Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
156s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
23/10/2023, 16:35
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.2023-09-09_2f6307951c3459660b659ac18fe79e5c_mafia_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.2023-09-09_2f6307951c3459660b659ac18fe79e5c_mafia_JC.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.2023-09-09_2f6307951c3459660b659ac18fe79e5c_mafia_JC.exe
-
Size
487KB
-
MD5
2f6307951c3459660b659ac18fe79e5c
-
SHA1
97467c91e56cc02dcd95c4d5dba27d3422314d72
-
SHA256
319cc187af80c77ad3bcc3d4814a834c6525eef12067ef62917cca00f3045729
-
SHA512
4f5ac64370c072c89f60ef800e8c136a50b1d1ddd9f7d9fb8dfe1252e84bfae8c480fe9b0397980221252de0221305a373b38df3f4fe20a0d01fc9acef01ee3e
-
SSDEEP
6144:qorf3lPvovsgZnqG2C7mOTeiL9DU2XkGSukuU47nnhhUoYQKGBwPDtQTZI3nVtnc:HU5rCOTeiJvXFvj7nhcQfwPJXVt6NZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3084 1F0C.tmp 3468 240D.tmp 3148 26EC.tmp 1576 2882.tmp 4540 29F9.tmp 3416 2B51.tmp 988 2D06.tmp 3228 2DF1.tmp 556 2EDB.tmp 3028 2FF4.tmp 3608 314C.tmp 4940 3350.tmp 4884 3563.tmp 1780 361E.tmp 4048 3776.tmp 1920 3BBC.tmp 1908 3C87.tmp 2980 3EE8.tmp 3124 3F75.tmp 420 4021.tmp 952 40EC.tmp 3452 437C.tmp 2224 46E7.tmp 4948 48AC.tmp 2292 49A6.tmp 1916 4A91.tmp 3812 4B6C.tmp 4868 4C56.tmp 5100 4CC3.tmp 3856 4D7F.tmp 3944 4E2B.tmp 3332 4FC1.tmp 4696 506D.tmp 1724 50F9.tmp 3008 5186.tmp 3996 5251.tmp 2216 52CE.tmp 1044 536A.tmp 2752 53E7.tmp 4380 5501.tmp 1480 5668.tmp 5028 56E5.tmp 448 5781.tmp 3460 580E.tmp 616 5A50.tmp 4844 5ADD.tmp 4552 5B98.tmp 2172 5C25.tmp 1848 5CD1.tmp 4600 5DBB.tmp 1600 5E48.tmp 3932 5EC5.tmp 2896 5F90.tmp 2052 602C.tmp 2164 61B3.tmp 4300 6339.tmp 4424 63B6.tmp 3988 6453.tmp 2212 64DF.tmp 3956 65E9.tmp 3536 6675.tmp 3044 6702.tmp 2936 678F.tmp 2012 680C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1808 wrote to memory of 3084 1808 NEAS.2023-09-09_2f6307951c3459660b659ac18fe79e5c_mafia_JC.exe 84 PID 1808 wrote to memory of 3084 1808 NEAS.2023-09-09_2f6307951c3459660b659ac18fe79e5c_mafia_JC.exe 84 PID 1808 wrote to memory of 3084 1808 NEAS.2023-09-09_2f6307951c3459660b659ac18fe79e5c_mafia_JC.exe 84 PID 3084 wrote to memory of 3468 3084 1F0C.tmp 85 PID 3084 wrote to memory of 3468 3084 1F0C.tmp 85 PID 3084 wrote to memory of 3468 3084 1F0C.tmp 85 PID 3468 wrote to memory of 3148 3468 240D.tmp 86 PID 3468 wrote to memory of 3148 3468 240D.tmp 86 PID 3468 wrote to memory of 3148 3468 240D.tmp 86 PID 3148 wrote to memory of 1576 3148 26EC.tmp 87 PID 3148 wrote to memory of 1576 3148 26EC.tmp 87 PID 3148 wrote to memory of 1576 3148 26EC.tmp 87 PID 1576 wrote to memory of 4540 1576 2882.tmp 88 PID 1576 wrote to memory of 4540 1576 2882.tmp 88 PID 1576 wrote to memory of 4540 1576 2882.tmp 88 PID 4540 wrote to memory of 3416 4540 29F9.tmp 89 PID 4540 wrote to memory of 3416 4540 29F9.tmp 89 PID 4540 wrote to memory of 3416 4540 29F9.tmp 89 PID 3416 wrote to memory of 988 3416 2B51.tmp 90 PID 3416 wrote to memory of 988 3416 2B51.tmp 90 PID 3416 wrote to memory of 988 3416 2B51.tmp 90 PID 988 wrote to memory of 3228 988 2D06.tmp 91 PID 988 wrote to memory of 3228 988 2D06.tmp 91 PID 988 wrote to memory of 3228 988 2D06.tmp 91 PID 3228 wrote to memory of 556 3228 2DF1.tmp 92 PID 3228 wrote to memory of 556 3228 2DF1.tmp 92 PID 3228 wrote to memory of 556 3228 2DF1.tmp 92 PID 556 wrote to memory of 3028 556 2EDB.tmp 93 PID 556 wrote to memory of 3028 556 2EDB.tmp 93 PID 556 wrote to memory of 3028 556 2EDB.tmp 93 PID 3028 wrote to memory of 3608 3028 2FF4.tmp 94 PID 3028 wrote to memory of 3608 3028 2FF4.tmp 94 PID 3028 wrote to memory of 3608 3028 2FF4.tmp 94 PID 3608 wrote to memory of 4940 3608 314C.tmp 95 