Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
02/02/2024, 04:33
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-02_674220b6fc9e3bd84a86c9c7980613fd_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-02-02_674220b6fc9e3bd84a86c9c7980613fd_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-02_674220b6fc9e3bd84a86c9c7980613fd_mafia.exe
-
Size
529KB
-
MD5
674220b6fc9e3bd84a86c9c7980613fd
-
SHA1
05d869987694c24854908485a8bbb27ecadaa04c
-
SHA256
65874ed738a72def12bbdacc6ff5dd0f1a25ec6f3760cf0ca9623586bda7990b
-
SHA512
771d9c1619e9e82d1275300cc859b2df82b116b6d73b8848a2b3e407f4c2d9bfdef171899563600ef6c8b621239a4bdc3ec5c465cce70f5f82b3b935e795f23f
-
SSDEEP
12288:NU5rCOTeijuafu/qt34KfQTSO2INTZwlH4Hp:NUQOJjuacqhQTtNTSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 804 FAD3.tmp 1844 FB21.tmp 2348 FB6F.tmp 1804 2A0D.tmp 2648 FC0B.tmp 2756 FC59.tmp 2816 FCB6.tmp 2608 FCF5.tmp 2764 FD43.tmp 2752 FD91.tmp 2536 FDEE.tmp 2552 FE3C.tmp 1704 FE8A.tmp 1244 FED8.tmp 2584 FF26.tmp 2480 FF65.tmp 2788 FFB3.tmp 1584 1.tmp 2892 3F.tmp 2880 7E.tmp 1980 BC.tmp 1444 10A.tmp 3044 148.tmp 1296 196.tmp 3036 209B.tmp 2064 223.tmp 2360 261.tmp 1996 2A0.tmp 2868 2DE.tmp 540 31C.tmp 1160 36A.tmp 1060 3A9.tmp 1492 231A.tmp 1824 435.tmp 1968 474.tmp 696 23D6.tmp 472 2414.tmp 1208 52F.tmp 1088 149A.tmp 1456 59C.tmp 1552 5CB.tmp 1616 1555.tmp 2680 648.tmp 404 686.tmp 1752 6C4.tmp 3012 168D.tmp 1128 26B3.tmp 2288 26F1.tmp 2220 2730.tmp 2148 80C.tmp 2184 27AC.tmp 892 27EB.tmp 2316 8C7.tmp 1676 2868.tmp 2468 18AF.tmp 2044 982.tmp 956 9C1.tmp 2180 9FF.tmp 1728 A3E.tmp 2588 A6C.tmp 2292 AAB.tmp 2744 ADA.tmp 2500 1A92.tmp 2632 1AD1.tmp -
Loads dropped DLL 64 IoCs
pid Process 2264 2024-02-02_674220b6fc9e3bd84a86c9c7980613fd_mafia.exe 804 FAD3.tmp 1844 FB21.tmp 2348 FB6F.tmp 1804 2A0D.tmp 2648 FC0B.tmp 2756 FC59.tmp 2816 FCB6.tmp 2608 FCF5.tmp 2764 FD43.tmp 2752 FD91.tmp 2536 FDEE.tmp 2552 FE3C.tmp 1704 FE8A.tmp 1244 FED8.tmp 2584 FF26.tmp 2480 FF65.tmp 2788 FFB3.tmp 1584 1.tmp 2892 3F.tmp 2880 7E.tmp 1980 BC.tmp 1444 10A.tmp 3044 148.tmp 1296 196.tmp 3036 209B.tmp 2064 223.tmp 2360 261.tmp 1996 2A0.tmp 2868 2DE.tmp 540 31C.tmp 1160 36A.tmp 1060 3A9.tmp 1492 231A.tmp 1824 435.tmp 1968 474.tmp 696 23D6.tmp 472 2414.tmp 1208 52F.tmp 1088 149A.tmp 1456 59C.tmp 1552 5CB.tmp 1616 1555.tmp 2680 648.tmp 404 686.tmp 1752 6C4.tmp 3012 168D.tmp 1128 26B3.tmp 2288 26F1.tmp 2220 2730.tmp 2148 80C.tmp 2184 27AC.tmp 892 27EB.tmp 2316 8C7.tmp 1676 2868.tmp 2468 18AF.tmp 2044 982.tmp 956 9C1.tmp 2180 9FF.tmp 1728 A3E.tmp 2588 A6C.tmp 2292 AAB.tmp 2744 ADA.tmp 2500 1A92.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2264 wrote to memory of 804 2264 2024-02-02_674220b6fc9e3bd84a86c9c7980613fd_mafia.exe 28 PID 2264 wrote to memory of 804 2264 2024-02-02_674220b6fc9e3bd84a86c9c7980613fd_mafia.exe 28 PID 2264 wrote to memory of 804 2264 2024-02-02_674220b6fc9e3bd84a86c9c7980613fd_mafia.exe 28 PID 2264 wrote to memory of 804 2264 2024-02-02_674220b6fc9e3bd84a86c9c7980613fd_mafia.exe 28 PID 804 wrote to memory of 1844 804 FAD3.tmp 29 PID 804 wrote to memory of 1844 804 FAD3.tmp 29 PID 804 wrote to memory of 1844 804 FAD3.tmp 29 PID 804 wrote to memory of 1844 804 FAD3.tmp 29 PID 1844 wrote to memory of 2348 1844 FB21.tmp 30 PID 1844 wrote to memory of 2348 1844 FB21.tmp 30 PID 1844 wrote to memory of 2348 1844 FB21.tmp 30 PID 1844 wrote to memory of 2348 1844 FB21.tmp 30 PID 2348 wrote to memory of 1804 2348 FB6F.tmp 220 PID 2348 wrote to memory of 1804 2348 FB6F.tmp 220 PID 2348 wrote to memory of 1804 2348 FB6F.tmp 220 PID 2348 wrote to memory of 1804 2348 FB6F.tmp 220 PID 1804 wrote to memory of 2648 1804 2A0D.tmp 31 PID 1804 wrote to memory of 2648 1804 2A0D.tmp 31 PID 1804 wrote to memory of 2648 1804 2A0D.tmp 31 PID 1804 wrote to memory