Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2023, 17:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8a8b7a47b9ca7cexeexeexeex.exe
Resource
win7-20230703-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
8a8b7a47b9ca7cexeexeexeex.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
8a8b7a47b9ca7cexeexeexeex.exe
-
Size
488KB
-
MD5
8a8b7a47b9ca7c2695b3d678595c676e
-
SHA1
93285091f1bf012885cf18c636b59096c210fe34
-
SHA256
a7156a6339671f783bb9b764fb5a27794a464574c6ad8e78dad0f172268a69ff
-
SHA512
e35b322f29832311c13679c39b6d0f4a6fd91b9e38bc5cef0de1a19fbd7c9a6292a7a472e5215efbbab964a23e4d9883b9038e59093cebc7a769d3f99fb333fc
-
SSDEEP
12288:/U5rCOTeiDsN9eqXaFGY3oQ2pWMS7eOTQ5nNZ:/UQOJDsN9eqqiQ2XS7RE5nN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1692 7CB2.tmp 3092 7D7D.tmp 2092 7E29.tmp 456 7EE4.tmp 3144 7F90.tmp 4444 802C.tmp 4152 80C9.tmp 2732 8146.tmp 4424 8201.tmp 4464 82BD.tmp 1248 8349.tmp 2472 8414.tmp 2580 8491.tmp 2056 851E.tmp 4312 85BA.tmp 2864 8712.tmp 4148 879F.tmp 3380 883B.tmp 4372 88E7.tmp 4984 8983.tmp 2996 8A1F.tmp 3904 8ABB.tmp 1832 8B67.tmp 4776 8C32.tmp 3864 8CFE.tmp 1280 8D9A.tmp 4636 8E26.tmp 4200 8EC3.tmp 2176 8F6F.tmp 4868 902A.tmp 4800 90E6.tmp 3032 91A1.tmp 228 921E.tmp 2532 928B.tmp 1264 9328.tmp 3936 9385.tmp 1744 9422.tmp 1036 948F.tmp 3772 952B.tmp 980 95B8.tmp 372 9645.tmp 2116 96D1.tmp 2644 975E.tmp 2556 97EA.tmp 3256 9867.tmp 1320 98D5.tmp 1692 9961.tmp 3744 99EE.tmp 4028 9A6B.tmp 1996 9AF8.tmp 3796 9B84.tmp 3708 9C4F.tmp 3752 9CDC.tmp 436 9D49.tmp 3584 9DE6.tmp 2808 9E63.tmp 4396 9EE0.tmp 1748 9F5D.tmp 4256 9FDA.tmp 2504 A066.tmp 4716 A0E3.tmp 3960 A151.tmp 4880 A1CE.tmp 2304 A25A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4956 wrote to memory of 1692 4956 8a8b7a47b9ca7cexeexeexeex.exe 87 PID 4956 wrote to memory of 1692 4956 8a8b7a47b9ca7cexeexeexeex.exe 87 PID 4956 wrote to memory of 1692 4956 8a8b7a47b9ca7cexeexeexeex.exe 87 PID 1692 wrote to memory of 3092 1692 7CB2.tmp 88 PID 1692 wrote to memory of 3092 1692 7CB2.tmp 88 PID 1692 wrote to memory of 3092 1692 7CB2.tmp 88 PID 3092 wrote to memory of 2092 3092 7D7D.tmp 89 PID 3092 wrote to memory of 2092 3092 7D7D.tmp 89 PID 3092 wrote to memory of 2092 3092 7D7D.tmp 89 PID 2092 wrote to memory of 456 2092 7E29.tmp 90 PID 2092 wrote to memory of 456 2092 7E29.tmp 90 PID 2092 wrote to memory of 456 2092 7E29.tmp 90 PID 456 wrote to memory of 3144 456 7EE4.tmp 91 PID 456 wrote to memory of 3144 456 7EE4.tmp 91 PID 456 wrote to memory of 3144 456 7EE4.tmp 91 PID 3144 wrote to memory of 4444 3144 7F90.tmp 92 PID 3144 wrote to memory of 4444 3144 7F90.tmp 92 PID 3144 wrote to memory of 4444 3144 7F90.tmp 92 PID 4444 wrote to memory of 4152 4444 802C.tmp 93 PID 4444 wrote to memory of 4152 4444 802C.tmp 93 PID 4444 wrote to memory of 4152 4444 802C.tmp 93 PID 4152 wrote to memory of 2732 4152 80C9.tmp 94 PID 4152 wrote to memory of 2732 4152 80C9.tmp 94 PID 4152 wrote to memory of 2732 4152 80C9.tmp 94 PID 2732 wrote to memory of 4424 2732 8146.tmp 95 PID 2732 wrote to memory of 4424 2732 8146.tmp 95 PID 2732 wrote to memory of 4424 2732 8146.tmp 95 PID 4424 wrote to memory of 4464 4424 8201.tmp 96 PID 4424 wrote to memory of 4464 4424 8201.tmp 96 PID 4424 wrote to memory of 4464 4424 8201.tmp 96 PID 4464 wrote to memory of 1248 4464 82BD.tmp 97 PID 4464 wrote to memory of 1248 4464 82BD.tmp 97 PID 4464 wrote to memory of 1248 4464 82BD.tmp 97 PID 1248 wrote to memory of 2472 1248 8349.tmp 98 PID 1248 wrote to memory of 2472 1248 8349.tmp 98 PID 1248 wrote to memory of 2472 1248 8349.tmp 98 PID 2472 wrote to memory of 2580 2472 8414.tmp 99 PID 2472 wrote to memory of 2580 2472 8414.tmp 99 PID 2472 wrote to memory of 2580 2472 8414.tmp 99 PID 2580 wrote to memory of 2056 2580 8491.tmp 100 PID 2580 wrote to memory of 2056 2580 8491.tmp 100 PID 2580 wrote to memory of 2056 2580 8491.tmp 100 PID 2056 wrote to memory of 4312 2056 851E.tmp 101 PID 2056 wrote to memory of 4312 2056 851E.tmp 101 PID 2056 wrote to memory of 4312 2056 851E.tmp 101 PID 4312 wrote to memory of 2864 4312 85BA.tmp 103 PID 4312 wrote to memory of 2864 4312 85BA.tmp 103 PID 4312 wrote to memory of 2864 4312 85BA.tmp 103 PID 2864 wrote to memory of 4148 2864 8712.tmp 104 PID 2864 wrote to memory of 4148 2864 8712.tmp 104 PID 2864 wrote to memory of 4148 2864 8712.tmp 104 PID 4148 wrote to memory of 3380 4148 879F.tmp 105 PID 4148 wrote to memory of 3380 4148 879F.tmp 105 PID 4148 wrote to memory of 3380 4148 879F.tmp 105 PID 3380 wrote to memory of 4372 3380 883B.tmp 106 PID 3380 wrote to memory of 4372 3380 883B.tmp 106 PID 3380 wrote to memory of 4372 3380 883B.tmp 106 PID 4372 wrote to memory of 4984 4372 88E7.tmp 108 PID 4372 wrote to memory of 4984 4372 88E7.tmp 108 PID 4372 wrote to memory of 4984 4372 88E7.tmp 108 PID 4984 wrote to memory of 2996 4984 8983.tmp 109 PID 4984 wrote to memory of 2996 4984 8983.tmp 109 PID 4984 wrote to memory of 2996 4984 8983.tmp 109 PID 2996 wrote to memory of 3904 2996 8A1F.