Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2024, 04:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-04_0846a194b39502ddcffdb94ffb15d652_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-04_0846a194b39502ddcffdb94ffb15d652_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-05-04_0846a194b39502ddcffdb94ffb15d652_mafia.exe
-
Size
765KB
-
MD5
0846a194b39502ddcffdb94ffb15d652
-
SHA1
2b9378a90b908ee0fb57e992fc21628ec743fa97
-
SHA256
e68ccc24278cb4c79283489e0a58b3afe5f59112fbf82ca7b0cfc06fc2403cf6
-
SHA512
652d370f7c8574333e439bd3fe968bba0278ed5101bea6525200177d4554f90f5b39a64833d30b422f021efa3d3c207f858686963691e7c8e8559afee9e76051
-
SSDEEP
12288:ZU5rCOTeiDFW70olqQKuTcW8fFTG3ZF5rn5rLOa54U5w5A:ZUQOJDF2fqtEcnftG3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4584 26CD.tmp 3028 2824.tmp 3580 28B1.tmp 548 292E.tmp 4156 29BB.tmp 4224 2BBE.tmp 3376 2C89.tmp 228 2D06.tmp 3272 2DE1.tmp 2940 2E5E.tmp 1900 2F29.tmp 1460 2FF4.tmp 3308 3071.tmp 4904 310E.tmp 4332 3256.tmp 1728 3330.tmp 4412 33EC.tmp 1212 3498.tmp 1764 3544.tmp 3456 35E0.tmp 4708 36BB.tmp 4120 3757.tmp 2284 3861.tmp 2992 392C.tmp 4812 39E7.tmp 1636 3A64.tmp 1508 3AE1.tmp 2436 3B9D.tmp 1860 3C29.tmp 1036 3D71.tmp 1088 3E3D.tmp 3504 3EBA.tmp 3576 3FC3.tmp 4380 409E.tmp 5088 411B.tmp 3068 4198.tmp 4784 4234.tmp 4552 42A2.tmp 2260 431F.tmp 5020 43F9.tmp 4584 4476.tmp 4868 4532.tmp 5016 4707.tmp 2348 4784.tmp 4224 4820.tmp 4648 48AC.tmp 4132 4929.tmp 208 49A6.tmp 964 4A33.tmp 4672 4ACF.tmp 1460 4BBA.tmp 1160 4C56.tmp 3176 4D21.tmp 3124 4DEC.tmp 3112 4EB7.tmp 1708 4F54.tmp 1728 4FE0.tmp 1760 50BB.tmp 2108 5167.tmp 4632 5290.tmp 3544 532C.tmp 4708 53B9.tmp 3292 5445.tmp 4384 54E1.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5020 wrote to memory of 4584 5020 2024-05-04_0846a194b39502ddcffdb94ffb15d652_mafia.exe 90 PID 5020 wrote to memory of 4584 5020 2024-05-04_0846a194b39502ddcffdb94ffb15d652_mafia.exe 90 PID 5020 wrote to memory of 4584 5020 2024-05-04_0846a194b39502ddcffdb94ffb15d652_mafia.exe 90 PID 4584 wrote to memory of 3028 4584 26CD.tmp 91 PID 4584 wrote to memory of 3028 4584 26CD.tmp 91 PID 4584 wrote to memory of 3028 4584 26CD.tmp 91 PID 3028 wrote to memory of 3580 3028 2824.tmp 92 PID 3028 wrote to memory of 3580 3028 2824.tmp 92 PID 3028 wrote to memory of 3580 3028 2824.tmp 92 PID 3580 wrote to memory of 548 3580 28B1.tmp 93 PID 3580 wrote to memory of 548 3580 28B1.tmp 93 PID 3580 wrote to memory of 548 3580 28B1.tmp 93 PID 548 wrote to memory of 4156 548 292E.tmp 94 PID 548 wrote to memory of 4156 548 292E.tmp 94 PID 548 wrote to memory of 4156 548 292E.tmp 94 PID 4156 wrote to memory of 4224 4156 29BB.tmp 95 PID 4156 wrote to memory of 4224 4156 29BB.tmp 95 PID 4156 wrote to memory of 4224 4156 29BB.tmp 95 PID 4224 wrote to memory of 3376 4224 2BBE.tmp 96 PID 4224 wrote to memory of 3376 4224 2BBE.tmp 96 PID 4224 wrote to memory of 3376 4224 2BBE.tmp 96 PID 3376 wrote to memory of 228 3376 2C89.tmp 97 PID 3376 wrote to memory of 228 3376 2C89.tmp 97 PID 3376 wrote to memory of 228 3376 2C89.tmp 97 PID 228 wrote to memory of 3272 228 2D06.tmp 98 PID 228 wrote to memory of 3272 228 2D06.tmp 98 PID 228 wrote to memory of 3272 228 2D06.tmp 98 PID 3272 wrote to memory of 2940 3272 2DE1.tmp 99 PID 3272 wrote to memory of 2940 3272 2DE1.tmp 99 PID 3272 wrote to memory of 2940 3272 2DE1.tmp 99 PID 2940 wrote to memory of 1900 2940 2E5E.tmp 100 PID 2940 wrote to memory of 1900 2940 2E5E.tmp 100 PID 2940 wrote to memory of 1900 2940 2E5E.tmp 100 PID 1900 wrote to memory of 1460 1900 2F29.tmp 101 PID 1900 wrote to memory of 1460 1900 2F29.tmp 101 PID 1900 wrote to memory of 1460 1900 2F29.tmp 101 PID 1460 