Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 14:02
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-28_aa30f5f4eceb2e0748e59efc09d2ded0_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-28_aa30f5f4eceb2e0748e59efc09d2ded0_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-28_aa30f5f4eceb2e0748e59efc09d2ded0_mafia.exe
-
Size
530KB
-
MD5
aa30f5f4eceb2e0748e59efc09d2ded0
-
SHA1
d20fe324b322147ec7e1fce0b08c5940412673b5
-
SHA256
eb556fb618503b46c9a617cd5c7c88406eb23c5a7140735e452bded09da8d3f4
-
SHA512
e404722c732c14891a79780c80c7fc273072f7b14fb703d2a55ffd01ecae1a049aa71a2b8cad5535f4d3bddee512e724fe953d32ec35bd5a6143589567d512f6
-
SSDEEP
12288:AU5rCOTeioD7NQQzl0+MhTLMNZulFVg0M1:AUQOJo9XzlbNclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1576 4016.tmp 2316 4074.tmp 1444 40E1.tmp 396 414F.tmp 2100 41BC.tmp 5012 4229.tmp 2172 42A6.tmp 1852 42F4.tmp 1108 4371.tmp 3488 43C0.tmp 4076 441D.tmp 2428 447B.tmp 4828 44F8.tmp 3264 4565.tmp 2696 45C3.tmp 4612 4621.tmp 4352 466F.tmp 2344 46DC.tmp 3308 4759.tmp 4456 47D6.tmp 4400 4844.tmp 964 4892.tmp 2856 48E0.tmp 972 493E.tmp 4996 49BB.tmp 2644 4A38.tmp 1432 4AB5.tmp 4420 4B03.tmp 3504 4B80.tmp 1940 4BED.tmp 4608 4C5B.tmp 4344 4CC8.tmp 2776 4D16.tmp 3228 4D64.tmp 3544 4DB2.tmp 2692 4E10.tmp 4136 4E5E.tmp 4396 4EAC.tmp 3204 4F0A.tmp 5052 4F58.tmp 3652 4FB6.tmp 1404 5004.tmp 3516 5062.tmp 1936 50C0.tmp 896 511D.tmp 4020 517B.tmp 3592 51D9.tmp 4460 5237.tmp 4584 5294.tmp 3748 52F2.tmp 2316 5350.tmp 2216 539E.tmp 1580 53FC.tmp 4792 545A.tmp 64 54A8.tmp 1200 54F6.tmp 2544 5554.tmp 4068 55A2.tmp 5096 55FF.tmp 540 564E.tmp 2440 56AB.tmp 2200 56F9.tmp 3532 5757.tmp 3792 57B5.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1204 wrote to memory of 1576 1204 2024-05-28_aa30f5f4eceb2e0748e59efc09d2ded0_mafia.exe 82 PID 1204 wrote to memory of 1576 1204 2024-05-28_aa30f5f4eceb2e0748e59efc09d2ded0_mafia.exe 82 PID 1204 wrote to memory of 1576 1204 2024-05-28_aa30f5f4eceb2e0748e59efc09d2ded0_mafia.exe 82 PID 1576 wrote to memory of 2316 1576 4016.tmp 83 PID 1576 wrote to memory of 2316 1576 4016.tmp 83 PID 1576 wrote to memory of 2316 1576 4016.tmp 83 PID 2316 wrote to memory of 1444 2316 4074.tmp 85 PID 2316 wrote to memory of 1444 2316 4074.tmp 85 PID 2316 wrote to memory of 1444 2316 4074.tmp 85 PID 1444 wrote to memory of 396 1444 40E1.tmp 87 PID 1444 wrote to memory of 396 1444 40E1.tmp 87 PID 1444 wrote to memory of 396 1444 40E1.tmp 87 PID 396 wrote to memory of 2100 396 414F.tmp 89 PID 396 wrote to memory of 2100 396 414F.tmp 89 PID 396 wrote to memory of 2100 396 414F.tmp 89 PID 2100 wrote to memory of 5012 2100 41BC.tmp 90 PID 2100 wrote to memory of 5012 2100 41BC.tmp 90 PID 2100 wrote to memory of 5012 2100 41BC.tmp 90 PID 5012 wrote to memory of 2172 5012 4229.tmp 91 PID 5012 wrote to memory of 2172 5012 4229.tmp 91 PID 5012 wrote to memory of 2172 5012 4229.tmp 91 PID 2172 wrote to memory of 1852 2172 42A6.tmp 92 PID 2172 wrote to memory of 1852 2172 42A6.tmp 92 PID 2172 wrote to memory of 1852 2172 42A6.tmp 92 PID 1852 wrote to memory of 1108 1852 42F4.tmp 93 PID 1852 wrote to memory of 1108 1852 42F4.tmp 93 PID 1852 wrote to memory of 1108 1852 42F4.tmp 93 PID 1108 wrote to memory of 3488 1108 4371.tmp 94 PID 1108 wrote to memory of 3488 1108 4371.tmp 94 PID 1108 wrote to memory of 3488 1108 4371.tmp 94 PID 3488 wrote to memory of 4076 3488 43C0.tmp 95 PID 3488 wrote to memory of 4076 3488 43C0.tmp 95 PID 3488 wrote to memory of 4076 3488 43C0.tmp 95 PID 4076 wrote to memory of 2428 4076 441D.tmp 96 PID 4076 wrote to memory of 2428 4076 441D.tmp 96 PID 4076 wrote to memory of 2428 4076 441D.tmp 96 PID 2428 wrote to memory of 4828 2428 447B.tmp 97 PID 2428 wrote to memory of 4828 2428 447B.tmp 97 PID 2428 wrote to memory of 4828 2428 447B.tmp 97 PID 4828 wrote to memory of 3264 4828 44F8.tmp 98 PID 4828 wrote to memory of 3264 4828 44F8.tmp 98 PID 4828 wrote to memory of 3264 4828 44F8.tmp 98 PID 3264 wrote to memory of 2696 3264 4565.tmp 99 PID 3264 wrote to memory of 2696 3264 4565.tmp 99 PID 3264 wrote to memory of 2696 3264 4565.tmp 99 PID 2696 wrote to memory of 4612 2696 45C3.tmp 100 PID 2696 wrote to memory of 4612 2696 45C3.tmp 100 PID 2696 wrote to memory of 4612 2696 45C3.tmp 100 PID 4612 wrote to memory of 4352 4612 4621.tmp 101 PID 4612 wrote to memory of 4352 4612 4621.tmp 101 PID 4612 wrote to memory of 4352 4612 4621.tmp 101 PID 4352 wrote to memory of 2344 4352 466F.tmp 102 PID 4352 wrote to memory of 2344 4352 466F.tmp 102 PID 4352 wrote to memory of 2344 4352 466F.tmp 102 PID 2344 wrote to memory of 3308 2344 46DC.tmp 103 PID 2344 wrote to memory of 3308 2344 46DC.tmp 103 PID 2344 wrote to memory of 3308 2344 46DC.tmp 103 PID 3308 wrote to memory of 4456 3308 4759.tmp 104 PID 3308 wrote to memory of 4456 3308 4759.tmp 104 PID 3308 wrote to memory of 4456 3308 4759.tmp 104 PID 4456 wrote to memory of 4400 4456 47D6.tmp 105 PID 4456 wrote to memory of 4400 4456 47D6.tmp 105 PID 4456 wrote to memory of 4400 4456 47D6.tmp 105 PID 4400 wrote to memory of 964 4400 4844.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-28_aa30f5f4eceb2e0748e59efc09d2ded0_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-28_aa30f5f4eceb2e0748e59efc09d2ded0_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\4016.tmp"C:\Users\Admin\AppData\Local\Temp\4016.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\4074.tmp"C:\Users\Admin\AppData\Local\Temp\4074.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\40E1.tmp"C:\Users\Admin\AppData\Local\Temp\40E1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\414F.tmp"C:\Users\Admin\AppData\Local\Temp\414F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\41BC.tmp"C:\Users\Admin\AppData\Local\Temp\41BC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\4229.tmp"C:\Users\Admin\AppData\Local\Temp\4229.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\42A6.tmp"C:\Users\Admin\AppData\Local\Temp\42A6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\42F4.tmp"C:\Users\Admin\AppData\Local\Temp\42F4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\4371.tmp"C:\Users\Admin\AppData\Local\Temp\4371.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\43C0.tmp"C:\Users\Admin\AppData\Local\Temp\43C0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\441D.tmp"C:\Users\Admin\AppData\Local\Temp\441D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\447B.tmp"C:\Users\Admin\AppData\Local\Temp\447B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\4565.tmp"C:\Users\Admin\AppData\Local\Temp\4565.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"23⤵
