Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
22/10/2023, 08:22
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.2023-09-05_1dc32eba23ffd9240a60987e5ae90d97_mafia_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.2023-09-05_1dc32eba23ffd9240a60987e5ae90d97_mafia_JC.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.2023-09-05_1dc32eba23ffd9240a60987e5ae90d97_mafia_JC.exe
-
Size
520KB
-
MD5
1dc32eba23ffd9240a60987e5ae90d97
-
SHA1
85c2dd725254264662b93e048651ea5bfb9a7364
-
SHA256
cf140fc5424b463b4b5b926e810cbf7cc505a18306ad75fe1083b21164918be8
-
SHA512
934f235450bad029b9368503481151a1f9406bbad472e77e8b9b81b5f96274f81a2c542e93007f8680f09a0fe3a0bed32236fab5f918449a7a506818041e8a3d
-
SSDEEP
6144:lLvd/XzCjUIF1UuXLyQjmOH+JjLKMM3vFBib3qzn3vhy+KKe1VUH7VHrj1teiuCK:roRXOQjmOynM3dMTJT71VUByiue96NZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1740 AE41.tmp 1508 AF0C.tmp 4040 AFC8.tmp 2668 B093.tmp 3640 B14E.tmp 2116 B1FA.tmp 4756 B2B6.tmp 1536 B342.tmp 3472 B3EE.tmp 4068 B47B.tmp 1804 B508.tmp 4352 B5B3.tmp 2264 B6DC.tmp 1240 B74A.tmp 444 B7D6.tmp 3820 B873.tmp 1164 B9CA.tmp 4632 BA95.tmp 2420 BB32.tmp 4960 BBED.tmp 2880 BCA9.tmp 1184 BD74.tmp 2476 BE10.tmp 3924 BEDB.tmp 2780 BFA6.tmp 1692 C071.tmp 1712 C13D.tmp 760 C227.tmp 3344 C2C3.tmp 3236 C36F.tmp 1216 C43A.tmp 1640 C525.tmp 3424 C60F.tmp 4104 C67C.tmp 3200 C6EA.tmp 3068 C776.tmp 3268 C7F3.tmp 1860 C870.tmp 4916 C8FD.tmp 2120 C98A.tmp 4312 CA26.tmp 4288 CAC2.tmp 1332 CBBC.tmp 4776 CC39.tmp 2284 CCB6.tmp 1564 CD43.tmp 2012 CDCF.tmp 4488 CE6C.tmp 4952 CEE9.tmp 4364 CF75.tmp 4040 CFF2.tmp 4236 D09E.tmp 748 D13A.tmp 3612 D1C7.tmp 3416 D254.tmp 3972 D2C1.tmp 2016 D33E.tmp 920 D3AB.tmp 4704 D438.tmp 5080 D4B5.tmp 3048 D542.tmp 2580 D5CE.tmp 1520 D66A.tmp 428 D6E7.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4500 wrote to memory of 1740 4500 NEAS.2023-09-05_1dc32eba23ffd9240a60987e5ae90d97_mafia_JC.exe 87 PID 4500 wrote to memory of 1740 4500 NEAS.2023-09-05_1dc32eba23ffd9240a60987e5ae90d97_mafia_JC.exe 87 PID 4500 wrote to memory of 1740 4500 NEAS.2023-09-05_1dc32eba23ffd9240a60987e5ae90d97_mafia_JC.exe 87 PID 1740 wrote to memory of 1508 1740 AE41.tmp 88 PID 1740 wrote to memory of 1508 1740 AE41.tmp 88 PID 1740 wrote to memory of 1508 1740 AE41.tmp 88 PID 1508 wrote to memory of 4040 1508 AF0C.tmp 90 PID 1508 wrote to memory of 4040 1508 AF0C.tmp 90 PID 1508 wrote to memory of 4040 1508 AF0C.tmp 90 PID 4040 wrote to memory of 2668 4040 AFC8.tmp 91 PID 4040 wrote to memory of 2668 4040 AFC8.tmp 91 PID 4040 wrote to memory of 2668 4040 AFC8.tmp 91 PID 2668 wrote to memory of 3640 2668 B093.tmp 92 PID 2668 wrote to memory of 3640 2668 B093.tmp 92 PID 2668 wrote to memory of 3640 2668 B093.tmp 92 PID 3640 wrote to memory of 2116 3640 B14E.tmp 93 PID 3640 wrote to memory of 2116 3640 B14E.tmp 93 PID 3640 wrote to memory of 2116 3640 B14E.tmp 93 PID 2116 wrote to memory of 4756 2116 B1FA.tmp 94 PID 2116 wrote to memory of 4756 2116 B1FA.tmp 94 PID 2116 wrote to memory of 4756 2116 B1FA.tmp 94 PID 4756 wrote to memory of 1536 4756 B2B6.tmp 95 PID 4756 wrote to memory of 1536 4756 B2B6.tmp 95 PID 4756 wrote to memory of 1536 4756 B2B6.tmp 95 PID 1536 wrote to memory of 3472 1536 B342.tmp 96 PID 1536 wrote to memory of 3472 1536 B342.tmp 96 PID 1536 wrote to memory of 3472 1536 B342.tmp 96 PID 3472 wrote to memory of 4068 3472 B3EE.tmp 97 PID 3472 wrote to memory of 4068 3472 B3EE.tmp 97 PID 3472 wrote to memory of 4068 3472 B3EE.tmp 97 PID 4068 wrote to memory of 1804 4068 B47B.tmp 98 PID 4068 wrote to memory of 1804 4068 B47B.tmp 98 PID 4068 wrote to memory of 1804 4068 B47B.tmp 98 PID 1804 wrote to memory of 4352 1804 B508.tmp 99 PID 1804 wrote to memory of 4352 1804 B508.tmp 99 PID 1804 wrote to memory of 4352 1804 B508.tmp 99 PID 4352 wrote to memory of 2264 4352 B5B3.tmp 100 PID 4352 wrote to memory of 2264 4352 B5B3.tmp 100 PID 4352 wrote to memory of 2264 4352 B5B3.tmp 100 PID 2264 wrote to memory of 1240 2264 B6DC.tmp 101 PID 2264 wrote to memory of 1240 2264 B6DC.tmp 101 PID 2264 wrote to memory of 1240 2264 B6DC.tmp 101 PID 1240 wrote to memory of 444 1240 B74A.tmp 103 PID 1240 wrote to memory of 444 1240 