Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/06/2024, 15:32
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-28_cf3d7d144b858ae0d7ac0203ce0c4369_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-28_cf3d7d144b858ae0d7ac0203ce0c4369_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-28_cf3d7d144b858ae0d7ac0203ce0c4369_mafia.exe
-
Size
488KB
-
MD5
cf3d7d144b858ae0d7ac0203ce0c4369
-
SHA1
fa54f09325321c674c923c19e24be266b035ef67
-
SHA256
7b43c1da3ad18014bb610d0e80e79435645c2c4d87d5216c046c7edeac59b23f
-
SHA512
c1c3326ae62b8aa8d9a5042ab24209502acef96689f5b46728effba7c73b80cc646a3aff7c355bd8a005e93e9c801d5770a5c4769a1795d902d6039fefc23701
-
SSDEEP
12288:/U5rCOTeiDRC2kte485QXDU3YkED0dLFfwNZ:/UQOJD02k2eTUXhwN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 828 3AA7.tmp 3272 3B44.tmp 4164 3BB1.tmp 1092 3C3E.tmp 4100 3CBB.tmp 4932 3D18.tmp 4812 3D95.tmp 4312 3E03.tmp 2496 3E70.tmp 4792 3EED.tmp 3372 3F5B.tmp 3492 3FD8.tmp 1028 4045.tmp 4984 40C2.tmp 3580 4110.tmp 4944 416E.tmp 3004 41CC.tmp 2516 4229.tmp 1472 42A6.tmp 1612 4304.tmp 3756 4362.tmp 948 43CF.tmp 4604 441D.tmp 1392 448B.tmp 1644 44D9.tmp 2484 4527.tmp 1252 4575.tmp 2804 45C3.tmp 1304 4611.tmp 2464 465F.tmp 4256 46AE.tmp 1276 470B.tmp 1772 4769.tmp 1856 47B7.tmp 5012 47F6.tmp 2584 4844.tmp 4196 4892.tmp 1460 48F0.tmp 3640 493E.tmp 4408 499C.tmp 2636 49EA.tmp 4032 4A38.tmp 3300 4A96.tmp 4360 4AE4.tmp 1532 4B41.tmp 5076 4B9F.tmp 3160 4BFD.tmp 3092 4C4B.tmp 2252 4C99.tmp 4380 4CF7.tmp 3212 4D45.tmp 4320 4D93.tmp 4556 4DF1.tmp 1260 4E3F.tmp 1888 4E8D.tmp 4376 4EDB.tmp 1976 4F29.tmp 5000 4F78.tmp 1616 4FC6.tmp 4344 5014.tmp 1656 5062.tmp 1084 50B0.tmp 1652 50FE.tmp 3972 514C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3216 wrote to memory of 828 3216 2024-06-28_cf3d7d144b858ae0d7ac0203ce0c4369_mafia.exe 81 PID 3216 wrote to memory of 828 3216 2024-06-28_cf3d7d144b858ae0d7ac0203ce0c4369_mafia.exe 81 PID 3216 wrote to memory of 828 3216 2024-06-28_cf3d7d144b858ae0d7ac0203ce0c4369_mafia.exe 81 PID 828 wrote to memory of 3272 828 3AA7.tmp 82 PID 828 wrote to memory of 3272 828 3AA7.tmp 82 PID 828 wrote to memory of 3272 828 3AA7.tmp 82 PID 3272 wrote to memory of 4164 3272 3B44.tmp 83 PID 3272 wrote to memory of 4164 3272 3B44.tmp 83 PID 3272 wrote to memory of 4164 3272 3B44.tmp 83 PID 4164 wrote to memory of 1092 4164 3BB1.tmp 84 PID 4164 wrote to memory of 1092 4164 3BB1.tmp 84 PID 4164 wrote to memory of 1092 4164 3BB1.tmp 84 PID 1092 wrote to memory of 4100 1092 3C3E.tmp 85 PID 1092 wrote to memory of 4100 1092 3C3E.tmp 85 PID 1092 wrote to memory of 4100 1092 3C3E.tmp 85 PID 4100 wrote to memory of 4932 4100 3CBB.tmp 86 PID 4100 wrote to memory of 4932 4100 3CBB.tmp 86 PID 4100 wrote to memory of 4932 4100 3CBB.tmp 86 PID 4932 wrote to memory of 4812 4932 3D18.tmp 87 PID 4932 wrote to memory of 4812 4932 3D18.tmp 87 PID 4932 wrote to memory of 4812 4932 3D18.tmp 87 PID 4812 wrote to memory of 4312 4812 3D95.tmp 88 PID 4812 wrote to memory of 4312 4812 3D95.tmp 88 PID 4812 wrote to memory of 4312 4812 3D95.tmp 88 PID 4312 wrote to memory of 2496 4312 3E03.tmp 89 PID 4312 wrote to memory of 2496 4312 3E03.tmp 89 PID 4312 wrote to memory of 2496 4312 3E03.tmp 89 PID 2496 wrote to memory of 4792 2496 3E70.tmp 90 PID 2496 wrote to memory of 4792 2496 3E70.tmp 90 PID 2496 wrote to memory of 4792 2496 3E70.tmp 90 PID 4792 wrote to memory of 3372 4792 3EED.tmp 91 PID 4792 wrote to memory of 3372 4792 3EED.tmp 91 PID 4792 wrote to memory of 3372 4792 3EED.tmp 91 PID 3372 wrote to memory of 3492 3372 3F5B.tmp 92 PID 3372 wrote to memory of 3492 3372 3F5B.tmp 92 PID 3372 wrote to memory of 3492 3372 3F5B.tmp 92 PID 3492 wrote to memory of 1028 3492 3FD8.tmp 93 PID 3492 wrote to memory of 1028 3492 3FD8.tmp 93 PID 3492 wrote to memory of 1028 3492 3FD8.tmp 93 PID 1028 wrote to memory of 4984 1028 4045.tmp 94 PID 1028 wrote to memory of 4984 1028 4045.tmp 94 PID 1028 wrote to memory of 4984 1028 4045.tmp 94 PID 4984 wrote to memory of 3580 4984 40C2.tmp 95 PID 4984 wrote to memory of 3580 4984 40C2.tmp 95 PID 4984 wrote to memory of 3580 4984 40C2.tmp 95 PID 3580 wrote to memory of 4944 3580 4110.tmp 96 PID 3580 wrote to memory of 4944 3580 4110.tmp 96 PID 3580 wrote to memory of 4944 3580 4110.tmp 96 PID 4944 wrote to memory of 3004 4944 416E.tmp 97 PID 4944 wrote to memory of 3004 4944 416E.tmp 97 PID 4944 wrote to memory of 3004 4944 416E.tmp 97 PID 3004 wrote to memory of 2516 3004 41CC.tmp 100 PID 3004 wrote to memory of 2516 3004 41CC.tmp 100 PID 3004 wrote to memory of 2516 3004 41CC.tmp 100 PID 2516 wrote to memory of 1472 2516 4229.tmp 101 PID 2516 wrote to memory of 1472 2516 4229.tmp 101 PID 2516 wrote to memory of 1472 2516 4229.tmp 101 PID 1472 wrote to memory of 1612 1472 42A6.tmp 102 PID 1472 wrote to memory of 1612 1472 42A6.tmp 102 PID 1472 wrote to memory of 1612 1472 42A6.tmp 102 PID 1612 wrote to memory of 3756 1612 4304.tmp 103 PID 1612 wrote to memory of 3756 1612 4304.tmp 103 PID 1612 wrote to memory of 3756 1612 4304.tmp 103 PID 3756 wrote to memory of 948 3756 4362.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-28_cf3d7d144b858ae0d7ac0203ce0c4369_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-28_cf3d7d144b858ae0d7ac0203ce0c4369_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\3AA7.tmp"C:\Users\Admin\AppData\Local\Temp\3AA7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\3B44.tmp"C:\Users\Admin\AppData\Local\Temp\3B44.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\3BB1.tmp"C:\Users\Admin\AppData\Local\Temp\3BB1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\3C3E.tmp"C:\Users\Admin\AppData\Local\Temp\3C3E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\3D18.tmp"C:\Users\Admin\AppData\Local\Temp\3D18.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\3D95.tmp"C:\Users\Admin\AppData\Local\Temp\3D95.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\3E03.tmp"C:\Users\Admin\AppData\Local\Temp\3E03.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\3E70.tmp"C:\Users\Admin\AppData\Local\Temp\3E70.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\3EED.tmp"C:\Users\Admin\AppData\Local\Temp\3EED.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\4045.tmp"C:\Users\Admin\AppData\Local\Temp\4045.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\40C2.tmp"C:\Users\Admin\AppData\Local\Temp\40C2.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\4110.tmp"C:\Users\Admin\AppData\Local\Temp\4110.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\416E.tmp"C:\Users\Admin\AppData\Local\Temp\416E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\4229.tmp"C:\Users\Admin\AppData\Local\Temp\4229.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\42A6.tmp"C:\Users\Admin\AppData\Local\Temp\42A6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\4304.tmp"C:\Users\Admin\AppData\Local\Temp\4304.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\4362.tmp"C:\Users\Admin\AppData\Local\Temp\4362.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\43CF.tmp"C:\Users\Admin\AppData\Local\Temp\43CF.tmp"23⤵
