Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
13/02/2024, 06:14
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-13_cb8ae7c1fd9806acb4f92e85d42e5e80_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-13_cb8ae7c1fd9806acb4f92e85d42e5e80_mafia.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-02-13_cb8ae7c1fd9806acb4f92e85d42e5e80_mafia.exe
-
Size
486KB
-
MD5
cb8ae7c1fd9806acb4f92e85d42e5e80
-
SHA1
a8830bb4456d1e4fd348a4fa17e8fde63b819cb2
-
SHA256
e5f40ff1c519977d57103a9b9b971b9678b1cafa6796f27e39969bb00ff4e842
-
SHA512
20f2de3698db2a532d33ac76cf4b636eb7d787d8fad2a50bbc362991084480d990bcb003227b5bf9361aae160d2c41e5d648e9d705ade0c2df4e9a9d32a145b6
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7mQRg19FSiu5U2qHfZYrs6tER08MpyGaSUwJG:/U5rCOTeiDWjUiczqhInEO8iBU77/NZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2296 697D.tmp 2772 6A38.tmp 2768 6B12.tmp 2368 6BCD.tmp 2788 6CC7.tmp 2596 6D82.tmp 2856 6E7C.tmp 2592 6F27.tmp 3052 6FD3.tmp 2092 7050.tmp 2000 711B.tmp 948 71A7.tmp 1508 7214.tmp 2804 72B0.tmp 2948 7427.tmp 2440 74B3.tmp 1096 755F.tmp 1412 761A.tmp 2476 76B6.tmp 1948 7733.tmp 932 77CF.tmp 312 78A9.tmp 2832 7974.tmp 1644 79E1.tmp 1640 7A3F.tmp 1532 7A9C.tmp 2120 7D79.tmp 1328 7E06.tmp 1512 7E73.tmp 2444 7EFF.tmp 2308 7F8C.tmp 2472 7FF9.tmp 1284 80A5.tmp 2112 8160.tmp 796 81EC.tmp 2464 82A7.tmp 1048 8343.tmp 1912 83C0.tmp 1940 842D.tmp 696 849B.tmp 1256 8527.tmp 1664 85B3.tmp 2344 8621.tmp 1892 86AD.tmp 984 8739.tmp 2332 87B6.tmp 2512 8833.tmp 2116 88A0.tmp 1884 890D.tmp 2516 898A.tmp 1172 8A07.tmp 2264 8A74.tmp 1104 8B10.tmp 2212 8B8D.tmp 1616 8C0A.tmp 2160 8C96.tmp 2764 8D13.tmp 2784 8D90.tmp 2780 8DFD.tmp 2724 8E7A.tmp 2860 8EF7.tmp 3048 8F83.tmp 2524 8FE1.tmp 2788 905D.tmp -
Loads dropped DLL 64 IoCs
pid Process 2904 2024-02-13_cb8ae7c1fd9806acb4f92e85d42e5e80_mafia.exe 2296 697D.tmp 2772 6A38.tmp 2768 6B12.tmp 2368 6BCD.tmp 2788 6CC7.tmp 2596 6D82.tmp 2856 6E7C.tmp 2592 6F27.tmp 3052 6FD3.tmp 2092 7050.tmp 2000 711B.tmp 948 71A7.tmp 1508 7214.tmp 2804 72B0.tmp 2948 7427.tmp 2440 74B3.tmp 1096 755F.tmp 1412 761A.tmp 2476 76B6.tmp 1948 7733.tmp 932 77CF.tmp 312 78A9.tmp 2832 7974.tmp 1644 79E1.tmp 1640 7A3F.tmp 1532 7A9C.tmp 2120 7D79.tmp 1328 7E06.tmp 1512 7E73.tmp 2444 7EFF.tmp 2308 7F8C.tmp 2472 7FF9.tmp 1284 80A5.tmp 2112 8160.tmp 796 81EC.tmp 2464 82A7.tmp 1048 8343.tmp 1912 83C0.tmp 1940 842D.tmp 696 849B.tmp 1256 8527.tmp 1664 85B3.tmp 2344 8621.tmp 1892 86AD.tmp 984 8739.tmp 2332 87B6.tmp 2512 8833.tmp 2116 88A0.tmp 1884 890D.tmp 2516 898A.tmp 1172 8A07.tmp 2264 8A74.tmp 1104 8B10.tmp 2212 8B8D.tmp 1616 8C0A.tmp 2160 8C96.tmp 2764 8D13.tmp 2784 8D90.tmp 2780 8DFD.tmp 2724 8E7A.tmp 2860 8EF7.tmp 3048 8F83.tmp 2524 8FE1.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2904 wrote to memory of 2296 2904 2024-02-13_cb8ae7c1fd9806acb4f92e85d42e5e80_mafia.exe 25 PID 2904 wrote to memory of 2296 2904 2024-02-13_cb8ae7c1fd9806acb4f92e85d42e5e80_mafia.exe 25 PID 2904 wrote to memory of 2296 2904 2024-02-13_cb8ae7c1fd9806acb4f92e85d42e5e80_mafia.exe 25 PID 2904 wrote to memory of 2296 2904 2024-02-13_cb8ae7c1fd9806acb4f92e85d42e5e80_mafia.exe 25 PID 2296 wrote to memory of 2772 2296 697D.tmp 24 PID 2296 wrote to memory of 2772 2296 697D.tmp 24 PID 2296 wrote to memory of 2772 2296 697D.tmp 24 PID 2296 wrote to memory of 2772 2296 697D.tmp 24 PID 2772 wrote to memory of 2768 2772 6A38.tmp 23 PID 2772 wrote to memory of 2768 2772 6A38.tmp 23 PID 2772 wrote to memory of 2768 2772 6A38.tmp 23 PID 2772 wrote to memory of 2768 2772 6A38.tmp 23 PID 2768 wrote to memory of 2368 2768 6B12.tmp 22 PID 2768 wrote to memory of 2368 2768 6B12.tmp 22 PID 2768 wrote to memory of 2368 2768 6B12.tmp 22 PID 2768 wrote to memory of 2368 2768 6B12.tmp 22 PID 2368 wrote to memory of 2788 2368 6BCD.tmp 21 PID 2368 wrote to memory of 2788 2368 6BCD.tmp 21 PID 2368 wrote to memory of 2788 2368 