Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
29/06/2024, 13:23
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-29_1929f458d278743897f71997ff969854_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-29_1929f458d278743897f71997ff969854_mafia.exe
Resource
win10v2004-20240611-en
General
-
Target
2024-06-29_1929f458d278743897f71997ff969854_mafia.exe
-
Size
487KB
-
MD5
1929f458d278743897f71997ff969854
-
SHA1
e4bc86b507d8352d47e6c10664b555b27b6f3f74
-
SHA256
6170fcb93a109f6788e4ecbbd9aef719679289353ba4d25bcddca0b8e17430e1
-
SHA512
239c7fec6b397043133049818080acad4e663b32d1f7821cffe9079bf83925c9ad3f83ef0e994c85c46ecfad3044d751062ee490a3d618dc80543f54fc8a67a4
-
SSDEEP
12288:yU5rCOTeiNoDOrZ+Hl6Eb/CDYAK4kScpKQbZ:yUQOJNoDOdNYAK4kScp1b
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1436 5C58.tmp 4564 5CF5.tmp 4604 5DB0.tmp 3864 5E4C.tmp 1836 5EBA.tmp 5104 5F46.tmp 3136 5FE3.tmp 4608 607F.tmp 2276 60EC.tmp 4956 6189.tmp 4908 6215.tmp 3100 6283.tmp 700 62F0.tmp 504 636D.tmp 4452 63EA.tmp 3020 6467.tmp 3180 64E4.tmp 4388 6561.tmp 4920 65BF.tmp 2928 663C.tmp 4580 66A9.tmp 2316 6736.tmp 536 67C2.tmp 4992 686E.tmp 3048 690A.tmp 3392 6987.tmp 4384 6A04.tmp 1496 6C18.tmp 4528 6C85.tmp 4768 6CF2.tmp 2712 6D7F.tmp 4532 6E0C.tmp 4308 6EC7.tmp 2356 6F35.tmp 4272 6F92.tmp 4192 6FF0.tmp 2844 704E.tmp 1792 70AC.tmp 2784 7109.tmp 3940 7157.tmp 2328 71A6.tmp 1488 71F4.tmp 3016 7280.tmp 4916 72EE.tmp 1596 735B.tmp 388 73C8.tmp 2444 7426.tmp 4588 7484.tmp 2272 74F1.tmp 1508 756E.tmp 1328 75CC.tmp 3956 7639.tmp 2032 7697.tmp 4908 7705.tmp 852 7762.tmp 224 77D0.tmp 3860 783D.tmp 4452 78AA.tmp 3020 7908.tmp 1728 7956.tmp 3960 79B4.tmp 4388 7A21.tmp 4776 7A7F.tmp 2928 7AED.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 676 wrote to memory of 1436 676 2024-06-29_1929f458d278743897f71997ff969854_mafia.exe 83 PID 676 wrote to memory of 1436 676 2024-06-29_1929f458d278743897f71997ff969854_mafia.exe 83 PID 676 wrote to memory of 1436 676 2024-06-29_1929f458d278743897f71997ff969854_mafia.exe 83 PID 1436 wrote to memory of 4564 1436 5C58.tmp 84 PID 1436 wrote to memory of 4564 1436 5C58.tmp 84 PID 1436 wrote to memory of 4564 1436 5C58.tmp 84 PID 4564 wrote to memory of 4604 4564 5CF5.tmp 85 PID 4564 wrote to memory of 4604 4564 5CF5.tmp 85 PID 4564 wrote to memory of 4604 4564 5CF5.tmp 85 PID 4604 wrote to memory of 3864 4604 5DB0.tmp 86 PID 4604 wrote to memory of 3864 4604 5DB0.tmp 86 PID 4604 wrote to memory of 3864 4604 5DB0.tmp 86 PID 3864 wrote to memory of 1836 3864 5E4C.tmp 87 PID 3864 wrote to memory of 1836 3864 5E4C.tmp 87 PID 3864 wrote to memory of 1836 3864 5E4C.tmp 87 PID 1836 wrote to memory of 5104 1836 5EBA.tmp 89 PID 1836 wrote to memory of 5104 1836 5EBA.tmp 89 PID 1836 wrote to memory of 5104 1836 5EBA.tmp 89 PID 5104 wrote to memory of 3136 5104 5F46.tmp 91 PID 5104 wrote to memory of 3136 5104 5F46.tmp 91 PID 5104 wrote to memory of 3136 5104 5F46.tmp 91 PID 3136 wrote to memory of 4608 3136 5FE3.tmp 92 PID 3136 wrote to memory of 4608 3136 5FE3.tmp 92 PID 3136 wrote to memory of 4608 3136 5FE3.tmp 92 PID 4608 wrote to memory of 2276 4608 607F.tmp 93 PID 4608 wrote to memory of 2276 4608 607F.tmp 93 PID 4608 wrote to memory of 2276 4608 607F.tmp 93 PID 2276 wrote to memory of 4956 2276 60EC.tmp 95 PID 2276 wrote to memory of 4956 2276 60EC.tmp 95 PID 2276 wrote to memory of 4956 2276 60EC.tmp 95 PID 4956 wrote to memory of 4908 4956 6189.tmp 96 PID 4956 wrote to memory of 4908 4956 6189.tmp 96 PID 4956 wrote to memory of 4908 4956 6189.tmp 96 PID 4908 wrote to memory of 3100 4908 6215.tmp 97 PID 4908 wrote to memory of 3100 4908 6215.tmp 97 PID 4908 wrote to memory of 3100 4908 6215.tmp 97 PID 3100 wrote to memory of 700 3100 6283.tmp 98 PID 3100 wrote to memory of 700 3100 6283.tmp 98 PID 3100 wrote to memory of 700 3100 6283.tmp 98 PID 700 wrote to memory of 504 700 62F0.tmp 99 PID 700 wrote to memory of 504 700 62F0.tmp 99 PID 700 wrote to memory of 504 700 62F0.tmp 99 PID 504 wrote to memory of 4452 504 636D.tmp 100 PID 504 wrote to memory of 4452 504 636D.tmp 100 PID 504 wrote to memory of 4452 504 636D.tmp 100 PID 4452 wrote to memory of 3020 4452 63EA.tmp 101 PID 4452 wrote to memory of 3020 4452 63EA.tmp 101 PID 4452 wrote to memory of 3020 4452 63EA.tmp 101 PID 3020 wrote to memory of 3180 3020 6467.tmp 102 PID 3020 wrote to memory of 3180 3020 6467.tmp 102 PID 3020 wrote to memory of 3180 3020 6467.tmp 102 PID 3180 wrote to memory of 4388 3180 64E4.tmp 103 PID 3180 wrote to memory of 4388 3180 64E4.tmp 103 PID 3180 wrote to memory of 4388 3180 64E4.tmp 103 PID 4388 wrote to memory of 4920 4388 6561.tmp 104 PID 4388 wrote to memory of 4920 4388 6561.tmp 104 PID 4388 wrote to memory of 4920 4388 6561.tmp 104 PID 4920 wrote to memory of 2928 4920 65BF.tmp 105 PID 4920 wrote to memory of 2928 4920 65BF.tmp 105 PID 4920 wrote to memory of 2928 4920 65BF.tmp 105 PID 2928 wrote to memory of 4580 2928 663C.tmp 106 PID 2928 wrote to memory of 4580 2928 663C.tmp 106 PID 2928 wrote to memory of 4580 2928 663C.tmp 106 PID 4580 wrote to memory of 2316 4580 66A9.