Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 05:01
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-10_eb2bb0ed0c5dce97452d0d08676b0563_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-05-10_eb2bb0ed0c5dce97452d0d08676b0563_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-10_eb2bb0ed0c5dce97452d0d08676b0563_mafia.exe
-
Size
486KB
-
MD5
eb2bb0ed0c5dce97452d0d08676b0563
-
SHA1
98dc47460690e15b46690b5d1c720b57b3cae40b
-
SHA256
6ca3c2510f42ae5d2dc83d6bd68a725e49e9ad92a19a880b9c87a931f2f409a8
-
SHA512
792057bf42d1f2f135809a99602999bd7dbb476d424f3f5847e74637c3a1b62bf6fe96273d35aa0622bdd6008639819cbef342823cf1d5dbb1f816f6f848f39c
-
SSDEEP
12288:/U5rCOTeiD3b1QW1O+KnX61r9menJe+48bYNZ:/UQOJDr1QUpKnK5gkeWUN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3172 E167.tmp 3644 E1F4.tmp 4992 E280.tmp 3132 E2FD.tmp 2380 E35B.tmp 4956 E3D8.tmp 2104 E426.tmp 1212 E4A3.tmp 3256 E4F1.tmp 4328 E55F.tmp 4920 E5DC.tmp 1404 E659.tmp 4380 E6D6.tmp 1064 E743.tmp 3364 E7B0.tmp 4404 E82D.tmp 2708 E88B.tmp 1564 E8E9.tmp 2232 E947.tmp 3732 E995.tmp 1488 EA12.tmp 4376 EA6F.tmp 2352 EAEC.tmp 1508 EB5A.tmp 1616 EBB8.tmp 4356 EC35.tmp 456 ECA2.tmp 5108 ECF0.tmp 3080 ED5D.tmp 1296 EDEA.tmp 4732 EE57.tmp 3064 EEB5.tmp 2872 EF32.tmp 3940 EF90.tmp 4644 EFEE.tmp 1776 F04B.tmp 3524 F0A9.tmp 3788 F0F7.tmp 2104 F145.tmp 5096 F194.tmp 1212 F1F1.tmp 3048 F23F.tmp 704 F29D.tmp 4328 F2FB.tmp 4920 F359.tmp 2244 F3B6.tmp 4484 F405.tmp 876 F462.tmp 5028 F4C0.tmp 1148 F51E.tmp 3516 F56C.tmp 2452 F5CA.tmp 2228 F627.tmp 4232 F685.tmp 1932 F6E3.tmp 1172 F731.tmp 1928 F77F.tmp 4888 F7CD.tmp 4400 F82B.tmp 1488 F879.tmp 3156 F8D7.tmp 4420 F935.tmp 1608 F983.tmp 2352 F9D1.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3492 wrote to memory of 3172 3492 2024-05-10_eb2bb0ed0c5dce97452d0d08676b0563_mafia.exe 90 PID 3492 wrote to memory of 3172 3492 2024-05-10_eb2bb0ed0c5dce97452d0d08676b0563_mafia.exe 90 PID 3492 wrote to memory of 3172 3492 2024-05-10_eb2bb0ed0c5dce97452d0d08676b0563_mafia.exe 90 PID 3172 wrote to memory of 3644 3172 E167.tmp 93 PID 3172 wrote to memory of 3644 3172 E167.tmp 93 PID 3172 wrote to memory of 3644 3172 E167.tmp 93 PID 3644 wrote to memory of 4992 3644 E1F4.tmp 94 PID 3644 wrote to memory of 4992 3644 E1F4.tmp 94 PID 3644 wrote to memory of 4992 3644 E1F4.tmp 94 PID 4992 wrote to memory of 3132 4992 E280.tmp 96 PID 4992 wrote to memory of 3132 4992 E280.tmp 96 PID 4992 wrote to memory of 3132 4992 E280.tmp 96 PID 3132 wrote to memory of 2380 3132 E2FD.tmp 97 PID 3132 wrote to memory of 2380 3132 E2FD.tmp 97 PID 3132 wrote to memory of 2380 3132 E2FD.tmp 97 PID 2380 wrote to memory of 4956 2380 E35B.tmp 98 PID 2380 wrote to memory of 4956 2380 E35B.tmp 98 PID 2380 wrote to memory of 4956 2380 E35B.tmp 98 PID 4956 wrote to memory of 2104 4956 E3D8.tmp 99 PID 4956 wrote to memory of 2104 4956 E3D8.tmp 99 PID 4956 wrote to memory of 2104 4956 E3D8.tmp 99 PID 2104 wrote to memory of 1212 2104 E426.tmp 100 PID 2104 wrote to memory of 1212 2104 E426.tmp 100 PID 2104 wrote to memory of 1212 2104 E426.tmp 100 PID 1212 wrote to memory of 3256 1212 E4A3.tmp 101 PID 1212 wrote to memory of 3256 1212 E4A3.tmp 101 PID 1212 wrote to memory of 3256 1212 E4A3.tmp 101 PID 3256 wrote to memory of 4328 3256 E4F1.tmp 102 PID 3256 wrote to memory of 4328 3256 E4F1.tmp 102 PID 3256 wrote to memory of 4328 3256 E4F1.tmp 102 PID 4328 wrote to memory of 4920 4328 E55F.tmp 103 PID 4328 wrote to memory of 4920 4328 E55F.tmp 103 PID 4328 wrote to memory of 4920 4328 E55F.tmp 103 PID 4920 wrote to memory of 1404 4920 E5DC.tmp 104 PID 4920 wrote to memory of 1404 4920 E5DC.tmp 104 PID 4920 wrote to memory of 1404 4920 E5DC.tmp 104 PID 1404 wrote to memory of 4380 1404 E659.tmp 105 PID 1404 wrote to memory of 4380 1404 E659.tmp 105 PID 1404 wrote to memory of 4380 1404 E659.tmp 105 PID 4380 wrote to memory of 1064 4380 E6D6.tmp 107 PID 4380 wrote to memory of 1064 4380 E6D6.tmp 107 PID 4380 wrote to memory of 1064 4380 E6D6.tmp 107 PID 1064 wrote to memory of 3364 1064 E743.tmp 108 PID 1064 wrote to memory of 3364 1064 E743.tmp 108 PID 1064 wrote to memory of 3364 1064 E743.tmp 108 PID 3364 wrote to memory of 4404 3364 E7B0.tmp 109 PID 3364 wrote to memory of 4404 3364 E7B0.tmp 109 PID 3364 wrote to memory of 4404 3364 E7B0.tmp 109 