Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2023, 22:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NA_07e1dc0c717e91exe_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
NA_07e1dc0c717e91exe_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
NA_07e1dc0c717e91exe_JC.exe
-
Size
486KB
-
MD5
07e1dc0c717e91f41d9612ecde6f2e32
-
SHA1
cf4ff9bfe9f2ab28ad92add1eb9deb1a7e7478e3
-
SHA256
34246b570068e59cf79e4ab159515f608c3aad77510de18f97e76828e67ed91a
-
SHA512
8fecd9757660a7cca0cfbc4ab78252f778b4e034d2af4c9846dc84804afac60c946d1bc3639303a8029a26e75bb192ba6c255c949153793bbd4037dc09d36ff4
-
SSDEEP
12288:/U5rCOTeiDOkAhmBGeQrgMua4ecgzmSuNZ:/UQOJDR5GFghwzmSuN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2252 92E9.tmp 1712 93D4.tmp 5064 94ED.tmp 3368 95D7.tmp 3752 96A2.tmp 3928 978D.tmp 4308 9829.tmp 4856 98E4.tmp 2716 9990.tmp 3612 9A0D.tmp 2592 9A9A.tmp 3868 9C6F.tmp 316 9D49.tmp 4064 9ED0.tmp 3756 9F8C.tmp 4364 A028.tmp 1548 A0D4.tmp 1376 A180.tmp 3972 A20C.tmp 4476 A289.tmp 2440 A335.tmp 3120 A3C2.tmp 4972 A47D.tmp 3816 A529.tmp 4788 A5D5.tmp 664 A77B.tmp 920 A894.tmp 1772 A950.tmp 1472 AA0B.tmp 1664 AB53.tmp 3936 AC3E.tmp 1808 ACE9.tmp 4824 ADB5.tmp 4600 AE41.tmp 4436 AEBE.tmp 3164 AF2C.tmp 4224 AFA9.tmp 468 B016.tmp 892 B0B2.tmp 4360 B17D.tmp 2864 B20A.tmp 1320 B297.tmp 2252 B342.tmp 4264 B3BF.tmp 1044 B43C.tmp 2136 B4D9.tmp 1824 B575.tmp 1676 B611.tmp 2228 B6EC.tmp 3908 B788.tmp 3040 B834.tmp 3032 B8C1.tmp 2072 B95D.tmp 4308 B9EA.tmp 1748 BA57.tmp 4292 BAE4.tmp 4988 BB80.tmp 316 BC3B.tmp 3988 BCC8.tmp 4872 BD35.tmp 2324 BDA3.tmp 4256 BE20.tmp 1548 BE8D.tmp 3940 BF0A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4024 wrote to memory of 2252 4024 NA_07e1dc0c717e91exe_JC.exe 86 PID 4024 wrote to memory of 2252 4024 NA_07e1dc0c717e91exe_JC.exe 86 PID 4024 wrote to memory of 2252 4024 NA_07e1dc0c717e91exe_JC.exe 86 PID 2252 wrote to memory of 1712 2252 92E9.tmp 87 PID 2252 wrote to memory of 1712 2252 92E9.tmp 87 PID 2252 wrote to memory of 1712 2252 92E9.tmp 87 PID 1712 wrote to memory of 5064 1712 93D4.tmp 88 PID 1712 wrote to memory of 5064 1712 93D4.tmp 88 PID 1712 wrote to memory of 5064 1712 93D4.tmp 88 PID 5064 wrote to memory of 3368 5064 94ED.tmp 89 PID 5064 wrote to memory of 3368 5064 94ED.tmp 89 PID 5064 wrote to memory of 3368 5064 94ED.tmp 89 PID 3368 wrote to memory of 3752 3368 95D7.tmp 90 PID 3368 wrote to memory of 3752 3368 95D7.tmp 90 PID 3368 wrote to memory of 3752 3368 95D7.tmp 90 PID 3752 wrote to memory of 3928 3752 96A2.tmp 91 PID 3752 wrote to memory of 3928 3752 96A2.tmp 91 PID 3752 wrote to memory of 3928 3752 96A2.tmp 91 PID 3928 wrote to memory of 4308 3928 978D.tmp 92 PID 3928 wrote to memory of 4308 3928 978D.tmp 92 PID 3928 wrote to memory of 4308 3928 978D.tmp 92 PID 4308 wrote to memory of 4856 4308 9829.tmp 93 PID 4308 wrote to memory of 4856 4308 9829.tmp 93 PID 4308 wrote to memory of 4856 4308 9829.tmp 93 PID 4856 wrote to memory of 2716 4856 98E4.tmp 94 PID 4856 wrote to memory of 2716 4856 98E4.tmp 94 PID 4856 wrote to memory of 2716 4856 98E4.tmp 94 PID 2716 wrote to memory of 3612 2716 9990.tmp 95 PID 2716 wrote to memory of 3612 2716 9990.tmp 95 PID 2716 wrote to memory of 3612 2716 9990.tmp 95 PID 3612 wrote to memory of 2592 3612 9A0D.tmp 96 PID 3612 wrote to memory of 2592 3612 9A0D.tmp 96 PID 3612 wrote to memory of 2592 3612 9A0D.tmp 96 PID 2592 wrote to memory of 3868 2592 9A9A.tmp 97 PID 2592 wrote to memory of 3868 2592 9A9A.tmp 97 PID 2592 wrote to memory of 3868 2592 9A9A.tmp 97 PID 3868 wrote to memory of 316 3868 9C6F.tmp 98 PID 3868 wrote to memory of 316 3868 9C6F.tmp 98 PID 3868 wrote to memory of 316 3868 9C6F.tmp 98 PID 316 wrote to memory of 4064 316 9D49.tmp 99 PID 316 wrote to memory of 4064 316 9D49.tmp 99 PID 316 wrote to memory of 4064 316 9D49.tmp 99 PID 4064 wrote to memory of 3756 4064 9ED0.tmp 102 PID 4064 wrote to memory of 3756 4064 9ED0.tmp 102 PID 4064 wrote to memory of 3756 4064 9ED0.tmp 102 PID 3756 wrote to memory of 4364 3756 9F8C.tmp 103 PID 3756 wrote to memory of 4364 3756 9F8C.tmp 103 PID 3756 wrote to memory of 4364 3756 9F8C.tmp 103 PID 4364 wrote to memory of 1548 4364 A028.tmp 104 PID 4364 wrote to memory of 1548 4364 A028.tmp 104 PID 4364 wrote to memory of 1548 4364 A028.tmp 104 PID 1548 wrote to memory of 1376 1548 A0D4.tmp 105 PID 1548 wrote to memory of 1376 1548 A0D4.tmp 105 PID 1548 wrote to memory of 1376 1548 A0D4.tmp 105 PID 1376 wrote to memory of 3972 1376 A180.tmp 106 PID 1376 wrote to memory of 3972 1376 A180.tmp 106 PID 1376 wrote to memory of 3972 1376 A180.tmp 106 PID 3972 wrote to memory of 4476 3972 A20C.tmp 107 PID 3972 wrote to memory of 4476 3972 A20C.tmp 107 PID 3972 wrote to memory of 4476 3972 A20C.tmp 107 PID 4476 wrote to memory of 2440 4476 A289.tmp 108 PID 4476 wrote to memory of 2440 4476 A289.tmp 108 PID 4476 wrote to memory of 2440 4476 A289.tmp 108 PID 2440 wrote to memory of 3120 2440 A335.