Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
23/10/2023, 17:02
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.2023-09-06_cdc50b0d1e05fe2abd7bcc17b8ece708_mafia_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.2023-09-06_cdc50b0d1e05fe2abd7bcc17b8ece708_mafia_JC.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.2023-09-06_cdc50b0d1e05fe2abd7bcc17b8ece708_mafia_JC.exe
-
Size
486KB
-
MD5
cdc50b0d1e05fe2abd7bcc17b8ece708
-
SHA1
dc968f9cd9e44f4e61f425481af6a4988cf7d8c8
-
SHA256
a1c11dc0c6bb96b8279beeac05252d46f2b2512f06c6360e603688ab0258c253
-
SHA512
c7d88a5499a80a5412be974ae19e9b1a2aae59a9331646dcb81b2b0a4629046ce11d6c0fa52e29b3e6ca978bf9cbe05811d08f1a3875d92cd2e014f9ff526470
-
SSDEEP
12288:UU5rCOTeiDRXahPjpR673LlMLDDlxmNZ:UUQOJD5MibLlMnDGN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4136 70EA.tmp 4048 71D4.tmp 1156 7251.tmp 820 72FD.tmp 564 73D8.tmp 3900 7474.tmp 1496 7501.tmp 3104 759D.tmp 528 76B6.tmp 1864 7743.tmp 5016 77C0.tmp 1904 782D.tmp 452 78AA.tmp 3688 7908.tmp 2532 7976.tmp 208 79D3.tmp 4992 7A50.tmp 2816 7AED.tmp 4996 7B79.tmp 668 7C35.tmp 4080 7CF0.tmp 4256 7D8C.tmp 3448 7E58.tmp 4620 7EC5.tmp 5044 7F61.tmp 3308 7FFD.tmp 2268 80B9.tmp 3416 8184.tmp 1732 8230.tmp 4036 82BD.tmp 2704 833A.tmp 848 83F5.tmp 2140 8482.tmp 2572 84FF.tmp 4736 857C.tmp 4912 8695.tmp 4408 8712.tmp 5092 877F.tmp 4632 87FC.tmp 4776 8879.tmp 1148 88E7.tmp 4012 8954.tmp 3116 89C1.tmp 3388 8A5E.tmp 4584 8AEA.tmp 3952 8BB5.tmp 1344 8C32.tmp 5028 8CAF.tmp 1832 8D3C.tmp 2916 8D9A.tmp 2436 8E17.tmp 4336 8E94.tmp 4368 8F11.tmp 2588 8F7E.tmp 3588 8FEC.tmp 492 9059.tmp 912 90C6.tmp 1672 9134.tmp 3544 91C0.tmp 4796 923D.tmp 2300 92BA.tmp 1492 9337.tmp 1904 93A5.tmp 3804 9422.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2948 wrote to memory of 4136 2948 NEAS.2023-09-06_cdc50b0d1e05fe2abd7bcc17b8ece708_mafia_JC.exe 88 PID 2948 wrote to memory of 4136 2948 NEAS.2023-09-06_cdc50b0d1e05fe2abd7bcc17b8ece708_mafia_JC.exe 88 PID 2948 wrote to memory of 4136 2948 NEAS.2023-09-06_cdc50b0d1e05fe2abd7bcc17b8ece708_mafia_JC.exe 88 PID 4136 wrote to memory of 4048 4136 70EA.tmp 89 PID 4136 wrote to memory of 4048 4136 70EA.tmp 89 PID 4136 wrote to memory of 4048 4136 70EA.tmp 89 PID 4048 wrote to memory of 1156 4048 71D4.tmp 90 PID 4048 wrote to memory of 1156 4048 71D4.tmp 90 PID 4048 wrote to memory of 1156 4048 71D4.tmp 90 PID 1156 wrote to memory of 820 1156 7251.tmp 91 PID 1156 wrote to memory of 820 1156 7251.tmp 91 PID 1156 wrote to memory of 820 1156 7251.tmp 91 PID 820 wrote to memory of 564 820 72FD.tmp 92 PID 820 wrote to memory of 564 820 72FD.tmp 92 PID 820 wrote to memory of 564 820 72FD.tmp 92 PID 564 wrote to memory of 3900 564 73D8.tmp 93 PID 564 wrote to memory of 3900 564 73D8.tmp 93 PID 564 wrote to memory of 3900 564 73D8.tmp 93 PID 3900 wrote to memory of 1496 3900 7474.tmp 94 PID 3900 wrote to memory of 1496 3900 7474.tmp 94 PID 3900 wrote to memory of 1496 3900 7474.tmp 94 PID 1496 wrote to memory of 3104 1496 7501.tmp 95 PID 1496 wrote to memory of 3104 1496 7501.tmp 95 PID 1496 wrote to memory of 3104 1496 7501.tmp 95 PID 3104 wrote to memory of 528 3104 759D.tmp 96 PID 3104 wrote to memory of 528 3104 759D.tmp 96 PID 3104 wrote to memory of 528 3104 759D.tmp 96 PID 528 wrote to memory of 1864 528 76B6.tmp 97 PID 528 wrote to memory of 1864 528 76B6.tmp 97 PID 528 wrote to memory of 1864 528 76B6.tmp 97 PID 1864 wrote to memory of 5016 1864 7743.tmp 98 PID 1864 wrote to memory of 5016 1864 7743.tmp 98 PID 1864 wrote to memory of 5016 1864 7743.tmp 98 PID 5016 wrote to memory of 1904 5016 77C0.tmp 99 PID 5016 wrote to memory of 1904 5016 77C0.tmp 99 PID 5016 wrote to memory of 1904 5016 77C0.tmp 99 PID 1904 wrote to memory of 452 1904 782D.tmp 100 PID 1904 wrote to memory of 452 1904 782D.tmp 100 PID 1904 wrote to memory of 452 1904 782D.tmp 100 PID 452 wrote to memory of 3688 452 78AA.tmp 101 PID 452 wrote to memory of 3688 452 78AA.tmp 101 PID 452 wrote to memory of 3688 452 78AA.tmp 101 PID 3688 wrote to memory of 2532 3688 7908.tmp 102 PID 3688 wrote to memory of 2532 3688 7908.tmp 102 PID 3688 wrote to memory of 2532 3688 7908.tmp 102 PID 2532 wrote to memory of 208 2532 7976.tmp 103 PID 2532 wrote to memory of 208 2532 7976.tmp 103 PID 2532 wrote to memory of 208 2532 7976.tmp 103 PID 208 wrote to memory of 4992 208 79D3.tmp 104 PID 208 wrote to memory of 4992 208 79D3.tmp 104 PID 208 wrote to memory of 4992 208 79D3.tmp 104 PID 4992 wrote to memory of 2816 4992 7A50.tmp 105 PID 4992 wrote to memory of 2816 4992 7A50.tmp 105 PID 4992 wrote to memory of 2816 4992 7A50.tmp 105 PID 2816 wrote to memory of 4996 2816 7AED.tmp 106 PID 2816 wrote to memory of 4996 2816 7AED.tmp 106 PID 2816 wrote to memory of 4996 2816 7AED.tmp 106 PID 4996 wrote to memory of 668 4996 7B79.tmp 107 PID 4996 wrote to memory of 668 4996 7B79.tmp 107 PID 4996 wrote to memory of 668 4996 7B79.tmp 107 PID 668 wrote to memory of 4080 668 7C35.tmp 108 PID 668 wrote to memory of 4080 668 7C35.tmp 108 PID 668 wrote to memory of 4080 668 7C35.tmp 108 PID 4080 wrote to memory of 4256 4080 7CF0.