Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
08/08/2023, 17:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9ea54dedbbd9f4fc905976a65689d838_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
9ea54dedbbd9f4fc905976a65689d838_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
9ea54dedbbd9f4fc905976a65689d838_mafia_JC.exe
-
Size
488KB
-
MD5
9ea54dedbbd9f4fc905976a65689d838
-
SHA1
ea6ba02766a46f3342fb01dea48ee1f22517696f
-
SHA256
e7c4d4545dcc8efed7c004ccee9f292f415b033eacccb919b5fc7e10131c873b
-
SHA512
31d91ce4a18073742e0bbce302e7699bdfa7ebc447edcd3fc83b5ac37513a8a07aad765a9da03d54a7c0887bf20d9b43d34612847a2494cec65874d770ac25a2
-
SSDEEP
12288:/U5rCOTeiDOo6zKWyHMdRq44NkA4l2r1qtPoyivRNZ:/UQOJDOo6zAHH4kwAroPo7RN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2176 8FC1.tmp 1652 90AB.tmp 2632 91D4.tmp 1692 929F.tmp 2612 935A.tmp 2796 9405.tmp 2164 94EF.tmp 2072 959B.tmp 2840 9685.tmp 3048 976F.tmp 2844 983A.tmp 2884 98E5.tmp 2880 99CF.tmp 2876 9A8B.tmp 2724 9B65.tmp 1944 9C30.tmp 2060 9C7E.tmp 2596 9DA6.tmp 2948 9ECF.tmp 2180 9FD8.tmp 2932 A026.tmp 852 A13F.tmp 1960 A1CB.tmp 1708 A248.tmp 812 A2C5.tmp 764 A341.tmp 1768 A46A.tmp 3064 A4C7.tmp 1340 A583.tmp 2032 A5E0.tmp 2124 A65D.tmp 1252 A6CA.tmp 1092 A737.tmp 1892 A7A5.tmp 1812 A821.tmp 436 A88F.tmp 468 A8EC.tmp 632 A959.tmp 1560 A9D6.tmp 1176 AA43.tmp 1824 AAC0.tmp 1888 AB2D.tmp 1492 ABBA.tmp 2108 AC37.tmp 1016 AC94.tmp 2496 AD11.tmp 1420 AD7E.tmp 2468 ADEB.tmp 524 AE59.tmp 2400 AEF5.tmp 560 AF71.tmp 1740 AFDF.tmp 1640 B05B.tmp 2128 B0D8.tmp 2240 B136.tmp 1612 B1A3.tmp 2616 B201.tmp 1872 B28D.tmp 2492 B30A.tmp 2224 B387.tmp 2644 B3E4.tmp 1680 B461.tmp 2204 B4CE.tmp 2612 B53B.tmp -
Loads dropped DLL 64 IoCs
pid Process 2564 9ea54dedbbd9f4fc905976a65689d838_mafia_JC.exe 2176 8FC1.tmp 1652 90AB.tmp 2632 91D4.tmp 1692 929F.tmp 2612 935A.tmp 2796 9405.tmp 2164 94EF.tmp 2072 959B.tmp 2840 9685.tmp 3048 976F.tmp 2844 983A.tmp 2884 98E5.tmp 2880 99CF.tmp 2876 9A8B.tmp 2724 9B65.tmp 1944 9C30.tmp 2060 9C7E.tmp 2596 9DA6.tmp 2948 9ECF.tmp 2180 9FD8.tmp 2932 A026.tmp 852 A13F.tmp 1960 A1CB.tmp 1708 A248.tmp 812 A2C5.tmp 764 A341.tmp 1768 A46A.tmp 3064 A4C7.tmp 1340 A583.tmp 2032 A5E0.tmp 2124 A65D.tmp 1252 A6CA.tmp 1092 A737.tmp 1892 A7A5.tmp 1812 A821.tmp 436 A88F.tmp 468 A8EC.tmp 632 A959.tmp 1560 A9D6.tmp 1176 AA43.tmp 1824 AAC0.tmp 1888 AB2D.tmp 1492 ABBA.tmp 2108 AC37.tmp 1016 AC94.tmp 2496 AD11.tmp 1420 AD7E.tmp 2468 ADEB.tmp 524 AE59.tmp 2400 AEF5.tmp 560 AF71.tmp 1740 AFDF.tmp 1640 B05B.tmp 2128 B0D8.tmp 2240 B136.tmp 1612 B1A3.tmp 2616 B201.tmp 1872 B28D.tmp 2492 B30A.tmp 2224 B387.tmp 2644 B3E4.tmp 1680 B461.tmp 2204 B4CE.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2564 wrote to memory of 2176 2564 9ea54dedbbd9f4fc905976a65689d838_mafia_JC.exe 14 PID 2564 wrote to memory of 2176 2564 9ea54dedbbd9f4fc905976a65689d838_mafia_JC.exe 14 PID 2564 wrote to memory of 2176 2564 9ea54dedbbd9f4fc905976a65689d838_mafia_JC.exe 14 PID 2564 wrote to memory of 2176 2564 9ea54dedbbd9f4fc905976a65689d838_mafia_JC.exe 14 PID 2176 wrote to memory of 1652 2176 8FC1.tmp 13 PID 2176 wrote to memory of 1652 2176 8FC1.tmp 13 PID 2176 wrote to memory of 1652 2176 8FC1.tmp 13 PID 2176 wrote to memory of 1652 2176 8FC1.tmp 13 PID 1652 wrote to memory of 2632 1652 90AB.tmp 12 PID 1652 wrote to memory of 2632 1652 90AB.tmp 12 PID 1652 wrote to memory of 2632 1652 90AB.tmp 12 PID 1652 wrote to memory of 2632 1652 90AB.tmp 12 PID 2632 wrote to memory of 1692 2632 91D4.tmp 11 PID 2632 wrote to memory of 1692 2632 91D4.tmp 11 PID 2632 wrote to memory of 1692 2632 91D4.tmp 11 PID 2632 wrote to memory of 1692 2632 91D4.tmp 11 PID 1692 wrote to memory of 2612 1692 929F.tmp 10 PID 1692 wrote to memory of 2612 1692 929F.tmp 10 PID 1692 wrote to