PID 3608 wrote to memory of 4940 3608 314C.tmp 95 PID 3608 wrote to memory of 4940 3608 314C.tmp 95 PID 4940 wrote to memory of 4884 4940 3350.tmp 96 PID 4940 wrote to memory of 4884 4940 3350.tmp 96 PID 4940 wrote to memory of 4884 4940 3350.tmp 96 PID 4884 wrote to memory of 1780 4884 3563.tmp 97 PID 4884 wrote to memory of 1780 4884 3563.tmp 97 PID 4884 wrote to memory of 1780 4884 3563.tmp 97 PID 1780 wrote to memory of 4048 1780 361E.tmp 98 PID 1780 wrote to memory of 4048 1780 361E.tmp 98 PID 1780 wrote to memory of 4048 1780 361E.tmp 98 PID 4048 wrote to memory of 1920 4048 3776.tmp 99 PID 4048 wrote to memory of 1920 4048 3776.tmp 99 PID 4048 wrote to memory of 1920 4048 3776.tmp 99 PID 1920 wrote to memory of 1908 1920 3BBC.tmp 100 PID 1920 wrote to memory of 1908 1920 3BBC.tmp 100 PID 1920 wrote to memory of 1908 1920 3BBC.tmp 100 PID 1908 wrote to memory of 2980 1908 3C87.tmp 101 PID 1908 wrote to memory of 2980 1908 3C87.tmp 101 PID 1908 wrote to memory of 2980 1908 3C87.tmp 101 PID 2980 wrote to memory of 3124 2980 3EE8.tmp 102 PID 2980 wrote to memory of 3124 2980 3EE8.tmp 102 PID 2980 wrote to memory of 3124 2980 3EE8.tmp 102 PID 3124 wrote to memory of 420 3124 3F75.tmp 103 PID 3124 wrote to memory of 420 3124 3F75.tmp 103 PID 3124 wrote to memory of 420 3124 3F75.tmp 103 PID 420 wrote to memory of 952 420 4021.tmp 104 PID 420 wrote to memory of 952 420 4021.tmp 104 PID 420 wrote to memory of 952 420 4021.tmp 104 PID 952 wrote to memory of 3452 952 40EC.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-09_2f6307951c3459660b659ac18fe79e5c_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-09_2f6307951c3459660b659ac18fe79e5c_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\240D.tmp"C:\Users\Admin\AppData\Local\Temp\240D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\26EC.tmp"C:\Users\Admin\AppData\Local\Temp\26EC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\2882.tmp"C:\Users\Admin\AppData\Local\Temp\2882.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\29F9.tmp"C:\Users\Admin\AppData\Local\Temp\29F9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\2B51.tmp"C:\Users\Admin\AppData\Local\Temp\2B51.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\2D06.tmp"C:\Users\Admin\AppData\Local\Temp\2D06.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\2EDB.tmp"C:\Users\Admin\AppData\Local\Temp\2EDB.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\2FF4.tmp"C:\Users\Admin\AppData\Local\Temp\2FF4.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\314C.tmp"C:\Users\Admin\AppData\Local\Temp\314C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\3563.tmp"C:\Users\Admin\AppData\Local\Temp\3563.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\361E.tmp"C:\Users\Admin\AppData\Local\Temp\361E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\3776.tmp"C:\Users\Admin\AppData\Local\Temp\3776.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\3BBC.tmp"C:\Users\Admin\AppData\Local\Temp\3BBC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\3C87.tmp"C:\Users\Admin\AppData\Local\Temp\3C87.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\3EE8.tmp"C:\Users\Admin\AppData\Local\Temp\3EE8.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\3F75.tmp"C:\Users\Admin\AppData\Local\Temp\3F75.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\4021.tmp"C:\Users\Admin\AppData\Local\Temp\4021.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Users\Admin\AppData\Local\Temp\40EC.tmp"C:\Users\Admin\AppData\Local\Temp\40EC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Temp\437C.tmp"C:\Users\Admin\AppData\Local\Temp\437C.tmp"23⤵
- Executes dropped EXE
