Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
25/08/2023, 13:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
910370ff3579409c498ef24dff6aa58c_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
910370ff3579409c498ef24dff6aa58c_mafia_JC.exe
Resource
win10v2004-20230824-en
2 signatures
150 seconds
General
-
Target
910370ff3579409c498ef24dff6aa58c_mafia_JC.exe
-
Size
488KB
-
MD5
910370ff3579409c498ef24dff6aa58c
-
SHA1
fbd131940166e5ebe418de036d0772cefb3aeecb
-
SHA256
7c151c0b19aba750432986e70105356442a70df36051beb47ff591a00246236d
-
SHA512
edddd4cba7801f1c454015de6091b0647b0dae762231b585f054ba8dd6dc8b25aad20a70edc79b03ae70a83b38eadcdab135ab1f1345c527e28414913f8e4428
-
SSDEEP
12288:/U5rCOTeiDJ5rjgMngjRadlhJSkUi/HUhUNZ:/UQOJDzgAkcbH/p/HFN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2124 7EFF.tmp 2504 7F8C.tmp 2836 80D3.tmp 2996 81EC.tmp 2080 8288.tmp 1528 8372.tmp 2916 843D.tmp 2872 8517.tmp 2712 85E2.tmp 2776 86AD.tmp 2464 87A7.tmp 872 8881.tmp 588 897B.tmp 548 8AA3.tmp 1340 8B8D.tmp 2300 8C87.tmp 2384 8D61.tmp 2284 8E2C.tmp 2420 8EE7.tmp 1952 901F.tmp 1764 9176.tmp 2928 9260.tmp 3004 932B.tmp 3036 93B7.tmp 2004 9415.tmp 1672 9492.tmp 1100 951E.tmp 2112 959B.tmp 1200 9608.tmp 2064 9685.tmp 472 96F2.tmp 2372 977F.tmp 2600 980B.tmp 2516 9888.tmp 1816 98F5.tmp 836 9981.tmp 1876 99FE.tmp 756 9A8B.tmp 1692 9B07.tmp 688 9B84.tmp 1360 9C01.tmp 1828 9C7E.tmp 2428 9CFB.tmp 1468 9D58.tmp 1908 9DC5.tmp 2536 9E33.tmp 2688 9EBF.tmp 1720 9F1D.tmp 752 9F8A.tmp 328 A007.tmp 1552 A074.tmp 1708 A0E1.tmp 1168 A14E.tmp 2164 A1CB.tmp 1608 A248.tmp 2908 A2D4.tmp 2068 A351.tmp 2124 A3CE.tmp 2948 A44B.tmp 2952 A4B8.tmp 2836 A525.tmp 2020 A592.tmp 2924 A6BB.tmp 2920 A757.tmp -
Loads dropped DLL 64 IoCs
pid Process 860 910370ff3579409c498ef24dff6aa58c_mafia_JC.exe 2124 7EFF.tmp 2504 7F8C.tmp 2836 80D3.tmp 2996 81EC.tmp 2080 8288.tmp 1528 8372.tmp 2916 843D.tmp 2872 8517.tmp 2712 85E2.tmp 2776 86AD.tmp 2464 87A7.tmp 872 8881.tmp 588 897B.tmp 548 8AA3.tmp 1340 8B8D.tmp 2300 8C87.tmp 2384 8D61.tmp 2284 8E2C.tmp 2420 8EE7.tmp 1952 901F.tmp 1764 9176.tmp 2928 9260.tmp 3004 932B.tmp 3036 93B7.tmp 2004 9415.tmp 1672 9492.tmp 1100 951E.tmp 2112 959B.tmp 1200 9608.tmp 2064 9685.tmp 472 96F2.tmp 2372 977F.tmp 2600 980B.tmp 2516 9888.tmp 1816 98F5.tmp 836 9981.tmp 1876 99FE.tmp 756 9A8B.tmp 1692 9B07.tmp 688 9B84.tmp 1360 9C01.tmp 1828 9C7E.tmp 2428 9CFB.tmp 1468 9D58.tmp 1908 9DC5.tmp 2536 9E33.tmp 2688 9EBF.tmp 1720 9F1D.tmp 752 9F8A.tmp 328 A007.tmp 1552 A074.tmp 1708 A0E1.tmp 1168 A14E.tmp 2164 A1CB.tmp 1608 A248.tmp 2908 A2D4.tmp 2068 A351.tmp 2124 A3CE.tmp 2948 A44B.tmp 2952 A4B8.tmp 2836 A525.tmp 2020 A592.tmp 2924 A6BB.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 860 wrote to memory of 2124 860 910370ff3579409c498ef24dff6aa58c_mafia_JC.exe 13 PID 860 wrote to memory of 2124 860 910370ff3579409c498ef24dff6aa58c_mafia_JC.exe 13 PID 860 wrote to memory of 2124 860 910370ff3579409c498ef24dff6aa58c_mafia_JC.exe 13 PID 860 wrote to memory of 2124 860 910370ff3579409c498ef24dff6aa58c_mafia_JC.exe 13 PID 2124 wrote to memory of 2504 2124 7EFF.tmp 12 PID 2124 wrote to memory of 2504 2124 7EFF.tmp 12 PID 2124 wrote to memory of 2504 2124 7EFF.tmp 12 PID 2124 wrote to memory of 2504 2124 7EFF.tmp 12 PID 2504 wrote to memory of 2836 2504 7F8C.tmp 11 PID 2504 wrote to memory of 2836 2504 7F8C.tmp 11 PID 2504 wrote to memory of 2836 2504 7F8C.tmp 11 PID 2504 wrote to memory of 2836 2504 7F8C.tmp 11 PID 2836 wrote to memory of 2996 2836 80D3.tmp 10 PID 2836 wrote to memory of 2996 2836 80D3.tmp 10 PID 2836 wrote to memory of 2996 2836 80D3.tmp 10 PID 2836 wrote to memory of 2996 2836 80D3.tmp 10 PID 2996 wrote