Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
22/10/2023, 08:50
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.2023-09-08_b81dcbe272985cd79004e94426cf33fc_mafia_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.2023-09-08_b81dcbe272985cd79004e94426cf33fc_mafia_JC.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.2023-09-08_b81dcbe272985cd79004e94426cf33fc_mafia_JC.exe
-
Size
486KB
-
MD5
b81dcbe272985cd79004e94426cf33fc
-
SHA1
5e1d3f4fb84173d8e274f3a69d226efe4df20071
-
SHA256
dff7e25e10074e8e44065ec6de9d2b59b7c89647334db0f74df5ad9a280a59ed
-
SHA512
f68cda687fb44b23e5b1d0a22d13689f50ecad7b347fdf675b877c6c3375d45ae5dd834ada7dea49ab06096f2f8b1e97eeeb4666aeaf5256ef593ddb8c63e301
-
SSDEEP
6144:Borf3lPvovsgZnqG2C7mOTeiLfD7nRqTsd8nVGZu2NMkmqzq3QD4VQv6OOwdyhni:oU5rCOTeiDV8Aejqzfke6OOwQWK2LNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2500 BBAF.tmp 540 BC6A.tmp 740 BD74.tmp 1184 BE3F.tmp 3212 BEFA.tmp 1204 BF97.tmp 3080 C15C.tmp 3880 C1D9.tmp 4052 C265.tmp 1332 C2F2.tmp 3604 C3BD.tmp 4824 C44A.tmp 4940 C4F6.tmp 4172 C5C1.tmp 1148 C69C.tmp 3760 C738.tmp 2756 C803.tmp 3832 C880.tmp 1848 C91C.tmp 4720 C9A9.tmp 1012 CA84.tmp 3312 CB6E.tmp 404 CC1A.tmp 4568 CCC6.tmp 1592 CD62.tmp 968 CE1D.tmp 1116 CED9.tmp 4288 CF75.tmp 4724 D040.tmp 212 D10B.tmp 1112 D225.tmp 2696 D2FF.tmp 4504 D3BB.tmp 1160 D457.tmp 4320 D4F3.tmp 1796 D59F.tmp 4520 D63C.tmp 4304 D6C8.tmp 392 D755.tmp 304 D7D2.tmp 3180 D85E.tmp 4928 D90A.tmp 3508 D997.tmp 916 DA24.tmp 2924 DB5C.tmp 740 DBD9.tmp 3560 DC56.tmp 4072 DCE3.tmp 4596 DD8F.tmp 1228 DE1B.tmp 4600 DE98.tmp 1204 DF15.tmp 2604 DFB1.tmp 4752 E02E.tmp 2564 E0AB.tmp 4052 E148.tmp 2792 E1C5.tmp 1320 E261.tmp 3604 E2EE.tmp 2324 E36B.tmp 836 E3E8.tmp 4332 E474.tmp 4080 E510.tmp 380 E59D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3576 wrote to memory of 2500 3576 NEAS.2023-09-08_b81dcbe272985cd79004e94426cf33fc_mafia_JC.exe 88 PID 3576 wrote to memory of 2500 3576 NEAS.2023-09-08_b81dcbe272985cd79004e94426cf33fc_mafia_JC.exe 88 PID 3576 wrote to memory of 2500 3576 NEAS.2023-09-08_b81dcbe272985cd79004e94426cf33fc_mafia_JC.exe 88 PID 2500 wrote to memory of 540 2500 BBAF.tmp 89 PID 2500 wrote to memory of 540 2500 BBAF.tmp 89 PID 2500 wrote to memory of 540 2500 BBAF.tmp 89 PID 540 wrote to memory of 740 540 BC6A.tmp 90 PID 540 wrote to memory of 740 540 BC6A.tmp 90 PID 540 wrote to memory of 740 540 BC6A.tmp 90 PID 740 wrote to memory of 1184 740 BD74.tmp 91 PID 740 wrote to memory of 1184 740 BD74.tmp 91 PID 740 wrote to memory of 1184 740 BD74.tmp 91 PID 1184 wrote to memory of 3212 1184 BE3F.tmp 92 PID 1184 wrote to memory of 3212 1184 BE3F.tmp 92 PID 1184 wrote to memory of 3212 1184 BE3F.tmp 92 PID 3212 wrote to memory of 1204 3212 BEFA.tmp 93 PID 3212 wrote to memory of 1204 3212 BEFA.tmp 93 PID 3212 wrote to memory of 1204 3212 BEFA.tmp 93 PID 1204 wrote to memory of 3080 1204 BF97.tmp 94 PID 1204 wrote to memory of 3080 1204 BF97.tmp 94 PID 1204 wrote to memory of 3080 1204 BF97.tmp 94 PID 3080 wrote to memory of 3880 3080 C15C.tmp 95 PID 3080 wrote to memory of 3880 3080 C15C.tmp 95 PID 3080 wrote to memory of 3880 3080 C15C.tmp 95 PID 3880 wrote to memory of 4052 3880 C1D9.tmp 96 PID 3880 wrote to memory of 4052 3880 C1D9.tmp 96 PID 3880 wrote to memory of 4052 3880 C1D9.tmp 96 PID 4052 wrote to memory of 1332 4052 C265.tmp 97 PID 4052 wrote to memory of 1332 4052 C265.tmp 97 PID 4052 wrote to memory of 1332 4052 C265.tmp 97 PID 1332 wrote to memory of 3604 1332 C2F2.tmp 98 PID 1332 wrote to memory of 3604 1332 C2F2.tmp 98 PID 1332 wrote to memory of 3604 1332 C2F2.tmp 98 PID 3604 wrote to memory of 4824 3604 C3BD.tmp 99 PID 3604 wrote to memory of 4824 3604 C3BD.tmp 99 PID 3604 wrote to memory of 4824 3604 C3BD.tmp 99 PID 4824 wrote to memory of 4940 4824 C44A.tmp 100 PID 4824 wrote to memory of 4940 4824 C44A.tmp 100 PID 4824 wrote to memory of 4940 4824 C44A.tmp 100 PID 4940 wrote to memory of 4172 4940 C4F6.tmp 102 PID 4940 wrote to memory of 4172 4940 C4F6.tmp 102 PID 4940 wrote to memory of 4172 4940 C4F6.tmp 102 PID 4172 wrote to memory of 1148 4172 C5C1.tmp 103 PID 4172 wrote to memory of 1148 