PID 4404 wrote to memory of 2708 4404 E82D.tmp 110 PID 4404 wrote to memory of 2708 4404 E82D.tmp 110 PID 4404 wrote to memory of 2708 4404 E82D.tmp 110 PID 2708 wrote to memory of 1564 2708 E88B.tmp 111 PID 2708 wrote to memory of 1564 2708 E88B.tmp 111 PID 2708 wrote to memory of 1564 2708 E88B.tmp 111 PID 1564 wrote to memory of 2232 1564 E8E9.tmp 112 PID 1564 wrote to memory of 2232 1564 E8E9.tmp 112 PID 1564 wrote to memory of 2232 1564 E8E9.tmp 112 PID 2232 wrote to memory of 3732 2232 E947.tmp 113 PID 2232 wrote to memory of 3732 2232 E947.tmp 113 PID 2232 wrote to memory of 3732 2232 E947.tmp 113 PID 3732 wrote to memory of 1488 3732 E995.tmp 114 PID 3732 wrote to memory of 1488 3732 E995.tmp 114 PID 3732 wrote to memory of 1488 3732 E995.tmp 114 PID 1488 wrote to memory of 4376 1488 EA12.tmp 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_eb2bb0ed0c5dce97452d0d08676b0563_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-10_eb2bb0ed0c5dce97452d0d08676b0563_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\E167.tmp"C:\Users\Admin\AppData\Local\Temp\E167.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\E1F4.tmp"C:\Users\Admin\AppData\Local\Temp\E1F4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\E280.tmp"C:\Users\Admin\AppData\Local\Temp\E280.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\E2FD.tmp"C:\Users\Admin\AppData\Local\Temp\E2FD.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\E35B.tmp"C:\Users\Admin\AppData\Local\Temp\E35B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\E3D8.tmp"C:\Users\Admin\AppData\Local\Temp\E3D8.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\E426.tmp"C:\Users\Admin\AppData\Local\Temp\E426.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\E4F1.tmp"C:\Users\Admin\AppData\Local\Temp\E4F1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\E55F.tmp"C:\Users\Admin\AppData\Local\Temp\E55F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\E659.tmp"C:\Users\Admin\AppData\Local\Temp\E659.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\E743.tmp"C:\Users\Admin\AppData\Local\Temp\E743.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\E82D.tmp"C:\Users\Admin\AppData\Local\Temp\E82D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\E88B.tmp"C:\Users\Admin\AppData\Local\Temp\E88B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\E947.tmp"C:\Users\Admin\AppData\Local\Temp\E947.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\E995.tmp"C:\Users\Admin\AppData\Local\Temp\E995.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\EA12.tmp"C:\Users\Admin\AppData\Local\Temp\EA12.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"23⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"24⤵
- Executes dropped EXE
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"25⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"26⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\EC35.tmp"C:\Users\Admin\AppData\Local\Temp\EC35.tmp"27⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\ECA2.tmp"C:\Users\Admin\AppData\Local\Temp\ECA2.tmp"28⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"29⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"30⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\EDEA.tmp"C:\Users\Admin\AppData\Local\Temp\EDEA.tmp"31⤵
- Executes dropped EXE
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\EE57.tmp"C:\Users\Admin\AppData\Local\Temp\EE57.tmp"32⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"33⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\EF32.tmp"C:\Users\Admin\AppData\Local\Temp\EF32.tmp"34⤵
- Executes dropped EXE
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\EF90.tmp"C:\Users\Admin\AppData\Local\Temp\EF90.tmp"35⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\EFEE.tmp"C:\Users\Admin\AppData\Local\Temp\EFEE.tmp"36⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\F04B.tmp"C:\Users\Admin\AppData\Local\Temp\F04B.tmp"37⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\F0A9.tmp"C:\Users\Admin\AppData\Local\Temp\F0A9.tmp"38⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\F0F7.tmp"C:\Users\Admin\AppData\Local\Temp\F0F7.tmp"39⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\F145.tmp"C:\Users\Admin\AppData\Local\Temp\F145.tmp"40⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\F194.tmp"C:\Users\Admin\AppData\Local\Temp\F194.tmp"41⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\F1F1.tmp"C:\Users\Admin\AppData\Local\Temp\F1F1.tmp"42⤵
