Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
53s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
26/04/2024, 10:26
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-26_fa44ab025783d35c8d614476b73fd459_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-04-26_fa44ab025783d35c8d614476b73fd459_mafia.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-04-26_fa44ab025783d35c8d614476b73fd459_mafia.exe
-
Size
529KB
-
MD5
fa44ab025783d35c8d614476b73fd459
-
SHA1
122e34b075c46f205455853ecb5a7315ba56b728
-
SHA256
6585cccc5397eb83628293efbe3c76cf76cf48b32c7131434ac366fe982dd4ad
-
SHA512
0e35f26845bb278e5333d99bb86045ebeed62a3c8e738bed24f939f65ca54a82484277576ef4a5a46353c12db0f8c4a7b3c5701042fca8e41e17f2ab029f2391
-
SSDEEP
12288:NU5rCOTeij2X9E2eqPJjXzLodvMSO9iTZwlH4Hp:NUQOJje9HeWJXUVMS+iTSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2892 44E8.tmp 2828 4575.tmp 2144 4602.tmp 4308 466F.tmp 1124 46EC.tmp 3636 474A.tmp 1192 47D6.tmp 3260 4834.tmp 5048 48A2.tmp 2676 490F.tmp 448 496D.tmp 3168 49BB.tmp 4884 4A47.tmp 2364 4AA5.tmp 2956 4B22.tmp 1136 4B90.tmp 1360 4BFD.tmp 4372 4C6A.tmp 2124 4CD8.tmp 832 4D45.tmp 3560 4DA3.tmp 2120 4E01.tmp 4484 4E6E.tmp 1476 4EDB.tmp 2600 4F58.tmp 1340 4FC6.tmp 4008 5033.tmp 3592 50B0.tmp 2228 510E.tmp 1420 517B.tmp 4808 51E9.tmp 4092 5237.tmp 452 52B4.tmp 4424 5302.tmp 3404 5350.tmp 532 538E.tmp 2836 53DD.tmp 1712 542B.tmp 2636 5479.tmp 2700 54C7.tmp 3820 5515.tmp 4616 5573.tmp 720 55C1.tmp 3892 560F.tmp 208 565D.tmp 3396 56AB.tmp 2872 56F9.tmp 2596 5757.tmp 4516 57A5.tmp 4856 5803.tmp 1860 5851.tmp 2892 589F.tmp 716 58DE.tmp 2828 592C.tmp 4772 597A.tmp 3932 59C8.tmp 3408 5A26.tmp 4872 5A84.tmp 4608 5AD2.tmp 1108 5B20.tmp 2424 5B6E.tmp 936 5BBC.tmp 3612 5C0A.tmp 1192 5C49.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4552 wrote to memory of 2892 4552 2024-04-26_fa44ab025783d35c8d614476b73fd459_mafia.exe 84 PID 4552 wrote to memory of 2892 4552 2024-04-26_fa44ab025783d35c8d614476b73fd459_mafia.exe 84 PID 4552 wrote to memory of 2892 4552 2024-04-26_fa44ab025783d35c8d614476b73fd459_mafia.exe 84 PID 2892 wrote to memory of 2828 2892 44E8.tmp 86 PID 2892 wrote to memory of 2828 2892 44E8.tmp 86 PID 2892 wrote to memory of 2828 2892 44E8.tmp 86 PID 2828 wrote to memory of 2144 2828 4575.tmp 88 PID 2828 wrote to memory of 2144 2828 4575.tmp 88 PID 2828 wrote to memory of 2144 2828 4575.tmp 88 PID 2144 wrote to memory of 4308 2144 4602.tmp 90 PID 2144 wrote to memory of 4308 2144 4602.tmp 90 PID 2144 wrote to memory of 4308 2144 4602.tmp 90 PID 4308 wrote to memory of 1124 4308 466F.tmp 91 PID 4308 wrote to memory of 1124 4308 466F.tmp 91 PID 4308 wrote to memory of 1124 4308 466F.tmp 91 PID 1124 wrote to memory of 3636 1124 46EC.tmp 92 PID 1124 wrote to memory of 3636 1124 46EC.tmp 92 PID 1124 wrote to memory of 3636 1124 46EC.tmp 92 PID 3636 wrote to memory of 1192 3636 474A.tmp 93 PID 3636 wrote to memory of 1192 3636 474A.tmp 93 PID 3636 wrote to memory of 1192 3636 474A.tmp 93 PID 1192 wrote to memory of 3260 1192 47D6.tmp 94 PID 1192 wrote to memory of 3260 1192 47D6.tmp 94 PID 1192 wrote to memory of 3260 1192 47D6.tmp 94 PID 3260 wrote to memory of 5048 3260 4834.tmp 95 PID 3260 wrote to memory of 5048 3260 4834.tmp 95 PID 3260 wrote to memory of 5048 3260 4834.tmp 95 PID 5048 wrote to memory of 2676 5048 48A2.tmp 96 PID 5048 wrote to memory of 2676 5048 48A2.tmp 96 PID 5048 wrote to memory of 2676 5048 48A2.tmp 96 PID 2676 wrote to memory of 448 2676 490F.tmp 97 PID 2676 wrote to memory of 448 2676 490F.tmp 97 PID 2676 wrote to memory of 448 2676 490F.tmp 97 PID 448 wrote to memory of 3168 448 496D.tmp 98 PID 448 wrote to memory of 3168 448 496D.tmp 98 PID 448 wrote to memory of 3168 448 496D.tmp 98 PID 3168 wrote to memory of 4884 3168 49BB.tmp 99 PID 3168 wrote to memory of 4884 3168 49BB.tmp 99 PID 3168 wrote to memory of 4884 3168 49BB.tmp 99 PID 4884 wrote to memory of 2364 4884 4A47.tmp 100 PID 4884 wrote to memory of 2364 4884 4A47.tmp 100 PID 4884 wrote to memory of 2364 4884 4A47.tmp 100 PID 2364 wrote to memory of 2956 2364 4AA5.tmp 101 PID 2364 wrote to memory of 2956 2364 4AA5.tmp 101 PID 2364 wrote to memory of 2956 2364 4AA5.tmp 101 PID 2956 wrote to memory of 1136 2956 4B22.tmp 102 PID 2956 wrote to memory of 1136 2956 4B22.tmp 102 PID 2956 wrote to memory of 1136 2956 4B22.tmp 102 PID 1136 wrote to memory of 1360 1136 4B90.tmp 103 PID 1136 wrote to memory of 1360 1136 4B90.tmp 103 PID 1136 wrote to memory of 1360 1136 4B90.tmp 103 PID 1360 wrote to memory of 4372 1360 4BFD.tmp 104 PID 1360 wrote to memory of 4372 1360 4BFD.tmp 104 PID 1360 wrote to memory of 4372 1360 4BFD.tmp 104 PID 4372 wrote to memory of 2124 4372 4C6A.tmp 105 PID 4372 wrote to memory of 2124 4372 4C6A.tmp 105 PID 4372 wrote to memory of 2124 4372 4C6A.tmp 105 PID 2124 wrote to memory of 832 2124 4CD8.tmp 106 PID 2124 wrote to memory of 832 2124 4CD8.tmp 106 PID 2124 wrote to memory of 832 2124 4CD8.tmp 106 PID 832 wrote to memory of 3560 832 4D45.tmp 107 PID 832 wrote to memory of 3560 832 4D45.tmp 107 PID 832 wrote to memory of 3560 832 4D45.tmp 107 PID 3560 wrote to memory of 2120 3560 4DA3.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-26_fa44ab025783d35c8d614476b73fd459_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-26_fa44ab025783d35c8d614476b73fd459_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\4602.tmp"C:\Users\Admin\AppData\Local\Temp\4602.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\46EC.tmp"C:\Users\Admin\AppData\Local\Temp\46EC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"23⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"24⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"25⤵
- Executes dropped EXE
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"26⤵
- Executes dropped EXE
