Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
03/07/2024, 13:58
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-03_eebd0ae70f0d31655be5e54052cf06ef_mafia.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2024-07-03_eebd0ae70f0d31655be5e54052cf06ef_mafia.exe
Resource
win10v2004-20240611-en
General
-
Target
2024-07-03_eebd0ae70f0d31655be5e54052cf06ef_mafia.exe
-
Size
487KB
-
MD5
eebd0ae70f0d31655be5e54052cf06ef
-
SHA1
39220b7ff7e208e171aee11e02b6bf3783cbcbd4
-
SHA256
370453df8796062814aa5e6a0858f89f2cd0ab00f431fff1c0753039f3dfed34
-
SHA512
4d76bb7f522f90c08209bff7c4ea48f117b5455f62ca291556d7c6d3d2559922e61175d8902474d4efa06bbc35daa17f2db47e0d111dbde7c831d05a5d4e2a76
-
SSDEEP
12288:yU5rCOTeiNtoSUbU0o5CsXWiugdMOj7qtsbZ:yUQOJNqL2wiugl7bb
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1512 413F.tmp 1908 41AC.tmp 1836 4229.tmp 2128 4297.tmp 4240 42F4.tmp 2928 4371.tmp 4108 43DF.tmp 2460 444C.tmp 1420 44BA.tmp 2448 4508.tmp 1244 4565.tmp 696 45D3.tmp 636 4650.tmp 2232 46CD.tmp 1072 473A.tmp 2292 4788.tmp 1896 47D6.tmp 652 4825.tmp 2656 4892.tmp 396 48F0.tmp 2936 495D.tmp 4288 49CA.tmp 4948 4A19.tmp 4252 4A67.tmp 3004 4AB5.tmp 4628 4B22.tmp 3724 4B80.tmp 916 4BCE.tmp 1544 4C2C.tmp 628 4C99.tmp 2836 4D07.tmp 3608 4D64.tmp 1144 4DE1.tmp 4328 4E3F.tmp 1316 4E8D.tmp 4652 4EEB.tmp 1676 4F39.tmp 1512 4FD5.tmp 5104 5033.tmp 1004 5091.tmp 1300 50EF.tmp 1656 514C.tmp 4128 519A.tmp 4080 51F8.tmp 4428 5256.tmp 4940 52B4.tmp 2636 5302.tmp 1240 536F.tmp 2672 53CD.tmp 2652 543A.tmp 1160 5498.tmp 1420 54F6.tmp 1904 5554.tmp 4672 55B1.tmp 2796 560F.tmp 4840 566D.tmp 1920 56CB.tmp 3488 5728.tmp 2232 5786.tmp 4528 57E4.tmp 2784 5842.tmp 220 589F.tmp 1896 58FD.tmp 4520 596A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1676 wrote to memory of 1512 1676 2024-07-03_eebd0ae70f0d31655be5e54052cf06ef_mafia.exe 83 PID 1676 wrote to memory of 1512 1676 2024-07-03_eebd0ae70f0d31655be5e54052cf06ef_mafia.exe 83 PID 1676 wrote to memory of 1512 1676 2024-07-03_eebd0ae70f0d31655be5e54052cf06ef_mafia.exe 83 PID 1512 wrote to memory of 1908 1512 413F.tmp 84 PID 1512 wrote to memory of 1908 1512 413F.tmp 84 PID 1512 wrote to memory of 1908 1512 413F.tmp 84 PID 1908 wrote to memory of 1836 1908 41AC.tmp 85 PID 1908 wrote to memory of 1836 1908 41AC.tmp 85 PID 1908 wrote to memory of 1836 1908 41AC.tmp 85 PID 1836 wrote to memory of 2128 1836 4229.tmp 87 PID 1836 wrote to memory of 2128 1836 4229.tmp 87 PID 1836 wrote to memory of 2128 1836 4229.tmp 87 PID 2128 wrote to memory of 4240 2128 4297.tmp 88 PID 2128 wrote to memory of 4240 2128 4297.tmp 88 PID 2128 wrote to memory of 4240 2128 4297.tmp 88 PID 4240 wrote to memory of 2928 4240 42F4.tmp 90 PID 4240 wrote to memory of 2928 4240 42F4.tmp 90 PID 4240 wrote to memory of 2928 4240 42F4.tmp 90 PID 2928 wrote to memory of 4108 2928 4371.tmp 92 PID 2928 wrote to memory of 4108 2928 4371.tmp 92 PID 2928 wrote to memory of 4108 2928 4371.tmp 92 PID 4108 wrote to memory of 2460 4108 43DF.tmp 93 PID 4108 wrote to memory of 2460 4108 43DF.tmp 93 PID 4108 wrote to memory of 2460 4108 43DF.tmp 93 PID 2460 wrote to memory of 1420 2460 444C.tmp 94 PID 2460 wrote to memory of 1420 2460 444C.tmp 94 PID 2460 wrote to memory of 1420 2460 444C.tmp 94 PID 1420 wrote to memory of 2448 1420 44BA.tmp 95 PID 1420 wrote to memory of 2448 1420 44BA.tmp 95 PID 1420 wrote to memory of 2448 1420 44BA.tmp 95 PID 2448 wrote to memory of 1244 2448 4508.tmp 96 PID 2448 wrote to memory of 1244 2448 4508.tmp 96 PID 2448 wrote to memory of 1244 2448 4508.tmp 96 PID 1244 wrote to memory of 696 1244 4565.tmp 97 PID 1244 wrote to memory of 696 1244 4565.tmp 97 PID 1244 wrote to memory of 696 1244 4565.tmp 97 PID 696 wrote to memory of 636 696 45D3.tmp 98 PID 696 wrote to memory of 636 696 45D3.tmp 98 PID 696 wrote to memory of 636 696 45D3.tmp 98 PID 636 wrote to memory of 2232 636 4650.tmp 99 PID 636 wrote to memory of 2232 636 4650.tmp 99 PID 636 wrote to memory of 2232 636 4650.tmp 99 PID 2232 wrote to memory of 1072 2232 46CD.tmp 100 PID 2232 wrote to memory of 1072 2232 46CD.tmp 100 PID 2232 wrote to memory of 1072 2232 46CD.tmp 100 PID 1072 wrote to memory of 2292 1072 473A.tmp 101 PID 1072 wrote to memory of 2292 1072 473A.tmp 101 PID 1072 wrote to memory of 2292 1072 473A.tmp 101 PID 2292 wrote to memory of 1896 2292 4788.tmp 102 PID 2292 wrote to memory of 1896 2292 4788.tmp 102 PID 2292 wrote to memory of 1896 2292 4788.tmp 102 PID 1896 wrote to memory of 652 1896 47D6.tmp 103 PID 1896 wrote to memory of 652 1896 47D6.tmp 103 PID 1896 wrote to memory of 652 1896 47D6.tmp 103 PID 652 wrote to memory of 2656 652 4825.tmp 104 PID 652 wrote to memory of 2656 652 4825.tmp 104 PID 652 wrote to memory of 2656 652 4825.tmp 104 PID 2656 wrote to memory of 396 2656 4892.tmp 105 PID 2656 wrote to memory of 396 2656 4892.tmp 105 PID 2656 wrote to memory of 396 2656 4892.tmp 105 PID 396 wrote to memory of 2936 396 48F0.tmp 106 PID 396 wrote to memory of 2936 396 48F0.tmp 106 PID 396 wrote to memory of 2936 396 48F0.tmp 106 PID 2936 wrote to memory of 4288 2936 495D.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-03_eebd0ae70f0d31655be5e54052cf06ef_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-03_eebd0ae70f0d31655be5e54052cf06ef_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\413F.tmp"C:\Users\Admin\AppData\Local\Temp\413F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\41AC.tmp"C:\Users\Admin\AppData\Local\Temp\41AC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\4229.tmp"C:\Users\Admin\AppData\Local\Temp\4229.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\42F4.tmp"C:\Users\Admin\AppData\Local\Temp\42F4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\4371.tmp"C:\Users\Admin\AppData\Local\Temp\4371.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\4565.tmp"C:\Users\Admin\AppData\Local\Temp\4565.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\45D3.tmp"C:\Users\Admin\AppData\Local\Temp\45D3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"23⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\4A19.tmp"C:\Users\Admin\AppData\Local\Temp\4A19.tmp"24⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"25⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"26⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"27⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"28⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"29⤵
