Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
28/08/2023, 19:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cb8ee32ebec9a652556476c82e500e27_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
cb8ee32ebec9a652556476c82e500e27_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
cb8ee32ebec9a652556476c82e500e27_mafia_JC.exe
-
Size
527KB
-
MD5
cb8ee32ebec9a652556476c82e500e27
-
SHA1
c3eb365d6111a43443cfede88577df4230a19c47
-
SHA256
9c86226b628a87b4a21e0b09fc4b73487ff10fd585631be100b7a3c2a748c30f
-
SHA512
aa292ed77900bda9ef356643af27dd247adcf4242946a331966c6b59b16608100f6c6d3e9269fa7cd49c1359eeee207057b0defdf59517100738caefaab11f96
-
SSDEEP
12288:fU5rCOTeidmZLLpWzMwAg3juL2O6KDZu:fUQOJdOvpBw3DKDo
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2896 6BCD.tmp 2816 6C3B.tmp 2912 6CB7.tmp 2944 6D34.tmp 2988 6DD0.tmp 2736 6E4D.tmp 2936 6EE9.tmp 2708 6F66.tmp 2772 6FF2.tmp 3004 707F.tmp 2688 70EC.tmp 268 7188.tmp 1428 71F5.tmp 936 7281.tmp 3032 730E.tmp 1592 73AA.tmp 1084 7436.tmp 1884 74D2.tmp 1632 755F.tmp 1948 75FB.tmp 884 7658.tmp 852 76B6.tmp 2956 7723.tmp 1120 77BF.tmp 1144 785B.tmp 304 78E7.tmp 1704 7974.tmp 1560 7A2F.tmp 1528 7AAC.tmp 2300 7B09.tmp 2368 7B96.tmp 2476 7C03.tmp 2504 7C70.tmp 1524 7CFD.tmp 1060 7DF6.tmp 2324 7EE0.tmp 1512 7F8C.tmp 2040 8037.tmp 2008 80A5.tmp 272 8112.tmp 2044 817F.tmp 2460 81EC.tmp 868 8259.tmp 1860 82B7.tmp 1652 8324.tmp 700 8391.tmp 624 840E.tmp 1476 847B.tmp 1620 84F8.tmp 2624 8575.tmp 3060 8601.tmp 2348 868E.tmp 1920 870B.tmp 2384 8778.tmp 1572 87F5.tmp 1712 8862.tmp 2800 88DF.tmp 1928 894C.tmp 2924 89B9.tmp 2920 8A17.tmp 2832 8A93.tmp 2160 8B10.tmp 2844 8B7D.tmp 1936 8BFA.tmp -
Loads dropped DLL 64 IoCs
pid Process 1880 cb8ee32ebec9a652556476c82e500e27_mafia_JC.exe 2896 6BCD.tmp 2816 6C3B.tmp 2912 6CB7.tmp 2944 6D34.tmp 2988 6DD0.tmp 2736 6E4D.tmp 2936 6EE9.tmp 2708 6F66.tmp 2772 6FF2.tmp 3004 707F.tmp 2688 70EC.tmp 268 7188.tmp 1428 71F5.tmp 936 7281.tmp 3032 730E.tmp 1592 73AA.tmp 1084 7436.tmp 1884 74D2.tmp 1632 755F.tmp 1948 75FB.tmp 884 7658.tmp 852 76B6.tmp 2956 7723.tmp 1120 77BF.tmp 1144 785B.tmp 304 78E7.tmp 1704 7974.tmp 1560 7A2F.tmp 1528 7AAC.tmp 2300 7B09.tmp 2368 7B96.tmp 2476 7C03.tmp 2504 7C70.tmp 1524 7CFD.tmp 1060 7DF6.tmp 2324 7EE0.tmp 1512 7F8C.tmp 2040 8037.tmp 2008 80A5.tmp 272 8112.tmp 2044 817F.tmp 2460 81EC.tmp 868 8259.tmp 1860 82B7.tmp 1652 8324.tmp 700 8391.tmp 624 840E.tmp 1476 847B.tmp 1620 84F8.tmp 2624 8575.tmp 3060 8601.tmp 2348 868E.tmp 1920 870B.tmp 2384 8778.tmp 1572 87F5.tmp 1712 8862.tmp 2800 88DF.tmp 1928 894C.tmp 2924 89B9.tmp 2920 8A17.tmp 2832 8A93.tmp 2160 8B10.tmp 2844 8B7D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1880 wrote to memory of 2896 1880 cb8ee32ebec9a652556476c82e500e27_mafia_JC.exe 28 PID 1880 wrote to memory of 2896 1880 cb8ee32ebec9a652556476c82e500e27_mafia_JC.exe 28 PID 1880 wrote to memory of 2896 1880 cb8ee32ebec9a652556476c82e500e27_mafia_JC.exe 28 PID 1880 wrote to memory of 2896 1880 cb8ee32ebec9a652556476c82e500e27_mafia_JC.exe 28 PID 2896 wrote to memory of 2816 2896 6BCD.tmp 29 PID 2896 wrote to memory of 2816 2896 6BCD.tmp 29 PID 2896 wrote to memory of 2816 2896 6BCD.tmp 29 PID 2896 wrote to memory of 2816 2896 6BCD.tmp 29 PID 2816 wrote to memory of 2912 2816 6C3B.tmp 30 PID 2816 wrote to memory of 2912 2816 6C3B.tmp 30 PID 2816 wrote to memory of 2912 2816 6C3B.tmp 30 PID 2816 wrote to memory of 2912 2816 6C3B.tmp 30 PID 2912 wrote to memory of 2944 2912 6CB7.tmp 31 PID 2912 wrote to memory of 2944 2912 6CB7.tmp 31 PID 2912 wrote to memory of 2944 2912 6CB7.tmp 31 PID 2912 wrote to memory of 2944 2912 6CB7.tmp 31 PID 2944 wrote to memory of 2988 2944 6D34.tmp 32 PID 2944 wrote to memory of 2988 2944 6D34.tmp 32 PID 2944 wrote to memory of 2988 2944 6D34.tmp 32 PID 2944 wrote to memory of 2988 2944 6D34.tmp 32 PID 2988 wrote to memory of 2736 2988 6DD0.tmp 33 PID 2988 wrote to memory of 2736 2988 6DD0.tmp 33 PID 2988 wrote to memory of 2736 2988 6DD0.tmp 33 PID 