- Executes dropped EXE
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\F23F.tmp"C:\Users\Admin\AppData\Local\Temp\F23F.tmp"43⤵
- Executes dropped EXE
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\F29D.tmp"C:\Users\Admin\AppData\Local\Temp\F29D.tmp"44⤵
- Executes dropped EXE
PID:704 -
C:\Users\Admin\AppData\Local\Temp\F2FB.tmp"C:\Users\Admin\AppData\Local\Temp\F2FB.tmp"45⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\F359.tmp"C:\Users\Admin\AppData\Local\Temp\F359.tmp"46⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"47⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\F405.tmp"C:\Users\Admin\AppData\Local\Temp\F405.tmp"48⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\F462.tmp"C:\Users\Admin\AppData\Local\Temp\F462.tmp"49⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\F4C0.tmp"C:\Users\Admin\AppData\Local\Temp\F4C0.tmp"50⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\F51E.tmp"C:\Users\Admin\AppData\Local\Temp\F51E.tmp"51⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\F56C.tmp"C:\Users\Admin\AppData\Local\Temp\F56C.tmp"52⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"53⤵
- Executes dropped EXE
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\F627.tmp"C:\Users\Admin\AppData\Local\Temp\F627.tmp"54⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\F685.tmp"C:\Users\Admin\AppData\Local\Temp\F685.tmp"55⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"56⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\F731.tmp"C:\Users\Admin\AppData\Local\Temp\F731.tmp"57⤵
- Executes dropped EXE
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\F77F.tmp"C:\Users\Admin\AppData\Local\Temp\F77F.tmp"58⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\F7CD.tmp"C:\Users\Admin\AppData\Local\Temp\F7CD.tmp"59⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\F82B.tmp"C:\Users\Admin\AppData\Local\Temp\F82B.tmp"60⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\F879.tmp"C:\Users\Admin\AppData\Local\Temp\F879.tmp"61⤵
- Executes dropped EXE
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\F8D7.tmp"C:\Users\Admin\AppData\Local\Temp\F8D7.tmp"62⤵
- Executes dropped EXE
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\F935.tmp"C:\Users\Admin\AppData\Local\Temp\F935.tmp"63⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\F983.tmp"C:\Users\Admin\AppData\Local\Temp\F983.tmp"64⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"65⤵
- Executes dropped EXE
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\FA2F.tmp"C:\Users\Admin\AppData\Local\Temp\FA2F.tmp"66⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"67⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"68⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\FB38.tmp"C:\Users\Admin\AppData\Local\Temp\FB38.tmp"69⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\FB86.tmp"C:\Users\Admin\AppData\Local\Temp\FB86.tmp"70⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\FBE4.tmp"C:\Users\Admin\AppData\Local\Temp\FBE4.tmp"71⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\FC32.tmp"C:\Users\Admin\AppData\Local\Temp\FC32.tmp"72⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\FC80.tmp"C:\Users\Admin\AppData\Local\Temp\FC80.tmp"73⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\FCDE.tmp"C:\Users\Admin\AppData\Local\Temp\FCDE.tmp"74⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"75⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\FD7A.tmp"C:\Users\Admin\AppData\Local\Temp\FD7A.tmp"76⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"77⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\FE26.tmp"C:\Users\Admin\AppData\Local\Temp\FE26.tmp"78⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\FE84.tmp"C:\Users\Admin\AppData\Local\Temp\FE84.tmp"79⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\FEE2.tmp"C:\Users\Admin\AppData\Local\Temp\FEE2.tmp"80⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\FF40.tmp"C:\Users\Admin\AppData\Local\Temp\FF40.tmp"81⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