Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/01/2024, 00:44
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-25_285eea86897595d1a2b2902d7fa46415_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-25_285eea86897595d1a2b2902d7fa46415_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-25_285eea86897595d1a2b2902d7fa46415_mafia.exe
-
Size
527KB
-
MD5
285eea86897595d1a2b2902d7fa46415
-
SHA1
4e00d4f04a0857bc9991526f13bb88a88e04cdea
-
SHA256
1999716cf6a0ccf81941b5110f8ad6b02c5b4b0c7f5b168d05ecf89d30715beb
-
SHA512
6f0532cb9204e091e1fff64eedb0f4181fb5e140c80db31c0cff8964cbce75874c4d7f298ebdb25f16016614697cabbec052152f913b140a2e0b1d12e8c9b99b
-
SSDEEP
12288:fU5rCOTeidmNpqvNnIiTITuxzbLg6a1DZu:fUQOJdsqvN3TITuxzfg6sDo
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4632 4B70.tmp 1952 4BED.tmp 4376 4C4B.tmp 1636 4CC8.tmp 1844 4D16.tmp 2036 4D64.tmp 2312 4DB2.tmp 3132 4E10.tmp 3528 5A74.tmp 3816 4EDB.tmp 4040 4F29.tmp 4936 4F87.tmp 1352 4FD5.tmp 2344 5033.tmp 1932 5081.tmp 4508 50CF.tmp 876 511D.tmp 2320 516C.tmp 1100 51BA.tmp 640 5208.tmp 4568 5266.tmp 2408 52B4.tmp 4600 5302.tmp 4108 5340.tmp 4828 539E.tmp 3904 53FC.tmp 3304 544A.tmp 4776 5498.tmp 3556 54E6.tmp 4324 5534.tmp 4056 55A2.tmp 4840 55F0.tmp 2296 564E.tmp 2028 56AB.tmp 1456 56F9.tmp 2452 5757.tmp 1484 57A5.tmp 4944 57F3.tmp 1080 5842.tmp 3788 589F.tmp 4244 58ED.tmp 4120 593C.tmp 4432 598A.tmp 3728 59D8.tmp 3208 5A26.tmp 3528 5A74.tmp 2536 5AC2.tmp 3288 5B01.tmp 4552 5B4F.tmp 1896 5B9D.tmp 3880 5BEB.tmp 1020 5C49.tmp 3704 5CA7.tmp 4148 5CF5.tmp 2500 5D72.tmp 3272 5DDF.tmp 1912 5E8B.tmp 4856 5F37.tmp 3988 5FC3.tmp 1464 6040.tmp 4268 613A.tmp 368 6198.tmp 520 61E6.tmp 4468 6244.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2144 wrote to memory of 4632 2144 2024-01-25_285eea86897595d1a2b2902d7fa46415_mafia.exe 87 PID 2144 wrote to memory of 4632 2144 2024-01-25_285eea86897595d1a2b2902d7fa46415_mafia.exe 87 PID 2144 wrote to memory of 4632 2144 2024-01-25_285eea86897595d1a2b2902d7fa46415_mafia.exe 87 PID 4632 wrote to memory of 1952 4632 4B70.tmp 89 PID 4632 wrote to memory of 1952 4632 4B70.tmp 89 PID 4632 wrote to memory of 1952 4632 4B70.tmp 89 PID 1952 wrote to memory of 4376 1952 4BED.tmp 90 PID 1952 wrote to memory of 4376 1952 4BED.tmp 90 PID 1952 wrote to memory of 4376 1952 4BED.tmp 90 PID 4376 wrote to memory of 1636 4376 4C4B.tmp 92 PID 4376 wrote to memory of 1636 4376 4C4B.tmp 92 PID 4376 wrote to memory of 1636 4376 4C4B.tmp 92 PID 1636 wrote to memory of 1844 1636 4CC8.tmp 93 PID 1636 wrote to memory of 1844 1636 4CC8.tmp 93 PID 1636 wrote to memory of 1844 1636 4CC8.tmp 93 PID 1844 wrote to memory of 2036 1844 4D16.tmp 96 PID 1844 wrote to memory of 2036 1844 4D16.tmp 96 PID 1844 wrote to memory of 2036 1844 4D16.tmp 96 PID 2036 wrote to memory of 2312 2036 4D64.tmp 94 PID 2036 wrote to memory of 2312 2036 4D64.tmp 94 PID 2036 wrote to memory of 2312 2036 4D64.tmp 94 PID 2312 wrote to memory of 3132 2312 4DB2.tmp 95 PID 2312 wrote to memory of 3132 2312 4DB2.tmp 95 PID 2312 wrote to memory of 3132 2312 4DB2.tmp 95 PID 3132 wrote to memory of 3528 3132 4E10.tmp 127 PID 3132 wrote to memory of 3528 3132 4E10.tmp 127 PID 3132 wrote to memory of 3528 3132 4E10.tmp 127 PID 3528 wrote to memory of 3816 3528 5A74.tmp 98 PID 3528 wrote to memory of 3816 3528 5A74.tmp 98 PID 3528 wrote to memory of 3816 3528 5A74.tmp 98 PID 3816 wrote to memory of 4040 3816 4EDB.tmp 99 PID 3816 wrote to memory of 4040 3816 4EDB.tmp 99 PID 3816 wrote to memory of 4040 3816 4EDB.tmp 99 PID 4040 wrote to memory of 4936 4040 4F29.tmp 100 PID 4040 wrote to memory of 4936 4040 4F29.tmp 100 PID 4040 wrote to memory of 4936 4040 4F29.tmp 100 PID 4936 wrote to memory of 1352 4936 4F87.tmp 104 PID 4936 wrote to memory of 1352 4936 4F87.tmp 104 PID 4936 wrote to memory of 1352 4936 4F87.tmp 104 PID 1352 wrote to memory of 2344 1352 4FD5.tmp 101 PID 1352 wrote to memory of 2344 1352 4FD5.tmp 101 PID 1352 wrote to memory of 2344 1352 4FD5.tmp 101 PID 2344 wrote to memory of 1932 2344 5033.tmp 102 PID 2344 wrote to memory of 1932 2344 5033.tmp 102 PID 2344 wrote to memory of 1932 2344 5033.tmp 102 PID 1932 wrote to memory of 4508 1932 5081.tmp 103 PID 1932 wrote to memory of 4508 1932 5081.tmp 103 PID 1932 wrote to memory of 4508 1932 5081.tmp 103 PID 4508 wrote to memory of 876 4508 50CF.tmp 144 PID 4508 wrote to memory of 876 4508 50CF.tmp 144 PID 4508 wrote to memory of 876 4508 50CF.tmp 144 PID 876 wrote to memory of 2320 876 511D.tmp 105 PID 876 wrote to memory of 2320 876 511D.tmp 105 PID 876 wrote to memory of 2320 876 511D.tmp 105 PID 2320 wrote to memory of 1100 2320 516C.tmp 143 PID 2320 wrote to memory of 1100 2320 516C.tmp 143 PID 2320 wrote to memory of 1100 2320 516C.tmp 143 PID 1100 wrote to memory of 640 1100 51BA.tmp 142 PID 1100 wrote to memory of 640 1100 51BA.tmp 142 PID 1100 wrote to memory of 640 1100 51BA.tmp 142 PID 640 wrote to memory of 4568 640 5208.tmp 141 PID 640 wrote to memory of 4568 640 5208.tmp 141 PID 640 wrote to memory of 4568 640 5208.tmp 141 PID 4568 wrote to memory of 2408 4568 5266.tmp 139
