Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
27/01/2024, 22:55
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-27_de892a449efe04833129632ba3c4b608_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-27_de892a449efe04833129632ba3c4b608_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-27_de892a449efe04833129632ba3c4b608_mafia.exe
-
Size
488KB
-
MD5
de892a449efe04833129632ba3c4b608
-
SHA1
f3445beab6cec43d77e7aa37c86ef1fb843443d5
-
SHA256
3f8f1227c495160f71ba35b96d197383a288c6deee903bc7ad900b2d60f05ab0
-
SHA512
dde6bb50fd7b16affbdcd13b9d34e8a49cf1d470bb0b53777cd50c52cb23f989874b9c522830659ce5aab547604e5102787a4fdcfebca5536364545821215f2e
-
SSDEEP
12288:/U5rCOTeiD2uv6fwxoJI0BvTLPwLu62NZ:/UQOJD2w6VvZTDwKTN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2496 B56.tmp 2000 BA4.tmp 2340 C02.tmp 2748 C40.tmp 2828 C8E.tmp 2752 CCD.tmp 2088 D1B.tmp 2640 D69.tmp 2780 DB7.tmp 2604 E14.tmp 2676 E53.tmp 2392 EA1.tmp 2492 EDF.tmp 2992 F1E.tmp 1720 F6C.tmp 2880 FBA.tmp 1260 1008.tmp 1648 1046.tmp 1436 1084.tmp 2592 10C3.tmp 2940 1101.tmp 1584 1140.tmp 856 117E.tmp 1232 11CC.tmp 2240 120A.tmp 2092 1249.tmp 2028 1287.tmp 2056 12C6.tmp 3032 1304.tmp 2060 1342.tmp 336 1381.tmp 788 13BF.tmp 1488 13FE.tmp 1472 143C.tmp 1856 148A.tmp 1804 14C8.tmp 1752 1507.tmp 1088 1545.tmp 2252 1584.tmp 1964 15C2.tmp 1440 1600.tmp 1768 163F.tmp 760 167D.tmp 328 16BC.tmp 2860 16EA.tmp 916 1719.tmp 2444 1758.tmp 3064 1796.tmp 1064 17D4.tmp 3012 1813.tmp 1988 1851.tmp 1504 1890.tmp 2324 18CE.tmp 2568 190C.tmp 1596 194B.tmp 1604 1989.tmp 1532 19B8.tmp 764 19F6.tmp 2440 1A35.tmp 2764 1A73.tmp 2420 1AB2.tmp 3028 1AF0.tmp 2832 1B2E.tmp 2752 CCD.tmp -
Loads dropped DLL 64 IoCs
pid Process 2560 2024-01-27_de892a449efe04833129632ba3c4b608_mafia.exe 2496 B56.tmp 2000 BA4.tmp 2340 C02.tmp 2748 C40.tmp 2828 C8E.tmp 2752 CCD.tmp 2088 D1B.tmp 2640 D69.tmp 2780 DB7.tmp 2604 E14.tmp 2676 E53.tmp 2392 EA1.tmp 2492 EDF.tmp 2992 F1E.tmp 1720 F6C.tmp 2880 FBA.tmp 1260 1008.tmp 1648 1046.tmp 1436 1084.tmp 2592 10C3.tmp 2940 1101.tmp 1584 1140.tmp 856 117E.tmp 1232 11CC.tmp 2240 120A.tmp 2092 1249.tmp 2028 1287.tmp 2056 12C6.tmp 3032 1304.tmp 2060 1342.tmp 336 1381.tmp 788 13BF.tmp 1488 13FE.tmp 1472 143C.tmp 1856 148A.tmp 1804 14C8.tmp 1752 1507.tmp 1088 1545.tmp 2252 1584.tmp 1964 15C2.tmp 1440 1600.tmp 1768 163F.tmp 760 167D.tmp 328 16BC.tmp 2860 16EA.tmp 916 1719.tmp 2444 1758.tmp 3064 1796.tmp 1064 17D4.tmp 3012 1813.tmp 1988 1851.tmp 1504 1890.tmp 2324 18CE.tmp 2568 190C.tmp 1596 194B.tmp 1604 1989.tmp 1532 19B8.tmp 764 19F6.tmp 2440 1A35.tmp 2764 1A73.tmp 2420 1AB2.tmp 3028 1AF0.tmp 2832 1B2E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2560 wrote to memory of 2496 2560 2024-01-27_de892a449efe04833129632ba3c4b608_mafia.exe 28 PID 2560 wrote to memory of 2496 2560 2024-01-27_de892a449efe04833129632ba3c4b608_mafia.exe 28 PID 2560 wrote to memory of 2496 2560 2024-01-27_de892a449efe04833129632ba3c4b608_mafia.exe 28 PID 2560 wrote to memory of 2496 2560 2024-01-27_de892a449efe04833129632ba3c4b608_mafia.exe 28 PID 2496 wrote to memory of 2000 2496 B56.tmp 29 PID 2496 wrote to memory of 2000 2496 B56.tmp 29 PID 2496 wrote to memory of 2000 2496 B56.tmp 29 PID 2496 wrote to memory of 2000 2496 B56.tmp 29 PID 2000 wrote to memory of 2340 2000 BA4.tmp 30 PID 2000 wrote to memory of 2340 2000 BA4.tmp 30 PID 2000 wrote to memory of 2340 2000 BA4.tmp 30 PID 2000 wrote to memory of 2340 2000 BA4.tmp 30 PID 2340 wrote to memory of 2748 2340 C02.tmp 32 PID 2340 wrote to memory of 2748 2340 C02.tmp 32 PID 2340 wrote to memory of 2748 2340 C02.tmp 32 PID 2340 wrote to memory of 2748 2340 C02.tmp 32 PID 2748 wrote to memory of 2828 2748 C40.tmp 31 PID 2748 wrote to memory of 2828 2748 C40.tmp 31 PID 2748 wrote to memory of 2828 2748 C40.tmp 31 PID 2748 wrote to memory of 2828 2748 C40.tmp 31 PID 2828 wrote to memory of 2752 2828 C8E.tmp 94 PID 2828 wrote to memory of 2752 2828 C8E.tmp 94 PID 2828 wrote to memory of 2752 2828 C8E.tmp 94 PID 2828 wrote to memory of 2752 2828 C8E.tmp 94 PID 2752 wrote to memory of 2088 2752 CCD.tmp 33 PID 2752 wrote to memory of 2088 2752 CCD.tmp 33 PID 2752 wrote to memory of 2088 2752 CCD.tmp 33 PID 2752 wrote to memory of 2088 2752 CCD.tmp 33 PID 2088 wrote to memory of 2640 2088 D1B.tmp 93 PID 2088 wrote to memory of 2640 2088 D1B.tmp 