Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
23/10/2023, 17:50
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.2023-09-05_8b9e3fc59b1091af7c577620cfe756d5_mafia_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.2023-09-05_8b9e3fc59b1091af7c577620cfe756d5_mafia_JC.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.2023-09-05_8b9e3fc59b1091af7c577620cfe756d5_mafia_JC.exe
-
Size
488KB
-
MD5
8b9e3fc59b1091af7c577620cfe756d5
-
SHA1
aff49e25e837715e3a3e1748590161383817e319
-
SHA256
fd99d2de79cfe3ea55b2b224b51d1d23ef426283e26b6893281a16c6862dda07
-
SHA512
efff42abed3553c29916638f669c1d2f7301e631ea79bb4d0c6bec2e358a4709e84c4221da464c5fda762098e46183aedfc2c6d723dc2442c926640fa17021e6
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7xVA7YwWVIzc9Aljfz1ViinsNfWmcB6eh2c1O:/U5rCOTeiDA0CcuSlHNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1184 CCF5.tmp 1384 CDB0.tmp 3372 CEBA.tmp 2124 CF85.tmp 2672 D1A8.tmp 392 D2FF.tmp 2272 D3DA.tmp 1792 D4A5.tmp 812 D561.tmp 3268 D5FD.tmp 4548 D6A9.tmp 1516 D801.tmp 1760 D8BC.tmp 5012 D968.tmp 748 DA04.tmp 3296 DA81.tmp 4916 DB1E.tmp 4632 DBD9.tmp 1028 DC75.tmp 3288 DD02.tmp 2140 DDEC.tmp 1052 DEA8.tmp 3860 DF63.tmp 2568 E00F.tmp 3908 E0AB.tmp 4320 E186.tmp 3560 E232.tmp 5008 E2CE.tmp 116 E38A.tmp 3516 E455.tmp 3464 E501.tmp 1056 E59D.tmp 4908 E668.tmp 2492 E6E5.tmp 3044 E772.tmp 3768 E9A4.tmp 1152 EAAE.tmp 648 EB69.tmp 3988 EC06.tmp 1748 ECA2.tmp 764 ED2F.tmp 1352 EDBB.tmp 876 EE48.tmp 3912 EED4.tmp 4492 EF71.tmp 3388 F00D.tmp 60 F09A.tmp 4760 F126.tmp 2740 F1D2.tmp 4472 F27E.tmp 3052 F31A.tmp 4400 F3A7.tmp 2376 F472.tmp 4212 F51E.tmp 64 F6D3.tmp 2260 F760.tmp 4900 F7ED.tmp 3932 F8B8.tmp 5000 F935.tmp 3936 F9A2.tmp 3384 FA2F.tmp 3220 FADB.tmp 3968 FB77.tmp 4584 FC13.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2580 wrote to memory of 1184 2580 NEAS.2023-09-05_8b9e3fc59b1091af7c577620cfe756d5_mafia_JC.exe 82 PID 2580 wrote to memory of 1184 2580 NEAS.2023-09-05_8b9e3fc59b1091af7c577620cfe756d5_mafia_JC.exe 82 PID 2580 wrote to memory of 1184 2580 NEAS.2023-09-05_8b9e3fc59b1091af7c577620cfe756d5_mafia_JC.exe 82 PID 1184 wrote to memory of 1384 1184 CCF5.tmp 83 PID 1184 wrote to memory of 1384 1184 CCF5.tmp 83 PID 1184 wrote to memory of 1384 1184 CCF5.tmp 83 PID 1384 wrote to memory of 3372 1384 CDB0.tmp 85 PID 1384 wrote to memory of 3372 1384 CDB0.tmp 85 PID 1384 wrote to memory of 3372 1384 CDB0.tmp 85 PID 3372 wrote to memory of 2124 3372 CEBA.tmp 86 PID 3372 wrote to memory of 2124 3372 CEBA.tmp 86 PID 3372 wrote to memory of 2124 3372 CEBA.tmp 86 PID 2124 wrote to memory of 2672 2124 CF85.tmp 88 PID 2124 wrote to memory of 2672 2124 CF85.tmp 88 PID 2124 wrote to memory of 2672 2124 CF85.tmp 88 PID 2672 wrote to memory of 392 2672 D1A8.tmp 90 PID 2672 wrote to memory of 392 2672 D1A8.tmp 90 PID 2672 wrote to memory of 392 2672 D1A8.tmp 90 PID 392 wrote to memory of 2272 392 D2FF.tmp 91 PID 392 wrote to memory of 2272 392 D2FF.tmp 91 PID 392 wrote to memory of 2272 392 D2FF.tmp 91 PID 2272 wrote to memory of 1792 2272 D3DA.tmp 92 PID 2272 wrote to memory of 1792 2272 D3DA.tmp 92 PID 2272 wrote to memory of 1792 2272 D3DA.tmp 92 PID 1792 wrote to memory of 812 1792 D4A5.tmp 93 PID 1792 wrote to memory of 812 1792 D4A5.tmp 93 PID 1792 wrote to memory of 812 1792 D4A5.tmp 93 PID 812 wrote to memory of 3268 812 D561.tmp 94 PID 812 wrote to memory of 3268 812 D561.tmp 94 PID 812 wrote to memory of 3268 812 D561.tmp 94 PID 3268 wrote to memory of 4548 3268 D5FD.tmp 95 PID 3268 wrote to memory of 4548 3268 D5FD.tmp 95 PID 3268 wrote to memory of 4548 3268 D5FD.tmp 95 PID 4548 wrote to memory of 1516 4548 D6A9.tmp 96 PID 4548 wrote to memory of 1516 4548 D6A9.tmp 96 PID 4548 wrote to memory of 1516 4548 D6A9.tmp 96 PID 1516 wrote to memory of 1760 1516 D801.tmp 97 PID 1516 wrote to memory of 1760 1516 D801.tmp 97 PID 1516 wrote to memory of 1760 1516 D801.tmp 97 PID 1760 wrote to memory of 5012 1760 D8BC.tmp 98 PID 1760 wrote to memory of 5012 1760 D8BC.tmp 98 PID 1760 wrote to memory of 5012 1760 D8BC.tmp 98 PID 5012 wrote to memory of 748 5012 D968.tmp 99 PID 5012 wrote to memory of 748 5012 D968.tmp 99 PID 5012 wrote to memory of 748 5012 D968.tmp 99 PID 748 wrote to memory of 3296 748 DA04.tmp 100 PID 748 wrote to memory of 3296 748 DA04.tmp 100 PID 748 wrote to memory of 3296 748 DA04.tmp 100 PID 3296 wrote to memory of 