Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
23/10/2023, 16:00
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.2023-09-05_9624e9946536d0bd82f74a9b4947ea8b_mafia_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.2023-09-05_9624e9946536d0bd82f74a9b4947ea8b_mafia_JC.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.2023-09-05_9624e9946536d0bd82f74a9b4947ea8b_mafia_JC.exe
-
Size
486KB
-
MD5
9624e9946536d0bd82f74a9b4947ea8b
-
SHA1
8d4ac55f8c8d218a1c6c3d7f86aeafae5705a7bf
-
SHA256
d992f6ff3a311138874e5c5f27718ac2dffe8eadbb8b5994dceb0b09f8e86842
-
SHA512
30af76d4ae9be0906f702686587514f62f59de7b356c887aaed0fe9e1bd0db48b106ea4f5f85790d3c07f08e48647b02eddad6afc1f3c3c28a78a98942c34bfa
-
SSDEEP
12288:/U5rCOTeiDQId4kX0aaaPT2zzK23Oa8NZ:/UQOJDtz0avmzPO5N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1068 B92E.tmp 2288 B9AB.tmp 2480 BA57.tmp 3440 BB41.tmp 916 BBFD.tmp 1184 BC89.tmp 764 BD55.tmp 3656 BDE1.tmp 1204 BE9D.tmp 5088 BF1A.tmp 4052 BFC6.tmp 3900 C033.tmp 544 C0B0.tmp 4824 C12D.tmp 5028 C1E8.tmp 376 C2B4.tmp 3432 C35F.tmp 2404 C3DC.tmp 3176 C4B7.tmp 1008 C534.tmp 4064 C5C1.tmp 744 C66D.tmp 4432 C6EA.tmp 1664 C776.tmp 4848 C7F3.tmp 4924 C8DE.tmp 812 C999.tmp 4380 CA64.tmp 1412 CB10.tmp 1348 CBDB.tmp 1484 CC97.tmp 2972 CD72.tmp 1628 CE4C.tmp 5084 CED9.tmp 4320 CF46.tmp 2236 CFD3.tmp 1972 D06F.tmp 4400 D10B.tmp 2760 D198.tmp 3160 D273.tmp 4544 D30F.tmp 1068 D3AB.tmp 1428 D438.tmp 4864 D4E4.tmp 3464 D570.tmp 4928 D5FD.tmp 2260 D6A9.tmp 4588 D736.tmp 756 D7A3.tmp 2176 D84F.tmp 4508 D8EB.tmp 4436 D968.tmp 4488 DA14.tmp 1228 DAA1.tmp 1568 DB2D.tmp 2764 DBC9.tmp 3592 DC66.tmp 3248 DD02.tmp 4052 DD8F.tmp 2884 DE2B.tmp 4620 DEA8.tmp 4340 DF44.tmp 868 DFE0.tmp 1292 E05D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4776 wrote to memory of 1068 4776 NEAS.2023-09-05_9624e9946536d0bd82f74a9b4947ea8b_mafia_JC.exe 87 PID 4776 wrote to memory of 1068 4776 NEAS.2023-09-05_9624e9946536d0bd82f74a9b4947ea8b_mafia_JC.exe 87 PID 4776 wrote to memory of 1068 4776 NEAS.2023-09-05_9624e9946536d0bd82f74a9b4947ea8b_mafia_JC.exe 87 PID 1068 wrote to memory of 2288 1068 B92E.tmp 88 PID 1068 wrote to memory of 2288 1068 B92E.tmp 88 PID 1068 wrote to memory of 2288 1068 B92E.tmp 88 PID 2288 wrote to memory of 2480 2288 B9AB.tmp 90 PID 2288 wrote to memory of 2480 2288 B9AB.tmp 90 PID 2288 wrote to memory of 2480 2288 B9AB.tmp 90 PID 2480 wrote to memory of 3440 2480 BA57.tmp 91 PID 2480 wrote to memory of 3440 2480 BA57.tmp 91 PID 2480 wrote to memory of 3440 2480 BA57.tmp 91 PID 3440 wrote to memory of 916 3440 BB41.tmp 93 PID 3440 wrote to memory of 916 3440 BB41.tmp 93 PID 3440 wrote to memory of 916 3440 BB41.tmp 93 PID 916 wrote to memory of 1184 916 BBFD.tmp 94 PID 916 wrote to memory of 1184 916 BBFD.tmp 94 PID 916 wrote to memory of 1184 916 BBFD.tmp 94 PID 1184 wrote to memory of 764 1184 BC89.tmp 96 PID 1184 wrote to memory of 764 1184 BC89.tmp 96 PID 1184 wrote to memory of 764 1184 BC89.tmp 96 PID 764 wrote to memory of 3656 764 BD55.tmp 97 PID 764 wrote to memory of 3656 764 BD55.tmp 97 PID 764 wrote to memory of 3656 764 BD55.tmp 97 PID 3656 wrote to memory of 1204 3656 BDE1.tmp 98 PID 3656 wrote to memory of 1204 3656 BDE1.tmp 98 PID 3656 wrote to memory of 1204 3656 BDE1.tmp 98 PID 1204 wrote to memory of 5088 1204 BE9D.tmp 99 PID 1204 wrote to memory of 5088 1204 BE9D.tmp 99 PID 1204 wrote to memory of 5088 1204 BE9D.tmp 99 PID 5088 wrote to memory of 4052 5088 BF1A.tmp 100 PID 5088 wrote to memory of 4052 5088 BF1A.tmp 100 PID 5088 wrote to memory of 4052 5088 BF1A.tmp 100 PID 4052 wrote to memory of 3900 4052 BFC6.tmp 101 PID 4052 wrote to memory of 3900 4052 BFC6.tmp 101 PID 4052 wrote to memory of 3900 4052 BFC6.tmp 101 PID 3900 wrote to memory of 544 3900 C033.tmp 102 PID 3900 wrote to memory of 544 3900 C033.tmp 102 PID 3900 wrote to memory of 544 3900 C033.tmp 102 PID 544 wrote to memory of 4824 544 C0B0.tmp 103 PID 544 wrote to memory of 4824 544 C0B0.tmp 103 PID 544 wrote to memory of 