Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
02/05/2024, 05:03
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-02_7e0b7a807157c9f2967d01e3549ab4e0_mafia.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2024-05-02_7e0b7a807157c9f2967d01e3549ab4e0_mafia.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-05-02_7e0b7a807157c9f2967d01e3549ab4e0_mafia.exe
-
Size
765KB
-
MD5
7e0b7a807157c9f2967d01e3549ab4e0
-
SHA1
988d7b2ee2a216ea4017384d8f0ffebef7e4dad5
-
SHA256
c8fd1632447a36527b3833c17e21ef9021a94032161c60628a49beacf238766f
-
SHA512
b9b28ea414ce5b04c48b3f814a0646b68930c8a339701e355d58b9b2c693931ff501d88516495e4113b45848090112f52af498a2a8f0aed9371f167a29c05f02
-
SSDEEP
12288:ZU5rCOTeiD5/Se+XltM9Acvz39UY1b3ZF5rn5rLOa54U5w5A:ZUQOJDR7aUAcvRr3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4628 3B63.tmp 3528 3BF0.tmp 4632 3C6D.tmp 3772 3D67.tmp 4752 3DE4.tmp 3820 3E80.tmp 4728 3F1C.tmp 3188 3FD8.tmp 1392 4045.tmp 3824 4093.tmp 1608 4110.tmp 2112 417D.tmp 816 421A.tmp 4636 42A6.tmp 3244 4333.tmp 4080 43C0.tmp 4372 446B.tmp 624 44E8.tmp 980 4556.tmp 3316 45C3.tmp 5012 465F.tmp 1784 46DC.tmp 4892 4788.tmp 2172 4805.tmp 3600 48A2.tmp 1988 490F.tmp 4232 497C.tmp 2280 49F9.tmp 3940 4A76.tmp 4416 4AF3.tmp 4608 4B90.tmp 4112 4BDE.tmp 3960 4C4B.tmp 3868 4CA9.tmp 5032 4CF7.tmp 1836 4D55.tmp 324 4DA3.tmp 4832 4DF1.tmp 636 4E4F.tmp 1196 4EAC.tmp 4500 4EFB.tmp 2076 4F49.tmp 4752 4FA6.tmp 4088 4FF5.tmp 3476 5043.tmp 1888 5091.tmp 2320 50DF.tmp 2180 513D.tmp 3188 519A.tmp 2524 51F8.tmp 2488 5256.tmp 4200 52A4.tmp 816 52F2.tmp 4820 5340.tmp 3064 538E.tmp 1036 53EC.tmp 980 544A.tmp 3312 5498.tmp 2588 54F6.tmp 3308 5554.tmp 2744 55B1.tmp 4204 560F.tmp 3564 566D.tmp 4708 56CB.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1836 wrote to memory of 4628 1836 2024-05-02_7e0b7a807157c9f2967d01e3549ab4e0_mafia.exe 84 PID 1836 wrote to memory of 4628 1836 2024-05-02_7e0b7a807157c9f2967d01e3549ab4e0_mafia.exe 84 PID 1836 wrote to memory of 4628 1836 2024-05-02_7e0b7a807157c9f2967d01e3549ab4e0_mafia.exe 84 PID 4628 wrote to memory of 3528 4628 3B63.tmp 85 PID 4628 wrote to memory of 3528 4628 3B63.tmp 85 PID 4628 wrote to memory of 3528 4628 3B63.tmp 85 PID 3528 wrote to memory of 4632 3528 3BF0.tmp 86 PID 3528 wrote to memory of 4632 3528 3BF0.tmp 86 PID 3528 wrote to memory of 4632 3528 3BF0.tmp 86 PID 4632 wrote to memory of 3772 4632 3C6D.tmp 87 PID 4632 wrote to memory of 3772 4632 3C6D.tmp 87 PID 4632 wrote to memory of 3772 4632 3C6D.tmp 87 PID 3772 wrote to memory of 4752 3772 3D67.tmp 89 PID 3772 wrote to memory of 4752 3772 3D67.tmp 89 PID 3772 wrote to memory of 4752 3772 3D67.tmp 89 PID 4752 wrote to memory of 3820 4752 3DE4.tmp 90 PID 4752 wrote to memory of 3820 4752 3DE4.tmp 90 PID 4752 wrote to memory of 3820 4752 3DE4.tmp 90 PID 3820 wrote to memory of 4728 3820 3E80.tmp 91 PID 3820 wrote to memory of 4728 3820 3E80.tmp 91 PID 3820 wrote to memory of 4728 3820 3E80.tmp 91 PID 4728 wrote to memory of 3188 4728 3F1C.tmp 93 PID 4728 wrote to memory of 3188 4728 3F1C.tmp 93 PID 4728 wrote to memory of 3188 4728 3F1C.tmp 93 PID 3188 wrote to memory of 1392 3188 3FD8.tmp 95 PID 3188 wrote to memory of 1392 3188 3FD8.tmp 95 PID 3188 wrote to memory of 1392 3188 3FD8.tmp 95 PID 1392 wrote to memory of 3824 1392 4045.tmp 96 PID 1392 wrote to memory of 3824 1392 4045.tmp 96 PID 1392 wrote to memory of 3824 1392 4045.tmp 96 PID 3824 wrote to memory of 1608 3824 4093.tmp 97 PID 3824 wrote to memory of 1608 3824 4093.tmp 97 PID 3824 wrote to memory of 1608 3824 4093.tmp 97 PID 1608 wrote to memory of 2112 1608 4110.tmp 98 PID 1608 wrote to memory of 2112 1608 4110.tmp 98 PID 1608 wrote to memory of 2112 1608 4110.tmp 98 PID 2112 wrote to memory of 816 2112 417D.tmp 99 PID 2112 wrote to memory of 816 2112 417D.tmp 99 PID 2112 wrote to memory of 816 2112 417D.tmp 99 PID 816 wrote to memory of 4636 816 421A.tmp 100 PID 816 wrote to memory of 4636 816 421A.tmp 100 PID 816 wrote to memory of 4636 816 421A.tmp 100 PID 4636 wrote to memory of 3244 4636 42A6.tmp 101 PID 4636 wrote to memory of 3244 4636 42A6.tmp 101 PID 4636 wrote to memory of 3244 4636 42A6.tmp 101 PID 3244 wrote to memory of 4080 3244 4333.tmp 102 PID 3244 wrote to memory of 4080 3244 4333.tmp 102 PID 3244 wrote to memory of 4080 3244 4333.tmp 102 PID 4080 wrote to memory of 4372 4080 43C0.tmp 103 PID 4080 wrote to memory of 4372 4080 43C0.tmp 103 PID 4080 wrote to memory of 4372 4080 43C0.tmp 103 PID 4372 wrote to memory of 624 4372 446B.tmp 104 PID 4372 wrote to memory of 624 4372 446B.tmp 104 PID 4372 wrote to memory of 624 4372 446B.tmp 104 PID 624 wrote to memory of 980 624 44E8.tmp 105 PID 624 wrote to memory of 980 624 44E8.tmp 105 PID 624 wrote to memory of 980 624 44E8.tmp 105 PID 980 wrote to memory of 3316 980 4556.tmp 106 PID 980 wrote to memory of 3316 980 4556.tmp 106 PID 980 wrote to memory of 3316 980 4556.tmp 106 PID 3316 wrote to memory of 5012 3316 45C3.tmp 107 PID 3316 wrote to memory of 5012 3316 45C3.tmp 107 PID 3316 wrote to memory of 5012 3316 45C3.tmp 107 PID 5012 wrote to memory of 1784 5012 465F.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-02_7e0b7a807157c9f2967d01e3549ab4e0_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-02_7e0b7a807157c9f2967d01e3549ab4e0_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\3B63.tmp"C:\Users\Admin\AppData\Local\Temp\3B63.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\3C6D.tmp"C:\Users\Admin\AppData\Local\Temp\3C6D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\3D67.tmp"C:\Users\Admin\AppData\Local\Temp\3D67.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\3E80.tmp"C:\Users\Admin\AppData\Local\Temp\3E80.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\4045.tmp"C:\Users\Admin\AppData\Local\Temp\4045.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\4093.tmp"C:\Users\Admin\AppData\Local\Temp\4093.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\4110.tmp"C:\Users\Admin\AppData\Local\Temp\4110.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\421A.tmp"C:\Users\Admin\AppData\Local\Temp\421A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\42A6.tmp"C:\Users\Admin\AppData\Local\Temp\42A6.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\43C0.tmp"C:\Users\Admin\AppData\Local\Temp\43C0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"23⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"24⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"25⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"26⤵