memory of 2612 1692 929F.tmp 10 PID 1692 wrote to memory of 2612 1692 929F.tmp 10 PID 2612 wrote to memory of 2796 2612 935A.tmp 9 PID 2612 wrote to memory of 2796 2612 935A.tmp 9 PID 2612 wrote to memory of 2796 2612 935A.tmp 9 PID 2612 wrote to memory of 2796 2612 935A.tmp 9 PID 2796 wrote to memory of 2164 2796 9405.tmp 8 PID 2796 wrote to memory of 2164 2796 9405.tmp 8 PID 2796 wrote to memory of 2164 2796 9405.tmp 8 PID 2796 wrote to memory of 2164 2796 9405.tmp 8 PID 2164 wrote to memory of 2072 2164 94EF.tmp 7 PID 2164 wrote to memory of 2072 2164 94EF.tmp 7 PID 2164 wrote to memory of 2072 2164 94EF.tmp 7 PID 2164 wrote to memory of 2072 2164 94EF.tmp 7 PID 2072 wrote to memory of 2840 2072 959B.tmp 6 PID 2072 wrote to memory of 2840 2072 959B.tmp 6 PID 2072 wrote to memory of 2840 2072 959B.tmp 6 PID 2072 wrote to memory of 2840 2072 959B.tmp 6 PID 2840 wrote to memory of 3048 2840 9685.tmp 5 PID 2840 wrote to memory of 3048 2840 9685.tmp 5 PID 2840 wrote to memory of 3048 2840 9685.tmp 5 PID 2840 wrote to memory of 3048 2840 9685.tmp 5 PID 3048 wrote to memory of 2844 3048 976F.tmp 4 PID 3048 wrote to memory of 2844 3048 976F.tmp 4 PID 3048 wrote to memory of 2844 3048 976F.tmp 4 PID 3048 wrote to memory of 2844 3048 976F.tmp 4 PID 2844 wrote to memory of 2884 2844 983A.tmp 3 PID 2844 wrote to memory of 2884 2844 983A.tmp 3 PID 2844 wrote to memory of 2884 2844 983A.tmp 3 PID 2844 wrote to memory of 2884 2844 983A.tmp 3 PID 2884 wrote to memory of 2880 2884 98E5.tmp 2 PID 2884 wrote to memory of 2880 2884 98E5.tmp 2 PID 2884 wrote to memory of 2880 2884 98E5.tmp 2 PID 2884 wrote to memory of 2880 2884 98E5.tmp 2 PID 2880 wrote to memory of 2876 2880 99CF.tmp 1 PID 2880 wrote to memory of 2876 2880 99CF.tmp 1 PID 2880 wrote to memory of 2876 2880 99CF.tmp 1 PID 2880 wrote to memory of 2876 2880 99CF.tmp 1 PID 2876 wrote to memory of 2724 2876 9A8B.tmp 42 PID 2876 wrote to memory of 2724 2876 9A8B.tmp 42 PID 2876 wrote to memory of 2724 2876 9A8B.tmp 42 PID 2876 wrote to memory of 2724 2876 9A8B.tmp 42 PID 2724 wrote to memory of 1944 2724 9B65.tmp 43 PID 2724 wrote to memory of 1944 2724 9B65.tmp 43 PID 2724 wrote to memory of 1944 2724 9B65.tmp 43 PID 2724 wrote to memory of 1944 2724 9B65.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\9A8B.tmp"C:\Users\Admin\AppData\Local\Temp\9A8B.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\9DA6.tmp"C:\Users\Admin\AppData\Local\Temp\9DA6.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\9ECF.tmp"C:\Users\Admin\AppData\Local\Temp\9ECF.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\9FD8.tmp"C:\Users\Admin\AppData\Local\Temp\9FD8.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\A026.tmp"C:\Users\Admin\AppData\Local\Temp\A026.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\A13F.tmp"C:\Users\Admin\AppData\Local\Temp\A13F.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:852 -
C:\Users\Admin\AppData\Local\Temp\A1CB.tmp"C:\Users\Admin\AppData\Local\Temp\A1CB.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\A248.tmp"C:\Users\Admin\AppData\Local\Temp\A248.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\A2C5.tmp"C:\Users\Admin\AppData\Local\Temp\A2C5.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:812 -
C:\Users\Admin\AppData\Local\Temp\A341.tmp"C:\Users\Admin\AppData\Local\Temp\A341.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764 -