4824 544 C0B0.tmp 103 PID 4824 wrote to memory of 5028 4824 C12D.tmp 104 PID 4824 wrote to memory of 5028 4824 C12D.tmp 104 PID 4824 wrote to memory of 5028 4824 C12D.tmp 104 PID 5028 wrote to memory of 376 5028 C1E8.tmp 105 PID 5028 wrote to memory of 376 5028 C1E8.tmp 105 PID 5028 wrote to memory of 376 5028 C1E8.tmp 105 PID 376 wrote to memory of 3432 376 C2B4.tmp 106 PID 376 wrote to memory of 3432 376 C2B4.tmp 106 PID 376 wrote to memory of 3432 376 C2B4.tmp 106 PID 3432 wrote to memory of 2404 3432 C35F.tmp 108 PID 3432 wrote to memory of 2404 3432 C35F.tmp 108 PID 3432 wrote to memory of 2404 3432 C35F.tmp 108 PID 2404 wrote to memory of 3176 2404 C3DC.tmp 109 PID 2404 wrote to memory of 3176 2404 C3DC.tmp 109 PID 2404 wrote to memory of 3176 2404 C3DC.tmp 109 PID 3176 wrote to memory of 1008 3176 C4B7.tmp 110 PID 3176 wrote to memory of 1008 3176 C4B7.tmp 110 PID 3176 wrote to memory of 1008 3176 C4B7.tmp 110 PID 1008 wrote to memory of 4064 1008 C534.tmp 111 PID 1008 wrote to memory of 4064 1008 C534.tmp 111 PID 1008 wrote to memory of 4064 1008 C534.tmp 111 PID 4064 wrote to memory of 744 4064 C5C1.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-05_9624e9946536d0bd82f74a9b4947ea8b_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-05_9624e9946536d0bd82f74a9b4947ea8b_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\BA57.tmp"C:\Users\Admin\AppData\Local\Temp\BA57.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\BB41.tmp"C:\Users\Admin\AppData\Local\Temp\BB41.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\BC89.tmp"C:\Users\Admin\AppData\Local\Temp\BC89.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\BD55.tmp"C:\Users\Admin\AppData\Local\Temp\BD55.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Users\Admin\AppData\Local\Temp\C35F.tmp"C:\Users\Admin\AppData\Local\Temp\C35F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\C3DC.tmp"C:\Users\Admin\AppData\Local\Temp\C3DC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\C534.tmp"C:\Users\Admin\AppData\Local\Temp\C534.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\C66D.tmp"C:\Users\Admin\AppData\Local\Temp\C66D.tmp"23⤵
- Executes dropped EXE
PID:744 -
C:\Users\Admin\AppData\Local\Temp\C6EA.tmp"C:\Users\Admin\AppData\Local\Temp\C6EA.tmp"24⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\C776.tmp"C:\Users\Admin\AppData\Local\Temp\C776.tmp"25⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"26⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"27⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\C999.tmp"C:\Users\Admin\AppData\Local\Temp\C999.tmp"28⤵
- Executes dropped EXE
PID:812 -
C:\Users\Admin\AppData\Local\Temp\CA64.tmp"C:\Users\Admin\AppData\Local\Temp\CA64.tmp"29⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\CB10.tmp"C:\Users\Admin\AppData\Local\Temp\CB10.tmp"30⤵
- Executes dropped EXE
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"31⤵
- Executes dropped EXE
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\CC97.tmp"C:\Users\Admin\AppData\Local\Temp\CC97.tmp"32⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\CD72.tmp"C:\Users\Admin\AppData\Local\Temp\CD72.tmp"33⤵
- Executes dropped EXE
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"34⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\CED9.tmp"C:\Users\Admin\AppData\Local\Temp\CED9.tmp"35⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\CF46.tmp"C:\Users\Admin\AppData\Local\Temp\CF46.tmp"36⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"37⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\D06F.tmp"C:\Users\Admin\AppData\Local\Temp\D06F.tmp"38⤵
- Executes dropped EXE
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\D10B.tmp"C:\Users\Admin\AppData\Local\Temp\D10B.tmp"39⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\D198.tmp"C:\Users\Admin\AppData\Local\Temp\D198.tmp"40⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\D273.tmp"C:\Users\Admin\AppData\Local\Temp\D273.tmp"41⤵
