Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28/01/2024, 08:01
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-28_4bb87f1ad0237042a65a5fdef378fb06_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-28_4bb87f1ad0237042a65a5fdef378fb06_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-28_4bb87f1ad0237042a65a5fdef378fb06_mafia.exe
-
Size
486KB
-
MD5
4bb87f1ad0237042a65a5fdef378fb06
-
SHA1
c3d0d76ecb102cb244caac81742fc53b216c8f84
-
SHA256
07678ae8a973a9fa9cc6cea63a06ba7adb3b867aec4c09314071cf23ca1d4d78
-
SHA512
b1b7282c2ddd0870f5957ecf6d341822218c924e7bab68c869dfaff485f78980fb22497f67bf20cca641514fd6fea16e62edeec488aaeaf25fc0a68e95670dba
-
SSDEEP
12288:/U5rCOTeiDnAnxcQ3o+Wq4jXxjT7O2D/PeI6NZ:/UQOJDnKh3b94jXtT7O2DP/6N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2616 6F06.tmp 1812 6F92.tmp 820 703E.tmp 3568 70EA.tmp 856 7177.tmp 2052 7213.tmp 4848 7280.tmp 1696 72DE.tmp 376 733C.tmp 656 7417.tmp 2196 7484.tmp 3992 7520.tmp 1020 759D.tmp 3488 761A.tmp 4648 76A7.tmp 3048 7724.tmp 2000 77A1.tmp 1652 783D.tmp 3032 78BA.tmp 632 7927.tmp 3872 79B4.tmp 3040 7A31.tmp 1792 7AAE.tmp 3060 7B5A.tmp 4892 7C06.tmp 1824 7C83.tmp 3688 7D0F.tmp 4756 7E67.tmp 4828 7EE4.tmp 2824 7FBF.tmp 4084 804C.tmp 4800 80D8.tmp 2780 8165.tmp 1576 81F1.tmp 4868 82AD.tmp 1140 831A.tmp 1616 8388.tmp 1932 83E5.tmp 5000 8472.tmp 1564 850E.tmp 4576 857C.tmp 2192 85F9.tmp 4996 86C4.tmp 3868 885A.tmp 916 89A2.tmp 2008 8ABB.tmp 2268 8B67.tmp 3188 8C32.tmp 4956 8CCF.tmp 2364 8D7B.tmp 3212 8E46.tmp 2196 8F11.tmp 2064 901A.tmp 5012 9105.tmp 1020 9182.tmp 2860 920E.tmp 3460 927C.tmp 4284 92F9.tmp 4656 9376.tmp 2000 93F3.tmp 2260 947F.tmp 3244 94FC.tmp 1504 9579.tmp 1304 9616.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4996 wrote to memory of 2616 4996 2024-01-28_4bb87f1ad0237042a65a5fdef378fb06_mafia.exe 87 PID 4996 wrote to memory of 2616 4996 2024-01-28_4bb87f1ad0237042a65a5fdef378fb06_mafia.exe 87 PID 4996 wrote to memory of 2616 4996 2024-01-28_4bb87f1ad0237042a65a5fdef378fb06_mafia.exe 87 PID 2616 wrote to memory of 1812 2616 6F06.tmp 88 PID 2616 wrote to memory of 1812 2616 6F06.tmp 88 PID 2616 wrote to memory of 1812 2616 6F06.tmp 88 PID 1812 wrote to memory of 820 1812 6F92.tmp 89 PID 1812 wrote to memory of 820 1812 6F92.tmp 89 PID 1812 wrote to memory of 820 1812 6F92.tmp 89 PID 820 wrote to memory of 3568 820 703E.tmp 90 PID 820 wrote to memory of 3568 820 703E.tmp 90 PID 820 wrote to memory of 3568 820 703E.tmp 90 PID 3568 wrote to memory of 856 3568 70EA.tmp 92 PID 3568 wrote to memory of 856 3568 70EA.tmp 92 PID 3568 wrote to memory of 856 3568 70EA.tmp 92 PID 856 wrote to memory of 2052 856 7177.tmp 93 PID 856 wrote to memory of 2052 856 7177.tmp 93 PID 856 wrote to memory of 2052 856 7177.tmp 93 PID 2052 wrote to memory of 4848 2052 7213.tmp 94 PID 2052 wrote to memory of 4848 2052 7213.tmp 94 PID 2052 wrote to memory of 4848 2052 7213.tmp 94 PID 4848 wrote to memory of 1696 4848 7280.tmp 95 PID 4848 wrote to memory of 1696 4848 7280.tmp 95 PID 4848 wrote to memory of 1696 4848 7280.tmp 95 PID 1696 wrote to memory of 376 1696 72DE.tmp 98 PID 1696 wrote to memory of 376 1696 72DE.tmp 98 PID 1696 wrote to memory of 376 1696 72DE.tmp 98 PID 376 wrote to memory of 656 376 733C.tmp 96 PID 376 wrote to memory of 656 376 733C.tmp 96 PID 376 wrote to memory of 656 376 733C.tmp 96 PID 656 wrote to memory of 2196 656 7417.tmp 97 PID 656 wrote to memory of 2196 656 7417.tmp 97 PID 656 wrote to memory of 2196 656 7417.tmp 97 PID 2196 wrote to memory of 3992 2196 7484.tmp 99 PID 2196 wrote to memory of 3992 2196 7484.tmp 99 PID 2196 wrote to memory of 3992 2196 7484.tmp 99 PID 3992 wrote to memory of 1020 3992 7520.tmp 100 PID 3992 wrote to memory of 1020 3992 7520.tmp 100 PID 3992 wrote to memory of 1020 3992 7520.tmp 100 PID 1020 wrote to memory of 3488 1020 759D.tmp 102 PID 1020 wrote to memory of 3488 1020 759D.tmp 102 PID 1020 wrote to memory of 3488 1020 759D.tmp 102 PID 3488 wrote to memory of 4648 3488 761A.tmp 101 PID 3488 wrote to memory of 4648 3488 761A.tmp 101 PID 3488 wrote to memory of 4648 3488 761A.tmp 101 PID 4648 wrote to memory of 3048 4648 76A7.tmp 104 PID 4648 wrote to memory of 3048 4648 76A7.tmp 104 PID 4648 wrote to memory of 3048 4648 76A7.tmp 104 PID 3048 wrote to memory of 2000 3048 7724.tmp 103 PID 3048 wrote to memory of 2000 3048 