Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
14/02/2024, 09:37
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-14_7b1adaca27f92167a356f3a6f1e69e9b_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-02-14_7b1adaca27f92167a356f3a6f1e69e9b_mafia.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-02-14_7b1adaca27f92167a356f3a6f1e69e9b_mafia.exe
-
Size
486KB
-
MD5
7b1adaca27f92167a356f3a6f1e69e9b
-
SHA1
7c1930aaaf743faae30ea46956fe14c432d39cd7
-
SHA256
29cc57867d23eb63613ae2929465c839bf3418913236a1d13cc95bc806cf0501
-
SHA512
ddab6ea7d5a33afa5e81b54b78e433cf66edfb3ace351981b9d90a8afe547cf39b4a102726a519107787c58821a3fcd0a6469f40a8bc1ce895069f5213638ca7
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7i8yyOnCvXWP3x56Jq7azGmdx6mRWhV/TsH3j:/U5rCOTeiDM3noAaz1dx9RoF4NZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3096 42F4.tmp 1292 4381.tmp 3536 43EE.tmp 3864 446B.tmp 2888 44BA.tmp 1592 4508.tmp 396 4556.tmp 632 45A4.tmp 4812 4621.tmp 2112 466F.tmp 4572 46DC.tmp 3256 472B.tmp 1700 4798.tmp 4664 4805.tmp 4836 4873.tmp 2604 48C1.tmp 4404 491F.tmp 4392 496D.tmp 3064 49BB.tmp 2080 4A38.tmp 2024 4A96.tmp 1464 4AF3.tmp 3424 4B61.tmp 1624 4BBE.tmp 4556 4C1C.tmp 1416 4C6A.tmp 3896 4CB8.tmp 4044 4D07.tmp 2252 4D84.tmp 3060 4E01.tmp 1164 4E7E.tmp 4240 4F0A.tmp 1668 4F58.tmp 1580 4FB6.tmp 2396 5014.tmp 3152 5062.tmp 1984 50C0.tmp 2972 511D.tmp 3596 517B.tmp 468 51C9.tmp 392 5217.tmp 1264 5266.tmp 4584 52C3.tmp 1240 5321.tmp 2536 537F.tmp 1032 53DD.tmp 3580 543A.tmp 4412 5498.tmp 1972 54E6.tmp 3228 5544.tmp 3808 5592.tmp 1948 560F.tmp 4372 566D.tmp 3992 56BB.tmp 4864 5709.tmp 372 5757.tmp 4960 57B5.tmp 4504 5803.tmp 2288 5851.tmp 3480 58AF.tmp 1816 590D.tmp 3544 596A.tmp 1292 59C8.tmp 1808 5A26.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3480 wrote to memory of 3096 3480 2024-02-14_7b1adaca27f92167a356f3a6f1e69e9b_mafia.exe 84 PID 3480 wrote to memory of 3096 3480 2024-02-14_7b1adaca27f92167a356f3a6f1e69e9b_mafia.exe 84 PID 3480 wrote to memory of 3096 3480 2024-02-14_7b1adaca27f92167a356f3a6f1e69e9b_mafia.exe 84 PID 3096 wrote to memory of 1292 3096 42F4.tmp 85 PID 3096 wrote to memory of 1292 3096 42F4.tmp 85 PID 3096 wrote to memory of 1292 3096 42F4.tmp 85 PID 1292 wrote to memory of 3536 1292 4381.tmp 86 PID 1292 wrote to memory of 3536 1292 4381.tmp 86 PID 1292 wrote to memory of 3536 1292 4381.tmp 86 PID 3536 wrote to memory of 3864 3536 43EE.tmp 87 PID 3536 wrote to memory of 3864 3536 43EE.tmp 87 PID 3536 wrote to memory of 3864 3536 43EE.tmp 87 PID 3864 wrote to memory of 2888 3864 446B.tmp 88 PID 3864 wrote to memory of 2888 3864 446B.tmp 88 PID 3864 wrote to memory of 2888 3864 446B.tmp 88 PID 2888 wrote to memory of 1592 2888 44BA.tmp 89 PID 2888 wrote to memory of 1592 2888 44BA.tmp 89 PID 2888 wrote to memory of 1592 2888 44BA.tmp 89 PID 1592 wrote to memory of 396 1592 4508.tmp 90 PID 1592 wrote to memory of 396 1592 4508.tmp 90 PID 1592 wrote to memory of 396 1592 4508.tmp 90 PID 396 wrote to memory of 632 396 4556.tmp 91 PID 396 wrote to memory of 632 396 4556.tmp 91 PID 396 wrote to memory of 632 396 4556.tmp 91 PID 632 wrote to memory of 4812 632 45A4.tmp 92 PID 632 wrote to memory of 4812 632 45A4.tmp 92 PID 632 wrote to memory of 4812 632 45A4.tmp 92 PID 4812 wrote to memory of 2112 4812 4621.tmp 93 PID 4812 wrote to memory of 2112 4812 4621.tmp 93 PID 4812 wrote to memory of 2112 4812 4621.tmp 93 PID 2112 wrote to memory of 4572 2112 466F.tmp 94 PID 2112 wrote to memory of 4572 2112 466F.tmp 94 PID 2112 wrote to memory of 4572 2112 466F.tmp 94 PID 4572 wrote to memory of 3256 4572 46DC.tmp 95 PID 4572 wrote to memory of 3256 4572 46DC.tmp 95 PID 4572 wrote to memory of 3256 4572 46DC.tmp 95 PID 3256 wrote to memory of 1700 3256 472B.tmp 96 PID 3256 wrote to memory of 1700 3256 472B.tmp 96 PID 3256 wrote to memory of 1700 3256 472B.tmp 96 PID 1700 wrote to memory of 4664 1700 4798.tmp 97 PID 1700 wrote to memory of 4664 1700 4798.tmp 97 PID 1700 wrote to memory of 4664 1700 4798.tmp 97 PID 4664 wrote to memory of 4836 4664 4805.tmp 98 PID 4664 wrote to memory of 4836 4664 4805.tmp 98 PID 4664 wrote to memory of 4836 4664 4805.tmp 98 PID 4836 wrote to memory of 2604 4836 4873.tmp 99 PID 4836 wrote to memory of 2604 4836 4873.tmp 99 PID 4836 wrote to memory of 2604 4836 4873.tmp 99 PID 2604 wrote to memory of 4404 2604 48C1.tmp 100 PID 2604 wrote to memory of 4404 2604 48C1.tmp 100 PID 2604 wrote to memory of 4404 2604 48C1.tmp 100 PID 4404 wrote to memory of 4392 4404 491F.tmp 101 PID 4404 wrote to memory of 4392 4404 491F.tmp 101 PID 4404 wrote to memory of 4392 4404 491F.tmp 101 PID 4392 wrote to memory of 3064 4392 496D.tmp 102 PID 4392 wrote to memory of 3064 4392 496D.tmp 102 PID 4392 wrote to memory of 3064 4392 496D.tmp 102 PID 3064 wrote to memory of 2080 3064 49BB.tmp 103 PID 3064 wrote to memory of 2080 3064 49BB.tmp 103 PID 3064 wrote to memory of 2080 3064 49BB.tmp 103 PID 2080 wrote to memory of 2024 2080 4A38.tmp 104 PID 2080 wrote to memory of 2024 2080 4A38.tmp 104 PID 2080 wrote to memory of 2024 2080 4A38.tmp 104 PID 2024 wrote to memory of 1464 2024 4A96.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-14_7b1adaca27f92167a356f3a6f1e69e9b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-14_7b1adaca27f92167a356f3a6f1e69e9b_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\42F4.tmp"C:\Users\Admin\AppData\Local\Temp\42F4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"23⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"24⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"25⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"26⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"27⤵
- Executes dropped EXE
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"28⤵
- Executes dropped EXE
