Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
164s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
21/10/2023, 20:57
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.2023-09-09_13267480011709c594e320a4ac156766_mafia_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.2023-09-09_13267480011709c594e320a4ac156766_mafia_JC.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.2023-09-09_13267480011709c594e320a4ac156766_mafia_JC.exe
-
Size
488KB
-
MD5
13267480011709c594e320a4ac156766
-
SHA1
f35eaee60e58b7746f318c6e48cf536bba525d62
-
SHA256
7b49cf758fee7e9699a9ea441b31e76807a1be929db39e20a57b73f7e9080734
-
SHA512
c7da1dfef3150eb4e413fefe684f158b67ac1a19f244382bfde8e8db9eea966f45b7fd5f07a0703a8af424684677964a76b210bdc3f68b81571cf9f4a85946f7
-
SSDEEP
12288:/U5rCOTeiDTbrTsWePU4MuDmseM5qg+6othNZ:/UQOJDHrQWes4qseiJvON
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3276 DF83.tmp 560 E0EA.tmp 1996 E196.tmp 1968 E38A.tmp 3428 E465.tmp 4772 E520.tmp 1500 E5CC.tmp 2100 E668.tmp 2464 E704.tmp 4992 F194.tmp 416 F59B.tmp 3460 F647.tmp 3744 F6E3.tmp 4296 F964.tmp 2952 FA00.tmp 3900 FB09.tmp 2956 FBC5.tmp 4224 FFAD.tmp 1016 1B1.tmp 772 5A8.tmp 4244 7FA.tmp 4860 122B.tmp 4784 1345.tmp 3044 17E8.tmp 388 1884.tmp 4880 1FC8.tmp 4588 218D.tmp 3856 2277.tmp 3484 2323.tmp 4916 23EE.tmp 4620 24C9.tmp 4436 25F2.tmp 3464 28FF.tmp 2504 298C.tmp 5052 2A18.tmp 4324 2AB5.tmp 3152 317B.tmp 3560 3330.tmp 3680 33DC.tmp 5040 3488.tmp 1068 3534.tmp 760 35D0.tmp 1864 3757.tmp 3804 4513.tmp 1436 4AA0.tmp 836 4CB4.tmp 3276 4D40.tmp 1108 4DAE.tmp 2864 4E2B.tmp 4876 5270.tmp 4952 53D8.tmp 5104 54E1.tmp 2952 553F.tmp 4092 5B79.tmp 2508 5E09.tmp 3612 628D.tmp 5056 6424.tmp 3328 684A.tmp 2516 6EE2.tmp 2196 7664.tmp 1956 84CB.tmp 1340 8A97.tmp 4492 943C.tmp 4392 94D8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3136 wrote to memory of 3276 3136 NEAS.2023-09-09_13267480011709c594e320a4ac156766_mafia_JC.exe 84 PID 3136 wrote to memory of 3276 3136 NEAS.2023-09-09_13267480011709c594e320a4ac156766_mafia_JC.exe 84 PID 3136 wrote to memory of 3276 3136 NEAS.2023-09-09_13267480011709c594e320a4ac156766_mafia_JC.exe 84 PID 3276 wrote to memory of 560 3276 DF83.tmp 86 PID 3276 wrote to memory of 560 3276 DF83.tmp 86 PID 3276 wrote to memory of 560 3276 DF83.tmp 86 PID 560 wrote to memory of 1996 560 E0EA.tmp 87 PID 560 wrote to memory of 1996 560 E0EA.tmp 87 PID 560 wrote to memory of 1996 560 E0EA.tmp 87 PID 1996 wrote to memory of 1968 1996 E196.tmp 88 PID 1996 wrote to memory of 1968 1996 E196.tmp 88 PID 1996 wrote to memory of 1968 1996 E196.tmp 88 PID 1968 wrote to memory of 3428 1968 E38A.tmp 89 PID 1968 wrote to memory of 3428 1968 E38A.tmp 89 PID 1968 wrote to memory of 3428 1968 E38A.tmp 89 PID 3428 wrote to memory of 4772 3428 E465.tmp 90 PID 3428 wrote to memory of 4772 3428 E465.tmp 90 PID 3428 wrote to memory of 4772 3428 E465.tmp 90 PID 4772 wrote to memory of 1500 4772 E520.tmp 91 PID 4772 wrote to memory of 1500 4772 E520.tmp 91 PID 4772 wrote to memory of 1500 4772 E520.tmp 91 PID 1500 wrote to memory of 2100 1500 E5CC.tmp 92 PID 1500 wrote to memory of 2100 1500 E5CC.tmp 92 PID 1500 wrote to memory of 2100 1500 E5CC.tmp 92 PID 2100 wrote to memory of 2464 2100 E668.tmp 93 PID 2100 wrote to memory of 2464 2100 E668.tmp 93 PID 2100 wrote to memory of 2464 2100 E668.tmp 93 PID 2464 wrote to memory of 4992 2464 E704.tmp 94 PID 2464 wrote to memory of 4992 2464 E704.tmp 94 PID 2464 wrote to memory of 4992 2464 E704.tmp 94 PID 4992 wrote to memory of 416 4992 F194.tmp 95 PID 4992 wrote to memory of 416 4992 F194.tmp 95 PID 4992 wrote to memory of 416 4992 F194.tmp 95 PID 416 