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_285eea86897595d1a2b2902d7fa46415_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_285eea86897595d1a2b2902d7fa46415_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"3⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100
-
-
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"1⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"2⤵
- Executes dropped EXE
PID:4828
-
-
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"1⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"2⤵
- Executes dropped EXE
PID:3304
-
-
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"1⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"2⤵
- Executes dropped EXE
PID:3556
-
-
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"1⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"2⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"3⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"4⤵
- Executes dropped EXE
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"5⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"6⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"7⤵
- Executes dropped EXE
PID:1080
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"1⤵
- Executes dropped EXE
PID:4840
-
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"1⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"2⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"3⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"4⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"5⤵
- Executes dropped EXE
PID:3208
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"1⤵
- Executes dropped EXE
PID:3788
-
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"2⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"3⤵
- Executes dropped EXE
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"4⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"5⤵
- Executes dropped EXE
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"6⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"7⤵
- Executes dropped EXE
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"8⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"9⤵
- Executes dropped EXE
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"10⤵
- Executes dropped EXE
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"11⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"12⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"13⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"14⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"15⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"16⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"17⤵
- Executes dropped EXE
PID:368 -
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"18⤵
- Executes dropped EXE
PID:520 -
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"19⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"20⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"21⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"22⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"23⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"24⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"25⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"26⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"27⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"28⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"29⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"30⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"31⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"32⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"33⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"34⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"35⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"36⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"37⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"38⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"39⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"40⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"41⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"42⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"43⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"44⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"45⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"46⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"47⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"48⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"49⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"50⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"51⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"52⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"53⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"54⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"55⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"56⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