Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
14/02/2024, 11:06
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-14_b4134d7d9190ecdac410eb468dee1e4c_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-14_b4134d7d9190ecdac410eb468dee1e4c_mafia.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-02-14_b4134d7d9190ecdac410eb468dee1e4c_mafia.exe
-
Size
488KB
-
MD5
b4134d7d9190ecdac410eb468dee1e4c
-
SHA1
60c9378ad2cd47d6855d7f767ee60a7e4fe5b151
-
SHA256
a94ad5b13778dc8de8b12e16c5d967430afd0c773ffdc44b49710bea85047dc8
-
SHA512
92b14aae092b07d024def7bc89a1ca02a7f167f66f74bc0aa196a0c8064bf31a39ae5d76b903aac3b1fbb6cae4cc2a86f6b6d7f45eba236213c116d63061c29c
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7FPkucqGDzDLiWOhrJRbkodvgGMXhxuIO9WG6:/U5rCOTeiDFfszDuWOh1Rb5d4humBNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4000 50CF.tmp 4396 514C.tmp 4284 51BA.tmp 4716 5227.tmp 1880 5285.tmp 5076 52E3.tmp 2792 5331.tmp 1928 538E.tmp 1152 53DD.tmp 3012 543A.tmp 4608 54B7.tmp 2596 5515.tmp 4476 5573.tmp 4604 55D1.tmp 4388 561F.tmp 4028 569C.tmp 3644 56F9.tmp 4228 5776.tmp 1156 57D4.tmp 4016 5832.tmp 1984 58AF.tmp 3168 58FD.tmp 2020 594B.tmp 4464 59B9.tmp 1576 5A26.tmp 4480 5A74.tmp 1400 5AD2.tmp 4720 5B20.tmp 412 5B6E.tmp 4008 5BEB.tmp 2332 5C58.tmp 2736 5CC6.tmp 1340 5D33.tmp 4704 5D91.tmp 4192 5DEF.tmp 3600 5E3D.tmp 2248 5E9B.tmp 4212 5EE9.tmp 4516 5F46.tmp 2840 5FA4.tmp 3020 6012.tmp 5052 6060.tmp 1848 60AE.tmp 2084 60FC.tmp 2712 614A.tmp 3840 6198.tmp 432 61E6.tmp 2200 6234.tmp 2204 6292.tmp 2640 62E0.tmp 4880 632E.tmp 4320 638C.tmp 464 63EA.tmp 1736 6438.tmp 3760 64E4.tmp 1160 6532.tmp 2180 6580.tmp 1532 65CE.tmp 1368 661C.tmp 4800 666B.tmp 1148 66B9.tmp 4744 6716.tmp 1596 6765.tmp 2036 67B3.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4040 wrote to memory of 4000 4040 2024-02-14_b4134d7d9190ecdac410eb468dee1e4c_mafia.exe 85 PID 4040 wrote to memory of 4000 4040 2024-02-14_b4134d7d9190ecdac410eb468dee1e4c_mafia.exe 85 PID 4040 wrote to memory of 4000 4040 2024-02-14_b4134d7d9190ecdac410eb468dee1e4c_mafia.exe 85 PID 4000 wrote to memory of 4396 4000 50CF.tmp 86 PID 4000 wrote to memory of 4396 4000 50CF.tmp 86 PID 4000 wrote to memory of 4396 4000 50CF.tmp 86 PID 4396 wrote to memory of 4284 4396 514C.tmp 87 PID 4396 wrote to memory of 4284 4396 514C.tmp 87 PID 4396 wrote to memory of 4284 4396 514C.tmp 87 PID 4284 wrote to memory of 4716 4284 51BA.tmp 88 PID 4284 wrote to memory of 4716 4284 51BA.tmp 88 PID 4284 wrote to memory of 4716 4284 51BA.tmp 88 PID 4716 wrote to memory of 1880 4716 5227.tmp 89 PID 4716 wrote to memory of 1880 4716 5227.tmp 89 PID 4716 wrote to memory of 1880 4716 5227.tmp 89 PID 1880 wrote to memory of 5076 1880 5285.tmp 90 PID 1880 wrote to memory of 5076 1880 5285.tmp 90 PID 1880 wrote to memory of 5076 1880 5285.tmp 90 PID 5076 wrote to memory of 2792 5076 52E3.tmp 91 PID 5076 wrote to memory of 2792 5076 52E3.tmp 91 PID 5076 wrote to memory of 2792 5076 52E3.tmp 91 PID 2792 wrote to memory of 1928 2792 5331.tmp 92 PID 2792 wrote to memory of 1928 2792 5331.tmp 92 PID 2792 wrote to memory of 1928 2792 5331.tmp 92 PID 1928 wrote to memory of 1152 1928 538E.tmp 93 PID 1928 wrote to memory of 1152 1928 538E.tmp 93 PID 1928 wrote to memory of 1152 1928 538E.tmp 93 PID 1152 wrote to memory of 3012 1152 53DD.tmp 94 PID 1152 wrote to memory of 3012 1152 53DD.tmp 94 PID 1152 wrote to memory of 3012 1152 53DD.tmp 94 PID 3012 wrote to memory of 4608 3012 543A.tmp 95 PID 3012 wrote to memory of 4608 3012 543A.tmp 95 PID 3012 wrote to memory of 4608 3012 543A.tmp 95 PID 4608 wrote to memory of 2596 4608 54B7.tmp 96 PID 4608 wrote to memory of 2596 4608 54B7.tmp 96 PID 4608 wrote to memory of 2596 4608 54B7.tmp 96 PID 2596 wrote to memory of 4476 2596 5515.tmp 97 PID 2596 wrote to memory of 4476 2596 5515.tmp 97 PID 2596 wrote to memory of 4476 2596 5515.tmp 97 PID 4476 wrote to memory of 4604 4476 5573.tmp 98 PID 4476 wrote to memory of 4604 4476 5573.tmp 98 PID 4476 wrote to memory of 4604 4476 5573.tmp 98 PID 4604 wrote to memory of 4388 4604 55D1.tmp 99 PID 4604 wrote to memory of 4388 4604 55D1.tmp 99 PID 4604 wrote to memory of 4388 4604 55D1.tmp 99 PID 4388 wrote to memory of 4028 4388 561F.tmp 100 PID 4388 wrote to memory of 4028 4388 561F.tmp 100 PID 4388 wrote to memory of 4028 4388 561F.tmp 100 PID 4028 wrote to memory of 3644 4028 569C.tmp 101 PID 4028 wrote to memory of 3644 4028 569C.tmp 101 PID 4028 wrote to memory of 3644 4028 569C.tmp 101 PID 3644 wrote to memory of 4228 3644 56F9.tmp 102 PID 3644 wrote to memory of 4228 3644 56F9.tmp 102 PID 3644 wrote to memory of 4228 3644 56F9.tmp 102 PID 4228 wrote to memory of 1156 4228 5776.tmp 103 PID 4228 wrote to memory of 1156 4228 5776.tmp 103 PID 4228 wrote to memory of 1156 4228 5776.tmp 103 PID 1156 wrote to memory of 4016 1156 57D4.tmp 104 PID 1156 wrote to memory of 4016 1156 57D4.tmp 104 PID 1156 wrote to memory of 4016 1156 57D4.tmp 104 PID 4016 wrote to memory of 1984 4016 5832.tmp 105 PID 4016 wrote to memory of 1984 4016 5832.tmp 105 PID 4016 wrote to memory of 1984 4016 5832.tmp 105 PID 1984 wrote to memory of 3168 1984 58AF.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-14_b4134d7d9190ecdac410eb468dee1e4c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-14_b4134d7d9190ecdac410eb468dee1e4c_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"23⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"24⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"25⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"26⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"27⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"28⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"29⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"30⤵
- Executes dropped EXE
PID:412 -
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"31⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"32⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"33⤵
