Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28/04/2024, 11:51
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-28_1a4977c026a31ee964d990c88372e1f9_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-04-28_1a4977c026a31ee964d990c88372e1f9_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-04-28_1a4977c026a31ee964d990c88372e1f9_mafia.exe
-
Size
536KB
-
MD5
1a4977c026a31ee964d990c88372e1f9
-
SHA1
d5e2d62bf8f30b34b50c9229b4faa9c1e0a9a672
-
SHA256
9fb1f89cb5e9ae452d3d37cd09cf2df9e1ae4bffff2417015c8392f89f955c44
-
SHA512
cf382d62aaade7e7af45792abc7c743e1200c5fd2aed80c070f05ecdca4f439710020166e46cf35a5902d8c654302c498599d5bb60303b00521962cd6049a745
-
SSDEEP
12288:wU5rCOTeiUu6prNJoY4nup/48FFBvJCi2xyuIZxVJ0ZT9:wUQOJUuYZSYDt4ODvJCTxyuIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3596 54C7.tmp 184 5592.tmp 852 564E.tmp 4804 5728.tmp 2752 5813.tmp 1204 58CE.tmp 668 598A.tmp 1384 5A74.tmp 1956 5B20.tmp 1872 5BDB.tmp 3024 5C97.tmp 3620 5D33.tmp 2784 5E0E.tmp 3000 5E9B.tmp 972 5F56.tmp 4796 5FE3.tmp 3064 608F.tmp 2160 615A.tmp 4600 6215.tmp 1764 6300.tmp 2672 639C.tmp 3924 6467.tmp 2824 6503.tmp 1616 65AF.tmp 1744 664B.tmp 4004 6716.tmp 1640 67B3.tmp 2316 684F.tmp 840 691A.tmp 3568 69B6.tmp 3580 6A62.tmp 2860 6AEF.tmp 5004 6BAA.tmp 1292 6C18.tmp 2236 6C75.tmp 1716 6CE3.tmp 4952 6D7F.tmp 4000 6DEC.tmp 2076 6E5A.tmp 3928 6EC7.tmp 960 6F35.tmp 4324 6F92.tmp 1948 7000.tmp 3732 709C.tmp 2772 7119.tmp 4572 71B5.tmp 3552 7251.tmp 1192 72AF.tmp 4664 734B.tmp 2080 73A9.tmp 1316 7417.tmp 4208 7465.tmp 4772 74B3.tmp 1496 7501.tmp 5112 755F.tmp 1148 75BC.tmp 3620 762A.tmp 3664 7678.tmp 2980 76C6.tmp 4848 7733.tmp 2624 77A1.tmp 2572 77FF.tmp 2468 784D.tmp 4868 789B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3420 wrote to memory of 3596 3420 2024-04-28_1a4977c026a31ee964d990c88372e1f9_mafia.exe 82 PID 3420 wrote to memory of 3596 3420 2024-04-28_1a4977c026a31ee964d990c88372e1f9_mafia.exe 82 PID 3420 wrote to memory of 3596 3420 2024-04-28_1a4977c026a31ee964d990c88372e1f9_mafia.exe 82 PID 3596 wrote to memory of 184 3596 54C7.tmp 84 PID 3596 wrote to memory of 184 3596 54C7.tmp 84 PID 3596 wrote to memory of 184 3596 54C7.tmp 84 PID 184 wrote to memory of 852 184 5592.tmp 86 PID 184 wrote to memory of 852 184 5592.tmp 86 PID 184 wrote to memory of 852 184 5592.tmp 86 PID 852 wrote to memory of 4804 852 564E.tmp 88 PID 852 wrote to memory of 4804 852 564E.tmp 88 PID 852 wrote to memory of 4804 852 564E.tmp 88 PID 4804 wrote to memory of 2752 4804 5728.tmp 89 PID 4804 wrote to memory of 2752 4804 5728.tmp 89 PID 4804 wrote to memory of 2752 4804 5728.tmp 89 PID 2752 wrote to memory of 1204 2752 5813.tmp 90 PID 2752 wrote to memory of 1204 2752 5813.tmp 90 PID 2752 wrote to memory of 1204 2752 5813.tmp 90 PID 1204 wrote to memory of 668 1204 58CE.tmp 91 PID 1204 wrote to memory of 668 1204 58CE.tmp 91 PID 1204 wrote to memory of 668 1204 58CE.tmp 91 PID 668 wrote to memory of 1384 668 598A.tmp 92 PID 668 wrote to memory of 1384 668 598A.tmp 92 PID 668 wrote to memory of 1384 668 598A.tmp 92 PID 1384 wrote to memory of 1956 1384 5A74.tmp 93 PID 1384 wrote to memory of 1956 1384 5A74.tmp 93 PID 1384 wrote to memory of 1956 1384 5A74.tmp 93 PID 1956 wrote to memory of 1872 1956 5B20.tmp 94 PID 1956 wrote to memory of 1872 1956 5B20.tmp 94 PID 1956 wrote to memory of 1872 1956 5B20.tmp 94 PID 1872 wrote to memory of 3024 1872 5BDB.tmp 95 PID 1872 wrote to memory of 3024 1872 5BDB.tmp 95 PID 1872 wrote to memory of 3024 1872 5BDB.tmp 95 PID 3024 wrote to memory of 3620 3024 5C97.tmp 96 PID 3024 wrote to memory of 3620 3024 5C97.tmp 96 PID 3024 wrote to memory of 3620 3024 5C97.tmp 96 PID 3620 wrote to memory of 2784 3620 5D33.tmp 97 PID 3620 wrote to memory of 2784 3620 5D33.tmp 97 PID 3620 wrote to memory of 2784 3620 5D33.tmp 97 PID 2784 wrote to memory of 3000 2784 5E0E.tmp 98 PID 2784 wrote to memory of 3000 2784 5E0E.tmp 98 PID 2784 wrote to memory of 3000 2784 5E0E.tmp 98 PID 3000 wrote to memory of 972 3000 5E9B.tmp 99 PID 3000 wrote to memory of 972 3000 5E9B.tmp 99 PID 3000 wrote to memory of 972 3000 5E9B.tmp 99 PID 972 wrote to memory of 4796 972 5F56.tmp 100 PID 972 wrote to memory of 4796 972 5F56.tmp 100 PID 972 wrote to memory of 4796 972 5F56.tmp 100 PID 4796 wrote to memory of 3064 4796 5FE3.tmp 101 PID 4796 wrote to memory of 3064 4796 5FE3.tmp 101 PID 4796 wrote to memory of 3064 4796 5FE3.tmp 101 PID 3064 wrote to memory of 2160 3064 608F.tmp 102 PID 3064 wrote to memory of 2160 3064 608F.tmp 102 PID 3064 wrote to memory of 2160 3064 608F.tmp 102 PID 2160 wrote to memory of 4600 2160 615A.tmp 103 PID 2160 wrote to memory of 4600 2160 615A.tmp 103 PID 2160 wrote to memory of 4600 2160 615A.tmp 103 PID 4600 wrote to memory of 1764 4600 6215.tmp 104 PID 4600 wrote to memory of 1764 4600 6215.tmp 104 PID 4600 wrote to memory of 1764 4600 6215.tmp 104 PID 1764 wrote to memory of 2672 1764 6300.tmp 105 PID 1764 wrote to memory of 2672 1764 6300.tmp 105 PID 1764 wrote to memory of 2672 1764 6300.tmp 105 PID 2672 wrote to memory of 3924 2672 639C.