Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
23/10/2023, 17:49
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.2023-09-06_7f97e44e65afde9641b5e66b6d75f06c_mafia_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.2023-09-06_7f97e44e65afde9641b5e66b6d75f06c_mafia_JC.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.2023-09-06_7f97e44e65afde9641b5e66b6d75f06c_mafia_JC.exe
-
Size
520KB
-
MD5
7f97e44e65afde9641b5e66b6d75f06c
-
SHA1
bc3f8fc1ec0b863ec387330de29f2e2c8564a98c
-
SHA256
2f29f969294d7b19437014f0e2217a2bab8d69d2764817f75505c63f1faf13ea
-
SHA512
f7fd4d7b1da9697c3a7f2f2eed2206a106c6dcc8ae43d7e1efcac0da9d1b82a9ac1fcc997b8b1490e00a26e6c489ea0870ec3565f163c31302b62f75f6280f3f
-
SSDEEP
12288:gj8fuxR21t5i8fL4THlYs5hZVOLe1asTNZ:gj8fuK1GYIlYwZVSecsTN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1196 E82D.tmp 4408 E8F8.tmp 4596 E9E3.tmp 1180 EA8F.tmp 1740 EC25.tmp 1696 ED00.tmp 3812 EDAC.tmp 4064 EE38.tmp 1280 EEE4.tmp 2228 EFA0.tmp 1764 F06B.tmp 3896 F145.tmp 1456 F220.tmp 2928 F5E9.tmp 772 F676.tmp 2336 F721.tmp 4540 F7AE.tmp 4552 F85A.tmp 4536 F915.tmp 4584 F9D1.tmp 2428 FA5E.tmp 652 FB09.tmp 4312 FBB5.tmp 4332 FC90.tmp 2300 FD2C.tmp 2716 FDC9.tmp 1392 FE94.tmp 1380 FF5F.tmp 4960 3A.tmp 2576 134.tmp 1732 1EF.tmp 828 29B.tmp 3224 356.tmp 4612 460.tmp 4716 4DD.tmp 4092 56A.tmp 2472 616.tmp 4040 6B2.tmp 520 74E.tmp 4816 7DB.tmp 3764 877.tmp 4624 8F4.tmp 4468 961.tmp 4768 9DE.tmp 2240 A8A.tmp 3588 B17.tmp 4452 BB3.tmp 3872 C4F.tmp 1160 CCC.tmp 2216 D59.tmp 3208 E05.tmp 1360 F0E.tmp 1200 FBA.tmp 1012 1047.tmp 3428 10E3.tmp 4060 1170.tmp 4252 120C.tmp 664 1299.tmp 948 1335.tmp 4140 13D1.tmp 3616 149C.tmp 2156 1519.tmp 1740 15C5.tmp 4748 1661.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2728 wrote to memory of 1196 2728 NEAS.2023-09-06_7f97e44e65afde9641b5e66b6d75f06c_mafia_JC.exe 84 PID 2728 wrote to memory of 1196 2728 NEAS.2023-09-06_7f97e44e65afde9641b5e66b6d75f06c_mafia_JC.exe 84 PID 2728 wrote to memory of 1196 2728 NEAS.2023-09-06_7f97e44e65afde9641b5e66b6d75f06c_mafia_JC.exe 84 PID 1196 wrote to memory of 4408 1196 E82D.tmp 85 PID 1196 wrote to memory of 4408 1196 E82D.tmp 85 PID 1196 wrote to memory of 4408 1196 E82D.tmp 85 PID 4408 wrote to memory of 4596 4408 E8F8.tmp 87 PID 4408 wrote to memory of 4596 4408 E8F8.tmp 87 PID 4408 wrote to memory of 4596 4408 E8F8.tmp 87 PID 4596 wrote to memory of 1180 4596 E9E3.tmp 88 PID 4596 wrote to memory of 1180 4596 E9E3.tmp 88 PID 4596 wrote to memory of 1180 4596 E9E3.tmp 88 PID 1180 wrote to memory of 1740 1180 EA8F.tmp 90 PID 1180 wrote to memory of 1740 1180 EA8F.tmp 90 PID 1180 wrote to memory of 1740 1180 EA8F.tmp 90 PID 1740 wrote to memory of 1696 1740 EC25.tmp 91 PID 1740 wrote to memory of 1696 1740 EC25.tmp 91 PID 1740 wrote to memory of 1696 1740 EC25.tmp 91 PID 1696 wrote to memory of 3812 1696 ED00.tmp 92 PID 1696 wrote to memory of 3812 1696 ED00.tmp 92 PID 1696 wrote to memory of 3812 1696 ED00.tmp 92 PID 3812 wrote to memory of 4064 3812 EDAC.tmp 93 PID 3812 wrote to memory of 4064 3812 EDAC.tmp 93 PID 3812 wrote to memory of 4064 3812 EDAC.tmp 93 PID 4064 wrote to memory of 1280 4064 EE38.tmp 94 PID 4064 wrote to memory of 1280 4064 EE38.tmp 94 PID 4064 wrote to memory of 1280 4064 EE38.tmp 94 PID 1280 wrote to memory of 2228 1280 EEE4.tmp 95 PID 1280 wrote to memory of 2228 1280 EEE4.tmp 95 PID 1280 wrote to memory of 2228 1280 EEE4.tmp 95 PID 2228 wrote to memory of 1764 2228 EFA0.tmp 96 PID 2228 wrote to memory of 1764 2228 EFA0.tmp 96 PID 2228 wrote to memory of 