Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
03/02/2024, 18:28
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-03_9fa4a52eb27a40fd7adfb42ef7f041fe_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-03_9fa4a52eb27a40fd7adfb42ef7f041fe_mafia.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-02-03_9fa4a52eb27a40fd7adfb42ef7f041fe_mafia.exe
-
Size
486KB
-
MD5
9fa4a52eb27a40fd7adfb42ef7f041fe
-
SHA1
99793c7eaf4c31372810b32a51479d4d85d043de
-
SHA256
5efbb02cf92c76e5935d0602ff4fd8dc0a78c80e92e001503e859301235101ee
-
SHA512
4edf4f4ad57cdd18282874f6821dff3f7b8c3e1ed4c5d20537f87441729114f92e20db5eee0f0369900532adccf04afa220892f6203cf82add672f2628a96822
-
SSDEEP
12288:/U5rCOTeiDgnTLu43YspkIaOFqLkiaoGXYbqQ177NZ:/UQOJD6q2Ys9anLYtXYF7N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4808 58FD.tmp 1544 595B.tmp 4024 59A9.tmp 3024 59F7.tmp 3764 5A45.tmp 1036 5A93.tmp 2684 5AE1.tmp 4072 5B30.tmp 4568 5B7E.tmp 3708 5BCC.tmp 4616 5C1A.tmp 1268 5C68.tmp 3244 5CB6.tmp 3728 5D04.tmp 2144 5D52.tmp 1508 5DA1.tmp 1716 5DEF.tmp 2972 5E3D.tmp 5084 5E8B.tmp 5000 5ED9.tmp 2936 5F27.tmp 4408 5F75.tmp 1848 5FC3.tmp 3588 6021.tmp 3572 606F.tmp 3232 60BD.tmp 2688 610C.tmp 2580 615A.tmp 5020 61A8.tmp 4520 61F6.tmp 4216 6244.tmp 4504 6292.tmp 64 62E0.tmp 5104 632E.tmp 2296 637D.tmp 1648 73B9.tmp 1044 7426.tmp 2472 6477.tmp 1916 64D4.tmp 624 6522.tmp 4424 6571.tmp 456 65BF.tmp 3416 660D.tmp 1208 665B.tmp 2440 6699.tmp 4028 66E8.tmp 1704 6736.tmp 668 6784.tmp 1128 67D2.tmp 3736 6820.tmp 5088 687E.tmp 1344 68CC.tmp 2620 691A.tmp 3108 6978.tmp 5036 69C6.tmp 4064 6A14.tmp 2740 6A62.tmp 4948 6AB0.tmp 2144 5D52.tmp 1508 5DA1.tmp 3464 6B9B.tmp 1272 6BE9.tmp 3512 6C37.tmp 3920 6C85.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4724 wrote to memory of 4808 4724 2024-02-03_9fa4a52eb27a40fd7adfb42ef7f041fe_mafia.exe 87 PID 4724 wrote to memory of 4808 4724 2024-02-03_9fa4a52eb27a40fd7adfb42ef7f041fe_mafia.exe 87 PID 4724 wrote to memory of 4808 4724 2024-02-03_9fa4a52eb27a40fd7adfb42ef7f041fe_mafia.exe 87 PID 4808 wrote to memory of 1544 4808 58FD.tmp 89 PID 4808 wrote to memory of 1544 4808 58FD.tmp 89 PID 4808 wrote to memory of 1544 4808 58FD.tmp 89 PID 1544 wrote to memory of 4024 1544 595B.tmp 91 PID 1544 wrote to memory of 4024 1544 595B.tmp 91 PID 1544 wrote to memory of 4024 1544 595B.tmp 91 PID 4024 wrote to memory of 3024 4024 59A9.tmp 176 PID 4024 wrote to memory of 3024 4024 59A9.tmp 176 PID 4024 wrote to memory of 3024 4024 59A9.tmp 176 PID 3024 wrote to memory of 3764 3024 59F7.tmp 175 PID 3024 wrote to memory of 3764 3024 59F7.tmp 175 PID 3024 wrote to memory of 3764 3024 59F7.tmp 175 PID 3764 wrote to memory of 1036 3764 5A45.tmp 92 PID 3764 wrote to memory of 1036 3764 5A45.tmp 92 PID 3764 wrote to memory of 1036 3764 5A45.tmp 92 PID 1036 wrote to memory of 2684 1036 5A93.tmp 174 PID 1036 wrote to memory of 2684 1036 5A93.tmp 174 PID 1036 wrote to memory of 2684 1036 5A93.tmp 174 PID 2684 wrote to memory of 4072 2684 5AE1.tmp 173 PID 2684 wrote to memory of 4072 2684 5AE1.tmp 173 PID 2684 wrote to memory of 4072 2684 5AE1.tmp 173 PID 4072 wrote to memory of 4568 4072 5B30.tmp 172 PID 4072 wrote to memory of 4568 4072 5B30.tmp 172 PID 4072 wrote to memory of 4568 4072 5B30.tmp 172 PID 4568 wrote to memory of 3708 4568 5B7E.tmp 171 PID 4568 wrote to memory of 3708 4568 5B7E.tmp 171 PID 4568 wrote to memory of 3708 4568 5B7E.tmp 171 PID 3708 wrote to memory of 4616 3708 5BCC.tmp 170 PID 3708 wrote to memory of 4616 3708 5BCC.tmp 170 PID 3708 wrote to memory of 4616 3708 5BCC.tmp 170 PID 4616 wrote to memory of 1268 4616 5C1A.tmp 95 PID 4616 wrote to memory of 1268 4616 5C1A.tmp 95 PID 4616 wrote to memory of 1268 4616 5C1A.tmp 95 PID 1268 wrote to memory of 3244 1268 5C68.tmp 94 PID 1268 wrote to memory of 3244 1268 5C68.tmp 94 PID 1268 wrote to memory of 3244 1268 5C68.tmp 94 PID 3244 wrote to memory of 3728 3244 5CB6.tmp 93 PID 3244 wrote to memory of 3728 3244 5CB6.tmp 93 PID 3244 wrote to memory of 3728 3244 5CB6.tmp 93 PID 3728 wrote to memory of 2144 3728 5D04.tmp 169 PID 3728 wrote to memory of 2144 3728 5D04.tmp 169 PID 3728 wrote to memory of 2144 3728 5D04.tmp 169 PID 2144 wrote to memory of 1508 2144 5D52.tmp 168 PID 2144 wrote to memory of 1508 2144 5D52.tmp 168 PID 2144 wrote to memory of 1508 2144 5D52.tmp 168 PID 1508 wrote to memory of 1716 1508 5DA1.tmp 167 PID 1508 wrote to memory of 1716 1508 5DA1.tmp 167 PID 1508 wrote to memory of 1716 1508 5DA1.tmp 167 PID 1716 wrote to memory of 2972 1716 5DEF.tmp 96 PID 1716 wrote to memory of 2972 1716 5DEF.tmp 96 PID 1716 wrote to memory of 2972 1716 5DEF.tmp 96 PID 2972 wrote to memory of 5084 2972 5E3D.tmp 97 PID 2972 wrote to memory of 5084 2972 5E3D.tmp 97 PID 2972 wrote to memory of 5084 2972 5E3D.tmp 97 PID 5084 wrote to memory of 5000 5084 5E8B.tmp 166 PID 5084 wrote to memory of 5000 5084 5E8B.tmp 166 PID 5084 wrote to memory of 5000 5084 5E8B.tmp 166 PID 5000 wrote to memory of 2936 5000 5ED9.tmp 165 PID 5000 wrote to memory of 2936 5000 5ED9.tmp 165 PID 5000 wrote to memory of 2936 5000 5ED9.tmp 165 PID 2936 wrote to memory of 4408 2936 5F27.tmp 163
