Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
21/02/2024, 09:32
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-21_733d2b3061fe0b82148baabeb7f23358_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-02-21_733d2b3061fe0b82148baabeb7f23358_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-21_733d2b3061fe0b82148baabeb7f23358_mafia.exe
-
Size
486KB
-
MD5
733d2b3061fe0b82148baabeb7f23358
-
SHA1
1a397a2e20562a5cfd959005262a0f0b95345a59
-
SHA256
a0382d7a90af95f38c96de33c5df8e7f19d54779e98c67d6f49409fc13fc024b
-
SHA512
f2f4ff120b60c140bb7834ff66f8b4bcb74825d4931acea52f0bd835a6912abfb3e7295ac45915966dd1d74ffd09a3882a6917a51ac5d266cb1931656a01b2c1
-
SSDEEP
12288:UU5rCOTeiDSmBicPeOOHMESo8o0D/kPA3/HfmMNZ:UUQOJDUb0D/kUHfhN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3924 E7D0.tmp 4088 E918.tmp 3460 E9A4.tmp 3916 EA21.tmp 3816 EAAE.tmp 1016 F09A.tmp 4556 F1C2.tmp 2152 F28E.tmp 3392 F359.tmp 4648 F3D6.tmp 1168 F482.tmp 488 F52D.tmp 2364 F627.tmp 2656 F6A4.tmp 3288 F731.tmp 1452 F7DD.tmp 2144 F86A.tmp 2384 F925.tmp 1292 F9B2.tmp 2612 FA8C.tmp 1936 FB29.tmp 4376 FBB5.tmp 3112 FC52.tmp 4368 FCFD.tmp 3032 FDA9.tmp 4408 FE74.tmp 4844 FF11.tmp 3332 FFCC.tmp 2480 B7.tmp 3944 182.tmp 1976 23D.tmp 1364 337.tmp 4848 48F.tmp 4552 51C.tmp 1640 5C7.tmp 4024 693.tmp 1696 74E.tmp 4940 7CB.tmp 4160 848.tmp 1832 8E4.tmp 4572 981.tmp 5060 A1D.tmp 4876 A8A.tmp 2956 B26.tmp 3220 BC3.tmp 372 C4F.tmp 3200 CEC.tmp 4392 D69.tmp 3712 DF5.tmp 3748 EB1.tmp 1596 F1E.tmp 4276 FE9.tmp 2852 1076.tmp 4872 10F3.tmp 1328 117F.tmp 4816 121C.tmp 1344 1299.tmp 3400 1306.tmp 4356 1373.tmp 2536 1400.tmp 3468 146D.tmp 2616 14DB.tmp 4088 1577.tmp 3892 15F4.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3468 wrote to memory of 3924 3468 2024-02-21_733d2b3061fe0b82148baabeb7f23358_mafia.exe 83 PID 3468 wrote to memory of 3924 3468 2024-02-21_733d2b3061fe0b82148baabeb7f23358_mafia.exe 83 PID 3468 wrote to memory of 3924 3468 2024-02-21_733d2b3061fe0b82148baabeb7f23358_mafia.exe 83 PID 3924 wrote to memory of 4088 3924 E7D0.tmp 84 PID 3924 wrote to memory of 4088 3924 E7D0.tmp 84 PID 3924 wrote to memory of 4088 3924 E7D0.tmp 84 PID 4088 wrote to memory of 3460 4088 E918.tmp 85 PID 4088 wrote to memory of 3460 4088 E918.tmp 85 PID 4088 wrote to memory of 3460 4088 E918.tmp 85 PID 3460 wrote to memory of 3916 3460 E9A4.tmp 86 PID 3460 wrote to memory of 3916 3460 E9A4.tmp 86 PID 3460 wrote to memory of 3916 3460 E9A4.tmp 86 PID 3916 wrote to memory of 3816 3916 EA21.tmp 87 PID 3916 wrote to memory of 3816 3916 EA21.tmp 87 PID 3916 wrote to memory of 3816 3916 EA21.tmp 87 PID 3816 wrote to memory of 1016 3816 EAAE.tmp 88 PID 3816 wrote to memory of 1016 3816 EAAE.tmp 88 PID 3816 wrote to memory of 1016 3816 EAAE.tmp 88 PID 1016 wrote to memory of 4556 1016 F09A.tmp 89 PID 1016 wrote to memory of 4556 1016 F09A.tmp 89 PID 1016 wrote to memory of 4556 1016 F09A.tmp 89 PID 4556 wrote to memory of 2152 4556 F1C2.tmp 90 PID 4556 wrote to memory of 2152 4556 F1C2.tmp 90 PID 4556 wrote to memory of 2152 4556 F1C2.tmp 90 PID 2152 wrote to memory of 3392 2152 F28E.tmp 91 PID 2152 wrote to memory of 3392 2152 F28E.tmp 91 PID 2152 wrote to memory of 3392 2152 F28E.tmp 91 PID 3392 wrote to memory of 4648 3392 F359.tmp 92 PID 3392 wrote to memory of 4648 3392 F359.tmp 92 PID 3392 wrote to memory of 4648 3392 F359.tmp 92 PID 4648 wrote to memory of 1168 4648 F3D6.tmp 93 PID 4648 wrote to memory of 1168 4648 F3D6.tmp 93 PID 4648 wrote to memory of 1168 4648 F3D6.tmp 93 PID 1168 wrote to memory of 488 1168 F482.tmp 94 PID 1168 wrote to memory of 488 1168 F482.tmp 94 PID 1168 wrote to memory of 488 1168 F482.tmp 94 PID 488 wrote to memory of 2364 488 F52D.tmp 96 PID 488 wrote to memory of 2364 488 F52D.tmp 96 PID 488 wrote to memory of 2364 488 F52D.tmp 96 PID 2364 wrote to memory of 2656 2364 F627.tmp 95 PID 2364 wrote to memory of 2656 2364 F627.tmp 95 