6BCD.tmp 21 PID 2368 wrote to memory of 2788 2368 6BCD.tmp 21 PID 2788 wrote to memory of 2596 2788 6CC7.tmp 20 PID 2788 wrote to memory of 2596 2788 6CC7.tmp 20 PID 2788 wrote to memory of 2596 2788 6CC7.tmp 20 PID 2788 wrote to memory of 2596 2788 6CC7.tmp 20 PID 2596 wrote to memory of 2856 2596 6D82.tmp 19 PID 2596 wrote to memory of 2856 2596 6D82.tmp 19 PID 2596 wrote to memory of 2856 2596 6D82.tmp 19 PID 2596 wrote to memory of 2856 2596 6D82.tmp 19 PID 2856 wrote to memory of 2592 2856 6E7C.tmp 18 PID 2856 wrote to memory of 2592 2856 6E7C.tmp 18 PID 2856 wrote to memory of 2592 2856 6E7C.tmp 18 PID 2856 wrote to memory of 2592 2856 6E7C.tmp 18 PID 2592 wrote to memory of 3052 2592 6F27.tmp 16 PID 2592 wrote to memory of 3052 2592 6F27.tmp 16 PID 2592 wrote to memory of 3052 2592 6F27.tmp 16 PID 2592 wrote to memory of 3052 2592 6F27.tmp 16 PID 3052 wrote to memory of 2092 3052 6FD3.tmp 13 PID 3052 wrote to memory of 2092 3052 6FD3.tmp 13 PID 3052 wrote to memory of 2092 3052 6FD3.tmp 13 PID 3052 wrote to memory of 2092 3052 6FD3.tmp 13 PID 2092 wrote to memory of 2000 2092 7050.tmp 8 PID 2092 wrote to memory of 2000 2092 7050.tmp 8 PID 2092 wrote to memory of 2000 2092 7050.tmp 8 PID 2092 wrote to memory of 2000 2092 7050.tmp 8 PID 2000 wrote to memory of 948 2000 711B.tmp 5 PID 2000 wrote to memory of 948 2000 711B.tmp 5 PID 2000 wrote to memory of 948 2000 711B.tmp 5 PID 2000 wrote to memory of 948 2000 711B.tmp 5 PID 948 wrote to memory of 1508 948 71A7.tmp 3 PID 948 wrote to memory of 1508 948 71A7.tmp 3 PID 948 wrote to memory of 1508 948 71A7.tmp 3 PID 948 wrote to memory of 1508 948 71A7.tmp 3 PID 1508 wrote to memory of 2804 1508 7214.tmp 2 PID 1508 wrote to memory of 2804 1508 7214.tmp 2 PID 1508 wrote to memory of 2804 1508 7214.tmp 2 PID 1508 wrote to memory of 2804 1508 7214.tmp 2 PID 2804 wrote to memory of 2948 2804 72B0.tmp 1 PID 2804 wrote to memory of 2948 2804 72B0.tmp 1 PID 2804 wrote to memory of 2948 2804 72B0.tmp 1 PID 2804 wrote to memory of 2948 2804 72B0.tmp 1 PID 2948 wrote to memory of 2440 2948 7427.tmp 4 PID 2948 wrote to memory of 2440 2948 7427.tmp 4 PID 2948 wrote to memory of 2440 2948 7427.tmp 4 PID 2948 wrote to memory of 2440 2948 7427.tmp 4
Processes
-
C:\Users\Admin\AppData\Local\Temp\7427.tmp"C:\Users\Admin\AppData\Local\Temp\7427.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2476
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\72B0.tmp"C:\Users\Admin\AppData\Local\Temp\72B0.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804
-
C:\Users\Admin\AppData\Local\Temp\7214.tmp"C:\Users\Admin\AppData\Local\Temp\7214.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1508
-
C:\Users\Admin\AppData\Local\Temp\71A7.tmp"C:\Users\Admin\AppData\Local\Temp\71A7.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:948
-
C:\Users\Admin\AppData\Local\Temp\711B.tmp"C:\Users\Admin\AppData\Local\Temp\711B.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2000
-
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\77CF.tmp"C:\Users\Admin\AppData\Local\Temp\77CF.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:932 -
C:\Users\Admin\AppData\Local\Temp\78A9.tmp"C:\Users\Admin\AppData\Local\Temp\78A9.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:312 -
C:\Users\Admin\AppData\Local\Temp\7974.tmp"C:\Users\Admin\AppData\Local\Temp\7974.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\79E1.tmp"C:\Users\Admin\AppData\Local\Temp\79E1.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\7A3F.tmp"C:\Users\Admin\AppData\Local\Temp\7A3F.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\7A9C.tmp"C:\Users\Admin\AppData\Local\Temp\7A9C.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\7D79.tmp"C:\Users\Admin\AppData\Local\Temp\7D79.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\7E06.tmp"C:\Users\Admin\AppData\Local\Temp\7E06.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\7E73.tmp"C:\Users\Admin\AppData\Local\Temp\7E73.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\7F8C.tmp"C:\Users\Admin\AppData\Local\Temp\7F8C.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\80A5.tmp"C:\Users\Admin\AppData\Local\Temp\80A5.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\8160.tmp"C:\Users\Admin\AppData\Local\Temp\8160.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\81EC.tmp"C:\Users\Admin\AppData\Local\Temp\81EC.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