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"29⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"30⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"31⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"32⤵
- Executes dropped EXE
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"33⤵
- Executes dropped EXE
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"34⤵
- Executes dropped EXE
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"35⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"36⤵
- Executes dropped EXE
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"37⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"38⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"39⤵
- Executes dropped EXE
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"40⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"41⤵
- Executes dropped EXE
PID:468 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"42⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"43⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"44⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"45⤵
- Executes dropped EXE
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"46⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"47⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"48⤵
- Executes dropped EXE
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"49⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"50⤵
- Executes dropped EXE
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"51⤵
- Executes dropped EXE
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"52⤵
- Executes dropped EXE
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"53⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"54⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"55⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"56⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"57⤵
- Executes dropped EXE
PID:372 -
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"58⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"59⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"60⤵
- Executes dropped EXE
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"61⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"62⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"63⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"64⤵
- Executes dropped EXE
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"65⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"66⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"67⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"68⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"69⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"70⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"71⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"72⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"73⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"74⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"75⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"76⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"77⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"78⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"79⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"80⤵PID:32
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"81⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"82⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"83⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"84⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"85⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"86⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"87⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"88⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"89⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"90⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"91⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"92⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"93⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"94⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"95⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"96⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"97⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"98⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"99⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"100⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"101⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"102⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"103⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"104⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"105⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"106⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"107⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"108⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"109⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"110⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"111⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"112⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"113⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"114⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"115⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"116⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"117⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"118⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"119⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"120⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"121⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"122⤵PID:4592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-