wrote to memory of 3460 416 F59B.tmp 96 PID 416 wrote to memory of 3460 416 F59B.tmp 96 PID 416 wrote to memory of 3460 416 F59B.tmp 96 PID 3460 wrote to memory of 3744 3460 F647.tmp 97 PID 3460 wrote to memory of 3744 3460 F647.tmp 97 PID 3460 wrote to memory of 3744 3460 F647.tmp 97 PID 3744 wrote to memory of 4296 3744 F6E3.tmp 98 PID 3744 wrote to memory of 4296 3744 F6E3.tmp 98 PID 3744 wrote to memory of 4296 3744 F6E3.tmp 98 PID 4296 wrote to memory of 2952 4296 F964.tmp 99 PID 4296 wrote to memory of 2952 4296 F964.tmp 99 PID 4296 wrote to memory of 2952 4296 F964.tmp 99 PID 2952 wrote to memory of 3900 2952 FA00.tmp 100 PID 2952 wrote to memory of 3900 2952 FA00.tmp 100 PID 2952 wrote to memory of 3900 2952 FA00.tmp 100 PID 3900 wrote to memory of 2956 3900 FB09.tmp 101 PID 3900 wrote to memory of 2956 3900 FB09.tmp 101 PID 3900 wrote to memory of 2956 3900 FB09.tmp 101 PID 2956 wrote to memory of 4224 2956 FBC5.tmp 102 PID 2956 wrote to memory of 4224 2956 FBC5.tmp 102 PID 2956 wrote to memory of 4224 2956 FBC5.tmp 102 PID 4224 wrote to memory of 1016 4224 FFAD.tmp 103 PID 4224 wrote to memory of 1016 4224 FFAD.tmp 103 PID 4224 wrote to memory of 1016 4224 FFAD.tmp 103 PID 1016 wrote to memory of 772 1016 1B1.tmp 104 PID 1016 wrote to memory of 772 1016 1B1.tmp 104 PID 1016 wrote to memory of 772 1016 1B1.tmp 104 PID 772 wrote to memory of 4244 772 5A8.tmp 105 PID 772 wrote to memory of 4244 772 5A8.tmp 105 PID 772 wrote to memory of 4244 772 5A8.tmp 105 PID 4244 wrote to memory of 4860 4244 7FA.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-09_13267480011709c594e320a4ac156766_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-09_13267480011709c594e320a4ac156766_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\DF83.tmp"C:\Users\Admin\AppData\Local\Temp\DF83.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\E196.tmp"C:\Users\Admin\AppData\Local\Temp\E196.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\E38A.tmp"C:\Users\Admin\AppData\Local\Temp\E38A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\E465.tmp"C:\Users\Admin\AppData\Local\Temp\E465.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\E520.tmp"C:\Users\Admin\AppData\Local\Temp\E520.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\E5CC.tmp"C:\Users\Admin\AppData\Local\Temp\E5CC.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\E668.tmp"C:\Users\Admin\AppData\Local\Temp\E668.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\E704.tmp"C:\Users\Admin\AppData\Local\Temp\E704.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\F194.tmp"C:\Users\Admin\AppData\Local\Temp\F194.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\F59B.tmp"C:\Users\Admin\AppData\Local\Temp\F59B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Users\Admin\AppData\Local\Temp\F647.tmp"C:\Users\Admin\AppData\Local\Temp\F647.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\F964.tmp"C:\Users\Admin\AppData\Local\Temp\F964.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\FA00.tmp"C:\Users\Admin\AppData\Local\Temp\FA00.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\FB09.tmp"C:\Users\Admin\AppData\Local\Temp\FB09.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\1B1.tmp"C:\Users\Admin\AppData\Local\Temp\1B1.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\5A8.tmp"C:\Users\Admin\AppData\Local\Temp\5A8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\7FA.tmp"C:\Users\Admin\AppData\Local\Temp\7FA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\122B.tmp"C:\Users\Admin\AppData\Local\Temp\122B.tmp"23⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\1345.tmp"C:\Users\Admin\AppData\Local\Temp\1345.tmp"24⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\17E8.tmp"C:\Users\Admin\AppData\Local\Temp\17E8.tmp"25⤵