"57⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"58⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"59⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"60⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"61⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"62⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"63⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\7177.tmp"C:\Users\Admin\AppData\Local\Temp\7177.tmp"64⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"65⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"66⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"67⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"68⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"69⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"70⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"71⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"72⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"73⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\74C2.tmp"C:\Users\Admin\AppData\Local\Temp\74C2.tmp"74⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"75⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"76⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"77⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"78⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"79⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"80⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\7724.tmp"C:\Users\Admin\AppData\Local\Temp\7724.tmp"81⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\7772.tmp"C:\Users\Admin\AppData\Local\Temp\7772.tmp"82⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"83⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"84⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"85⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"86⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\7927.tmp"C:\Users\Admin\AppData\Local\Temp\7927.tmp"87⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"88⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"89⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"90⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"91⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"92⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"93⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\7B98.tmp"C:\Users\Admin\AppData\Local\Temp\7B98.tmp"94⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"95⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\7C44.tmp"C:\Users\Admin\AppData\Local\Temp\7C44.tmp"96⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\7C92.tmp"C:\Users\Admin\AppData\Local\Temp\7C92.tmp"97⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"98⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"99⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"100⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"101⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"102⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\7E67.tmp"C:\Users\Admin\AppData\Local\Temp\7E67.tmp"103⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"104⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\7F03.tmp"C:\Users\Admin\AppData\Local\Temp\7F03.tmp"105⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\7F52.tmp"C:\Users\Admin\AppData\Local\Temp\7F52.tmp"106⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"107⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"108⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\803C.tmp"C:\Users\Admin\AppData\Local\Temp\803C.tmp"109⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\809A.tmp"C:\Users\Admin\AppData\Local\Temp\809A.tmp"110⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\80E8.tmp"C:\Users\Admin\AppData\Local\Temp\80E8.tmp"111⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\8155.tmp"C:\Users\Admin\AppData\Local\Temp\8155.tmp"112⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\8194.tmp"C:\Users\Admin\AppData\Local\Temp\8194.tmp"113⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\81E2.tmp"C:\Users\Admin\AppData\Local\Temp\81E2.tmp"114⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\8240.tmp"C:\Users\Admin\AppData\Local\Temp\8240.tmp"115⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\828E.tmp"C:\Users\Admin\AppData\Local\Temp\828E.tmp"116⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\82EB.tmp"C:\Users\Admin\AppData\Local\Temp\82EB.tmp"117⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\8349.tmp"C:\Users\Admin\AppData\Local\Temp\8349.tmp"118⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"119⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\83F5.tmp"C:\Users\Admin\AppData\Local\Temp\83F5.tmp"120⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"121⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\84A1.tmp"C:\Users\Admin\AppData\Local\Temp\84A1.tmp"122⤵PID:2704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-