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_1a4977c026a31ee964d990c88372e1f9_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_1a4977c026a31ee964d990c88372e1f9_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:184 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"23⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"24⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"25⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"26⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"27⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"28⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"29⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"30⤵
- Executes dropped EXE
PID:840 -
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"31⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"32⤵
- Executes dropped EXE
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"33⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"34⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"35⤵
- Executes dropped EXE
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"36⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"37⤵
- Executes dropped EXE
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"38⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"39⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"40⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"41⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"42⤵
- Executes dropped EXE
PID:960 -
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"43⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"44⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"45⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"46⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\71B5.tmp"C:\Users\Admin\AppData\Local\Temp\71B5.tmp"47⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"48⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"49⤵
- Executes dropped EXE
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"50⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"51⤵
- Executes dropped EXE
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"52⤵
- Executes dropped EXE
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"53⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"54⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"55⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"56⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"57⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"58⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"59⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"60⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"61⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\77A1.tmp"C:\Users\Admin\AppData\Local\Temp\77A1.tmp"62⤵
- Executes dropped EXE
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\77FF.tmp"C:\Users\Admin\AppData\Local\Temp\77FF.tmp"63⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"64⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\789B.tmp"C:\Users\Admin\AppData\Local\Temp\789B.tmp"65⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\78F9.tmp"C:\Users\Admin\AppData\Local\Temp\78F9.tmp"66⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"67⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\79A4.tmp"C:\Users\Admin\AppData\Local\Temp\79A4.tmp"68⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"69⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"70⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"71⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"72⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"73⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\7B98.tmp"C:\Users\Admin\AppData\Local\Temp\7B98.tmp"74⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"75⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\7C35.tmp"C:\Users\Admin\AppData\Local