Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23/05/2024, 18:09
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-23_6784c04096ae70a3ec3caee2c2586690_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-05-23_6784c04096ae70a3ec3caee2c2586690_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-23_6784c04096ae70a3ec3caee2c2586690_mafia.exe
-
Size
520KB
-
MD5
6784c04096ae70a3ec3caee2c2586690
-
SHA1
5cc2c8e6aa2526eda1a768406ebcaec523e67d0f
-
SHA256
eda39c3f34496c2c9cc970c9f6fff0a69f147bc79bc98d1d355191db7b954660
-
SHA512
0fc24f43f6ee7c2bb5fad3420c1a953b00f374080297ea37c28e92162b7c5c8a7e7fddd638d8d0f44fb8714bd1ca186f60b904ad3dfbf2c6c1489ee0c74f459b
-
SSDEEP
6144:lLvd/XzCjUIF1UuXLyQjmOH+JjLyAE8XftXS9eMEBYILMQMoctX8ke20LUsmk7xn:roRXOQjmOyjR62BdzcBv0LPd2K2rYNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5056 6C47.tmp 2552 6CB4.tmp 5112 6D02.tmp 5068 6D50.tmp 1764 6D9E.tmp 4936 6E0C.tmp 2348 6E79.tmp 812 6EC7.tmp 1988 6F15.tmp 2628 6F83.tmp 5092 6FD1.tmp 3776 701F.tmp 748 707D.tmp 464 70CB.tmp 1236 7119.tmp 1952 7186.tmp 868 71D4.tmp 3460 7223.tmp 3736 7271.tmp 4832 72CE.tmp 4952 733C.tmp 4668 73A9.tmp 3544 73F7.tmp 3724 7465.tmp 3368 74B3.tmp 4608 7530.tmp 5044 757E.tmp 3764 75DC.tmp 4900 7649.tmp 516 7697.tmp 5028 7705.tmp 4100 7772.tmp 2428 77D0.tmp 3040 781E.tmp 4756 786C.tmp 4304 78CA.tmp 3700 7947.tmp 3036 79A4.tmp 2304 7A02.tmp 2528 7A60.tmp 2172 7AAE.tmp 4816 7B0C.tmp 876 7B6A.tmp 3676 7BB8.tmp 1316 7C06.tmp 4252 7C54.tmp 812 7CA2.tmp 3432 7CF0.tmp 4768 7D4E.tmp 4964 7DAC.tmp 4600 7E09.tmp 332 7E58.tmp 2700 7EB5.tmp 1092 7F13.tmp 1544 7F71.tmp 2500 7FCF.tmp 4992 802C.tmp 1180 807A.tmp 4672 80D8.tmp 536 8126.tmp 1792 8184.tmp 5100 81E2.tmp 1280 8240.tmp 1896 828E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4488 wrote to memory of 5056 4488 2024-05-23_6784c04096ae70a3ec3caee2c2586690_mafia.exe 86 PID 4488 wrote to memory of 5056 4488 2024-05-23_6784c04096ae70a3ec3caee2c2586690_mafia.exe 86 PID 4488 wrote to memory of 5056 4488 2024-05-23_6784c04096ae70a3ec3caee2c2586690_mafia.exe 86 PID 5056 wrote to memory of 2552 5056 6C47.tmp 87 PID 5056 wrote to memory of 2552 5056 6C47.tmp 87 PID 5056 wrote to memory of 2552 5056 6C47.tmp 87 PID 2552 wrote to memory of 5112 2552 6CB4.tmp 88 PID 2552 wrote to memory of 5112 2552 6CB4.tmp 88 PID 2552 wrote to memory of 5112 2552 6CB4.tmp 88 PID 5112 wrote to memory of 5068 5112 6D02.tmp 89 PID 5112 wrote to memory of 5068 5112 6D02.tmp 89 PID 5112 wrote to memory of 5068 5112 6D02.tmp 89 PID 5068 wrote to memory of 1764 5068 6D50.tmp 91 PID 5068 wrote to memory of 1764 5068 6D50.tmp 91 PID 5068 wrote to memory of 1764 5068 6D50.tmp 91 PID 1764 wrote to memory of 4936 1764 6D9E.tmp 93 PID 1764 wrote to memory of 4936 1764 6D9E.tmp 93 PID 1764 wrote to memory of 4936 1764 6D9E.tmp 93 PID 4936 wrote to memory of 2348 4936 6E0C.tmp 94 PID 4936 wrote to memory of 2348 4936 6E0C.tmp 94 PID 4936 wrote to memory of 2348 4936 6E0C.tmp 94 PID 2348 wrote to memory of 812 2348 6E79.tmp 95 PID 2348 wrote to memory of 812 2348 6E79.tmp 95 PID 2348 wrote to memory of 812 2348 6E79.tmp 95 PID 812 wrote to memory of 1988 812 6EC7.tmp 97 PID 812 wrote to memory of 1988 812 6EC7.tmp 97 PID 812 wrote to memory of 1988 812 6EC7.tmp 97 PID 1988 wrote to memory of 2628 1988 6F15.tmp 98 PID 1988 wrote to memory of 2628 1988 6F15.tmp 98 PID 1988 wrote to memory of 2628 1988 6F15.tmp 98 PID 2628 wrote to memory of 5092 2628 6F83.tmp 99 PID 2628 wrote to memory of 5092 2628 6F83.tmp 99 PID 2628 wrote to memory of 5092 2628 6F83.tmp 99 PID 5092 wrote to memory of 3776 5092 6FD1.tmp 100 PID 5092 wrote to memory of 3776 5092 6FD1.tmp 100 PID 5092 wrote to memory of 3776 5092 6FD1.tmp 100 PID 3776 wrote to memory of 748 3776 701F.tmp 101 PID 3776 wrote to memory of 748 3776 701F.tmp 101 PID 3776 wrote to memory of 748 3776 701F.tmp 101 PID 748 wrote to memory of 464 748 707D.tmp 102 PID 748 wrote to memory of 464 748 707D.tmp 102 PID 748 wrote to memory of 464 748 707D.tmp 102 PID 464 wrote to memory of 1236 464 70CB.tmp 103 PID 464 wrote to memory of 1236 464 70CB.tmp 103 PID 464 wrote to memory of 1236 464 70CB.tmp 103 PID 1236 wrote to memory of 1952 1236 7119.tmp 104 PID 1236 wrote to memory of 1952 1236 7119.tmp 104 PID 1236 wrote to memory of 1952 1236 7119.tmp 104 PID 1952 wrote to memory of 868 1952 7186.tmp 105 PID 1952 wrote to memory of 868 1952 7186.tmp 105 PID 1952 wrote to memory of 868 1952 7186.tmp 105 PID 868 wrote to memory of 3460 868 71D4.tmp 106 PID 868 wrote to memory of 3460 868 71D4.tmp 106 PID 868 wrote to memory of 3460 868 71D4.tmp 106 PID 3460 wrote to memory of 3736 3460 7223.tmp 107 PID 3460 wrote to memory of 3736 3460 7223.tmp 107 PID 3460 wrote to memory of 3736 3460 7223.tmp 107 PID 3736 wrote to memory of 4832 3736 7271.tmp 108 PID 3736 wrote to memory of 4832 3736 7271.tmp 108 PID 3736 wrote to memory of 4832 3736 7271.tmp 108 PID 4832 wrote to memory of 4952 4832 72CE.tmp 109 PID 4832 wrote to memory of 4952 4832 72CE.tmp 109 PID 4832 wrote to memory of 4952 4832 72CE.tmp 109 PID 4952 wrote to memory of 4668 4952 733C.