Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
23/10/2023, 20:17
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.2023-09-06_0f25c86294e06ed3949d591ba98242eb_mafia_JC.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.2023-09-06_0f25c86294e06ed3949d591ba98242eb_mafia_JC.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.2023-09-06_0f25c86294e06ed3949d591ba98242eb_mafia_JC.exe
-
Size
488KB
-
MD5
0f25c86294e06ed3949d591ba98242eb
-
SHA1
e20a67c8ac484690470acb44cf76927314a55681
-
SHA256
6fe3e82cf7d08abf48bc1552bee9217ba0f3c90f351352b46266fad187b4a235
-
SHA512
28eddfd0e1ce2ec68fa646dfcbea72720d634b327c1be06f99d0756a0c603139e1e027522c52c9ec144f32dd08c4e2a59368e2fba001e60eaf02fe3eba096585
-
SSDEEP
12288:/U5rCOTeiDjD/qhIjqPjTth5VPgJU6Za/kbNZ:/UQOJDvSijqPjtVmU6Za/kbN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2156 142F.tmp 3044 1519.tmp 2952 15B6.tmp 3692 1690.tmp 904 175B.tmp 3172 1827.tmp 2436 1911.tmp 3696 19CC.tmp 964 1AD6.tmp 3084 1B92.tmp 2592 1C2E.tmp 1364 1CDA.tmp 2332 1DB4.tmp 4328 1E60.tmp 3080 20A2.tmp 4440 21AC.tmp 3672 2287.tmp 2236 2342.tmp 2016 23FE.tmp 2972 24AA.tmp 4504 2556.tmp 5036 2630.tmp 2136 26FB.tmp 5116 2798.tmp 4808 2824.tmp 1272 292E.tmp 4888 29DA.tmp 3820 2AF3.tmp 4500 2C0C.tmp 3280 2D35.tmp 1032 2E10.tmp 3104 2EEB.tmp 1484 2FB6.tmp 3028 3062.tmp 1212 31E8.tmp 2368 3285.tmp 2688 3321.tmp 1700 33CD.tmp 2284 344A.tmp 1528 3573.tmp 5088 362E.tmp 4628 36EA.tmp 2712 3776.tmp 992 3822.tmp 3092 38BE.tmp 1296 396A.tmp 1652 39F7.tmp 4548 3A93.tmp 1968 3B20.tmp 1800 3B9D.tmp 1976 3C1A.tmp 2276 3CC6.tmp 3744 3D62.tmp 3312 3E0E.tmp 3112 3E8B.tmp 2920 3F56.tmp 2720 407F.tmp 1724 413A.tmp 2004 41D6.tmp 4044 4282.tmp 2120 432E.tmp 4900 43DA.tmp 1180 4467.tmp 5064 4503.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4756 wrote to memory of 2156 4756 NEAS.2023-09-06_0f25c86294e06ed3949d591ba98242eb_mafia_JC.exe 80 PID 4756 wrote to memory of 2156 4756 NEAS.2023-09-06_0f25c86294e06ed3949d591ba98242eb_mafia_JC.exe 80 PID 4756 wrote to memory of 2156 4756 NEAS.2023-09-06_0f25c86294e06ed3949d591ba98242eb_mafia_JC.exe 80 PID 2156 wrote to memory of 3044 2156 142F.tmp 81 PID 2156 wrote to memory of 3044 2156 142F.tmp 81 PID 2156 wrote to memory of 3044 2156 142F.tmp 81 PID 3044 wrote to memory of 2952 3044 1519.tmp 82 PID 3044 wrote to memory of 2952 3044 1519.tmp 82 PID 3044 wrote to memory of 2952 3044 1519.tmp 82 PID 2952 wrote to memory of 3692 2952 15B6.tmp 83 PID 2952 wrote to memory of 3692 2952 15B6.tmp 83 PID 2952 wrote to memory of 3692 2952 15B6.tmp 83 PID 3692 wrote to memory of 904 3692 1690.tmp 84 PID 3692 wrote to memory of 904 3692 1690.tmp 84 PID 3692 wrote to memory of 904 3692 1690.tmp 84 PID 904 wrote to memory of 3172 904 175B.tmp 85 PID 904 wrote to memory of 3172 904 175B.tmp 85 PID 904 wrote to memory of 3172 904 175B.tmp 85 PID 3172 wrote to memory of 2436 3172 1827.tmp 86 PID 3172 wrote to memory of 2436 3172 1827.tmp 86 PID 3172 wrote to memory of 2436 3172 1827.tmp 86 PID 2436 wrote to memory of 3696 2436 1911.tmp 87 PID 2436 wrote to memory of 3696 2436 1911.tmp 87 PID 2436 wrote to memory of 3696 2436 1911.tmp 87 PID 3696 wrote to memory of 964 3696 19CC.tmp 88 PID 3696 wrote to memory of 964 3696 19CC.tmp 88 PID 3696 wrote to memory of 964 3696 19CC.tmp 88 PID 964 wrote to memory of 3084 964 1AD6.tmp 89 PID 964 wrote to memory of 3084 964 1AD6.tmp 89 PID 964 wrote to memory of 3084 964 1AD6.tmp 89 PID 3084 wrote to memory of 2592 3084 1B92.tmp 90 PID 3084 wrote to memory of 2592 3084 1B92.tmp 90 PID 3084 wrote to memory of 2592 3084 1B92.tmp 90 PID 2592 wrote to memory of 1364 2592 1C2E.tmp 91 PID 2592 wrote to memory of 1364 2592 1C2E.tmp 91 PID 2592 