Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
06/07/2023, 11:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2439232baad40dexeexeexeex.exe
Resource
win7-20230703-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2439232baad40dexeexeexeex.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
2439232baad40dexeexeexeex.exe
-
Size
488KB
-
MD5
2439232baad40de5a7ff7e100231b1ea
-
SHA1
9754531c050892eab3748414426c0e94a76d0fbb
-
SHA256
e7ee142bae32bec75b3a0abdac6c015c2039dfab3b579d856fa265270f5d5bf2
-
SHA512
5596705aa50d565d40f50292335ecff1802d39b9892232e03511de90700b49e64fb7a188faad0ab4629ede5fa321fe06d356e5b17b445b1829af961bae586fb9
-
SSDEEP
12288:/U5rCOTeiDHAAkvlQCgF0bS8ZSj+eE+IGVngNZ:/UQOJDbT0nZSi8BhgN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4056 B1DB.tmp 3796 B297.tmp 1108 B342.tmp 4856 B45C.tmp 1564 B527.tmp 2784 B5E2.tmp 1608 B6AD.tmp 940 B74A.tmp 3428 B7C7.tmp 444 B892.tmp 3972 BA28.tmp 2196 BB03.tmp 4944 BC1C.tmp 1924 BCE7.tmp 4608 BDB2.tmp 1520 BECC.tmp 3636 BF97.tmp 4828 C091.tmp 2160 C18B.tmp 2208 C275.tmp 4956 C37F.tmp 2892 C42B.tmp 3120 C4E6.tmp 4936 C5C1.tmp 3608 C6AB.tmp 3388 C767.tmp 4288 C861.tmp 4152 C90D.tmp 1812 C9A9.tmp 2596 CA35.tmp 3548 CB01.tmp 4292 CBFB.tmp 4968 CCD5.tmp 3996 CD81.tmp 1104 CE0E.tmp 2104 CEAA.tmp 4464 CF46.tmp 4484 CFE3.tmp 3976 D06F.tmp 4352 D11B.tmp 2288 D1A8.tmp 4216 D244.tmp 1368 D2D1.tmp 5092 D34E.tmp 948 D3CB.tmp 3132 D448.tmp 3784 D4E4.tmp 2936 D551.tmp 2980 D5CE.tmp 3136 D6C8.tmp 1252 D745.tmp 2840 D7D2.tmp 3204 D83F.tmp 2680 D8AD.tmp 4052 D92A.tmp 3604 D9A7.tmp 3736 DA43.tmp 4180 DADF.tmp 3380 DB4C.tmp 3312 DBC9.tmp 1872 DC66.tmp 1928 DD12.tmp 5040 DDBD.tmp 1964 DE3A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4372 wrote to memory of 4056 4372 2439232baad40dexeexeexeex.exe 83 PID 4372 wrote to memory of 4056 4372 2439232baad40dexeexeexeex.exe 83 PID 4372 wrote to memory of 4056 4372 2439232baad40dexeexeexeex.exe 83 PID 4056 wrote to memory of 3796 4056 B1DB.tmp 84 PID 4056 wrote to memory of 3796 4056 B1DB.tmp 84 PID 4056 wrote to memory of 3796 4056 B1DB.tmp 84 PID 3796 wrote to memory of 1108 3796 B297.tmp 85 PID 3796 wrote to memory of 1108 3796 B297.tmp 85 PID 3796 wrote to memory of 1108 3796 B297.tmp 85 PID 1108 wrote to memory of 4856 1108 B342.tmp 86 PID 1108 wrote to memory of 4856 1108 B342.tmp 86 PID 1108 wrote to memory of 4856 1108 B342.tmp 86 PID 4856 wrote to memory of 1564 4856 B45C.tmp 87 PID 4856 wrote to memory of 1564 4856 B45C.tmp 87 PID 4856 wrote to memory of 1564 4856 B45C.tmp 87 PID 1564 wrote to memory of 2784 1564 B527.tmp 88 PID 1564 wrote to memory of 2784 1564 B527.tmp 88 PID 1564 wrote to memory of 2784 1564 B527.tmp 88 PID 2784 wrote to memory of 1608 2784 B5E2.tmp 89 PID 2784 wrote to memory of 1608 2784 B5E2.tmp 89 PID 2784 wrote to memory of 1608 2784 B5E2.tmp 89 PID 1608 wrote to memory of 940 1608 B6AD.tmp 90 PID 1608 wrote to memory of 940 1608 B6AD.tmp 90 PID 1608 wrote to memory of 940 1608 B6AD.tmp 90 PID 940 wrote to memory of 3428 940 B74A.tmp 91 PID 940 wrote to memory of 3428 940 B74A.tmp 91 PID 940 wrote to memory of 3428 940 B74A.tmp 91 PID 3428 wrote to memory of 444 3428 B7C7.tmp 92 PID 3428 wrote to memory of 444 3428 B7C7.tmp 92 PID 3428 wrote to memory of 444 3428 B7C7.tmp 92 PID 444 wrote to memory of 3972 444 B892.tmp 93 PID 444 wrote to memory of 3972 444 B892.tmp 93 PID 444 wrote to memory of 3972 444 B892.tmp 93 PID 3972 wrote to memory of 2196 3972 BA28.tmp 94 PID 3972 wrote to memory of 2196 3972 BA28.tmp 94 PID 3972 wrote to memory of 2196 3972 BA28.tmp 94 PID 2196 wrote to memory of 4944 2196 BB03.tmp 95 PID 2196 wrote to memory of 4944 2196 BB03.tmp 95 PID 2196 wrote to memory of 4944 2196 BB03.tmp 95 PID 4944 wrote to memory of 1924 4944 BC1C.tmp 96 PID 4944 wrote to memory of 1924 4944 BC1C.tmp 96 PID 4944 wrote to memory of 1924 4944 BC1C.tmp 96 PID 1924 wrote to memory of 4608 1924 BCE7.tmp 97 PID 1924 wrote to memory of 4608 1924 BCE7.tmp 97 PID 1924 wrote to memory of 4608 1924 BCE7.tmp 97 PID 4608 wrote to memory of 1520 4608 BDB2.tmp 98 PID 4608 