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_6784c04096ae70a3ec3caee2c2586690_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_6784c04096ae70a3ec3caee2c2586690_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"23⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\73F7.tmp"C:\Users\Admin\AppData\Local\Temp\73F7.tmp"24⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"25⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"26⤵
- Executes dropped EXE
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"27⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"28⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"29⤵
- Executes dropped EXE
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"30⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"31⤵
- Executes dropped EXE
PID:516 -
C:\Users\Admin\AppData\Local\Temp\7705.tmp"C:\Users\Admin\AppData\Local\Temp\7705.tmp"32⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\7772.tmp"C:\Users\Admin\AppData\Local\Temp\7772.tmp"33⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"34⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"35⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\786C.tmp"C:\Users\Admin\AppData\Local\Temp\786C.tmp"36⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"37⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"38⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\79A4.tmp"C:\Users\Admin\AppData\Local\Temp\79A4.tmp"39⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\7A02.tmp"C:\Users\Admin\AppData\Local\Temp\7A02.tmp"40⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\7A60.tmp"C:\Users\Admin\AppData\Local\Temp\7A60.tmp"41⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"42⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"43⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"44⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"45⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\7C06.tmp"C:\Users\Admin\AppData\Local\Temp\7C06.tmp"46⤵
- Executes dropped EXE
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\7C54.tmp"C:\Users\Admin\AppData\Local\Temp\7C54.tmp"47⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"48⤵
- Executes dropped EXE
PID:812 -
C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"49⤵
- Executes dropped EXE
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"50⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"51⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\7E09.tmp"C:\Users\Admin\AppData\Local\Temp\7E09.tmp"52⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"53⤵
- Executes dropped EXE
PID:332 -
C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"54⤵
- Executes dropped EXE
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\7F13.tmp"C:\Users\Admin\AppData\Local\Temp\7F13.tmp"55⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\7F71.tmp"C:\Users\Admin\AppData\Local\Temp\7F71.tmp"56⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"57⤵
- Executes dropped EXE
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\802C.tmp"C:\Users\Admin\AppData\Local\Temp\802C.tmp"58⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\807A.tmp"C:\Users\Admin\AppData\Local\Temp\807A.tmp"59⤵
- Executes dropped EXE
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\80D8.tmp"C:\Users\Admin\AppData\Local\Temp\80D8.tmp"60⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\8126.tmp"C:\Users\Admin\AppData\Local\Temp\8126.tmp"61⤵
- Executes dropped EXE
PID:536 -
C:\Users\Admin\AppData\Local\Temp\8184.tmp"C:\Users\Admin\AppData\Local\Temp\8184.tmp"62⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\81E2.tmp"C:\Users\Admin\AppData\Local\Temp\81E2.tmp"63⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\8240.tmp"C:\Users\Admin\AppData\Local\Temp\8240.tmp"64⤵
- Executes dropped EXE
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\828E.tmp"C:\Users\Admin\AppData\Local\Temp\828E.tmp"65⤵
- Executes dropped EXE