of 2648 1804 2A0D.tmp 31 PID 2648 wrote to memory of 2756 2648 FC0B.tmp 181 PID 2648 wrote to memory of 2756 2648 FC0B.tmp 181 PID 2648 wrote to memory of 2756 2648 FC0B.tmp 181 PID 2648 wrote to memory of 2756 2648 FC0B.tmp 181 PID 2756 wrote to memory of 2816 2756 FC59.tmp 180 PID 2756 wrote to memory of 2816 2756 FC59.tmp 180 PID 2756 wrote to memory of 2816 2756 FC59.tmp 180 PID 2756 wrote to memory of 2816 2756 FC59.tmp 180 PID 2816 wrote to memory of 2608 2816 FCB6.tmp 179 PID 2816 wrote to memory of 2608 2816 FCB6.tmp 179 PID 2816 wrote to memory of 2608 2816 FCB6.tmp 179 PID 2816 wrote to memory of 2608 2816 FCB6.tmp 179 PID 2608 wrote to memory of 2764 2608 FCF5.tmp 178 PID 2608 wrote to memory of 2764 2608 FCF5.tmp 178 PID 2608 wrote to memory of 2764 2608 FCF5.tmp 178 PID 2608 wrote to memory of 2764 2608 FCF5.tmp 178 PID 2764 wrote to memory of 2752 2764 FD43.tmp 177 PID 2764 wrote to memory of 2752 2764 FD43.tmp 177 PID 2764 wrote to memory of 2752 2764 FD43.tmp 177 PID 2764 wrote to memory of 2752 2764 FD43.tmp 177 PID 2752 wrote to memory of 2536 2752 FD91.tmp 175 PID 2752 wrote to memory of 2536 2752 FD91.tmp 175 PID 2752 wrote to memory of 2536 2752 FD91.tmp 175 PID 2752 wrote to memory of 2536 2752 FD91.tmp 175 PID 2536 wrote to memory of 2552 2536 FDEE.tmp 174 PID 2536 wrote to memory of 2552 2536 FDEE.tmp 174 PID 2536 wrote to memory of 2552 2536 FDEE.tmp 174 PID 2536 wrote to memory of 2552 2536 FDEE.tmp 174 PID 2552 wrote to memory of 1704 2552 FE3C.tmp 173 PID 2552 wrote to memory of 1704 2552 FE3C.tmp 173 PID 2552 wrote to memory of 1704 2552 FE3C.tmp 173 PID 2552 wrote to memory of 1704 2552 FE3C.tmp 173 PID 1704 wrote to memory of 1244 1704 FE8A.tmp 172 PID 1704 wrote to memory of 1244 1704 FE8A.tmp 172 PID 1704 wrote to memory of 1244 1704 FE8A.tmp 172 PID 1704 wrote to memory of 1244 1704 FE8A.tmp 172 PID 1244 wrote to memory of 2584 1244 FED8.tmp 170 PID 1244 wrote to memory of 2584 1244 FED8.tmp 170 PID 1244 wrote to memory of 2584 1244 FED8.tmp 170 PID 1244 wrote to memory of 2584 1244 FED8.tmp 170 PID 2584 wrote to memory of 2480 2584 FF26.tmp 169 PID 2584 wrote to memory of 2480 2584 FF26.tmp 169 PID 2584 wrote to memory of 2480 2584 FF26.tmp 169 PID 2584 wrote to memory of 2480 2584 FF26.tmp 169
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-02_674220b6fc9e3bd84a86c9c7980613fd_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-02_674220b6fc9e3bd84a86c9c7980613fd_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\FAD3.tmp"C:\Users\Admin\AppData\Local\Temp\FAD3.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\FB21.tmp"C:\Users\Admin\AppData\Local\Temp\FB21.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\FB6F.tmp"C:\Users\Admin\AppData\Local\Temp\FB6F.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\FBBD.tmp"C:\Users\Admin\AppData\Local\Temp\FBBD.tmp"5⤵PID:1804
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\FC0B.tmp"C:\Users\Admin\AppData\Local\Temp\FC0B.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\FC59.tmp"C:\Users\Admin\AppData\Local\Temp\FC59.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756
-
-
C:\Users\Admin\AppData\Local\Temp\148.tmp"C:\Users\Admin\AppData\Local\Temp\148.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\196.tmp"C:\Users\Admin\AppData\Local\Temp\196.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1296
-
-
C:\Users\Admin\AppData\Local\Temp\10A.tmp"C:\Users\Admin\AppData\Local\Temp\10A.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444
-
C:\Users\Admin\AppData\Local\Temp\1D5.tmp"C:\Users\Admin\AppData\Local\Temp\1D5.tmp"1⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\223.tmp"C:\Users\Admin\AppData\Local\Temp\223.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064
-
-