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\46E7.tmp"C:\Users\Admin\AppData\Local\Temp\46E7.tmp"24⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\48AC.tmp"C:\Users\Admin\AppData\Local\Temp\48AC.tmp"25⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\49A6.tmp"C:\Users\Admin\AppData\Local\Temp\49A6.tmp"26⤵
- Executes dropped EXE
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\4A91.tmp"C:\Users\Admin\AppData\Local\Temp\4A91.tmp"27⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\4B6C.tmp"C:\Users\Admin\AppData\Local\Temp\4B6C.tmp"28⤵
- Executes dropped EXE
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\4C56.tmp"C:\Users\Admin\AppData\Local\Temp\4C56.tmp"29⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\4CC3.tmp"C:\Users\Admin\AppData\Local\Temp\4CC3.tmp"30⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\4D7F.tmp"C:\Users\Admin\AppData\Local\Temp\4D7F.tmp"31⤵
- Executes dropped EXE
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\4E2B.tmp"C:\Users\Admin\AppData\Local\Temp\4E2B.tmp"32⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\4FC1.tmp"C:\Users\Admin\AppData\Local\Temp\4FC1.tmp"33⤵
- Executes dropped EXE
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\506D.tmp"C:\Users\Admin\AppData\Local\Temp\506D.tmp"34⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\50F9.tmp"C:\Users\Admin\AppData\Local\Temp\50F9.tmp"35⤵
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\5186.tmp"C:\Users\Admin\AppData\Local\Temp\5186.tmp"36⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\5251.tmp"C:\Users\Admin\AppData\Local\Temp\5251.tmp"37⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\52CE.tmp"C:\Users\Admin\AppData\Local\Temp\52CE.tmp"38⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\536A.tmp"C:\Users\Admin\AppData\Local\Temp\536A.tmp"39⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\53E7.tmp"C:\Users\Admin\AppData\Local\Temp\53E7.tmp"40⤵
- Executes dropped EXE
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\5501.tmp"C:\Users\Admin\AppData\Local\Temp\5501.tmp"41⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\5668.tmp"C:\Users\Admin\AppData\Local\Temp\5668.tmp"42⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\56E5.tmp"C:\Users\Admin\AppData\Local\Temp\56E5.tmp"43⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\5781.tmp"C:\Users\Admin\AppData\Local\Temp\5781.tmp"44⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\580E.tmp"C:\Users\Admin\AppData\Local\Temp\580E.tmp"45⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\5A50.tmp"C:\Users\Admin\AppData\Local\Temp\5A50.tmp"46⤵
- Executes dropped EXE
PID:616 -
C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"47⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\5B98.tmp"C:\Users\Admin\AppData\Local\Temp\5B98.tmp"48⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\5C25.tmp"C:\Users\Admin\AppData\Local\Temp\5C25.tmp"49⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\5CD1.tmp"C:\Users\Admin\AppData\Local\Temp\5CD1.tmp"50⤵
- Executes dropped EXE
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\5DBB.tmp"C:\Users\Admin\AppData\Local\Temp\5DBB.tmp"51⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\5E48.tmp"C:\Users\Admin\AppData\Local\Temp\5E48.tmp"52⤵
- Executes dropped EXE
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\5EC5.tmp"C:\Users\Admin\AppData\Local\Temp\5EC5.tmp"53⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\5F90.tmp"C:\Users\Admin\AppData\Local\Temp\5F90.tmp"54⤵
- Executes dropped EXE
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\602C.tmp"C:\Users\Admin\AppData\Local\Temp\602C.tmp"55⤵
- Executes dropped EXE