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-06_cdc50b0d1e05fe2abd7bcc17b8ece708_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-06_cdc50b0d1e05fe2abd7bcc17b8ece708_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Users\Admin\AppData\Local\Temp\7743.tmp"C:\Users\Admin\AppData\Local\Temp\7743.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\782D.tmp"C:\Users\Admin\AppData\Local\Temp\782D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\7908.tmp"C:\Users\Admin\AppData\Local\Temp\7908.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\7976.tmp"C:\Users\Admin\AppData\Local\Temp\7976.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\79D3.tmp"C:\Users\Admin\AppData\Local\Temp\79D3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\7A50.tmp"C:\Users\Admin\AppData\Local\Temp\7A50.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\7AED.tmp"C:\Users\Admin\AppData\Local\Temp\7AED.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\7B79.tmp"C:\Users\Admin\AppData\Local\Temp\7B79.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\7C35.tmp"C:\Users\Admin\AppData\Local\Temp\7C35.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"23⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"24⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"25⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\7F61.tmp"C:\Users\Admin\AppData\Local\Temp\7F61.tmp"26⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"27⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\80B9.tmp"C:\Users\Admin\AppData\Local\Temp\80B9.tmp"28⤵
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\8184.tmp"C:\Users\Admin\AppData\Local\Temp\8184.tmp"29⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\8230.tmp"C:\Users\Admin\AppData\Local\Temp\8230.tmp"30⤵
- Executes dropped EXE
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\82BD.tmp"C:\Users\Admin\AppData\Local\Temp\82BD.tmp"31⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\833A.tmp"C:\Users\Admin\AppData\Local\Temp\833A.tmp"32⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\83F5.tmp"C:\Users\Admin\AppData\Local\Temp\83F5.tmp"33⤵
- Executes dropped EXE
PID:848 -
C:\Users\Admin\AppData\Local\Temp\8482.tmp"C:\Users\Admin\AppData\Local\Temp\8482.tmp"34⤵
- Executes dropped EXE
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\84FF.tmp"C:\Users\Admin\AppData\Local\Temp\84FF.tmp"35⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\857C.tmp"C:\Users\Admin\AppData\Local\Temp\857C.tmp"36⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\8695.tmp"C:\Users\Admin\AppData\Local\Temp\8695.tmp"37⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\8712.tmp"C:\Users\Admin\AppData\Local\Temp\8712.tmp"38⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\877F.tmp"C:\Users\Admin\AppData\Local\Temp\877F.tmp"39⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\87FC.tmp"C:\Users\Admin\AppData\Local\Temp\87FC.tmp"40⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\8879.tmp"C:\Users\Admin\AppData\Local\Temp\8879.tmp"41⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\88E7.tmp"C:\Users\Admin\AppData\Local\Temp\88E7.tmp"42⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\8954.tmp"C:\Users\Admin\AppData\Local\Temp\8954.tmp"43⤵
- Executes dropped EXE
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\89C1.tmp"C:\Users\Admin\AppData\Local\Temp\89C1.tmp"44⤵
- Executes dropped EXE
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"45⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"46⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"47⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\8C32.tmp"C:\Users\Admin\AppData\Local\Temp\8C32.tmp"48⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"49⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"50⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"51⤵
- Executes dropped EXE
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\8E17.tmp"C:\Users\Admin\AppData\Local\Temp\8E17.tmp"52⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\8E94.tmp"C:\Users\Admin\AppData\Local\Temp\8E94.tmp"53⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"54⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"55⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"56⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"57⤵
- Executes dropped EXE
PID:492 -
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"58⤵
- Executes dropped EXE
PID:912 -
C:\Users\Admin\AppData\Local\Temp\9134.tmp"C:\Users\Admin\AppData\Local\Temp\9134.tmp"59⤵
- Executes dropped EXE