C:\Users\Admin\AppData\Local\Temp\261.tmp"C:\Users\Admin\AppData\Local\Temp\261.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\2A0.tmp"C:\Users\Admin\AppData\Local\Temp\2A0.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\2DE.tmp"C:\Users\Admin\AppData\Local\Temp\2DE.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868
-
-
-
C:\Users\Admin\AppData\Local\Temp\31C.tmp"C:\Users\Admin\AppData\Local\Temp\31C.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:540 -
C:\Users\Admin\AppData\Local\Temp\36A.tmp"C:\Users\Admin\AppData\Local\Temp\36A.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1160
-
-
C:\Users\Admin\AppData\Local\Temp\3E7.tmp"C:\Users\Admin\AppData\Local\Temp\3E7.tmp"1⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\435.tmp"C:\Users\Admin\AppData\Local\Temp\435.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1824
-
-
C:\Users\Admin\AppData\Local\Temp\3A9.tmp"C:\Users\Admin\AppData\Local\Temp\3A9.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1060
-
C:\Users\Admin\AppData\Local\Temp\474.tmp"C:\Users\Admin\AppData\Local\Temp\474.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\4B2.tmp"C:\Users\Admin\AppData\Local\Temp\4B2.tmp"2⤵PID:696
-
-
C:\Users\Admin\AppData\Local\Temp\55E.tmp"C:\Users\Admin\AppData\Local\Temp\55E.tmp"1⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\14D8.tmp"C:\Users\Admin\AppData\Local\Temp\14D8.tmp"2⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\1516.tmp"C:\Users\Admin\AppData\Local\Temp\1516.tmp"3⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\1555.tmp"C:\Users\Admin\AppData\Local\Temp\1555.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\648.tmp"C:\Users\Admin\AppData\Local\Temp\648.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\5CB.tmp"C:\Users\Admin\AppData\Local\Temp\5CB.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552
-
-
-
C:\Users\Admin\AppData\Local\Temp\609.tmp"C:\Users\Admin\AppData\Local\Temp\609.tmp"1⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\1593.tmp"C:\Users\Admin\AppData\Local\Temp\1593.tmp"2⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\15D2.tmp"C:\Users\Admin\AppData\Local\Temp\15D2.tmp"3⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\1610.tmp"C:\Users\Admin\AppData\Local\Temp\1610.tmp"4⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\164E.tmp"C:\Users\Admin\AppData\Local\Temp\164E.tmp"5⤵PID:2544
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\686.tmp"C:\Users\Admin\AppData\Local\Temp\686.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:404 -
C:\Users\Admin\AppData\Local\Temp\6C4.tmp"C:\Users\Admin\AppData\Local\Temp\6C4.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752
-
-
C:\Users\Admin\AppData\Local\Temp\712.tmp"C:\Users\Admin\AppData\Local\Temp\712.tmp"1⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\7CE.tmp"C:\Users\Admin\AppData\Local\Temp\7CE.tmp"1⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\80C.tmp"C:\Users\Admin\AppData\Local\Temp\80C.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148
-
-
C:\Users\Admin\AppData\Local\Temp\84A.tmp"C:\Users\Admin\AppData\Local\Temp\84A.tmp"1⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\889.tmp"C:\Users\Admin\AppData\Local\Temp\889.tmp"2⤵PID:892
-
-
C:\Users\Admin\AppData\Local\Temp\906.tmp"C:\Users\Admin\AppData\Local\Temp\906.tmp"1⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\944.tmp"C:\Users\Admin\AppData\Local\Temp\944.tmp"2⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\18ED.tmp"C:\Users\Admin\AppData\Local\Temp\18ED.tmp"3⤵PID:2384
-
-
-
C:\Users\Admin\AppData\Local\Temp\982.tmp"C:\Users\Admin\AppData\Local\Temp\982.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\9C1.tmp"C:\Users\Admin\AppData\Local\Temp\9C1.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956 -