B74A.tmp 103 PID 1240 wrote to memory of 444 1240 B74A.tmp 103 PID 444 wrote to memory of 3820 444 B7D6.tmp 104 PID 444 wrote to memory of 3820 444 B7D6.tmp 104 PID 444 wrote to memory of 3820 444 B7D6.tmp 104 PID 3820 wrote to memory of 1164 3820 B873.tmp 105 PID 3820 wrote to memory of 1164 3820 B873.tmp 105 PID 3820 wrote to memory of 1164 3820 B873.tmp 105 PID 1164 wrote to memory of 4632 1164 B9CA.tmp 106 PID 1164 wrote to memory of 4632 1164 B9CA.tmp 106 PID 1164 wrote to memory of 4632 1164 B9CA.tmp 106 PID 4632 wrote to memory of 2420 4632 BA95.tmp 108 PID 4632 wrote to memory of 2420 4632 BA95.tmp 108 PID 4632 wrote to memory of 2420 4632 BA95.tmp 108 PID 2420 wrote to memory of 4960 2420 BB32.tmp 109 PID 2420 wrote to memory of 4960 2420 BB32.tmp 109 PID 2420 wrote to memory of 4960 2420 BB32.tmp 109 PID 4960 wrote to memory of 2880 4960 BBED.tmp 110 PID 4960 wrote to memory of 2880 4960 BBED.tmp 110 PID 4960 wrote to memory of 2880 4960 BBED.tmp 110 PID 2880 wrote to memory of 1184 2880 BCA9.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-05_1dc32eba23ffd9240a60987e5ae90d97_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-05_1dc32eba23ffd9240a60987e5ae90d97_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\AE41.tmp"C:\Users\Admin\AppData\Local\Temp\AE41.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\B093.tmp"C:\Users\Admin\AppData\Local\Temp\B093.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\B14E.tmp"C:\Users\Admin\AppData\Local\Temp\B14E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\B342.tmp"C:\Users\Admin\AppData\Local\Temp\B342.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\B47B.tmp"C:\Users\Admin\AppData\Local\Temp\B47B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\B508.tmp"C:\Users\Admin\AppData\Local\Temp\B508.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\B74A.tmp"C:\Users\Admin\AppData\Local\Temp\B74A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
C:\Users\Admin\AppData\Local\Temp\B873.tmp"C:\Users\Admin\AppData\Local\Temp\B873.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\BA95.tmp"C:\Users\Admin\AppData\Local\Temp\BA95.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\BB32.tmp"C:\Users\Admin\AppData\Local\Temp\BB32.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\BBED.tmp"C:\Users\Admin\AppData\Local\Temp\BBED.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\BD74.tmp"C:\Users\Admin\AppData\Local\Temp\BD74.tmp"23⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\BE10.tmp"C:\Users\Admin\AppData\Local\Temp\BE10.tmp"24⤵
- Executes dropped EXE
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"25⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"26⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\C071.tmp"C:\Users\Admin\AppData\Local\Temp\C071.tmp"27⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"28⤵
- Executes dropped EXE
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"29⤵
- Executes dropped EXE
PID:760 -
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"30⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\C36F.tmp"C:\Users\Admin\AppData\Local\Temp\C36F.tmp"31⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\C43A.tmp"C:\Users\Admin\AppData\Local\Temp\C43A.tmp"32⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\C525.tmp"C:\Users\Admin\AppData\Local\Temp\C525.tmp"33⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\C60F.tmp"C:\Users\Admin\AppData\Local\Temp\C60F.tmp"34⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\C67C.tmp"C:\Users\Admin\AppData\Local\Temp\C67C.tmp"35⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\C6EA.tmp"C:\Users\Admin\AppData\Local\Temp\C6EA.tmp"36⤵
- Executes dropped EXE
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\C776.tmp"C:\Users\Admin\AppData\Local\Temp\C776.tmp"37⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"38⤵
- Executes dropped EXE
