Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
20/02/2024, 02:52
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-20_f7a6dd4809ced5b95ad49e0d4d9909e0_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-20_f7a6dd4809ced5b95ad49e0d4d9909e0_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-20_f7a6dd4809ced5b95ad49e0d4d9909e0_mafia.exe
-
Size
530KB
-
MD5
f7a6dd4809ced5b95ad49e0d4d9909e0
-
SHA1
bb6b8cd7a42da658dff7b691dec5b83915dcb9b9
-
SHA256
5b7c6c01c1d65293de44769176d489990c84e7cb05cb092442b268b38d63f593
-
SHA512
b20698f1b53ed8af16256cf6918f845ee6171d880d836fe9ee0b204ddacde23fcdb2850269d9da43f52a15cf813450b554d37accbfb99599ec2973fafeedcd26
-
SSDEEP
12288:AU5rCOTeioGaWCW28pFEZ4XLAkIfNZulFVg0M1:AUQOJorEAarIfNclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4824 473A.tmp 4872 4798.tmp 3900 47E6.tmp 1460 4834.tmp 4396 4882.tmp 1372 48D0.tmp 4928 491F.tmp 1568 497C.tmp 1576 49CA.tmp 2412 4A19.tmp 712 4A76.tmp 5076 4AC4.tmp 1764 4B13.tmp 3716 4B61.tmp 3028 4BAF.tmp 1136 4BFD.tmp 464 4C4B.tmp 2752 4C99.tmp 4092 4CE7.tmp 3136 4D84.tmp 528 4DD2.tmp 4868 4E20.tmp 5048 4E6E.tmp 3020 4EEB.tmp 1100 4F49.tmp 2784 4F97.tmp 3520 4FF5.tmp 2740 5043.tmp 2328 5091.tmp 2920 510E.tmp 3180 517B.tmp 1092 51C9.tmp 3116 5217.tmp 1192 5266.tmp 5072 52B4.tmp 3208 5302.tmp 4328 5350.tmp 4000 539E.tmp 4236 53EC.tmp 3588 543A.tmp 3572 5488.tmp 3888 54D7.tmp 3428 5525.tmp 4644 5573.tmp 4568 55C1.tmp 3976 560F.tmp 3068 565D.tmp 3104 56AB.tmp 5028 56F9.tmp 632 5748.tmp 4628 5796.tmp 4880 57E4.tmp 3064 5822.tmp 2020 5870.tmp 2872 58BF.tmp 1436 590D.tmp 1012 595B.tmp 4408 59F7.tmp 3776 5A55.tmp 3212 5AA3.tmp 4840 5B01.tmp 3672 5B5E.tmp 1460 5BAD.tmp 2704 5BFB.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3684 wrote to memory of 4824 3684 2024-02-20_f7a6dd4809ced5b95ad49e0d4d9909e0_mafia.exe 77 PID 3684 wrote to memory of 4824 3684 2024-02-20_f7a6dd4809ced5b95ad49e0d4d9909e0_mafia.exe 77 PID 3684 wrote to memory of 4824 3684 2024-02-20_f7a6dd4809ced5b95ad49e0d4d9909e0_mafia.exe 77 PID 4824 wrote to memory of 4872 4824 473A.tmp 76 PID 4824 wrote to memory of 4872 4824 473A.tmp 76 PID 4824 wrote to memory of 4872 4824 473A.tmp 76 PID 4872 wrote to memory of 3900 4872 4798.tmp 20 PID 4872 wrote to memory of 3900 4872 4798.tmp 20 PID 4872 wrote to memory of 3900 4872 4798.tmp 20 PID 3900 wrote to memory of 1460 3900 47E6.tmp 75 PID 3900 wrote to memory of 1460 3900 47E6.tmp 75 PID 3900 wrote to memory of 1460 3900 47E6.tmp 75 PID 1460 wrote to memory of 4396 1460 4834.tmp 74 PID 1460 wrote to memory of 4396 1460 4834.tmp 74 PID 1460 wrote to memory of 4396 1460 4834.tmp 74 PID 4396 wrote to memory of 1372 4396 4882.tmp 73 PID 4396 wrote to memory of 1372 4396 4882.tmp 73 PID 4396 wrote to memory of 1372 4396 4882.tmp 73 PID 1372 wrote to memory of 4928 1372 48D0.tmp 21 PID 1372 wrote to memory of 4928 1372 48D0.tmp 21 PID 1372 wrote to memory of 4928 1372 48D0.tmp 21 PID 4928 wrote to memory of 1568 4928 491F.tmp 72 PID 4928 wrote to memory of 1568 4928 491F.tmp 72 PID 4928 wrote to memory of 1568 4928 491F.tmp 72 PID 1568 wrote to memory of 1576 1568 497C.tmp 71 PID 1568 wrote to memory of 1576 1568 497C.tmp 71 PID 1568 wrote to memory of 1576 1568 497C.tmp 71 PID 1576 wrote to memory of 2412 1576 49CA.tmp 22 PID 1576 wrote to memory of 2412 1576 49CA.tmp 22 PID 1576 wrote to memory of 2412 1576 49CA.tmp 22 PID 2412 wrote to memory of 712 2412 4A19.tmp 70 PID 2412 wrote to memory of 712 2412 4A19.tmp 70 PID 2412 wrote to memory of 712 2412 4A19.tmp 70 PID 712 wrote to memory of 5076 712 4A76.tmp 24 PID 712 wrote to memory of 5076 712 4A76.tmp 24 PID 712 wrote to memory of 5076 712 4A76.tmp 24 PID 5076 wrote to memory of 1764 5076 4AC4.tmp 23 PID 5076 wrote to memory of 1764 5076 4AC4.tmp 23 PID 5076 wrote to memory of 1764 5076 4AC4.tmp 23 PID 1764 wrote to memory of 3716 1764 4B13.tmp 25 PID 1764 wrote to memory of 3716 1764 4B13.tmp 25 PID 1764 wrote to memory of 3716 1764 4B13.tmp 25 PID 3716 wrote to memory of 3028 3716 4B61.tmp 69 PID 3716 wrote to memory of 3028 3716 4B61.tmp 69 PID 3716 wrote to memory of 3028 3716 4B61.tmp 69 PID 3028 wrote to memory of 1136 3028 4BAF.tmp 68 PID 3028 wrote to memory of 1136 3028 4BAF.tmp 68 PID 3028 wrote to memory of 1136 3028 4BAF.tmp 68 PID 1136 wrote to memory of 464 1136 4BFD.tmp 67 PID 1136 wrote to memory of 464 1136 4BFD.tmp 67 PID 1136 wrote to memory of 464 1136 4BFD.tmp 67 PID 464 wrote to memory of 2752 464 4C4B.tmp 26 PID 464 wrote to memory of 2752 464 4C4B.tmp 26 PID 464 wrote to memory of 2752 464 4C4B.tmp 26 PID 2752 wrote to memory of 4092 2752 4C99.tmp 27 PID 2752 wrote to memory of 4092 2752 4C99.tmp 27 PID 2752 wrote to memory of 4092 2752 4C99.tmp 27 PID 4092 wrote to memory of 3136 4092 4CE7.tmp 65 PID 4092 wrote to memory of 3136 4092 4CE7.tmp 65 PID 4092 wrote to memory of 3136 4092 4CE7.tmp 65 PID 3136 wrote to memory of 528 3136 4D84.tmp 64 PID 3136 wrote to memory of 528 3136 4D84.tmp 64 PID 3136 wrote to memory of 528 3136 4D84.tmp 64 PID 528 wrote to memory of 4868 528 4DD2.tmp 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-20_f7a6dd4809ced5b95ad49e0d4d9909e0_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-20_f7a6dd4809ced5b95ad49e0d4d9909e0_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824