wrote to memory of 1520 4608 BDB2.tmp 98 PID 4608 wrote to memory of 1520 4608 BDB2.tmp 98 PID 1520 wrote to memory of 3636 1520 BECC.tmp 99 PID 1520 wrote to memory of 3636 1520 BECC.tmp 99 PID 1520 wrote to memory of 3636 1520 BECC.tmp 99 PID 3636 wrote to memory of 4828 3636 BF97.tmp 100 PID 3636 wrote to memory of 4828 3636 BF97.tmp 100 PID 3636 wrote to memory of 4828 3636 BF97.tmp 100 PID 4828 wrote to memory of 2160 4828 C091.tmp 101 PID 4828 wrote to memory of 2160 4828 C091.tmp 101 PID 4828 wrote to memory of 2160 4828 C091.tmp 101 PID 2160 wrote to memory of 2208 2160 C18B.tmp 102 PID 2160 wrote to memory of 2208 2160 C18B.tmp 102 PID 2160 wrote to memory of 2208 2160 C18B.tmp 102 PID 2208 wrote to memory of 4956 2208 C275.tmp 103 PID 2208 wrote to memory of 4956 2208 C275.tmp 103 PID 2208 wrote to memory of 4956 2208 C275.tmp 103 PID 4956 wrote to memory of 2892 4956 C37F.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2439232baad40dexeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\2439232baad40dexeexeexeex.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\B342.tmp"C:\Users\Admin\AppData\Local\Temp\B342.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\B45C.tmp"C:\Users\Admin\AppData\Local\Temp\B45C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\B527.tmp"C:\Users\Admin\AppData\Local\Temp\B527.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\B74A.tmp"C:\Users\Admin\AppData\Local\Temp\B74A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\B892.tmp"C:\Users\Admin\AppData\Local\Temp\B892.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
C:\Users\Admin\AppData\Local\Temp\BA28.tmp"C:\Users\Admin\AppData\Local\Temp\BA28.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\BB03.tmp"C:\Users\Admin\AppData\Local\Temp\BB03.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\BF97.tmp"C:\Users\Admin\AppData\Local\Temp\BF97.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\C091.tmp"C:\Users\Admin\AppData\Local\Temp\C091.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\C18B.tmp"C:\Users\Admin\AppData\Local\Temp\C18B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\C275.tmp"C:\Users\Admin\AppData\Local\Temp\C275.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\C37F.tmp"C:\Users\Admin\AppData\Local\Temp\C37F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\C42B.tmp"C:\Users\Admin\AppData\Local\Temp\C42B.tmp"23⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"24⤵
- Executes dropped EXE
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"25⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"26⤵
- Executes dropped EXE
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\C767.tmp"C:\Users\Admin\AppData\Local\Temp\C767.tmp"27⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\C861.tmp"C:\Users\Admin\AppData\Local\Temp\C861.tmp"28⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\C90D.tmp"C:\Users\Admin\AppData\Local\Temp\C90D.tmp"29⤵
- Executes dropped EXE
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"30⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\CA35.tmp"C:\Users\Admin\AppData\Local\Temp\CA35.tmp"31⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\CB01.tmp"C:\Users\Admin\AppData\Local\Temp\CB01.tmp"32⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"33⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\CCD5.tmp"C:\Users\Admin\AppData\Local\Temp\CCD5.tmp"34⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\CD81.tmp"C:\Users\Admin\AppData\Local\Temp\CD81.tmp"35⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\CE0E.tmp"C:\Users\Admin\AppData\Local\Temp\CE0E.tmp"36⤵
- Executes dropped EXE
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\CEAA.tmp"C:\Users\Admin\AppData\Local\Temp\CEAA.tmp"37⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\CF46.tmp"C:\Users\Admin\AppData\Local\Temp\CF46.tmp"38⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\CFE3.tmp"C:\Users\Admin\AppData\Local\Temp\CFE3.tmp"39⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\D06F.tmp"C:\Users\Admin\AppData\Local\Temp\D06F.tmp"40⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\D11B.tmp"C:\Users\Admin\AppData\Local\Temp\D11B.tmp"41⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\D1A8.tmp"C:\Users\Admin\AppData\Local\Temp\D1A8.tmp"42⤵