to memory of 2080 2996 81EC.tmp 9 PID 2996 wrote to memory of 2080 2996 81EC.tmp 9 PID 2996 wrote to memory of 2080 2996 81EC.tmp 9 PID 2996 wrote to memory of 2080 2996 81EC.tmp 9 PID 2080 wrote to memory of 1528 2080 8288.tmp 8 PID 2080 wrote to memory of 1528 2080 8288.tmp 8 PID 2080 wrote to memory of 1528 2080 8288.tmp 8 PID 2080 wrote to memory of 1528 2080 8288.tmp 8 PID 1528 wrote to memory of 2916 1528 8372.tmp 7 PID 1528 wrote to memory of 2916 1528 8372.tmp 7 PID 1528 wrote to memory of 2916 1528 8372.tmp 7 PID 1528 wrote to memory of 2916 1528 8372.tmp 7 PID 2916 wrote to memory of 2872 2916 843D.tmp 6 PID 2916 wrote to memory of 2872 2916 843D.tmp 6 PID 2916 wrote to memory of 2872 2916 843D.tmp 6 PID 2916 wrote to memory of 2872 2916 843D.tmp 6 PID 2872 wrote to memory of 2712 2872 8517.tmp 5 PID 2872 wrote to memory of 2712 2872 8517.tmp 5 PID 2872 wrote to memory of 2712 2872 8517.tmp 5 PID 2872 wrote to memory of 2712 2872 8517.tmp 5 PID 2712 wrote to memory of 2776 2712 85E2.tmp 4 PID 2712 wrote to memory of 2776 2712 85E2.tmp 4 PID 2712 wrote to memory of 2776 2712 85E2.tmp 4 PID 2712 wrote to memory of 2776 2712 85E2.tmp 4 PID 2776 wrote to memory of 2464 2776 86AD.tmp 3 PID 2776 wrote to memory of 2464 2776 86AD.tmp 3 PID 2776 wrote to memory of 2464 2776 86AD.tmp 3 PID 2776 wrote to memory of 2464 2776 86AD.tmp 3 PID 2464 wrote to memory of 872 2464 87A7.tmp 2 PID 2464 wrote to memory of 872 2464 87A7.tmp 2 PID 2464 wrote to memory of 872 2464 87A7.tmp 2 PID 2464 wrote to memory of 872 2464 87A7.tmp 2 PID 872 wrote to memory of 588 872 8881.tmp 1 PID 872 wrote to memory of 588 872 8881.tmp 1 PID 872 wrote to memory of 588 872 8881.tmp 1 PID 872 wrote to memory of 588 872 8881.tmp 1 PID 588 wrote to memory of 548 588 897B.tmp 41 PID 588 wrote to memory of 548 588 897B.tmp 41 PID 588 wrote to memory of 548 588 897B.tmp 41 PID 588 wrote to memory of 548 588 897B.tmp 41 PID 548 wrote to memory of 1340 548 8AA3.tmp 42 PID 548 wrote to memory of 1340 548 8AA3.tmp 42 PID 548 wrote to memory of 1340 548 8AA3.tmp 42 PID 548 wrote to memory of 1340 548 8AA3.tmp 42 PID 1340 wrote to memory of 2300 1340 8B8D.tmp 43 PID 1340 wrote to memory of 2300 1340 8B8D.tmp 43 PID 1340 wrote to memory of 2300 1340 8B8D.tmp 43 PID 1340 wrote to memory of 2300 1340 8B8D.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\897B.tmp"C:\Users\Admin\AppData\Local\Temp\897B.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:588 -
C:\Users\Admin\AppData\Local\Temp\8AA3.tmp"C:\Users\Admin\AppData\Local\Temp\8AA3.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\8B8D.tmp"C:\Users\Admin\AppData\Local\Temp\8B8D.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\8C87.tmp"C:\Users\Admin\AppData\Local\Temp\8C87.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\8D61.tmp"C:\Users\Admin\AppData\Local\Temp\8D61.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\8E2C.tmp"C:\Users\Admin\AppData\Local\Temp\8E2C.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\8EE7.tmp"C:\Users\Admin\AppData\Local\Temp\8EE7.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\901F.tmp"C:\Users\Admin\AppData\Local\Temp\901F.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\9176.tmp"C:\Users\Admin\AppData\Local\Temp\9176.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\9260.tmp"C:\Users\Admin\AppData\Local\Temp\9260.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\932B.tmp"C:\Users\Admin\AppData\Local\Temp\932B.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\93B7.tmp"C:\Users\Admin\AppData\Local\Temp\93B7.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\9415.tmp"C:\Users\Admin\AppData\Local\Temp\9415.