Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11/06/2024, 07:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-11_a62a27859c134979a69e87cc0a27d14f_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
General
-
Target
2024-06-11_a62a27859c134979a69e87cc0a27d14f_mafia.exe
-
Size
527KB
-
MD5
a62a27859c134979a69e87cc0a27d14f
-
SHA1
8862e802c4105036bdcf88855fa701d865dd2b68
-
SHA256
df749b13dcfb7caa1d09738207d08dbef5505fbd8a6834802244ba67e1479db5
-
SHA512
ddba5b945b66459e48bb3f8c66ecc9c149499b75b5aeffcbbcf35ac19e763f9ebb7cf235e01ca071130178e3b947ec93af5b4450b529e01f68b96fa4016dacce
-
SSDEEP
6144:yorf3lPvovsgZnqG2C7mOTeiLRDYTBzy9BXc6FTDaVImDH+Q+rrYvb+LIgMr5aBv:fU5rCOTeidim9W0PcI5AOMr5aGDZu
Malware Config
Signatures
-
Detected AnchorDNS Backdoor 1 IoCs
Sample triggered yara rules associated with the AnchorDNS malware family.
resource yara_rule behavioral2/files/0x0007000000023400-46.dat family_anchor_dns -
Executes dropped EXE 64 IoCs
pid Process 2988 36CF.tmp 632 375C.tmp 3644 37C9.tmp 5112 3827.tmp 1052 3894.tmp 1648 39DC.tmp 2120 3A59.tmp 3988 3AD6.tmp 368 3B34.tmp 1652 3BA1.tmp 2448 3C0F.tmp 3864 3C6D.tmp 1224 3CF9.tmp 3204 3D76.tmp 1044 3DE4.tmp 3084 3E41.tmp 1324 3E9F.tmp 4964 3F1C.tmp 3600 3F7A.tmp 4936 3FD8.tmp 692 4045.tmp 4736 40A3.tmp 1960 4100.tmp 944 414F.tmp 2384 41BC.tmp 3860 421A.tmp 2656 4277.tmp 2468 42D5.tmp 4244 4323.tmp 216 43A0.tmp 3008 440E.tmp 672 446B.tmp 2424 44D9.tmp 3036 4527.tmp 1252 4585.tmp 976 45E2.tmp 4168 4631.tmp 4684 467F.tmp 5116 46CD.tmp 3616 471B.tmp 4624 4779.tmp 620 47C7.tmp 1400 4815.tmp 3092 4873.tmp 4048 48D0.tmp 4304 492E.tmp 4808 498C.tmp 3752 49EA.tmp 2896 4A47.tmp 4768 4AA5.tmp 2288 4AF3.tmp 4444 4B51.tmp 1380 4B9F.tmp 1852 4BFD.tmp 3216 4C4B.tmp 4784 4C99.tmp 4296 4CF7.tmp 2224 4D45.tmp 1184 4D93.tmp 3924 4DE1.tmp 1804 4E3F.tmp 808 4E8D.tmp 4660 4EEB.tmp 704 4F49.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1392 wrote to memory of 2988 1392 2024-06-11_a62a27859c134979a69e87cc0a27d14f_mafia.exe 80 PID 1392 wrote to memory of 2988 1392 2024-06-11_a62a27859c134979a69e87cc0a27d14f_mafia.exe 80 PID 1392 wrote to memory of 2988 1392 2024-06-11_a62a27859c134979a69e87cc0a27d14f_mafia.exe 80 PID 2988 wrote to memory of 632 2988 36CF.tmp 81 PID 2988 wrote to memory of 632 2988 36CF.tmp 81 PID 2988 wrote to memory of 632 2988 36CF.tmp 81 PID 632 wrote to memory of 3644 632 375C.tmp 82 PID 632 wrote to memory of 3644 632 375C.tmp 82 PID 632 wrote to memory of 3644 632 375C.tmp 82 PID 3644 wrote to memory of 5112 3644 37C9.tmp 83 PID 3644 wrote to memory of 5112 3644 37C9.tmp 83 PID 3644 wrote to memory of 5112 3644 37C9.tmp 83 PID 5112 wrote to memory of 1052 5112 3827.tmp 84 PID 5112 wrote to memory of 1052 5112 3827.tmp 84 PID 5112 wrote to memory of 1052 5112 3827.tmp 84 PID 1052 wrote to memory of 1648 1052 3894.tmp 85 PID 1052 wrote to memory of 1648 1052 3894.tmp 85 PID 1052 wrote to memory of 1648 1052 3894.tmp 85 PID 1648 wrote to memory of 2120 1648 39DC.tmp 86 PID 1648 wrote to memory of 2120 1648 39DC.tmp 86 PID 1648 wrote to memory of 2120 1648 39DC.tmp 86 PID 2120 wrote to memory of 3988 2120 3A59.tmp 87 PID 2120 wrote to memory of 3988 2120 3A59.tmp 87 PID 2120 wrote to memory of 3988 2120 3A59.tmp 87 PID 3988 wrote to memory of 368 3988 3AD6.tmp 88 PID 3988 wrote to memory of 368 3988 3AD6.tmp 88 PID 3988 wrote to memory of 368 3988 3AD6.tmp 88 PID 368 wrote to memory of 1652 368 3B34.tmp 89 PID 368 wrote to memory of 1652 368 3B34.tmp 89 PID 368 wrote to memory of 1652 368 3B34.tmp 89 PID 1652 wrote to memory of 2448 1652 3BA1.tmp 90 PID 1652 wrote to memory of 2448 1652 3BA1.tmp 90 PID 1652 wrote to memory of 2448 1652 3BA1.tmp 90 PID 2448 wrote to memory of 3864 2448 3C0F.tmp 91 PID 2448 wrote to memory of 3864 2448 3C0F.tmp 91 PID 2448 wrote to memory of 3864 2448 3C0F.tmp 91 PID 3864 wrote to memory of 1224 3864 3C6D.tmp 92 PID 3864 wrote to memory of 1224 3864 3C6D.tmp 92 PID 3864 wrote to memory of 1224 3864 3C6D.tmp 92 PID 1224 wrote to memory of 3204 1224 3CF9.tmp 93 PID 1224 wrote to memory of 3204 1224 3CF9.tmp 93 PID 1224 wrote to memory of 3204 1224 3CF9.tmp 93 PID 3204 wrote to memory of 1044 3204 3D76.tmp 94 PID 3204 wrote to memory of 1044 3204 3D76.tmp 94 PID 3204 wrote to memory of 1044 3204 3D76.tmp 94 PID 1044 wrote to memory of 3084 1044 3DE4.tmp 95 PID 1044 wrote to memory of 3084 1044 3DE4.tmp 95 PID 1044 wrote to memory of 3084 1044 3DE4.tmp 95 PID 3084 wrote to memory of 1324 3084 3E41.tmp 96 PID 3084 wrote to memory of 1324 3084 3E41.tmp 96 PID 3084 wrote to memory of 1324 3084 3E41.tmp 96 PID 1324 wrote to memory of 4964 1324 3E9F.tmp 97 PID 1324 wrote to memory of 4964 1324 3E9F.tmp 97 PID 1324 wrote to memory of 4964 1324 3E9F.tmp 97 PID 4964 wrote to memory of 3600 4964 3F1C.tmp 98 PID 4964 wrote to memory of 3600 4964 3F1C.tmp 98 PID 4964 wrote to memory of 3600 4964 3F1C.tmp 98 PID 3600 wrote to memory of 4936 3600 3F7A.tmp 99 PID 3600 wrote to memory of 4936 3600 3F7A.tmp 99 PID 3600 wrote to memory of 4936 3600 3F7A.tmp 99 PID 4936 wrote to memory of 692 4936 3FD8.tmp 100 PID 4936 wrote to memory of 692 4936 3FD8.tmp 100 PID 4936 wrote to memory of 692 4936 3FD8.tmp 100 PID 692 wrote to memory of 4736 692 4045.tmp 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_a62a27859c134979a69e87cc0a27d14f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_a62a27859c134979a69e87cc0a27d14f_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\36CF.tmp"C:\Users\Admin\AppData\Local\Temp\36CF.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\375C.tmp"C:\Users\Admin\AppData\Local\Temp\375C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\37C9.tmp"C:\Users\Admin\AppData\Local\Temp\37C9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\3827.tmp"C:\Users\Admin\AppData\Local\Temp\3827.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\3894.tmp"C:\Users\Admin\AppData\Local\Temp\3894.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\39DC.tmp"C:\Users\Admin\AppData\Local\Temp\39DC.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\3A59.tmp"C:\Users\Admin\AppData\Local\Temp\3A59.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\3B34.tmp"C:\Users\Admin\AppData\Local\Temp\3B34.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\3C0F.tmp"C:\Users\Admin\AppData\Local\Temp\3C0F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\3C6D.tmp"C:\Users\Admin\AppData\Local\Temp\3C6D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\3D76.tmp"C:\Users\Admin\AppData\Local\Temp\3D76.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\3E41.tmp"C:\Users\Admin\AppData\Local\Temp\3E41.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\4045.tmp"C:\Users\Admin\AppData\Local\Temp\4045.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Users\Admin\AppData\Local\Temp\40A3.tmp"C:\Users\Admin\AppData\Local\Temp\40A3.tmp"23⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\4100.tmp"C:\Users\Admin\AppData\Local\Temp\4100.tmp"24⤵
