Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
50s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
30/04/2024, 13:42
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-30_a46fd807a4003cf13f53d44d52e1fd44_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-30_a46fd807a4003cf13f53d44d52e1fd44_mafia.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-04-30_a46fd807a4003cf13f53d44d52e1fd44_mafia.exe
-
Size
541KB
-
MD5
a46fd807a4003cf13f53d44d52e1fd44
-
SHA1
e33aaf2731ba637c1ade25a3137834f6c4769744
-
SHA256
d0f236ff6f9319f249a3c3ab55124a5d2a4703a528748b70ad9483b3d69eaf2c
-
SHA512
982e2da714d089e2c1b370a440520a424290fd9ffba93bf9ccb3a2da4f4086c2e75f64494e8afc311234aa50e53ce4b2ff2ccd33c59ee3ff3c3bd2425c048e93
-
SSDEEP
12288:UU5rCOTeifZahDNJzN6F8xTaR14ngrZa73ctO:UUQOJf4DTJQWTaRHrU73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4780 440E.tmp 324 446B.tmp 1136 44E8.tmp 1848 4565.tmp 2784 45F2.tmp 2352 466F.tmp 1660 46DC.tmp 2192 473A.tmp 4384 4798.tmp 2764 4805.tmp 2744 4863.tmp 2968 48D0.tmp 1984 492E.tmp 2016 49AB.tmp 4644 4A09.tmp 4352 4A86.tmp 4444 4AF3.tmp 1692 4B61.tmp 2676 4BBE.tmp 3416 4C1C.tmp 3848 4C99.tmp 2872 4D07.tmp 2620 4D64.tmp 3656 4DC2.tmp 4524 4E20.tmp 3056 4E6E.tmp 1972 4ECC.tmp 5076 4F29.tmp 2580 4F78.tmp 4992 4FE5.tmp 1412 5033.tmp 2284 5091.tmp 2952 50FE.tmp 4652 514C.tmp 4736 519A.tmp 4152 51E9.tmp 5116 5237.tmp 3152 5285.tmp 4372 52D3.tmp 1768 5331.tmp 2380 537F.tmp 3268 53CD.tmp 4596 541B.tmp 428 5479.tmp 4552 54D7.tmp 412 5525.tmp 2084 5573.tmp 3636 55D1.tmp 1476 562E.tmp 4268 567C.tmp 4504 56CB.tmp 4488 5719.tmp 1572 5767.tmp 4560 57B5.tmp 1712 5813.tmp 4144 5861.tmp 1936 58AF.tmp 1540 58FD.tmp 1848 594B.tmp 868 5999.tmp 712 59E7.tmp 3668 5A36.tmp 3448 5A84.tmp 4616 5AE1.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1572 wrote to memory of 4780 1572 2024-04-30_a46fd807a4003cf13f53d44d52e1fd44_mafia.exe 84 PID 1572 wrote to memory of 4780 1572 2024-04-30_a46fd807a4003cf13f53d44d52e1fd44_mafia.exe 84 PID 1572 wrote to memory of 4780 1572 2024-04-30_a46fd807a4003cf13f53d44d52e1fd44_mafia.exe 84 PID 4780 wrote to memory of 324 4780 440E.tmp 85 PID 4780 wrote to memory of 324 4780 440E.tmp 85 PID 4780 wrote to memory of 324 4780 440E.tmp 85 PID 324 wrote to memory of 1136 324 446B.tmp 86 PID 324 wrote to memory of 1136 324 446B.tmp 86 PID 324 wrote to memory of 1136 324 446B.tmp 86 PID 1136 wrote to memory of 1848 1136 44E8.tmp 88 PID 1136 wrote to memory of 1848 1136 44E8.tmp 88 PID 1136 wrote to memory of 1848 1136 44E8.tmp 88 PID 1848 wrote to memory of 2784 1848 4565.tmp 90 PID 1848 wrote to memory of 2784 1848 4565.tmp 90 PID 1848 wrote to memory of 2784 1848 4565.tmp 90 PID 2784 wrote to memory of 2352 2784 45F2.tmp 91 PID 2784 wrote to memory of 2352 2784 45F2.tmp 91 PID 2784 wrote to memory of 2352 2784 45F2.tmp 91 PID 2352 wrote to memory of 1660 2352 466F.tmp 93 PID 2352 wrote to memory of 1660 2352 466F.tmp 93 PID 2352 wrote to memory of 1660 2352 466F.tmp 93 PID 1660 wrote to memory of 2192 1660 46DC.tmp 94 PID 1660 wrote to memory of 2192 1660 46DC.tmp 94 PID 1660 wrote to memory of 2192 1660 46DC.tmp 94 PID 2192 wrote to memory of 4384 2192 473A.tmp 95 PID 2192 wrote to memory of 4384 2192 473A.tmp 95 PID 2192 wrote to memory of 4384 2192 473A.tmp 95 PID 4384 wrote to memory of 2764 4384 4798.tmp 96 PID 4384 wrote to memory of 2764 4384 4798.tmp 96 PID 4384 wrote to memory of 2764 4384 4798.tmp 96 PID 2764 wrote to memory of 2744 2764 4805.tmp 97 PID 2764 wrote to memory of 2744 2764 4805.tmp 97 PID 2764 wrote to memory of 2744 2764 4805.tmp 97 PID 2744 wrote to memory of 2968 2744 4863.tmp 98 PID 2744 wrote to memory of 2968 2744 4863.tmp 98 PID 2744 wrote to memory of 2968 2744 4863.tmp 98 PID 2968 wrote to memory of 1984 2968 48D0.tmp 99 PID 2968 wrote to memory of 1984 2968 48D0.tmp 99 PID 2968 wrote to memory of 1984 2968 48D0.tmp 99 PID 1984 wrote to memory of 2016 1984 492E.tmp 100 PID 1984 wrote to memory of 2016 1984 492E.tmp 100 PID 1984 wrote to memory of 2016 1984 492E.tmp 100 PID 2016 wrote to memory of 4644 2016 49AB.tmp 101 PID 2016 wrote to memory of 4644 2016 49AB.tmp 101 PID 2016 wrote to memory of 4644 2016 49AB.tmp 101 PID 4644 wrote to memory of 4352 4644 4A09.tmp 102 PID 4644 wrote to memory of 4352 4644 4A09.tmp 102 PID 4644 wrote to memory of 4352 4644 4A09.tmp 102 PID 4352 wrote to memory of 4444 4352 4A86.tmp 103 PID 4352 wrote to memory of 4444 4352 4A86.tmp 103 PID 4352 wrote to memory of 4444 4352 4A86.tmp 103 PID 4444 wrote to memory of 1692 4444 4AF3.tmp 104 PID 4444 wrote to memory of 1692 4444 4AF3.tmp 104 PID 4444 wrote to memory of 1692 4444 4AF3.tmp 104 PID 1692 wrote to memory of 2676 1692 4B61.tmp 105 PID 1692 wrote to memory of 2676 1692 4B61.tmp 105 PID 1692 wrote to memory of 2676 1692 4B61.tmp 105 PID 2676 wrote to memory of 3416 2676 4BBE.tmp 106 PID 2676 wrote to memory of 3416 2676 4BBE.tmp 106 PID 2676 wrote to memory of 3416 2676 4BBE.tmp 106 PID 3416 wrote to memory of 3848 3416 4C1C.tmp 107 PID 3416 wrote to memory of 3848 3416 4C1C.tmp 107 PID 3416 wrote to memory of 3848 3416 4C1C.tmp 107 PID 3848 wrote to memory of 2872 3848 4C99.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-30_a46fd807a4003cf13f53d44d52e1fd44_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-30_a46fd807a4003cf13f53d44d52e1fd44_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\4565.tmp"C:\Users\Admin\AppData\Local\Temp\4565.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\45F2.tmp"C:\Users\Admin\AppData\Local\Temp\45F2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"23⤵
- Executes dropped EXE
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"24⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"25⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"26⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"27⤵
- Executes dropped EXE