- Executes dropped EXE
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\1884.tmp"C:\Users\Admin\AppData\Local\Temp\1884.tmp"26⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\1FC8.tmp"C:\Users\Admin\AppData\Local\Temp\1FC8.tmp"27⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\218D.tmp"C:\Users\Admin\AppData\Local\Temp\218D.tmp"28⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\2277.tmp"C:\Users\Admin\AppData\Local\Temp\2277.tmp"29⤵
- Executes dropped EXE
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\2323.tmp"C:\Users\Admin\AppData\Local\Temp\2323.tmp"30⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\23EE.tmp"C:\Users\Admin\AppData\Local\Temp\23EE.tmp"31⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\24C9.tmp"C:\Users\Admin\AppData\Local\Temp\24C9.tmp"32⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\25F2.tmp"C:\Users\Admin\AppData\Local\Temp\25F2.tmp"33⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\28FF.tmp"C:\Users\Admin\AppData\Local\Temp\28FF.tmp"34⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\298C.tmp"C:\Users\Admin\AppData\Local\Temp\298C.tmp"35⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\2A18.tmp"C:\Users\Admin\AppData\Local\Temp\2A18.tmp"36⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\2AB5.tmp"C:\Users\Admin\AppData\Local\Temp\2AB5.tmp"37⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\317B.tmp"C:\Users\Admin\AppData\Local\Temp\317B.tmp"38⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\3330.tmp"C:\Users\Admin\AppData\Local\Temp\3330.tmp"39⤵
- Executes dropped EXE
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"40⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"41⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"42⤵
- Executes dropped EXE
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\35D0.tmp"C:\Users\Admin\AppData\Local\Temp\35D0.tmp"43⤵
- Executes dropped EXE
PID:760 -
C:\Users\Admin\AppData\Local\Temp\364D.tmp"C:\Users\Admin\AppData\Local\Temp\364D.tmp"44⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\3757.tmp"C:\Users\Admin\AppData\Local\Temp\3757.tmp"45⤵
- Executes dropped EXE
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\4513.tmp"C:\Users\Admin\AppData\Local\Temp\4513.tmp"46⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\4AA0.tmp"C:\Users\Admin\AppData\Local\Temp\4AA0.tmp"47⤵
- Executes dropped EXE
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\4CB4.tmp"C:\Users\Admin\AppData\Local\Temp\4CB4.tmp"48⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\4D40.tmp"C:\Users\Admin\AppData\Local\Temp\4D40.tmp"49⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\4DAE.tmp"C:\Users\Admin\AppData\Local\Temp\4DAE.tmp"50⤵
- Executes dropped EXE
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\4E2B.tmp"C:\Users\Admin\AppData\Local\Temp\4E2B.tmp"51⤵
- Executes dropped EXE
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\5270.tmp"C:\Users\Admin\AppData\Local\Temp\5270.tmp"52⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\53D8.tmp"C:\Users\Admin\AppData\Local\Temp\53D8.tmp"53⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\54E1.tmp"C:\Users\Admin\AppData\Local\Temp\54E1.tmp"54⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\553F.tmp"C:\Users\Admin\AppData\Local\Temp\553F.tmp"55⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\5B79.tmp"C:\Users\Admin\AppData\Local\Temp\5B79.tmp"56⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\5E09.tmp"C:\Users\Admin\AppData\Local\Temp\5E09.tmp"57⤵
