Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
22/10/2023, 09:40
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.2023-09-07_4cfe94e4a17bf0adf43afb5e8806afbe_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.2023-09-07_4cfe94e4a17bf0adf43afb5e8806afbe_mafia_JC.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.2023-09-07_4cfe94e4a17bf0adf43afb5e8806afbe_mafia_JC.exe
-
Size
488KB
-
MD5
4cfe94e4a17bf0adf43afb5e8806afbe
-
SHA1
6a360cffde8e82918f8823521302683cec6a9eb5
-
SHA256
62e6a68f7dacaef2a2f3f87367e38db3885d060a0f26b5c69c6f510aea7504cf
-
SHA512
0ad55069932e990d51d5586bcc5e5b33019e7c8482001e96e7e93759c64f0eff2c4cc6f27a99e4217e958366e93a2e71c5471cc9f9cf435004025e332e3500bf
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7pZethvTH+5EinaWUyM4fh1+PPy0Wg0+YdK5O:/U5rCOTeiDyvLe5ZnaWpvAVjpRANZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2944 975E.tmp 1564 97FA.tmp 5104 9887.tmp 216 9952.tmp 4556 99FE.tmp 956 9AAA.tmp 640 9B84.tmp 4688 9C4F.tmp 4792 9CEC.tmp 2212 9D69.tmp 3648 9DD6.tmp 3756 9E63.tmp 4056 9EEF.tmp 4296 9F6C.tmp 2216 9FE9.tmp 4116 A1CE.tmp 2740 A299.tmp 1576 A364.tmp 3884 A44E.tmp 3248 A4DB.tmp 3552 A587.tmp 4156 A623.tmp 4512 A6A0.tmp 1084 A75C.tmp 456 A807.tmp 4100 A8C3.tmp 1532 A98E.tmp 2016 AA69.tmp 2672 AB15.tmp 2108 AC1E.tmp 736 ACE9.tmp 3564 AD86.tmp 4572 AE51.tmp 2052 AEBE.tmp 2096 AF3B.tmp 1756 AFA9.tmp 2988 B0E1.tmp 4696 B15E.tmp 2536 B1EB.tmp 2668 B277.tmp 3332 B2F4.tmp 2044 B391.tmp 1664 B41D.tmp 1480 B4B9.tmp 1216 B546.tmp 224 B5D3.tmp 3288 B650.tmp 4880 B6CD.tmp 3548 B74A.tmp 1648 B7D6.tmp 3260 B844.tmp 4732 B8A1.tmp 4376 B92E.tmp 4380 B9AB.tmp 4228 BA28.tmp 972 BAB5.tmp 4800 BB51.tmp 4108 BBDE.tmp 1092 BC6A.tmp 2428 BCE7.tmp 4772 BD74.tmp 2436 BDF1.tmp 1928 BE7D.tmp 3472 BEFA.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3332 wrote to memory of 2944 3332 NEAS.2023-09-07_4cfe94e4a17bf0adf43afb5e8806afbe_mafia_JC.exe 87 PID 3332 wrote to memory of 2944 3332 NEAS.2023-09-07_4cfe94e4a17bf0adf43afb5e8806afbe_mafia_JC.exe 87 PID 3332 wrote to memory of 2944 3332 NEAS.2023-09-07_4cfe94e4a17bf0adf43afb5e8806afbe_mafia_JC.exe 87 PID 2944 wrote to memory of 1564 2944 975E.tmp 89 PID 2944 wrote to memory of 1564 2944 975E.tmp 89 PID 2944 wrote to memory of 1564 2944 975E.tmp 89 PID 1564 wrote to memory of 5104 1564 97FA.tmp 90 PID 1564 wrote to memory of 5104 1564 97FA.tmp 90 PID 1564 wrote to memory of 5104 1564 97FA.tmp 90 PID 5104 wrote to memory of 216 5104 9887.tmp 91 PID 5104 wrote to memory of 216 5104 9887.tmp 91 PID 5104 wrote to memory of 216 5104 9887.tmp 91 PID 216 wrote to memory of 4556 216 9952.tmp 92 PID 216 wrote to memory of 4556 216 9952.tmp 92 PID 216 wrote to memory of 4556 216 9952.tmp 92 PID 4556 wrote to memory of 956 4556 99FE.tmp 93 PID 4556 wrote to memory of 956 4556 99FE.tmp 93 PID 4556 wrote to memory of 956 4556 99FE.tmp 93 PID 956 wrote to memory of 640 956 9AAA.tmp 94 PID 956 wrote to memory of 640 956 9AAA.tmp 94 PID 956 wrote to memory of 640 956 9AAA.tmp 94 PID 640 wrote to memory of 4688 640 9B84.tmp 95 PID 640 wrote to memory of 4688 640 9B84.tmp 95 PID 640 wrote to memory of 4688 640 9B84.tmp 95 PID 4688 wrote to memory of 4792 4688 9C4F.tmp 96 PID 4688 wrote to memory of 4792 4688 9C4F.tmp 96 PID 4688 wrote to memory of 4792 4688 9C4F.tmp 96 PID 4792 wrote to memory of 2212 4792 9CEC.tmp 97 PID 4792 wrote to memory of 2212 4792 9CEC.tmp 97 PID 4792 wrote to memory of 2212 4792 9CEC.tmp 97 PID 2212 wrote to memory of 3648 2212 9D69.tmp 98 PID 2212 wrote to memory of 3648 2212 9D69.tmp 98 PID 2212 wrote to memory of 3648 2212 9D69.tmp 98 PID 3648 wrote to memory of 3756 3648 9DD6.tmp 99 PID 3648 wrote to memory of 3756 3648 9DD6.tmp 99 PID 3648 wrote to memory of 3756 3648 9DD6.tmp 99 PID 3756 wrote to memory of 4056 3756 9E63.tmp 100 PID 3756 wrote to memory of 4056 3756 9E63.tmp 100 PID 3756 wrote to memory of 4056 3756 9E63.tmp 100 PID 4056 wrote to memory of 4296 4056 9EEF.tmp 101 PID 4056 wrote to memory of 4296 4056 9EEF.tmp 101 PID 4056 wrote to memory of 4296 4056 9EEF.tmp 101 PID 4296 wrote to memory of 2216 4296 9F6C.tmp 102 PID 4296 wrote to memory of 2216 4296 9F6C.tmp 102 PID 4296 wrote to memory of 2216 4296 9F6C.tmp 102 PID 2216 wrote to memory of 4116 2216 9FE9.tmp 104 PID 2216 wrote to memory of 4116 2216 9FE9.tmp 104 PID 2216 wrote to memory of 4116 2216 9FE9.tmp 104 PID 4116 wrote to memory of 2740 4116 A1CE.tmp 105 PID 4116 wrote to memory of 2740 4116 A1CE.tmp 105 PID 4116 wrote to memory of 2740 4116 A1CE.tmp 105 PID 2740 wrote to memory of 1576 2740 A299.tmp 106 PID 2740 wrote to memory of 1576 2740 A299.tmp 106 PID 2740 wrote to memory of 1576 2740 A299.tmp 106 PID 1576 wrote to memory of 3884 1576 A364.tmp 107 PID 1576 wrote to memory of 3884 1576 A364.tmp 107 PID 1576 wrote to memory of 3884 1576 A364.tmp 107 PID 3884 wrote to memory of 3248 3884 A44E.tmp 109 PID 3884 wrote to memory of 3248 3884 A44E.tmp 109 PID 3884 wrote to memory of 3248 3884 A44E.tmp 109 PID 3248 wrote to memory of 3552 3248 A4DB.tmp 110 PID 3248 wrote to memory of 3552 3248 A4DB.tmp 110 PID 3248 wrote to memory of 3552 3248 A4DB.tmp 110 PID 3552 wrote to memory of 4156 3552 A587.