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\61B3.tmp"C:\Users\Admin\AppData\Local\Temp\61B3.tmp"56⤵
- Executes dropped EXE
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\6339.tmp"C:\Users\Admin\AppData\Local\Temp\6339.tmp"57⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\63B6.tmp"C:\Users\Admin\AppData\Local\Temp\63B6.tmp"58⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\6453.tmp"C:\Users\Admin\AppData\Local\Temp\6453.tmp"59⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\64DF.tmp"C:\Users\Admin\AppData\Local\Temp\64DF.tmp"60⤵
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\65E9.tmp"C:\Users\Admin\AppData\Local\Temp\65E9.tmp"61⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\6675.tmp"C:\Users\Admin\AppData\Local\Temp\6675.tmp"62⤵
- Executes dropped EXE
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\6702.tmp"C:\Users\Admin\AppData\Local\Temp\6702.tmp"63⤵
- Executes dropped EXE
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\678F.tmp"C:\Users\Admin\AppData\Local\Temp\678F.tmp"64⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\680C.tmp"C:\Users\Admin\AppData\Local\Temp\680C.tmp"65⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\68D7.tmp"C:\Users\Admin\AppData\Local\Temp\68D7.tmp"66⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\6983.tmp"C:\Users\Admin\AppData\Local\Temp\6983.tmp"67⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\6ADA.tmp"C:\Users\Admin\AppData\Local\Temp\6ADA.tmp"68⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\6B57.tmp"C:\Users\Admin\AppData\Local\Temp\6B57.tmp"69⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\6C03.tmp"C:\Users\Admin\AppData\Local\Temp\6C03.tmp"70⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\6CA0.tmp"C:\Users\Admin\AppData\Local\Temp\6CA0.tmp"71⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\6D3C.tmp"C:\Users\Admin\AppData\Local\Temp\6D3C.tmp"72⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\6DD8.tmp"C:\Users\Admin\AppData\Local\Temp\6DD8.tmp"73⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\6F01.tmp"C:\Users\Admin\AppData\Local\Temp\6F01.tmp"74⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\6F7E.tmp"C:\Users\Admin\AppData\Local\Temp\6F7E.tmp"75⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\7059.tmp"C:\Users\Admin\AppData\Local\Temp\7059.tmp"76⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\7162.tmp"C:\Users\Admin\AppData\Local\Temp\7162.tmp"77⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\71EF.tmp"C:\Users\Admin\AppData\Local\Temp\71EF.tmp"78⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\727C.tmp"C:\Users\Admin\AppData\Local\Temp\727C.tmp"79⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\73C4.tmp"C:\Users\Admin\AppData\Local\Temp\73C4.tmp"80⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\7431.tmp"C:\Users\Admin\AppData\Local\Temp\7431.tmp"81⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\74AE.tmp"C:\Users\Admin\AppData\Local\Temp\74AE.tmp"82⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\7589.tmp"C:\Users\Admin\AppData\Local\Temp\7589.tmp"83⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\7644.tmp"C:\Users\Admin\AppData\Local\Temp\7644.tmp"84⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\76C1.tmp"C:\Users\Admin\AppData\Local\Temp\76C1.tmp"85⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\774E.tmp"C:\Users\Admin\AppData\Local\Temp\774E.tmp"86⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\77EA.tmp"C:\Users\Admin\AppData\Local\Temp\77EA.tmp"87⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\7886.tmp"C:\Users\Admin\AppData\Local\Temp\7886.tmp"88⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\7A0D.tmp"C:\Users\Admin\AppData\Local\Temp\7A0D.tmp"89⤵PID:420