1764 2228 EFA0.tmp 96 PID 1764 wrote to memory of 3896 1764 F06B.tmp 97 PID 1764 wrote to memory of 3896 1764 F06B.tmp 97 PID 1764 wrote to memory of 3896 1764 F06B.tmp 97 PID 3896 wrote to memory of 1456 3896 F145.tmp 98 PID 3896 wrote to memory of 1456 3896 F145.tmp 98 PID 3896 wrote to memory of 1456 3896 F145.tmp 98 PID 1456 wrote to memory of 2928 1456 F220.tmp 99 PID 1456 wrote to memory of 2928 1456 F220.tmp 99 PID 1456 wrote to memory of 2928 1456 F220.tmp 99 PID 2928 wrote to memory of 772 2928 F5E9.tmp 100 PID 2928 wrote to memory of 772 2928 F5E9.tmp 100 PID 2928 wrote to memory of 772 2928 F5E9.tmp 100 PID 772 wrote to memory of 2336 772 F676.tmp 101 PID 772 wrote to memory of 2336 772 F676.tmp 101 PID 772 wrote to memory of 2336 772 F676.tmp 101 PID 2336 wrote to memory of 4540 2336 F721.tmp 102 PID 2336 wrote to memory of 4540 2336 F721.tmp 102 PID 2336 wrote to memory of 4540 2336 F721.tmp 102 PID 4540 wrote to memory of 4552 4540 F7AE.tmp 103 PID 4540 wrote to memory of 4552 4540 F7AE.tmp 103 PID 4540 wrote to memory of 4552 4540 F7AE.tmp 103 PID 4552 wrote to memory of 4536 4552 F85A.tmp 104 PID 4552 wrote to memory of 4536 4552 F85A.tmp 104 PID 4552 wrote to memory of 4536 4552 F85A.tmp 104 PID 4536 wrote to memory of 4584 4536 F915.tmp 105 PID 4536 wrote to memory of 4584 4536 F915.tmp 105 PID 4536 wrote to memory of 4584 4536 F915.tmp 105 PID 4584 wrote to memory of 2428 4584 F9D1.tmp 106 PID 4584 wrote to memory of 2428 4584 F9D1.tmp 106 PID 4584 wrote to memory of 2428 4584 F9D1.tmp 106 PID 2428 wrote to memory of 652 2428 FA5E.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-06_7f97e44e65afde9641b5e66b6d75f06c_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-06_7f97e44e65afde9641b5e66b6d75f06c_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\E82D.tmp"C:\Users\Admin\AppData\Local\Temp\E82D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\E9E3.tmp"C:\Users\Admin\AppData\Local\Temp\E9E3.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\EA8F.tmp"C:\Users\Admin\AppData\Local\Temp\EA8F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\EC25.tmp"C:\Users\Admin\AppData\Local\Temp\EC25.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\ED00.tmp"C:\Users\Admin\AppData\Local\Temp\ED00.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\EDAC.tmp"C:\Users\Admin\AppData\Local\Temp\EDAC.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\EE38.tmp"C:\Users\Admin\AppData\Local\Temp\EE38.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\EFA0.tmp"C:\Users\Admin\AppData\Local\Temp\EFA0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\F06B.tmp"C:\Users\Admin\AppData\Local\Temp\F06B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\F145.tmp"C:\Users\Admin\AppData\Local\Temp\F145.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\F220.tmp"C:\Users\Admin\AppData\Local\Temp\F220.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\F5E9.tmp"C:\Users\Admin\AppData\Local\Temp\F5E9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\F676.tmp"C:\Users\Admin\AppData\Local\Temp\F676.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\F721.tmp"C:\Users\Admin\AppData\Local\Temp\F721.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\F7AE.tmp"C:\Users\Admin\AppData\Local\Temp\F7AE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\F85A.tmp"C:\Users\Admin\AppData\Local\Temp\F85A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\F915.tmp"C:\Users\Admin\AppData\Local\Temp\F915.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\FB09.tmp"C:\Users\Admin\AppData\Local\Temp\FB09.tmp"23⤵