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a8b7a47b9ca7cexeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\8a8b7a47b9ca7cexeexeexeex.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\7E29.tmp"C:\Users\Admin\AppData\Local\Temp\7E29.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\7F90.tmp"C:\Users\Admin\AppData\Local\Temp\7F90.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\802C.tmp"C:\Users\Admin\AppData\Local\Temp\802C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\80C9.tmp"C:\Users\Admin\AppData\Local\Temp\80C9.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\8146.tmp"C:\Users\Admin\AppData\Local\Temp\8146.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\8201.tmp"C:\Users\Admin\AppData\Local\Temp\8201.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\82BD.tmp"C:\Users\Admin\AppData\Local\Temp\82BD.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\8349.tmp"C:\Users\Admin\AppData\Local\Temp\8349.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\8414.tmp"C:\Users\Admin\AppData\Local\Temp\8414.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\8491.tmp"C:\Users\Admin\AppData\Local\Temp\8491.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\851E.tmp"C:\Users\Admin\AppData\Local\Temp\851E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\85BA.tmp"C:\Users\Admin\AppData\Local\Temp\85BA.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\8712.tmp"C:\Users\Admin\AppData\Local\Temp\8712.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\879F.tmp"C:\Users\Admin\AppData\Local\Temp\879F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\883B.tmp"C:\Users\Admin\AppData\Local\Temp\883B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\88E7.tmp"C:\Users\Admin\AppData\Local\Temp\88E7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\8983.tmp"C:\Users\Admin\AppData\Local\Temp\8983.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"23⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\8B67.tmp"C:\Users\Admin\AppData\Local\Temp\8B67.tmp"24⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\8C32.tmp"C:\Users\Admin\AppData\Local\Temp\8C32.tmp"25⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"26⤵
- Executes dropped EXE
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"27⤵
- Executes dropped EXE
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\8E26.tmp"C:\Users\Admin\AppData\Local\Temp\8E26.tmp"28⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"29⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"30⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\902A.tmp"C:\Users\Admin\AppData\Local\Temp\902A.tmp"31⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\90E6.tmp"C:\Users\Admin\AppData\Local\Temp\90E6.tmp"32⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"33⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\921E.tmp"C:\Users\Admin\AppData\Local\Temp\921E.tmp"34⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"35⤵
- Executes dropped EXE
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\9328.tmp"C:\Users\Admin\AppData\Local\Temp\9328.tmp"36⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\9385.tmp"C:\Users\Admin\AppData\Local\Temp\9385.tmp"37⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\9422.tmp"C:\Users\Admin\AppData\Local\Temp\9422.tmp"38⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\948F.tmp"C:\Users\Admin\AppData\Local\Temp\948F.tmp"39⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"40⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\95B8.tmp"C:\Users\Admin\AppData\Local\Temp\95B8.tmp"41⤵
- Executes dropped EXE
PID:980 -
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"42⤵
- Executes dropped EXE
PID:372 -
C:\Users\Admin\AppData\Local\Temp\96D1.tmp"C:\Users\Admin\AppData\Local\Temp\96D1.tmp"43⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"44⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\97EA.tmp"C:\Users\Admin\AppData\Local\Temp\97EA.tmp"45⤵
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\9867.tmp"C:\Users\Admin\AppData\Local\Temp\9867.tmp"46⤵
- Executes dropped EXE
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\98D5.tmp"C:\Users\Admin\AppData\Local\Temp\98D5.tmp"47⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"48⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\99EE.tmp"C:\Users\Admin\AppData\Local\Temp\99EE.tmp"49⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"50⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"51⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"52⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"53⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"54⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"55⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"56⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\9E63.tmp"C:\Users\Admin\AppData\Local\Temp\9E63.tmp"57⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"58⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