Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
160s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
22/10/2023, 10:15
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.2023-09-05_f59aa1e79d6fed25ac8e2021ca9f2b06_mafia_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.2023-09-05_f59aa1e79d6fed25ac8e2021ca9f2b06_mafia_JC.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.2023-09-05_f59aa1e79d6fed25ac8e2021ca9f2b06_mafia_JC.exe
-
Size
488KB
-
MD5
f59aa1e79d6fed25ac8e2021ca9f2b06
-
SHA1
18bfac2e69dd374034450d7121befdfdbe700c7b
-
SHA256
729c9de5ebc3c394e3f0593b4b333efad0f13495ed0a6f49589f28ee358ec1e3
-
SHA512
9d02ea36bee6cd5efc8c1d811d7d03e1aa75e5b54443bb4a452a80658799f1d7b92c5c781b0b9cb7761efb13b190b5a156cf6e593ac03f152d294ca74c4d5b24
-
SSDEEP
12288:/U5rCOTeiDwXY6jDvKqrxm6j0YLkBvcpSNZ:/UQOJDJ6jDvKc4ikBvcoN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 840 A5E5.tmp 4552 AA3A.tmp 4524 AAE6.tmp 2896 AC6C.tmp 1704 AD28.tmp 4896 ADA5.tmp 536 AE41.tmp 2888 AEFD.tmp 2792 AF89.tmp 3620 B17D.tmp 2344 B21A.tmp 3224 B297.tmp 5064 B314.tmp 628 B391.tmp 2172 B42D.tmp 4724 B4B9.tmp 2432 B7F6.tmp 1000 BF58.tmp 4304 C3EC.tmp 2320 C488.tmp 344 C534.tmp 4508 C9B8.tmp 2988 D07F.tmp 3460 D62C.tmp 852 D86E.tmp 2716 D9D5.tmp 220 DB1E.tmp 4200 DD21.tmp 5024 DF25.tmp 5012 E0FA.tmp 4360 E186.tmp 4768 E232.tmp 2992 E30D.tmp 3768 E399.tmp 4440 E3F7.tmp 2076 E5FB.tmp 3104 E85C.tmp 5044 EA50.tmp 1112 EADD.tmp 3040 EB69.tmp 1424 F5E9.tmp 4780 F731.tmp 1704 F80C.tmp 1384 FA1F.tmp 3948 FAFA.tmp 2892 FDA9.tmp 3400 FE26.tmp 2392 FFBD.tmp 4728 162.tmp 396 23D.tmp 4736 2AB.tmp 60 366.tmp 456 3E3.tmp 4704 441.tmp 2124 4BE.tmp 1488 52B.tmp 4180 5A8.tmp 4604 644.tmp 3284 6C1.tmp 952 74E.tmp 224 7CB.tmp 2968 848.tmp 2432 8B5.tmp 4060 932.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4636 wrote to memory of 840 4636 NEAS.2023-09-05_f59aa1e79d6fed25ac8e2021ca9f2b06_mafia_JC.exe 88 PID 4636 wrote to memory of 840 4636 NEAS.2023-09-05_f59aa1e79d6fed25ac8e2021ca9f2b06_mafia_JC.exe 88 PID 4636 wrote to memory of 840 4636 NEAS.2023-09-05_f59aa1e79d6fed25ac8e2021ca9f2b06_mafia_JC.exe 88 PID 840 wrote to memory of 4552 840 A5E5.tmp 89 PID 840 wrote to memory of 4552 840 A5E5.tmp 89 PID 840 wrote to memory of 4552 840 A5E5.tmp 89 PID 4552 wrote to memory of 4524 4552 AA3A.tmp 90 PID 4552 wrote to memory of 4524 4552 AA3A.tmp 90 PID 4552 wrote to memory of 4524 4552 AA3A.tmp 90 PID 4524 wrote to memory of 2896 4524 AAE6.tmp 91 PID 4524 wrote to memory of 2896 4524 AAE6.tmp 91 PID 4524 wrote to memory of 2896 4524 AAE6.tmp 91 PID 2896 wrote to memory of 1704 2896 AC6C.tmp 92 PID 2896 wrote to memory of 1704 2896 AC6C.tmp 92 PID 2896 wrote to memory of 1704 2896 AC6C.tmp 92 PID 1704 wrote to memory of 4896 1704 AD28.tmp 93 PID 1704 wrote to memory of 4896 1704 AD28.tmp 93 PID 1704 wrote to memory of 4896 1704 AD28.tmp 93 PID 4896 wrote to memory of 536 4896 ADA5.tmp 94 PID 4896 wrote to memory of 536 4896 ADA5.tmp 94 PID 4896 wrote to memory of 536 4896 ADA5.tmp 94 PID 536 wrote to memory of 2888 536 AE41.tmp 95 PID 536 wrote to memory of 2888 536 AE41.tmp 95 PID 536 wrote to memory of 2888 536 AE41.tmp 95 PID 2888 wrote to memory of 2792 2888 AEFD.tmp 96 PID 2888 wrote to memory of 2792 2888 AEFD.tmp 96 PID 2888 wrote to memory of 2792 2888 AEFD.tmp 96 PID 2792 wrote to memory of 3620 2792 AF89.tmp 97 PID 2792 wrote to memory of 3620 2792 AF89.tmp 97 PID 2792 wrote to memory of 3620 2792 AF89.tmp 97 PID 3620 wrote to memory of 2344 3620 B17D.tmp 98 PID 3620 wrote to memory of 2344 3620 B17D.tmp 98 PID 3620 wrote to memory of 2344 3620 B17D.tmp 98 PID 2344 wrote to memory of 3224 2344 B21A.tmp 99 PID 2344 wrote to memory of 3224 2344 B21A.tmp 99 PID 2344 wrote to memory of 3224 2344 B21A.tmp 99 PID 3224 wrote to memory of 5064 3224 B297.tmp 101 PID 3224 wrote to memory of 5064 3224 B297.tmp 101 PID 3224 wrote to memory of 5064 3224 B297.tmp 101 PID 5064 wrote to memory of 628 5064 B314.tmp 102 PID 5064 wrote to memory of 628 5064 B314.tmp 102 PID 5064 wrote to memory of 628 5064 B314.tmp 102 PID 628 wrote to memory of 2172 628 B391.tmp 104 PID 628 wrote to memory of 2172 628 B391.tmp 104 PID 628 wrote to memory of 2172 628 