Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
23/10/2023, 17:58
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.2023-09-04_d8d3042a31a5c63a91c433b1d65ba85e_mafia_JC.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.2023-09-04_d8d3042a31a5c63a91c433b1d65ba85e_mafia_JC.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.2023-09-04_d8d3042a31a5c63a91c433b1d65ba85e_mafia_JC.exe
-
Size
488KB
-
MD5
d8d3042a31a5c63a91c433b1d65ba85e
-
SHA1
2d3deee4a766397e326df674d0be88612ab93b5f
-
SHA256
05b28aa6c9b7c4e15bf943f1ecc6b68c09c5e7835763a7ceed50e0ac9f49d68f
-
SHA512
04eb9be4cb891f51887f7aa06f1727013d60e1d4366cdaece896fa45dfc04cbcdd27c8d9c77754552788e7d28b5b4629bcafe947de1f2e4ee159a8d025f53922
-
SSDEEP
12288:/U5rCOTeiDcHevV0uLR6U/8m+M4bYsyl1NZ:/UQOJDietMk8lM4UsY1N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4984 6580.tmp 400 663C.tmp 1420 66E8.tmp 4484 67B3.tmp 3988 687E.tmp 2872 68FB.tmp 888 69C6.tmp 4064 6A91.tmp 2140 6B1E.tmp 2044 6B9B.tmp 916 6C37.tmp 4404 6D02.tmp 4952 6D8F.tmp 4592 6F25.tmp 4008 6FF0.tmp 4464 70BB.tmp 4888 7186.tmp 3200 7203.tmp 1588 72CE.tmp 3656 733C.tmp 3444 73F7.tmp 2656 7501.tmp 4268 757E.tmp 3900 75EB.tmp 968 76B6.tmp 3352 7753.tmp 1568 77D0.tmp 2096 786C.tmp 4660 7908.tmp 3300 79C4.tmp 4088 7A8F.tmp 1928 7B3B.tmp 456 7C06.tmp 3892 7C92.tmp 4032 7D1F.tmp 3580 7D9C.tmp 2468 7E29.tmp 3648 7EB5.tmp 4772 7F52.tmp 4692 800D.tmp 3488 807A.tmp 4020 80E8.tmp 2056 8174.tmp 4508 8201.tmp 1824 826E.tmp 4624 82DC.tmp 1016 8368.tmp 1184 83E5.tmp 1696 8462.tmp 1188 84DF.tmp 4016 856C.tmp 2860 85E9.tmp 3972 8666.tmp 4488 86E3.tmp 4448 8760.tmp 4476 87BE.tmp 3192 882B.tmp 2728 88A8.tmp 1332 8954.tmp 4288 89D1.tmp 3596 8A3E.tmp 4484 8AAC.tmp 3712 8B38.tmp 3548 8C13.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4476 wrote to memory of 4984 4476 NEAS.2023-09-04_d8d3042a31a5c63a91c433b1d65ba85e_mafia_JC.exe 82 PID 4476 wrote to memory of 4984 4476 NEAS.2023-09-04_d8d3042a31a5c63a91c433b1d65ba85e_mafia_JC.exe 82 PID 4476 wrote to memory of 4984 4476 NEAS.2023-09-04_d8d3042a31a5c63a91c433b1d65ba85e_mafia_JC.exe 82 PID 4984 wrote to memory of 400 4984 6580.tmp 83 PID 4984 wrote to memory of 400 4984 6580.tmp 83 PID 4984 wrote to memory of 400 4984 6580.tmp 83 PID 400 wrote to memory of 1420 400 663C.tmp 84 PID 400 wrote to memory of 1420 400 663C.tmp 84 PID 400 wrote to memory of 1420 400 663C.tmp 84 PID 1420 wrote to memory of 4484 1420 66E8.tmp 85 PID 1420 wrote to memory of 4484 1420 66E8.tmp 85 PID 1420 wrote to memory of 4484 1420 66E8.tmp 85 PID 4484 wrote to memory of 3988 4484 67B3.tmp 86 PID 4484 wrote to memory of 3988 4484 67B3.tmp 86 PID 4484 wrote to memory of 3988 4484 67B3.tmp 86 PID 3988 wrote to memory of 2872 3988 687E.tmp 87 PID 3988 wrote to memory of 2872 3988 687E.tmp 87 PID 3988 wrote to memory of 2872 3988 687E.tmp 87 PID 2872 wrote to memory of 888 2872 68FB.tmp 89 PID 2872 wrote to memory of 888 2872 68FB.tmp 89 PID 2872 wrote to memory of 888 2872 68FB.tmp 89 PID 888 wrote to memory of 4064 888 69C6.tmp 90 PID 888 wrote to memory of 4064 888 69C6.tmp 90 PID 888 wrote to memory of 4064 888 69C6.tmp 90 PID 4064 wrote to memory of 2140 4064 6A91.tmp 91 PID 4064 wrote to memory of 2140 4064 6A91.tmp 91 PID 4064 wrote to memory of 2140 4064 6A91.tmp 91 PID 2140 wrote to memory of 2044 2140 6B1E.tmp 92 PID 2140 wrote to memory of 2044 2140 6B1E.tmp 92 PID 2140 wrote to memory of 2044 2140 6B1E.tmp 92 PID 2044 wrote to memory of 916 2044 6B9B.tmp 93 PID 2044 wrote to memory of 916 2044 6B9B.tmp 93 PID 2044 wrote to memory of 916 2044 6B9B.tmp 93 PID 916 wrote to memory of 4404 916 6C37.tmp 94 PID 916 wrote to memory of 4404 916 6C37.tmp 94 PID 916 wrote to memory of 4404 916 6C37.tmp 94 PID 4404 wrote to memory of 4952 4404 6D02.tmp 95 PID 4404 wrote to memory of 4952 4404 6D02.tmp 95 PID 4404 wrote to memory of 4952 4404 6D02.tmp 95 PID 4952 wrote to memory of 4592 4952 6D8F.tmp 96 PID 4952 wrote to memory of 4592 4952 6D8F.tmp 96 PID 4952 wrote to memory of 4592 4952 6D8F.tmp 96 PID 4592 wrote to memory of 4008 4592 6F25.tmp 98 PID 4592 wrote to memory of 4008 4592 6F25.tmp 98 PID 4592 wrote to memory of 4008 4592 6F25.tmp 98 PID 4008 wrote to memory of 4464 4008 6FF0.tmp 99 PID 4008 wrote to memory of 4464 4008 6FF0.tmp 99 PID 4008 wrote to memory of 4464 4008 6FF0.tmp 99 PID 4464 wrote to memory of 4888 4464 70BB.tmp 100 PID 4464 wrote to memory of 4888 4464 70BB.tmp 100 PID 4464 wrote to memory of 4888 4464 70BB.tmp 100 PID 4888 wrote to memory of 3200 4888 7186.tmp 101 PID 4888 wrote to memory of 3200 4888 7186.tmp 101 PID 4888 wrote to memory of 3200 4888 7186.tmp 101 PID 3200 wrote to memory of 1588 3200 7203.tmp 102 PID 3200 wrote to memory of 1588 3200 7203.tmp 102 PID 3200 wrote to memory of 1588 3200 7203.tmp 102 PID 1588 wrote to memory of 3656 1588 72CE.tmp 103 PID 1588 wrote to memory of 3656 1588 72CE.tmp 103 PID 1588 wrote to memory of 3656 1588 72CE.tmp 103 PID 3656 wrote to memory of 3444 3656 733C.tmp 104 PID 3656 wrote to memory of 3444 3656 733C.tmp 104 PID 3656 wrote to memory of 3444 3656 733C.tmp 104 PID 3444 wrote to memory of 2656 3444 73F7.