- Executes dropped EXE
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\628D.tmp"C:\Users\Admin\AppData\Local\Temp\628D.tmp"58⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\6424.tmp"C:\Users\Admin\AppData\Local\Temp\6424.tmp"59⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\684A.tmp"C:\Users\Admin\AppData\Local\Temp\684A.tmp"60⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\6EE2.tmp"C:\Users\Admin\AppData\Local\Temp\6EE2.tmp"61⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\7664.tmp"C:\Users\Admin\AppData\Local\Temp\7664.tmp"62⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\84CB.tmp"C:\Users\Admin\AppData\Local\Temp\84CB.tmp"63⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\8A97.tmp"C:\Users\Admin\AppData\Local\Temp\8A97.tmp"64⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\943C.tmp"C:\Users\Admin\AppData\Local\Temp\943C.tmp"65⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\94D8.tmp"C:\Users\Admin\AppData\Local\Temp\94D8.tmp"66⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\9565.tmp"C:\Users\Admin\AppData\Local\Temp\9565.tmp"67⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\971B.tmp"C:\Users\Admin\AppData\Local\Temp\971B.tmp"68⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\9788.tmp"C:\Users\Admin\AppData\Local\Temp\9788.tmp"69⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\9834.tmp"C:\Users\Admin\AppData\Local\Temp\9834.tmp"70⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\98C0.tmp"C:\Users\Admin\AppData\Local\Temp\98C0.tmp"71⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\9A86.tmp"C:\Users\Admin\AppData\Local\Temp\9A86.tmp"72⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\9AF3.tmp"C:\Users\Admin\AppData\Local\Temp\9AF3.tmp"73⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\9B70.tmp"C:\Users\Admin\AppData\Local\Temp\9B70.tmp"74⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\9BED.tmp"C:\Users\Admin\AppData\Local\Temp\9BED.tmp"75⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\9C7A.tmp"C:\Users\Admin\AppData\Local\Temp\9C7A.tmp"76⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\9D35.tmp"C:\Users\Admin\AppData\Local\Temp\9D35.tmp"77⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\9DB2.tmp"C:\Users\Admin\AppData\Local\Temp\9DB2.tmp"78⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\9E3F.tmp"C:\Users\Admin\AppData\Local\Temp\9E3F.tmp"79⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\A042.tmp"C:\Users\Admin\AppData\Local\Temp\A042.tmp"80⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\AF65.tmp"C:\Users\Admin\AppData\Local\Temp\AF65.tmp"81⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\B8FA.tmp"C:\Users\Admin\AppData\Local\Temp\B8FA.tmp"82⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\BFE0.tmp"C:\Users\Admin\AppData\Local\Temp\BFE0.tmp"83⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\C07C.tmp"C:\Users\Admin\AppData\Local\Temp\C07C.tmp"84⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\C0F9.tmp"C:\Users\Admin\AppData\Local\Temp\C0F9.tmp"85⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\C167.tmp"C:\Users\Admin\AppData\Local\Temp\C167.tmp"86⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\C2CE.tmp"C:\Users\Admin\AppData\Local\Temp\C2CE.tmp"87⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\D491.tmp"C:\Users\Admin\AppData\Local\Temp\D491.tmp"88⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\D50E.tmp"C:\Users\Admin\AppData\Local\Temp\D50E.tmp"89⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