Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
10/07/2023, 15:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cfbb81cb1ae96cexeexeexeex.exe
Resource
win7-20230703-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
cfbb81cb1ae96cexeexeexeex.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
cfbb81cb1ae96cexeexeexeex.exe
-
Size
486KB
-
MD5
cfbb81cb1ae96cc1733b7638393008dc
-
SHA1
d27d2354513fd9370f3de5fc913adbddb53520f7
-
SHA256
09708fd919dbb7fde14ec1acd52f232d508505348b3b7994628f5c4efbd5d107
-
SHA512
79bdd9b95b6d8ab32b594c50947b10c42cc79fbe3f1489da893647825158d9d8057d4ac3d3da8a5f66d90f36b7001c5fc2135b8809210c5f36fc2a853b7a0078
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7c7pvrZODMd+UhoeBIof4VeU4MjC8avh48c+d:/U5rCOTeiDyZNT6MIAU4MRa285bJNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4340 CC29.tmp 4968 CD23.tmp 2348 CE1D.tmp 236 CF27.tmp 5056 D021.tmp 2360 D0DD.tmp 2480 D1C7.tmp 452 DC46.tmp 3588 DD12.tmp 3708 DE1B.tmp 4900 DEE6.tmp 4856 DFF0.tmp 1424 E0EA.tmp 3432 E1D4.tmp 3088 E280.tmp 2836 E35B.tmp 1708 E3E8.tmp 1780 E4A3.tmp 4184 E55F.tmp 3876 E5FB.tmp 4328 E6B6.tmp 2676 E743.tmp 2068 E81E.tmp 632 E975.tmp 840 EA50.tmp 2940 EB4A.tmp 3172 EBF6.tmp 1072 ECD1.tmp 3516 EDBB.tmp 1916 EE48.tmp 1272 EF32.tmp 4500 EFFD.tmp 216 F0E8.tmp 5104 F194.tmp 3108 F230.tmp 4640 F2CC.tmp 3940 F368.tmp 4864 F3E5.tmp 2132 F491.tmp 2304 F54D.tmp 1104 F5D9.tmp 4628 F647.tmp 2108 F6F3.tmp 1224 F77F.tmp 2040 F80C.tmp 3596 F8B8.tmp 3612 F964.tmp 2280 F9F0.tmp 2332 FA7D.tmp 3208 FAFA.tmp 1888 FB77.tmp 2960 FBF4.tmp 3592 FC61.tmp 5016 FD5B.tmp 1488 FDE8.tmp 396 FE94.tmp 1216 FF20.tmp 1096 FFAD.tmp 3608 49.tmp 3728 D6.tmp 4120 172.tmp 568 1FF.tmp 572 28B.tmp 1932 318.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5016 wrote to memory of 4340 5016 cfbb81cb1ae96cexeexeexeex.exe 85 PID 5016 wrote to memory of 4340 5016 cfbb81cb1ae96cexeexeexeex.exe 85 PID 5016 wrote to memory of 4340 5016 cfbb81cb1ae96cexeexeexeex.exe 85 PID 4340 wrote to memory of 4968 4340 CC29.tmp 86 PID 4340 wrote to memory of 4968 4340 CC29.tmp 86 PID 4340 wrote to memory of 4968 4340 CC29.tmp 86 PID 4968 wrote to memory of 2348 4968 CD23.tmp 88 PID 4968 wrote to memory of 2348 4968 CD23.tmp 88 PID 4968 wrote to memory of 2348 4968 CD23.tmp 88 PID 2348 wrote to memory of 236 2348 CE1D.tmp 89 PID 2348 wrote to memory of 236 2348 CE1D.tmp 89 PID 2348 wrote to memory of 236 2348 CE1D.tmp 89 PID 236 wrote to memory of 5056 236 CF27.tmp 90 PID 236 wrote to memory of 5056 236 CF27.tmp 90 PID 236 wrote to memory of 5056 236 CF27.tmp 90 PID 5056 wrote to memory of 2360 5056 D021.tmp 91 PID 5056 wrote to memory of 2360 5056 D021.tmp 91 PID 5056 wrote to memory of 2360 5056 D021.tmp 91 PID 2360 wrote to memory of 2480 2360 D0DD.tmp 93 PID 2360 wrote to memory of 2480 2360 D0DD.tmp 93 PID 2360 wrote to memory of 2480 2360 D0DD.tmp 93 PID 2480 wrote to memory of 452 2480 D1C7.tmp 94 PID 2480 wrote to memory of 452 2480 D1C7.tmp 94 PID 2480 wrote to memory of 452 2480 D1C7.tmp 94 PID 452 wrote to memory of 3588 452 DC46.tmp 95 PID 452 wrote to memory of 3588 452 DC46.tmp 95 PID 452 wrote to memory of 3588 452 DC46.tmp 95 PID 3588 wrote to memory of 3708 3588 DD12.tmp 96 PID 3588 wrote to memory of 3708 3588 DD12.tmp 96 PID 3588 wrote to memory of 3708 3588 DD12.tmp 96 PID 3708 wrote to memory of 4900 3708 DE1B.tmp 97 PID 3708 wrote to memory of 4900 3708 DE1B.tmp 97 PID 3708 wrote to memory of 4900 3708 DE1B.tmp 97 PID 4900 wrote to memory of 4856 4900 DEE6.tmp 98 PID 4900 wrote to memory of 4856 4900 DEE6.tmp 98 PID 4900 wrote to memory of 4856 4900 DEE6.tmp 98 PID 4856 wrote to memory of 1424 4856 DFF0.tmp 99 PID 4856 wrote to memory of 1424 4856 DFF0.tmp 99 PID 4856 wrote to memory of 1424 4856 DFF0.tmp 99 PID 1424 wrote to memory of 3432 1424 E0EA.tmp 100 PID 1424 wrote to memory of 3432 1424 E0EA.tmp 100 PID 1424 wrote to memory of 3432 1424 E0EA.tmp 100 PID 3432 wrote to memory of 3088 3432 E1D4.tmp 101 PID 3432 wrote to memory of 3088 3432 E1D4.tmp 101 PID 3432 wrote to memory of 3088 3432 E1D4.tmp 101 PID 3088 wrote to memory of 2836 3088 E280.tmp 102 PID 3088 wrote to memory of 2836 3088 E280.tmp 102 PID 3088 wrote to memory of 2836 