wrote to memory of 1364 2592 1C2E.tmp 91 PID 1364 wrote to memory of 2332 1364 1CDA.tmp 92 PID 1364 wrote to memory of 2332 1364 1CDA.tmp 92 PID 1364 wrote to memory of 2332 1364 1CDA.tmp 92 PID 2332 wrote to memory of 4328 2332 1DB4.tmp 93 PID 2332 wrote to memory of 4328 2332 1DB4.tmp 93 PID 2332 wrote to memory of 4328 2332 1DB4.tmp 93 PID 4328 wrote to memory of 3080 4328 1E60.tmp 94 PID 4328 wrote to memory of 3080 4328 1E60.tmp 94 PID 4328 wrote to memory of 3080 4328 1E60.tmp 94 PID 3080 wrote to memory of 4440 3080 20A2.tmp 95 PID 3080 wrote to memory of 4440 3080 20A2.tmp 95 PID 3080 wrote to memory of 4440 3080 20A2.tmp 95 PID 4440 wrote to memory of 3672 4440 21AC.tmp 96 PID 4440 wrote to memory of 3672 4440 21AC.tmp 96 PID 4440 wrote to memory of 3672 4440 21AC.tmp 96 PID 3672 wrote to memory of 2236 3672 2287.tmp 97 PID 3672 wrote to memory of 2236 3672 2287.tmp 97 PID 3672 wrote to memory of 2236 3672 2287.tmp 97 PID 2236 wrote to memory of 2016 2236 2342.tmp 98 PID 2236 wrote to memory of 2016 2236 2342.tmp 98 PID 2236 wrote to memory of 2016 2236 2342.tmp 98 PID 2016 wrote to memory of 2972 2016 23FE.tmp 99 PID 2016 wrote to memory of 2972 2016 23FE.tmp 99 PID 2016 wrote to memory of 2972 2016 23FE.tmp 99 PID 2972 wrote to memory of 4504 2972 24AA.tmp 100 PID 2972 wrote to memory of 4504 2972 24AA.tmp 100 PID 2972 wrote to memory of 4504 2972 24AA.tmp 100 PID 4504 wrote to memory of 5036 4504 2556.tmp 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-06_0f25c86294e06ed3949d591ba98242eb_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-06_0f25c86294e06ed3949d591ba98242eb_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\142F.tmp"C:\Users\Admin\AppData\Local\Temp\142F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\1519.tmp"C:\Users\Admin\AppData\Local\Temp\1519.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\15B6.tmp"C:\Users\Admin\AppData\Local\Temp\15B6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\1690.tmp"C:\Users\Admin\AppData\Local\Temp\1690.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\175B.tmp"C:\Users\Admin\AppData\Local\Temp\175B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Users\Admin\AppData\Local\Temp\1827.tmp"C:\Users\Admin\AppData\Local\Temp\1827.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\1911.tmp"C:\Users\Admin\AppData\Local\Temp\1911.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\19CC.tmp"C:\Users\Admin\AppData\Local\Temp\19CC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\1AD6.tmp"C:\Users\Admin\AppData\Local\Temp\1AD6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\1B92.tmp"C:\Users\Admin\AppData\Local\Temp\1B92.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\1C2E.tmp"C:\Users\Admin\AppData\Local\Temp\1C2E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\1DB4.tmp"C:\Users\Admin\AppData\Local\Temp\1DB4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\1E60.tmp"C:\Users\Admin\AppData\Local\Temp\1E60.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\20A2.tmp"C:\Users\Admin\AppData\Local\Temp\20A2.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\21AC.tmp"C:\Users\Admin\AppData\Local\Temp\21AC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\2287.tmp"C:\Users\Admin\AppData\Local\Temp\2287.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\2342.tmp"C:\Users\Admin\AppData\Local\Temp\2342.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\23FE.tmp"C:\Users\Admin\AppData\Local\Temp\23FE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\24AA.tmp"C:\Users\Admin\AppData\Local\Temp\24AA.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\2556.tmp"C:\Users\Admin\AppData\Local\Temp\2556.