Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
30/04/2024, 17:31
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-30_e5e01e8c1bb6914bfa8eb2539461a3c5_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-04-30_e5e01e8c1bb6914bfa8eb2539461a3c5_mafia.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-04-30_e5e01e8c1bb6914bfa8eb2539461a3c5_mafia.exe
-
Size
529KB
-
MD5
e5e01e8c1bb6914bfa8eb2539461a3c5
-
SHA1
3816bfd9a9bc13a847be417733efe6695df2be62
-
SHA256
94078dfa2384f0e0633e94659849e9911486418f2c1ce23cf74059c2eb12f213
-
SHA512
0c6fbd21197e9ff517ec79856955d94d60d69d9715fbec2df1cee4173b94518aab5ee84bd66d14ccde60513ad828eb3eba9667ae88ecc226efd7ef3922eb0294
-
SSDEEP
12288:NU5rCOTeijhG4Jvfv7eUJsehKFCwOaIoETZwlH4Hp:NUQOJjE8nvnJsgKFOacTSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3076 4035.tmp 3848 40E1.tmp 1496 416E.tmp 2888 41DB.tmp 1360 4268.tmp 4992 42F4.tmp 712 4371.tmp 2500 43CF.tmp 2416 442D.tmp 5084 44AA.tmp 1184 4527.tmp 4376 4594.tmp 636 45E2.tmp 4252 47B7.tmp 4700 4805.tmp 4600 4853.tmp 4224 48B1.tmp 732 492E.tmp 2836 49AB.tmp 4764 4A28.tmp 4260 4A96.tmp 3176 4AF3.tmp 2420 4B41.tmp 4532 4B90.tmp 4616 4BED.tmp 5048 4C5B.tmp 1444 4CD8.tmp 3976 4D45.tmp 4824 4DC2.tmp 4736 4E2F.tmp 3996 4E9D.tmp 2668 4EFB.tmp 3940 4F58.tmp 1052 4FB6.tmp 2596 5004.tmp 2308 5052.tmp 3388 50A0.tmp 3844 50FE.tmp 1740 514C.tmp 2060 519A.tmp 3036 51E9.tmp 4284 5237.tmp 4584 5285.tmp 868 52E3.tmp 3192 5331.tmp 2568 537F.tmp 3848 53DD.tmp 4436 542B.tmp 4504 5479.tmp 5040 54C7.tmp 4120 5515.tmp 908 5573.tmp 2016 55C1.tmp 2880 561F.tmp 2220 567C.tmp 2204 56CB.tmp 3572 5719.tmp 3092 5776.tmp 2020 57C5.tmp 1216 5813.tmp 4860 5870.tmp 5024 58CE.tmp 5052 591C.tmp 3084 596A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3604 wrote to memory of 3076 3604 2024-04-30_e5e01e8c1bb6914bfa8eb2539461a3c5_mafia.exe 84 PID 3604 wrote to memory of 3076 3604 2024-04-30_e5e01e8c1bb6914bfa8eb2539461a3c5_mafia.exe 84 PID 3604 wrote to memory of 3076 3604 2024-04-30_e5e01e8c1bb6914bfa8eb2539461a3c5_mafia.exe 84 PID 3076 wrote to memory of 3848 3076 4035.tmp 85 PID 3076 wrote to memory of 3848 3076 4035.tmp 85 PID 3076 wrote to memory of 3848 3076 4035.tmp 85 PID 3848 wrote to memory of 1496 3848 40E1.tmp 86 PID 3848 wrote to memory of 1496 3848 40E1.tmp 86 PID 3848 wrote to memory of 1496 3848 40E1.tmp 86 PID 1496 wrote to memory of 2888 1496 416E.tmp 88 PID 1496 wrote to memory of 2888 1496 416E.tmp 88 PID 1496 wrote to memory of 2888 1496 416E.tmp 88 PID 2888 wrote to memory of 1360 2888 41DB.tmp 90 PID 2888 wrote to memory of 1360 2888 41DB.tmp 90 PID 2888 wrote to memory of 1360 2888 41DB.tmp 90 PID 1360 wrote to memory of 4992 1360 4268.tmp 92 PID 1360 wrote to memory of 4992 1360 4268.tmp 92 PID 1360 wrote to memory of 4992 1360 4268.tmp 92 PID 4992 wrote to memory of 712 4992 42F4.tmp 93 PID 4992 wrote to memory of 712 4992 42F4.tmp 93 PID 4992 wrote to memory of 712 4992 42F4.tmp 93 PID 712 wrote to memory of 2500 712 4371.tmp 95 PID 712 wrote to memory of 2500 712 4371.tmp 95 PID 712 wrote to memory of 2500 712 4371.tmp 95 PID 2500 wrote to memory of 2416 2500 43CF.tmp 96 PID 2500 wrote to memory of 2416 2500 43CF.tmp 96 PID 2500 wrote to memory of 2416 2500 43CF.tmp 96 PID 2416 wrote to memory of 5084 2416 442D.tmp 97 PID 2416 wrote to memory of 5084 2416 442D.tmp 97 PID 2416 wrote to memory of 5084 2416 442D.tmp 97 PID 5084 wrote to memory of 1184 5084 44AA.tmp 98 PID 5084 wrote to memory of 1184 5084 44AA.tmp 98 PID 5084 wrote to memory of 1184 5084 44AA.tmp 98 PID 1184 wrote to memory of 4376 1184 4527.tmp 99 PID 1184 wrote to memory of 4376 1184 4527.tmp 99 PID 1184 wrote to memory of 4376 1184 4527.tmp 99 PID 4376 wrote to memory of 636 4376 4594.tmp 100 PID 4376 wrote to memory of 636 4376 4594.tmp 100 PID 4376 wrote to memory of 636 4376 4594.tmp 100 PID 636 wrote to memory of 4252 636 45E2.tmp 101 PID 636 wrote to memory of 4252 636 45E2.tmp 101 PID 636 wrote to memory of 4252 636 45E2.tmp 101 PID 4252 wrote to memory of 4700 4252 47B7.tmp 102 PID 4252 wrote to memory of 4700 4252 47B7.tmp 102 PID 4252 wrote to memory of 4700 4252 47B7.tmp 102 PID 4700 wrote to memory of 4600 4700 4805.tmp 103 PID 4700 wrote to memory of 4600 4700 4805.tmp 103 PID 4700 wrote to memory of 4600 4700 4805.tmp 103 PID 4600 wrote to memory of 4224 4600 4853.tmp 104 PID 4600 wrote to memory of 4224 4600 4853.tmp 104 PID 4600 wrote to memory of 4224 4600 4853.tmp 104 PID 4224 wrote to memory of 732 4224 48B1.tmp 105 PID 4224 wrote to memory of 732 4224 48B1.tmp 105 PID 4224 wrote to memory of 732 4224 48B1.tmp 105 PID 732 wrote to memory of 2836 732 492E.tmp 106 PID 732 wrote to memory of 2836 732 492E.tmp 106 PID 732 wrote to memory of 2836 732 492E.tmp 106 PID 2836 wrote to memory of 4764 2836 49AB.tmp 107 PID 2836 wrote to memory of 4764 2836 49AB.tmp 107 PID 2836 wrote to memory of 4764 2836 49AB.tmp 107 PID 4764 wrote to memory of 4260 4764 4A28.tmp 108 PID 4764 wrote to memory of 4260 4764 4A28.tmp 108 PID 4764 wrote to memory of 4260 4764 4A28.tmp 108 PID 4260 wrote to memory of 3176 4260 4A96.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-30_e5e01e8c1bb6914bfa8eb2539461a3c5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-30_e5e01e8c1bb6914bfa8eb2539461a3c5_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\4035.tmp"C:\Users\Admin\AppData\Local\Temp\4035.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\40E1.tmp"C:\Users\Admin\AppData\Local\Temp\40E1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\416E.tmp"C:\Users\Admin\AppData\Local\Temp\416E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\41DB.tmp"C:\Users\Admin\AppData\Local\Temp\41DB.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\4268.tmp"C:\Users\Admin\AppData\Local\Temp\4268.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\42F4.tmp"C:\Users\Admin\AppData\Local\Temp\42F4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\4371.tmp"C:\Users\Admin\AppData\Local\Temp\4371.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Users\Admin\AppData\Local\Temp\43CF.tmp"C:\Users\Admin\AppData\Local\Temp\43CF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\44AA.tmp"C:\Users\Admin\AppData\Local\Temp\44AA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\48B1.tmp"C:\Users\Admin\AppData\Local\Temp\48B1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"23⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"24⤵