PID:796 -
C:\Users\Admin\AppData\Local\Temp\82A7.tmp"C:\Users\Admin\AppData\Local\Temp\82A7.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\8343.tmp"C:\Users\Admin\AppData\Local\Temp\8343.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\83C0.tmp"C:\Users\Admin\AppData\Local\Temp\83C0.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\842D.tmp"C:\Users\Admin\AppData\Local\Temp\842D.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\849B.tmp"C:\Users\Admin\AppData\Local\Temp\849B.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:696 -
C:\Users\Admin\AppData\Local\Temp\8527.tmp"C:\Users\Admin\AppData\Local\Temp\8527.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\85B3.tmp"C:\Users\Admin\AppData\Local\Temp\85B3.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\8621.tmp"C:\Users\Admin\AppData\Local\Temp\8621.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\86AD.tmp"C:\Users\Admin\AppData\Local\Temp\86AD.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\8739.tmp"C:\Users\Admin\AppData\Local\Temp\8739.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:984 -
C:\Users\Admin\AppData\Local\Temp\87B6.tmp"C:\Users\Admin\AppData\Local\Temp\87B6.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\8833.tmp"C:\Users\Admin\AppData\Local\Temp\8833.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\88A0.tmp"C:\Users\Admin\AppData\Local\Temp\88A0.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\890D.tmp"C:\Users\Admin\AppData\Local\Temp\890D.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\898A.tmp"C:\Users\Admin\AppData\Local\Temp\898A.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\8A07.tmp"C:\Users\Admin\AppData\Local\Temp\8A07.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\8A74.tmp"C:\Users\Admin\AppData\Local\Temp\8A74.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\8B10.tmp"C:\Users\Admin\AppData\Local\Temp\8B10.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\8B8D.tmp"C:\Users\Admin\AppData\Local\Temp\8B8D.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\8C0A.tmp"C:\Users\Admin\AppData\Local\Temp\8C0A.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\8C96.tmp"C:\Users\Admin\AppData\Local\Temp\8C96.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\8D13.tmp"C:\Users\Admin\AppData\Local\Temp\8D13.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\8D90.tmp"C:\Users\Admin\AppData\Local\Temp\8D90.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\8DFD.tmp"C:\Users\Admin\AppData\Local\Temp\8DFD.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\8E7A.tmp"C:\Users\Admin\AppData\Local\Temp\8E7A.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\8EF7.tmp"C:\Users\Admin\AppData\Local\Temp\8EF7.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\8F83.tmp"C:\Users\Admin\AppData\Local\Temp\8F83.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\8FE1.tmp"C:\Users\Admin\AppData\Local\Temp\8FE1.