2988 wrote to memory of 2736 2988 6DD0.tmp 33 PID 2736 wrote to memory of 2936 2736 6E4D.tmp 34 PID 2736 wrote to memory of 2936 2736 6E4D.tmp 34 PID 2736 wrote to memory of 2936 2736 6E4D.tmp 34 PID 2736 wrote to memory of 2936 2736 6E4D.tmp 34 PID 2936 wrote to memory of 2708 2936 6EE9.tmp 35 PID 2936 wrote to memory of 2708 2936 6EE9.tmp 35 PID 2936 wrote to memory of 2708 2936 6EE9.tmp 35 PID 2936 wrote to memory of 2708 2936 6EE9.tmp 35 PID 2708 wrote to memory of 2772 2708 6F66.tmp 52 PID 2708 wrote to memory of 2772 2708 6F66.tmp 52 PID 2708 wrote to memory of 2772 2708 6F66.tmp 52 PID 2708 wrote to memory of 2772 2708 6F66.tmp 52 PID 2772 wrote to memory of 3004 2772 6FF2.tmp 51 PID 2772 wrote to memory of 3004 2772 6FF2.tmp 51 PID 2772 wrote to memory of 3004 2772 6FF2.tmp 51 PID 2772 wrote to memory of 3004 2772 6FF2.tmp 51 PID 3004 wrote to memory of 2688 3004 707F.tmp 50 PID 3004 wrote to memory of 2688 3004 707F.tmp 50 PID 3004 wrote to memory of 2688 3004 707F.tmp 50 PID 3004 wrote to memory of 2688 3004 707F.tmp 50 PID 2688 wrote to memory of 268 2688 70EC.tmp 49 PID 2688 wrote to memory of 268 2688 70EC.tmp 49 PID 2688 wrote to memory of 268 2688 70EC.tmp 49 PID 2688 wrote to memory of 268 2688 70EC.tmp 49 PID 268 wrote to memory of 1428 268 7188.tmp 48 PID 268 wrote to memory of 1428 268 7188.tmp 48 PID 268 wrote to memory of 1428 268 7188.tmp 48 PID 268 wrote to memory of 1428 268 7188.tmp 48 PID 1428 wrote to memory of 936 1428 71F5.tmp 47 PID 1428 wrote to memory of 936 1428 71F5.tmp 47 PID 1428 wrote to memory of 936 1428 71F5.tmp 47 PID 1428 wrote to memory of 936 1428 71F5.tmp 47 PID 936 wrote to memory of 3032 936 7281.tmp 46 PID 936 wrote to memory of 3032 936 7281.tmp 46 PID 936 wrote to memory of 3032 936 7281.tmp 46 PID 936 wrote to memory of 3032 936 7281.tmp 46 PID 3032 wrote to memory of 1592 3032 730E.tmp 45 PID 3032 wrote to memory of 1592 3032 730E.tmp 45 PID 3032 wrote to memory of 1592 3032 730E.tmp 45 PID 3032 wrote to memory of 1592 3032 730E.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb8ee32ebec9a652556476c82e500e27_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\cb8ee32ebec9a652556476c82e500e27_mafia_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\6BCD.tmp"C:\Users\Admin\AppData\Local\Temp\6BCD.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\6C3B.tmp"C:\Users\Admin\AppData\Local\Temp\6C3B.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\6CB7.tmp"C:\Users\Admin\AppData\Local\Temp\6CB7.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\6D34.tmp"C:\Users\Admin\AppData\Local\Temp\6D34.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\6DD0.tmp"C:\Users\Admin\AppData\Local\Temp\6DD0.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\6E4D.tmp"C:\Users\Admin\AppData\Local\Temp\6E4D.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\6EE9.tmp"C:\Users\Admin\AppData\Local\Temp\6EE9.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\6F66.tmp"C:\Users\Admin\AppData\Local\Temp\6F66.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\6FF2.tmp"C:\Users\Admin\AppData\Local\Temp\6FF2.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884
-
-
C:\Users\Admin\AppData\Local\Temp\7723.tmp"C:\Users\Admin\AppData\Local\Temp\7723.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\77BF.tmp"C:\Users\Admin\AppData\Local\Temp\77BF.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\785B.tmp"C:\Users\Admin\AppData\Local\Temp\785B.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\78E7.tmp"C:\Users\Admin\AppData\Local\Temp\78E7.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:304 -
