Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
12/05/2024, 15:44
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-12_16437495e23812287dceba0b2dfcf518_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-12_16437495e23812287dceba0b2dfcf518_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-12_16437495e23812287dceba0b2dfcf518_mafia.exe
-
Size
530KB
-
MD5
16437495e23812287dceba0b2dfcf518
-
SHA1
44d522b6996f8936edffd9bf7c4f5929fae2c348
-
SHA256
84a9a235be7b2b71f04709ec6ca1c25341f819b263626385df6336a81dfa771f
-
SHA512
42f221ab05789f2019c235d057d1919943ecaecdc538a68b731dd5531b4dd14861a012a59b5fefcfeb38e9e510a70899b3d847536c0496fa9c90c77d9222d55e
-
SSDEEP
12288:AU5rCOTeioQaTFDamK1E0d+Key2NZulFVg0M1:AUQOJodFDajXd+LdNclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4124 4239.tmp 4896 42A6.tmp 1544 4323.tmp 448 4381.tmp 3764 43EE.tmp 4788 445C.tmp 1132 44BA.tmp 2340 4508.tmp 1712 4565.tmp 4860 45B4.tmp 4652 4631.tmp 5000 467F.tmp 3604 46DC.tmp 4312 4759.tmp 4416 47B7.tmp 2544 4825.tmp 1344 4892.tmp 5044 48FF.tmp 4500 494D.tmp 4456 499C.tmp 4868 49EA.tmp 1816 4A38.tmp 2024 4A86.tmp 804 4AD4.tmp 60 4B22.tmp 4244 4BAF.tmp 2508 4C0D.tmp 4996 4C6A.tmp 4744 4CD8.tmp 1828 4D45.tmp 5028 4D93.tmp 1960 4E01.tmp 5048 4E4F.tmp 4784 4EAC.tmp 4468 4EFB.tmp 2084 4F49.tmp 1940 4F97.tmp 4932 4FF5.tmp 700 5043.tmp 1900 50B0.tmp 2700 510E.tmp 4896 516C.tmp 2680 51BA.tmp 4616 5217.tmp 992 5266.tmp 596 52B4.tmp 3568 5311.tmp 2300 536F.tmp 2912 53CD.tmp 3132 542B.tmp 2220 5488.tmp 744 54D7.tmp 508 5525.tmp 4776 5582.tmp 3244 55E0.tmp 1896 562E.tmp 3060 568C.tmp 1344 56EA.tmp 520 5748.tmp 3960 57A5.tmp 4032 5803.tmp 4948 5861.tmp 5080 58BF.tmp 4480 590D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2812 wrote to memory of 4124 2812 2024-05-12_16437495e23812287dceba0b2dfcf518_mafia.exe 82 PID 2812 wrote to memory of 4124 2812 2024-05-12_16437495e23812287dceba0b2dfcf518_mafia.exe 82 PID 2812 wrote to memory of 4124 2812 2024-05-12_16437495e23812287dceba0b2dfcf518_mafia.exe 82 PID 4124 wrote to memory of 4896 4124 4239.tmp 83 PID 4124 wrote to memory of 4896 4124 4239.tmp 83 PID 4124 wrote to memory of 4896 4124 4239.tmp 83 PID 4896 wrote to memory of 1544 4896 42A6.tmp 84 PID 4896 wrote to memory of 1544 4896 42A6.tmp 84 PID 4896 wrote to memory of 1544 4896 42A6.tmp 84 PID 1544 wrote to memory of 448 1544 4323.tmp 86 PID 1544 wrote to memory of 448 1544 4323.tmp 86 PID 1544 wrote to memory of 448 1544 4323.tmp 86 PID 448 wrote to memory of 3764 448 4381.tmp 87 PID 448 wrote to memory of 3764 448 4381.tmp 87 PID 448 wrote to memory of 3764 448 4381.tmp 87 PID 3764 wrote to memory of 4788 3764 43EE.tmp 89 PID 3764 wrote to memory of 4788 3764 43EE.tmp 89 PID 3764 wrote to memory of 4788 3764 43EE.tmp 89 PID 4788 wrote to memory of 1132 4788 445C.tmp 91 PID 4788 wrote to memory of 1132 4788 445C.tmp 91 PID 4788 wrote to memory of 1132 4788 445C.tmp 91 PID 1132 wrote to memory of 2340 1132 44BA.tmp 92 PID 1132 wrote to memory of 2340 1132 44BA.tmp 92 PID 1132 wrote to memory of 2340 1132 44BA.tmp 92 PID 2340 wrote to memory of 1712 2340 4508.tmp 93 PID 2340 wrote to memory of 1712 2340 4508.tmp 93 PID 2340 wrote to memory of 1712 2340 4508.tmp 93 PID 1712 wrote to memory of 4860 1712 4565.tmp 94 PID 1712 wrote to memory of 4860 1712 4565.tmp 94 PID 1712 wrote to memory of 4860 1712 4565.tmp 94 PID 4860 wrote to memory of 4652 4860 45B4.tmp 95 PID 4860 wrote to memory of 4652 4860 45B4.tmp 95 PID 4860 wrote to memory of 4652 4860 45B4.tmp 95 PID 4652 wrote to memory of 5000 4652 4631.tmp 96 PID 4652 wrote to memory of 5000 4652 4631.tmp 96 PID 4652 wrote to memory of 5000 4652 4631.tmp 96 PID 5000 wrote to memory of 3604 5000 467F.tmp 97 PID 5000 wrote to memory of 3604 5000 467F.tmp 97 PID 5000 wrote to memory of 3604 5000 467F.tmp 97 PID 3604 wrote to memory of 4312 3604 46DC.tmp 98 PID 3604 wrote to memory of 4312 3604 46DC.tmp 98 PID 3604 wrote to memory of 4312 3604 46DC.tmp 98 PID 4312 wrote to memory of 4416 4312 4759.tmp 99 PID 4312 wrote to memory of 4416 4312 4759.tmp 99 PID 4312 wrote to memory of 4416 4312 4759.tmp 99 PID 4416 wrote to memory of 2544 4416 47B7.tmp 100 PID 4416 wrote to memory of 2544 4416 47B7.tmp 100 PID 4416 wrote to memory of 2544 4416 47B7.tmp 100 PID 2544 wrote to memory of 1344 2544 4825.tmp 101 PID 2544 wrote to memory of 1344 2544 4825.tmp 101 PID 2544 wrote to memory of 1344 2544 4825.tmp 101 PID 1344 wrote to memory of 5044 1344 4892.tmp 102 PID 1344 wrote to memory of 5044 1344 4892.tmp 102 PID 1344 wrote to memory of 5044 1344 4892.tmp 102 PID 5044 wrote to memory of 4500 5044 48FF.tmp 103 PID 5044 wrote to memory of 4500 5044 48FF.tmp 103 PID 5044 wrote to memory of 4500 5044 48FF.tmp 103 PID 4500 wrote to memory of 4456 4500 494D.tmp 104 PID 4500 wrote to memory of 4456 4500 494D.tmp 104 PID 4500 wrote to memory of 4456 4500 494D.tmp 104 PID 4456 wrote to memory of 4868 4456 499C.tmp 105 PID 4456 wrote to memory of 4868 4456 499C.tmp 105 PID 4456 wrote to memory of 4868 4456 499C.tmp 105 PID 4868 wrote to memory of 1816 4868 49EA.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-12_16437495e23812287dceba0b2dfcf518_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-12_16437495e23812287dceba0b2dfcf518_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\42A6.tmp"C:\Users\Admin\AppData\Local\Temp\42A6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\4565.tmp"C:\Users\Admin\AppData\Local\Temp\4565.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"23⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"24⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"25⤵
- Executes dropped EXE
PID:804 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"26⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"27⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"28⤵
- Executes dropped EXE
