Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 05:42
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-11_6553ac0beeb055794f11f6c06f6c2b51_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-11_6553ac0beeb055794f11f6c06f6c2b51_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-11_6553ac0beeb055794f11f6c06f6c2b51_mafia.exe
-
Size
488KB
-
MD5
6553ac0beeb055794f11f6c06f6c2b51
-
SHA1
72fdd466a0b0e79c2b84c66aa748402e1a85b122
-
SHA256
559fab148e8600d93cb57676e7cd95239a1e3ef358d09a2be22f4cbc3015099b
-
SHA512
0953e2a82bbb5a4014afbe52847d30270bfcec114c2a4aeb617dc5701c119c64853e38119b674df0d31851f203576a1a199c541b0d973a6aaba8b2ae04ee2f3f
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7fHMuUk58TMKoPqDZDNFPPT4PzZFHsvnARpS9:/U5rCOTeiDfHrv5yDZDNBCjHEOutNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5016 47B7.tmp 1976 4834.tmp 1972 48B1.tmp 1988 491F.tmp 4860 49AB.tmp 2948 4A09.tmp 3016 4A76.tmp 388 4AC4.tmp 4848 4B22.tmp 2440 4B80.tmp 2260 4BFD.tmp 1168 4C4B.tmp 3220 4CD8.tmp 4784 4D26.tmp 624 4D84.tmp 1784 4DD2.tmp 4124 4E20.tmp 1604 4E8D.tmp 4692 4F0A.tmp 1644 4F87.tmp 396 5004.tmp 752 5062.tmp 2064 50C0.tmp 3796 511D.tmp 440 516C.tmp 4804 51BA.tmp 2092 5237.tmp 2704 52A4.tmp 868 5321.tmp 628 539E.tmp 3036 53FC.tmp 3600 545A.tmp 2024 54C7.tmp 2576 5515.tmp 1412 5573.tmp 4500 55C1.tmp 4068 562E.tmp 920 567C.tmp 400 56CB.tmp 1592 5719.tmp 812 5776.tmp 4472 57C5.tmp 4744 5822.tmp 2588 5880.tmp 4328 58DE.tmp 1164 592C.tmp 1200 598A.tmp 1676 59E7.tmp 448 5A36.tmp 2572 5A93.tmp 4396 5AF1.tmp 3416 5B5E.tmp 3324 5BAD.tmp 5104 5BFB.tmp 4416 5C58.tmp 1988 5CB6.tmp 2368 5D14.tmp 4384 5D62.tmp 976 5DC0.tmp 668 5E1E.tmp 1692 5E7B.tmp 5100 5ED9.tmp 1176 5F37.tmp 2380 5F85.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 644 wrote to memory of 5016 644 2024-05-11_6553ac0beeb055794f11f6c06f6c2b51_mafia.exe 83 PID 644 wrote to memory of 5016 644 2024-05-11_6553ac0beeb055794f11f6c06f6c2b51_mafia.exe 83 PID 644 wrote to memory of 5016 644 2024-05-11_6553ac0beeb055794f11f6c06f6c2b51_mafia.exe 83 PID 5016 wrote to memory of 1976 5016 47B7.tmp 85 PID 5016 wrote to memory of 1976 5016 47B7.tmp 85 PID 5016 wrote to memory of 1976 5016 47B7.tmp 85 PID 1976 wrote to memory of 1972 1976 4834.tmp 87 PID 1976 wrote to memory of 1972 1976 4834.tmp 87 PID 1976 wrote to memory of 1972 1976 4834.tmp 87 PID 1972 wrote to memory of 1988 1972 48B1.tmp 88 PID 1972 wrote to memory of 1988 1972 48B1.tmp 88 PID 1972 wrote to memory of 1988 1972 48B1.tmp 88 PID 1988 wrote to memory of 4860 1988 491F.tmp 89 PID 1988 wrote to memory of 4860 1988 491F.tmp 89 PID 1988 wrote to memory of 4860 1988 491F.tmp 89 PID 4860 wrote to memory of 2948 4860 49AB.tmp 90 PID 4860 wrote to memory of 2948 4860 49AB.tmp 90 PID 4860 wrote to memory of 2948 4860 49AB.tmp 90 PID 2948 wrote to memory of 3016 2948 4A09.tmp 91 PID 2948 wrote to memory of 3016 2948 4A09.tmp 91 PID 2948 wrote to memory of 3016 2948 4A09.tmp 91 PID 3016 wrote to memory of 388 3016 4A76.tmp 92 PID 3016 wrote to memory of 388 3016 4A76.tmp 92 PID 3016 wrote to memory of 388 3016 4A76.tmp 92 PID 388 wrote to memory of 4848 388 4AC4.tmp 93 PID 388 wrote to memory of 4848 388 4AC4.tmp 93 PID 388 wrote to memory of 4848 388 4AC4.tmp 93 PID 4848 wrote to memory of 2440 4848 4B22.tmp 94 PID 4848 wrote to memory of 2440 4848 4B22.tmp 94 PID 4848 wrote to memory of 2440 4848 4B22.tmp 94 PID 2440 wrote to memory of 2260 2440 4B80.tmp 95 PID 2440 wrote to memory of 2260 2440 4B80.tmp 95 PID 2440 wrote to memory of 2260 2440 4B80.tmp 95 PID 2260 wrote to memory of 1168 2260 4BFD.tmp 96 PID 2260 wrote to memory of 1168 2260 4BFD.tmp 96 PID 2260 wrote to memory of 1168 2260 4BFD.tmp 96 PID 1168 wrote to memory of 3220 1168 4C4B.tmp 97 PID 1168 wrote to memory of 3220 1168 4C4B.tmp 97 PID 1168 wrote to memory of 3220 1168 4C4B.tmp 97 PID 3220 wrote to memory of 4784 3220 4CD8.tmp 99 PID 3220 wrote to memory of 4784 3220 4CD8.tmp 99 PID 3220 wrote to memory of 4784 3220 4CD8.tmp 99 PID 4784 wrote to memory of 624 4784 4D26.tmp 100 PID 4784 wrote to memory of 624 4784 4D26.tmp 100 PID 4784 wrote to memory of 624 4784 4D26.tmp 100 PID 624 wrote to memory of 1784 624 4D84.tmp 102 PID 624 wrote to memory of 1784 624 4D84.tmp 102 PID 624 wrote to memory of 1784 624 4D84.tmp 102 PID 1784 wrote to memory of 4124 1784 4DD2.tmp 103 PID 1784 wrote to memory of 4124 1784 4DD2.tmp 103 PID 1784 wrote to memory of 4124 1784 4DD2.tmp 103 PID 4124 wrote to memory of 1604 4124 4E20.tmp 104 PID 4124 wrote to memory of 1604 4124 4E20.tmp 104 PID 4124 wrote to memory of 1604 4124 4E20.tmp 104 PID 1604 wrote to memory of 4692 1604 4E8D.tmp 105 PID 1604 wrote to memory of 4692 1604 4E8D.tmp 105 PID 1604 wrote to memory of 4692 1604 4E8D.tmp 105 PID 4692 wrote to memory of 1644 4692 4F0A.tmp 107 PID 4692 wrote to memory of 1644 4692 4F0A.tmp 107 PID 4692 wrote to memory of 1644 4692 4F0A.tmp 107 PID 1644 wrote to memory of 396 1644 4F87.tmp 108 PID 1644 wrote to memory of 396 1644 4F87.tmp 108 PID 1644 wrote to memory of 396 1644 4F87.tmp 108 PID 396 wrote to memory of 752 396 5004.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-11_6553ac0beeb055794f11f6c06f6c2b51_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-11_6553ac0beeb055794f11f6c06f6c2b51_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\48B1.tmp"C:\Users\Admin\AppData\Local\Temp\48B1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"23⤵
- Executes dropped EXE
PID:752 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"24⤵
- Executes dropped EXE
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"25⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"26⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"27⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"28⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"29⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"30⤵