C:\Users\Admin\AppData\Local\Temp\7974.tmp"C:\Users\Admin\AppData\Local\Temp\7974.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\7A2F.tmp"C:\Users\Admin\AppData\Local\Temp\7A2F.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\7AAC.tmp"C:\Users\Admin\AppData\Local\Temp\7AAC.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\7B09.tmp"C:\Users\Admin\AppData\Local\Temp\7B09.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\7B96.tmp"C:\Users\Admin\AppData\Local\Temp\7B96.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\7C03.tmp"C:\Users\Admin\AppData\Local\Temp\7C03.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\7C70.tmp"C:\Users\Admin\AppData\Local\Temp\7C70.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\7CFD.tmp"C:\Users\Admin\AppData\Local\Temp\7CFD.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\7DF6.tmp"C:\Users\Admin\AppData\Local\Temp\7DF6.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\7EE0.tmp"C:\Users\Admin\AppData\Local\Temp\7EE0.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\7F8C.tmp"C:\Users\Admin\AppData\Local\Temp\7F8C.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\8037.tmp"C:\Users\Admin\AppData\Local\Temp\8037.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\80A5.tmp"C:\Users\Admin\AppData\Local\Temp\80A5.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\8112.tmp"C:\Users\Admin\AppData\Local\Temp\8112.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:272 -
C:\Users\Admin\AppData\Local\Temp\817F.tmp"C:\Users\Admin\AppData\Local\Temp\817F.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\81EC.tmp"C:\Users\Admin\AppData\Local\Temp\81EC.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\8259.tmp"C:\Users\Admin\AppData\Local\Temp\8259.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:868 -
C:\Users\Admin\AppData\Local\Temp\82B7.tmp"C:\Users\Admin\AppData\Local\Temp\82B7.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\8324.tmp"C:\Users\Admin\AppData\Local\Temp\8324.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\8391.tmp"C:\Users\Admin\AppData\Local\Temp\8391.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:700 -
C:\Users\Admin\AppData\Local\Temp\840E.tmp"C:\Users\Admin\AppData\Local\Temp\840E.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:624 -
C:\Users\Admin\AppData\Local\Temp\847B.tmp"C:\Users\Admin\AppData\Local\Temp\847B.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\84F8.tmp"C:\Users\Admin\AppData\Local\Temp\84F8.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\8575.tmp"C:\Users\Admin\AppData\Local\Temp\8575.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\8601.tmp"C:\Users\Admin\AppData\Local\Temp\8601.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\868E.tmp"C:\Users\Admin\AppData\Local\Temp\868E.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\870B.tmp"C:\Users\Admin\AppData\Local\Temp\870B.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\8778.tmp"C:\Users\Admin\AppData\Local\Temp\8778.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\87F5.tmp"C:\Users\Admin\AppData\Local\Temp\87F5.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\8862.tmp"C:\Users\Admin\AppData\Local\Temp\8862.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\88DF.tmp"C:\Users\Admin\AppData\Local\Temp\88DF.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\894C.tmp"C:\Users\Admin\AppData\Local\Temp\894C.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\89B9.tmp"C:\Users\Admin\AppData\Local\Temp\89B9.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\8A17.tmp"C:\Users\Admin\AppData\Local\Temp\8A17.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\8A93.tmp"C:\Users\Admin\AppData\Local\Temp\8A93.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\8B10.tmp"C:\Users\Admin\AppData\Local\Temp\8B10.