- Executes dropped EXE
PID:652 -
C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"24⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\FC90.tmp"C:\Users\Admin\AppData\Local\Temp\FC90.tmp"25⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"26⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"27⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\FE94.tmp"C:\Users\Admin\AppData\Local\Temp\FE94.tmp"28⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\FF5F.tmp"C:\Users\Admin\AppData\Local\Temp\FF5F.tmp"29⤵
- Executes dropped EXE
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A.tmp"30⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\134.tmp"C:\Users\Admin\AppData\Local\Temp\134.tmp"31⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\1EF.tmp"C:\Users\Admin\AppData\Local\Temp\1EF.tmp"32⤵
- Executes dropped EXE
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\29B.tmp"C:\Users\Admin\AppData\Local\Temp\29B.tmp"33⤵
- Executes dropped EXE
PID:828 -
C:\Users\Admin\AppData\Local\Temp\356.tmp"C:\Users\Admin\AppData\Local\Temp\356.tmp"34⤵
- Executes dropped EXE
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\460.tmp"C:\Users\Admin\AppData\Local\Temp\460.tmp"35⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\4DD.tmp"C:\Users\Admin\AppData\Local\Temp\4DD.tmp"36⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\56A.tmp"C:\Users\Admin\AppData\Local\Temp\56A.tmp"37⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\616.tmp"C:\Users\Admin\AppData\Local\Temp\616.tmp"38⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\6B2.tmp"C:\Users\Admin\AppData\Local\Temp\6B2.tmp"39⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\74E.tmp"C:\Users\Admin\AppData\Local\Temp\74E.tmp"40⤵
- Executes dropped EXE
PID:520 -
C:\Users\Admin\AppData\Local\Temp\7DB.tmp"C:\Users\Admin\AppData\Local\Temp\7DB.tmp"41⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\877.tmp"C:\Users\Admin\AppData\Local\Temp\877.tmp"42⤵
- Executes dropped EXE
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\8F4.tmp"C:\Users\Admin\AppData\Local\Temp\8F4.tmp"43⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\961.tmp"C:\Users\Admin\AppData\Local\Temp\961.tmp"44⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\9DE.tmp"C:\Users\Admin\AppData\Local\Temp\9DE.tmp"45⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\A8A.tmp"C:\Users\Admin\AppData\Local\Temp\A8A.tmp"46⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\B17.tmp"C:\Users\Admin\AppData\Local\Temp\B17.tmp"47⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\BB3.tmp"C:\Users\Admin\AppData\Local\Temp\BB3.tmp"48⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\C4F.tmp"C:\Users\Admin\AppData\Local\Temp\C4F.tmp"49⤵
- Executes dropped EXE
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\CCC.tmp"C:\Users\Admin\AppData\Local\Temp\CCC.tmp"50⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\D59.tmp"C:\Users\Admin\AppData\Local\Temp\D59.tmp"51⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\E05.tmp"C:\Users\Admin\AppData\Local\Temp\E05.tmp"52⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\E82.tmp"C:\Users\Admin\AppData\Local\Temp\E82.tmp"53⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\F0E.tmp"C:\Users\Admin\AppData\Local\Temp\F0E.tmp"54⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"55⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\1047.tmp"C:\Users\Admin\AppData\Local\Temp\1047.tmp"56⤵