- Executes dropped EXE
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\D30F.tmp"C:\Users\Admin\AppData\Local\Temp\D30F.tmp"42⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"43⤵
- Executes dropped EXE
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\D438.tmp"C:\Users\Admin\AppData\Local\Temp\D438.tmp"44⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"45⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\D570.tmp"C:\Users\Admin\AppData\Local\Temp\D570.tmp"46⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\D5FD.tmp"C:\Users\Admin\AppData\Local\Temp\D5FD.tmp"47⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\D6A9.tmp"C:\Users\Admin\AppData\Local\Temp\D6A9.tmp"48⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\D736.tmp"C:\Users\Admin\AppData\Local\Temp\D736.tmp"49⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\D7A3.tmp"C:\Users\Admin\AppData\Local\Temp\D7A3.tmp"50⤵
- Executes dropped EXE
PID:756 -
C:\Users\Admin\AppData\Local\Temp\D84F.tmp"C:\Users\Admin\AppData\Local\Temp\D84F.tmp"51⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"52⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\D968.tmp"C:\Users\Admin\AppData\Local\Temp\D968.tmp"53⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\DA14.tmp"C:\Users\Admin\AppData\Local\Temp\DA14.tmp"54⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\DAA1.tmp"C:\Users\Admin\AppData\Local\Temp\DAA1.tmp"55⤵
- Executes dropped EXE
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\DB2D.tmp"C:\Users\Admin\AppData\Local\Temp\DB2D.tmp"56⤵
- Executes dropped EXE
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"57⤵
- Executes dropped EXE
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\DC66.tmp"C:\Users\Admin\AppData\Local\Temp\DC66.tmp"58⤵
- Executes dropped EXE
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\DD02.tmp"C:\Users\Admin\AppData\Local\Temp\DD02.tmp"59⤵
- Executes dropped EXE
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\DD8F.tmp"C:\Users\Admin\AppData\Local\Temp\DD8F.tmp"60⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\DE2B.tmp"C:\Users\Admin\AppData\Local\Temp\DE2B.tmp"61⤵
- Executes dropped EXE
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"62⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\DF44.tmp"C:\Users\Admin\AppData\Local\Temp\DF44.tmp"63⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\DFE0.tmp"C:\Users\Admin\AppData\Local\Temp\DFE0.tmp"64⤵
- Executes dropped EXE
PID:868 -
C:\Users\Admin\AppData\Local\Temp\E05D.tmp"C:\Users\Admin\AppData\Local\Temp\E05D.tmp"65⤵
- Executes dropped EXE
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"66⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\E167.tmp"C:\Users\Admin\AppData\Local\Temp\E167.tmp"67⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\E213.tmp"C:\Users\Admin\AppData\Local\Temp\E213.tmp"68⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\E290.tmp"C:\Users\Admin\AppData\Local\Temp\E290.tmp"69⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\E30D.tmp"C:\Users\Admin\AppData\Local\Temp\E30D.tmp"70⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\E399.tmp"C:\Users\Admin\AppData\Local\Temp\E399.tmp"71⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\E426.tmp"C:\Users\Admin\AppData\Local\Temp\E426.tmp"72⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"73⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\E530.tmp"C:\Users\Admin\AppData\Local\Temp\E530.tmp"74⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"75⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\E649.tmp"C:\Users\Admin\AppData\Local\Temp\E649.tmp"76⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"77⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\E733.tmp"C:\Users\Admin\AppData\Local\Temp\E733.tmp"78⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"79⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\E85C.tmp"C:\Users\Admin\AppData\Local\Temp\E85C.tmp"80⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