Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/01/2024, 05:43
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-25_4ab7dbf782e762c0e6619fc80c213407_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-25_4ab7dbf782e762c0e6619fc80c213407_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-25_4ab7dbf782e762c0e6619fc80c213407_mafia.exe
-
Size
486KB
-
MD5
4ab7dbf782e762c0e6619fc80c213407
-
SHA1
158843ee7bcf1123d9621dc251b963a5a8ded32c
-
SHA256
1ad4c6be91a2848f5a7cacf3aa5454ce4f248be41f8291b390cf29b3b8f5cded
-
SHA512
99638fb7ddbd1740d35252c023d25154b613d9b20a3880737a04216374aae67757a306437eda78fe8e9fc882dd96c0fb1c1069e25e5c0de60970bef40c46b0bd
-
SSDEEP
12288:oU5rCOTeiDCmTc4ncIL9rii+AREsm0rTkeg22SEANZ:oUQOJDCmY41IrARZrTken5N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4984 44AA.tmp 1952 4527.tmp 5668 4585.tmp 112 45F2.tmp 2700 4650.tmp 448 46AE.tmp 2396 473A.tmp 2964 47A8.tmp 2836 4825.tmp 5792 48A2.tmp 5820 48F0.tmp 5448 495D.tmp 5548 49BB.tmp 636 4A28.tmp 3604 4A86.tmp 5128 4AF3.tmp 2168 4B61.tmp 4600 4BBE.tmp 960 4C3B.tmp 4256 4CC8.tmp 3780 4D35.tmp 4696 4D84.tmp 4264 4DF1.tmp 3672 4E3F.tmp 5604 4EBC.tmp 648 4F39.tmp 4968 4F97.tmp 60 5014.tmp 5000 5062.tmp 6080 50CF.tmp 3128 511D.tmp 3460 518B.tmp 5528 5208.tmp 5148 5256.tmp 6100 52D3.tmp 4136 5331.tmp 5732 537F.tmp 1688 53DD.tmp 2852 543A.tmp 5920 54A8.tmp 3176 55A2.tmp 5452 55F0.tmp 5160 564E.tmp 552 56AB.tmp 5340 5719.tmp 5556 5767.tmp 3480 57B5.tmp 5544 5813.tmp 888 5870.tmp 5696 58CE.tmp 2252 592C.tmp 1280 598A.tmp 1860 59E7.tmp 700 5A64.tmp 1512 5AB3.tmp 3252 5B01.tmp 3944 5B4F.tmp 3188 5BAD.tmp 2160 5BFB.tmp 3308 5C49.tmp 5884 5C97.tmp 4068 5CE5.tmp 4036 5D33.tmp 2552 5D81.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4688 wrote to memory of 4984 4688 2024-01-25_4ab7dbf782e762c0e6619fc80c213407_mafia.exe 86 PID 4688 wrote to memory of 4984 4688 2024-01-25_4ab7dbf782e762c0e6619fc80c213407_mafia.exe 86 PID 4688 wrote to memory of 4984 4688 2024-01-25_4ab7dbf782e762c0e6619fc80c213407_mafia.exe 86 PID 4984 wrote to memory of 1952 4984 44AA.tmp 88 PID 4984 wrote to memory of 1952 4984 44AA.tmp 88 PID 4984 wrote to memory of 1952 4984 44AA.tmp 88 PID 1952 wrote to memory of 5668 1952 4527.tmp 90 PID 1952 wrote to memory of 5668 1952 4527.tmp 90 PID 1952 wrote to memory of 5668 1952 4527.tmp 90 PID 5668 wrote to memory of 112 5668 4585.tmp 91 PID 5668 wrote to memory of 112 5668 4585.tmp 91 PID 5668 wrote to memory of 112 5668 4585.tmp 91 PID 112 wrote to memory of 2700 112 45F2.tmp 92 PID 112 wrote to memory of 2700 112 45F2.tmp 92 PID 112 wrote to memory of 2700 112 45F2.tmp 92 PID 2700 wrote to memory of 448 2700 4650.tmp 93 PID 2700 wrote to memory of 448 2700 4650.tmp 93 PID 2700 wrote to memory of 448 2700 4650.tmp 93 PID 448 wrote to memory of 2396 448 46AE.tmp 95 PID 448 wrote to memory of 2396 448 46AE.tmp 95 PID 448 wrote to memory of 2396 448 46AE.tmp 95 PID 2396 wrote to memory of 2964 2396 473A.tmp 96 PID 2396 wrote to memory of 2964 2396 473A.tmp 96 PID 2396 wrote to memory of 2964 2396 473A.tmp 96 PID 2964 wrote to memory of 2836 2964 47A8.tmp 97 PID 2964 wrote to memory of 2836 2964 47A8.tmp 97 PID 2964 wrote to memory of 2836 2964 47A8.tmp 97 PID 2836 wrote to memory of 5792 2836 4825.tmp 98 PID 2836 wrote to memory of 5792 2836 4825.tmp 98 PID 2836 wrote to memory of 5792 2836 4825.tmp 98 PID 5792 wrote to memory of 5820 5792 48A2.tmp 99 PID 5792 wrote to memory of 5820 5792 48A2.tmp 99 PID 5792 wrote to memory of 5820 5792 48A2.tmp 99 PID 5820 wrote to memory of 5448 5820 48F0.tmp 100 PID 5820 wrote to memory of 5448 5820 48F0.tmp 100 PID 5820 wrote to memory of 5448 5820 48F0.tmp 100 PID 5448 wrote to memory of 5548 5448 495D.tmp 101 PID 5448 wrote to memory of 5548 5448 495D.tmp 101 PID 5448 wrote to memory of 5548 5448 495D.tmp 101 PID 5548 wrote to memory of 636 5548 49BB.tmp 102 PID 5548 wrote to memory of 636 5548 49BB.tmp 102 PID 5548 wrote to memory of 636 5548 49BB.tmp 102 PID 636 wrote to memory of 3604 636 4A28.tmp 103 PID 636 wrote to memory of 3604 636 4A28.tmp 103 PID 636 wrote to memory of 3604 636 4A28.tmp 103 PID 3604 wrote to memory of 5128 3604 4A86.tmp 104 PID 3604 wrote to memory of 5128 3604 4A86.tmp 104 PID 3604 wrote to memory of 5128 3604 4A86.tmp 104 PID 5128 wrote to memory of 2168 5128 4AF3.tmp 105 PID 5128 wrote to memory of 2168 5128 4AF3.tmp 105 PID 5128 wrote to memory of 2168 5128 4AF3.tmp 105 PID 2168 wrote to memory of 4600 2168 4B61.tmp 106 PID 2168 wrote to memory of 4600 2168 4B61.tmp 106 PID 2168 wrote to memory of 4600 2168 4B61.tmp 106 PID 4600 wrote to memory of 960 4600 4BBE.tmp 107 PID 4600 wrote to memory of 960 4600 4BBE.tmp 107 PID 4600 wrote to memory of 960 4600 4BBE.tmp 107 PID 960 wrote to memory of 4256 960 4C3B.tmp 110 PID 960 wrote to memory of 4256 960 4C3B.tmp 110 PID 960 wrote to memory of 4256 960 4C3B.tmp 110 PID 4256 wrote to memory of 3780 4256 4CC8.tmp 111 PID 4256 wrote to memory of 3780 4256 4CC8.tmp 111 PID 4256 wrote to memory of 3780 4256 4CC8.tmp 111 PID 3780 wrote to memory of 4696 3780 4D35.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_4ab7dbf782e762c0e6619fc80c213407_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_4ab7dbf782e762c0e6619fc80c213407_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\44AA.tmp"C:\Users\Admin\AppData\Local\Temp\44AA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\45F2.tmp"C:\Users\Admin\AppData\Local\Temp\45F2.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"23⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"24⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"25⤵
- Executes dropped EXE
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"26⤵
- Executes dropped EXE
PID:5604 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"27⤵
- Executes dropped EXE
PID:648 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"28⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"29⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"30⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"31⤵