93 PID 2088 wrote to memory of 2640 2088 D1B.tmp 93 PID 2088 wrote to memory of 2640 2088 D1B.tmp 93 PID 2640 wrote to memory of 2780 2640 D69.tmp 92 PID 2640 wrote to memory of 2780 2640 D69.tmp 92 PID 2640 wrote to memory of 2780 2640 D69.tmp 92 PID 2640 wrote to memory of 2780 2640 D69.tmp 92 PID 2780 wrote to memory of 2604 2780 DB7.tmp 91 PID 2780 wrote to memory of 2604 2780 DB7.tmp 91 PID 2780 wrote to memory of 2604 2780 DB7.tmp 91 PID 2780 wrote to memory of 2604 2780 DB7.tmp 91 PID 2604 wrote to memory of 2676 2604 E14.tmp 90 PID 2604 wrote to memory of 2676 2604 E14.tmp 90 PID 2604 wrote to memory of 2676 2604 E14.tmp 90 PID 2604 wrote to memory of 2676 2604 E14.tmp 90 PID 2676 wrote to memory of 2392 2676 E53.tmp 89 PID 2676 wrote to memory of 2392 2676 E53.tmp 89 PID 2676 wrote to memory of 2392 2676 E53.tmp 89 PID 2676 wrote to memory of 2392 2676 E53.tmp 89 PID 2392 wrote to memory of 2492 2392 EA1.tmp 34 PID 2392 wrote to memory of 2492 2392 EA1.tmp 34 PID 2392 wrote to memory of 2492 2392 EA1.tmp 34 PID 2392 wrote to memory of 2492 2392 EA1.tmp 34 PID 2492 wrote to memory of 2992 2492 EDF.tmp 88 PID 2492 wrote to memory of 2992 2492 EDF.tmp 88 PID 2492 wrote to memory of 2992 2492 EDF.tmp 88 PID 2492 wrote to memory of 2992 2492 EDF.tmp 88 PID 2992 wrote to memory of 1720 2992 F1E.tmp 35 PID 2992 wrote to memory of 1720 2992 F1E.tmp 35 PID 2992 wrote to memory of 1720 2992 F1E.tmp 35 PID 2992 wrote to memory of 1720 2992 F1E.tmp 35 PID 1720 wrote to memory of 2880 1720 F6C.tmp 87 PID 1720 wrote to memory of 2880 1720 F6C.tmp 87 PID 1720 wrote to memory of 2880 1720 F6C.tmp 87 PID 1720 wrote to memory of 2880 1720 F6C.tmp 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-27_de892a449efe04833129632ba3c4b608_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-27_de892a449efe04833129632ba3c4b608_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\B56.tmp"C:\Users\Admin\AppData\Local\Temp\B56.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\BA4.tmp"C:\Users\Admin\AppData\Local\Temp\BA4.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\C02.tmp"C:\Users\Admin\AppData\Local\Temp\C02.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\C40.tmp"C:\Users\Admin\AppData\Local\Temp\C40.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\C8E.tmp"C:\Users\Admin\AppData\Local\Temp\C8E.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\CCD.tmp"C:\Users\Admin\AppData\Local\Temp\CCD.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752
-
-
C:\Users\Admin\AppData\Local\Temp\D1B.tmp"C:\Users\Admin\AppData\Local\Temp\D1B.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\D69.tmp"C:\Users\Admin\AppData\Local\Temp\D69.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640
-
-
C:\Users\Admin\AppData\Local\Temp\EDF.tmp"C:\Users\Admin\AppData\Local\Temp\EDF.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2992
-
-
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880
-
-
C:\Users\Admin\AppData\Local\Temp\1140.tmp"C:\Users\Admin\AppData\Local\Temp\1140.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\117E.tmp"C:\Users\Admin\AppData\Local\Temp\117E.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\11CC.tmp"C:\Users\Admin\AppData\Local\Temp\11CC.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1232
-
-
-
C:\Users\Admin\AppData\Local\Temp\1249.tmp"C:\Users\Admin\AppData\Local\Temp\1249.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\1287.tmp"C:\Users\Admin\AppData\Local\Temp\1287.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028
-
-
C:\Users\Admin\AppData\Local\Temp\12C6.tmp"C:\Users\Admin\AppData\Local\Temp\12C6.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\1304.tmp"C:\Users\Admin\AppData\Local\Temp\1304.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032
-
-
C:\Users\Admin\AppData\Local\Temp\1342.tmp"C:\Users\Admin\AppData\Local\Temp\1342.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\1381.tmp"C:\Users\Admin\AppData\Local\Temp\1381.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:336
-
-
C:\Users\Admin\AppData\Local\Temp\13FE.tmp"C:\Users\Admin\AppData\Local\Temp\13FE.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\143C.tmp"C:\Users\Admin\AppData\Local\Temp\143C.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\148A.tmp"C:\Users\Admin\AppData\Local\Temp\148A.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856