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\82EB.tmp"C:\Users\Admin\AppData\Local\Temp\82EB.tmp"66⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\833A.tmp"C:\Users\Admin\AppData\Local\Temp\833A.tmp"67⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"68⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\83E5.tmp"C:\Users\Admin\AppData\Local\Temp\83E5.tmp"69⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"70⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\8491.tmp"C:\Users\Admin\AppData\Local\Temp\8491.tmp"71⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\84EF.tmp"C:\Users\Admin\AppData\Local\Temp\84EF.tmp"72⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\854D.tmp"C:\Users\Admin\AppData\Local\Temp\854D.tmp"73⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\85AB.tmp"C:\Users\Admin\AppData\Local\Temp\85AB.tmp"74⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\85F9.tmp"C:\Users\Admin\AppData\Local\Temp\85F9.tmp"75⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"76⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"77⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\8712.tmp"C:\Users\Admin\AppData\Local\Temp\8712.tmp"78⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\8770.tmp"C:\Users\Admin\AppData\Local\Temp\8770.tmp"79⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\87CD.tmp"C:\Users\Admin\AppData\Local\Temp\87CD.tmp"80⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\881C.tmp"C:\Users\Admin\AppData\Local\Temp\881C.tmp"81⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\8879.tmp"C:\Users\Admin\AppData\Local\Temp\8879.tmp"82⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\88C7.tmp"C:\Users\Admin\AppData\Local\Temp\88C7.tmp"83⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\8916.tmp"C:\Users\Admin\AppData\Local\Temp\8916.tmp"84⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\8973.tmp"C:\Users\Admin\AppData\Local\Temp\8973.tmp"85⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\89D1.tmp"C:\Users\Admin\AppData\Local\Temp\89D1.tmp"86⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"87⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"88⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"89⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\8B38.tmp"C:\Users\Admin\AppData\Local\Temp\8B38.tmp"90⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\8B96.tmp"C:\Users\Admin\AppData\Local\Temp\8B96.tmp"91⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"92⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"93⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"94⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"95⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"96⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"97⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\8E17.tmp"C:\Users\Admin\AppData\Local\Temp\8E17.tmp"98⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\8E75.tmp"C:\Users\Admin\AppData\Local\Temp\8E75.tmp"99⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"100⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\8F30.tmp"C:\Users\Admin\AppData\Local\Temp\8F30.tmp"101⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"102⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"103⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\903A.tmp"C:\Users\Admin\AppData\Local\Temp\903A.tmp"104⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\9097.tmp"C:\Users\Admin\AppData\Local\Temp\9097.tmp"105⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"106⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\9153.tmp"C:\Users\Admin\AppData\Local\Temp\9153.tmp"107⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\91B1.tmp"C:\Users\Admin\AppData\Local\Temp\91B1.tmp"108⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"109⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\926C.tmp"C:\Users\Admin\AppData\Local\Temp\926C.tmp"110⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"111⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"112⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\9366.tmp"C:\Users\Admin\AppData\Local\Temp\9366.tmp"113⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\93B4.tmp"C:\Users\Admin\AppData\Local\Temp\93B4.tmp"114⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\9412.tmp"C:\Users\Admin\AppData\Local\Temp\9412.tmp"115⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\9460.tmp"C:\Users\Admin\AppData\Local\Temp\9460.tmp"116⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\94AE.tmp"C:\Users\Admin\AppData\Local\Temp\94AE.tmp"117⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\94FC.tmp"C:\Users\Admin\AppData\Local\Temp\94FC.tmp"118⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"119⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"120⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\9606.tmp"C:\Users\Admin\AppData\Local\Temp\9606.tmp"121⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\9654.tmp"C:\Users\Admin\AppData\Local\Temp\9654.tmp"122⤵PID:3620
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-