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\10E3.tmp"C:\Users\Admin\AppData\Local\Temp\10E3.tmp"57⤵
- Executes dropped EXE
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\1170.tmp"C:\Users\Admin\AppData\Local\Temp\1170.tmp"58⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\120C.tmp"C:\Users\Admin\AppData\Local\Temp\120C.tmp"59⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\1299.tmp"C:\Users\Admin\AppData\Local\Temp\1299.tmp"60⤵
- Executes dropped EXE
PID:664 -
C:\Users\Admin\AppData\Local\Temp\1335.tmp"C:\Users\Admin\AppData\Local\Temp\1335.tmp"61⤵
- Executes dropped EXE
PID:948 -
C:\Users\Admin\AppData\Local\Temp\13D1.tmp"C:\Users\Admin\AppData\Local\Temp\13D1.tmp"62⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\149C.tmp"C:\Users\Admin\AppData\Local\Temp\149C.tmp"63⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\1519.tmp"C:\Users\Admin\AppData\Local\Temp\1519.tmp"64⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\15C5.tmp"C:\Users\Admin\AppData\Local\Temp\15C5.tmp"65⤵
- Executes dropped EXE
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\1661.tmp"C:\Users\Admin\AppData\Local\Temp\1661.tmp"66⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\16FE.tmp"C:\Users\Admin\AppData\Local\Temp\16FE.tmp"67⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\178A.tmp"C:\Users\Admin\AppData\Local\Temp\178A.tmp"68⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\1807.tmp"C:\Users\Admin\AppData\Local\Temp\1807.tmp"69⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\18B3.tmp"C:\Users\Admin\AppData\Local\Temp\18B3.tmp"70⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\1940.tmp"C:\Users\Admin\AppData\Local\Temp\1940.tmp"71⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\19DC.tmp"C:\Users\Admin\AppData\Local\Temp\19DC.tmp"72⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\1A69.tmp"C:\Users\Admin\AppData\Local\Temp\1A69.tmp"73⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"74⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\1B82.tmp"C:\Users\Admin\AppData\Local\Temp\1B82.tmp"75⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\1BFF.tmp"C:\Users\Admin\AppData\Local\Temp\1BFF.tmp"76⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\1C7C.tmp"C:\Users\Admin\AppData\Local\Temp\1C7C.tmp"77⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\1CE9.tmp"C:\Users\Admin\AppData\Local\Temp\1CE9.tmp"78⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\1D66.tmp"C:\Users\Admin\AppData\Local\Temp\1D66.tmp"79⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\1DE3.tmp"C:\Users\Admin\AppData\Local\Temp\1DE3.tmp"80⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\1E8F.tmp"C:\Users\Admin\AppData\Local\Temp\1E8F.tmp"81⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\1F2B.tmp"C:\Users\Admin\AppData\Local\Temp\1F2B.tmp"82⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\1FB8.tmp"C:\Users\Admin\AppData\Local\Temp\1FB8.tmp"83⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\2054.tmp"C:\Users\Admin\AppData\Local\Temp\2054.tmp"84⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\20E1.tmp"C:\Users\Admin\AppData\Local\Temp\20E1.tmp"85⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\21BC.tmp"C:\Users\Admin\AppData\Local\Temp\21BC.tmp"86⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\2239.tmp"C:\Users\Admin\AppData\Local\Temp\2239.tmp"87⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\22D5.tmp"C:\Users\Admin\AppData\Local\Temp\22D5.tmp"88⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