Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/07/2024, 13:27
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-03_d349e75acac107f71e1d27d31beb2cad_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-07-03_d349e75acac107f71e1d27d31beb2cad_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-07-03_d349e75acac107f71e1d27d31beb2cad_mafia.exe
-
Size
536KB
-
MD5
d349e75acac107f71e1d27d31beb2cad
-
SHA1
8df0c1b34914195d3efad615f0b136536772f6c9
-
SHA256
d66c29559b4224d8240825b8dca9f26b6f56aa6cde58b291e43dd6f5eed42bd9
-
SHA512
df41f042deda6a029e2afe5d816862266232cb63ac5e22cb554ccf7f05aab6844cbeea669e026b10fb84e9c3b833ee1466d69f1d4b50cb805b8e2e36e095f2b8
-
SSDEEP
12288:wU5rCOTeiU6HMDXx9xJjBEjLIURIpzNrf56cdLIZxVJ0ZT9:wUQOJUXXTjBGLL2zNrUIIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4608 3BE0.tmp 404 3CBB.tmp 5028 3D38.tmp 3612 3DE4.tmp 316 3E80.tmp 3528 3F0C.tmp 3452 3F89.tmp 2364 4016.tmp 644 40C2.tmp 2824 415E.tmp 3784 41EB.tmp 1300 4258.tmp 4028 42E5.tmp 1032 4362.tmp 632 43FE.tmp 4992 447B.tmp 5104 4517.tmp 3620 45A4.tmp 2252 4631.tmp 1820 469E.tmp 4400 470B.tmp 2024 47C7.tmp 4792 4853.tmp 1448 48D0.tmp 5084 495D.tmp 3876 49EA.tmp 1720 4A47.tmp 376 4AF3.tmp 1160 4B70.tmp 3320 4BDE.tmp 4080 4C7A.tmp 4952 4D07.tmp 2560 4D74.tmp 2544 4DC2.tmp 4504 4E3F.tmp 4844 4E8D.tmp 3508 4EEB.tmp 1972 4F49.tmp 1308 4F97.tmp 1948 5004.tmp 3284 5072.tmp 1620 50EF.tmp 4884 513D.tmp 4376 519A.tmp 1984 5217.tmp 1880 5285.tmp 4044 5311.tmp 876 5360.tmp 4896 53BD.tmp 4296 541B.tmp 3000 5469.tmp 2536 54B7.tmp 2408 5505.tmp 1520 5554.tmp 316 55A2.tmp 3616 55F0.tmp 3068 563E.tmp 1360 568C.tmp 2616 56DA.tmp 2824 5719.tmp 4624 5776.tmp 656 57C5.tmp 1564 5822.tmp 1376 5870.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2736 wrote to memory of 4608 2736 2024-07-03_d349e75acac107f71e1d27d31beb2cad_mafia.exe 80 PID 2736 wrote to memory of 4608 2736 2024-07-03_d349e75acac107f71e1d27d31beb2cad_mafia.exe 80 PID 2736 wrote to memory of 4608 2736 2024-07-03_d349e75acac107f71e1d27d31beb2cad_mafia.exe 80 PID 4608 wrote to memory of 404 4608 3BE0.tmp 81 PID 4608 wrote to memory of 404 4608 3BE0.tmp 81 PID 4608 wrote to memory of 404 4608 3BE0.tmp 81 PID 404 wrote to memory of 5028 404 3CBB.tmp 82 PID 404 wrote to memory of 5028 404 3CBB.tmp 82 PID 404 wrote to memory of 5028 404 3CBB.tmp 82 PID 5028 wrote to memory of 3612 5028 3D38.tmp 83 PID 5028 wrote to memory of 3612 5028 3D38.tmp 83 PID 5028 wrote to memory of 3612 5028 3D38.tmp 83 PID 3612 wrote to memory of 316 3612 3DE4.tmp 84 PID 3612 wrote to memory of 316 3612 3DE4.tmp 84 PID 3612 wrote to memory of 316 3612 3DE4.tmp 84 PID 316 wrote to memory of 3528 316 3E80.tmp 85 PID 316 wrote to memory of 3528 316 3E80.tmp 85 PID 316 wrote to memory of 3528 316 3E80.tmp 85 PID 3528 wrote to memory of 3452 3528 3F0C.tmp 86 PID 3528 wrote to memory of 3452 3528 3F0C.tmp 86 PID 3528 wrote to memory of 3452 3528 3F0C.tmp 86 PID 3452 wrote to memory of 2364 3452 3F89.tmp 87 PID 3452 wrote to memory of 2364 3452 3F89.tmp 87 PID 3452 wrote to memory of 2364 3452 3F89.tmp 87 PID 2364 wrote to memory of 644 2364 4016.tmp 88 PID 2364 wrote to memory of 644 2364 4016.tmp 88 PID 2364 wrote to memory of 644 2364 4016.tmp 88 PID 644 wrote to memory of 2824 644 40C2.tmp 89 PID 644 wrote to memory of 2824 644 40C2.tmp 89 PID 644 wrote to memory of 2824 644 40C2.tmp 89 PID 2824 wrote to memory of 3784 2824 415E.tmp 90 PID 2824 wrote to memory of 3784 2824 415E.tmp 90 PID 2824 wrote to memory of 3784 2824 415E.tmp 90 PID 3784 wrote to memory of 1300 3784 41EB.tmp 91 PID 3784 wrote to memory of 1300 3784 41EB.tmp 91 PID 3784 wrote to memory of 1300 3784 41EB.tmp 91 PID 1300 wrote to memory of 4028 1300 4258.tmp 93 PID 1300 wrote to memory of 4028 1300 4258.tmp 93 PID 1300 wrote to memory of 4028 1300 4258.tmp 93 PID 4028 wrote to memory of 1032 4028 42E5.tmp 94 PID 4028 wrote to memory of 1032 4028 42E5.tmp 94 PID 4028 wrote to memory of 1032 4028 42E5.tmp 94 PID 1032 wrote to memory of 632 1032 4362.tmp 95 PID 1032 wrote to memory of 632 1032 4362.tmp 95 PID 1032 wrote to memory of 632 1032 4362.tmp 95 PID 632 wrote to memory of 4992 632 43FE.tmp 96 PID 632 wrote to memory of 4992 632 43FE.tmp 96 PID 632 wrote to memory of 4992 632 43FE.tmp 96 PID 4992 wrote to memory of 5104 4992 447B.tmp 97 PID 4992 wrote to memory of 5104 4992 447B.tmp 97 PID 4992 wrote to memory of 5104 4992 447B.tmp 97 PID 5104 wrote to memory of 3620 5104 4517.tmp 98 PID 5104 wrote to memory of 3620 5104 4517.tmp 98 PID 5104 wrote to memory of 3620 5104 4517.tmp 98 PID 3620 wrote to memory of 2252 3620 45A4.tmp 99 PID 3620 wrote to memory of 2252 3620 45A4.tmp 99 PID 3620 wrote to memory of 2252 3620 45A4.tmp 99 PID 2252 wrote to memory of 1820 2252 4631.tmp 100 PID 2252 wrote to memory of 1820 2252 4631.tmp 100 PID 2252 wrote to memory of 1820 2252 4631.tmp 100 PID 1820 wrote to memory of 4400 1820 469E.tmp 101 PID 1820 wrote to memory of 4400 1820 469E.tmp 101 PID 1820 wrote to memory of 4400 1820 469E.tmp 101 PID 4400 wrote to memory of 2024 4400 470B.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-03_d349e75acac107f71e1d27d31beb2cad_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-03_d349e75acac107f71e1d27d31beb2cad_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\3D38.tmp"C:\Users\Admin\AppData\Local\Temp\3D38.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\3E80.tmp"C:\Users\Admin\AppData\Local\Temp\3E80.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\3F89.tmp"C:\Users\Admin\AppData\Local\Temp\3F89.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\4016.tmp"C:\Users\Admin\AppData\Local\Temp\4016.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\40C2.tmp"C:\Users\Admin\AppData\Local\Temp\40C2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\415E.tmp"C:\Users\Admin\AppData\Local\Temp\415E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\41EB.tmp"C:\Users\Admin\AppData\Local\Temp\41EB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\4258.tmp"C:\Users\Admin\AppData\Local\Temp\4258.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\4362.tmp"C:\Users\Admin\AppData\Local\Temp\4362.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\43FE.tmp"C:\Users\Admin\AppData\Local\Temp\43FE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\447B.tmp"C:\Users\Admin\AppData\Local\Temp\447B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"23⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"24⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"25⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"26⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"27⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"28⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"29⤵