-
-
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460
-
-
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568
-
-
C:\Users\Admin\AppData\Local\Temp\4A19.tmp"C:\Users\Admin\AppData\Local\Temp\4A19.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712
-
-
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028
-
-
-
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076
-
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136
-
-
-
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"1⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"2⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"3⤵
- Executes dropped EXE
PID:3020
-
-
-
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"1⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"2⤵
- Executes dropped EXE
PID:2740
-
-
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"1⤵
- Executes dropped EXE
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"2⤵
- Executes dropped EXE
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"3⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"4⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"5⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"6⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"7⤵
- Executes dropped EXE
PID:4236
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"1⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"2⤵
- Executes dropped EXE
PID:3572
-
-
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"1⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"2⤵
- Executes dropped EXE
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"3⤵
- Executes dropped EXE
PID:4644
-
-
-
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"1⤵
- Executes dropped EXE
PID:1092
-
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"1⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"2⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"3⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"4⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"5⤵
- Executes dropped EXE
PID:5028
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"1⤵
- Executes dropped EXE
PID:632 -
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"2⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"3⤵
- Executes dropped EXE
PID:4880
-
-
-
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"1⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"2⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"3⤵
- Executes dropped EXE
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"4⤵
- Executes dropped EXE
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"5⤵
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"6⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"7⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"8⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"9⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"10⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"11⤵
- Executes dropped EXE
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"12⤵
- Executes dropped EXE
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"13⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"14⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"15⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"16⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"17⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"18⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"19⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"20⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"21⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"22⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"23⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"24⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"25⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"26⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"27⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"28⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"29⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"30⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"31⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"32⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"33⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"34⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"35⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"36⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"37⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"38⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"39⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"40⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"41⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"42⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"43⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"44⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"45⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"46⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"47⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"48⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"49⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