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-07_4cfe94e4a17bf0adf43afb5e8806afbe_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-07_4cfe94e4a17bf0adf43afb5e8806afbe_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\97FA.tmp"C:\Users\Admin\AppData\Local\Temp\97FA.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\9952.tmp"C:\Users\Admin\AppData\Local\Temp\9952.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\9D69.tmp"C:\Users\Admin\AppData\Local\Temp\9D69.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\9E63.tmp"C:\Users\Admin\AppData\Local\Temp\9E63.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\A299.tmp"C:\Users\Admin\AppData\Local\Temp\A299.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\A364.tmp"C:\Users\Admin\AppData\Local\Temp\A364.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"23⤵
- Executes dropped EXE
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"24⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"25⤵
- Executes dropped EXE
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"26⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"27⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"28⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\AA69.tmp"C:\Users\Admin\AppData\Local\Temp\AA69.tmp"29⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\AB15.tmp"C:\Users\Admin\AppData\Local\Temp\AB15.tmp"30⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"31⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"32⤵
- Executes dropped EXE
PID:736 -
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"33⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\AE51.tmp"C:\Users\Admin\AppData\Local\Temp\AE51.tmp"34⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"35⤵
- Executes dropped EXE
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"36⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"37⤵
- Executes dropped EXE
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\B035.tmp"C:\Users\Admin\AppData\Local\Temp\B035.tmp"38⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"39⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\B15E.tmp"C:\Users\Admin\AppData\Local\Temp\B15E.tmp"40⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"41⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\B277.tmp"C:\Users\Admin\AppData\Local\Temp\B277.tmp"42⤵
- Executes dropped EXE
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"43⤵
- Executes dropped EXE
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\B391.tmp"C:\Users\Admin\AppData\Local\Temp\B391.tmp"44⤵
- Executes dropped EXE
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\B41D.tmp"C:\Users\Admin\AppData\Local\Temp\B41D.tmp"45⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"46⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\B546.tmp"C:\Users\Admin\AppData\Local\Temp\B546.tmp"47⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"48⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\B650.tmp"C:\Users\Admin\AppData\Local\Temp\B650.tmp"49⤵
- Executes dropped EXE
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"50⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\B74A.tmp"C:\Users\Admin\AppData\Local\Temp\B74A.tmp"51⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"52⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\B844.tmp"C:\Users\Admin\AppData\Local\Temp\B844.tmp"53⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"54⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"55⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"56⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\BA28.tmp"C:\Users\Admin\AppData\Local\Temp\BA28.tmp"57⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"58⤵
- Executes dropped EXE
PID:972 -
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"59⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"60⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"61⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"62⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\BD74.tmp"C:\Users\Admin\AppData\Local\Temp\BD74.tmp"63⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"64⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"65⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"66⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\BF87.tmp"C:\Users\Admin\AppData\Local\Temp\BF87.tmp"67⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\C014.tmp"C:\Users\Admin\AppData\Local\Temp\C014.tmp"68⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"69⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"70⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\C16B.tmp"C:\Users\Admin\AppData\Local\Temp\C16B.tmp"71⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