B391.tmp 104 PID 2172 wrote to memory of 4724 2172 B42D.tmp 105 PID 2172 wrote to memory of 4724 2172 B42D.tmp 105 PID 2172 wrote to memory of 4724 2172 B42D.tmp 105 PID 4724 wrote to memory of 2432 4724 B4B9.tmp 106 PID 4724 wrote to memory of 2432 4724 B4B9.tmp 106 PID 4724 wrote to memory of 2432 4724 B4B9.tmp 106 PID 2432 wrote to memory of 1000 2432 B7F6.tmp 108 PID 2432 wrote to memory of 1000 2432 B7F6.tmp 108 PID 2432 wrote to memory of 1000 2432 B7F6.tmp 108 PID 1000 wrote to memory of 4304 1000 BF58.tmp 109 PID 1000 wrote to memory of 4304 1000 BF58.tmp 109 PID 1000 wrote to memory of 4304 1000 BF58.tmp 109 PID 4304 wrote to memory of 2320 4304 C3EC.tmp 110 PID 4304 wrote to memory of 2320 4304 C3EC.tmp 110 PID 4304 wrote to memory of 2320 4304 C3EC.tmp 110 PID 2320 wrote to memory of 344 2320 C488.tmp 111 PID 2320 wrote to memory of 344 2320 C488.tmp 111 PID 2320 wrote to memory of 344 2320 C488.tmp 111 PID 344 wrote to memory of 4508 344 C534.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-05_f59aa1e79d6fed25ac8e2021ca9f2b06_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-05_f59aa1e79d6fed25ac8e2021ca9f2b06_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\AE41.tmp"C:\Users\Admin\AppData\Local\Temp\AE41.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\B17D.tmp"C:\Users\Admin\AppData\Local\Temp\B17D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\B21A.tmp"C:\Users\Admin\AppData\Local\Temp\B21A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\B314.tmp"C:\Users\Admin\AppData\Local\Temp\B314.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\B391.tmp"C:\Users\Admin\AppData\Local\Temp\B391.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\B42D.tmp"C:\Users\Admin\AppData\Local\Temp\B42D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\BF58.tmp"C:\Users\Admin\AppData\Local\Temp\BF58.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\C488.tmp"C:\Users\Admin\AppData\Local\Temp\C488.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\C534.tmp"C:\Users\Admin\AppData\Local\Temp\C534.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"23⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\D07F.tmp"C:\Users\Admin\AppData\Local\Temp\D07F.tmp"24⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\D62C.tmp"C:\Users\Admin\AppData\Local\Temp\D62C.tmp"25⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\D86E.tmp"C:\Users\Admin\AppData\Local\Temp\D86E.tmp"26⤵
- Executes dropped EXE
PID:852 -
C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"27⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"28⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\DD21.tmp"C:\Users\Admin\AppData\Local\Temp\DD21.tmp"29⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\DF25.tmp"C:\Users\Admin\AppData\Local\Temp\DF25.tmp"30⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"31⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\E186.tmp"C:\Users\Admin\AppData\Local\Temp\E186.tmp"32⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\E232.tmp"C:\Users\Admin\AppData\Local\Temp\E232.tmp"33⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\E30D.tmp"C:\Users\Admin\AppData\Local\Temp\E30D.tmp"34⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\E399.tmp"C:\Users\Admin\AppData\Local\Temp\E399.tmp"35⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\E3F7.tmp"C:\Users\Admin\AppData\Local\Temp\E3F7.tmp"36⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"37⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\E85C.tmp"C:\Users\Admin\AppData\Local\Temp\E85C.tmp"38⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\EA50.tmp"C:\Users\Admin\AppData\Local\Temp\EA50.tmp"39⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\EADD.tmp"C:\Users\Admin\AppData\Local\Temp\EADD.tmp"40⤵
- Executes dropped EXE
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\EB69.tmp"C:\Users\Admin\AppData\Local\Temp\EB69.tmp"41⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\F5E9.tmp"C:\Users\Admin\AppData\Local\Temp\F5E9.tmp"42⤵
- Executes dropped EXE