4916 3296 DA81.tmp 101 PID 3296 wrote to memory of 4916 3296 DA81.tmp 101 PID 3296 wrote to memory of 4916 3296 DA81.tmp 101 PID 4916 wrote to memory of 4632 4916 DB1E.tmp 102 PID 4916 wrote to memory of 4632 4916 DB1E.tmp 102 PID 4916 wrote to memory of 4632 4916 DB1E.tmp 102 PID 4632 wrote to memory of 1028 4632 DBD9.tmp 103 PID 4632 wrote to memory of 1028 4632 DBD9.tmp 103 PID 4632 wrote to memory of 1028 4632 DBD9.tmp 103 PID 1028 wrote to memory of 3288 1028 DC75.tmp 104 PID 1028 wrote to memory of 3288 1028 DC75.tmp 104 PID 1028 wrote to memory of 3288 1028 DC75.tmp 104 PID 3288 wrote to memory of 2140 3288 DD02.tmp 105 PID 3288 wrote to memory of 2140 3288 DD02.tmp 105 PID 3288 wrote to memory of 2140 3288 DD02.tmp 105 PID 2140 wrote to memory of 1052 2140 DDEC.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-05_8b9e3fc59b1091af7c577620cfe756d5_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-05_8b9e3fc59b1091af7c577620cfe756d5_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\CF85.tmp"C:\Users\Admin\AppData\Local\Temp\CF85.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\D1A8.tmp"C:\Users\Admin\AppData\Local\Temp\D1A8.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\D2FF.tmp"C:\Users\Admin\AppData\Local\Temp\D2FF.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\D3DA.tmp"C:\Users\Admin\AppData\Local\Temp\D3DA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\D561.tmp"C:\Users\Admin\AppData\Local\Temp\D561.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Users\Admin\AppData\Local\Temp\D5FD.tmp"C:\Users\Admin\AppData\Local\Temp\D5FD.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\D6A9.tmp"C:\Users\Admin\AppData\Local\Temp\D6A9.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\D801.tmp"C:\Users\Admin\AppData\Local\Temp\D801.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\D968.tmp"C:\Users\Admin\AppData\Local\Temp\D968.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\DA04.tmp"C:\Users\Admin\AppData\Local\Temp\DA04.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\DA81.tmp"C:\Users\Admin\AppData\Local\Temp\DA81.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\DBD9.tmp"C:\Users\Admin\AppData\Local\Temp\DBD9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\DC75.tmp"C:\Users\Admin\AppData\Local\Temp\DC75.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\DD02.tmp"C:\Users\Admin\AppData\Local\Temp\DD02.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\DDEC.tmp"C:\Users\Admin\AppData\Local\Temp\DDEC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"23⤵
- Executes dropped EXE
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\DF63.tmp"C:\Users\Admin\AppData\Local\Temp\DF63.tmp"24⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\E00F.tmp"C:\Users\Admin\AppData\Local\Temp\E00F.tmp"25⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\E0AB.tmp"C:\Users\Admin\AppData\Local\Temp\E0AB.tmp"26⤵
- Executes dropped EXE
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\E186.tmp"C:\Users\Admin\AppData\Local\Temp\E186.tmp"27⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\E232.tmp"C:\Users\Admin\AppData\Local\Temp\E232.tmp"28⤵
- Executes dropped EXE
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"29⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\E38A.tmp"C:\Users\Admin\AppData\Local\Temp\E38A.tmp"30⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\E455.tmp"C:\Users\Admin\AppData\Local\Temp\E455.tmp"31⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\E501.tmp"C:\Users\Admin\AppData\Local\Temp\E501.tmp"32⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\E59D.tmp"C:\Users\Admin\AppData\Local\Temp\E59D.tmp"33⤵
- Executes dropped EXE
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\E668.tmp"C:\Users\Admin\AppData\Local\Temp\E668.tmp"34⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"35⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\E772.tmp"C:\Users\Admin\AppData\Local\Temp\E772.tmp"36⤵
- Executes dropped EXE
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"37⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\EAAE.tmp"C:\Users\Admin\AppData\Local\Temp\EAAE.tmp"38⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\EB69.tmp"C:\Users\Admin\AppData\Local\Temp\EB69.tmp"39⤵
- Executes dropped EXE
PID:648 -