C:\Users\Admin\AppData\Local\Temp\9FF.tmp"C:\Users\Admin\AppData\Local\Temp\9FF.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180
-
-
-
C:\Users\Admin\AppData\Local\Temp\8C7.tmp"C:\Users\Admin\AppData\Local\Temp\8C7.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316
-
C:\Users\Admin\AppData\Local\Temp\AAB.tmp"C:\Users\Admin\AppData\Local\Temp\AAB.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\ADA.tmp"C:\Users\Admin\AppData\Local\Temp\ADA.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744
-
-
C:\Users\Admin\AppData\Local\Temp\B18.tmp"C:\Users\Admin\AppData\Local\Temp\B18.tmp"1⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\B47.tmp"C:\Users\Admin\AppData\Local\Temp\B47.tmp"2⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"3⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"4⤵PID:2740
-
-
C:\Users\Admin\AppData\Local\Temp\BB4.tmp"C:\Users\Admin\AppData\Local\Temp\BB4.tmp"4⤵PID:2656
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\C60.tmp"C:\Users\Admin\AppData\Local\Temp\C60.tmp"1⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\CFC.tmp"C:\Users\Admin\AppData\Local\Temp\CFC.tmp"1⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\D78.tmp"C:\Users\Admin\AppData\Local\Temp\D78.tmp"1⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\1D70.tmp"C:\Users\Admin\AppData\Local\Temp\1D70.tmp"2⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"3⤵PID:2216
-
-
-
C:\Users\Admin\AppData\Local\Temp\DF5.tmp"C:\Users\Admin\AppData\Local\Temp\DF5.tmp"1⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"2⤵PID:1096
-
-
C:\Users\Admin\AppData\Local\Temp\E72.tmp"C:\Users\Admin\AppData\Local\Temp\E72.tmp"1⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\EB0.tmp"C:\Users\Admin\AppData\Local\Temp\EB0.tmp"2⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\EEF.tmp"C:\Users\Admin\AppData\Local\Temp\EEF.tmp"3⤵PID:1480
-
-
-
C:\Users\Admin\AppData\Local\Temp\F2D.tmp"C:\Users\Admin\AppData\Local\Temp\F2D.tmp"1⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"2⤵PID:1372
-
-
C:\Users\Admin\AppData\Local\Temp\1027.tmp"C:\Users\Admin\AppData\Local\Temp\1027.tmp"1⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\1065.tmp"C:\Users\Admin\AppData\Local\Temp\1065.tmp"2⤵PID:2000
-
-
C:\Users\Admin\AppData\Local\Temp\10D2.tmp"C:\Users\Admin\AppData\Local\Temp\10D2.tmp"1⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\1101.tmp"C:\Users\Admin\AppData\Local\Temp\1101.tmp"2⤵PID:2904
-
-
C:\Users\Admin\AppData\Local\Temp\450C.tmp"C:\Users\Admin\AppData\Local\Temp\450C.tmp"2⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\454A.tmp"C:\Users\Admin\AppData\Local\Temp\454A.tmp"3⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\4588.tmp"C:\Users\Admin\AppData\Local\Temp\4588.tmp"4⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\45C7.tmp"C:\Users\Admin\AppData\Local\Temp\45C7.tmp"5⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\4605.tmp"C:\Users\Admin\AppData\Local\Temp\4605.tmp"6⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\4644.tmp"C:\Users\Admin\AppData\Local\Temp\4644.tmp"7⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\4682.tmp"C:\Users\Admin\AppData\Local\Temp\4682.tmp"8⤵PID:356
-