-
-
-
C:\Users\Admin\AppData\Local\Temp\14C8.tmp"C:\Users\Admin\AppData\Local\Temp\14C8.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\1507.tmp"C:\Users\Admin\AppData\Local\Temp\1507.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\1545.tmp"C:\Users\Admin\AppData\Local\Temp\1545.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\1584.tmp"C:\Users\Admin\AppData\Local\Temp\1584.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\15C2.tmp"C:\Users\Admin\AppData\Local\Temp\15C2.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1600.tmp"C:\Users\Admin\AppData\Local\Temp\1600.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\163F.tmp"C:\Users\Admin\AppData\Local\Temp\163F.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768
-
-
C:\Users\Admin\AppData\Local\Temp\16BC.tmp"C:\Users\Admin\AppData\Local\Temp\16BC.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:328 -
C:\Users\Admin\AppData\Local\Temp\16EA.tmp"C:\Users\Admin\AppData\Local\Temp\16EA.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860
-
-
C:\Users\Admin\AppData\Local\Temp\167D.tmp"C:\Users\Admin\AppData\Local\Temp\167D.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:760
-
C:\Users\Admin\AppData\Local\Temp\1796.tmp"C:\Users\Admin\AppData\Local\Temp\1796.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\17D4.tmp"C:\Users\Admin\AppData\Local\Temp\17D4.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\1813.tmp"C:\Users\Admin\AppData\Local\Temp\1813.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012
-
-
-
C:\Users\Admin\AppData\Local\Temp\1890.tmp"C:\Users\Admin\AppData\Local\Temp\1890.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\18CE.tmp"C:\Users\Admin\AppData\Local\Temp\18CE.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324
-
-
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988
-
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596
-
-
C:\Users\Admin\AppData\Local\Temp\19B8.tmp"C:\Users\Admin\AppData\Local\Temp\19B8.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\19F6.tmp"C:\Users\Admin\AppData\Local\Temp\19F6.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764 -
C:\Users\Admin\AppData\Local\Temp\1A35.tmp"C:\Users\Admin\AppData\Local\Temp\1A35.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\1A73.tmp"C:\Users\Admin\AppData\Local\Temp\1A73.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604
-
C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"4⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"5⤵PID:2400
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1758.tmp"C:\Users\Admin\AppData\Local\Temp\1758.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444
-
C:\Users\Admin\AppData\Local\Temp\1719.tmp"C:\Users\Admin\AppData\Local\Temp\1719.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:916
-
C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"1⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\1C28.tmp"C:\Users\Admin\AppData\Local\Temp\1C28.tmp"2⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\1C76.tmp"C:\Users\Admin\AppData\Local\Temp\1C76.tmp"3⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"4⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\1D22.tmp"C:\Users\Admin\AppData\Local\Temp\1D22.tmp"5⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"6⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"7⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"8⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\1E98.tmp"C:\Users\Admin\AppData\Local\Temp\1E98.tmp"9⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"10⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"11⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"12⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"13⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\206C.tmp"C:\Users\Admin\AppData\Local\Temp\206C.tmp"14⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"15⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"16⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\2127.tmp"C:\Users\Admin\AppData\Local\Temp\2127.tmp"17⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\2166.tmp"C:\Users\Admin\AppData\Local\Temp\2166.tmp"18⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