4172 C5C1.tmp 103 PID 4172 wrote to memory of 1148 4172 C5C1.tmp 103 PID 1148 wrote to memory of 3760 1148 C69C.tmp 104 PID 1148 wrote to memory of 3760 1148 C69C.tmp 104 PID 1148 wrote to memory of 3760 1148 C69C.tmp 104 PID 3760 wrote to memory of 2756 3760 C738.tmp 105 PID 3760 wrote to memory of 2756 3760 C738.tmp 105 PID 3760 wrote to memory of 2756 3760 C738.tmp 105 PID 2756 wrote to memory of 3832 2756 C803.tmp 106 PID 2756 wrote to memory of 3832 2756 C803.tmp 106 PID 2756 wrote to memory of 3832 2756 C803.tmp 106 PID 3832 wrote to memory of 1848 3832 C880.tmp 108 PID 3832 wrote to memory of 1848 3832 C880.tmp 108 PID 3832 wrote to memory of 1848 3832 C880.tmp 108 PID 1848 wrote to memory of 4720 1848 C91C.tmp 109 PID 1848 wrote to memory of 4720 1848 C91C.tmp 109 PID 1848 wrote to memory of 4720 1848 C91C.tmp 109 PID 4720 wrote to memory of 1012 4720 C9A9.tmp 110 PID 4720 wrote to memory of 1012 4720 C9A9.tmp 110 PID 4720 wrote to memory of 1012 4720 C9A9.tmp 110 PID 1012 wrote to memory of 3312 1012 CA84.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-08_b81dcbe272985cd79004e94426cf33fc_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-08_b81dcbe272985cd79004e94426cf33fc_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\BD74.tmp"C:\Users\Admin\AppData\Local\Temp\BD74.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\BF97.tmp"C:\Users\Admin\AppData\Local\Temp\BF97.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\C3BD.tmp"C:\Users\Admin\AppData\Local\Temp\C3BD.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\C44A.tmp"C:\Users\Admin\AppData\Local\Temp\C44A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\C69C.tmp"C:\Users\Admin\AppData\Local\Temp\C69C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\C738.tmp"C:\Users\Admin\AppData\Local\Temp\C738.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\C803.tmp"C:\Users\Admin\AppData\Local\Temp\C803.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\C880.tmp"C:\Users\Admin\AppData\Local\Temp\C880.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\C91C.tmp"C:\Users\Admin\AppData\Local\Temp\C91C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\CA84.tmp"C:\Users\Admin\AppData\Local\Temp\CA84.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"23⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"24⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\CCC6.tmp"C:\Users\Admin\AppData\Local\Temp\CCC6.tmp"25⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\CD62.tmp"C:\Users\Admin\AppData\Local\Temp\CD62.tmp"26⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"27⤵
- Executes dropped EXE
PID:968 -
C:\Users\Admin\AppData\Local\Temp\CED9.tmp"C:\Users\Admin\AppData\Local\Temp\CED9.tmp"28⤵
- Executes dropped EXE
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\CF75.tmp"C:\Users\Admin\AppData\Local\Temp\CF75.tmp"29⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\D040.tmp"C:\Users\Admin\AppData\Local\Temp\D040.tmp"30⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\D10B.tmp"C:\Users\Admin\AppData\Local\Temp\D10B.tmp"31⤵
- Executes dropped EXE
PID:212 -
C:\Users\Admin\AppData\Local\Temp\D225.tmp"C:\Users\Admin\AppData\Local\Temp\D225.tmp"32⤵
- Executes dropped EXE
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\D2FF.tmp"C:\Users\Admin\AppData\Local\Temp\D2FF.tmp"33⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"34⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\D457.tmp"C:\Users\Admin\AppData\Local\Temp\D457.tmp"35⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\D4F3.tmp"C:\Users\Admin\AppData\Local\Temp\D4F3.tmp"36⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\D59F.tmp"C:\Users\Admin\AppData\Local\Temp\D59F.tmp"37⤵
- Executes dropped EXE
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\D63C.tmp"C:\Users\Admin\AppData\Local\Temp\D63C.tmp"38⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"39⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\D755.tmp"C:\Users\Admin\AppData\Local\Temp\D755.tmp"40⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"41⤵
- Executes dropped EXE
PID:304 -