C:\Users\Admin\AppData\Local\Temp\A46A.tmp"C:\Users\Admin\AppData\Local\Temp\A46A.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\A4C7.tmp"C:\Users\Admin\AppData\Local\Temp\A4C7.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\A583.tmp"C:\Users\Admin\AppData\Local\Temp\A583.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\A5E0.tmp"C:\Users\Admin\AppData\Local\Temp\A5E0.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\A65D.tmp"C:\Users\Admin\AppData\Local\Temp\A65D.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\A6CA.tmp"C:\Users\Admin\AppData\Local\Temp\A6CA.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\A737.tmp"C:\Users\Admin\AppData\Local\Temp\A737.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\A821.tmp"C:\Users\Admin\AppData\Local\Temp\A821.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\A88F.tmp"C:\Users\Admin\AppData\Local\Temp\A88F.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:436 -
C:\Users\Admin\AppData\Local\Temp\A8EC.tmp"C:\Users\Admin\AppData\Local\Temp\A8EC.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:468 -
C:\Users\Admin\AppData\Local\Temp\A959.tmp"C:\Users\Admin\AppData\Local\Temp\A959.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:632 -
C:\Users\Admin\AppData\Local\Temp\A9D6.tmp"C:\Users\Admin\AppData\Local\Temp\A9D6.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\AA43.tmp"C:\Users\Admin\AppData\Local\Temp\AA43.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\AAC0.tmp"C:\Users\Admin\AppData\Local\Temp\AAC0.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\AB2D.tmp"C:\Users\Admin\AppData\Local\Temp\AB2D.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\ABBA.tmp"C:\Users\Admin\AppData\Local\Temp\ABBA.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\AC37.tmp"C:\Users\Admin\AppData\Local\Temp\AC37.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\AC94.tmp"C:\Users\Admin\AppData\Local\Temp\AC94.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\AD11.tmp"C:\Users\Admin\AppData\Local\Temp\AD11.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\AD7E.tmp"C:\Users\Admin\AppData\Local\Temp\AD7E.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\ADEB.tmp"C:\Users\Admin\AppData\Local\Temp\ADEB.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\AE59.tmp"C:\Users\Admin\AppData\Local\Temp\AE59.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:524 -
C:\Users\Admin\AppData\Local\Temp\AEF5.tmp"C:\Users\Admin\AppData\Local\Temp\AEF5.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\AF71.tmp"C:\Users\Admin\AppData\Local\Temp\AF71.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:560 -
C:\Users\Admin\AppData\Local\Temp\AFDF.tmp"C:\Users\Admin\AppData\Local\Temp\AFDF.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\B05B.tmp"C:\Users\Admin\AppData\Local\Temp\B05B.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\B0D8.tmp"C:\Users\Admin\AppData\Local\Temp\B0D8.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\B136.tmp"C:\Users\Admin\AppData\Local\Temp\B136.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\B1A3.tmp"C:\Users\Admin\AppData\Local\Temp\B1A3.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\B201.tmp"C:\Users\Admin\AppData\Local\Temp\B201.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\B28D.tmp"C:\Users\Admin\AppData\Local\Temp\B28D.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\B30A.tmp"C:\Users\Admin\AppData\Local\Temp\B30A.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\B387.tmp"C:\Users\Admin\AppData\Local\Temp\B387.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\B3E4.tmp"C:\Users\Admin\AppData\Local\Temp\B3E4.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\B461.tmp"C:\Users\Admin\AppData\Local\Temp\B461.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\B4CE.tmp"C:\Users\Admin\AppData\Local\Temp\B4CE.