3088 E280.tmp 102 PID 2836 wrote to memory of 1708 2836 E35B.tmp 103 PID 2836 wrote to memory of 1708 2836 E35B.tmp 103 PID 2836 wrote to memory of 1708 2836 E35B.tmp 103 PID 1708 wrote to memory of 1780 1708 E3E8.tmp 104 PID 1708 wrote to memory of 1780 1708 E3E8.tmp 104 PID 1708 wrote to memory of 1780 1708 E3E8.tmp 104 PID 1780 wrote to memory of 4184 1780 E4A3.tmp 105 PID 1780 wrote to memory of 4184 1780 E4A3.tmp 105 PID 1780 wrote to memory of 4184 1780 E4A3.tmp 105 PID 4184 wrote to memory of 3876 4184 E55F.tmp 106 PID 4184 wrote to memory of 3876 4184 E55F.tmp 106 PID 4184 wrote to memory of 3876 4184 E55F.tmp 106 PID 3876 wrote to memory of 4328 3876 E5FB.tmp 107 PID 3876 wrote to memory of 4328 3876 E5FB.tmp 107 PID 3876 wrote to memory of 4328 3876 E5FB.tmp 107 PID 4328 wrote to memory of 2676 4328 E6B6.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfbb81cb1ae96cexeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\cfbb81cb1ae96cexeexeexeex.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\CC29.tmp"C:\Users\Admin\AppData\Local\Temp\CC29.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\CD23.tmp"C:\Users\Admin\AppData\Local\Temp\CD23.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\CF27.tmp"C:\Users\Admin\AppData\Local\Temp\CF27.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Users\Admin\AppData\Local\Temp\D021.tmp"C:\Users\Admin\AppData\Local\Temp\D021.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\D0DD.tmp"C:\Users\Admin\AppData\Local\Temp\D0DD.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\DC46.tmp"C:\Users\Admin\AppData\Local\Temp\DC46.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\DD12.tmp"C:\Users\Admin\AppData\Local\Temp\DD12.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\E1D4.tmp"C:\Users\Admin\AppData\Local\Temp\E1D4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\E280.tmp"C:\Users\Admin\AppData\Local\Temp\E280.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\E35B.tmp"C:\Users\Admin\AppData\Local\Temp\E35B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\E3E8.tmp"C:\Users\Admin\AppData\Local\Temp\E3E8.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\E55F.tmp"C:\Users\Admin\AppData\Local\Temp\E55F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\E743.tmp"C:\Users\Admin\AppData\Local\Temp\E743.tmp"23⤵
- Executes dropped EXE
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\E81E.tmp"C:\Users\Admin\AppData\Local\Temp\E81E.tmp"24⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\E975.tmp"C:\Users\Admin\AppData\Local\Temp\E975.tmp"25⤵
- Executes dropped EXE
PID:632 -
C:\Users\Admin\AppData\Local\Temp\EA50.tmp"C:\Users\Admin\AppData\Local\Temp\EA50.tmp"26⤵
- Executes dropped EXE
PID:840 -
C:\Users\Admin\AppData\Local\Temp\EB4A.tmp"C:\Users\Admin\AppData\Local\Temp\EB4A.tmp"27⤵
- Executes dropped EXE
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"28⤵
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"29⤵
- Executes dropped EXE
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"30⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\EE48.tmp"C:\Users\Admin\AppData\Local\Temp\EE48.tmp"31⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\EF32.tmp"C:\Users\Admin\AppData\Local\Temp\EF32.tmp"32⤵
- Executes dropped EXE
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"33⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\F0E8.tmp"C:\Users\Admin\AppData\Local\Temp\F0E8.tmp"34⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\F194.tmp"C:\Users\Admin\AppData\Local\Temp\F194.tmp"35⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\F230.tmp"C:\Users\Admin\AppData\Local\Temp\F230.tmp"36⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\F2CC.tmp"C:\Users\Admin\AppData\Local\Temp\F2CC.tmp"37⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\F368.tmp"C:\Users\Admin\AppData\Local\Temp\F368.tmp"38⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\F3E5.tmp"C:\Users\Admin\AppData\Local\Temp\F3E5.tmp"39⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\F491.tmp"C:\Users\Admin\AppData\Local\Temp\F491.tmp"40⤵
- Executes dropped EXE