- Executes dropped EXE
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"34⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"35⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"36⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"37⤵
- Executes dropped EXE
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"38⤵
- Executes dropped EXE
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"39⤵
- Executes dropped EXE
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"40⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"41⤵
- Executes dropped EXE
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"42⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"43⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"44⤵
- Executes dropped EXE
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"45⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"46⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"47⤵
- Executes dropped EXE
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"48⤵
- Executes dropped EXE
PID:432 -
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"49⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"50⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"51⤵
- Executes dropped EXE
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"52⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"53⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"54⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"55⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"56⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"57⤵
- Executes dropped EXE
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"58⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"59⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"60⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"61⤵
- Executes dropped EXE
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"62⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"63⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"64⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"65⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"66⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"67⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"68⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"69⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"70⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"71⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"72⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"73⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"74⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"75⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"76⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"77⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"78⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"79⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"80⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"81⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"82⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"83⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"84⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"85⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"86⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"87⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"88⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"89⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\6F63.tmp"C:\Users\Admin\AppData\Local\Temp\6F63.tmp"90⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"91⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"92⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"93⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"94⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"95⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\7157.tmp"C:\Users\Admin\AppData\Local\Temp\7157.tmp"96⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"97⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"98⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"99⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"100⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"101⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"102⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"103⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"104⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"105⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"106⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"107⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"108⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"109⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"110⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"111⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"112⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\7705.tmp"C:\Users\Admin\AppData\Local\Temp\7705.tmp"113⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\7762.tmp"C:\Users\Admin\AppData\Local\Temp\7762.tmp"114⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\77B0.tmp"C:\Users\Admin\AppData\Local\Temp\77B0.tmp"115⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\77FF.tmp"C:\Users\Admin\AppData\Local\Temp\77FF.tmp"116⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"117⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\789B.tmp"C:\Users\Admin\AppData\Local\Temp\789B.tmp"118⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"119⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\7937.tmp"C:\Users\Admin\AppData\Local\Temp\7937.tmp"120⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"121⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\79D3.tmp"C:\Users\Admin\AppData\Local\Temp\79D3.tmp"122⤵PID:4800
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-