- Executes dropped EXE
PID:6080 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"32⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"33⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"34⤵
- Executes dropped EXE
PID:5528 -
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"35⤵
- Executes dropped EXE
PID:5148 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"36⤵
- Executes dropped EXE
PID:6100 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"37⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"38⤵
- Executes dropped EXE
PID:5732 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"39⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"40⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"41⤵
- Executes dropped EXE
PID:5920 -
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"42⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"43⤵
- Executes dropped EXE
PID:5452 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"44⤵
- Executes dropped EXE
PID:5160 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"45⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"46⤵
- Executes dropped EXE
PID:5340 -
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"47⤵
- Executes dropped EXE
PID:5556 -
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"48⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"49⤵
- Executes dropped EXE
PID:5544 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"50⤵
- Executes dropped EXE
PID:888 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"51⤵
- Executes dropped EXE
PID:5696 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"52⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"53⤵
- Executes dropped EXE
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"54⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"55⤵
- Executes dropped EXE
PID:700 -
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"56⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"57⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"58⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"59⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"60⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"61⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"62⤵
- Executes dropped EXE
PID:5884 -
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"63⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"64⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"65⤵
- Executes dropped EXE
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"66⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"67⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"68⤵PID:5296
-
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"69⤵PID:5400
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"70⤵PID:5704
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"71⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"72⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"73⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"74⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"75⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"76⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"77⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"78⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"79⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"80⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"81⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"82⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"83⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"84⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"85⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"86⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"87⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"88⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"89⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"90⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"91⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\6745.tmp"C:\Users\Admin\AppData\Local\Temp\6745.tmp"92⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"93⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"94⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"95⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"96⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"97⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"98⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"99⤵PID:6140
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"100⤵PID:5464
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"101⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"102⤵PID:5272
-
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"103⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"104⤵PID:5872
-
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"105⤵PID:5664
-
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"106⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"107⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"108⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"109⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"110⤵PID:6132
-
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"111⤵PID:5204
-
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"112⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"113⤵PID:6128
-
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"114⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"115⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"116⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"117⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"118⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"119⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\7148.tmp"C:\Users\Admin\AppData\Local\Temp\7148.tmp"120⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"121⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"122⤵PID:3108
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-