wrote to memory of 3308 1460 2FF4.tmp 102 PID 1460 wrote to memory of 3308 1460 2FF4.tmp 102 PID 1460 wrote to memory of 3308 1460 2FF4.tmp 102 PID 3308 wrote to memory of 4904 3308 3071.tmp 103 PID 3308 wrote to memory of 4904 3308 3071.tmp 103 PID 3308 wrote to memory of 4904 3308 3071.tmp 103 PID 4904 wrote to memory of 4332 4904 310E.tmp 104 PID 4904 wrote to memory of 4332 4904 310E.tmp 104 PID 4904 wrote to memory of 4332 4904 310E.tmp 104 PID 4332 wrote to memory of 1728 4332 3256.tmp 105 PID 4332 wrote to memory of 1728 4332 3256.tmp 105 PID 4332 wrote to memory of 1728 4332 3256.tmp 105 PID 1728 wrote to memory of 4412 1728 3330.tmp 106 PID 1728 wrote to memory of 4412 1728 3330.tmp 106 PID 1728 wrote to memory of 4412 1728 3330.tmp 106 PID 4412 wrote to memory of 1212 4412 33EC.tmp 107 PID 4412 wrote to memory of 1212 4412 33EC.tmp 107 PID 4412 wrote to memory of 1212 4412 33EC.tmp 107 PID 1212 wrote to memory of 1764 1212 3498.tmp 108 PID 1212 wrote to memory of 1764 1212 3498.tmp 108 PID 1212 wrote to memory of 1764 1212 3498.tmp 108 PID 1764 wrote to memory of 3456 1764 3544.tmp 109 PID 1764 wrote to memory of 3456 1764 3544.tmp 109 PID 1764 wrote to memory of 3456 1764 3544.tmp 109 PID 3456 wrote to memory of 4708 3456 35E0.tmp 110 PID 3456 wrote to memory of 4708 3456 35E0.tmp 110 PID 3456 wrote to memory of 4708 3456 35E0.tmp 110 PID 4708 wrote to memory of 4120 4708 36BB.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-04_0846a194b39502ddcffdb94ffb15d652_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-04_0846a194b39502ddcffdb94ffb15d652_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\26CD.tmp"C:\Users\Admin\AppData\Local\Temp\26CD.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\2824.tmp"C:\Users\Admin\AppData\Local\Temp\2824.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\28B1.tmp"C:\Users\Admin\AppData\Local\Temp\28B1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\292E.tmp"C:\Users\Admin\AppData\Local\Temp\292E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\29BB.tmp"C:\Users\Admin\AppData\Local\Temp\29BB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\2BBE.tmp"C:\Users\Admin\AppData\Local\Temp\2BBE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\2C89.tmp"C:\Users\Admin\AppData\Local\Temp\2C89.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\2D06.tmp"C:\Users\Admin\AppData\Local\Temp\2D06.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\2DE1.tmp"C:\Users\Admin\AppData\Local\Temp\2DE1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\2E5E.tmp"C:\Users\Admin\AppData\Local\Temp\2E5E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\2F29.tmp"C:\Users\Admin\AppData\Local\Temp\2F29.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\2FF4.tmp"C:\Users\Admin\AppData\Local\Temp\2FF4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\3071.tmp"C:\Users\Admin\AppData\Local\Temp\3071.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\310E.tmp"C:\Users\Admin\AppData\Local\Temp\310E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\3330.tmp"C:\Users\Admin\AppData\Local\Temp\3330.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\3498.tmp"C:\Users\Admin\AppData\Local\Temp\3498.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\3544.tmp"C:\Users\Admin\AppData\Local\Temp\3544.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\35E0.tmp"C:\Users\Admin\AppData\Local\Temp\35E0.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\36BB.tmp"C:\Users\Admin\AppData\Local\Temp\36BB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\3757.tmp"C:\Users\Admin\AppData\Local\Temp\3757.tmp"23⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\3861.tmp"C:\Users\Admin\AppData\Local\Temp\3861.tmp"24⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\392C.tmp"C:\Users\Admin\AppData\Local\Temp\392C.tmp"25⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\39E7.tmp"C:\Users\Admin\AppData\Local\Temp\39E7.tmp"26⤵