C:\Users\Admin\AppData\Local\Temp\46C0.tmp"C:\Users\Admin\AppData\Local\Temp\46C0.tmp"9⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\46FF.tmp"C:\Users\Admin\AppData\Local\Temp\46FF.tmp"10⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\472E.tmp"C:\Users\Admin\AppData\Local\Temp\472E.tmp"11⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\476C.tmp"C:\Users\Admin\AppData\Local\Temp\476C.tmp"12⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\47AA.tmp"C:\Users\Admin\AppData\Local\Temp\47AA.tmp"13⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\47E9.tmp"C:\Users\Admin\AppData\Local\Temp\47E9.tmp"14⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\4827.tmp"C:\Users\Admin\AppData\Local\Temp\4827.tmp"15⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\4866.tmp"C:\Users\Admin\AppData\Local\Temp\4866.tmp"16⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\48A4.tmp"C:\Users\Admin\AppData\Local\Temp\48A4.tmp"17⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\4902.tmp"C:\Users\Admin\AppData\Local\Temp\4902.tmp"18⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\4940.tmp"C:\Users\Admin\AppData\Local\Temp\4940.tmp"19⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\497E.tmp"C:\Users\Admin\AppData\Local\Temp\497E.tmp"20⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\49BD.tmp"C:\Users\Admin\AppData\Local\Temp\49BD.tmp"21⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\4A0B.tmp"C:\Users\Admin\AppData\Local\Temp\4A0B.tmp"22⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\4A78.tmp"C:\Users\Admin\AppData\Local\Temp\4A78.tmp"23⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\4AD6.tmp"C:\Users\Admin\AppData\Local\Temp\4AD6.tmp"24⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\4B14.tmp"C:\Users\Admin\AppData\Local\Temp\4B14.tmp"25⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\4B52.tmp"C:\Users\Admin\AppData\Local\Temp\4B52.tmp"26⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\4B91.tmp"C:\Users\Admin\AppData\Local\Temp\4B91.tmp"27⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\4BCF.tmp"C:\Users\Admin\AppData\Local\Temp\4BCF.tmp"28⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\4C0E.tmp"C:\Users\Admin\AppData\Local\Temp\4C0E.tmp"29⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\4C4C.tmp"C:\Users\Admin\AppData\Local\Temp\4C4C.tmp"30⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"31⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\4CC9.tmp"C:\Users\Admin\AppData\Local\Temp\4CC9.tmp"32⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"33⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\4D46.tmp"C:\Users\Admin\AppData\Local\Temp\4D46.tmp"34⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"35⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"36⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"37⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"38⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"39⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"40⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"41⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"42⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"43⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\4FE4.tmp"C:\Users\Admin\AppData\Local\Temp\4FE4.tmp"44⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"45⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\5061.tmp"C:\Users\Admin\AppData\Local\Temp\5061.tmp"46⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\50AF.tmp"C:\Users\Admin\AppData\Local\Temp\50AF.tmp"47⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\50EE.tmp"C:\Users\Admin\AppData\Local\Temp\50EE.tmp"48⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\512C.tmp"C:\Users\Admin\AppData\Local\Temp\512C.tmp"49⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\516A.tmp"C:\Users\Admin\AppData\Local\Temp\516A.tmp"50⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\51A9.tmp"C:\Users\Admin\AppData\Local\Temp\51A9.tmp"51⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\51F7.tmp"C:\Users\Admin\AppData\Local\Temp\51F7.tmp"52⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\5235.tmp"C:\Users\Admin\AppData\Local\Temp\5235.tmp"53⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