7724.tmp 103 PID 3048 wrote to memory of 2000 3048 7724.tmp 103 PID 2000 wrote to memory of 1652 2000 77A1.tmp 107 PID 2000 wrote to memory of 1652 2000 77A1.tmp 107 PID 2000 wrote to memory of 1652 2000 77A1.tmp 107 PID 1652 wrote to memory of 3032 1652 783D.tmp 106 PID 1652 wrote to memory of 3032 1652 783D.tmp 106 PID 1652 wrote to memory of 3032 1652 783D.tmp 106 PID 3032 wrote to memory of 632 3032 78BA.tmp 105 PID 3032 wrote to memory of 632 3032 78BA.tmp 105 PID 3032 wrote to memory of 632 3032 78BA.tmp 105 PID 632 wrote to memory of 3872 632 7927.tmp 112 PID 632 wrote to memory of 3872 632 7927.tmp 112 PID 632 wrote to memory of 3872 632 7927.tmp 112 PID 3872 wrote to memory of 3040 3872 79B4.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-28_4bb87f1ad0237042a65a5fdef378fb06_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-28_4bb87f1ad0237042a65a5fdef378fb06_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\7177.tmp"C:\Users\Admin\AppData\Local\Temp\7177.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\7213.tmp"C:\Users\Admin\AppData\Local\Temp\7213.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\7724.tmp"C:\Users\Admin\AppData\Local\Temp\7724.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048
-
-
C:\Users\Admin\AppData\Local\Temp\77A1.tmp"C:\Users\Admin\AppData\Local\Temp\77A1.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\783D.tmp"C:\Users\Admin\AppData\Local\Temp\783D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652
-
-
C:\Users\Admin\AppData\Local\Temp\7927.tmp"C:\Users\Admin\AppData\Local\Temp\7927.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\79B4.tmp"C:\Users\Admin\AppData\Local\Temp\79B4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872
-
-
C:\Users\Admin\AppData\Local\Temp\78BA.tmp"C:\Users\Admin\AppData\Local\Temp\78BA.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032
-
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"1⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"2⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"3⤵
- Executes dropped EXE
PID:3060
-
-
-
C:\Users\Admin\AppData\Local\Temp\7C06.tmp"C:\Users\Admin\AppData\Local\Temp\7C06.tmp"1⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\7C83.tmp"C:\Users\Admin\AppData\Local\Temp\7C83.tmp"2⤵
- Executes dropped EXE
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"3⤵
- Executes dropped EXE
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\7E67.tmp"C:\Users\Admin\AppData\Local\Temp\7E67.tmp"4⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"5⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"6⤵
- Executes dropped EXE
PID:2824
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\804C.tmp"C:\Users\Admin\AppData\Local\Temp\804C.tmp"1⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\80D8.tmp"C:\Users\Admin\AppData\Local\Temp\80D8.tmp"2⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\8165.tmp"C:\Users\Admin\AppData\Local\Temp\8165.tmp"3⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\81F1.tmp"C:\Users\Admin\AppData\Local\Temp\81F1.tmp"4⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\82AD.tmp"C:\Users\Admin\AppData\Local\Temp\82AD.tmp"5⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"6⤵
- Executes dropped EXE
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\8388.tmp"C:\Users\Admin\AppData\Local\Temp\8388.tmp"7⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\83E5.tmp"C:\Users\Admin\AppData\Local\Temp\83E5.tmp"8⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\8472.tmp"C:\Users\Admin\AppData\Local\Temp\8472.tmp"9⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\850E.tmp"C:\Users\Admin\AppData\Local\Temp\850E.tmp"10⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\857C.tmp"C:\Users\Admin\AppData\Local\Temp\857C.tmp"11⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\85F9.tmp"C:\Users\Admin\AppData\Local\Temp\85F9.tmp"12⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\86C4.tmp"C:\Users\Admin\AppData\Local\Temp\86C4.tmp"13⤵
- Executes dropped EXE
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\885A.tmp"C:\Users\Admin\AppData\Local\Temp\885A.tmp"14⤵
- Executes dropped EXE
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\89A2.tmp"C:\Users\Admin\AppData\Local\Temp\89A2.tmp"15⤵
- Executes dropped EXE
PID:916 -