- Executes dropped EXE
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\414F.tmp"C:\Users\Admin\AppData\Local\Temp\414F.tmp"25⤵
- Executes dropped EXE
PID:944 -
C:\Users\Admin\AppData\Local\Temp\41BC.tmp"C:\Users\Admin\AppData\Local\Temp\41BC.tmp"26⤵
- Executes dropped EXE
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\421A.tmp"C:\Users\Admin\AppData\Local\Temp\421A.tmp"27⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\4277.tmp"C:\Users\Admin\AppData\Local\Temp\4277.tmp"28⤵
- Executes dropped EXE
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"29⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"30⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"31⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"32⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"33⤵
- Executes dropped EXE
PID:672 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"34⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"35⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"36⤵
- Executes dropped EXE
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"37⤵
- Executes dropped EXE
PID:976 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"38⤵
- Executes dropped EXE
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"39⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"40⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"41⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"42⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"43⤵
- Executes dropped EXE
PID:620 -
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"44⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"45⤵
- Executes dropped EXE
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"46⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"47⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"48⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"49⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"50⤵
- Executes dropped EXE
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"51⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"52⤵
- Executes dropped EXE
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"53⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"54⤵
- Executes dropped EXE
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"55⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"56⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"57⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"58⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"59⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"60⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"61⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"62⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"63⤵
- Executes dropped EXE
PID:808 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"64⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"65⤵
- Executes dropped EXE
PID:704 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"66⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"67⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"68⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"69⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"70⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"71⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"72⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"73⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"74⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"75⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"76⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"77⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"78⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"79⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"80⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"81⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"82⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"83⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"84⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"85⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"86⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"87⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"88⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"89⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"90⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"91⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"92⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"93⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"94⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"95⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"96⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"97⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"98⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"99⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"100⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"101⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"102⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"103⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"104⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"105⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"106⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"107⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"108⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"109⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"110⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"111⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"112⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"113⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"114⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"115⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"116⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"117⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"118⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"119⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"120⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"121⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"122⤵PID:4504
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-