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\F54D.tmp"C:\Users\Admin\AppData\Local\Temp\F54D.tmp"41⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"42⤵
- Executes dropped EXE
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\F647.tmp"C:\Users\Admin\AppData\Local\Temp\F647.tmp"43⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"44⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\F77F.tmp"C:\Users\Admin\AppData\Local\Temp\F77F.tmp"45⤵
- Executes dropped EXE
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\F80C.tmp"C:\Users\Admin\AppData\Local\Temp\F80C.tmp"46⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\F8B8.tmp"C:\Users\Admin\AppData\Local\Temp\F8B8.tmp"47⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\F964.tmp"C:\Users\Admin\AppData\Local\Temp\F964.tmp"48⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\F9F0.tmp"C:\Users\Admin\AppData\Local\Temp\F9F0.tmp"49⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\FA7D.tmp"C:\Users\Admin\AppData\Local\Temp\FA7D.tmp"50⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"51⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\FB77.tmp"C:\Users\Admin\AppData\Local\Temp\FB77.tmp"52⤵
- Executes dropped EXE
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"53⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\FC61.tmp"C:\Users\Admin\AppData\Local\Temp\FC61.tmp"54⤵
- Executes dropped EXE
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"55⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"56⤵
- Executes dropped EXE
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\FE94.tmp"C:\Users\Admin\AppData\Local\Temp\FE94.tmp"57⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\FF20.tmp"C:\Users\Admin\AppData\Local\Temp\FF20.tmp"58⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"59⤵
- Executes dropped EXE
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\49.tmp"C:\Users\Admin\AppData\Local\Temp\49.tmp"60⤵
- Executes dropped EXE
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\D6.tmp"C:\Users\Admin\AppData\Local\Temp\D6.tmp"61⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\172.tmp"C:\Users\Admin\AppData\Local\Temp\172.tmp"62⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\1FF.tmp"C:\Users\Admin\AppData\Local\Temp\1FF.tmp"63⤵
- Executes dropped EXE
PID:568 -
C:\Users\Admin\AppData\Local\Temp\28B.tmp"C:\Users\Admin\AppData\Local\Temp\28B.tmp"64⤵
- Executes dropped EXE
PID:572 -
C:\Users\Admin\AppData\Local\Temp\318.tmp"C:\Users\Admin\AppData\Local\Temp\318.tmp"65⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\395.tmp"C:\Users\Admin\AppData\Local\Temp\395.tmp"66⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\422.tmp"C:\Users\Admin\AppData\Local\Temp\422.tmp"67⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\48F.tmp"C:\Users\Admin\AppData\Local\Temp\48F.tmp"68⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\50C.tmp"C:\Users\Admin\AppData\Local\Temp\50C.tmp"69⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\599.tmp"C:\Users\Admin\AppData\Local\Temp\599.tmp"70⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\616.tmp"C:\Users\Admin\AppData\Local\Temp\616.tmp"71⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\683.tmp"C:\Users\Admin\AppData\Local\Temp\683.tmp"72⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\700.tmp"C:\Users\Admin\AppData\Local\Temp\700.tmp"73⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\76D.tmp"C:\Users\Admin\AppData\Local\Temp\76D.tmp"74⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\7DB.tmp"C:\Users\Admin\AppData\Local\Temp\7DB.tmp"75⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\848.tmp"C:\Users\Admin\AppData\Local\Temp\848.tmp"76⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\8C5.tmp"C:\Users\Admin\AppData\Local\Temp\8C5.tmp"77⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\932.tmp"C:\Users\Admin\AppData\Local\Temp\932.tmp"78⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\9A0.tmp"C:\Users\Admin\AppData\Local\Temp\9A0.tmp"79⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\A1D.tmp"C:\Users\Admin\AppData\Local\Temp\A1D.tmp"80⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\A9A.tmp"C:\Users\Admin\AppData\Local\Temp