95 PID 2108 wrote to memory of 1104 2108 4E01.tmp 96 PID 2108 wrote to memory of 1104 2108 4E01.tmp 96 PID 2108 wrote to memory of 1104 2108 4E01.tmp 96 PID 1104 wrote to memory of 2104 1104 4E6E.tmp 97 PID 1104 wrote to memory of 2104 1104 4E6E.tmp 97 PID 1104 wrote to memory of 2104 1104 4E6E.tmp 97 PID 2104 wrote to memory of 1852 2104 4ECC.tmp 98 PID 2104 wrote to memory of 1852 2104 4ECC.tmp 98 PID 2104 wrote to memory of 1852 2104 4ECC.tmp 98 PID 1852 wrote to memory of 4524 1852 4F39.tmp 99 PID 1852 wrote to memory of 4524 1852 4F39.tmp 99 PID 1852 wrote to memory of 4524 1852 4F39.tmp 99 PID 4524 wrote to memory of 5020 4524 4F97.tmp 100 PID 4524 wrote to memory of 5020 4524 4F97.tmp 100 PID 4524 wrote to memory of 5020 4524 4F97.tmp 100 PID 5020 wrote to memory of 2260 5020 5004.tmp 101 PID 5020 wrote to memory of 2260 5020 5004.tmp 101 PID 5020 wrote to memory of 2260 5020 5004.tmp 101 PID 2260 wrote to memory of 3900 2260 5062.tmp 102 PID 2260 wrote to memory of 3900 2260 5062.tmp 102 PID 2260 wrote to memory of 3900 2260 5062.tmp 102 PID 3900 wrote to memory of 3652 3900 50B0.tmp 103 PID 3900 wrote to memory of 3652 3900 50B0.tmp 103 PID 3900 wrote to memory of 3652 3900 50B0.tmp 103 PID 3652 wrote to memory of 4088 3652 511D.tmp 104 PID 3652 wrote to memory of 4088 3652 511D.tmp 104 PID 3652 wrote to memory of 4088 3652 511D.tmp 104 PID 4088 wrote to memory of 3932 4088 518B.tmp 105 PID 4088 wrote to memory of 3932 4088 518B.tmp 105 PID 4088 wrote to memory of 3932 4088 518B.tmp 105 PID 3932 wrote to memory of 3468 3932 51F8.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-14_31cf0491d1cf9aebc1f0a4028bcd1a30_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-14_31cf0491d1cf9aebc1f0a4028bcd1a30_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"23⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"24⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"25⤵
- Executes dropped EXE
PID:528 -
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"26⤵
- Executes dropped EXE
PID:64 -
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"27⤵
- Executes dropped EXE
PID:760 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"28⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"29⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"30⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"31⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"32⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"33⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"34⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"35⤵
- Executes dropped EXE
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"36⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"37⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"38⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"39⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"40⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"41⤵
- Executes dropped EXE
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"42⤵
- Executes dropped EXE
PID:880 -
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"43⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"44⤵
- Executes dropped EXE
PID:568 -
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"45⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"46⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"47⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"48⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"49⤵
- Executes dropped EXE
PID:368 -
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"50⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"51⤵
- Executes dropped EXE
PID:964 -
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"52⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"53⤵
- Executes dropped EXE
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"54⤵
- Executes dropped EXE
PID:984 -
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"55⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"56⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"57⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"58⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"59⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"60⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"61⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"62⤵
- Executes dropped EXE
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"63⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"64⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"65⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"66⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"67⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"68⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"69⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"70⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"71⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"72⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"73⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"74⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"75⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"76⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"77⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"78⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"79⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"80⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"81⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"82⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"83⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"84⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"85⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"86⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"87⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"88⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"89⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"90⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"91⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"92⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"93⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"94⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"95⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"96⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"97⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"98⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"99⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"100⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"101⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"102⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"103⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"104⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"105⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"106⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"107⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"108⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"109⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"110⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"111⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"112⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"113⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\7177.tmp"C:\Users\Admin\AppData\Local\Temp\7177.tmp"114⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"115⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\7213.tmp"C:\Users\Admin\AppData\Local\Temp\7213.tmp"116⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"117⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"118⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"119⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"120⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"121⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"122⤵PID:4808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-