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\91C0.tmp"C:\Users\Admin\AppData\Local\Temp\91C0.tmp"60⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\923D.tmp"C:\Users\Admin\AppData\Local\Temp\923D.tmp"61⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"62⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\9337.tmp"C:\Users\Admin\AppData\Local\Temp\9337.tmp"63⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\93A5.tmp"C:\Users\Admin\AppData\Local\Temp\93A5.tmp"64⤵
- Executes dropped EXE
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\9422.tmp"C:\Users\Admin\AppData\Local\Temp\9422.tmp"65⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\94AE.tmp"C:\Users\Admin\AppData\Local\Temp\94AE.tmp"66⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"67⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\95B8.tmp"C:\Users\Admin\AppData\Local\Temp\95B8.tmp"68⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"69⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\96D1.tmp"C:\Users\Admin\AppData\Local\Temp\96D1.tmp"70⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"71⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\97CB.tmp"C:\Users\Admin\AppData\Local\Temp\97CB.tmp"72⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\9848.tmp"C:\Users\Admin\AppData\Local\Temp\9848.tmp"73⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\98D5.tmp"C:\Users\Admin\AppData\Local\Temp\98D5.tmp"74⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\9952.tmp"C:\Users\Admin\AppData\Local\Temp\9952.tmp"75⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"76⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"77⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"78⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"79⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"80⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"81⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"82⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"83⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"84⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"85⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"86⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"87⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"88⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\A112.tmp"C:\Users\Admin\AppData\Local\Temp\A112.tmp"89⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\A18F.tmp"C:\Users\Admin\AppData\Local\Temp\A18F.tmp"90⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\A20C.tmp"C:\Users\Admin\AppData\Local\Temp\A20C.tmp"91⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"92⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"93⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\A374.tmp"C:\Users\Admin\AppData\Local\Temp\A374.tmp"94⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"95⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"96⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"97⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"98⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"99⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\A671.tmp"C:\Users\Admin\AppData\Local\Temp\A671.tmp"100⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"101⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"102⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"103⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"104⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"105⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\A940.tmp"C:\Users\Admin\AppData\Local\Temp\A940.tmp"106⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"107⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\AA59.tmp"C:\Users\Admin\AppData\Local\Temp\AA59.tmp"108⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"109⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\AB44.tmp"C:\Users\Admin\AppData\Local\Temp\AB44.tmp"110⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"111⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"112⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"113⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\AD09.tmp"C:\Users\Admin\AppData\Local\Temp\AD09.tmp"114⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\AD76.tmp"C:\Users\Admin\AppData\Local\Temp\AD76.tmp"115⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"116⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\AE70.tmp"C:\Users\Admin\AppData\Local\Temp\AE70.tmp"117⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"118⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"119⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"120⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\B074.tmp"C:\Users\Admin\AppData\Local\Temp\B074.tmp"121⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\B100.tmp"C:\Users\Admin\AppData\Local\Temp\B100.tmp"122⤵PID:528
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-