- Executes dropped EXE
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"27⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"28⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"29⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"30⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"31⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"32⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"33⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"34⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"35⤵
- Executes dropped EXE
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"36⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"37⤵
- Executes dropped EXE
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"38⤵
- Executes dropped EXE
PID:324 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"39⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"40⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"41⤵
- Executes dropped EXE
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"42⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"43⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"44⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"45⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"46⤵
- Executes dropped EXE
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"47⤵
- Executes dropped EXE
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"48⤵
- Executes dropped EXE
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"49⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"50⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"51⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"52⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"53⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"54⤵
- Executes dropped EXE
PID:816 -
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"55⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"56⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"57⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"58⤵
- Executes dropped EXE
PID:980 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"59⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"60⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"61⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"62⤵
- Executes dropped EXE
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"63⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"64⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"65⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"66⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"67⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"68⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"69⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"70⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"71⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"72⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"73⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"74⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"75⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"76⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"77⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"78⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"79⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"80⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"81⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"82⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"83⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"84⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"85⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"86⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"87⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"88⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"89⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"90⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"91⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"92⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"93⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"94⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"95⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"96⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"97⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"98⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"99⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"100⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"101⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"102⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"103⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"104⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"105⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"106⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"107⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"108⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"109⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"110⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"111⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"112⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"113⤵PID:32
-
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"114⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"115⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"116⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"117⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"118⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"119⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"120⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"121⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"122⤵PID:4416
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-