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\9492.tmp"C:\Users\Admin\AppData\Local\Temp\9492.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\951E.tmp"C:\Users\Admin\AppData\Local\Temp\951E.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\959B.tmp"C:\Users\Admin\AppData\Local\Temp\959B.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\9608.tmp"C:\Users\Admin\AppData\Local\Temp\9608.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\9685.tmp"C:\Users\Admin\AppData\Local\Temp\9685.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\96F2.tmp"C:\Users\Admin\AppData\Local\Temp\96F2.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:472 -
C:\Users\Admin\AppData\Local\Temp\977F.tmp"C:\Users\Admin\AppData\Local\Temp\977F.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\980B.tmp"C:\Users\Admin\AppData\Local\Temp\980B.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\9888.tmp"C:\Users\Admin\AppData\Local\Temp\9888.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\98F5.tmp"C:\Users\Admin\AppData\Local\Temp\98F5.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:836 -
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\9A8B.tmp"C:\Users\Admin\AppData\Local\Temp\9A8B.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:756 -
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:688 -
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\9D58.tmp"C:\Users\Admin\AppData\Local\Temp\9D58.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\9DC5.tmp"C:\Users\Admin\AppData\Local\Temp\9DC5.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\9E33.tmp"C:\Users\Admin\AppData\Local\Temp\9E33.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\9EBF.tmp"C:\Users\Admin\AppData\Local\Temp\9EBF.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\9F1D.tmp"C:\Users\Admin\AppData\Local\Temp\9F1D.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\9F8A.tmp"C:\Users\Admin\AppData\Local\Temp\9F8A.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:752 -
C:\Users\Admin\AppData\Local\Temp\A007.tmp"C:\Users\Admin\AppData\Local\Temp\A007.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:328 -
C:\Users\Admin\AppData\Local\Temp\A074.tmp"C:\Users\Admin\AppData\Local\Temp\A074.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\A0E1.tmp"C:\Users\Admin\AppData\Local\Temp\A0E1.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\A14E.tmp"C:\Users\Admin\AppData\Local\Temp\A14E.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\A1CB.tmp"C:\Users\Admin\AppData\Local\Temp\A1CB.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\A248.tmp"C:\Users\Admin\AppData\Local\Temp\A248.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\A2D4.tmp"C:\Users\Admin\AppData\Local\Temp\A2D4.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\A351.tmp"C:\Users\Admin\AppData\Local\Temp\A351.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\A3CE.tmp"C:\Users\Admin\AppData\Local\Temp\A3CE.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\A44B.tmp"C:\Users\Admin\AppData\Local\Temp\A44B.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\A4B8.tmp"C:\Users\Admin\AppData\Local\Temp\A4B8.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\A525.tmp"C:\Users\Admin\AppData\Local\Temp\A525.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\A592.tmp"C:\Users\Admin\AppData\Local\Temp\A592.