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\905D.tmp"C:\Users\Admin\AppData\Local\Temp\905D.tmp"45⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\90BB.tmp"C:\Users\Admin\AppData\Local\Temp\90BB.tmp"46⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\9128.tmp"C:\Users\Admin\AppData\Local\Temp\9128.tmp"47⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\92ED.tmp"C:\Users\Admin\AppData\Local\Temp\92ED.tmp"48⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\9482.tmp"C:\Users\Admin\AppData\Local\Temp\9482.tmp"49⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\94EF.tmp"C:\Users\Admin\AppData\Local\Temp\94EF.tmp"50⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\956C.tmp"C:\Users\Admin\AppData\Local\Temp\956C.tmp"51⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\95D9.tmp"C:\Users\Admin\AppData\Local\Temp\95D9.tmp"52⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\9647.tmp"C:\Users\Admin\AppData\Local\Temp\9647.tmp"53⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\96B4.tmp"C:\Users\Admin\AppData\Local\Temp\96B4.tmp"54⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\9731.tmp"C:\Users\Admin\AppData\Local\Temp\9731.tmp"55⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\979E.tmp"C:\Users\Admin\AppData\Local\Temp\979E.tmp"56⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\980B.tmp"C:\Users\Admin\AppData\Local\Temp\980B.tmp"57⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\9878.tmp"C:\Users\Admin\AppData\Local\Temp\9878.tmp"58⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\98E5.tmp"C:\Users\Admin\AppData\Local\Temp\98E5.tmp"59⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\9953.tmp"C:\Users\Admin\AppData\Local\Temp\9953.tmp"60⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\99C0.tmp"C:\Users\Admin\AppData\Local\Temp\99C0.tmp"61⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"62⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"63⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"64⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\9BF1.tmp"C:\Users\Admin\AppData\Local\Temp\9BF1.tmp"65⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"66⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\9CBC.tmp"C:\Users\Admin\AppData\Local\Temp\9CBC.tmp"67⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"68⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\9DA6.tmp"C:\Users\Admin\AppData\Local\Temp\9DA6.tmp"69⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\9E23.tmp"C:\Users\Admin\AppData\Local\Temp\9E23.tmp"70⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\9EA0.tmp"C:\Users\Admin\AppData\Local\Temp\9EA0.tmp"71⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\9EFD.tmp"C:\Users\Admin\AppData\Local\Temp\9EFD.tmp"72⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\9F4B.tmp"C:\Users\Admin\AppData\Local\Temp\9F4B.tmp"73⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\9FC8.tmp"C:\Users\Admin\AppData\Local\Temp\9FC8.tmp"74⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\A045.tmp"C:\Users\Admin\AppData\Local\Temp\A045.tmp"75⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\A0D1.tmp"C:\Users\Admin\AppData\Local\Temp\A0D1.tmp"76⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\A15E.tmp"C:\Users\Admin\AppData\Local\Temp\A15E.tmp"77⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\A1BB.tmp"C:\Users\Admin\AppData\Local\Temp\A1BB.tmp"78⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\A229.tmp"C:\Users\Admin\AppData\Local\Temp\A229.tmp"79⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\A2F3.tmp"C:\Users\Admin\AppData\Local\Temp\A2F3.tmp"80⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\A380.tmp"C:\Users\Admin\AppData\Local\Temp\A380.tmp"81⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\A40C.tmp"C:\Users\Admin\AppData\Local\Temp\A40C.tmp"82⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\A489.tmp"C:\Users\Admin\AppData\Local\Temp\A489.tmp"83⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\A506.tmp"C:\Users\Admin\AppData\Local\Temp\A506.tmp"84⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\A563.tmp"C:\Users\Admin\AppData\Local\Temp\A563.tmp"85⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"86⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