Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10/07/2024, 07:25
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-10_7bd258e86a09b01481f5a2c429e2f8ac_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-07-10_7bd258e86a09b01481f5a2c429e2f8ac_mafia.exe
Resource
win10v2004-20240709-en
General
-
Target
2024-07-10_7bd258e86a09b01481f5a2c429e2f8ac_mafia.exe
-
Size
520KB
-
MD5
7bd258e86a09b01481f5a2c429e2f8ac
-
SHA1
c162c62eae7736afed976a3d2d457e86824474da
-
SHA256
847735838994ea6ecc53334b78b9386894226ad73d5241e6086cfee26dfcb372
-
SHA512
7ee53e69b42f465c6c26d40ac0a66754cb3d414a1b9cda9375bcacb6f98d34caf41ae63ee44bd982899f46b5c3ed271a002d7d357fd533aa2c4fec236f401af2
-
SSDEEP
12288:gj8fuxR21t5i8fdCHQpANRoKw1W/hVhqy0SOR9NZ:gj8fuK1GYdnAN6Kw1W/46O3N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4972 CCB6.tmp 2508 CD52.tmp 1548 CDDF.tmp 4172 CE7B.tmp 2336 CF27.tmp 4408 CF94.tmp 4416 D031.tmp 1824 D0AE.tmp 4988 D12B.tmp 1068 D1E6.tmp 1200 D254.tmp 1800 D2E0.tmp 1108 D36D.tmp 4936 D3EA.tmp 1440 D486.tmp 1868 D503.tmp 4520 D551.tmp 1640 D5BF.tmp 2632 D66A.tmp 364 D6C8.tmp 2216 D736.tmp 1848 D7B3.tmp 2572 D830.tmp 1980 D89D.tmp 3308 D90A.tmp 1564 D987.tmp 1048 DA14.tmp 3600 DA91.tmp 988 DB0E.tmp 1112 DB8B.tmp 4916 DBE9.tmp 4212 DC75.tmp 2176 DCE3.tmp 1736 DD40.tmp 4372 DD9E.tmp 1704 DDEC.tmp 524 DE4A.tmp 4556 DEA8.tmp 1268 DF06.tmp 3588 DF54.tmp 940 DFC1.tmp 3572 E00F.tmp 3752 E07D.tmp 464 E0DA.tmp 2756 E128.tmp 384 E186.tmp 2816 E1D4.tmp 4528 E232.tmp 4800 E290.tmp 4516 E2FD.tmp 4320 E36B.tmp 2636 E3B9.tmp 3232 E416.tmp 1844 E474.tmp 1016 E4D2.tmp 3368 E53F.tmp 2948 E58D.tmp 3948 E5DC.tmp 3596 E639.tmp 3960 E697.tmp 4204 E6F5.tmp 1632 E753.tmp 4480 E7C0.tmp 3420 E81E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4328 wrote to memory of 4972 4328 2024-07-10_7bd258e86a09b01481f5a2c429e2f8ac_mafia.exe 83 PID 4328 wrote to memory of 4972 4328 2024-07-10_7bd258e86a09b01481f5a2c429e2f8ac_mafia.exe 83 PID 4328 wrote to memory of 4972 4328 2024-07-10_7bd258e86a09b01481f5a2c429e2f8ac_mafia.exe 83 PID 4972 wrote to memory of 2508 4972 CCB6.tmp 84 PID 4972 wrote to memory of 2508 4972 CCB6.tmp 84 PID 4972 wrote to memory of 2508 4972 CCB6.tmp 84 PID 2508 wrote to memory of 1548 2508 CD52.tmp 86 PID 2508 wrote to memory of 1548 2508 CD52.tmp 86 PID 2508 wrote to memory of 1548 2508 CD52.tmp 86 PID 1548 wrote to memory of 4172 1548 CDDF.tmp 87 PID 1548 wrote to memory of 4172 1548 CDDF.tmp 87 PID 1548 wrote to memory of 4172 1548 CDDF.tmp 87 PID 4172 wrote to memory of 2336 4172 CE7B.tmp 88 PID 4172 wrote to memory of 2336 4172 CE7B.tmp 88 PID 4172 wrote to memory of 2336 4172 CE7B.tmp 88 PID 2336 wrote to memory of 4408 2336 CF27.tmp 89 PID 2336 wrote to memory of 4408 2336 CF27.tmp 89 PID 2336 wrote to memory of 4408 2336 CF27.tmp 89 PID 4408 wrote to memory of 4416 4408 CF94.tmp 90 PID 4408 wrote to memory of 4416 4408 CF94.tmp 90 PID 4408 wrote to memory of 4416 4408 CF94.tmp 90 PID 4416 wrote to memory of 1824 4416 D031.tmp 91 PID 4416 wrote to memory of 1824 4416 D031.tmp 91 PID 4416 wrote to memory of 1824 4416 D031.tmp 91 PID 1824 wrote to memory of 4988 1824 D0AE.tmp 92 PID 1824 wrote to memory of 4988 1824 D0AE.tmp 92 PID 1824 wrote to memory of 4988 1824 D0AE.tmp 92 PID 4988 wrote to memory of 1068 4988 D12B.tmp 93 PID 4988 wrote to memory of 1068 4988 D12B.tmp 93 PID 4988 wrote to memory of 1068 4988 D12B.tmp 93 PID 1068 wrote to memory of 1200 1068 D1E6.tmp 94 PID 1068 wrote to memory of 1200 1068 D1E6.tmp 94 PID 1068 wrote to memory of 1200 1068 D1E6.tmp 94 PID 1200 wrote to memory of 1800 1200 D254.tmp 95 PID 1200 wrote to memory of 1800 1200 D254.tmp 95 PID 1200 wrote to memory of 1800 1200 D254.tmp 95 PID 1800 wrote to memory of 1108 1800 D2E0.tmp 96 PID 1800 wrote to memory of 1108 1800 D2E0.tmp 96 PID 1800 wrote to memory of 1108 1800 D2E0.tmp 96 PID 1108 wrote to memory of 4936 1108 D36D.tmp 97 PID 1108 wrote to memory of 4936 1108 D36D.tmp 97 PID 1108 wrote to memory of 4936 1108 D36D.tmp 97 PID 4936 wrote to memory of 1440 4936 D3EA.tmp 98 PID 4936 wrote to memory of 1440 4936 D3EA.tmp 98 PID 4936 wrote to memory of 1440 4936 D3EA.tmp 98 PID 1440 wrote to memory of 1868 1440 D486.tmp 99 PID 1440 wrote to memory of 1868 1440 D486.tmp 99 PID 1440 wrote to memory of 1868 1440 D486.tmp 99 PID 1868 wrote to memory of 4520 1868 