Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
02/05/2024, 01:11
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-02_d5ae902cacb2edae0d10575bfa11d027_mafia.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2024-05-02_d5ae902cacb2edae0d10575bfa11d027_mafia.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-05-02_d5ae902cacb2edae0d10575bfa11d027_mafia.exe
-
Size
520KB
-
MD5
d5ae902cacb2edae0d10575bfa11d027
-
SHA1
a2ee56377059f4b7e02aa77968eb56e0ddec2b6e
-
SHA256
f552a12e10657fcd509eb5f5e4ec321ddbefab837699ef708a2c1e8927f6df81
-
SHA512
7b19c91d12a99d903a89aa0423b338b05aa8bb3fcb85f0f83dcc6a2053b89108ba9fce26d29b433f67af35cc941f1212109baea7ed302ffbe2aacdc36b87bbb7
-
SSDEEP
6144:lLvd/XzCjUIF1UuXLyQjmOH+JjLw3vtwltoJ4VNWeRaMy0MMOjs9McKbg84BELsz:roRXOQjmOygsieRzOjGMpg84BXNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4352 4508.tmp 1484 4585.tmp 1940 45E2.tmp 3124 465F.tmp 4912 46DC.tmp 2636 474A.tmp 424 47C7.tmp 4988 4834.tmp 3232 4882.tmp 1664 48D0.tmp 5068 493E.tmp 4416 49CA.tmp 1548 4A47.tmp 2692 4A96.tmp 4484 4B03.tmp 3828 4B61.tmp 3160 4BCE.tmp 4532 4C3B.tmp 4636 4CA9.tmp 2344 4D45.tmp 5044 4DC2.tmp 1512 4E3F.tmp 4408 4EBC.tmp 804 4F39.tmp 1252 4FB6.tmp 4920 5014.tmp 1412 5072.tmp 2964 50EF.tmp 1428 516C.tmp 664 51F8.tmp 4112 5256.tmp 2268 52B4.tmp 4072 5311.tmp 912 5360.tmp 3068 53AE.tmp 3432 540B.tmp 3596 545A.tmp 4740 54A8.tmp 2516 54F6.tmp 3048 5544.tmp 2968 5592.tmp 1260 55E0.tmp 3616 563E.tmp 3896 568C.tmp 4340 56DA.tmp 1364 5728.tmp 1248 5776.tmp 3260 57D4.tmp 2044 5822.tmp 1228 5870.tmp 3024 58BF.tmp 396 590D.tmp 3008 595B.tmp 3156 59B9.tmp 4912 5A07.tmp 2636 5A55.tmp 4028 5AA3.tmp 1048 5AF1.tmp 424 5B3F.tmp 3268 5B8D.tmp 4444 5BDB.tmp 3204 5C2A.tmp 868 5C87.tmp 1444 5CE5.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2296 wrote to memory of 4352 2296 2024-05-02_d5ae902cacb2edae0d10575bfa11d027_mafia.exe 83 PID 2296 wrote to memory of 4352 2296 2024-05-02_d5ae902cacb2edae0d10575bfa11d027_mafia.exe 83 PID 2296 wrote to memory of 4352 2296 2024-05-02_d5ae902cacb2edae0d10575bfa11d027_mafia.exe 83 PID 4352 wrote to memory of 1484 4352 4508.tmp 84 PID 4352 wrote to memory of 1484 4352 4508.tmp 84 PID 4352 wrote to memory of 1484 4352 4508.tmp 84 PID 1484 wrote to memory of 1940 1484 4585.tmp 85 PID 1484 wrote to memory of 1940 1484 4585.tmp 85 PID 1484 wrote to memory of 1940 1484 4585.tmp 85 PID 1940 wrote to memory of 3124 1940 45E2.tmp 86 PID 1940 wrote to memory of 3124 1940 45E2.tmp 86 PID 1940 wrote to memory of 3124 1940 45E2.tmp 86 PID 3124 wrote to memory of 4912 3124 465F.tmp 88 PID 3124 wrote to memory of 4912 3124 465F.tmp 88 PID 3124 wrote to memory of 4912 3124 465F.tmp 88 PID 4912 wrote to memory of 2636 4912 46DC.tmp 90 PID 4912 wrote to memory of 2636 4912 46DC.tmp 90 PID 4912 wrote to memory of 2636 4912 46DC.tmp 90 PID 2636 wrote to memory of 424 2636 474A.tmp 91 PID 2636 wrote to memory of 424 2636 474A.tmp 91 PID 2636 wrote to memory of 424 2636 474A.tmp 91 PID 424 wrote to memory of 4988 424 47C7.tmp 93 PID 424 wrote to memory of 4988 424 47C7.tmp 93 PID 424 wrote to memory of 4988 424 47C7.tmp 93 PID 4988 wrote to memory of 3232 4988 4834.tmp 94 PID 4988 wrote to memory of 3232 4988 4834.tmp 94 PID 4988 wrote to memory of 3232 4988 4834.tmp 94 PID 3232 wrote to memory of 1664 3232 4882.tmp 95 PID 3232 wrote to memory of 1664 3232 4882.tmp 95 PID 3232 wrote to memory of 1664 3232 4882.tmp 95 PID 1664 wrote to memory of 5068 1664 48D0.tmp 96 PID 1664 wrote to memory of 5068 1664 48D0.tmp 96 PID 1664 wrote to memory of 5068 1664 48D0.tmp 96 PID 5068 wrote to memory of 4416 5068 493E.tmp 97 PID 5068 wrote to memory of 4416 5068 493E.tmp 97 PID 5068 wrote to memory of 4416 5068 493E.tmp 97 PID 4416 wrote to memory of 1548 4416 49CA.tmp 98 PID 4416 wrote to memory of 1548 4416 49CA.tmp 98 PID 4416 wrote to memory of 1548 4416 49CA.tmp 98 PID 1548 wrote to memory of 2692 1548 4A47.tmp 99 PID 1548 wrote to memory of 2692 1548 4A47.tmp 99 PID 1548 wrote to memory of 2692 1548 4A47.tmp 99 PID 2692 wrote to memory of 4484 2692 4A96.tmp 100 PID 2692 wrote to memory of 4484 2692 4A96.tmp 100 PID 2692 wrote to memory of 4484 2692 4A96.tmp 100 PID 4484 wrote to memory of 3828 4484 4B03.tmp 101 PID 4484 wrote to memory of 3828 4484 4B03.tmp 101 PID 4484 wrote to memory of 3828 4484 4B03.tmp 101 PID 3828 wrote to memory of 3160 3828 4B61.tmp 102 PID 3828 wrote to memory of 3160 3828 4B61.tmp 102 PID 3828 wrote to memory of 3160 3828 4B61.tmp 102 PID 3160 wrote to memory of 4532 3160 4BCE.tmp 103 PID 3160 wrote to memory of 4532 3160 4BCE.tmp 103 PID 3160 wrote to memory of 4532 3160 4BCE.tmp 103 PID 4532 wrote to memory of 4636 4532 4C3B.tmp 104 PID 4532 wrote to memory of 4636 4532 4C3B.tmp 104 PID 4532 wrote to memory of 4636 4532 4C3B.tmp 104 PID 4636 wrote to memory of 2344 4636 4CA9.tmp 105 PID 4636 wrote to memory of 2344 4636 4CA9.tmp 105 PID 4636 wrote to memory of 2344 4636 4CA9.tmp 105 PID 2344 wrote to memory of 5044 2344 4D45.tmp 106 PID 2344 wrote to memory of 5044 2344 4D45.tmp 106 PID 2344 wrote to memory of 5044 2344 4D45.tmp 106 PID 5044 wrote to memory of 1512 5044 4DC2.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-02_d5ae902cacb2edae0d10575bfa11d027_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-02_d5ae902cacb2edae0d10575bfa11d027_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"23⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"24⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"25⤵
- Executes dropped EXE
PID:804 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"26⤵
- Executes dropped EXE
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"27⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"28⤵
- Executes dropped EXE
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"29⤵