\21A4.tmp"C:\Users\Admin\AppData\Local\Temp\21A4.tmp"19⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"20⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"21⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"22⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"23⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"24⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"25⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"26⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"27⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\23D6.tmp"C:\Users\Admin\AppData\Local\Temp\23D6.tmp"28⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"29⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"30⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"31⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"32⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"33⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"34⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"35⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"36⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"37⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"38⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"39⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"40⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"41⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\276E.tmp"C:\Users\Admin\AppData\Local\Temp\276E.tmp"42⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"43⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\27EB.tmp"C:\Users\Admin\AppData\Local\Temp\27EB.tmp"44⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\2829.tmp"C:\Users\Admin\AppData\Local\Temp\2829.tmp"45⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\2868.tmp"C:\Users\Admin\AppData\Local\Temp\2868.tmp"46⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\28A6.tmp"C:\Users\Admin\AppData\Local\Temp\28A6.tmp"47⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\28E4.tmp"C:\Users\Admin\AppData\Local\Temp\28E4.tmp"48⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"49⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"50⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"51⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"52⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"53⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"54⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"55⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"56⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\2B16.tmp"C:\Users\Admin\AppData\Local\Temp\2B16.tmp"57⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\2B64.tmp"C:\Users\Admin\AppData\Local\Temp\2B64.tmp"58⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"59⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"60⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"61⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"62⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"63⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"64⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\2D28.tmp"C:\Users\Admin\AppData\Local\Temp\2D28.tmp"65⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\2D67.tmp"C:\Users\Admin\AppData\Local\Temp\2D67.tmp"66⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"67⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"68⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\2E22.tmp"C:\Users\Admin\AppData\Local\Temp\2E22.tmp"69⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\2E60.tmp"C:\Users\Admin\AppData\Local\Temp\2E60.tmp"70⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"71⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\2EED.tmp"C:\Users\Admin\AppData\Local\Temp\2EED.tmp"72⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"73⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"74⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"75⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"76⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\3025.tmp"C:\Users\Admin\AppData\Local\Temp\3025.tmp"77⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\3063.tmp"C:\Users\Admin\AppData\Local\Temp\3063.tmp"78⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