Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18/07/2023, 14:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bba7e0c59815e6_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
bba7e0c59815e6_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
bba7e0c59815e6_JC.exe
-
Size
488KB
-
MD5
bba7e0c59815e66efda16b95d707ae82
-
SHA1
a3e2df7a2a1c71d1637e2e58af6d0ccc0b51c8a8
-
SHA256
b25f271c3c86d8fdc8e15fc672c088405cf6f841f9e51d0c6572fa319be55526
-
SHA512
b2fad79153739de5ba5d45f95b69c6733f150bae95db2a5fd1488194db1f55254b1be07bb0b32fae2ed0d0b17e86e74e5539946490ca4cf4982952f375929850
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7ShJ47uqbW5IsFwG6nwwbciRHLwQjozsvm1oP:/U5rCOTeiDSci8WdUw4hwVyuo8ixlNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4932 7BF6.tmp 2656 7CC1.tmp 2952 7D7D.tmp 2300 7E38.tmp 396 7EF4.tmp 4640 7FBF.tmp 4196 808A.tmp 616 8126.tmp 720 81F1.tmp 1060 82CC.tmp 4136 8368.tmp 3612 8434.tmp 1200 84DF.tmp 4876 859B.tmp 2224 8637.tmp 2900 877F.tmp 1568 881C.tmp 2000 88F6.tmp 2844 89A2.tmp 2368 8A1F.tmp 676 8ACB.tmp 4644 8B96.tmp 4280 8C61.tmp 3860 8D4C.tmp 2928 8E07.tmp 3220 8ED2.tmp 372 8FCC.tmp 3900 9088.tmp 1468 9163.tmp 3212 923D.tmp 4036 9328.tmp 2060 93D4.tmp 4932 947F.tmp 2656 955A.tmp 5052 95D7.tmp 4352 9664.tmp 4912 971F.tmp 396 97CB.tmp 4888 9867.tmp 1436 98E4.tmp 4132 9971.tmp 856 9A0D.tmp 2572 9AC9.tmp 2768 9B46.tmp 3972 9C11.tmp 3864 9C8E.tmp 4136 9D2A.tmp 4808 9DA7.tmp 3656 9E53.tmp 1976 9EC0.tmp 3956 9F2E.tmp 872 9FCA.tmp 3548 A037.tmp 1064 A0E3.tmp 216 A151.tmp 916 A1BE.tmp 3460 A21C.tmp 2332 A289.tmp 4512 A2F7.tmp 552 A345.tmp 2980 A3E1.tmp 2316 A46E.tmp 3216 A4EB.tmp 4460 A558.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2060 wrote to memory of 4932 2060 bba7e0c59815e6_JC.exe 85 PID 2060 wrote to memory of 4932 2060 bba7e0c59815e6_JC.exe 85 PID 2060 wrote to memory of 4932 2060 bba7e0c59815e6_JC.exe 85 PID 4932 wrote to memory of 2656 4932 7BF6.tmp 86 PID 4932 wrote to memory of 2656 4932 7BF6.tmp 86 PID 4932 wrote to memory of 2656 4932 7BF6.tmp 86 PID 2656 wrote to memory of 2952 2656 7CC1.tmp 87 PID 2656 wrote to memory of 2952 2656 7CC1.tmp 87 PID 2656 wrote to memory of 2952 2656 7CC1.tmp 87 PID 2952 wrote to memory of 2300 2952 7D7D.tmp 88 PID 2952 wrote to memory of 2300 2952 7D7D.tmp 88 PID 2952 wrote to memory of 2300 2952 7D7D.tmp 88 PID 2300 wrote to memory of 396 2300 7E38.tmp 90 PID 2300 wrote to memory of 396 2300 7E38.tmp 90 PID 2300 wrote to memory of 396 2300 7E38.tmp 90 PID 396 wrote to memory of 4640 396 7EF4.tmp 91 PID 396 wrote to memory of 4640 396 7EF4.tmp 91 PID 396 wrote to memory of 4640 396 7EF4.tmp 91 PID 4640 wrote to memory of 4196 4640 7FBF.tmp 92 PID 4640 wrote to memory of 4196 4640 7FBF.tmp 92 PID 4640 wrote to memory of 4196 4640 7FBF.tmp 92 PID 4196 wrote to memory of 616 4196 808A.tmp 93 PID 4196 wrote to memory of 616 4196 808A.tmp 93 PID 4196 wrote to memory of 616 4196 808A.tmp 93 PID 616 wrote to memory of 720 616 8126.tmp 94 PID 616 wrote to memory of 720 616 8126.tmp 94 PID 616 wrote to memory of 720 616 8126.tmp 94 PID 720 wrote to memory of 1060 720 81F1.tmp 95 PID 720 wrote to memory of 1060 720 81F1.tmp 95 PID 720 wrote to memory of 1060 720 81F1.tmp 95 PID 1060 wrote to memory of 4136 1060 82CC.tmp 96 PID 1060 wrote to memory of 4136 1060 82CC.tmp 96 PID 1060 wrote to memory of 4136 1060 82CC.tmp 96 PID 4136 wrote to memory of 3612 4136 8368.tmp 97 PID 4136 wrote to memory of 3612 4136 8368.tmp 97 PID 4136 wrote to memory of 3612 4136 8368.tmp 97 PID 3612 wrote to memory of 1200 3612 8434.tmp 100 PID 3612 wrote to memory of 1200 3612 8434.tmp 100 PID 3612 wrote to memory of 1200 3612 8434.tmp 100 PID 1200 wrote to memory of 4876 1200 84DF.tmp 102 PID 1200 wrote to memory of 4876 1200 84DF.tmp 102 PID 1200 wrote to memory of 4876 1200 84DF.tmp 102 PID 4876 wrote to memory of 2224 4876 859B.tmp 103 PID 4876 wrote to memory of 2224 4876 859B.tmp 103 PID 4876 wrote to memory of 2224 4876 859B.tmp 103 PID 2224 wrote to memory of 2900 2224 8637.tmp 104 PID 2224 wrote to memory of 2900 2224 8637.tmp 104 PID 2224 wrote to memory of 2900 2224 8637.tmp 104 PID 2900 wrote to memory of 1568 2900 877F.tmp 106 PID 2900 wrote to memory of 1568 2900 877F.tmp 106 PID 2900 wrote to memory of 1568 2900 877F.tmp 106 PID 1568 wrote to memory of 2000 1568 881C.tmp 107 PID 1568 wrote to memory of 2000 1568 881C.tmp 107 PID 1568 wrote to memory of 2000 1568 881C.tmp 107 PID 2000 wrote to memory of 2844 2000 88F6.tmp 109 PID 2000 wrote to memory of 2844 2000 88F6.tmp 109 PID 2000 wrote to memory of 2844 2000 88F6.tmp 109 PID 2844 wrote to memory of 2368 2844 89A2.tmp 110 PID 2844 wrote to memory of 2368 2844 89A2.tmp 110 PID 2844 wrote to memory of 2368 2844 89A2.tmp 110 PID 2368 wrote to memory of 676 2368 8A1F.tmp 112 PID 2368 wrote to memory of 676 2368 8A1F.tmp 112 PID 2368 wrote to memory of 676 2368 8A1F.tmp 112 PID 676 wrote to memory of 4644 676 8ACB.tmp 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\bba7e0c59815e6_JC.exe"C:\Users\Admin\AppData\Local\Temp\bba7e0c59815e6_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\7E38.tmp"C:\Users\Admin\AppData\Local\Temp\7E38.