PID 2364 wrote to memory of 2656 2364 F627.tmp 95 PID 2656 wrote to memory of 3288 2656 F6A4.tmp 97 PID 2656 wrote to memory of 3288 2656 F6A4.tmp 97 PID 2656 wrote to memory of 3288 2656 F6A4.tmp 97 PID 3288 wrote to memory of 1452 3288 F731.tmp 98 PID 3288 wrote to memory of 1452 3288 F731.tmp 98 PID 3288 wrote to memory of 1452 3288 F731.tmp 98 PID 1452 wrote to memory of 2144 1452 F7DD.tmp 99 PID 1452 wrote to memory of 2144 1452 F7DD.tmp 99 PID 1452 wrote to memory of 2144 1452 F7DD.tmp 99 PID 2144 wrote to memory of 2384 2144 F86A.tmp 100 PID 2144 wrote to memory of 2384 2144 F86A.tmp 100 PID 2144 wrote to memory of 2384 2144 F86A.tmp 100 PID 2384 wrote to memory of 1292 2384 F925.tmp 101 PID 2384 wrote to memory of 1292 2384 F925.tmp 101 PID 2384 wrote to memory of 1292 2384 F925.tmp 101 PID 1292 wrote to memory of 2612 1292 F9B2.tmp 105 PID 1292 wrote to memory of 2612 1292 F9B2.tmp 105 PID 1292 wrote to memory of 2612 1292 F9B2.tmp 105 PID 2612 wrote to memory of 1936 2612 FA8C.tmp 102 PID 2612 wrote to memory of 1936 2612 FA8C.tmp 102 PID 2612 wrote to memory of 1936 2612 FA8C.tmp 102 PID 1936 wrote to memory of 4376 1936 FB29.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-21_733d2b3061fe0b82148baabeb7f23358_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-21_733d2b3061fe0b82148baabeb7f23358_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\E918.tmp"C:\Users\Admin\AppData\Local\Temp\E918.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\EA21.tmp"C:\Users\Admin\AppData\Local\Temp\EA21.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\EAAE.tmp"C:\Users\Admin\AppData\Local\Temp\EAAE.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\F09A.tmp"C:\Users\Admin\AppData\Local\Temp\F09A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\F28E.tmp"C:\Users\Admin\AppData\Local\Temp\F28E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\F359.tmp"C:\Users\Admin\AppData\Local\Temp\F359.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\F3D6.tmp"C:\Users\Admin\AppData\Local\Temp\F3D6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\F482.tmp"C:\Users\Admin\AppData\Local\Temp\F482.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\F52D.tmp"C:\Users\Admin\AppData\Local\Temp\F52D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:488 -
C:\Users\Admin\AppData\Local\Temp\F627.tmp"C:\Users\Admin\AppData\Local\Temp\F627.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\F731.tmp"C:\Users\Admin\AppData\Local\Temp\F731.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\F86A.tmp"C:\Users\Admin\AppData\Local\Temp\F86A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\F925.tmp"C:\Users\Admin\AppData\Local\Temp\F925.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\FB29.tmp"C:\Users\Admin\AppData\Local\Temp\FB29.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"2⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\FC52.tmp"C:\Users\Admin\AppData\Local\Temp\FC52.tmp"3⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\FCFD.tmp"C:\Users\Admin\AppData\Local\Temp\FCFD.tmp"4⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"5⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\FE74.tmp"C:\Users\Admin\AppData\Local\Temp\FE74.tmp"6⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\FF11.tmp"C:\Users\Admin\AppData\Local\Temp\FF11.tmp"7⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\FFCC.tmp"C:\Users\Admin\AppData\Local\Temp\FFCC.tmp"8⤵
- Executes dropped EXE
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7.tmp"9⤵
- Executes dropped EXE
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\182.tmp"C:\Users\Admin\AppData\Local\Temp\182.tmp"10⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\23D.tmp"C:\Users\Admin\AppData\Local\Temp\23D.tmp"11⤵
- Executes dropped EXE