"59⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"60⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\A066.tmp"C:\Users\Admin\AppData\Local\Temp\A066.tmp"61⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"62⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"63⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"64⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"65⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"66⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\A364.tmp"C:\Users\Admin\AppData\Local\Temp\A364.tmp"67⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"68⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"69⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"70⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"71⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"72⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\A642.tmp"C:\Users\Admin\AppData\Local\Temp\A642.tmp"73⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"74⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\A76B.tmp"C:\Users\Admin\AppData\Local\Temp\A76B.tmp"75⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"76⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\A856.tmp"C:\Users\Admin\AppData\Local\Temp\A856.tmp"77⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"78⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"79⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"80⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"81⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\AB05.tmp"C:\Users\Admin\AppData\Local\Temp\AB05.tmp"82⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"83⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"84⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"85⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"86⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"87⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\AE80.tmp"C:\Users\Admin\AppData\Local\Temp\AE80.tmp"88⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"89⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"90⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\B054.tmp"C:\Users\Admin\AppData\Local\Temp\B054.tmp"91⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"92⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\B15E.tmp"C:\Users\Admin\AppData\Local\Temp\B15E.tmp"93⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"94⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\B268.tmp"C:\Users\Admin\AppData\Local\Temp\B268.tmp"95⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\B304.tmp"C:\Users\Admin\AppData\Local\Temp\B304.tmp"96⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\B381.tmp"C:\Users\Admin\AppData\Local\Temp\B381.tmp"97⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\B41D.tmp"C:\Users\Admin\AppData\Local\Temp\B41D.tmp"98⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"99⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\B527.tmp"C:\Users\Admin\AppData\Local\Temp\B527.tmp"100⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"101⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\B640.tmp"C:\Users\Admin\AppData\Local\Temp\B640.tmp"102⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"103⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\B788.tmp"C:\Users\Admin\AppData\Local\Temp\B788.tmp"104⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\B805.tmp"C:\Users\Admin\AppData\Local\Temp\B805.tmp"105⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"106⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\B93E.tmp"C:\Users\Admin\AppData\Local\Temp\B93E.tmp"107⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"108⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\BA47.tmp"C:\Users\Admin\AppData\Local\Temp\BA47.tmp"109⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"110⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\BB70.tmp"C:\Users\Admin\AppData\Local\Temp\BB70.tmp"111⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\BBED.tmp"C:\Users\Admin\AppData\Local\Temp\BBED.tmp"112⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"113⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\BD16.tmp"C:\Users\Admin\AppData\Local\Temp\BD16.tmp"114⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"115⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"116⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"117⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\BF58.tmp"C:\Users\Admin\AppData\Local\Temp\BF58.tmp"118⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"119⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\C062.tmp"C:\Users\Admin\AppData\Local\Temp\C062.tmp"120⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"121⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"122⤵PID:3708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-