- Executes dropped EXE
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\3A64.tmp"C:\Users\Admin\AppData\Local\Temp\3A64.tmp"27⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\3AE1.tmp"C:\Users\Admin\AppData\Local\Temp\3AE1.tmp"28⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\3B9D.tmp"C:\Users\Admin\AppData\Local\Temp\3B9D.tmp"29⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\3C29.tmp"C:\Users\Admin\AppData\Local\Temp\3C29.tmp"30⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\3D71.tmp"C:\Users\Admin\AppData\Local\Temp\3D71.tmp"31⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\3E3D.tmp"C:\Users\Admin\AppData\Local\Temp\3E3D.tmp"32⤵
- Executes dropped EXE
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\3EBA.tmp"C:\Users\Admin\AppData\Local\Temp\3EBA.tmp"33⤵
- Executes dropped EXE
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\3FC3.tmp"C:\Users\Admin\AppData\Local\Temp\3FC3.tmp"34⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\409E.tmp"C:\Users\Admin\AppData\Local\Temp\409E.tmp"35⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\411B.tmp"C:\Users\Admin\AppData\Local\Temp\411B.tmp"36⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\4198.tmp"C:\Users\Admin\AppData\Local\Temp\4198.tmp"37⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\4234.tmp"C:\Users\Admin\AppData\Local\Temp\4234.tmp"38⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\42A2.tmp"C:\Users\Admin\AppData\Local\Temp\42A2.tmp"39⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\431F.tmp"C:\Users\Admin\AppData\Local\Temp\431F.tmp"40⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\43F9.tmp"C:\Users\Admin\AppData\Local\Temp\43F9.tmp"41⤵
- Executes dropped EXE
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\4476.tmp"C:\Users\Admin\AppData\Local\Temp\4476.tmp"42⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\4532.tmp"C:\Users\Admin\AppData\Local\Temp\4532.tmp"43⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\4707.tmp"C:\Users\Admin\AppData\Local\Temp\4707.tmp"44⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\4784.tmp"C:\Users\Admin\AppData\Local\Temp\4784.tmp"45⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\4820.tmp"C:\Users\Admin\AppData\Local\Temp\4820.tmp"46⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\48AC.tmp"C:\Users\Admin\AppData\Local\Temp\48AC.tmp"47⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\4929.tmp"C:\Users\Admin\AppData\Local\Temp\4929.tmp"48⤵
- Executes dropped EXE
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\49A6.tmp"C:\Users\Admin\AppData\Local\Temp\49A6.tmp"49⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\4A33.tmp"C:\Users\Admin\AppData\Local\Temp\4A33.tmp"50⤵
- Executes dropped EXE
PID:964 -
C:\Users\Admin\AppData\Local\Temp\4ACF.tmp"C:\Users\Admin\AppData\Local\Temp\4ACF.tmp"51⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\4BBA.tmp"C:\Users\Admin\AppData\Local\Temp\4BBA.tmp"52⤵
- Executes dropped EXE
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\4C56.tmp"C:\Users\Admin\AppData\Local\Temp\4C56.tmp"53⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\4D21.tmp"C:\Users\Admin\AppData\Local\Temp\4D21.tmp"54⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\4DEC.tmp"C:\Users\Admin\AppData\Local\Temp\4DEC.tmp"55⤵
- Executes dropped EXE