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\B53B.tmp"C:\Users\Admin\AppData\Local\Temp\B53B.tmp"51⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\B5A9.tmp"C:\Users\Admin\AppData\Local\Temp\B5A9.tmp"52⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\B654.tmp"C:\Users\Admin\AppData\Local\Temp\B654.tmp"53⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\B6E1.tmp"C:\Users\Admin\AppData\Local\Temp\B6E1.tmp"54⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\B74E.tmp"C:\Users\Admin\AppData\Local\Temp\B74E.tmp"55⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\B7BB.tmp"C:\Users\Admin\AppData\Local\Temp\B7BB.tmp"56⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\B819.tmp"C:\Users\Admin\AppData\Local\Temp\B819.tmp"57⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\B8A5.tmp"C:\Users\Admin\AppData\Local\Temp\B8A5.tmp"58⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\B912.tmp"C:\Users\Admin\AppData\Local\Temp\B912.tmp"59⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\B98F.tmp"C:\Users\Admin\AppData\Local\Temp\B98F.tmp"60⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\BA1B.tmp"C:\Users\Admin\AppData\Local\Temp\BA1B.tmp"61⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\BA89.tmp"C:\Users\Admin\AppData\Local\Temp\BA89.tmp"62⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\BB05.tmp"C:\Users\Admin\AppData\Local\Temp\BB05.tmp"63⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\BB82.tmp"C:\Users\Admin\AppData\Local\Temp\BB82.tmp"64⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\BBEF.tmp"C:\Users\Admin\AppData\Local\Temp\BBEF.tmp"65⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\BC5D.tmp"C:\Users\Admin\AppData\Local\Temp\BC5D.tmp"66⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\BCD9.tmp"C:\Users\Admin\AppData\Local\Temp\BCD9.tmp"67⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\BD56.tmp"C:\Users\Admin\AppData\Local\Temp\BD56.tmp"68⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\BDB4.tmp"C:\Users\Admin\AppData\Local\Temp\BDB4.tmp"69⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\BE21.tmp"C:\Users\Admin\AppData\Local\Temp\BE21.tmp"70⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\BE8E.tmp"C:\Users\Admin\AppData\Local\Temp\BE8E.tmp"71⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\BF1B.tmp"C:\Users\Admin\AppData\Local\Temp\BF1B.tmp"72⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\BF88.tmp"C:\Users\Admin\AppData\Local\Temp\BF88.tmp"73⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\BFF5.tmp"C:\Users\Admin\AppData\Local\Temp\BFF5.tmp"74⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\C053.tmp"C:\Users\Admin\AppData\Local\Temp\C053.tmp"75⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"76⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"77⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"78⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\C217.tmp"C:\Users\Admin\AppData\Local\Temp\C217.tmp"79⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\C284.tmp"C:\Users\Admin\AppData\Local\Temp\C284.tmp"80⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\C2F1.tmp"C:\Users\Admin\AppData\Local\Temp\C2F1.tmp"81⤵PID:272
-
C:\Users\Admin\AppData\Local\Temp\C37E.tmp"C:\Users\Admin\AppData\Local\Temp\C37E.tmp"82⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\C3DB.tmp"C:\Users\Admin\AppData\Local\Temp\C3DB.tmp"83⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\C439.tmp"C:\Users\Admin\AppData\Local\Temp\C439.tmp"84⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\C4B6.tmp"C:\Users\Admin\AppData\Local\Temp\C4B6.tmp"85⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\C533.tmp"C:\Users\Admin\AppData\Local\Temp\C533.tmp"86⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\C5AF.tmp"C:\Users\Admin\AppData\Local\Temp\C5AF.tmp"87⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\C62C.tmp"C:\Users\Admin\AppData\Local\Temp\C62C.tmp"88⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\C699.tmp"C:\Users\Admin\AppData\Local\Temp\C699.tmp"89⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\C716.tmp"C:\Users\Admin\AppData\Local\Temp\C716.tmp"90⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\C783.tmp"C:\Users\Admin\AppData\Local\Temp\C783.tmp"91⤵PID:300