"81⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\E956.tmp"C:\Users\Admin\AppData\Local\Temp\E956.tmp"82⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"83⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\EA60.tmp"C:\Users\Admin\AppData\Local\Temp\EA60.tmp"84⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\EABE.tmp"C:\Users\Admin\AppData\Local\Temp\EABE.tmp"85⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\EB3B.tmp"C:\Users\Admin\AppData\Local\Temp\EB3B.tmp"86⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"87⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\EC44.tmp"C:\Users\Admin\AppData\Local\Temp\EC44.tmp"88⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"89⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\ED4E.tmp"C:\Users\Admin\AppData\Local\Temp\ED4E.tmp"90⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\EDCB.tmp"C:\Users\Admin\AppData\Local\Temp\EDCB.tmp"91⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\EE96.tmp"C:\Users\Admin\AppData\Local\Temp\EE96.tmp"92⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\EF13.tmp"C:\Users\Admin\AppData\Local\Temp\EF13.tmp"93⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\EFBF.tmp"C:\Users\Admin\AppData\Local\Temp\EFBF.tmp"94⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\F04B.tmp"C:\Users\Admin\AppData\Local\Temp\F04B.tmp"95⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"96⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\F155.tmp"C:\Users\Admin\AppData\Local\Temp\F155.tmp"97⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\F1D2.tmp"C:\Users\Admin\AppData\Local\Temp\F1D2.tmp"98⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\F25F.tmp"C:\Users\Admin\AppData\Local\Temp\F25F.tmp"99⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\F2CC.tmp"C:\Users\Admin\AppData\Local\Temp\F2CC.tmp"100⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\F349.tmp"C:\Users\Admin\AppData\Local\Temp\F349.tmp"101⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\F3E5.tmp"C:\Users\Admin\AppData\Local\Temp\F3E5.tmp"102⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\F462.tmp"C:\Users\Admin\AppData\Local\Temp\F462.tmp"103⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\F4EF.tmp"C:\Users\Admin\AppData\Local\Temp\F4EF.tmp"104⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\F57C.tmp"C:\Users\Admin\AppData\Local\Temp\F57C.tmp"105⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\F608.tmp"C:\Users\Admin\AppData\Local\Temp\F608.tmp"106⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\F666.tmp"C:\Users\Admin\AppData\Local\Temp\F666.tmp"107⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"108⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\F750.tmp"C:\Users\Admin\AppData\Local\Temp\F750.tmp"109⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\F7BE.tmp"C:\Users\Admin\AppData\Local\Temp\F7BE.tmp"110⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\F82B.tmp"C:\Users\Admin\AppData\Local\Temp\F82B.tmp"111⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"112⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\F944.tmp"C:\Users\Admin\AppData\Local\Temp\F944.tmp"113⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"114⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"115⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"116⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\FB67.tmp"C:\Users\Admin\AppData\Local\Temp\FB67.tmp"117⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"118⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\FC71.tmp"C:\Users\Admin\AppData\Local\Temp\FC71.tmp"119⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"120⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\FD6B.tmp"C:\Users\Admin\AppData\Local\Temp\FD6B.tmp"121⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"122⤵PID:2884
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-