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\808A.tmp"C:\Users\Admin\AppData\Local\Temp\808A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\8126.tmp"C:\Users\Admin\AppData\Local\Temp\8126.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Local\Temp\81F1.tmp"C:\Users\Admin\AppData\Local\Temp\81F1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\8368.tmp"C:\Users\Admin\AppData\Local\Temp\8368.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\8434.tmp"C:\Users\Admin\AppData\Local\Temp\8434.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\84DF.tmp"C:\Users\Admin\AppData\Local\Temp\84DF.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\859B.tmp"C:\Users\Admin\AppData\Local\Temp\859B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\8637.tmp"C:\Users\Admin\AppData\Local\Temp\8637.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\877F.tmp"C:\Users\Admin\AppData\Local\Temp\877F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\881C.tmp"C:\Users\Admin\AppData\Local\Temp\881C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\88F6.tmp"C:\Users\Admin\AppData\Local\Temp\88F6.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\89A2.tmp"C:\Users\Admin\AppData\Local\Temp\89A2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Users\Admin\AppData\Local\Temp\8B96.tmp"C:\Users\Admin\AppData\Local\Temp\8B96.tmp"23⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\8C61.tmp"C:\Users\Admin\AppData\Local\Temp\8C61.tmp"24⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"25⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\8E07.tmp"C:\Users\Admin\AppData\Local\Temp\8E07.tmp"26⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"27⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"28⤵
- Executes dropped EXE
PID:372 -
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"29⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\9163.tmp"C:\Users\Admin\AppData\Local\Temp\9163.tmp"30⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\923D.tmp"C:\Users\Admin\AppData\Local\Temp\923D.tmp"31⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\9328.tmp"C:\Users\Admin\AppData\Local\Temp\9328.tmp"32⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"33⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\947F.tmp"C:\Users\Admin\AppData\Local\Temp\947F.tmp"34⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"35⤵
- Executes dropped EXE
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\95D7.tmp"C:\Users\Admin\AppData\Local\Temp\95D7.tmp"36⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\9664.tmp"C:\Users\Admin\AppData\Local\Temp\9664.tmp"37⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"38⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\97CB.tmp"C:\Users\Admin\AppData\Local\Temp\97CB.tmp"39⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\9867.tmp"C:\Users\Admin\AppData\Local\Temp\9867.tmp"40⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\98E4.tmp"C:\Users\Admin\AppData\Local\Temp\98E4.tmp"41⤵
- Executes dropped EXE
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"42⤵
- Executes dropped EXE
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"43⤵
- Executes dropped EXE
PID:856 -
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"44⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"45⤵
- Executes dropped EXE
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"46⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"47⤵
- Executes dropped EXE
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"48⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"49⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\9E53.tmp"C:\Users\Admin\AppData\Local\Temp\9E53.tmp"50⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"51⤵
- Executes dropped EXE
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"52⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"53⤵
- Executes dropped EXE
PID:872 -
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"54⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"55⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"56⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"57⤵
- Executes dropped EXE
PID:916 -