- Executes dropped EXE
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\D244.tmp"C:\Users\Admin\AppData\Local\Temp\D244.tmp"43⤵
- Executes dropped EXE
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"44⤵
- Executes dropped EXE
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\D34E.tmp"C:\Users\Admin\AppData\Local\Temp\D34E.tmp"45⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\D3CB.tmp"C:\Users\Admin\AppData\Local\Temp\D3CB.tmp"46⤵
- Executes dropped EXE
PID:948 -
C:\Users\Admin\AppData\Local\Temp\D448.tmp"C:\Users\Admin\AppData\Local\Temp\D448.tmp"47⤵
- Executes dropped EXE
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"48⤵
- Executes dropped EXE
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\D551.tmp"C:\Users\Admin\AppData\Local\Temp\D551.tmp"49⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\D5CE.tmp"C:\Users\Admin\AppData\Local\Temp\D5CE.tmp"50⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"51⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\D745.tmp"C:\Users\Admin\AppData\Local\Temp\D745.tmp"52⤵
- Executes dropped EXE
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"53⤵
- Executes dropped EXE
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\D83F.tmp"C:\Users\Admin\AppData\Local\Temp\D83F.tmp"54⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\D8AD.tmp"C:\Users\Admin\AppData\Local\Temp\D8AD.tmp"55⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\D92A.tmp"C:\Users\Admin\AppData\Local\Temp\D92A.tmp"56⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\D9A7.tmp"C:\Users\Admin\AppData\Local\Temp\D9A7.tmp"57⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\DA43.tmp"C:\Users\Admin\AppData\Local\Temp\DA43.tmp"58⤵
- Executes dropped EXE
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\DADF.tmp"C:\Users\Admin\AppData\Local\Temp\DADF.tmp"59⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\DB4C.tmp"C:\Users\Admin\AppData\Local\Temp\DB4C.tmp"60⤵
- Executes dropped EXE
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"61⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\DC66.tmp"C:\Users\Admin\AppData\Local\Temp\DC66.tmp"62⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\DD12.tmp"C:\Users\Admin\AppData\Local\Temp\DD12.tmp"63⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\DDBD.tmp"C:\Users\Admin\AppData\Local\Temp\DDBD.tmp"64⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\DE3A.tmp"C:\Users\Admin\AppData\Local\Temp\DE3A.tmp"65⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"66⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\DF15.tmp"C:\Users\Admin\AppData\Local\Temp\DF15.tmp"67⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"68⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\E04E.tmp"C:\Users\Admin\AppData\Local\Temp\E04E.tmp"69⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\E0BB.tmp"C:\Users\Admin\AppData\Local\Temp\E0BB.tmp"70⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\E157.tmp"C:\Users\Admin\AppData\Local\Temp\E157.tmp"71⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"72⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\E251.tmp"C:\Users\Admin\AppData\Local\Temp\E251.tmp"73⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\E2EE.tmp"C:\Users\Admin\AppData\Local\Temp\E2EE.tmp"74⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\E399.tmp"C:\Users\Admin\AppData\Local\Temp\E399.tmp"75⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\E426.tmp"C:\Users\Admin\AppData\Local\Temp\E426.tmp"76⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\E493.tmp"C:\Users\Admin\AppData\Local\Temp\E493.tmp"77⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\E510.tmp"C:\Users\Admin\AppData\Local\Temp\E510.tmp"78⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\E5BC.tmp"C:\Users\Admin\