-
C:\Users\Admin\AppData\Local\Temp\7A9A.tmp"C:\Users\Admin\AppData\Local\Temp\7A9A.tmp"90⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\7B46.tmp"C:\Users\Admin\AppData\Local\Temp\7B46.tmp"91⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\7BB3.tmp"C:\Users\Admin\AppData\Local\Temp\7BB3.tmp"92⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\7C4F.tmp"C:\Users\Admin\AppData\Local\Temp\7C4F.tmp"93⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\7CDC.tmp"C:\Users\Admin\AppData\Local\Temp\7CDC.tmp"94⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\7E91.tmp"C:\Users\Admin\AppData\Local\Temp\7E91.tmp"95⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\7F0E.tmp"C:\Users\Admin\AppData\Local\Temp\7F0E.tmp"96⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\7FD9.tmp"C:\Users\Admin\AppData\Local\Temp\7FD9.tmp"97⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\8056.tmp"C:\Users\Admin\AppData\Local\Temp\8056.tmp"98⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\80F3.tmp"C:\Users\Admin\AppData\Local\Temp\80F3.tmp"99⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\8170.tmp"C:\Users\Admin\AppData\Local\Temp\8170.tmp"100⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\82E7.tmp"C:\Users\Admin\AppData\Local\Temp\82E7.tmp"101⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\8364.tmp"C:\Users\Admin\AppData\Local\Temp\8364.tmp"102⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\8400.tmp"C:\Users\Admin\AppData\Local\Temp\8400.tmp"103⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\846D.tmp"C:\Users\Admin\AppData\Local\Temp\846D.tmp"104⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\8613.tmp"C:\Users\Admin\AppData\Local\Temp\8613.tmp"105⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\86AF.tmp"C:\Users\Admin\AppData\Local\Temp\86AF.tmp"106⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\879A.tmp"C:\Users\Admin\AppData\Local\Temp\879A.tmp"107⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\8875.tmp"C:\Users\Admin\AppData\Local\Temp\8875.tmp"108⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\88E2.tmp"C:\Users\Admin\AppData\Local\Temp\88E2.tmp"109⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\896F.tmp"C:\Users\Admin\AppData\Local\Temp\896F.tmp"110⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\8A0B.tmp"C:\Users\Admin\AppData\Local\Temp\8A0B.tmp"111⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\8B72.tmp"C:\Users\Admin\AppData\Local\Temp\8B72.tmp"112⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\8C3D.tmp"C:\Users\Admin\AppData\Local\Temp\8C3D.tmp"113⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\8DC4.tmp"C:\Users\Admin\AppData\Local\Temp\8DC4.tmp"114⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\8E31.tmp"C:\Users\Admin\AppData\Local\Temp\8E31.tmp"115⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\8EAE.tmp"C:\Users\Admin\AppData\Local\Temp\8EAE.tmp"116⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\8F3B.tmp"C:\Users\Admin\AppData\Local\Temp\8F3B.tmp"117⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\90D1.tmp"C:\Users\Admin\AppData\Local\Temp\90D1.tmp"118⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\9277.tmp"C:\Users\Admin\AppData\Local\Temp\9277.tmp"119⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\9313.tmp"C:\Users\Admin\AppData\Local\Temp\9313.tmp"120⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\93CF.tmp"C:\Users\Admin\AppData\Local\Temp\93CF.tmp"121⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\946B.tmp"C:\Users\Admin\AppData\Local\Temp\946B.tmp"122⤵PID:1848
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-