D503.tmp 100 PID 1868 wrote to memory of 4520 1868 D503.tmp 100 PID 1868 wrote to memory of 4520 1868 D503.tmp 100 PID 4520 wrote to memory of 1640 4520 D551.tmp 101 PID 4520 wrote to memory of 1640 4520 D551.tmp 101 PID 4520 wrote to memory of 1640 4520 D551.tmp 101 PID 1640 wrote to memory of 2632 1640 D5BF.tmp 102 PID 1640 wrote to memory of 2632 1640 D5BF.tmp 102 PID 1640 wrote to memory of 2632 1640 D5BF.tmp 102 PID 2632 wrote to memory of 364 2632 D66A.tmp 103 PID 2632 wrote to memory of 364 2632 D66A.tmp 103 PID 2632 wrote to memory of 364 2632 D66A.tmp 103 PID 364 wrote to memory of 2216 364 D6C8.tmp 104 PID 364 wrote to memory of 2216 364 D6C8.tmp 104 PID 364 wrote to memory of 2216 364 D6C8.tmp 104 PID 2216 wrote to memory of 1848 2216 D736.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-10_7bd258e86a09b01481f5a2c429e2f8ac_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-10_7bd258e86a09b01481f5a2c429e2f8ac_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\CD52.tmp"C:\Users\Admin\AppData\Local\Temp\CD52.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\CDDF.tmp"C:\Users\Admin\AppData\Local\Temp\CDDF.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\CF27.tmp"C:\Users\Admin\AppData\Local\Temp\CF27.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\CF94.tmp"C:\Users\Admin\AppData\Local\Temp\CF94.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\D031.tmp"C:\Users\Admin\AppData\Local\Temp\D031.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\D12B.tmp"C:\Users\Admin\AppData\Local\Temp\D12B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\D254.tmp"C:\Users\Admin\AppData\Local\Temp\D254.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\D36D.tmp"C:\Users\Admin\AppData\Local\Temp\D36D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\D3EA.tmp"C:\Users\Admin\AppData\Local\Temp\D3EA.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\D486.tmp"C:\Users\Admin\AppData\Local\Temp\D486.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\D503.tmp"C:\Users\Admin\AppData\Local\Temp\D503.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\D551.tmp"C:\Users\Admin\AppData\Local\Temp\D551.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\D5BF.tmp"C:\Users\Admin\AppData\Local\Temp\D5BF.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\D66A.tmp"C:\Users\Admin\AppData\Local\Temp\D66A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\AppData\Local\Temp\D736.tmp"C:\Users\Admin\AppData\Local\Temp\D736.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"23⤵
- Executes dropped EXE
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\D830.tmp"C:\Users\Admin\AppData\Local\Temp\D830.tmp"24⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\D89D.tmp"C:\Users\Admin\AppData\Local\Temp\D89D.tmp"25⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\D90A.tmp"C:\Users\Admin\AppData\Local\Temp\D90A.tmp"26⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\D987.tmp"C:\Users\Admin\AppData\Local\Temp\D987.tmp"27⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\DA14.tmp"C:\Users\Admin\AppData\Local\Temp\DA14.tmp"28⤵
- Executes dropped EXE
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\DA91.tmp"C:\Users\Admin\AppData\Local\Temp\DA91.tmp"29⤵
- Executes dropped EXE
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\DB0E.tmp"C:\Users\Admin\AppData\Local\Temp\DB0E.tmp"30⤵
- Executes dropped EXE
PID:988 -
C:\Users\Admin\AppData\Local\Temp\DB8B.tmp"C:\Users\Admin\AppData\Local\Temp\DB8B.tmp"31⤵
- Executes dropped EXE
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\DBE9.tmp"C:\Users\Admin\AppData\Local\Temp\DBE9.tmp"32⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\DC75.tmp"C:\Users\Admin\AppData\Local\Temp\DC75.tmp"33⤵
- Executes dropped EXE
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\DCE3.tmp"C:\Users\Admin\AppData\Local\Temp\DCE3.tmp"34⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\DD40.tmp"C:\Users\Admin\AppData\Local\Temp\DD40.tmp"35⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\DD9E.tmp"C:\Users\Admin\AppData\Local\Temp\DD9E.tmp"36⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\DDEC.tmp"C:\Users\Admin\AppData\Local\Temp\DDEC.tmp"37⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\DE4A.tmp"C:\Users\Admin\AppData\Local\Temp\DE4A.tmp"38⤵