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-04_d8d3042a31a5c63a91c433b1d65ba85e_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-04_d8d3042a31a5c63a91c433b1d65ba85e_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\73F7.tmp"C:\Users\Admin\AppData\Local\Temp\73F7.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"23⤵
- Executes dropped EXE
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"24⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"25⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"26⤵
- Executes dropped EXE
PID:968 -
C:\Users\Admin\AppData\Local\Temp\7753.tmp"C:\Users\Admin\AppData\Local\Temp\7753.tmp"27⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"28⤵
- Executes dropped EXE
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\786C.tmp"C:\Users\Admin\AppData\Local\Temp\786C.tmp"29⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\7908.tmp"C:\Users\Admin\AppData\Local\Temp\7908.tmp"30⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\79C4.tmp"C:\Users\Admin\AppData\Local\Temp\79C4.tmp"31⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"32⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"33⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\7C06.tmp"C:\Users\Admin\AppData\Local\Temp\7C06.tmp"34⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\7C92.tmp"C:\Users\Admin\AppData\Local\Temp\7C92.tmp"35⤵
- Executes dropped EXE
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"36⤵
- Executes dropped EXE
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"37⤵
- Executes dropped EXE
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\7E29.tmp"C:\Users\Admin\AppData\Local\Temp\7E29.tmp"38⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"39⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\7F52.tmp"C:\Users\Admin\AppData\Local\Temp\7F52.tmp"40⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\800D.tmp"C:\Users\Admin\AppData\Local\Temp\800D.tmp"41⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\807A.tmp"C:\Users\Admin\AppData\Local\Temp\807A.tmp"42⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\80E8.tmp"C:\Users\Admin\AppData\Local\Temp\80E8.tmp"43⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\8174.tmp"C:\Users\Admin\AppData\Local\Temp\8174.tmp"44⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\8201.tmp"C:\Users\Admin\AppData\Local\Temp\8201.tmp"45⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"46⤵
- Executes dropped EXE
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\82DC.tmp"C:\Users\Admin\AppData\Local\Temp\82DC.tmp"47⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\8368.tmp"C:\Users\Admin\AppData\Local\Temp\8368.tmp"48⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\83E5.tmp"C:\Users\Admin\AppData\Local\Temp\83E5.tmp"49⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\8462.tmp"C:\Users\Admin\AppData\Local\Temp\8462.tmp"50⤵
- Executes dropped EXE
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\84DF.tmp"C:\Users\Admin\AppData\Local\Temp\84DF.tmp"51⤵
- Executes dropped EXE
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\856C.tmp"C:\Users\Admin\AppData\Local\Temp\856C.tmp"52⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"53⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\8666.tmp"C:\Users\Admin\AppData\Local\Temp\8666.tmp"54⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\86E3.tmp"C:\Users\Admin\AppData\Local\Temp\86E3.tmp"55⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\8760.tmp"C:\Users\Admin\AppData\Local\Temp\8760.tmp"56⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\87BE.tmp"C:\Users\Admin\AppData\Local\Temp\87BE.tmp"57⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\882B.tmp"C:\Users\Admin\AppData\Local\Temp\882B.tmp"58⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\88A8.tmp"C:\Users\Admin\AppData\Local\Temp\88A8.tmp"59⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\8954.tmp"C:\Users\Admin\AppData\Local\Temp\8954.tmp"60⤵
