Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2023, 14:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
528d545ca3b921exeexe_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
528d545ca3b921exeexe_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
528d545ca3b921exeexe_JC.exe
-
Size
486KB
-
MD5
528d545ca3b921380516d9fef6aaeef8
-
SHA1
4b354def48e692e64e4034fbc82069040b9a88d9
-
SHA256
77fbce0f2980e5cd9c714c2965f75cd841170a26f09926c5fadd445ad2707b7d
-
SHA512
7c529af818e4b8c9ac3371b6d53ca8cc4412a91f5481cdd33c46b7e1d56c63373d5dc03fb3a85a31b75cac7c00ca26de6a35690ecd1a8b19505ef5d00dca2ae1
-
SSDEEP
12288:/U5rCOTeiDLjjBd1OruiVcv6HzY5JENZ:/UQOJDeuiE6HzM+N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4184 7CA2.tmp 3612 7D7D.tmp 2220 7E19.tmp 4468 7ED5.tmp 948 7F71.tmp 4496 802C.tmp 4036 80A9.tmp 4612 8136.tmp 4592 8211.tmp 2708 8770.tmp 2060 884A.tmp 2408 88F6.tmp 2700 8993.tmp 1448 8A3E.tmp 4420 8AAC.tmp 4544 8B67.tmp 4788 8BF4.tmp 2656 8CAF.tmp 5080 8D1D.tmp 3672 8DA9.tmp 3416 8E46.tmp 3540 8F20.tmp 3232 8F8E.tmp 3652 903A.tmp 8 90C6.tmp 2604 9134.tmp 4200 91D0.tmp 2732 924D.tmp 3820 9328.tmp 2628 93B4.tmp 1384 9460.tmp 2388 94DD.tmp 588 95C8.tmp 4184 9654.tmp 1936 96D1.tmp 3816 976D.tmp 3680 9839.tmp 2900 98C5.tmp 5088 9961.tmp 2464 99CF.tmp 1392 9A7B.tmp 3912 9B07.tmp 4516 9B75.tmp 4376 9BD2.tmp 2808 9C4F.tmp 456 9CBD.tmp 3960 9D59.tmp 4592 9DD6.tmp 2108 9E43.tmp 4392 9EC0.tmp 1352 9F4D.tmp 3768 9FCA.tmp 2560 A066.tmp 4872 A0E3.tmp 3988 A151.tmp 3636 A1CE.tmp 1456 A24B.tmp 4448 A2C8.tmp 472 A354.tmp 3924 A3D1.tmp 4332 A44E.tmp 4412 A4DB.tmp 5080 A577.tmp 5104 A5F4.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2080 wrote to memory of 4184 2080 528d545ca3b921exeexe_JC.exe 83 PID 2080 wrote to memory of 4184 2080 528d545ca3b921exeexe_JC.exe 83 PID 2080 wrote to memory of 4184 2080 528d545ca3b921exeexe_JC.exe 83 PID 4184 wrote to memory of 3612 4184 7CA2.tmp 84 PID 4184 wrote to memory of 3612 4184 7CA2.tmp 84 PID 4184 wrote to memory of 3612 4184 7CA2.tmp 84 PID 3612 wrote to memory of 2220 3612 7D7D.tmp 85 PID 3612 wrote to memory of 2220 3612 7D7D.tmp 85 PID 3612 wrote to memory of 2220 3612 7D7D.tmp 85 PID 2220 wrote to memory of 4468 2220 7E19.tmp 86 PID 2220 wrote to memory of 4468 2220 7E19.tmp 86 PID 2220 wrote to memory of 4468 2220 7E19.tmp 86 PID 4468 wrote to memory of 948 4468 7ED5.tmp 87 PID 4468 wrote to memory of 948 4468 7ED5.tmp 87 PID 4468 wrote to memory of 948 4468 7ED5.tmp 87 PID 948 wrote to memory of 4496 948 7F71.tmp 89 PID 948 wrote to memory of 4496 948 7F71.tmp 89 PID 948 wrote to memory of 4496 948 7F71.tmp 89 PID 4496 wrote to memory of 4036 4496 802C.tmp 90 PID 4496 wrote to memory of 4036 4496 802C.tmp 90 PID 4496 wrote to memory of 4036 4496 802C.tmp 90 PID 4036 wrote to memory of 4612 4036 80A9.tmp 91 PID 4036 wrote to memory of 4612 4036 80A9.tmp 91 PID 4036 wrote to memory of 4612 4036 80A9.tmp 91 PID 4612 wrote to memory of 4592 4612 8136.tmp 92 PID 4612 wrote to memory of 4592 4612 8136.tmp 92 PID 4612 wrote to memory of 4592 4612 8136.tmp 92 PID 4592 wrote to memory of 2708 4592 8211.tmp 93 PID 4592 wrote to memory of 2708 4592 8211.tmp 93 PID 4592 wrote to memory of 2708 4592 8211.tmp 93 PID 2708 wrote to memory of 2060 2708 8770.tmp 94 PID 2708 wrote to memory of 2060 2708 8770.tmp 94 PID 2708 wrote to memory of 2060 2708 8770.tmp 94 PID 2060 wrote to memory of 2408 2060 884A.tmp 95 PID 2060 wrote to memory of 2408 2060 884A.tmp 95 PID 2060 wrote to memory of 2408 2060 884A.tmp 95 PID 2408 wrote to memory of 2700 2408 88F6.tmp 96 PID 2408 wrote to memory of 2700 2408 88F6.tmp 96 PID 2408 wrote to memory of 2700 2408 88F6.tmp 96 PID 2700 wrote to memory of 1448 2700 8993.tmp 97 PID 2700 wrote to memory of 1448 2700 8993.tmp 97 PID 2700 wrote to memory of 1448 2700 8993.tmp 97 PID 1448 wrote to memory of 4420 1448 8A3E.tmp 98 PID 1448 wrote to memory of 4420 1448 8A3E.tmp 98 PID 1448 wrote to memory of 4420 1448 8A3E.tmp 98 PID 4420 wrote to memory of 4544 4420 8AAC.tmp 99 PID 4420 wrote to memory of 4544 4420 8AAC.tmp 99 PID 4420 wrote to memory of 4544 4420 8AAC.tmp 99 PID 4544 wrote to memory of 4788 4544 8B67.tmp 100 PID 4544 wrote to memory of 4788 4544 8B67.tmp 100 PID 4544 wrote to memory of 4788 4544 8B67.tmp 100 PID 4788 wrote to memory of 2656 4788 8BF4.tmp 101 PID 4788 wrote to memory of 2656 4788 8BF4.tmp 101 PID 4788 wrote to memory of 2656 4788 8BF4.tmp 101 PID 2656 wrote to memory of 5080 2656 8CAF.tmp 102 PID 2656 wrote to memory of 5080 2656 8CAF.tmp 102 PID 2656 wrote to memory of 5080 2656 8CAF.tmp 102 PID 5080 wrote to memory of 3672 5080 8D1D.tmp 105 PID 5080 wrote to memory of 3672 5080 8D1D.tmp 105 PID 5080 wrote to memory of 3672 5080 8D1D.tmp 105 PID 3672 wrote to memory of 3416 3672 8DA9.tmp 106 PID 3672 wrote to memory of 3416 3672 8DA9.tmp 106 PID 3672 wrote to memory of 3416 3672 8DA9.tmp 106 PID 3416 wrote to memory of 3540 3416 8E46.