- Executes dropped EXE
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"30⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"31⤵
- Executes dropped EXE
PID:664 -
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"32⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"33⤵
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"34⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"35⤵
- Executes dropped EXE
PID:912 -
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"36⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"37⤵
- Executes dropped EXE
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"38⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"39⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"40⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"41⤵
- Executes dropped EXE
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"42⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"43⤵
- Executes dropped EXE
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"44⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"45⤵
- Executes dropped EXE
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"46⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"47⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"48⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"49⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"50⤵
- Executes dropped EXE
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"51⤵
- Executes dropped EXE
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"52⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"53⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"54⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"55⤵
- Executes dropped EXE
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"56⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"57⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"58⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"59⤵
- Executes dropped EXE
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"60⤵
- Executes dropped EXE
PID:424 -
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"61⤵
- Executes dropped EXE
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"62⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"63⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"64⤵
- Executes dropped EXE
PID:868 -
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"65⤵
- Executes dropped EXE
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"66⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"67⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"68⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"69⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"70⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"71⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"72⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"73⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"74⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"75⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"76⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"77⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"78⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"79⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"80⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"81⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"82⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"83⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"84⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"85⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"86⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"87⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"88⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"89⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"90⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"91⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"92⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"93⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"94⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"95⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"96⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"97⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"98⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"99⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"100⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"101⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"102⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"103⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"104⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"105⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"106⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"107⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"108⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"109⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"110⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"111⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"112⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"113⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"114⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"115⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"116⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"117⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"118⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"119⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"120⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"121⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"122⤵PID:3124
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-