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-03_9fa4a52eb27a40fd7adfb42ef7f041fe_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-03_9fa4a52eb27a40fd7adfb42ef7f041fe_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684
-
-
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144
-
-
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244
-
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268
-
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000
-
-
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"1⤵
- Executes dropped EXE
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"2⤵
- Executes dropped EXE
PID:3588
-
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"1⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"2⤵
- Executes dropped EXE
PID:4216
-
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"1⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"2⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"3⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"4⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"5⤵
- Executes dropped EXE
PID:2472
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"1⤵
- Executes dropped EXE
PID:64
-
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"1⤵
- Executes dropped EXE
PID:624 -
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"2⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"3⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"4⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"5⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"6⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"7⤵
- Executes dropped EXE
PID:4028
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"1⤵
- Executes dropped EXE
PID:1916
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"1⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"2⤵
- Executes dropped EXE
PID:668 -
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"3⤵
- Executes dropped EXE
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"4⤵
- Executes dropped EXE
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"5⤵
- Executes dropped EXE
PID:5088
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"1⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"2⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"3⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"4⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"5⤵
- Executes dropped EXE
PID:4064
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"1⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"2⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"3⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"4⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"5⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"6⤵
- Executes dropped EXE
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"7⤵
- Executes dropped EXE
PID:3512
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716
-
-
-
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"1⤵
- Executes dropped EXE
PID:4504
-
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"1⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"2⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"3⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"4⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"5⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"6⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"7⤵PID:1928
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"1⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"2⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"3⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"4⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"5⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"6⤵PID:1156
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"1⤵
- Executes dropped EXE
PID:5020
-
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"1⤵
- Executes dropped EXE
PID:2580
-
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"1⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"2⤵PID:3312
-
-