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\4EB7.tmp"C:\Users\Admin\AppData\Local\Temp\4EB7.tmp"56⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\4F54.tmp"C:\Users\Admin\AppData\Local\Temp\4F54.tmp"57⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\4FE0.tmp"C:\Users\Admin\AppData\Local\Temp\4FE0.tmp"58⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\50BB.tmp"C:\Users\Admin\AppData\Local\Temp\50BB.tmp"59⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\5167.tmp"C:\Users\Admin\AppData\Local\Temp\5167.tmp"60⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\5290.tmp"C:\Users\Admin\AppData\Local\Temp\5290.tmp"61⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\532C.tmp"C:\Users\Admin\AppData\Local\Temp\532C.tmp"62⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\53B9.tmp"C:\Users\Admin\AppData\Local\Temp\53B9.tmp"63⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\5445.tmp"C:\Users\Admin\AppData\Local\Temp\5445.tmp"64⤵
- Executes dropped EXE
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\54E1.tmp"C:\Users\Admin\AppData\Local\Temp\54E1.tmp"65⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\55CC.tmp"C:\Users\Admin\AppData\Local\Temp\55CC.tmp"66⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\5678.tmp"C:\Users\Admin\AppData\Local\Temp\5678.tmp"67⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\5724.tmp"C:\Users\Admin\AppData\Local\Temp\5724.tmp"68⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\57B0.tmp"C:\Users\Admin\AppData\Local\Temp\57B0.tmp"69⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\58BA.tmp"C:\Users\Admin\AppData\Local\Temp\58BA.tmp"70⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\59A4.tmp"C:\Users\Admin\AppData\Local\Temp\59A4.tmp"71⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\5A50.tmp"C:\Users\Admin\AppData\Local\Temp\5A50.tmp"72⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\5B0C.tmp"C:\Users\Admin\AppData\Local\Temp\5B0C.tmp"73⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\5BC7.tmp"C:\Users\Admin\AppData\Local\Temp\5BC7.tmp"74⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\5C83.tmp"C:\Users\Admin\AppData\Local\Temp\5C83.tmp"75⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\5D2E.tmp"C:\Users\Admin\AppData\Local\Temp\5D2E.tmp"76⤵PID:492
-
C:\Users\Admin\AppData\Local\Temp\5E09.tmp"C:\Users\Admin\AppData\Local\Temp\5E09.tmp"77⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"78⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\5F71.tmp"C:\Users\Admin\AppData\Local\Temp\5F71.tmp"79⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\5FEE.tmp"C:\Users\Admin\AppData\Local\Temp\5FEE.tmp"80⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\607A.tmp"C:\Users\Admin\AppData\Local\Temp\607A.tmp"81⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\6116.tmp"C:\Users\Admin\AppData\Local\Temp\6116.tmp"82⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\61B3.tmp"C:\Users\Admin\AppData\Local\Temp\61B3.tmp"83⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\623F.tmp"C:\Users\Admin\AppData\Local\Temp\623F.tmp"84⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\6339.tmp"C:\Users\Admin\AppData\Local\Temp\6339.tmp"85⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\6404.tmp"C:\Users\Admin\AppData\Local\Temp\6404.tmp"86⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\6491.tmp"C:\Users\Admin\AppData\Local\Temp\6491.tmp"87⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\652D.tmp"C:\Users\Admin\AppData\Local\Temp\652D.tmp"88⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\65D9.tmp"C:\Users\Admin\AppData\Local\Temp\65D9.tmp"89⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