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\NA_07e1dc0c717e91exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NA_07e1dc0c717e91exe_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\94ED.tmp"C:\Users\Admin\AppData\Local\Temp\94ED.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\95D7.tmp"C:\Users\Admin\AppData\Local\Temp\95D7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\978D.tmp"C:\Users\Admin\AppData\Local\Temp\978D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\98E4.tmp"C:\Users\Admin\AppData\Local\Temp\98E4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\A028.tmp"C:\Users\Admin\AppData\Local\Temp\A028.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\A180.tmp"C:\Users\Admin\AppData\Local\Temp\A180.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\A20C.tmp"C:\Users\Admin\AppData\Local\Temp\A20C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"23⤵
- Executes dropped EXE
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\A47D.tmp"C:\Users\Admin\AppData\Local\Temp\A47D.tmp"24⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"25⤵
- Executes dropped EXE
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"26⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"27⤵
- Executes dropped EXE
PID:664 -
C:\Users\Admin\AppData\Local\Temp\A894.tmp"C:\Users\Admin\AppData\Local\Temp\A894.tmp"28⤵
- Executes dropped EXE
PID:920 -
C:\Users\Admin\AppData\Local\Temp\A950.tmp"C:\Users\Admin\AppData\Local\Temp\A950.tmp"29⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"30⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\AB53.tmp"C:\Users\Admin\AppData\Local\Temp\AB53.tmp"31⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"32⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"33⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"34⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\AE41.tmp"C:\Users\Admin\AppData\Local\Temp\AE41.tmp"35⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"36⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"37⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"38⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\B016.tmp"C:\Users\Admin\AppData\Local\Temp\B016.tmp"39⤵
- Executes dropped EXE
PID:468 -
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"40⤵
- Executes dropped EXE
PID:892 -
C:\Users\Admin\AppData\Local\Temp\B17D.tmp"C:\Users\Admin\AppData\Local\Temp\B17D.tmp"41⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\B20A.tmp"C:\Users\Admin\AppData\Local\Temp\B20A.tmp"42⤵
- Executes dropped EXE
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"43⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\B342.tmp"C:\Users\Admin\AppData\Local\Temp\B342.tmp"44⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"45⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\B43C.tmp"C:\Users\Admin\AppData\Local\Temp\B43C.tmp"46⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"47⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\B575.tmp"C:\Users\Admin\AppData\Local\Temp\B575.tmp"48⤵
- Executes dropped EXE
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\B611.tmp"C:\Users\Admin\AppData\Local\Temp\B611.tmp"49⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"50⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\B788.tmp"C:\Users\Admin\AppData\Local\Temp\B788.tmp"51⤵
- Executes dropped EXE
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\B834.tmp"C:\Users\Admin\AppData\Local\Temp\B834.tmp"52⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"53⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\B95D.tmp"C:\Users\Admin\AppData\Local\Temp\B95D.tmp"54⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"55⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\BA57.tmp"C:\Users\Admin\AppData\Local\Temp\BA57.tmp"56⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"57⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\BB80.tmp"C:\Users\Admin\AppData\Local\Temp\BB80.tmp"58⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"59⤵
- Executes dropped EXE
PID:316 -