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\2630.tmp"C:\Users\Admin\AppData\Local\Temp\2630.tmp"23⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\26FB.tmp"C:\Users\Admin\AppData\Local\Temp\26FB.tmp"24⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\2798.tmp"C:\Users\Admin\AppData\Local\Temp\2798.tmp"25⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\2824.tmp"C:\Users\Admin\AppData\Local\Temp\2824.tmp"26⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\292E.tmp"C:\Users\Admin\AppData\Local\Temp\292E.tmp"27⤵
- Executes dropped EXE
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\29DA.tmp"C:\Users\Admin\AppData\Local\Temp\29DA.tmp"28⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"29⤵
- Executes dropped EXE
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\2C0C.tmp"C:\Users\Admin\AppData\Local\Temp\2C0C.tmp"30⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\2D35.tmp"C:\Users\Admin\AppData\Local\Temp\2D35.tmp"31⤵
- Executes dropped EXE
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\2E10.tmp"C:\Users\Admin\AppData\Local\Temp\2E10.tmp"32⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\2EEB.tmp"C:\Users\Admin\AppData\Local\Temp\2EEB.tmp"33⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\2FB6.tmp"C:\Users\Admin\AppData\Local\Temp\2FB6.tmp"34⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\3062.tmp"C:\Users\Admin\AppData\Local\Temp\3062.tmp"35⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\31E8.tmp"C:\Users\Admin\AppData\Local\Temp\31E8.tmp"36⤵
- Executes dropped EXE
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"37⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"38⤵
- Executes dropped EXE
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"39⤵
- Executes dropped EXE
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"40⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\3573.tmp"C:\Users\Admin\AppData\Local\Temp\3573.tmp"41⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\362E.tmp"C:\Users\Admin\AppData\Local\Temp\362E.tmp"42⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\36EA.tmp"C:\Users\Admin\AppData\Local\Temp\36EA.tmp"43⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\3776.tmp"C:\Users\Admin\AppData\Local\Temp\3776.tmp"44⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\3822.tmp"C:\Users\Admin\AppData\Local\Temp\3822.tmp"45⤵
- Executes dropped EXE
PID:992 -
C:\Users\Admin\AppData\Local\Temp\38BE.tmp"C:\Users\Admin\AppData\Local\Temp\38BE.tmp"46⤵
- Executes dropped EXE
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\396A.tmp"C:\Users\Admin\AppData\Local\Temp\396A.tmp"47⤵
- Executes dropped EXE
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\39F7.tmp"C:\Users\Admin\AppData\Local\Temp\39F7.tmp"48⤵
- Executes dropped EXE
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\3A93.tmp"C:\Users\Admin\AppData\Local\Temp\3A93.tmp"49⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\3B20.tmp"C:\Users\Admin\AppData\Local\Temp\3B20.tmp"50⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\3B9D.tmp"C:\Users\Admin\AppData\Local\Temp\3B9D.tmp"51⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\3C1A.tmp"C:\Users\Admin\AppData\Local\Temp\3C1A.tmp"52⤵
- Executes dropped EXE
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\3CC6.tmp"C:\Users\Admin\AppData\Local\Temp\3CC6.tmp"53⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\3D62.tmp"C:\Users\Admin\AppData\Local\Temp\3D62.tmp"54⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\3E0E.tmp"C:\Users\Admin\AppData\Local\Temp\3E0E.tmp"55⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\3E8B.tmp"C:\Users\Admin\AppData\Local\Temp\3E8B.tmp"56⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\3F56.tmp"C:\Users\Admin\AppData\Local\Temp\3F56.tmp"57⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\407F.tmp"C:\Users\Admin\AppData\Local\Temp\407F.tmp"58⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\413A.tmp"C:\Users\Admin\AppData\Local\Temp\413A.tmp"59⤵