C:\Users\Admin\AppData\Local\Temp\D85E.tmp"C:\Users\Admin\AppData\Local\Temp\D85E.tmp"42⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\D90A.tmp"C:\Users\Admin\AppData\Local\Temp\D90A.tmp"43⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\D997.tmp"C:\Users\Admin\AppData\Local\Temp\D997.tmp"44⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\DA24.tmp"C:\Users\Admin\AppData\Local\Temp\DA24.tmp"45⤵
- Executes dropped EXE
PID:916 -
C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"46⤵
- Executes dropped EXE
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\DBD9.tmp"C:\Users\Admin\AppData\Local\Temp\DBD9.tmp"47⤵
- Executes dropped EXE
PID:740 -
C:\Users\Admin\AppData\Local\Temp\DC56.tmp"C:\Users\Admin\AppData\Local\Temp\DC56.tmp"48⤵
- Executes dropped EXE
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\DCE3.tmp"C:\Users\Admin\AppData\Local\Temp\DCE3.tmp"49⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\DD8F.tmp"C:\Users\Admin\AppData\Local\Temp\DD8F.tmp"50⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"51⤵
- Executes dropped EXE
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\DE98.tmp"C:\Users\Admin\AppData\Local\Temp\DE98.tmp"52⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\DF15.tmp"C:\Users\Admin\AppData\Local\Temp\DF15.tmp"53⤵
- Executes dropped EXE
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"54⤵
- Executes dropped EXE
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\E02E.tmp"C:\Users\Admin\AppData\Local\Temp\E02E.tmp"55⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\E0AB.tmp"C:\Users\Admin\AppData\Local\Temp\E0AB.tmp"56⤵
- Executes dropped EXE
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\E148.tmp"C:\Users\Admin\AppData\Local\Temp\E148.tmp"57⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"58⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\E261.tmp"C:\Users\Admin\AppData\Local\Temp\E261.tmp"59⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\E2EE.tmp"C:\Users\Admin\AppData\Local\Temp\E2EE.tmp"60⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\E36B.tmp"C:\Users\Admin\AppData\Local\Temp\E36B.tmp"61⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\E3E8.tmp"C:\Users\Admin\AppData\Local\Temp\E3E8.tmp"62⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\E474.tmp"C:\Users\Admin\AppData\Local\Temp\E474.tmp"63⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\E510.tmp"C:\Users\Admin\AppData\Local\Temp\E510.tmp"64⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\E59D.tmp"C:\Users\Admin\AppData\Local\Temp\E59D.tmp"65⤵
- Executes dropped EXE
PID:380 -
C:\Users\Admin\AppData\Local\Temp\E639.tmp"C:\Users\Admin\AppData\Local\Temp\E639.tmp"66⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"67⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\E733.tmp"C:\Users\Admin\AppData\Local\Temp\E733.tmp"68⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"69⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\E86C.tmp"C:\Users\Admin\AppData\Local\Temp\E86C.tmp"70⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"71⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\E956.tmp"C:\Users\Admin\AppData\Local\Temp\E956.tmp"72⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"73⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\EA50.tmp"C:\Users\Admin\AppData\Local\Temp\EA50.tmp"74⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\EAFC.tmp"C:\Users\Admin\AppData\Local\Temp\EAFC.tmp"75⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\EB89.tmp"C:\Users\Admin\AppData\Local\Temp\EB89.tmp"76⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"77⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\EC63.tmp"C:\Users\Admin\AppData\Local\Temp\EC63.tmp"78⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"79⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\ED7D.tmp"C:\Users\Admin\AppData\Local\Temp\ED7D.tmp"80⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\EDEA.tmp"C:\Users\Admin\AppData\Local\Temp\EDEA.tmp"81⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\EE67.tmp"C:\Users\Admin\AppData\Local\Temp\EE67.tmp