C:\Users\Admin\AppData\Local\Temp\EC06.tmp"C:\Users\Admin\AppData\Local\Temp\EC06.tmp"40⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\ECA2.tmp"C:\Users\Admin\AppData\Local\Temp\ECA2.tmp"41⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"42⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"43⤵
- Executes dropped EXE
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\EE48.tmp"C:\Users\Admin\AppData\Local\Temp\EE48.tmp"44⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\EED4.tmp"C:\Users\Admin\AppData\Local\Temp\EED4.tmp"45⤵
- Executes dropped EXE
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\EF71.tmp"C:\Users\Admin\AppData\Local\Temp\EF71.tmp"46⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\F00D.tmp"C:\Users\Admin\AppData\Local\Temp\F00D.tmp"47⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\F09A.tmp"C:\Users\Admin\AppData\Local\Temp\F09A.tmp"48⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\F126.tmp"C:\Users\Admin\AppData\Local\Temp\F126.tmp"49⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\F1D2.tmp"C:\Users\Admin\AppData\Local\Temp\F1D2.tmp"50⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\F27E.tmp"C:\Users\Admin\AppData\Local\Temp\F27E.tmp"51⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\F31A.tmp"C:\Users\Admin\AppData\Local\Temp\F31A.tmp"52⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\F3A7.tmp"C:\Users\Admin\AppData\Local\Temp\F3A7.tmp"53⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\F472.tmp"C:\Users\Admin\AppData\Local\Temp\F472.tmp"54⤵
- Executes dropped EXE
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\F51E.tmp"C:\Users\Admin\AppData\Local\Temp\F51E.tmp"55⤵
- Executes dropped EXE
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"56⤵
- Executes dropped EXE
PID:64 -
C:\Users\Admin\AppData\Local\Temp\F760.tmp"C:\Users\Admin\AppData\Local\Temp\F760.tmp"57⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\F7ED.tmp"C:\Users\Admin\AppData\Local\Temp\F7ED.tmp"58⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\F8B8.tmp"C:\Users\Admin\AppData\Local\Temp\F8B8.tmp"59⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\F935.tmp"C:\Users\Admin\AppData\Local\Temp\F935.tmp"60⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\F9A2.tmp"C:\Users\Admin\AppData\Local\Temp\F9A2.tmp"61⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\FA2F.tmp"C:\Users\Admin\AppData\Local\Temp\FA2F.tmp"62⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\FADB.tmp"C:\Users\Admin\AppData\Local\Temp\FADB.tmp"63⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\FB77.tmp"C:\Users\Admin\AppData\Local\Temp\FB77.tmp"64⤵
- Executes dropped EXE
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\FC13.tmp"C:\Users\Admin\AppData\Local\Temp\FC13.tmp"65⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"66⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\FD3C.tmp"C:\Users\Admin\AppData\Local\Temp\FD3C.tmp"67⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\FDD8.tmp"C:\Users\Admin\AppData\Local\Temp\FDD8.tmp"68⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\FE74.tmp"C:\Users\Admin\AppData\Local\Temp\FE74.tmp"69⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\FF11.tmp"C:\Users\Admin\AppData\Local\Temp\FF11.tmp"70⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\FF9D.tmp"C:\Users\Admin\AppData\Local\Temp\FF9D.tmp"71⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\1A.tmp"C:\Users\Admin\AppData\Local\Temp\1A.tmp"72⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\A7.tmp"C:\Users\Admin\AppData\Local\Temp\A7.tmp"73⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\134.tmp"C:\Users\Admin\AppData\Local\Temp\134.tmp"74⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\1B1.tmp"C:\Users\Admin\AppData\Local\Temp\1B1.tmp"75⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\23D.tmp"C:\Users\Admin\AppData\Local\Temp\23D.tmp"76⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\2BA.tmp"C:\Users\Admin\AppData\Local\Temp\2BA.tmp"77⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\337.tmp"C:\Users\Admin\AppData\Local\Temp\337.tmp"78⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\3C4.tmp"C:\Users\Admin\AppData\Local\Temp\3C4.tmp"79⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\450.tmp"C:\Users\Admin\AppData\Local\Temp\450.tmp"80⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\4ED.