\2362.tmp"C:\Users\Admin\AppData\Local\Temp\2362.tmp"89⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\23EE.tmp"C:\Users\Admin\AppData\Local\Temp\23EE.tmp"90⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\246B.tmp"C:\Users\Admin\AppData\Local\Temp\246B.tmp"91⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\2507.tmp"C:\Users\Admin\AppData\Local\Temp\2507.tmp"92⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\25F2.tmp"C:\Users\Admin\AppData\Local\Temp\25F2.tmp"93⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\267E.tmp"C:\Users\Admin\AppData\Local\Temp\267E.tmp"94⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\271B.tmp"C:\Users\Admin\AppData\Local\Temp\271B.tmp"95⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\2798.tmp"C:\Users\Admin\AppData\Local\Temp\2798.tmp"96⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\2834.tmp"C:\Users\Admin\AppData\Local\Temp\2834.tmp"97⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\28D0.tmp"C:\Users\Admin\AppData\Local\Temp\28D0.tmp"98⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\298C.tmp"C:\Users\Admin\AppData\Local\Temp\298C.tmp"99⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\2A18.tmp"C:\Users\Admin\AppData\Local\Temp\2A18.tmp"100⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\2A95.tmp"C:\Users\Admin\AppData\Local\Temp\2A95.tmp"101⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\2B32.tmp"C:\Users\Admin\AppData\Local\Temp\2B32.tmp"102⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\2BCE.tmp"C:\Users\Admin\AppData\Local\Temp\2BCE.tmp"103⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"104⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"105⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\2D74.tmp"C:\Users\Admin\AppData\Local\Temp\2D74.tmp"106⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"107⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\2E8D.tmp"C:\Users\Admin\AppData\Local\Temp\2E8D.tmp"108⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\2F0A.tmp"C:\Users\Admin\AppData\Local\Temp\2F0A.tmp"109⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\2F97.tmp"C:\Users\Admin\AppData\Local\Temp\2F97.tmp"110⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\3071.tmp"C:\Users\Admin\AppData\Local\Temp\3071.tmp"111⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\30FE.tmp"C:\Users\Admin\AppData\Local\Temp\30FE.tmp"112⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\31AA.tmp"C:\Users\Admin\AppData\Local\Temp\31AA.tmp"113⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\3227.tmp"C:\Users\Admin\AppData\Local\Temp\3227.tmp"114⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\32B3.tmp"C:\Users\Admin\AppData\Local\Temp\32B3.tmp"115⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"116⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"117⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\3479.tmp"C:\Users\Admin\AppData\Local\Temp\3479.tmp"118⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\34F6.tmp"C:\Users\Admin\AppData\Local\Temp\34F6.tmp"119⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\35E0.tmp"C:\Users\Admin\AppData\Local\Temp\35E0.tmp"120⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\368C.tmp"C:\Users\Admin\AppData\Local\Temp\368C.tmp"121⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\3728.tmp"C:\Users\Admin\AppData\Local\Temp\3728.tmp"122⤵PID:4524
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-