AppData\Local\Temp\E5BC.tmp"79⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\E61A.tmp"C:\Users\Admin\AppData\Local\Temp\E61A.tmp"80⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"81⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\E743.tmp"C:\Users\Admin\AppData\Local\Temp\E743.tmp"82⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"83⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\E83D.tmp"C:\Users\Admin\AppData\Local\Temp\E83D.tmp"84⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\E8CA.tmp"C:\Users\Admin\AppData\Local\Temp\E8CA.tmp"85⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\E966.tmp"C:\Users\Admin\AppData\Local\Temp\E966.tmp"86⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"87⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\EA8F.tmp"C:\Users\Admin\AppData\Local\Temp\EA8F.tmp"88⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"89⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"90⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\EC15.tmp"C:\Users\Admin\AppData\Local\Temp\EC15.tmp"91⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"92⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"93⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\ED9C.tmp"C:\Users\Admin\AppData\Local\Temp\ED9C.tmp"94⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\EE29.tmp"C:\Users\Admin\AppData\Local\Temp\EE29.tmp"95⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"96⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\EF51.tmp"C:\Users\Admin\AppData\Local\Temp\EF51.tmp"97⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\EFEE.tmp"C:\Users\Admin\AppData\Local\Temp\EFEE.tmp"98⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\F06B.tmp"C:\Users\Admin\AppData\Local\Temp\F06B.tmp"99⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\F107.tmp"C:\Users\Admin\AppData\Local\Temp\F107.tmp"100⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\F194.tmp"C:\Users\Admin\AppData\Local\Temp\F194.tmp"101⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\F211.tmp"C:\Users\Admin\AppData\Local\Temp\F211.tmp"102⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\F29D.tmp"C:\Users\Admin\AppData\Local\Temp\F29D.tmp"103⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\F31A.tmp"C:\Users\Admin\AppData\Local\Temp\F31A.tmp"104⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"105⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\F433.tmp"C:\Users\Admin\AppData\Local\Temp\F433.tmp"106⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\F4B0.tmp"C:\Users\Admin\AppData\Local\Temp\F4B0.tmp"107⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\F52D.tmp"C:\Users\Admin\AppData\Local\Temp\F52D.tmp"108⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\F5BA.tmp"C:\Users\Admin\AppData\Local\Temp\F5BA.tmp"109⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\F656.tmp"C:\Users\Admin\AppData\Local\Temp\F656.tmp"110⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"111⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\F760.tmp"C:\Users\Admin\AppData\Local\Temp\F760.tmp"112⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"113⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\F85A.tmp"C:\Users\Admin\AppData\Local\Temp\F85A.tmp"114⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\F906.tmp"C:\Users\Admin\AppData\Local\Temp\F906.tmp"115⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"116⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\FA2F.tmp"C:\Users\Admin\AppData\Local\Temp\FA2F.tmp"117⤵PID:100
-
C:\Users\Admin\AppData\Local\Temp\FADB.tmp"C:\Users\Admin\AppData\Local\Temp\FADB.tmp"118⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\FB58.tmp"C:\Users\Admin\AppData\Local\Temp\FB58.tmp"119⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"120⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\FC71.tmp"C:\Users\Admin\AppData\Local\Temp\FC71.tmp"121⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"122⤵PID:4080
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-