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\41D6.tmp"C:\Users\Admin\AppData\Local\Temp\41D6.tmp"60⤵
- Executes dropped EXE
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\4282.tmp"C:\Users\Admin\AppData\Local\Temp\4282.tmp"61⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\432E.tmp"C:\Users\Admin\AppData\Local\Temp\432E.tmp"62⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\43DA.tmp"C:\Users\Admin\AppData\Local\Temp\43DA.tmp"63⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\4467.tmp"C:\Users\Admin\AppData\Local\Temp\4467.tmp"64⤵
- Executes dropped EXE
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\4503.tmp"C:\Users\Admin\AppData\Local\Temp\4503.tmp"65⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\459F.tmp"C:\Users\Admin\AppData\Local\Temp\459F.tmp"66⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\463B.tmp"C:\Users\Admin\AppData\Local\Temp\463B.tmp"67⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\46C8.tmp"C:\Users\Admin\AppData\Local\Temp\46C8.tmp"68⤵PID:32
-
C:\Users\Admin\AppData\Local\Temp\4784.tmp"C:\Users\Admin\AppData\Local\Temp\4784.tmp"69⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\4820.tmp"C:\Users\Admin\AppData\Local\Temp\4820.tmp"70⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\48BC.tmp"C:\Users\Admin\AppData\Local\Temp\48BC.tmp"71⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\4958.tmp"C:\Users\Admin\AppData\Local\Temp\4958.tmp"72⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\49C6.tmp"C:\Users\Admin\AppData\Local\Temp\49C6.tmp"73⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\4A52.tmp"C:\Users\Admin\AppData\Local\Temp\4A52.tmp"74⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\4B8B.tmp"C:\Users\Admin\AppData\Local\Temp\4B8B.tmp"75⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\4C27.tmp"C:\Users\Admin\AppData\Local\Temp\4C27.tmp"76⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\4CE3.tmp"C:\Users\Admin\AppData\Local\Temp\4CE3.tmp"77⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\4E69.tmp"C:\Users\Admin\AppData\Local\Temp\4E69.tmp"78⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\4EE6.tmp"C:\Users\Admin\AppData\Local\Temp\4EE6.tmp"79⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\4F63.tmp"C:\Users\Admin\AppData\Local\Temp\4F63.tmp"80⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\500F.tmp"C:\Users\Admin\AppData\Local\Temp\500F.tmp"81⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\50AB.tmp"C:\Users\Admin\AppData\Local\Temp\50AB.tmp"82⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\5138.tmp"C:\Users\Admin\AppData\Local\Temp\5138.tmp"83⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\51C5.tmp"C:\Users\Admin\AppData\Local\Temp\51C5.tmp"84⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\5242.tmp"C:\Users\Admin\AppData\Local\Temp\5242.tmp"85⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\52CE.tmp"C:\Users\Admin\AppData\Local\Temp\52CE.tmp"86⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\537A.tmp"C:\Users\Admin\AppData\Local\Temp\537A.tmp"87⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\5426.tmp"C:\Users\Admin\AppData\Local\Temp\5426.tmp"88⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\54A3.tmp"C:\Users\Admin\AppData\Local\Temp\54A3.tmp"89⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