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"28⤵
- Executes dropped EXE
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"29⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"30⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"31⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"32⤵
- Executes dropped EXE
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"33⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"34⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"35⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"36⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"37⤵
- Executes dropped EXE
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"38⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"39⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"40⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"41⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"42⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"43⤵
- Executes dropped EXE
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"44⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"45⤵
- Executes dropped EXE
PID:428 -
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"46⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"47⤵
- Executes dropped EXE
PID:412 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"48⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"49⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"50⤵
- Executes dropped EXE
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"51⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"52⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"53⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"54⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"55⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"56⤵
- Executes dropped EXE
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"57⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"58⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"59⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"60⤵
- Executes dropped EXE
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"61⤵
- Executes dropped EXE
PID:868 -
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"62⤵
- Executes dropped EXE
PID:712 -
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"63⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"64⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"65⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"66⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"67⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"68⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"69⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"70⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"71⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"72⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"73⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"74⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"75⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"76⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"77⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"78⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"79⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"80⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"81⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"82⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"83⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"84⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"85⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"86⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"87⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"88⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"89⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"90⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"91⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"92⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"93⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"94⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"95⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"96⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"97⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"98⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"99⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"100⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"101⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"102⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\6745.tmp"C:\Users\Admin\AppData\Local\Temp\6745.tmp"103⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"104⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"105⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"106⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"107⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"108⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"109⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"110⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"111⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"112⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"113⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"114⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"115⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"116⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"117⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"118⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"119⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"120⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"121⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"122⤵PID:1084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-