\FF8E.tmp"C:\Users\Admin\AppData\Local\Temp\FF8E.tmp"82⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"83⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A.tmp"84⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\88.tmp"C:\Users\Admin\AppData\Local\Temp\88.tmp"85⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\E5.tmp"C:\Users\Admin\AppData\Local\Temp\E5.tmp"86⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\134.tmp"C:\Users\Admin\AppData\Local\Temp\134.tmp"87⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\182.tmp"C:\Users\Admin\AppData\Local\Temp\182.tmp"88⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\1DF.tmp"C:\Users\Admin\AppData\Local\Temp\1DF.tmp"89⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\23D.tmp"C:\Users\Admin\AppData\Local\Temp\23D.tmp"90⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\29B.tmp"C:\Users\Admin\AppData\Local\Temp\29B.tmp"91⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\2F9.tmp"C:\Users\Admin\AppData\Local\Temp\2F9.tmp"92⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\347.tmp"C:\Users\Admin\AppData\Local\Temp\347.tmp"93⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\395.tmp"C:\Users\Admin\AppData\Local\Temp\395.tmp"94⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\3F3.tmp"C:\Users\Admin\AppData\Local\Temp\3F3.tmp"95⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\450.tmp"C:\Users\Admin\AppData\Local\Temp\450.tmp"96⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\49F.tmp"C:\Users\Admin\AppData\Local\Temp\49F.tmp"97⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\4ED.tmp"C:\Users\Admin\AppData\Local\Temp\4ED.tmp"98⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\54A.tmp"C:\Users\Admin\AppData\Local\Temp\54A.tmp"99⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\599.tmp"C:\Users\Admin\AppData\Local\Temp\599.tmp"100⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\5F6.tmp"C:\Users\Admin\AppData\Local\Temp\5F6.tmp"101⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\654.tmp"C:\Users\Admin\AppData\Local\Temp\654.tmp"102⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\6B2.tmp"C:\Users\Admin\AppData\Local\Temp\6B2.tmp"103⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\710.tmp"C:\Users\Admin\AppData\Local\Temp\710.tmp"104⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\76D.tmp"C:\Users\Admin\AppData\Local\Temp\76D.tmp"105⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\7BB.tmp"C:\Users\Admin\AppData\Local\Temp\7BB.tmp"106⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\819.tmp"C:\Users\Admin\AppData\Local\Temp\819.tmp"107⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\877.tmp"C:\Users\Admin\AppData\Local\Temp\877.tmp"108⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\8D5.tmp"C:\Users\Admin\AppData\Local\Temp\8D5.tmp"109⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\932.tmp"C:\Users\Admin\AppData\Local\Temp\932.tmp"110⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\981.tmp"C:\Users\Admin\AppData\Local\Temp\981.tmp"111⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\9CF.tmp"C:\Users\Admin\AppData\Local\Temp\9CF.tmp"112⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\A2C.tmp"C:\Users\Admin\AppData\Local\Temp\A2C.tmp"113⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\A8A.tmp"C:\Users\Admin\AppData\Local\Temp\A8A.tmp"114⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\AD8.tmp"C:\Users\Admin\AppData\Local\Temp\AD8.tmp"115⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\B36.tmp"C:\Users\Admin\AppData\Local\Temp\B36.tmp"116⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\B84.tmp"C:\Users\Admin\AppData\Local\Temp\B84.tmp"117⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\BD2.tmp"C:\Users\Admin\AppData\Local\Temp\BD2.tmp"118⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\C20.tmp"C:\Users\Admin\AppData\Local\Temp\C20.tmp"119⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"120⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\CBD.tmp"C:\Users\Admin\AppData\Local\Temp\CBD.tmp"121⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\D1A.tmp"C:\Users\Admin\AppData\Local\Temp\D1A.tmp"122⤵PID:3080
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-