\Temp\7C35.tmp"76⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\7C92.tmp"C:\Users\Admin\AppData\Local\Temp\7C92.tmp"77⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"78⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"79⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"80⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"81⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\7E29.tmp"C:\Users\Admin\AppData\Local\Temp\7E29.tmp"82⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\7E77.tmp"C:\Users\Admin\AppData\Local\Temp\7E77.tmp"83⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"84⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\7F32.tmp"C:\Users\Admin\AppData\Local\Temp\7F32.tmp"85⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\7F80.tmp"C:\Users\Admin\AppData\Local\Temp\7F80.tmp"86⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"87⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\803C.tmp"C:\Users\Admin\AppData\Local\Temp\803C.tmp"88⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\809A.tmp"C:\Users\Admin\AppData\Local\Temp\809A.tmp"89⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\80E8.tmp"C:\Users\Admin\AppData\Local\Temp\80E8.tmp"90⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\8136.tmp"C:\Users\Admin\AppData\Local\Temp\8136.tmp"91⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\8184.tmp"C:\Users\Admin\AppData\Local\Temp\8184.tmp"92⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\81D2.tmp"C:\Users\Admin\AppData\Local\Temp\81D2.tmp"93⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\8230.tmp"C:\Users\Admin\AppData\Local\Temp\8230.tmp"94⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\827E.tmp"C:\Users\Admin\AppData\Local\Temp\827E.tmp"95⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\82DC.tmp"C:\Users\Admin\AppData\Local\Temp\82DC.tmp"96⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"97⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\8378.tmp"C:\Users\Admin\AppData\Local\Temp\8378.tmp"98⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\83E5.tmp"C:\Users\Admin\AppData\Local\Temp\83E5.tmp"99⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\8434.tmp"C:\Users\Admin\AppData\Local\Temp\8434.tmp"100⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\8482.tmp"C:\Users\Admin\AppData\Local\Temp\8482.tmp"101⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\84DF.tmp"C:\Users\Admin\AppData\Local\Temp\84DF.tmp"102⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\853D.tmp"C:\Users\Admin\AppData\Local\Temp\853D.tmp"103⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\858B.tmp"C:\Users\Admin\AppData\Local\Temp\858B.tmp"104⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\85D9.tmp"C:\Users\Admin\AppData\Local\Temp\85D9.tmp"105⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\8637.tmp"C:\Users\Admin\AppData\Local\Temp\8637.tmp"106⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\8695.tmp"C:\Users\Admin\AppData\Local\Temp\8695.tmp"107⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\86F3.tmp"C:\Users\Admin\AppData\Local\Temp\86F3.tmp"108⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\8750.tmp"C:\Users\Admin\AppData\Local\Temp\8750.tmp"109⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\879F.tmp"C:\Users\Admin\AppData\Local\Temp\879F.tmp"110⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"111⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\883B.tmp"C:\Users\Admin\AppData\Local\Temp\883B.tmp"112⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\8899.tmp"C:\Users\Admin\AppData\Local\Temp\8899.tmp"113⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\88F6.tmp"C:\Users\Admin\AppData\Local\Temp\88F6.tmp"114⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"115⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\8993.tmp"C:\Users\Admin\AppData\Local\Temp\8993.tmp"116⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\89E1.tmp"C:\Users\Admin\AppData\Local\Temp\89E1.tmp"117⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"118⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"119⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"120⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\8B19.tmp"C:\Users\Admin\AppData\Local\Temp\8B19.tmp"121⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\8B77.tmp"C:\Users\Admin\AppData\Local\Temp\8B77.tmp"122⤵PID:4232
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-