- Executes dropped EXE
PID:964 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"24⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"25⤵
- Executes dropped EXE
PID:972 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"26⤵
- Executes dropped EXE
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"27⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"28⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"29⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"30⤵
- Executes dropped EXE
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"31⤵
- Executes dropped EXE
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"32⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"33⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"34⤵
- Executes dropped EXE
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"35⤵
- Executes dropped EXE
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"36⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"37⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"38⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"39⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"40⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"41⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"42⤵
- Executes dropped EXE
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"43⤵
- Executes dropped EXE
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"44⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"45⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"46⤵
- Executes dropped EXE
PID:896 -
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"47⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"48⤵
- Executes dropped EXE
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"49⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"50⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"51⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"52⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"53⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"54⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"55⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"56⤵
- Executes dropped EXE
PID:64 -
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"57⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"58⤵
- Executes dropped EXE
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"59⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"60⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"61⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"62⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"63⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"64⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"65⤵
- Executes dropped EXE
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"66⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"67⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"68⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"69⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"70⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"71⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"72⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"73⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"74⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"75⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"76⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"77⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"78⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"79⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"80⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"81⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"82⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"83⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"84⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"85⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"86⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"87⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"88⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"89⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"90⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"91⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"92⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"93⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"94⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"95⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"96⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"97⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"98⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"99⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"100⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"101⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"102⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"103⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"104⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"105⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"106⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"107⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"108⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"109⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"110⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"111⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"112⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"113⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"114⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"115⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"116⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"117⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"118⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"119⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"120⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"121⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"122⤵PID:4828
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-