\555E.tmp"C:\Users\Admin\AppData\Local\Temp\555E.tmp"90⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\55FB.tmp"C:\Users\Admin\AppData\Local\Temp\55FB.tmp"91⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\56A7.tmp"C:\Users\Admin\AppData\Local\Temp\56A7.tmp"92⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\5752.tmp"C:\Users\Admin\AppData\Local\Temp\5752.tmp"93⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\57EF.tmp"C:\Users\Admin\AppData\Local\Temp\57EF.tmp"94⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\586C.tmp"C:\Users\Admin\AppData\Local\Temp\586C.tmp"95⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\58E9.tmp"C:\Users\Admin\AppData\Local\Temp\58E9.tmp"96⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\5985.tmp"C:\Users\Admin\AppData\Local\Temp\5985.tmp"97⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\5A21.tmp"C:\Users\Admin\AppData\Local\Temp\5A21.tmp"98⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\5ACD.tmp"C:\Users\Admin\AppData\Local\Temp\5ACD.tmp"99⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\5B69.tmp"C:\Users\Admin\AppData\Local\Temp\5B69.tmp"100⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\5BF6.tmp"C:\Users\Admin\AppData\Local\Temp\5BF6.tmp"101⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\5C92.tmp"C:\Users\Admin\AppData\Local\Temp\5C92.tmp"102⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\5D2E.tmp"C:\Users\Admin\AppData\Local\Temp\5D2E.tmp"103⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\5DDA.tmp"C:\Users\Admin\AppData\Local\Temp\5DDA.tmp"104⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\5E67.tmp"C:\Users\Admin\AppData\Local\Temp\5E67.tmp"105⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\5F03.tmp"C:\Users\Admin\AppData\Local\Temp\5F03.tmp"106⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\5F9F.tmp"C:\Users\Admin\AppData\Local\Temp\5F9F.tmp"107⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\601C.tmp"C:\Users\Admin\AppData\Local\Temp\601C.tmp"108⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\6099.tmp"C:\Users\Admin\AppData\Local\Temp\6099.tmp"109⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\6136.tmp"C:\Users\Admin\AppData\Local\Temp\6136.tmp"110⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\61B3.tmp"C:\Users\Admin\AppData\Local\Temp\61B3.tmp"111⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\625F.tmp"C:\Users\Admin\AppData\Local\Temp\625F.tmp"112⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\630A.tmp"C:\Users\Admin\AppData\Local\Temp\630A.tmp"113⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\6387.tmp"C:\Users\Admin\AppData\Local\Temp\6387.tmp"114⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\6414.tmp"C:\Users\Admin\AppData\Local\Temp\6414.tmp"115⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\6491.tmp"C:\Users\Admin\AppData\Local\Temp\6491.tmp"116⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\652D.tmp"C:\Users\Admin\AppData\Local\Temp\652D.tmp"117⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\65D9.tmp"C:\Users\Admin\AppData\Local\Temp\65D9.tmp"118⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\6685.tmp"C:\Users\Admin\AppData\Local\Temp\6685.tmp"119⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\6721.tmp"C:\Users\Admin\AppData\Local\Temp\6721.tmp"120⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\67BE.tmp"C:\Users\Admin\AppData\Local\Temp\67BE.tmp"121⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\6869.tmp"C:\Users\Admin\AppData\Local\Temp\6869.tmp"122⤵PID:3088
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-