"82⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\EEF4.tmp"C:\Users\Admin\AppData\Local\Temp\EEF4.tmp"83⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\EF61.tmp"C:\Users\Admin\AppData\Local\Temp\EF61.tmp"84⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"85⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\F04B.tmp"C:\Users\Admin\AppData\Local\Temp\F04B.tmp"86⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"87⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\F174.tmp"C:\Users\Admin\AppData\Local\Temp\F174.tmp"88⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\F211.tmp"C:\Users\Admin\AppData\Local\Temp\F211.tmp"89⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\F28E.tmp"C:\Users\Admin\AppData\Local\Temp\F28E.tmp"90⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\F32A.tmp"C:\Users\Admin\AppData\Local\Temp\F32A.tmp"91⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\F3C6.tmp"C:\Users\Admin\AppData\Local\Temp\F3C6.tmp"92⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\F453.tmp"C:\Users\Admin\AppData\Local\Temp\F453.tmp"93⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\F4EF.tmp"C:\Users\Admin\AppData\Local\Temp\F4EF.tmp"94⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\F57C.tmp"C:\Users\Admin\AppData\Local\Temp\F57C.tmp"95⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\F5F9.tmp"C:\Users\Admin\AppData\Local\Temp\F5F9.tmp"96⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\F676.tmp"C:\Users\Admin\AppData\Local\Temp\F676.tmp"97⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\F702.tmp"C:\Users\Admin\AppData\Local\Temp\F702.tmp"98⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\F79E.tmp"C:\Users\Admin\AppData\Local\Temp\F79E.tmp"99⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\F83B.tmp"C:\Users\Admin\AppData\Local\Temp\F83B.tmp"100⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\F8B8.tmp"C:\Users\Admin\AppData\Local\Temp\F8B8.tmp"101⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\F944.tmp"C:\Users\Admin\AppData\Local\Temp\F944.tmp"102⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"103⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\FA2F.tmp"C:\Users\Admin\AppData\Local\Temp\FA2F.tmp"104⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\FACB.tmp"C:\Users\Admin\AppData\Local\Temp\FACB.tmp"105⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\FB77.tmp"C:\Users\Admin\AppData\Local\Temp\FB77.tmp"106⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\FBE4.tmp"C:\Users\Admin\AppData\Local\Temp\FBE4.tmp"107⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"108⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\FD1D.tmp"C:\Users\Admin\AppData\Local\Temp\FD1D.tmp"109⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\FD8A.tmp"C:\Users\Admin\AppData\Local\Temp\FD8A.tmp"110⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\FE17.tmp"C:\Users\Admin\AppData\Local\Temp\FE17.tmp"111⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\FE94.tmp"C:\Users\Admin\AppData\Local\Temp\FE94.tmp"112⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\FF20.tmp"C:\Users\Admin\AppData\Local\Temp\FF20.tmp"113⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"114⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A.tmp"115⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\A7.tmp"C:\Users\Admin\AppData\Local\Temp\A7.tmp"116⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\124.tmp"C:\Users\Admin\AppData\Local\Temp\124.tmp"117⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\191.tmp"C:\Users\Admin\AppData\Local\Temp\191.tmp"118⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\20E.tmp"C:\Users\Admin\AppData\Local\Temp\20E.tmp"119⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\27C.tmp"C:\Users\Admin\AppData\Local\Temp\27C.tmp"120⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\318.tmp"C:\Users\Admin\AppData\Local\Temp\318.tmp"121⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\3A5.tmp"C:\Users\Admin\AppData\Local\Temp\3A5.tmp"122⤵PID:2276
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-