C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"16⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\8B67.tmp"C:\Users\Admin\AppData\Local\Temp\8B67.tmp"17⤵
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\8C32.tmp"C:\Users\Admin\AppData\Local\Temp\8C32.tmp"18⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"19⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"20⤵
- Executes dropped EXE
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\8E46.tmp"C:\Users\Admin\AppData\Local\Temp\8E46.tmp"21⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"22⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\901A.tmp"C:\Users\Admin\AppData\Local\Temp\901A.tmp"23⤵
- Executes dropped EXE
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"24⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\9182.tmp"C:\Users\Admin\AppData\Local\Temp\9182.tmp"25⤵
- Executes dropped EXE
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"26⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\927C.tmp"C:\Users\Admin\AppData\Local\Temp\927C.tmp"27⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\92F9.tmp"C:\Users\Admin\AppData\Local\Temp\92F9.tmp"28⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\9376.tmp"C:\Users\Admin\AppData\Local\Temp\9376.tmp"29⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\93F3.tmp"C:\Users\Admin\AppData\Local\Temp\93F3.tmp"30⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\947F.tmp"C:\Users\Admin\AppData\Local\Temp\947F.tmp"31⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\94FC.tmp"C:\Users\Admin\AppData\Local\Temp\94FC.tmp"32⤵
- Executes dropped EXE
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\9579.tmp"C:\Users\Admin\AppData\Local\Temp\9579.tmp"33⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"34⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\96B2.tmp"C:\Users\Admin\AppData\Local\Temp\96B2.tmp"35⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"36⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\977D.tmp"C:\Users\Admin\AppData\Local\Temp\977D.tmp"37⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\97FA.tmp"C:\Users\Admin\AppData\Local\Temp\97FA.tmp"38⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"39⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\98D5.tmp"C:\Users\Admin\AppData\Local\Temp\98D5.tmp"40⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\9952.tmp"C:\Users\Admin\AppData\Local\Temp\9952.tmp"41⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"42⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"43⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"44⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"45⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"46⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"47⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"48⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"49⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\9E15.tmp"C:\Users\Admin\AppData\Local\Temp\9E15.tmp"50⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"51⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"52⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"53⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"54⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\A086.tmp"C:\Users\Admin\AppData\Local\Temp\A086.tmp"55⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\A112.tmp"C:\Users\Admin\AppData\Local\Temp\A112.tmp"56⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\A18F.tmp"C:\Users\Admin\AppData\Local\Temp\A18F.tmp"57⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\A21C.tmp"C:\Users\Admin\AppData\Local\Temp\A21C.tmp"58⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"59⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\A354.tmp"C:\Users\Admin\AppData\Local\Temp\A354.tmp"60⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"61⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"62⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"63⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"64⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"65⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"66⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"67⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"68⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