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-29_1929f458d278743897f71997ff969854_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-29_1929f458d278743897f71997ff969854_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:504 -
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"23⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"24⤵
- Executes dropped EXE
PID:536 -
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"25⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"26⤵
- Executes dropped EXE
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"27⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"28⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"29⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"30⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"31⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"32⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"33⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"34⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"35⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"36⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"37⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"38⤵
- Executes dropped EXE
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"39⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"40⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\7157.tmp"C:\Users\Admin\AppData\Local\Temp\7157.tmp"41⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"42⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"43⤵
- Executes dropped EXE
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"44⤵
- Executes dropped EXE
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\72EE.tmp"C:\Users\Admin\AppData\Local\Temp\72EE.tmp"45⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"46⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"47⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"48⤵
- Executes dropped EXE
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"49⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\74F1.tmp"C:\Users\Admin\AppData\Local\Temp\74F1.tmp"50⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"51⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"52⤵
- Executes dropped EXE
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"53⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"54⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\7705.tmp"C:\Users\Admin\AppData\Local\Temp\7705.tmp"55⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\7762.tmp"C:\Users\Admin\AppData\Local\Temp\7762.tmp"56⤵
- Executes dropped EXE
PID:852 -
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"57⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\783D.tmp"C:\Users\Admin\AppData\Local\Temp\783D.tmp"58⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"59⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\7908.tmp"C:\Users\Admin\AppData\Local\Temp\7908.tmp"60⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\7956.tmp"C:\Users\Admin\AppData\Local\Temp\7956.tmp"61⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\79B4.tmp"C:\Users\Admin\AppData\Local\Temp\79B4.tmp"62⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\7A21.tmp"C:\Users\Admin\AppData\Local\Temp\7A21.tmp"63⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"64⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\7AED.tmp"C:\Users\Admin\AppData\Local\Temp\7AED.tmp"65⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"66⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"67⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\7C35.tmp"C:\Users\Admin\AppData\Local\Temp\7C35.tmp"68⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"69⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"70⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"71⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"72⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"73⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