"50⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"51⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"52⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"53⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"54⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"55⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"56⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"57⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"58⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"59⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"60⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"61⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"62⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"63⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"64⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"65⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"66⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"67⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"68⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"69⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"70⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"71⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"72⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"73⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"74⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"75⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"76⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"77⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"78⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"79⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"80⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"81⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"82⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"83⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\74C2.tmp"C:\Users\Admin\AppData\Local\Temp\74C2.tmp"84⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"85⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"86⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"87⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\760B.tmp"C:\Users\Admin\AppData\Local\Temp\760B.tmp"88⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\7659.tmp"C:\Users\Admin\AppData\Local\Temp\7659.tmp"89⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"90⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\76F5.tmp"C:\Users\Admin\AppData\Local\Temp\76F5.tmp"91⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\7743.tmp"C:\Users\Admin\AppData\Local\Temp\7743.tmp"92⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\7791.tmp"C:\Users\Admin\AppData\Local\Temp\7791.tmp"93⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\77DF.tmp"C:\Users\Admin\AppData\Local\Temp\77DF.tmp"94⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\782D.tmp"C:\Users\Admin\AppData\Local\Temp\782D.tmp"95⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"96⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"97⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\7918.tmp"C:\Users\Admin\AppData\Local\Temp\7918.tmp"98⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\7976.tmp"C:\Users\Admin\AppData\Local\Temp\7976.tmp"99⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\79D3.tmp"C:\Users\Admin\AppData\Local\Temp\79D3.tmp"100⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"101⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"102⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"103⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"104⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"105⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"106⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\7C15.tmp"C:\Users\Admin\AppData\Local\Temp\7C15.tmp"107⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\7C64.tmp"C:\Users\Admin\AppData\Local\Temp\7C64.tmp"108⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"109⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"110⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"111⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"112⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"113⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\7E67.tmp"C:\Users\Admin\AppData\Local\Temp\7E67.tmp"114⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"115⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\7F13.tmp"C:\Users\Admin\AppData\Local\Temp\7F13.tmp"116⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\7F61.tmp"C:\Users\Admin\AppData\Local\Temp\7F61.tmp"117⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"118⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"119⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\804C.tmp"C:\Users\Admin\AppData\Local\Temp\804C.tmp"120⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\809A.tmp"C:\Users\Admin\AppData\Local\Temp\809A.tmp"121⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\80F7.tmp"C:\Users\Admin\AppData\Local\Temp\80F7.tmp"122⤵PID:3060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-