"69⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\A836.tmp"C:\Users\Admin\AppData\Local\Temp\A836.tmp"70⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"71⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\A911.tmp"C:\Users\Admin\AppData\Local\Temp\A911.tmp"72⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"73⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"74⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"75⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"76⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"77⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"78⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"79⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\AD76.tmp"C:\Users\Admin\AppData\Local\Temp\AD76.tmp"80⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"81⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\AE60.tmp"C:\Users\Admin\AppData\Local\Temp\AE60.tmp"82⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\AECE.tmp"C:\Users\Admin\AppData\Local\Temp\AECE.tmp"83⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"84⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"85⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\B045.tmp"C:\Users\Admin\AppData\Local\Temp\B045.tmp"86⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"87⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\B14E.tmp"C:\Users\Admin\AppData\Local\Temp\B14E.tmp"88⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"89⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\B268.tmp"C:\Users\Admin\AppData\Local\Temp\B268.tmp"90⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\B304.tmp"C:\Users\Admin\AppData\Local\Temp\B304.tmp"91⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"92⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\B41D.tmp"C:\Users\Admin\AppData\Local\Temp\B41D.tmp"93⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"94⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\B536.tmp"C:\Users\Admin\AppData\Local\Temp\B536.tmp"95⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"96⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"97⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"98⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\B73A.tmp"C:\Users\Admin\AppData\Local\Temp\B73A.tmp"99⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"100⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\B853.tmp"C:\Users\Admin\AppData\Local\Temp\B853.tmp"101⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"102⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\B94D.tmp"C:\Users\Admin\AppData\Local\Temp\B94D.tmp"103⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"104⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\BA38.tmp"C:\Users\Admin\AppData\Local\Temp\BA38.tmp"105⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"106⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\BB41.tmp"C:\Users\Admin\AppData\Local\Temp\BB41.tmp"107⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"108⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"109⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"110⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\BD64.tmp"C:\Users\Admin\AppData\Local\Temp\BD64.tmp"111⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"112⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"113⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"114⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\BF77.tmp"C:\Users\Admin\AppData\Local\Temp\BF77.tmp"115⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\C004.tmp"C:\Users\Admin\AppData\Local\Temp\C004.tmp"116⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\C091.tmp"C:\Users\Admin\AppData\Local\Temp\C091.tmp"117⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\C10E.tmp"C:\Users\Admin\AppData\Local\Temp\C10E.tmp"118⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\C18B.tmp"C:\Users\Admin\AppData\Local\Temp\C18B.tmp"119⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\C208.tmp"C:\Users\Admin\AppData\Local\Temp\C208.tmp"120⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"121⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"122⤵PID:1612
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-