\5274.tmp"C:\Users\Admin\AppData\Local\Temp\5274.tmp"54⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\52B2.tmp"C:\Users\Admin\AppData\Local\Temp\52B2.tmp"55⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\52F0.tmp"C:\Users\Admin\AppData\Local\Temp\52F0.tmp"56⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\532F.tmp"C:\Users\Admin\AppData\Local\Temp\532F.tmp"57⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\536D.tmp"C:\Users\Admin\AppData\Local\Temp\536D.tmp"58⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\53AC.tmp"C:\Users\Admin\AppData\Local\Temp\53AC.tmp"59⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\53FA.tmp"C:\Users\Admin\AppData\Local\Temp\53FA.tmp"60⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\5438.tmp"C:\Users\Admin\AppData\Local\Temp\5438.tmp"61⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\5476.tmp"C:\Users\Admin\AppData\Local\Temp\5476.tmp"62⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\54B5.tmp"C:\Users\Admin\AppData\Local\Temp\54B5.tmp"63⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\54F3.tmp"C:\Users\Admin\AppData\Local\Temp\54F3.tmp"64⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\5532.tmp"C:\Users\Admin\AppData\Local\Temp\5532.tmp"65⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\5570.tmp"C:\Users\Admin\AppData\Local\Temp\5570.tmp"66⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\55AE.tmp"C:\Users\Admin\AppData\Local\Temp\55AE.tmp"67⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\55ED.tmp"C:\Users\Admin\AppData\Local\Temp\55ED.tmp"68⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\562B.tmp"C:\Users\Admin\AppData\Local\Temp\562B.tmp"69⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\566A.tmp"C:\Users\Admin\AppData\Local\Temp\566A.tmp"70⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\56A8.tmp"C:\Users\Admin\AppData\Local\Temp\56A8.tmp"71⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\56D7.tmp"C:\Users\Admin\AppData\Local\Temp\56D7.tmp"72⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\5715.tmp"C:\Users\Admin\AppData\Local\Temp\5715.tmp"73⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\5754.tmp"C:\Users\Admin\AppData\Local\Temp\5754.tmp"74⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\5792.tmp"C:\Users\Admin\AppData\Local\Temp\5792.tmp"75⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\57D0.tmp"C:\Users\Admin\AppData\Local\Temp\57D0.tmp"76⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\580F.tmp"C:\Users\Admin\AppData\Local\Temp\580F.tmp"77⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\584D.tmp"C:\Users\Admin\AppData\Local\Temp\584D.tmp"78⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\588C.tmp"C:\Users\Admin\AppData\Local\Temp\588C.tmp"79⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\58CA.tmp"C:\Users\Admin\AppData\Local\Temp\58CA.tmp"80⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\5908.tmp"C:\Users\Admin\AppData\Local\Temp\5908.tmp"81⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\5947.tmp"C:\Users\Admin\AppData\Local\Temp\5947.tmp"82⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\5985.tmp"C:\Users\Admin\AppData\Local\Temp\5985.tmp"83⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\59C4.tmp"C:\Users\Admin\AppData\Local\Temp\59C4.tmp"84⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\5A02.tmp"C:\Users\Admin\AppData\Local\Temp\5A02.tmp"85⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\5A40.tmp"C:\Users\Admin\AppData\Local\Temp\5A40.tmp"86⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\5A7F.tmp"C:\Users\Admin\AppData\Local\Temp\5A7F.tmp"87⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\5ACD.tmp"C:\Users\Admin\AppData\Local\Temp\5ACD.tmp"88⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\5B0B.tmp"C:\Users\Admin\AppData\Local\Temp\5B0B.tmp"89⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"90⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\5B88.tmp"C:\Users\Admin\AppData\Local\Temp\5B88.tmp"91⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\5BC6.tmp"C:\Users\Admin\AppData\Local\Temp\5BC6.tmp"92⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\5C05.tmp"C:\Users\Admin\AppData\Local\Temp\5C05.tmp"93⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\5C43.tmp"C:\Users\Admin\AppData\Local\Temp\5C43.tmp"94⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\5C82.tmp"C:\Users\Admin\AppData\Local\Temp\5C82.tmp"95⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\5CC0.tmp"C:\Users\Admin\AppData\Local\Temp\5CC0.tmp"96⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\5CFE.tmp"C:\Users\Admin\AppData\Local\Temp\5CFE.tmp"97⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\5D3D.tmp"C:\Users\Admin\AppData\Local\Temp\5D3D.tmp"98⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\5D7B.tmp"C:\Users\Admin\AppData\Local\Temp\5D7B.tmp"99⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\5DBA.tmp"C:\Users\Admin\AppData\Local\Temp\5DBA.tmp"100⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\5DF8.tmp"C:\Users\Admin\AppData\Local\Temp\5DF8.tmp"101⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\5E36.tmp"C:\Users\Admin\AppData\Local\Temp\5E36.tmp"102⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\5E75.tmp"C:\Users\Admin\AppData\Local\Temp\5E75.tmp"103⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\5EB3.tmp"C:\Users\Admin\AppData\Local\Temp\5EB3.tmp"104⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\5EF2.tmp"C:\Users\Admin\AppData\Local\Temp\5EF2.tmp"105⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\5F30.tmp"C:\Users\Admin\AppData\Local\Temp\5F30.tmp"106⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\5F6E.tmp"C:\Users\Admin\AppData\Local\Temp\5F6E.tmp"107⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\5FAD.tmp"C:\Users\Admin\AppData\Local\Temp\5FAD.tmp"108⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\5FEB.tmp"C:\Users\Admin\AppData\Local\Temp\5FEB.tmp"109⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\602A.tmp"C:\Users\Admin\AppData\Local\Temp\602A.tmp"110⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\6068.tmp"C:\Users\Admin\AppData\Local\Temp\6068.tmp"111⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\60A6.tmp"C:\Users\Admin\AppData\Local\Temp\60A6.tmp"112⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\60E5.tmp"C:\Users\Admin\AppData\Local\Temp\60E5.tmp"113⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\6123.tmp"C:\Users\Admin\AppData\Local\Temp\6123.tmp"114⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\6162.tmp"C:\Users\Admin\AppData\Local\Temp\6162.tmp"115⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\61A0.tmp"C:\Users\Admin\AppData\Local\Temp\61A0.tmp"116⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\61DE.tmp"C:\Users\Admin\AppData\Local\Temp\61DE.tmp"117⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\621D.tmp"C:\Users\Admin\AppData\Local\Temp\621D.tmp"118⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\625B.tmp"C:\Users\Admin\AppData\Local\Temp\625B.tmp"119⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\629A.tmp"C:\Users\Admin\AppData\Local\Temp\629A.tmp"120⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\62D8.tmp"C:\Users\Admin\AppData\Local\Temp\62D8.tmp"121⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\6316.tmp"C:\Users\Admin\AppData\Local\Temp\6316.tmp"122⤵PID:2396
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-