- Executes dropped EXE
PID:868 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"31⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"32⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"33⤵
- Executes dropped EXE
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"34⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"35⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"36⤵
- Executes dropped EXE
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"37⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"38⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"39⤵
- Executes dropped EXE
PID:920 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"40⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"41⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"42⤵
- Executes dropped EXE
PID:812 -
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"43⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"44⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"45⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"46⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"47⤵
- Executes dropped EXE
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"48⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"49⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"50⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"51⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"52⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"53⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"54⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"55⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"56⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"57⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"58⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"59⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"60⤵
- Executes dropped EXE
PID:976 -
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"61⤵
- Executes dropped EXE
PID:668 -
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"62⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"63⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"64⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"65⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"66⤵PID:184
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"67⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"68⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"69⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"70⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"71⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"72⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"73⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"74⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"75⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"76⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"77⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"78⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"79⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"80⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"81⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"82⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"83⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"84⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"85⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"86⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"87⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"88⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"89⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"90⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"91⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"92⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"93⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"94⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"95⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"96⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"97⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"98⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"99⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"100⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"101⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"102⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\6C56.tmp"C:\Users\Admin\AppData\Local\Temp\6C56.tmp"103⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"104⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"105⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"106⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"107⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"108⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"109⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"110⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"111⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"112⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"113⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"114⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"115⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"116⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\70DA.tmp"C:\Users\Admin\AppData\Local\Temp\70DA.tmp"117⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"118⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"119⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"120⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"121⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\7290.tmp"C:\Users\Admin\AppData\Local\Temp\7290.tmp"122⤵PID:3824
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-