- Executes dropped EXE
PID:376 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"30⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"31⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"32⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"33⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"34⤵
- Executes dropped EXE
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"35⤵
- Executes dropped EXE
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"36⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"37⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"38⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"39⤵
- Executes dropped EXE
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"40⤵
- Executes dropped EXE
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"41⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"42⤵
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"43⤵
- Executes dropped EXE
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"44⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"45⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"46⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"47⤵
- Executes dropped EXE
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"48⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"49⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"50⤵
- Executes dropped EXE
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"51⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"52⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"53⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"54⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"55⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"56⤵
- Executes dropped EXE
PID:316 -
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"57⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"58⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"59⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"60⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"61⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"62⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"63⤵
- Executes dropped EXE
PID:656 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"64⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"65⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"66⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"67⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"68⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"69⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"70⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"71⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"72⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"73⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"74⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"75⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"76⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"77⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"78⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"79⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"80⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"81⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"82⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"83⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"84⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"85⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"86⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"87⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"88⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"89⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"90⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"91⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"92⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"93⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"94⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"95⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"96⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"97⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"98⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"99⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"100⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"101⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"102⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"103⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"104⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"105⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"106⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"107⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"108⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"109⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"110⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"111⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"112⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"113⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"114⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"115⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"116⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"117⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"118⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"119⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"120⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"121⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"122⤵PID:4864
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-