- Executes dropped EXE
PID:524 -
C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"39⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\DF06.tmp"C:\Users\Admin\AppData\Local\Temp\DF06.tmp"40⤵
- Executes dropped EXE
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\DF54.tmp"C:\Users\Admin\AppData\Local\Temp\DF54.tmp"41⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\DFC1.tmp"C:\Users\Admin\AppData\Local\Temp\DFC1.tmp"42⤵
- Executes dropped EXE
PID:940 -
C:\Users\Admin\AppData\Local\Temp\E00F.tmp"C:\Users\Admin\AppData\Local\Temp\E00F.tmp"43⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\E07D.tmp"C:\Users\Admin\AppData\Local\Temp\E07D.tmp"44⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"45⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\E128.tmp"C:\Users\Admin\AppData\Local\Temp\E128.tmp"46⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\E186.tmp"C:\Users\Admin\AppData\Local\Temp\E186.tmp"47⤵
- Executes dropped EXE
PID:384 -
C:\Users\Admin\AppData\Local\Temp\E1D4.tmp"C:\Users\Admin\AppData\Local\Temp\E1D4.tmp"48⤵
- Executes dropped EXE
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\E232.tmp"C:\Users\Admin\AppData\Local\Temp\E232.tmp"49⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\E290.tmp"C:\Users\Admin\AppData\Local\Temp\E290.tmp"50⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\E2FD.tmp"C:\Users\Admin\AppData\Local\Temp\E2FD.tmp"51⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\E36B.tmp"C:\Users\Admin\AppData\Local\Temp\E36B.tmp"52⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"53⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\E416.tmp"C:\Users\Admin\AppData\Local\Temp\E416.tmp"54⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\E474.tmp"C:\Users\Admin\AppData\Local\Temp\E474.tmp"55⤵
- Executes dropped EXE
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\E4D2.tmp"C:\Users\Admin\AppData\Local\Temp\E4D2.tmp"56⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\E53F.tmp"C:\Users\Admin\AppData\Local\Temp\E53F.tmp"57⤵
- Executes dropped EXE
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\E58D.tmp"C:\Users\Admin\AppData\Local\Temp\E58D.tmp"58⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"59⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\E639.tmp"C:\Users\Admin\AppData\Local\Temp\E639.tmp"60⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\E697.tmp"C:\Users\Admin\AppData\Local\Temp\E697.tmp"61⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"62⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\E753.tmp"C:\Users\Admin\AppData\Local\Temp\E753.tmp"63⤵
- Executes dropped EXE
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"64⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\E81E.tmp"C:\Users\Admin\AppData\Local\Temp\E81E.tmp"65⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\E86C.tmp"C:\Users\Admin\AppData\Local\Temp\E86C.tmp"66⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\E8CA.tmp"C:\Users\Admin\AppData\Local\Temp\E8CA.tmp"67⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\E927.tmp"C:\Users\Admin\AppData\Local\Temp\E927.tmp"68⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\E975.tmp"C:\Users\Admin\AppData\Local\Temp\E975.tmp"69⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"70⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\EA21.tmp"C:\Users\Admin\AppData\Local\Temp\EA21.tmp"71⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"72⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\EABE.tmp"C:\Users\Admin\AppData\Local\Temp\EABE.tmp"73⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\EB1B.tmp"C:\Users\Admin\AppData\Local\Temp\EB1B.tmp"74⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\EB79.tmp"C:\Users\Admin\AppData\Local\Temp\EB79.tmp"75⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"76⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\EC35.tmp"C:\Users\Admin\AppData\Local\Temp\EC35.tmp"77⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\EC92.tmp"C:\Users\Admin\AppData\Local\Temp\EC92.tmp"78⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\ECE0.tmp"C:\Users\Admin\AppData\Local\Temp\ECE0.tmp"79⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\ED3E.tmp"C:\Users\Admin\AppData\Local\Temp\ED3E.tmp"80⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