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\337.tmp"C:\Users\Admin\AppData\Local\Temp\337.tmp"12⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\48F.tmp"C:\Users\Admin\AppData\Local\Temp\48F.tmp"13⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\51C.tmp"C:\Users\Admin\AppData\Local\Temp\51C.tmp"14⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\5C7.tmp"C:\Users\Admin\AppData\Local\Temp\5C7.tmp"15⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\693.tmp"C:\Users\Admin\AppData\Local\Temp\693.tmp"16⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\74E.tmp"C:\Users\Admin\AppData\Local\Temp\74E.tmp"17⤵
- Executes dropped EXE
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\7CB.tmp"C:\Users\Admin\AppData\Local\Temp\7CB.tmp"18⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\848.tmp"C:\Users\Admin\AppData\Local\Temp\848.tmp"19⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\8E4.tmp"C:\Users\Admin\AppData\Local\Temp\8E4.tmp"20⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\981.tmp"C:\Users\Admin\AppData\Local\Temp\981.tmp"21⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\A1D.tmp"C:\Users\Admin\AppData\Local\Temp\A1D.tmp"22⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\A8A.tmp"C:\Users\Admin\AppData\Local\Temp\A8A.tmp"23⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\B26.tmp"C:\Users\Admin\AppData\Local\Temp\B26.tmp"24⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\BC3.tmp"C:\Users\Admin\AppData\Local\Temp\BC3.tmp"25⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\C4F.tmp"C:\Users\Admin\AppData\Local\Temp\C4F.tmp"26⤵
- Executes dropped EXE
PID:372 -
C:\Users\Admin\AppData\Local\Temp\CEC.tmp"C:\Users\Admin\AppData\Local\Temp\CEC.tmp"27⤵
- Executes dropped EXE
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\D69.tmp"C:\Users\Admin\AppData\Local\Temp\D69.tmp"28⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\DF5.tmp"C:\Users\Admin\AppData\Local\Temp\DF5.tmp"29⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\EB1.tmp"C:\Users\Admin\AppData\Local\Temp\EB1.tmp"30⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"31⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\FE9.tmp"C:\Users\Admin\AppData\Local\Temp\FE9.tmp"32⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\1076.tmp"C:\Users\Admin\AppData\Local\Temp\1076.tmp"33⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\10F3.tmp"C:\Users\Admin\AppData\Local\Temp\10F3.tmp"34⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\117F.tmp"C:\Users\Admin\AppData\Local\Temp\117F.tmp"35⤵
- Executes dropped EXE
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\121C.tmp"C:\Users\Admin\AppData\Local\Temp\121C.tmp"36⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\1299.tmp"C:\Users\Admin\AppData\Local\Temp\1299.tmp"37⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\1306.tmp"C:\Users\Admin\AppData\Local\Temp\1306.tmp"38⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\1373.tmp"C:\Users\Admin\AppData\Local\Temp\1373.tmp"39⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\1400.tmp"C:\Users\Admin\AppData\Local\Temp\1400.tmp"40⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\146D.tmp"C:\Users\Admin\AppData\Local\Temp\146D.tmp"41⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\14DB.tmp"C:\Users\Admin\AppData\Local\Temp\14DB.tmp"42⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\1577.tmp"C:\Users\Admin\AppData\Local\Temp\1577.tmp"43⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\15F4.tmp"C:\Users\Admin\AppData\Local\Temp\15F4.tmp"44⤵
- Executes dropped EXE