-
C:\Users\Admin\AppData\Local\Temp\C7F1.tmp"C:\Users\Admin\AppData\Local\Temp\C7F1.tmp"92⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\C85E.tmp"C:\Users\Admin\AppData\Local\Temp\C85E.tmp"93⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\C8DB.tmp"C:\Users\Admin\AppData\Local\Temp\C8DB.tmp"94⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\C948.tmp"C:\Users\Admin\AppData\Local\Temp\C948.tmp"95⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\C9C5.tmp"C:\Users\Admin\AppData\Local\Temp\C9C5.tmp"96⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\CADD.tmp"C:\Users\Admin\AppData\Local\Temp\CADD.tmp"97⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\CBB8.tmp"C:\Users\Admin\AppData\Local\Temp\CBB8.tmp"98⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\CC25.tmp"C:\Users\Admin\AppData\Local\Temp\CC25.tmp"99⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\CC92.tmp"C:\Users\Admin\AppData\Local\Temp\CC92.tmp"100⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\CCF0.tmp"C:\Users\Admin\AppData\Local\Temp\CCF0.tmp"101⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\CD3E.tmp"C:\Users\Admin\AppData\Local\Temp\CD3E.tmp"102⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\CDAB.tmp"C:\Users\Admin\AppData\Local\Temp\CDAB.tmp"103⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\CE18.tmp"C:\Users\Admin\AppData\Local\Temp\CE18.tmp"104⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\CE95.tmp"C:\Users\Admin\AppData\Local\Temp\CE95.tmp"105⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\CF02.tmp"C:\Users\Admin\AppData\Local\Temp\CF02.tmp"106⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\CF7F.tmp"C:\Users\Admin\AppData\Local\Temp\CF7F.tmp"107⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\CFEC.tmp"C:\Users\Admin\AppData\Local\Temp\CFEC.tmp"108⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\D069.tmp"C:\Users\Admin\AppData\Local\Temp\D069.tmp"109⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\D0E6.tmp"C:\Users\Admin\AppData\Local\Temp\D0E6.tmp"110⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\D153.tmp"C:\Users\Admin\AppData\Local\Temp\D153.tmp"111⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\D1C0.tmp"C:\Users\Admin\AppData\Local\Temp\D1C0.tmp"112⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\D20E.tmp"C:\Users\Admin\AppData\Local\Temp\D20E.tmp"113⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\D26C.tmp"C:\Users\Admin\AppData\Local\Temp\D26C.tmp"114⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\D2C9.tmp"C:\Users\Admin\AppData\Local\Temp\D2C9.tmp"115⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\D317.tmp"C:\Users\Admin\AppData\Local\Temp\D317.tmp"116⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\D385.tmp"C:\Users\Admin\AppData\Local\Temp\D385.tmp"117⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\D3D3.tmp"C:\Users\Admin\AppData\Local\Temp\D3D3.tmp"118⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\D440.tmp"C:\Users\Admin\AppData\Local\Temp\D440.tmp"119⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\D49D.tmp"C:\Users\Admin\AppData\Local\Temp\D49D.tmp"120⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\D4FB.tmp"C:\Users\Admin\AppData\Local\Temp\D4FB.tmp"121⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\D559.tmp"C:\Users\Admin\AppData\Local\Temp\D559.tmp"122⤵PID:3008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-