- Executes dropped EXE
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\89D1.tmp"C:\Users\Admin\AppData\Local\Temp\89D1.tmp"61⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"62⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"63⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\8B38.tmp"C:\Users\Admin\AppData\Local\Temp\8B38.tmp"64⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\8C13.tmp"C:\Users\Admin\AppData\Local\Temp\8C13.tmp"65⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"66⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"67⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"68⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"69⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\8E84.tmp"C:\Users\Admin\AppData\Local\Temp\8E84.tmp"70⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"71⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"72⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"73⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"74⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"75⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\9191.tmp"C:\Users\Admin\AppData\Local\Temp\9191.tmp"76⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"77⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"78⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"79⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"80⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"81⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"82⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\94AE.tmp"C:\Users\Admin\AppData\Local\Temp\94AE.tmp"83⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"84⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\95D7.tmp"C:\Users\Admin\AppData\Local\Temp\95D7.tmp"85⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\9654.tmp"C:\Users\Admin\AppData\Local\Temp\9654.tmp"86⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"87⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"88⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\9819.tmp"C:\Users\Admin\AppData\Local\Temp\9819.tmp"89⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\9896.tmp"C:\Users\Admin\AppData\Local\Temp\9896.tmp"90⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"91⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"92⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"93⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"94⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"95⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"96⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"97⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"98⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"99⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"100⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"101⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"102⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"103⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"104⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"105⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\A066.tmp"C:\Users\Admin\AppData\Local\Temp\A066.tmp"106⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"107⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"108⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"109⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\A24B.tmp"C:\Users\Admin\AppData\Local\Temp\A24B.tmp"110⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"111⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\A354.tmp"C:\Users\Admin\AppData\Local\Temp\A354.tmp"112⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"113⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\A47D.tmp"C:\Users\Admin\AppData\Local\Temp\A47D.tmp"114⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\A50A.tmp"C:\Users\Admin\AppData\Local\Temp\A50A.tmp"115⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"116⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"117⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"118⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"119⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\A74C.tmp"C:\Users\Admin\AppData\Local\Temp\A74C.tmp"120⤵PID:244
-
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"121⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\A836.tmp"C:\Users\Admin\AppData\Local\Temp\A836.tmp"122⤵PID:4356
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-