tmp"C:\Users\Admin\AppData\Local\Temp\4ED.tmp"81⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\589.tmp"C:\Users\Admin\AppData\Local\Temp\589.tmp"82⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\606.tmp"C:\Users\Admin\AppData\Local\Temp\606.tmp"83⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\683.tmp"C:\Users\Admin\AppData\Local\Temp\683.tmp"84⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\700.tmp"C:\Users\Admin\AppData\Local\Temp\700.tmp"85⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\77D.tmp"C:\Users\Admin\AppData\Local\Temp\77D.tmp"86⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\80A.tmp"C:\Users\Admin\AppData\Local\Temp\80A.tmp"87⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\8A6.tmp"C:\Users\Admin\AppData\Local\Temp\8A6.tmp"88⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\952.tmp"C:\Users\Admin\AppData\Local\Temp\952.tmp"89⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\9EE.tmp"C:\Users\Admin\AppData\Local\Temp\9EE.tmp"90⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\A8A.tmp"C:\Users\Admin\AppData\Local\Temp\A8A.tmp"91⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\B65.tmp"C:\Users\Admin\AppData\Local\Temp\B65.tmp"92⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"93⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"94⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\CFB.tmp"C:\Users\Admin\AppData\Local\Temp\CFB.tmp"95⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\D88.tmp"C:\Users\Admin\AppData\Local\Temp\D88.tmp"96⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"97⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\E91.tmp"C:\Users\Admin\AppData\Local\Temp\E91.tmp"98⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\F2E.tmp"C:\Users\Admin\AppData\Local\Temp\F2E.tmp"99⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\FAB.tmp"C:\Users\Admin\AppData\Local\Temp\FAB.tmp"100⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\1047.tmp"C:\Users\Admin\AppData\Local\Temp\1047.tmp"101⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\10D4.tmp"C:\Users\Admin\AppData\Local\Temp\10D4.tmp"102⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\1170.tmp"C:\Users\Admin\AppData\Local\Temp\1170.tmp"103⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\121C.tmp"C:\Users\Admin\AppData\Local\Temp\121C.tmp"104⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\1299.tmp"C:\Users\Admin\AppData\Local\Temp\1299.tmp"105⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\1335.tmp"C:\Users\Admin\AppData\Local\Temp\1335.tmp"106⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\13C2.tmp"C:\Users\Admin\AppData\Local\Temp\13C2.tmp"107⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\144E.tmp"C:\Users\Admin\AppData\Local\Temp\144E.tmp"108⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\14EA.tmp"C:\Users\Admin\AppData\Local\Temp\14EA.tmp"109⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\15E4.tmp"C:\Users\Admin\AppData\Local\Temp\15E4.tmp"110⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\1671.tmp"C:\Users\Admin\AppData\Local\Temp\1671.tmp"111⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\16EE.tmp"C:\Users\Admin\AppData\Local\Temp\16EE.tmp"112⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\177B.tmp"C:\Users\Admin\AppData\Local\Temp\177B.tmp"113⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\17F8.tmp"C:\Users\Admin\AppData\Local\Temp\17F8.tmp"114⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\18A4.tmp"C:\Users\Admin\AppData\Local\Temp\18A4.tmp"115⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\1930.tmp"C:\Users\Admin\AppData\Local\Temp\1930.tmp"116⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\19AD.tmp"C:\Users\Admin\AppData\Local\Temp\19AD.tmp"117⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\1A3A.tmp"C:\Users\Admin\AppData\Local\Temp\1A3A.tmp"118⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"119⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\1B63.tmp"C:\Users\Admin\AppData\Local\Temp\1B63.tmp"120⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\1BFF.tmp"C:\Users\Admin\AppData\Local\Temp\1BFF.tmp"121⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\1C7C.tmp"C:\Users\Admin\AppData\Local\Temp\1C7C.tmp"122⤵PID:60
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-