\6675.tmp"C:\Users\Admin\AppData\Local\Temp\6675.tmp"90⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\6712.tmp"C:\Users\Admin\AppData\Local\Temp\6712.tmp"91⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\679E.tmp"C:\Users\Admin\AppData\Local\Temp\679E.tmp"92⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\6869.tmp"C:\Users\Admin\AppData\Local\Temp\6869.tmp"93⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\68F6.tmp"C:\Users\Admin\AppData\Local\Temp\68F6.tmp"94⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\69A2.tmp"C:\Users\Admin\AppData\Local\Temp\69A2.tmp"95⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\6A3E.tmp"C:\Users\Admin\AppData\Local\Temp\6A3E.tmp"96⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\6ACB.tmp"C:\Users\Admin\AppData\Local\Temp\6ACB.tmp"97⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\6B77.tmp"C:\Users\Admin\AppData\Local\Temp\6B77.tmp"98⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\6C03.tmp"C:\Users\Admin\AppData\Local\Temp\6C03.tmp"99⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\6C71.tmp"C:\Users\Admin\AppData\Local\Temp\6C71.tmp"100⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\6D0D.tmp"C:\Users\Admin\AppData\Local\Temp\6D0D.tmp"101⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\6D8A.tmp"C:\Users\Admin\AppData\Local\Temp\6D8A.tmp"102⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\6E45.tmp"C:\Users\Admin\AppData\Local\Temp\6E45.tmp"103⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\6EB3.tmp"C:\Users\Admin\AppData\Local\Temp\6EB3.tmp"104⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\6F30.tmp"C:\Users\Admin\AppData\Local\Temp\6F30.tmp"105⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\6FAD.tmp"C:\Users\Admin\AppData\Local\Temp\6FAD.tmp"106⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\701A.tmp"C:\Users\Admin\AppData\Local\Temp\701A.tmp"107⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\70A7.tmp"C:\Users\Admin\AppData\Local\Temp\70A7.tmp"108⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\7172.tmp"C:\Users\Admin\AppData\Local\Temp\7172.tmp"109⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\71EF.tmp"C:\Users\Admin\AppData\Local\Temp\71EF.tmp"110⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\729B.tmp"C:\Users\Admin\AppData\Local\Temp\729B.tmp"111⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\7347.tmp"C:\Users\Admin\AppData\Local\Temp\7347.tmp"112⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\73F3.tmp"C:\Users\Admin\AppData\Local\Temp\73F3.tmp"113⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\7470.tmp"C:\Users\Admin\AppData\Local\Temp\7470.tmp"114⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\750C.tmp"C:\Users\Admin\AppData\Local\Temp\750C.tmp"115⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\7589.tmp"C:\Users\Admin\AppData\Local\Temp\7589.tmp"116⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\75F6.tmp"C:\Users\Admin\AppData\Local\Temp\75F6.tmp"117⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\7692.tmp"C:\Users\Admin\AppData\Local\Temp\7692.tmp"118⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\7700.tmp"C:\Users\Admin\AppData\Local\Temp\7700.tmp"119⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\776D.tmp"C:\Users\Admin\AppData\Local\Temp\776D.tmp"120⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\77FA.tmp"C:\Users\Admin\AppData\Local\Temp\77FA.tmp"121⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\7867.tmp"C:\Users\Admin\AppData\Local\Temp\7867.tmp"122⤵PID:548
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-