\A61F.tmp"C:\Users\Admin\AppData\Local\Temp\A61F.tmp"87⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\A68C.tmp"C:\Users\Admin\AppData\Local\Temp\A68C.tmp"88⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\A709.tmp"C:\Users\Admin\AppData\Local\Temp\A709.tmp"89⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\A776.tmp"C:\Users\Admin\AppData\Local\Temp\A776.tmp"90⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\A7E3.tmp"C:\Users\Admin\AppData\Local\Temp\A7E3.tmp"91⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\A998.tmp"C:\Users\Admin\AppData\Local\Temp\A998.tmp"92⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\AA15.tmp"C:\Users\Admin\AppData\Local\Temp\AA15.tmp"93⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\AA82.tmp"C:\Users\Admin\AppData\Local\Temp\AA82.tmp"94⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\AAFF.tmp"C:\Users\Admin\AppData\Local\Temp\AAFF.tmp"95⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\AB6C.tmp"C:\Users\Admin\AppData\Local\Temp\AB6C.tmp"96⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\ABD9.tmp"C:\Users\Admin\AppData\Local\Temp\ABD9.tmp"97⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\AC65.tmp"C:\Users\Admin\AppData\Local\Temp\AC65.tmp"98⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\ACC3.tmp"C:\Users\Admin\AppData\Local\Temp\ACC3.tmp"99⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\AD40.tmp"C:\Users\Admin\AppData\Local\Temp\AD40.tmp"100⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\ADAD.tmp"C:\Users\Admin\AppData\Local\Temp\ADAD.tmp"101⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\AE1A.tmp"C:\Users\Admin\AppData\Local\Temp\AE1A.tmp"102⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\AE97.tmp"C:\Users\Admin\AppData\Local\Temp\AE97.tmp"103⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\AF14.tmp"C:\Users\Admin\AppData\Local\Temp\AF14.tmp"104⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\AF91.tmp"C:\Users\Admin\AppData\Local\Temp\AF91.tmp"105⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\B00D.tmp"C:\Users\Admin\AppData\Local\Temp\B00D.tmp"106⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\B07B.tmp"C:\Users\Admin\AppData\Local\Temp\B07B.tmp"107⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"108⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\B165.tmp"C:\Users\Admin\AppData\Local\Temp\B165.tmp"109⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"110⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\B25E.tmp"C:\Users\Admin\AppData\Local\Temp\B25E.tmp"111⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\B2DB.tmp"C:\Users\Admin\AppData\Local\Temp\B2DB.tmp"112⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\B358.tmp"C:\Users\Admin\AppData\Local\Temp\B358.tmp"113⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\B3B5.tmp"C:\Users\Admin\AppData\Local\Temp\B3B5.tmp"114⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\B413.tmp"C:\Users\Admin\AppData\Local\Temp\B413.tmp"115⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\B490.tmp"C:\Users\Admin\AppData\Local\Temp\B490.tmp"116⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\B50D.tmp"C:\Users\Admin\AppData\Local\Temp\B50D.tmp"117⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\B56A.tmp"C:\Users\Admin\AppData\Local\Temp\B56A.tmp"118⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\B5D7.tmp"C:\Users\Admin\AppData\Local\Temp\B5D7.tmp"119⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\B654.tmp"C:\Users\Admin\AppData\Local\Temp\B654.tmp"120⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\B6D1.tmp"C:\Users\Admin\AppData\Local\Temp\B6D1.tmp"121⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\B74E.tmp"C:\Users\Admin\AppData\Local\Temp\B74E.tmp"122⤵PID:2912
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-