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\A757.tmp"C:\Users\Admin\AppData\Local\Temp\A757.tmp"52⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\A7E3.tmp"C:\Users\Admin\AppData\Local\Temp\A7E3.tmp"53⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\A850.tmp"C:\Users\Admin\AppData\Local\Temp\A850.tmp"54⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\A8BD.tmp"C:\Users\Admin\AppData\Local\Temp\A8BD.tmp"55⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\A93A.tmp"C:\Users\Admin\AppData\Local\Temp\A93A.tmp"56⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\A9A7.tmp"C:\Users\Admin\AppData\Local\Temp\A9A7.tmp"57⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\AA05.tmp"C:\Users\Admin\AppData\Local\Temp\AA05.tmp"58⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\AA72.tmp"C:\Users\Admin\AppData\Local\Temp\AA72.tmp"59⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\AAEF.tmp"C:\Users\Admin\AppData\Local\Temp\AAEF.tmp"60⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\AB5C.tmp"C:\Users\Admin\AppData\Local\Temp\AB5C.tmp"61⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\ABC9.tmp"C:\Users\Admin\AppData\Local\Temp\ABC9.tmp"62⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\AC37.tmp"C:\Users\Admin\AppData\Local\Temp\AC37.tmp"63⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\ACA4.tmp"C:\Users\Admin\AppData\Local\Temp\ACA4.tmp"64⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\AD11.tmp"C:\Users\Admin\AppData\Local\Temp\AD11.tmp"65⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\AD7E.tmp"C:\Users\Admin\AppData\Local\Temp\AD7E.tmp"66⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\ADFB.tmp"C:\Users\Admin\AppData\Local\Temp\ADFB.tmp"67⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\AE68.tmp"C:\Users\Admin\AppData\Local\Temp\AE68.tmp"68⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\AED5.tmp"C:\Users\Admin\AppData\Local\Temp\AED5.tmp"69⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\AF43.tmp"C:\Users\Admin\AppData\Local\Temp\AF43.tmp"70⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\AFB0.tmp"C:\Users\Admin\AppData\Local\Temp\AFB0.tmp"71⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\B00D.tmp"C:\Users\Admin\AppData\Local\Temp\B00D.tmp"72⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\B06B.tmp"C:\Users\Admin\AppData\Local\Temp\B06B.tmp"73⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\B0E8.tmp"C:\Users\Admin\AppData\Local\Temp\B0E8.tmp"74⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\B165.tmp"C:\Users\Admin\AppData\Local\Temp\B165.tmp"75⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"76⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\B25E.tmp"C:\Users\Admin\AppData\Local\Temp\B25E.tmp"77⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\B2CB.tmp"C:\Users\Admin\AppData\Local\Temp\B2CB.tmp"78⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\B329.tmp"C:\Users\Admin\AppData\Local\Temp\B329.tmp"79⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\B3B5.tmp"C:\Users\Admin\AppData\Local\Temp\B3B5.tmp"80⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\B423.tmp"C:\Users\Admin\AppData\Local\Temp\B423.tmp"81⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\B490.tmp"C:\Users\Admin\AppData\Local\Temp\B490.tmp"82⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\B4FD.tmp"C:\Users\Admin\AppData\Local\Temp\B4FD.tmp"83⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\B55B.tmp"C:\Users\Admin\AppData\Local\Temp\B55B.tmp"84⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\B5B8.tmp"C:\Users\Admin\AppData\Local\Temp\B5B8.tmp"85⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\B625.tmp"C:\Users\Admin\AppData\Local\Temp\B625.tmp"86⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\B6C1.tmp"C:\Users\Admin\AppData\Local\Temp\B6C1.tmp"87⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\B72F.tmp"C:\Users\Admin\AppData