\30A2.tmp"C:\Users\Admin\AppData\Local\Temp\30A2.tmp"79⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\30E0.tmp"C:\Users\Admin\AppData\Local\Temp\30E0.tmp"80⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\311E.tmp"C:\Users\Admin\AppData\Local\Temp\311E.tmp"81⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\315D.tmp"C:\Users\Admin\AppData\Local\Temp\315D.tmp"82⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\319B.tmp"C:\Users\Admin\AppData\Local\Temp\319B.tmp"83⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\31DA.tmp"C:\Users\Admin\AppData\Local\Temp\31DA.tmp"84⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\3218.tmp"C:\Users\Admin\AppData\Local\Temp\3218.tmp"85⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"86⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\3295.tmp"C:\Users\Admin\AppData\Local\Temp\3295.tmp"87⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\32D3.tmp"C:\Users\Admin\AppData\Local\Temp\32D3.tmp"88⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\3312.tmp"C:\Users\Admin\AppData\Local\Temp\3312.tmp"89⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"90⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"91⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"92⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"93⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"94⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"95⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\34C6.tmp"C:\Users\Admin\AppData\Local\Temp\34C6.tmp"96⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"97⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\3543.tmp"C:\Users\Admin\AppData\Local\Temp\3543.tmp"98⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"99⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\35C0.tmp"C:\Users\Admin\AppData\Local\Temp\35C0.tmp"100⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\35FE.tmp"C:\Users\Admin\AppData\Local\Temp\35FE.tmp"101⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\363D.tmp"C:\Users\Admin\AppData\Local\Temp\363D.tmp"102⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\367B.tmp"C:\Users\Admin\AppData\Local\Temp\367B.tmp"103⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\36BA.tmp"C:\Users\Admin\AppData\Local\Temp\36BA.tmp"104⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\36F8.tmp"C:\Users\Admin\AppData\Local\Temp\36F8.tmp"105⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\3736.tmp"C:\Users\Admin\AppData\Local\Temp\3736.tmp"106⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\3775.tmp"C:\Users\Admin\AppData\Local\Temp\3775.tmp"107⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\37B3.tmp"C:\Users\Admin\AppData\Local\Temp\37B3.tmp"108⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\37F2.tmp"C:\Users\Admin\AppData\Local\Temp\37F2.tmp"109⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\3840.tmp"C:\Users\Admin\AppData\Local\Temp\3840.tmp"110⤵PID:500
-
C:\Users\Admin\AppData\Local\Temp\387E.tmp"C:\Users\Admin\AppData\Local\Temp\387E.tmp"111⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\38BC.tmp"C:\Users\Admin\AppData\Local\Temp\38BC.tmp"112⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\38FB.tmp"C:\Users\Admin\AppData\Local\Temp\38FB.tmp"113⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\3939.tmp"C:\Users\Admin\AppData\Local\Temp\3939.tmp"114⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\3978.tmp"C:\Users\Admin\AppData\Local\Temp\3978.tmp"115⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\39B6.tmp"C:\Users\Admin\AppData\Local\Temp\39B6.tmp"116⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\39F4.tmp"C:\Users\Admin\AppData\Local\Temp\39F4.tmp"117⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\3A33.tmp"C:\Users\Admin\AppData\Local\Temp\3A33.tmp"118⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\3A71.tmp"C:\Users\Admin\AppData\Local\Temp\3A71.tmp"119⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"120⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\3AFE.tmp"C:\Users\Admin\AppData\Local\Temp\3AFE.tmp"121⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\3B3C.tmp"C:\Users\Admin\AppData\Local\Temp\3B3C.tmp"122⤵PID:2252
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-