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\528d545ca3b921exeexe_JC.exe"C:\Users\Admin\AppData\Local\Temp\528d545ca3b921exeexe_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\7F71.tmp"C:\Users\Admin\AppData\Local\Temp\7F71.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\802C.tmp"C:\Users\Admin\AppData\Local\Temp\802C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\80A9.tmp"C:\Users\Admin\AppData\Local\Temp\80A9.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\8136.tmp"C:\Users\Admin\AppData\Local\Temp\8136.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\8770.tmp"C:\Users\Admin\AppData\Local\Temp\8770.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\88F6.tmp"C:\Users\Admin\AppData\Local\Temp\88F6.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\8993.tmp"C:\Users\Admin\AppData\Local\Temp\8993.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\8B67.tmp"C:\Users\Admin\AppData\Local\Temp\8B67.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\8E46.tmp"C:\Users\Admin\AppData\Local\Temp\8E46.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\8F20.tmp"C:\Users\Admin\AppData\Local\Temp\8F20.tmp"23⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"24⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\903A.tmp"C:\Users\Admin\AppData\Local\Temp\903A.tmp"25⤵
- Executes dropped EXE
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"26⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\9134.tmp"C:\Users\Admin\AppData\Local\Temp\9134.tmp"27⤵
- Executes dropped EXE
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\91D0.tmp"C:\Users\Admin\AppData\Local\Temp\91D0.tmp"28⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\924D.tmp"C:\Users\Admin\AppData\Local\Temp\924D.tmp"29⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\9328.tmp"C:\Users\Admin\AppData\Local\Temp\9328.tmp"30⤵
- Executes dropped EXE
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\93B4.tmp"C:\Users\Admin\AppData\Local\Temp\93B4.tmp"31⤵
- Executes dropped EXE
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\9460.tmp"C:\Users\Admin\AppData\Local\Temp\9460.tmp"32⤵
- Executes dropped EXE
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\94DD.tmp"C:\Users\Admin\AppData\Local\Temp\94DD.tmp"33⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\95C8.tmp"C:\Users\Admin\AppData\Local\Temp\95C8.tmp"34⤵
- Executes dropped EXE
PID:588 -
C:\Users\Admin\AppData\Local\Temp\9654.tmp"C:\Users\Admin\AppData\Local\Temp\9654.tmp"35⤵
- Executes dropped EXE
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\96D1.tmp"C:\Users\Admin\AppData\Local\Temp\96D1.tmp"36⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\976D.tmp"C:\Users\Admin\AppData\Local\Temp\976D.tmp"37⤵
- Executes dropped EXE
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\9839.tmp"C:\Users\Admin\AppData\Local\Temp\9839.tmp"38⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\98C5.tmp"C:\Users\Admin\AppData\Local\Temp\98C5.tmp"39⤵
- Executes dropped EXE
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"40⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"41⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"42⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"43⤵
- Executes dropped EXE
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"44⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"45⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"46⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"47⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\9D59.tmp"C:\Users\Admin\AppData\Local\Temp\9D59.tmp"48⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"49⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"50⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"51⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"52⤵
- Executes dropped EXE
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"53⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\A066.tmp"C:\Users\Admin\AppData\Local\Temp\A066.tmp"54⤵
- Executes dropped EXE
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"55⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"56⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"57⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\A24B.tmp"C:\Users\Admin\AppData\Local\Temp\A24B.tmp"58⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"59⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\A354.tmp"C:\Users\Admin\AppData\Local\Temp\A354.tmp"60⤵
- Executes dropped EXE
PID:472 -