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"42⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\8C77.tmp"C:\Users\Admin\AppData\Local\Temp\8C77.tmp"43⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\8D03.tmp"C:\Users\Admin\AppData\Local\Temp\8D03.tmp"44⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\8D80.tmp"C:\Users\Admin\AppData\Local\Temp\8D80.tmp"45⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\8DFD.tmp"C:\Users\Admin\AppData\Local\Temp\8DFD.tmp"46⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\8E89.tmp"C:\Users\Admin\AppData\Local\Temp\8E89.tmp"47⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\8F16.tmp"C:\Users\Admin\AppData\Local\Temp\8F16.tmp"48⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\8F83.tmp"C:\Users\Admin\AppData\Local\Temp\8F83.tmp"49⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\9000.tmp"C:\Users\Admin\AppData\Local\Temp\9000.tmp"50⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\906D.tmp"C:\Users\Admin\AppData\Local\Temp\906D.tmp"51⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\90EA.tmp"C:\Users\Admin\AppData\Local\Temp\90EA.tmp"52⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\9167.tmp"C:\Users\Admin\AppData\Local\Temp\9167.tmp"53⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\91C4.tmp"C:\Users\Admin\AppData\Local\Temp\91C4.tmp"54⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\9231.tmp"C:\Users\Admin\AppData\Local\Temp\9231.tmp"55⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\93B7.tmp"C:\Users\Admin\AppData\Local\Temp\93B7.tmp"56⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\9415.tmp"C:\Users\Admin\AppData\Local\Temp\9415.tmp"57⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\94C1.tmp"C:\Users\Admin\AppData\Local\Temp\94C1.tmp"58⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\952E.tmp"C:\Users\Admin\AppData\Local\Temp\952E.tmp"59⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\958B.tmp"C:\Users\Admin\AppData\Local\Temp\958B.tmp"60⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\9608.tmp"C:\Users\Admin\AppData\Local\Temp\9608.tmp"61⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\9685.tmp"C:\Users\Admin\AppData\Local\Temp\9685.tmp"62⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\96F2.tmp"C:\Users\Admin\AppData\Local\Temp\96F2.tmp"63⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\975F.tmp"C:\Users\Admin\AppData\Local\Temp\975F.tmp"64⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\97CD.tmp"C:\Users\Admin\AppData\Local\Temp\97CD.tmp"65⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\983A.tmp"C:\Users\Admin\AppData\Local\Temp\983A.tmp"66⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\98B7.tmp"C:\Users\Admin\AppData\Local\Temp\98B7.tmp"67⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\9924.tmp"C:\Users\Admin\AppData\Local\Temp\9924.tmp"68⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"69⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\99EF.tmp"C:\Users\Admin\AppData\Local\Temp\99EF.tmp"70⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"71⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"72⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"73⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"74⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\9C20.tmp"C:\Users\Admin\AppData\Local\Temp\9C20.tmp"75⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"76⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\9D0A.tmp"C:\Users\Admin\AppData\Local\Temp\9D0A.tmp"77⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\9D68.tmp"C:\Users\Admin\AppData\Local\Temp\9D68.tmp"78⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\9DD5.tmp"C:\Users\Admin\AppData\Local\Temp\9DD5.tmp"79⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\9E52.tmp"C:\Users\Admin\AppData\Local\Temp\9E52.tmp"80⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\9EBF.tmp"C:\Users\Admin\AppData\Local\Temp\9EBF.tmp"81⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\9F4B.tmp"C:\Users\Admin\AppData\Local\Temp\9F4B.tmp"82⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\9FA9.tmp"C:\Users\Admin\AppData\Local\Temp\9FA9.tmp"83⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\9FE7.tmp"C:\Users\Admin\AppData\Local\Temp\9FE7.tmp"84⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\A064.tmp"C:\Users\Admin\AppData\Local\Temp\A064.tmp"85⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