- Executes dropped EXE
PID:948 -
C:\Users\Admin\AppData\Local\Temp\441D.tmp"C:\Users\Admin\AppData\Local\Temp\441D.tmp"24⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\448B.tmp"C:\Users\Admin\AppData\Local\Temp\448B.tmp"25⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"26⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"27⤵
- Executes dropped EXE
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"28⤵
- Executes dropped EXE
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"29⤵
- Executes dropped EXE
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"30⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"31⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"32⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"33⤵
- Executes dropped EXE
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"34⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"35⤵
- Executes dropped EXE
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"36⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"37⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"38⤵
- Executes dropped EXE
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"39⤵
- Executes dropped EXE
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"40⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"41⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"42⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"43⤵
- Executes dropped EXE
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"44⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"45⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"46⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"47⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"48⤵
- Executes dropped EXE
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"49⤵
- Executes dropped EXE
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"50⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"51⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"52⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"53⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"54⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"55⤵
- Executes dropped EXE
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"56⤵
- Executes dropped EXE
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"57⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"58⤵
- Executes dropped EXE
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"59⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"60⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"61⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"62⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"63⤵
- Executes dropped EXE
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"64⤵
- Executes dropped EXE
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"65⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"66⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"67⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"68⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"69⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"70⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"71⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"72⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"73⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"74⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"75⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"76⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"77⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"78⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"79⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"80⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"81⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"82⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"83⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"84⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"85⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"86⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"87⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"88⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"89⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"90⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"91⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"92⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"93⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"94⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"95⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"96⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"97⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"98⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"99⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"100⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"101⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"102⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"103⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"104⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"105⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"106⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"107⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"108⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"109⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"110⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"111⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"112⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"113⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"114⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"115⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"116⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"117⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"118⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"119⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"120⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"121⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"122⤵PID:1656
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-