Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2023, 15:48
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.2023-09-08_ff7c45e34c5304372cc1d626d5f20315_mafia_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.2023-09-08_ff7c45e34c5304372cc1d626d5f20315_mafia_JC.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.2023-09-08_ff7c45e34c5304372cc1d626d5f20315_mafia_JC.exe
-
Size
487KB
-
MD5
ff7c45e34c5304372cc1d626d5f20315
-
SHA1
0a674d8e377e824c71df4306553fef6a3b151af3
-
SHA256
a472289538e6a04d4cc013205059044efb082a4d100ca1683d155be419901c67
-
SHA512
39160015906b2e03028c025272d30f0e21598a3e5e0debbb559c6900633a93e0690b7d610c10a2bad44d108f37ebb29e644b37d1ee91048d8671c444b15efba2
-
SSDEEP
12288:yU5rCOTeiNLWO46GamIUBByuE0PjDHPbZ:yUQOJNLWpajUPyuE0bDHPb
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3596 828E.tmp 1932 831A.tmp 4352 83A7.tmp 1408 8482.tmp 312 855C.tmp 4124 8608.tmp 116 8722.tmp 4520 879F.tmp 4784 8879.tmp 4928 8925.tmp 1144 89D1.tmp 824 8A5E.tmp 3772 8B38.tmp 4832 8C32.tmp 4064 8CEE.tmp 4820 8DD8.tmp 3608 8E84.tmp 4736 8F30.tmp 1448 9049.tmp 4368 9124.tmp 2504 920E.tmp 3156 9318.tmp 1816 93C4.tmp 788 949F.tmp 4084 951C.tmp 3596 95A8.tmp 3028 9673.tmp 2144 977D.tmp 4108 9867.tmp 4728 9971.tmp 5028 9A2D.tmp 4988 9AD8.tmp 2916 9BA4.tmp 1368 9C8E.tmp 3752 9D2A.tmp 4432 9DD6.tmp 1612 9E63.tmp 1676 9EFF.tmp 2260 9F9B.tmp 4204 A028.tmp 2480 A0B4.tmp 2856 A131.tmp 3308 A1BE.tmp 4812 A26A.tmp 824 A345.tmp 2332 A3C2.tmp 3940 A43F.tmp 2228 A4CB.tmp 4832 A548.tmp 4428 A5C5.tmp 2292 A652.tmp 3084 A6EE.tmp 2744 A75C.tmp 1364 A7F8.tmp 2972 A884.tmp 3240 A901.tmp 4032 A98E.tmp 2164 AA1B.tmp 2520 AA98.tmp 1044 AB44.tmp 1460 ABB1.tmp 3708 AC5D.tmp 4020 ACF9.tmp 4312 ADA5.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2344 wrote to memory of 3596 2344 NEAS.2023-09-08_ff7c45e34c5304372cc1d626d5f20315_mafia_JC.exe 86 PID 2344 wrote to memory of 3596 2344 NEAS.2023-09-08_ff7c45e34c5304372cc1d626d5f20315_mafia_JC.exe 86 PID 2344 wrote to memory of 3596 2344 NEAS.2023-09-08_ff7c45e34c5304372cc1d626d5f20315_mafia_JC.exe 86 PID 3596 wrote to memory of 1932 3596 828E.tmp 87 PID 3596 wrote to memory of 1932 3596 828E.tmp 87 PID 3596 wrote to memory of 1932 3596 828E.tmp 87 PID 1932 wrote to memory of 4352 1932 831A.tmp 89 PID 1932 wrote to memory of 4352 1932 831A.tmp 89 PID 1932 wrote to memory of 4352 1932 831A.tmp 89 PID 4352 wrote to memory of 1408 4352 83A7.tmp 90 PID 4352 wrote to memory of 1408 4352 83A7.tmp 90 PID 4352 wrote to memory of 1408 4352 83A7.tmp 90 PID 1408 wrote to memory of 312 1408 8482.tmp 92 PID 1408 wrote to memory of 312 1408 8482.tmp 92 PID 1408 wrote to memory of 312 1408 8482.tmp 92 PID 312 wrote to memory of 4124 312 855C.tmp 93 PID 312 wrote to memory of 4124 312 855C.tmp 93 PID 312 wrote to memory of 4124 312 855C.tmp 93 PID 4124 wrote to memory of 116 4124 8608.tmp 94 PID 4124 wrote to memory of 116 4124 8608.tmp 94 PID 4124 wrote to memory of 116 4124 8608.tmp 94 PID 116 wrote to memory of 4520 116 8722.tmp 96 PID 116 wrote to memory of 4520 116 8722.tmp 96 PID 116 wrote to memory of 4520 116 8722.tmp 96 PID 4520 wrote to memory of 4784 4520 879F.tmp 97 PID 4520 wrote to memory of 4784 4520 879F.tmp 97 PID 4520 wrote to memory of 4784 4520 879F.tmp 97 PID 4784 wrote to memory of 4928 4784 8879.tmp 98 PID 4784 wrote to memory of 4928 4784 8879.tmp 98 PID 4784 wrote to memory of 4928 4784 8879.tmp 98 PID 4928 wrote to memory of 1144 4928 8925.tmp 99 PID 4928 wrote to memory of 1144 4928 8925.tmp 99 PID 4928 wrote to memory of 1144 4928 8925.tmp 99 PID 1144 wrote to memory of 824 1144 89D1.tmp 100 PID 1144 wrote to memory of 824 1144 89D1.tmp 100 PID 1144 wrote to memory of 824 1144 89D1.tmp 100 PID 824 wrote to memory of 3772 824 8A5E.tmp 102 PID 824 wrote to memory of 3772 824 8A5E.tmp 102 PID 824 wrote to memory of 3772 824 8A5E.tmp 102 PID 3772 wrote to memory of 4832 3772 8B38.tmp 103 PID 3772 wrote to memory of 4832 3772 8B38.tmp 103 PID 3772 wrote to memory of 4832 3772 8B38.tmp 103 PID 4832 wrote to memory of 4064 4832 8C32.tmp 104 PID 4832 wrote to memory of 4064 4832 8C32.tmp 104 PID 4832 wrote to memory of 4064 4832 8C32.tmp 104 PID 4064 wrote to memory of 4820 4064 8CEE.tmp 106 PID 4064 wrote to memory of 4820 4064 8CEE.tmp 106 PID 4064 wrote to memory of 4820 4064 8CEE.tmp 106 PID 4820 wrote to memory of 3608 4820 8DD8.tmp 107 PID 4820 wrote to memory of 3608 4820 8DD8.tmp 107 PID 4820 wrote to memory of 3608 4820 8DD8.tmp 107 PID 3608 wrote to memory of 4736 3608 8E84.tmp 110 PID 3608 wrote to memory of 4736 3608 8E84.tmp 110 PID 3608 wrote to memory of 4736 3608 8E84.tmp 110 PID 4736 wrote to memory of 1448 4736 8F30.tmp 111 PID 4736 wrote to memory of 1448 4736 8F30.tmp 111 PID 4736 wrote to memory of 1448 4736 8F30.tmp 111 PID 1448 wrote to memory of 4368 1448 9049.tmp 112 PID 1448 wrote to memory of 4368 1448 9049.tmp 112 PID 1448 wrote to memory of 4368 1448 9049.tmp 112 PID 4368 wrote to memory of 2504 4368 9124.tmp 113 PID 4368 wrote to memory of 2504 4368 9124.tmp 113 PID 4368 wrote to memory of 2504 4368 9124.tmp 113 PID 2504 wrote to memory of 3156 2504 920E.tmp 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-08_ff7c45e34c5304372cc1d626d5f20315_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-08_ff7c45e34c5304372cc1d626d5f20315_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\828E.tmp"C:\Users\Admin\AppData\Local\Temp\828E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\83A7.tmp"C:\Users\Admin\AppData\Local\Temp\83A7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\8482.tmp"C:\Users\Admin\AppData\Local\Temp\8482.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\855C.tmp"C:\Users\Admin\AppData\Local\Temp\855C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312 -