C:\Users\Admin\AppData\Local\Temp\7148.tmp"C:\Users\Admin\AppData\Local\Temp\7148.tmp"1⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"2⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"3⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\7232.tmp"C:\Users\Admin\AppData\Local\Temp\7232.tmp"4⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"5⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"6⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"7⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"8⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"9⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"10⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"11⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"12⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"13⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\7705.tmp"C:\Users\Admin\AppData\Local\Temp\7705.tmp"14⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\7791.tmp"C:\Users\Admin\AppData\Local\Temp\7791.tmp"15⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\780E.tmp"C:\Users\Admin\AppData\Local\Temp\780E.tmp"16⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"17⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\78F9.tmp"C:\Users\Admin\AppData\Local\Temp\78F9.tmp"18⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\7976.tmp"C:\Users\Admin\AppData\Local\Temp\7976.tmp"19⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"20⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"21⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"22⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"23⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"24⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"25⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\7C06.tmp"C:\Users\Admin\AppData\Local\Temp\7C06.tmp"26⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\7C64.tmp"C:\Users\Admin\AppData\Local\Temp\7C64.tmp"27⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"28⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\7D00.tmp"C:\Users\Admin\AppData\Local\Temp\7D00.tmp"29⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"30⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"31⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\7E09.tmp"C:\Users\Admin\AppData\Local\Temp\7E09.tmp"32⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\7E67.tmp"C:\Users\Admin\AppData\Local\Temp\7E67.tmp"33⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"34⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\7F13.tmp"C:\Users\Admin\AppData\Local\Temp\7F13.tmp"35⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\7F71.tmp"C:\Users\Admin\AppData\Local\Temp\7F71.tmp"36⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"37⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\800D.tmp"C:\Users\Admin\AppData\Local\Temp\800D.tmp"38⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\805B.tmp"C:\Users\Admin\AppData\Local\Temp\805B.tmp"39⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\80A9.tmp"C:\Users\Admin\AppData\Local\Temp\80A9.tmp"40⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\80F7.tmp"C:\Users\Admin\AppData\Local\Temp\80F7.tmp"41⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\8146.tmp"C:\Users\Admin\AppData\Local\Temp\8146.tmp"42⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\8194.tmp"C:\Users\Admin\AppData\Local\Temp\8194.tmp"43⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\81E2.tmp"C:\Users\Admin\AppData\Local\Temp\81E2.tmp"44⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\8230.tmp"C:\Users\Admin\AppData\Local\Temp\8230.tmp"45⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\827E.tmp"C:\Users\Admin\AppData\Local\Temp\827E.tmp"46⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"47⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"48⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\8368.tmp"C:\Users\Admin\AppData\Local\Temp\8368.tmp"49⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\83B7.tmp"C:\Users\Admin\AppData\Local\Temp\83B7.tmp"50⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\8405.tmp"C:\Users\Admin\AppData\Local\Temp\8405.tmp"51⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\8453.tmp"C:\Users\Admin\AppData\Local\Temp\8453.tmp"52⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\84A1.tmp"C:\Users\Admin\AppData\Local\Temp\84A1.tmp"53⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\84EF.tmp"C:\Users\Admin\AppData\Local\Temp\84EF.tmp"54⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\853D.tmp"C:\Users\Admin\AppData\Local\Temp\853D.tmp"55⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\858B.tmp"C:\Users\Admin\AppData\Local\Temp\858B.tmp"56⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\85D9.tmp"C:\Users\Admin\AppData\Local\Temp\85D9.tmp"57⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\8628.tmp"C:\Users\Admin\AppData\Local\Temp\8628.tmp"58⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\8676.tmp"C:\Users\Admin\AppData\Local\Temp\8676.tmp"59⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\86C4.tmp"C:\Users\Admin\AppData\Local\Temp\86C4.tmp"60⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\8712.tmp"C:\Users\Admin\AppData\Local\Temp\8712.tmp"61⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\8760.tmp"C:\Users\Admin\AppData\Local\Temp\8760.tmp"62⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\87AE.tmp"C:\Users\Admin\AppData\Local\Temp\87AE.tmp"63⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\87FC.tmp"C:\Users\Admin\AppData\Local\Temp\87FC.tmp"64⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