- Executes dropped EXE
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"25⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"26⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"27⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"28⤵
- Executes dropped EXE
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"29⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"30⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"31⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"32⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"33⤵
- Executes dropped EXE
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"34⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"35⤵
- Executes dropped EXE
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"36⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"37⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"38⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"39⤵
- Executes dropped EXE
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"40⤵
- Executes dropped EXE
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"41⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"42⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"43⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"44⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"45⤵
- Executes dropped EXE
PID:868 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"46⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"47⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"48⤵
- Executes dropped EXE
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"49⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"50⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"51⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"52⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"53⤵
- Executes dropped EXE
PID:908 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"54⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"55⤵
- Executes dropped EXE
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"56⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"57⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"58⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"59⤵
- Executes dropped EXE
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"60⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"61⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"62⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"63⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"64⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"65⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"66⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"67⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"68⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"69⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"70⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"71⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"72⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"73⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"74⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"75⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"76⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"77⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"78⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"79⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"80⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"81⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"82⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"83⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"84⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"85⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"86⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"87⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"88⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"89⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"90⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"91⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"92⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"93⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"94⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"95⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"96⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"97⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"98⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"99⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"100⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"101⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"102⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"103⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"104⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"105⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"106⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"107⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"108⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"109⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"110⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"111⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"112⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"113⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"114⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"115⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"116⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"117⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"118⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"119⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"120⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"121⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"122⤵PID:2236
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-