C:\Users\Admin\AppData\Local\Temp\8608.tmp"C:\Users\Admin\AppData\Local\Temp\8608.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\8722.tmp"C:\Users\Admin\AppData\Local\Temp\8722.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\879F.tmp"C:\Users\Admin\AppData\Local\Temp\879F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\8879.tmp"C:\Users\Admin\AppData\Local\Temp\8879.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\8925.tmp"C:\Users\Admin\AppData\Local\Temp\8925.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\89D1.tmp"C:\Users\Admin\AppData\Local\Temp\89D1.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\8B38.tmp"C:\Users\Admin\AppData\Local\Temp\8B38.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\8C32.tmp"C:\Users\Admin\AppData\Local\Temp\8C32.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\8E84.tmp"C:\Users\Admin\AppData\Local\Temp\8E84.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\8F30.tmp"C:\Users\Admin\AppData\Local\Temp\8F30.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\9049.tmp"C:\Users\Admin\AppData\Local\Temp\9049.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"23⤵
- Executes dropped EXE
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"24⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"25⤵
- Executes dropped EXE
PID:788 -
C:\Users\Admin\AppData\Local\Temp\951C.tmp"C:\Users\Admin\AppData\Local\Temp\951C.tmp"26⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"27⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\9673.tmp"C:\Users\Admin\AppData\Local\Temp\9673.tmp"28⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\977D.tmp"C:\Users\Admin\AppData\Local\Temp\977D.tmp"29⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\9867.tmp"C:\Users\Admin\AppData\Local\Temp\9867.tmp"30⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"31⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"32⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"33⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"34⤵
- Executes dropped EXE
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"35⤵
- Executes dropped EXE
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"36⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"37⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\9E63.tmp"C:\Users\Admin\AppData\Local\Temp\9E63.tmp"38⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"39⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"40⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\A028.tmp"C:\Users\Admin\AppData\Local\Temp\A028.tmp"41⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"42⤵
- Executes dropped EXE
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"43⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"44⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\A26A.tmp"C:\Users\Admin\AppData\Local\Temp\A26A.tmp"45⤵
- Executes dropped EXE
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"46⤵
- Executes dropped EXE
PID:824 -
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"47⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\A43F.tmp"C:\Users\Admin\AppData\Local\Temp\A43F.tmp"48⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"49⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"50⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"51⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"52⤵
- Executes dropped EXE
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"53⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"54⤵
- Executes dropped EXE
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"55⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\A884.tmp"C:\Users\Admin\AppData\Local\Temp\A884.tmp"56⤵
- Executes dropped EXE
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"57⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"58⤵
- Executes dropped EXE
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"59⤵
- Executes dropped EXE
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"60⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\AB44.tmp"C:\Users\Admin\AppData\Local\Temp\AB44.tmp"61⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"62⤵
- Executes dropped EXE