"65⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\8899.tmp"C:\Users\Admin\AppData\Local\Temp\8899.tmp"66⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\88E7.tmp"C:\Users\Admin\AppData\Local\Temp\88E7.tmp"67⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\8935.tmp"C:\Users\Admin\AppData\Local\Temp\8935.tmp"68⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\8983.tmp"C:\Users\Admin\AppData\Local\Temp\8983.tmp"69⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\89D1.tmp"C:\Users\Admin\AppData\Local\Temp\89D1.tmp"70⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"71⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"72⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"73⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"74⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\8B58.tmp"C:\Users\Admin\AppData\Local\Temp\8B58.tmp"75⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"76⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\8C04.tmp"C:\Users\Admin\AppData\Local\Temp\8C04.tmp"77⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"78⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"79⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"80⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"81⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"82⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"83⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\8E46.tmp"C:\Users\Admin\AppData\Local\Temp\8E46.tmp"84⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\8E94.tmp"C:\Users\Admin\AppData\Local\Temp\8E94.tmp"85⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"86⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\8F40.tmp"C:\Users\Admin\AppData\Local\Temp\8F40.tmp"87⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"88⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"89⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\902A.tmp"C:\Users\Admin\AppData\Local\Temp\902A.tmp"90⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\9078.tmp"C:\Users\Admin\AppData\Local\Temp\9078.tmp"91⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"92⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\9134.tmp"C:\Users\Admin\AppData\Local\Temp\9134.tmp"93⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\9182.tmp"C:\Users\Admin\AppData\Local\Temp\9182.tmp"94⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\91D0.tmp"C:\Users\Admin\AppData\Local\Temp\91D0.tmp"95⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\922E.tmp"C:\Users\Admin\AppData\Local\Temp\922E.tmp"96⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\927C.tmp"C:\Users\Admin\AppData\Local\Temp\927C.tmp"97⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\92CA.tmp"C:\Users\Admin\AppData\Local\Temp\92CA.tmp"98⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"99⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\9366.tmp"C:\Users\Admin\AppData\Local\Temp\9366.tmp"100⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\93B4.tmp"C:\Users\Admin\AppData\Local\Temp\93B4.tmp"101⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\9412.tmp"C:\Users\Admin\AppData\Local\Temp\9412.tmp"102⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\9460.tmp"C:\Users\Admin\AppData\Local\Temp\9460.tmp"103⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\94BE.tmp"C:\Users\Admin\AppData\Local\Temp\94BE.tmp"104⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\950C.tmp"C:\Users\Admin\AppData\Local\Temp\950C.tmp"105⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"106⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"107⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\95F6.tmp"C:\Users\Admin\AppData\Local\Temp\95F6.tmp"108⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"109⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\9693.tmp"C:\Users\Admin\AppData\Local\Temp\9693.tmp"110⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\96E1.tmp"C:\Users\Admin\AppData\Local\Temp\96E1.tmp"111⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\972F.tmp"C:\Users\Admin\AppData\Local\Temp\972F.tmp"112⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\977D.tmp"C:\Users\Admin\AppData\Local\Temp\977D.tmp"113⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\97DB.tmp"C:\Users\Admin\AppData\Local\Temp\97DB.tmp"114⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"115⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"116⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\98D5.tmp"C:\Users\Admin\AppData\Local\Temp\98D5.tmp"117⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"118⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"119⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"120⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"121⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"122⤵PID:5036
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-