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"29⤵
- Executes dropped EXE
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"30⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"31⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"32⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"33⤵
- Executes dropped EXE
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"34⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"35⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"36⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"37⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"38⤵
- Executes dropped EXE
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"39⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"40⤵
- Executes dropped EXE
PID:700 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"41⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"42⤵
- Executes dropped EXE
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"43⤵
- Executes dropped EXE
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"44⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"45⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"46⤵
- Executes dropped EXE
PID:992 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"47⤵
- Executes dropped EXE
PID:596 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"48⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"49⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"50⤵
- Executes dropped EXE
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"51⤵
- Executes dropped EXE
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"52⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"53⤵
- Executes dropped EXE
PID:744 -
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"54⤵
- Executes dropped EXE
PID:508 -
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"55⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"56⤵
- Executes dropped EXE
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"57⤵
- Executes dropped EXE
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"58⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"59⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"60⤵
- Executes dropped EXE
PID:520 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"61⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"62⤵
- Executes dropped EXE
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"63⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"64⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"65⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"66⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"67⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"68⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"69⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"70⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"71⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"72⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"73⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"74⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"75⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"76⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"77⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"78⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"79⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"80⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"81⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"82⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"83⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"84⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"85⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"86⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"87⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"88⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"89⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"90⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"91⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"92⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"93⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"94⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"95⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"96⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"97⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"98⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"99⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"100⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"101⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"102⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"103⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"104⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"105⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"106⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"107⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"108⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"109⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"110⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"111⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"112⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"113⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"114⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"115⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"116⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"117⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"118⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"119⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"120⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"121⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"122⤵PID:2448
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-