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"61⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"62⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"63⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\A577.tmp"C:\Users\Admin\AppData\Local\Temp\A577.tmp"64⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"65⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"66⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"67⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"68⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"69⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"70⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\A950.tmp"C:\Users\Admin\AppData\Local\Temp\A950.tmp"71⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"72⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\AA69.tmp"C:\Users\Admin\AppData\Local\Temp\AA69.tmp"73⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"74⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\AB72.tmp"C:\Users\Admin\AppData\Local\Temp\AB72.tmp"75⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"76⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"77⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"78⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"79⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"80⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\AE60.tmp"C:\Users\Admin\AppData\Local\Temp\AE60.tmp"81⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"82⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"83⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"84⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\B093.tmp"C:\Users\Admin\AppData\Local\Temp\B093.tmp"85⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\B100.tmp"C:\Users\Admin\AppData\Local\Temp\B100.tmp"86⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\B17D.tmp"C:\Users\Admin\AppData\Local\Temp\B17D.tmp"87⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\B21A.tmp"C:\Users\Admin\AppData\Local\Temp\B21A.tmp"88⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"89⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\B323.tmp"C:\Users\Admin\AppData\Local\Temp\B323.tmp"90⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"91⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"92⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\B45C.tmp"C:\Users\Admin\AppData\Local\Temp\B45C.tmp"93⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"94⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"95⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"96⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"97⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"98⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\B71B.tmp"C:\Users\Admin\AppData\Local\Temp\B71B.tmp"99⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\B779.tmp"C:\Users\Admin\AppData\Local\Temp\B779.tmp"100⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"101⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\B863.tmp"C:\Users\Admin\AppData\Local\Temp\B863.tmp"102⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"103⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\B95D.tmp"C:\Users\Admin\AppData\Local\Temp\B95D.tmp"104⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"105⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\BA57.tmp"C:\Users\Admin\AppData\Local\Temp\BA57.tmp"106⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"107⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\BB41.tmp"C:\Users\Admin\AppData\Local\Temp\BB41.tmp"108⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"109⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"110⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"111⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\BD74.tmp"C:\Users\Admin\AppData\Local\Temp\BD74.tmp"112⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"113⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"114⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"115⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\BF77.tmp"C:\Users\Admin\AppData\Local\Temp\BF77.tmp"116⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\C004.tmp"C:\Users\Admin\AppData\Local\Temp\C004.tmp"117⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"118⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"119⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"120⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"121⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\C285.tmp"C:\Users\Admin\AppData\Local\Temp\C285.tmp"122⤵PID:3652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-