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"27⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"28⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"29⤵
- Executes dropped EXE
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"30⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"31⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"32⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"33⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"34⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"35⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"36⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"37⤵
- Executes dropped EXE
PID:532 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"38⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"39⤵
- Executes dropped EXE
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"40⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"41⤵
- Executes dropped EXE
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"42⤵
- Executes dropped EXE
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"43⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"44⤵
- Executes dropped EXE
PID:720 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"45⤵
- Executes dropped EXE
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"46⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"47⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"48⤵
- Executes dropped EXE
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"49⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"50⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"51⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"52⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"53⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"54⤵
- Executes dropped EXE
PID:716 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"55⤵
- Executes dropped EXE
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"56⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"57⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"58⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"59⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"60⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"61⤵
- Executes dropped EXE
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"62⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"63⤵
- Executes dropped EXE
PID:936 -
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"64⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"65⤵
- Executes dropped EXE
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"66⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"67⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"68⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"69⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"70⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"71⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"72⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"73⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"74⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"75⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"76⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"77⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"78⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"79⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"80⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"81⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"82⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"83⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"84⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"85⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"86⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"87⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"88⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"89⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"90⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"91⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"92⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"93⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"94⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"95⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"96⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"97⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"98⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"99⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"100⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"101⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"102⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"103⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"104⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"105⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"106⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"107⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"108⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"109⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"110⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"111⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"112⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"113⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"114⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"115⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"116⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"117⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"118⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"119⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"120⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"121⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"122⤵PID:2140
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-