\Local\Temp\B72F.tmp"88⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\B7AB.tmp"C:\Users\Admin\AppData\Local\Temp\B7AB.tmp"89⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\B809.tmp"C:\Users\Admin\AppData\Local\Temp\B809.tmp"90⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\B886.tmp"C:\Users\Admin\AppData\Local\Temp\B886.tmp"91⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\B8F3.tmp"C:\Users\Admin\AppData\Local\Temp\B8F3.tmp"92⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\B960.tmp"C:\Users\Admin\AppData\Local\Temp\B960.tmp"93⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\B9DD.tmp"C:\Users\Admin\AppData\Local\Temp\B9DD.tmp"94⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\BA3B.tmp"C:\Users\Admin\AppData\Local\Temp\BA3B.tmp"95⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\BAB7.tmp"C:\Users\Admin\AppData\Local\Temp\BAB7.tmp"96⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\BB15.tmp"C:\Users\Admin\AppData\Local\Temp\BB15.tmp"97⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\BB82.tmp"C:\Users\Admin\AppData\Local\Temp\BB82.tmp"98⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\BC2E.tmp"C:\Users\Admin\AppData\Local\Temp\BC2E.tmp"99⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\BCAB.tmp"C:\Users\Admin\AppData\Local\Temp\BCAB.tmp"100⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\BD18.tmp"C:\Users\Admin\AppData\Local\Temp\BD18.tmp"101⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\BD95.tmp"C:\Users\Admin\AppData\Local\Temp\BD95.tmp"102⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\BE02.tmp"C:\Users\Admin\AppData\Local\Temp\BE02.tmp"103⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\BE7F.tmp"C:\Users\Admin\AppData\Local\Temp\BE7F.tmp"104⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\BEDC.tmp"C:\Users\Admin\AppData\Local\Temp\BEDC.tmp"105⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\BF3A.tmp"C:\Users\Admin\AppData\Local\Temp\BF3A.tmp"106⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\BFA7.tmp"C:\Users\Admin\AppData\Local\Temp\BFA7.tmp"107⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"108⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\C0A1.tmp"C:\Users\Admin\AppData\Local\Temp\C0A1.tmp"109⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\C11D.tmp"C:\Users\Admin\AppData\Local\Temp\C11D.tmp"110⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"111⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\C207.tmp"C:\Users\Admin\AppData\Local\Temp\C207.tmp"112⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\C275.tmp"C:\Users\Admin\AppData\Local\Temp\C275.tmp"113⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"114⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\C34F.tmp"C:\Users\Admin\AppData\Local\Temp\C34F.tmp"115⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\C3BC.tmp"C:\Users\Admin\AppData\Local\Temp\C3BC.tmp"116⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\C439.tmp"C:\Users\Admin\AppData\Local\Temp\C439.tmp"117⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\C4A6.tmp"C:\Users\Admin\AppData\Local\Temp\C4A6.tmp"118⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\C513.tmp"C:\Users\Admin\AppData\Local\Temp\C513.tmp"119⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\C590.tmp"C:\Users\Admin\AppData\Local\Temp\C590.tmp"120⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\C5FD.tmp"C:\Users\Admin\AppData\Local\Temp\C5FD.tmp"121⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\C65B.tmp"C:\Users\Admin\AppData\Local\Temp\C65B.tmp"122⤵PID:2912
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-