\A9A.tmp"81⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\B07.tmp"C:\Users\Admin\AppData\Local\Temp\B07.tmp"82⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\B75.tmp"C:\Users\Admin\AppData\Local\Temp\B75.tmp"83⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\BE2.tmp"C:\Users\Admin\AppData\Local\Temp\BE2.tmp"84⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"85⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\CDC.tmp"C:\Users\Admin\AppData\Local\Temp\CDC.tmp"86⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\D49.tmp"C:\Users\Admin\AppData\Local\Temp\D49.tmp"87⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\DC6.tmp"C:\Users\Admin\AppData\Local\Temp\DC6.tmp"88⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\E43.tmp"C:\Users\Admin\AppData\Local\Temp\E43.tmp"89⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\EA1.tmp"C:\Users\Admin\AppData\Local\Temp\EA1.tmp"90⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"91⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\F9B.tmp"C:\Users\Admin\AppData\Local\Temp\F9B.tmp"92⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\1037.tmp"C:\Users\Admin\AppData\Local\Temp\1037.tmp"93⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\10D4.tmp"C:\Users\Admin\AppData\Local\Temp\10D4.tmp"94⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\1151.tmp"C:\Users\Admin\AppData\Local\Temp\1151.tmp"95⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\11DD.tmp"C:\Users\Admin\AppData\Local\Temp\11DD.tmp"96⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\125A.tmp"C:\Users\Admin\AppData\Local\Temp\125A.tmp"97⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\12D7.tmp"C:\Users\Admin\AppData\Local\Temp\12D7.tmp"98⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\1364.tmp"C:\Users\Admin\AppData\Local\Temp\1364.tmp"99⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\13D1.tmp"C:\Users\Admin\AppData\Local\Temp\13D1.tmp"100⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\14CB.tmp"C:\Users\Admin\AppData\Local\Temp\14CB.tmp"101⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\1539.tmp"C:\Users\Admin\AppData\Local\Temp\1539.tmp"102⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\15E4.tmp"C:\Users\Admin\AppData\Local\Temp\15E4.tmp"103⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\1652.tmp"C:\Users\Admin\AppData\Local\Temp\1652.tmp"104⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\16CF.tmp"C:\Users\Admin\AppData\Local\Temp\16CF.tmp"105⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\173C.tmp"C:\Users\Admin\AppData\Local\Temp\173C.tmp"106⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\17AA.tmp"C:\Users\Admin\AppData\Local\Temp\17AA.tmp"107⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\1817.tmp"C:\Users\Admin\AppData\Local\Temp\1817.tmp"108⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\1894.tmp"C:\Users\Admin\AppData\Local\Temp\1894.tmp"109⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\1911.tmp"C:\Users\Admin\AppData\Local\Temp\1911.tmp"110⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\199E.tmp"C:\Users\Admin\AppData\Local\Temp\199E.tmp"111⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"112⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\1A98.tmp"C:\Users\Admin\AppData\Local\Temp\1A98.tmp"113⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\1B34.tmp"C:\Users\Admin\AppData\Local\Temp\1B34.tmp"114⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"115⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\1C3D.tmp"C:\Users\Admin\AppData\Local\Temp\1C3D.tmp"116⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"117⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\1D37.tmp"C:\Users\Admin\AppData\Local\Temp\1D37.tmp"118⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"119⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\1E41.tmp"C:\Users\Admin\AppData\Local\Temp\1E41.tmp"120⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"121⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\1F7A.tmp"C:\Users\Admin\AppData\Local\Temp\1F7A.tmp"122⤵PID:3900
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-