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\F731.tmp"C:\Users\Admin\AppData\Local\Temp\F731.tmp"43⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\F80C.tmp"C:\Users\Admin\AppData\Local\Temp\F80C.tmp"44⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\FA1F.tmp"C:\Users\Admin\AppData\Local\Temp\FA1F.tmp"45⤵
- Executes dropped EXE
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"46⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"47⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\FE26.tmp"C:\Users\Admin\AppData\Local\Temp\FE26.tmp"48⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"49⤵
- Executes dropped EXE
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\162.tmp"C:\Users\Admin\AppData\Local\Temp\162.tmp"50⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\23D.tmp"C:\Users\Admin\AppData\Local\Temp\23D.tmp"51⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\2AB.tmp"C:\Users\Admin\AppData\Local\Temp\2AB.tmp"52⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\366.tmp"C:\Users\Admin\AppData\Local\Temp\366.tmp"53⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\3E3.tmp"C:\Users\Admin\AppData\Local\Temp\3E3.tmp"54⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\441.tmp"C:\Users\Admin\AppData\Local\Temp\441.tmp"55⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\4BE.tmp"C:\Users\Admin\AppData\Local\Temp\4BE.tmp"56⤵
- Executes dropped EXE
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\52B.tmp"C:\Users\Admin\AppData\Local\Temp\52B.tmp"57⤵
- Executes dropped EXE
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\5A8.tmp"C:\Users\Admin\AppData\Local\Temp\5A8.tmp"58⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\644.tmp"C:\Users\Admin\AppData\Local\Temp\644.tmp"59⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\6C1.tmp"C:\Users\Admin\AppData\Local\Temp\6C1.tmp"60⤵
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\74E.tmp"C:\Users\Admin\AppData\Local\Temp\74E.tmp"61⤵
- Executes dropped EXE
PID:952 -
C:\Users\Admin\AppData\Local\Temp\7CB.tmp"C:\Users\Admin\AppData\Local\Temp\7CB.tmp"62⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\848.tmp"C:\Users\Admin\AppData\Local\Temp\848.tmp"63⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\8B5.tmp"C:\Users\Admin\AppData\Local\Temp\8B5.tmp"64⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\932.tmp"C:\Users\Admin\AppData\Local\Temp\932.tmp"65⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\9BF.tmp"C:\Users\Admin\AppData\Local\Temp\9BF.tmp"66⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\A4C.tmp"C:\Users\Admin\AppData\Local\Temp\A4C.tmp"67⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\AC9.tmp"C:\Users\Admin\AppData\Local\Temp\AC9.tmp"68⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\B46.tmp"C:\Users\Admin\AppData\Local\Temp\B46.tmp"69⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\BC3.tmp"C:\Users\Admin\AppData\Local\Temp\BC3.tmp"70⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\C40.tmp"C:\Users\Admin\AppData\Local\Temp\C40.tmp"71⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\CBD.tmp"C:\Users\Admin\AppData\Local\Temp\CBD.tmp"72⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\D3A.tmp"C:\Users\Admin\AppData\Local\Temp\D3A.tmp"73⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\D97.tmp"C:\Users\Admin\AppData\Local\Temp\D97.tmp"74⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\E14.tmp"C:\Users\Admin\AppData\Local\Temp\E14.tmp"75⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\E72.tmp"C:\Users\Admin\AppData\Local\Temp\E72.tmp"76⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\EEF.tmp"C:\Users\Admin\AppData\Local\Temp\EEF.tmp"77⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\F7C.tmp"C:\Users\Admin\AppData\Local\Temp\F7C.tmp"78⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"79⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\1085.tmp"C:\Users\Admin\AppData\Local\Temp\1085.tmp"80⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\1112.tmp"C:\Users\Admin\AppData\Local\Temp\1112.tmp"81⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\119F.tmp"C:\Users\Admin\AppData\Local\Temp\119F.tmp"82⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\120C.tmp"C:\Users\Admin\AppData\Local\Temp\120C.tmp"83⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\1289.tmp"C:\Users\Admin\AppData\Local\Temp\1289.tmp"84⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\1345.tmp"C:\Users\Admin\AppData\Local\Temp\1345.tmp"85⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\13B2.tmp"C:\Users\Admin\AppData\Local\Temp\13B2.tmp"86⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\142F.tmp"C:\Users\Admin\AppData\Local\Temp\142F.tmp"87⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\149C.tmp"C:\Users\Admin\AppData\Local\Temp\149C.tmp"88⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\1529.tmp"C:\Users\Admin\AppData\Local\Temp\1529.tmp"89⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\15B6.tmp"C:\Users\Admin\AppData\Local\Temp\15B6.tmp"90⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\1652.tmp"C:\Users\Admin\AppData\Local\Temp\1652.tmp"91⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\16CF.tmp"C:\Users\Admin\AppData\Local\Temp\16CF.tmp"92⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\175B.tmp"C:\Users\Admin\AppData\Local\Temp\175B.tmp"93⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\17E8.tmp"C:\Users\Admin\AppData\Local\Temp\17E8.tmp"94⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\1884.tmp"C:\Users\Admin\AppData\Local\Temp\1884.tmp"95⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\18F2.tmp"C:\Users\Admin\AppData\Local\Temp\18F2.tmp"96⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\198E.tmp"C:\Users\Admin\AppData\Local\Temp\198E.tmp"97⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"98⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\1A88.tmp"C:\Users\Admin\AppData\Local\Temp\1A88.tmp"99⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"100⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\1B53.tmp"C:\Users\Admin\AppData\Local\Temp\1B53.tmp"101⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\1BC0.tmp"C:\Users\Admin\AppData\Local\Temp\1BC0.tmp"102⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"103⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\1C8C.tmp"C:\Users\Admin\AppData\Local\Temp\1C8C.tmp"104⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\1CE9.tmp"C:\Users\Admin\AppData\Local\Temp\1CE9.tmp"105⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\1D47.tmp"C:\Users\Admin\AppData\Local\Temp\1D47.tmp"106⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\1DA5.tmp"C:\Users\Admin\AppData\Local\Temp\1DA5.tmp"107⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\1E03.tmp"C:\Users\Admin\AppData\Local\Temp\1E03.tmp"108⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\1E60.tmp"C:\Users\Admin\AppData\Local\Temp\1E60.tmp"109⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\1EBE.tmp"C:\Users\Admin\AppData\Local\Temp\1EBE.tmp"110⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\1F1C.tmp"C:\Users\Admin\AppData\Local\Temp\1F1C.tmp"111⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\1F7A.tmp"C:\Users\Admin\AppData\Local\Temp\1F7A.tmp"112⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\1FD7.tmp"C:\Users\Admin\AppData\Local\Temp\1FD7.tmp"113⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\2035.tmp"C:\Users\Admin\AppData\Local\Temp\2035.tmp"114⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\2083.tmp"C:\Users\Admin\AppData\Local\Temp\2083.tmp"115⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\20E1.tmp"C:\Users\Admin\AppData\Local\Temp\20E1.tmp"116⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\213F.tmp"C:\Users\Admin\AppData\Local\Temp\213F.tmp"117⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\219C.tmp"C:\Users\Admin\AppData\Local\Temp\219C.tmp"118⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\21EB.tmp"C:\Users\Admin\AppData\Local\Temp\21EB.tmp"119⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\2248.tmp"C:\Users\Admin\AppData\Local\Temp\2248.tmp"120⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\22A6.tmp"C:\Users\Admin\AppData\Local\Temp\22A6.tmp"121⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\2313.tmp"C:\Users\Admin\AppData\Local\Temp\2313.tmp"122⤵PID:4708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-