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\C870.tmp"C:\Users\Admin\AppData\Local\Temp\C870.tmp"39⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"40⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\C98A.tmp"C:\Users\Admin\AppData\Local\Temp\C98A.tmp"41⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\CA26.tmp"C:\Users\Admin\AppData\Local\Temp\CA26.tmp"42⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\CAC2.tmp"C:\Users\Admin\AppData\Local\Temp\CAC2.tmp"43⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\CBBC.tmp"C:\Users\Admin\AppData\Local\Temp\CBBC.tmp"44⤵
- Executes dropped EXE
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\CC39.tmp"C:\Users\Admin\AppData\Local\Temp\CC39.tmp"45⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"46⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\CD43.tmp"C:\Users\Admin\AppData\Local\Temp\CD43.tmp"47⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"48⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"49⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\CEE9.tmp"C:\Users\Admin\AppData\Local\Temp\CEE9.tmp"50⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\CF75.tmp"C:\Users\Admin\AppData\Local\Temp\CF75.tmp"51⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\CFF2.tmp"C:\Users\Admin\AppData\Local\Temp\CFF2.tmp"52⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\D09E.tmp"C:\Users\Admin\AppData\Local\Temp\D09E.tmp"53⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\D13A.tmp"C:\Users\Admin\AppData\Local\Temp\D13A.tmp"54⤵
- Executes dropped EXE
PID:748 -
C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"55⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\D254.tmp"C:\Users\Admin\AppData\Local\Temp\D254.tmp"56⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\D2C1.tmp"C:\Users\Admin\AppData\Local\Temp\D2C1.tmp"57⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\D33E.tmp"C:\Users\Admin\AppData\Local\Temp\D33E.tmp"58⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"59⤵
- Executes dropped EXE
PID:920 -
C:\Users\Admin\AppData\Local\Temp\D438.tmp"C:\Users\Admin\AppData\Local\Temp\D438.tmp"60⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\D4B5.tmp"C:\Users\Admin\AppData\Local\Temp\D4B5.tmp"61⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\D542.tmp"C:\Users\Admin\AppData\Local\Temp\D542.tmp"62⤵
- Executes dropped EXE
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\D5CE.tmp"C:\Users\Admin\AppData\Local\Temp\D5CE.tmp"63⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\D66A.tmp"C:\Users\Admin\AppData\Local\Temp\D66A.tmp"64⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\D6E7.tmp"C:\Users\Admin\AppData\Local\Temp\D6E7.tmp"65⤵
- Executes dropped EXE
PID:428 -
C:\Users\Admin\AppData\Local\Temp\D755.tmp"C:\Users\Admin\AppData\Local\Temp\D755.tmp"66⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"67⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\D85E.tmp"C:\Users\Admin\AppData\Local\Temp\D85E.tmp"68⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"69⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\D997.tmp"C:\Users\Admin\AppData\Local\Temp\D997.tmp"70⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\DA33.tmp"C:\Users\Admin\AppData\Local\Temp\DA33.tmp"71⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\DACF.tmp"C:\Users\Admin\AppData\Local\Temp\DACF.tmp"72⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"73⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\DBBA.tmp"C:\Users\Admin\AppData\Local\Temp\DBBA.tmp"74⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\DC37.tmp"C:\Users\Admin\AppData\Local\Temp\DC37.tmp"75⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\DC95.tmp"C:\Users\Admin\AppData\Local\Temp\DC95.tmp"76⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\DD31.tmp"C:\Users\Admin\AppData\Local\Temp\DD31.tmp"77⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\DDBD.tmp"C:\Users\Admin\AppData\Local\Temp\DDBD.tmp"78⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\DE4A.tmp"C:\Users\Admin\AppData\Local\Temp\DE4A.tmp"79⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\DEF6.tmp"C:\Users\Admin\AppData\Local\Temp\DEF6.tmp"80⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\DF83.tmp"C:\Users\Admin\AppData\Local\Temp\DF83.tmp"81⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\E00F.tmp"C:\Users\Admin\AppData\Local\Temp\E00F.tmp"82⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\E0BB.tmp"C:\Users\Admin\AppData\Local\Temp\E0BB.tmp"83⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\E128.tmp"C:\Users\Admin\AppData\Local\Temp\E128.tmp"84⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\E1B5.tmp"C:\Users\Admin\AppData\Local\Temp\E1B5.tmp"85⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\E251.tmp"C:\Users\Admin\AppData\Local\Temp\E251.tmp"86⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\E2DE.tmp"C:\Users\Admin\AppData\Local\Temp\E2DE.tmp"87⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\E35B.tmp"C:\Users\Admin\AppData\Local\Temp\E35B.tmp"88⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\E3D8.tmp"C:\Users\Admin\AppData\Local\Temp\E3D8.tmp"89⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\E474.tmp"C:\Users\Admin\AppData\Local\Temp\E474.tmp"90⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\E4F1.tmp"C:\Users\Admin\AppData\Local\Temp\E4F1.tmp"91⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\E58D.tmp"C:\Users\Admin\AppData\Local\Temp\E58D.tmp"92⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\E639.tmp"C:\Users\Admin\AppData\Local\Temp\E639.tmp"93⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"94⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\E743.tmp"C:\Users\Admin\AppData\Local\Temp\E743.tmp"95⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"96⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\E84D.tmp"C:\Users\Admin\AppData\Local\Temp\E84D.tmp"97⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\E8CA.tmp"C:\Users\Admin\AppData\Local\Temp\E8CA.tmp"98⤵PID:360
-
C:\Users\Admin\AppData\Local\Temp\E956.tmp"C:\Users\Admin\AppData\Local\Temp\E956.tmp"99⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\E9E3.tmp"C:\Users\Admin\AppData\Local\Temp\E9E3.tmp"100⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\EA60.tmp"C:\Users\Admin\AppData\Local\Temp\EA60.tmp"101⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"102⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"103⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\EC06.tmp"C:\Users\Admin\AppData\Local\Temp\EC06.tmp"104⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\EC83.tmp"C:\Users\Admin\AppData\Local\Temp\EC83.tmp"105⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\ED0F.tmp"C:\Users\Admin\AppData\Local\Temp\ED0F.tmp"106⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\ED9C.tmp"C:\Users\Admin\AppData\Local\Temp\ED9C.tmp"107⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\EE29.tmp"C:\Users\Admin\AppData\Local\Temp\EE29.tmp"108⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"109⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\EF32.tmp"C:\Users\Admin\AppData\Local\Temp\EF32.tmp"110⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\EFBF.tmp"C:\Users\Admin\AppData\Local\Temp\EFBF.tmp"111⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\F03C.tmp"C:\Users\Admin\AppData\Local\Temp\F03C.tmp"112⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"113⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\F145.tmp"C:\Users\Admin\AppData\Local\Temp\F145.tmp"114⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\F1D2.tmp"C:\Users\Admin\AppData\Local\Temp\F1D2.tmp"115⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\F24F.tmp"C:\Users\Admin\AppData\Local\Temp\F24F.tmp"116⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\F2CC.tmp"C:\Users\Admin\AppData\Local\Temp\F2CC.tmp"117⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\F359.tmp"C:\Users\Admin\AppData\Local\Temp\F359.tmp"118⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\F3F5.tmp"C:\Users\Admin\AppData\Local\Temp\F3F5.tmp"119⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\F482.tmp"C:\Users\Admin\AppData\Local\Temp\F482.tmp"120⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\F51E.tmp"C:\Users\Admin\AppData\Local\Temp\F51E.tmp"121⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\F59B.tmp"C:\Users\Admin\AppData\Local\Temp\F59B.tmp"122⤵PID:3052
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-