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\16A0.tmp"C:\Users\Admin\AppData\Local\Temp\16A0.tmp"45⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\170D.tmp"C:\Users\Admin\AppData\Local\Temp\170D.tmp"46⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\17AA.tmp"C:\Users\Admin\AppData\Local\Temp\17AA.tmp"47⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\1817.tmp"C:\Users\Admin\AppData\Local\Temp\1817.tmp"48⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\1894.tmp"C:\Users\Admin\AppData\Local\Temp\1894.tmp"49⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\195F.tmp"C:\Users\Admin\AppData\Local\Temp\195F.tmp"50⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\19DC.tmp"C:\Users\Admin\AppData\Local\Temp\19DC.tmp"51⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\1A49.tmp"C:\Users\Admin\AppData\Local\Temp\1A49.tmp"52⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\1AB7.tmp"C:\Users\Admin\AppData\Local\Temp\1AB7.tmp"53⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\1B24.tmp"C:\Users\Admin\AppData\Local\Temp\1B24.tmp"54⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"55⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"56⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"57⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\1D66.tmp"C:\Users\Admin\AppData\Local\Temp\1D66.tmp"58⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\1DE3.tmp"C:\Users\Admin\AppData\Local\Temp\1DE3.tmp"59⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\1E80.tmp"C:\Users\Admin\AppData\Local\Temp\1E80.tmp"60⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"61⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\1F89.tmp"C:\Users\Admin\AppData\Local\Temp\1F89.tmp"62⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"63⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\2093.tmp"C:\Users\Admin\AppData\Local\Temp\2093.tmp"64⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\2100.tmp"C:\Users\Admin\AppData\Local\Temp\2100.tmp"65⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\217D.tmp"C:\Users\Admin\AppData\Local\Temp\217D.tmp"66⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\21FA.tmp"C:\Users\Admin\AppData\Local\Temp\21FA.tmp"67⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\22C5.tmp"C:\Users\Admin\AppData\Local\Temp\22C5.tmp"68⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\2333.tmp"C:\Users\Admin\AppData\Local\Temp\2333.tmp"69⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\23BF.tmp"C:\Users\Admin\AppData\Local\Temp\23BF.tmp"70⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\243C.tmp"C:\Users\Admin\AppData\Local\Temp\243C.tmp"71⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\24B9.tmp"C:\Users\Admin\AppData\Local\Temp\24B9.tmp"72⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\2546.tmp"C:\Users\Admin\AppData\Local\Temp\2546.tmp"73⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\25D3.tmp"C:\Users\Admin\AppData\Local\Temp\25D3.tmp"74⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\2640.tmp"C:\Users\Admin\AppData\Local\Temp\2640.tmp"75⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\26DC.tmp"C:\Users\Admin\AppData\Local\Temp\26DC.tmp"76⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\2759.tmp"C:\Users\Admin\AppData\Local\Temp\2759.tmp"77⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\27C7.tmp"C:\Users\Admin\AppData\Local\Temp\27C7.tmp"78⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\2834.tmp"C:\Users\Admin\AppData\Local\Temp\2834.tmp"79⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\28E0.tmp"C:\Users\Admin\AppData\Local\Temp\28E0.tmp"80⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\298C.tmp"C:\Users\Admin\AppData\Local\Temp\298C.tmp"81⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\2A38.tmp"C:\Users\Admin\AppData\Local\Temp\2A38.tmp"82⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\2AD4.tmp"C:\Users\Admin\AppData\Local\Temp\2AD4.tmp"83⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\2B70.tmp"C:\Users\Admin\AppData\Local\Temp\2B70.tmp"84⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\2BFD.tmp"C:\Users\Admin\AppData\Local\Temp\2BFD.tmp"85⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