\EA2C.tmp"C:\Users\Admin\AppData\Local\Temp\EA2C.tmp"90⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\F112.tmp"C:\Users\Admin\AppData\Local\Temp\F112.tmp"91⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\F623.tmp"C:\Users\Admin\AppData\Local\Temp\F623.tmp"92⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\FE12.tmp"C:\Users\Admin\AppData\Local\Temp\FE12.tmp"93⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\FE9F.tmp"C:\Users\Admin\AppData\Local\Temp\FE9F.tmp"94⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\FF2B.tmp"C:\Users\Admin\AppData\Local\Temp\FF2B.tmp"95⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\1F27.tmp"C:\Users\Admin\AppData\Local\Temp\1F27.tmp"96⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\2AA0.tmp"C:\Users\Admin\AppData\Local\Temp\2AA0.tmp"97⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\3658.tmp"C:\Users\Admin\AppData\Local\Temp\3658.tmp"98⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\3C25.tmp"C:\Users\Admin\AppData\Local\Temp\3C25.tmp"99⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\4721.tmp"C:\Users\Admin\AppData\Local\Temp\4721.tmp"100⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\4C51.tmp"C:\Users\Admin\AppData\Local\Temp\4C51.tmp"101⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\5F2D.tmp"C:\Users\Admin\AppData\Local\Temp\5F2D.tmp"102⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\66CE.tmp"C:\Users\Admin\AppData\Local\Temp\66CE.tmp"103⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\68B3.tmp"C:\Users\Admin\AppData\Local\Temp\68B3.tmp"104⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\6A88.tmp"C:\Users\Admin\AppData\Local\Temp\6A88.tmp"105⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\74B9.tmp"C:\Users\Admin\AppData\Local\Temp\74B9.tmp"106⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\7F0A.tmp"C:\Users\Admin\AppData\Local\Temp\7F0A.tmp"107⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\895A.tmp"C:\Users\Admin\AppData\Local\Temp\895A.tmp"108⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\8CB6.tmp"C:\Users\Admin\AppData\Local\Temp\8CB6.tmp"109⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\934D.tmp"C:\Users\Admin\AppData\Local\Temp\934D.tmp"110⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\987D.tmp"C:\Users\Admin\AppData\Local\Temp\987D.tmp"111⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\A1D4.tmp"C:\Users\Admin\AppData\Local\Temp\A1D4.tmp"112⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\ABF6.tmp"C:\Users\Admin\AppData\Local\Temp\ABF6.tmp"113⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\AC92.tmp"C:\Users\Admin\AppData\Local\Temp\AC92.tmp"114⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\B443.tmp"C:\Users\Admin\AppData\Local\Temp\B443.tmp"115⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\BF2F.tmp"C:\Users\Admin\AppData\Local\Temp\BF2F.tmp"116⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\C569.tmp"C:\Users\Admin\AppData\Local\Temp\C569.tmp"117⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\C5E6.tmp"C:\Users\Admin\AppData\Local\Temp\C5E6.tmp"118⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\C692.tmp"C:\Users\Admin\AppData\Local\Temp\C692.tmp"119⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\C73E.tmp"C:\Users\Admin\AppData\Local\Temp\C73E.tmp"120⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\C7DA.tmp"C:\Users\Admin\AppData\Local\Temp\C7DA.tmp"121⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\C867.tmp"C:\Users\Admin\AppData\Local\Temp\C867.tmp"122⤵PID:4268
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-