"81⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\EDEA.tmp"C:\Users\Admin\AppData\Local\Temp\EDEA.tmp"82⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\EE38.tmp"C:\Users\Admin\AppData\Local\Temp\EE38.tmp"83⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\EE86.tmp"C:\Users\Admin\AppData\Local\Temp\EE86.tmp"84⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"85⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\EF32.tmp"C:\Users\Admin\AppData\Local\Temp\EF32.tmp"86⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\EF90.tmp"C:\Users\Admin\AppData\Local\Temp\EF90.tmp"87⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\EFEE.tmp"C:\Users\Admin\AppData\Local\Temp\EFEE.tmp"88⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\F03C.tmp"C:\Users\Admin\AppData\Local\Temp\F03C.tmp"89⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\F09A.tmp"C:\Users\Admin\AppData\Local\Temp\F09A.tmp"90⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\F0E8.tmp"C:\Users\Admin\AppData\Local\Temp\F0E8.tmp"91⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\F145.tmp"C:\Users\Admin\AppData\Local\Temp\F145.tmp"92⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\F1B3.tmp"C:\Users\Admin\AppData\Local\Temp\F1B3.tmp"93⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\F211.tmp"C:\Users\Admin\AppData\Local\Temp\F211.tmp"94⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\F25F.tmp"C:\Users\Admin\AppData\Local\Temp\F25F.tmp"95⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\F2AD.tmp"C:\Users\Admin\AppData\Local\Temp\F2AD.tmp"96⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\F30B.tmp"C:\Users\Admin\AppData\Local\Temp\F30B.tmp"97⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\F368.tmp"C:\Users\Admin\AppData\Local\Temp\F368.tmp"98⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"99⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\F414.tmp"C:\Users\Admin\AppData\Local\Temp\F414.tmp"100⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\F462.tmp"C:\Users\Admin\AppData\Local\Temp\F462.tmp"101⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\F4C0.tmp"C:\Users\Admin\AppData\Local\Temp\F4C0.tmp"102⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\F50E.tmp"C:\Users\Admin\AppData\Local\Temp\F50E.tmp"103⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\F56C.tmp"C:\Users\Admin\AppData\Local\Temp\F56C.tmp"104⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\F5BA.tmp"C:\Users\Admin\AppData\Local\Temp\F5BA.tmp"105⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\F608.tmp"C:\Users\Admin\AppData\Local\Temp\F608.tmp"106⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\F666.tmp"C:\Users\Admin\AppData\Local\Temp\F666.tmp"107⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\F6C4.tmp"C:\Users\Admin\AppData\Local\Temp\F6C4.tmp"108⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\F721.tmp"C:\Users\Admin\AppData\Local\Temp\F721.tmp"109⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\F770.tmp"C:\Users\Admin\AppData\Local\Temp\F770.tmp"110⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\F7BE.tmp"C:\Users\Admin\AppData\Local\Temp\F7BE.tmp"111⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\F81B.tmp"C:\Users\Admin\AppData\Local\Temp\F81B.tmp"112⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\F889.tmp"C:\Users\Admin\AppData\Local\Temp\F889.tmp"113⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\F8F6.tmp"C:\Users\Admin\AppData\Local\Temp\F8F6.tmp"114⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\F964.tmp"C:\Users\Admin\AppData\Local\Temp\F964.tmp"115⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\F9C1.tmp"C:\Users\Admin\AppData\Local\Temp\F9C1.tmp"116⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\FA1F.tmp"C:\Users\Admin\AppData\Local\Temp\FA1F.tmp"117⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"118⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"119⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\FB48.tmp"C:\Users\Admin\AppData\Local\Temp\FB48.tmp"120⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"121⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\FC03.tmp"C:\Users\Admin\AppData\Local\Temp\FC03.tmp"122⤵PID:4572
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-