\2C7A.tmp"C:\Users\Admin\AppData\Local\Temp\2C7A.tmp"86⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\2D06.tmp"C:\Users\Admin\AppData\Local\Temp\2D06.tmp"87⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\2DB2.tmp"C:\Users\Admin\AppData\Local\Temp\2DB2.tmp"88⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\2E2F.tmp"C:\Users\Admin\AppData\Local\Temp\2E2F.tmp"89⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\2E9D.tmp"C:\Users\Admin\AppData\Local\Temp\2E9D.tmp"90⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\2F29.tmp"C:\Users\Admin\AppData\Local\Temp\2F29.tmp"91⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"92⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\3062.tmp"C:\Users\Admin\AppData\Local\Temp\3062.tmp"93⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\30BF.tmp"C:\Users\Admin\AppData\Local\Temp\30BF.tmp"94⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\313C.tmp"C:\Users\Admin\AppData\Local\Temp\313C.tmp"95⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\31C9.tmp"C:\Users\Admin\AppData\Local\Temp\31C9.tmp"96⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"97⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\32C3.tmp"C:\Users\Admin\AppData\Local\Temp\32C3.tmp"98⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\3340.tmp"C:\Users\Admin\AppData\Local\Temp\3340.tmp"99⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"100⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\342A.tmp"C:\Users\Admin\AppData\Local\Temp\342A.tmp"101⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\34C7.tmp"C:\Users\Admin\AppData\Local\Temp\34C7.tmp"102⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"103⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\35E0.tmp"C:\Users\Admin\AppData\Local\Temp\35E0.tmp"104⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\364D.tmp"C:\Users\Admin\AppData\Local\Temp\364D.tmp"105⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\36BB.tmp"C:\Users\Admin\AppData\Local\Temp\36BB.tmp"106⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\3747.tmp"C:\Users\Admin\AppData\Local\Temp\3747.tmp"107⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\37C4.tmp"C:\Users\Admin\AppData\Local\Temp\37C4.tmp"108⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\3841.tmp"C:\Users\Admin\AppData\Local\Temp\3841.tmp"109⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\38ED.tmp"C:\Users\Admin\AppData\Local\Temp\38ED.tmp"110⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\396A.tmp"C:\Users\Admin\AppData\Local\Temp\396A.tmp"111⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\3A16.tmp"C:\Users\Admin\AppData\Local\Temp\3A16.tmp"112⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\3A93.tmp"C:\Users\Admin\AppData\Local\Temp\3A93.tmp"113⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\3B00.tmp"C:\Users\Admin\AppData\Local\Temp\3B00.tmp"114⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\3B7D.tmp"C:\Users\Admin\AppData\Local\Temp\3B7D.tmp"115⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\3C29.tmp"C:\Users\Admin\AppData\Local\Temp\3C29.tmp"116⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\3C97.tmp"C:\Users\Admin\AppData\Local\Temp\3C97.tmp"117⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\3D14.tmp"C:\Users\Admin\AppData\Local\Temp\3D14.tmp"118⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\3D91.tmp"C:\Users\Admin\AppData\Local\Temp\3D91.tmp"119⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\3E1D.tmp"C:\Users\Admin\AppData\Local\Temp\3E1D.tmp"120⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\3E9A.tmp"C:\Users\Admin\AppData\Local\Temp\3E9A.tmp"121⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\3F65.tmp"C:\Users\Admin\AppData\Local\Temp\3F65.tmp"122⤵PID:2340
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-