- Executes dropped EXE
PID:916 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"30⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"31⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"32⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"33⤵
- Executes dropped EXE
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"34⤵
- Executes dropped EXE
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"35⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"36⤵
- Executes dropped EXE
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"37⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"38⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"39⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"40⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"41⤵
- Executes dropped EXE
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"42⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"43⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"44⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"45⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"46⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"47⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"48⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"49⤵
- Executes dropped EXE
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"50⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"51⤵
- Executes dropped EXE
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"52⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"53⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"54⤵
- Executes dropped EXE
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"55⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"56⤵
- Executes dropped EXE
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"57⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"58⤵
- Executes dropped EXE
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"59⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"60⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"61⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"62⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"63⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"64⤵
- Executes dropped EXE
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"65⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"66⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"67⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"68⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"69⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"70⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"71⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"72⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"73⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"74⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"75⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"76⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"77⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"78⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"79⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"80⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"81⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"82⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"83⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"84⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"85⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"86⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"87⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"88⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"89⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"90⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"91⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"92⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"93⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"94⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"95⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"96⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"97⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"98⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"99⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"100⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"101⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"102⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"103⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"104⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"105⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"106⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"107⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"108⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"109⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"110⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"111⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"112⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"113⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"114⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"115⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"116⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"117⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"118⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"119⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"120⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"121⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"122⤵PID:948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-