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"63⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"64⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"65⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\AE41.tmp"C:\Users\Admin\AppData\Local\Temp\AE41.tmp"66⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"67⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\AF99.tmp"C:\Users\Admin\AppData\Local\Temp\AF99.tmp"68⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\B016.tmp"C:\Users\Admin\AppData\Local\Temp\B016.tmp"69⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\B093.tmp"C:\Users\Admin\AppData\Local\Temp\B093.tmp"70⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\B12F.tmp"C:\Users\Admin\AppData\Local\Temp\B12F.tmp"71⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"72⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\B258.tmp"C:\Users\Admin\AppData\Local\Temp\B258.tmp"73⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"74⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\B381.tmp"C:\Users\Admin\AppData\Local\Temp\B381.tmp"75⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\B41D.tmp"C:\Users\Admin\AppData\Local\Temp\B41D.tmp"76⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\B49A.tmp"C:\Users\Admin\AppData\Local\Temp\B49A.tmp"77⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\B517.tmp"C:\Users\Admin\AppData\Local\Temp\B517.tmp"78⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"79⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\B640.tmp"C:\Users\Admin\AppData\Local\Temp\B640.tmp"80⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"81⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\B779.tmp"C:\Users\Admin\AppData\Local\Temp\B779.tmp"82⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"83⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\B853.tmp"C:\Users\Admin\AppData\Local\Temp\B853.tmp"84⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"85⤵PID:180
-
C:\Users\Admin\AppData\Local\Temp\B95D.tmp"C:\Users\Admin\AppData\Local\Temp\B95D.tmp"86⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"87⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\BA67.tmp"C:\Users\Admin\AppData\Local\Temp\BA67.tmp"88⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"89⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\BB61.tmp"C:\Users\Admin\AppData\Local\Temp\BB61.tmp"90⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"91⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\BC89.tmp"C:\Users\Admin\AppData\Local\Temp\BC89.tmp"92⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\BD26.tmp"C:\Users\Admin\AppData\Local\Temp\BD26.tmp"93⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"94⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\BE20.tmp"C:\Users\Admin\AppData\Local\Temp\BE20.tmp"95⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"96⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\BF49.tmp"C:\Users\Admin\AppData\Local\Temp\BF49.tmp"97⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"98⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\C043.tmp"C:\Users\Admin\AppData\Local\Temp\C043.tmp"99⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"100⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\C17B.tmp"C:\Users\Admin\AppData\Local\Temp\C17B.tmp"101⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\C208.tmp"C:\Users\Admin\AppData\Local\Temp\C208.tmp"102⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\C285.tmp"C:\Users\Admin\AppData\Local\Temp\C285.tmp"103⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\C321.tmp"C:\Users\Admin\AppData\Local\Temp\C321.tmp"104⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"105⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\C469.tmp"C:\Users\Admin\AppData\Local\Temp\C469.tmp"106⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"107⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"108⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\C62E.tmp"C:\Users\Admin\AppData\Local\Temp\C62E.tmp"109⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\C93B.tmp"C:\Users\Admin\AppData\Local\Temp\C93B.tmp"110⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"111⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\CA26.tmp"C:\Users\Admin\AppData\Local\Temp\CA26.tmp"112⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\CAB2.tmp"C:\Users\Admin\AppData\Local\Temp\CAB2.tmp"113⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\CB20.tmp"C:\Users\Admin\AppData\Local\Temp\CB20.tmp"114⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"115⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\D39C.tmp"C:\Users\Admin\AppData\Local\Temp\D39C.tmp"116⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\D62C.tmp"C:\Users\Admin\AppData\Local\Temp\D62C.tmp"117⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\DAB0.tmp"C:\Users\Admin\AppData\Local\Temp\DAB0.tmp"118⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\E03E.tmp"C:\Users\Admin\AppData\Local\Temp\E03E.tmp"119⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\E34B.tmp"C:\Users\Admin\AppData\Local\Temp\E34B.tmp"120⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\E501.tmp"C:\Users\Admin\AppData\Local\Temp\E501.tmp"121⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"122⤵PID:3244
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-