"74⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\7F32.tmp"C:\Users\Admin\AppData\Local\Temp\7F32.tmp"75⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"76⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\802C.tmp"C:\Users\Admin\AppData\Local\Temp\802C.tmp"77⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\8107.tmp"C:\Users\Admin\AppData\Local\Temp\8107.tmp"78⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\8174.tmp"C:\Users\Admin\AppData\Local\Temp\8174.tmp"79⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\81D2.tmp"C:\Users\Admin\AppData\Local\Temp\81D2.tmp"80⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\8240.tmp"C:\Users\Admin\AppData\Local\Temp\8240.tmp"81⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\828E.tmp"C:\Users\Admin\AppData\Local\Temp\828E.tmp"82⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\82FB.tmp"C:\Users\Admin\AppData\Local\Temp\82FB.tmp"83⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\8349.tmp"C:\Users\Admin\AppData\Local\Temp\8349.tmp"84⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\83A7.tmp"C:\Users\Admin\AppData\Local\Temp\83A7.tmp"85⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\8405.tmp"C:\Users\Admin\AppData\Local\Temp\8405.tmp"86⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\8462.tmp"C:\Users\Admin\AppData\Local\Temp\8462.tmp"87⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\84B1.tmp"C:\Users\Admin\AppData\Local\Temp\84B1.tmp"88⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\84FF.tmp"C:\Users\Admin\AppData\Local\Temp\84FF.tmp"89⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\855C.tmp"C:\Users\Admin\AppData\Local\Temp\855C.tmp"90⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\85CA.tmp"C:\Users\Admin\AppData\Local\Temp\85CA.tmp"91⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\8637.tmp"C:\Users\Admin\AppData\Local\Temp\8637.tmp"92⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\8695.tmp"C:\Users\Admin\AppData\Local\Temp\8695.tmp"93⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\86F3.tmp"C:\Users\Admin\AppData\Local\Temp\86F3.tmp"94⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\8770.tmp"C:\Users\Admin\AppData\Local\Temp\8770.tmp"95⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\87DD.tmp"C:\Users\Admin\AppData\Local\Temp\87DD.tmp"96⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"97⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\88A8.tmp"C:\Users\Admin\AppData\Local\Temp\88A8.tmp"98⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\8916.tmp"C:\Users\Admin\AppData\Local\Temp\8916.tmp"99⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\8973.tmp"C:\Users\Admin\AppData\Local\Temp\8973.tmp"100⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\89E1.tmp"C:\Users\Admin\AppData\Local\Temp\89E1.tmp"101⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"102⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"103⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"104⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\8B58.tmp"C:\Users\Admin\AppData\Local\Temp\8B58.tmp"105⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"106⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\8C13.tmp"C:\Users\Admin\AppData\Local\Temp\8C13.tmp"107⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\8C61.tmp"C:\Users\Admin\AppData\Local\Temp\8C61.tmp"108⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"109⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"110⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"111⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"112⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp"113⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\8E84.tmp"C:\Users\Admin\AppData\Local\Temp\8E84.tmp"114⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"115⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\8F20.tmp"C:\Users\Admin\AppData\Local\Temp\8F20.tmp"116⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"117⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"118⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\902A.tmp"C:\Users\Admin\AppData\Local\Temp\902A.tmp"119⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"120⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\90E6.tmp"C:\Users\Admin\AppData\Local\Temp\90E6.tmp"121⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\9134.tmp"C:\Users\Admin\AppData\Local\Temp\9134.tmp"122⤵PID:3548
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-