C:\Users\Admin\AppData\Local\Temp\A21C.tmp"C:\Users\Admin\AppData\Local\Temp\A21C.tmp"58⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"59⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"60⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"61⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"62⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\A46E.tmp"C:\Users\Admin\AppData\Local\Temp\A46E.tmp"63⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"64⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"65⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"66⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"67⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"68⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"69⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\A856.tmp"C:\Users\Admin\AppData\Local\Temp\A856.tmp"70⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"71⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"72⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"73⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"74⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\AB72.tmp"C:\Users\Admin\AppData\Local\Temp\AB72.tmp"75⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"76⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"77⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"78⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"79⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"80⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"81⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"82⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\AF99.tmp"C:\Users\Admin\AppData\Local\Temp\AF99.tmp"83⤵PID:508
-
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"84⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"85⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\B14E.tmp"C:\Users\Admin\AppData\Local\Temp\B14E.tmp"86⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"87⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\B229.tmp"C:\Users\Admin\AppData\Local\Temp\B229.tmp"88⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"89⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"90⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\B371.tmp"C:\Users\Admin\AppData\Local\Temp\B371.tmp"91⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"92⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\B45C.tmp"C:\Users\Admin\AppData\Local\Temp\B45C.tmp"93⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"94⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"95⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"96⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\B621.tmp"C:\Users\Admin\AppData\Local\Temp\B621.tmp"97⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\B69E.tmp"C:\Users\Admin\AppData\Local\Temp\B69E.tmp"98⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\B71B.tmp"C:\Users\Admin\AppData\Local\Temp\B71B.tmp"99⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"100⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\B824.tmp"C:\Users\Admin\AppData\Local\Temp\B824.tmp"101⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"102⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\B96D.tmp"C:\Users\Admin\AppData\Local\Temp\B96D.tmp"103⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"104⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\BA67.tmp"C:\Users\Admin\AppData\Local\Temp\BA67.tmp"105⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\BAF3.tmp"C:\Users\Admin\AppData\Local\Temp\BAF3.tmp"106⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\BB80.tmp"C:\Users\Admin\AppData\Local\Temp\BB80.tmp"107⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"108⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"109⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\BD35.tmp"C:\Users\Admin\AppData\Local\Temp\BD35.tmp"110⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"111⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"112⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"113⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\BF97.tmp"C:\Users\Admin\AppData\Local\Temp\BF97.tmp"114⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"115⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"116⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"117⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"118⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\C246.tmp"C:\Users\Admin\AppData\Local\Temp\C246.tmp"119⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"120⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\C36F.tmp"C:\Users\Admin\AppData\Local\Temp\C36F.tmp"121⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\C41B.tmp"C:\Users\Admin\AppData\Local\Temp\C41B.tmp"122⤵PID:2180
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-