\C208.tmp"C:\Users\Admin\AppData\Local\Temp\C208.tmp"72⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\C285.tmp"C:\Users\Admin\AppData\Local\Temp\C285.tmp"73⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\C302.tmp"C:\Users\Admin\AppData\Local\Temp\C302.tmp"74⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\C37F.tmp"C:\Users\Admin\AppData\Local\Temp\C37F.tmp"75⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\C40B.tmp"C:\Users\Admin\AppData\Local\Temp\C40B.tmp"76⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\C498.tmp"C:\Users\Admin\AppData\Local\Temp\C498.tmp"77⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\C515.tmp"C:\Users\Admin\AppData\Local\Temp\C515.tmp"78⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"79⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\C66D.tmp"C:\Users\Admin\AppData\Local\Temp\C66D.tmp"80⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\C709.tmp"C:\Users\Admin\AppData\Local\Temp\C709.tmp"81⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\C786.tmp"C:\Users\Admin\AppData\Local\Temp\C786.tmp"82⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\C803.tmp"C:\Users\Admin\AppData\Local\Temp\C803.tmp"83⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\C890.tmp"C:\Users\Admin\AppData\Local\Temp\C890.tmp"84⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\C90D.tmp"C:\Users\Admin\AppData\Local\Temp\C90D.tmp"85⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\C97A.tmp"C:\Users\Admin\AppData\Local\Temp\C97A.tmp"86⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\CA07.tmp"C:\Users\Admin\AppData\Local\Temp\CA07.tmp"87⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\CA74.tmp"C:\Users\Admin\AppData\Local\Temp\CA74.tmp"88⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"89⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"90⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"91⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\CC87.tmp"C:\Users\Admin\AppData\Local\Temp\CC87.tmp"92⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\CD14.tmp"C:\Users\Admin\AppData\Local\Temp\CD14.tmp"93⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\CD91.tmp"C:\Users\Admin\AppData\Local\Temp\CD91.tmp"94⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"95⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"96⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\CF17.tmp"C:\Users\Admin\AppData\Local\Temp\CF17.tmp"97⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"98⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\D040.tmp"C:\Users\Admin\AppData\Local\Temp\D040.tmp"99⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"100⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\D14A.tmp"C:\Users\Admin\AppData\Local\Temp\D14A.tmp"101⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"102⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\D244.tmp"C:\Users\Admin\AppData\Local\Temp\D244.tmp"103⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\D2B1.tmp"C:\Users\Admin\AppData\Local\Temp\D2B1.tmp"104⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\D31F.tmp"C:\Users\Admin\AppData\Local\Temp\D31F.tmp"105⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"106⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\D419.tmp"C:\Users\Admin\AppData\Local\Temp\D419.tmp"107⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\D486.tmp"C:\Users\Admin\AppData\Local\Temp\D486.tmp"108⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\D4F3.tmp"C:\Users\Admin\AppData\Local\Temp\D4F3.tmp"109⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\D580.tmp"C:\Users\Admin\AppData\Local\Temp\D580.tmp"110⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"111⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\D67A.tmp"C:\Users\Admin\AppData\Local\Temp\D67A.tmp"112⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\D6E7.tmp"C:\Users\Admin\AppData\Local\Temp\D6E7.tmp"113⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\D764.tmp"C:\Users\Admin\AppData\Local\Temp\D764.tmp"114⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\D7E1.tmp"C:\Users\Admin\AppData\Local\Temp\D7E1.tmp"115⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\D84F.tmp"C:\Users\Admin\AppData\Local\Temp\D84F.tmp"116⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\D8CC.tmp"C:\Users\Admin\AppData\Local\Temp\D8CC.tmp"117⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\D949.tmp"C:\Users\Admin\AppData\Local\Temp\D949.tmp"118⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"119⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\DA72.tmp"C:\Users\Admin\AppData\Local\Temp\DA72.tmp"120⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\DAFE.tmp"C:\Users\Admin\AppData\Local\Temp\DAFE.tmp"121⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\DB7B.tmp"C:\Users\Admin\AppData\Local\Temp\DB7B.tmp"122⤵PID:2592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-