\A0E1.tmp"C:\Users\Admin\AppData\Local\Temp\A0E1.tmp"86⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\A14E.tmp"C:\Users\Admin\AppData\Local\Temp\A14E.tmp"87⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\A1AC.tmp"C:\Users\Admin\AppData\Local\Temp\A1AC.tmp"88⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\A229.tmp"C:\Users\Admin\AppData\Local\Temp\A229.tmp"89⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\A2B5.tmp"C:\Users\Admin\AppData\Local\Temp\A2B5.tmp"90⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\A322.tmp"C:\Users\Admin\AppData\Local\Temp\A322.tmp"91⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\A370.tmp"C:\Users\Admin\AppData\Local\Temp\A370.tmp"92⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\A3DD.tmp"C:\Users\Admin\AppData\Local\Temp\A3DD.tmp"93⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\A479.tmp"C:\Users\Admin\AppData\Local\Temp\A479.tmp"94⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\A4D7.tmp"C:\Users\Admin\AppData\Local\Temp\A4D7.tmp"95⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\A544.tmp"C:\Users\Admin\AppData\Local\Temp\A544.tmp"96⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"97⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\A62E.tmp"C:\Users\Admin\AppData\Local\Temp\A62E.tmp"98⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\A6AB.tmp"C:\Users\Admin\AppData\Local\Temp\A6AB.tmp"99⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\A747.tmp"C:\Users\Admin\AppData\Local\Temp\A747.tmp"100⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\A7B4.tmp"C:\Users\Admin\AppData\Local\Temp\A7B4.tmp"101⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\A8FC.tmp"C:\Users\Admin\AppData\Local\Temp\A8FC.tmp"102⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\A998.tmp"C:\Users\Admin\AppData\Local\Temp\A998.tmp"103⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\AA05.tmp"C:\Users\Admin\AppData\Local\Temp\AA05.tmp"104⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\AA63.tmp"C:\Users\Admin\AppData\Local\Temp\AA63.tmp"105⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\AAC0.tmp"C:\Users\Admin\AppData\Local\Temp\AAC0.tmp"106⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\AB3D.tmp"C:\Users\Admin\AppData\Local\Temp\AB3D.tmp"107⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\ABAA.tmp"C:\Users\Admin\AppData\Local\Temp\ABAA.tmp"108⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\AC08.tmp"C:\Users\Admin\AppData\Local\Temp\AC08.tmp"109⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\AC94.tmp"C:\Users\Admin\AppData\Local\Temp\AC94.tmp"110⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\AD21.tmp"C:\Users\Admin\AppData\Local\Temp\AD21.tmp"111⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"112⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\ADFB.tmp"C:\Users\Admin\AppData\Local\Temp\ADFB.tmp"113⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\AE68.tmp"C:\Users\Admin\AppData\Local\Temp\AE68.tmp"114⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\AEE5.tmp"C:\Users\Admin\AppData\Local\Temp\AEE5.tmp"115⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\AF43.tmp"C:\Users\Admin\AppData\Local\Temp\AF43.tmp"116⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\AFB0.tmp"C:\Users\Admin\AppData\Local\Temp\AFB0.tmp"117⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\B00D.tmp"C:\Users\Admin\AppData\Local\Temp\B00D.tmp"118⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\B07B.tmp"C:\Users\Admin\AppData\Local\Temp\B07B.tmp"119⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\B0E8.tmp"C:\Users\Admin\AppData\Local\Temp\B0E8.tmp"120⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\B136.tmp"C:\Users\Admin\AppData\Local\Temp\B136.tmp"121⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\B1B3.tmp"C:\Users\Admin\AppData\Local\Temp\B1B3.tmp"122⤵PID:744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-