C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"60⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\BD35.tmp"C:\Users\Admin\AppData\Local\Temp\BD35.tmp"61⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"62⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\BE20.tmp"C:\Users\Admin\AppData\Local\Temp\BE20.tmp"63⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"64⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"65⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"66⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"67⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"68⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"69⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"70⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"71⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\C37F.tmp"C:\Users\Admin\AppData\Local\Temp\C37F.tmp"72⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"73⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\C469.tmp"C:\Users\Admin\AppData\Local\Temp\C469.tmp"74⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"75⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\C592.tmp"C:\Users\Admin\AppData\Local\Temp\C592.tmp"76⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\C62E.tmp"C:\Users\Admin\AppData\Local\Temp\C62E.tmp"77⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"78⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\C709.tmp"C:\Users\Admin\AppData\Local\Temp\C709.tmp"79⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\C776.tmp"C:\Users\Admin\AppData\Local\Temp\C776.tmp"80⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"81⤵PID:492
-
C:\Users\Admin\AppData\Local\Temp\C870.tmp"C:\Users\Admin\AppData\Local\Temp\C870.tmp"82⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"83⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\C92C.tmp"C:\Users\Admin\AppData\Local\Temp\C92C.tmp"84⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\C999.tmp"C:\Users\Admin\AppData\Local\Temp\C999.tmp"85⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\CA07.tmp"C:\Users\Admin\AppData\Local\Temp\CA07.tmp"86⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\CA74.tmp"C:\Users\Admin\AppData\Local\Temp\CA74.tmp"87⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"88⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"89⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\CC78.tmp"C:\Users\Admin\AppData\Local\Temp\CC78.tmp"90⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\CCE5.tmp"C:\Users\Admin\AppData\Local\Temp\CCE5.tmp"91⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\CD72.tmp"C:\Users\Admin\AppData\Local\Temp\CD72.tmp"92⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\CE0E.tmp"C:\Users\Admin\AppData\Local\Temp\CE0E.tmp"93⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"94⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\CF27.tmp"C:\Users\Admin\AppData\Local\Temp\CF27.tmp"95⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"96⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\D031.tmp"C:\Users\Admin\AppData\Local\Temp\D031.tmp"97⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\D09E.tmp"C:\Users\Admin\AppData\Local\Temp\D09E.tmp"98⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\D11B.tmp"C:\Users\Admin\AppData\Local\Temp\D11B.tmp"99⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\D1B7.tmp"C:\Users\Admin\AppData\Local\Temp\D1B7.tmp"100⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\D234.tmp"C:\Users\Admin\AppData\Local\Temp\D234.tmp"101⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"102⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\D37C.tmp"C:\Users\Admin\AppData\Local\Temp\D37C.tmp"103⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\D3F9.tmp"C:\Users\Admin\AppData\Local\Temp\D3F9.tmp"104⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"105⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\D532.tmp"C:\Users\Admin\AppData\Local\Temp\D532.tmp"106⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"107⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\D67A.tmp"C:\Users\Admin\AppData\Local\Temp\D67A.tmp"108⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"109⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\D85E.tmp"C:\Users\Admin\AppData\Local\Temp\D85E.tmp"110⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"111⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\D978.tmp"C:\Users\Admin\AppData\Local\Temp\D978.tmp"112⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\D9F5.tmp"C:\Users\Admin\AppData\Local\Temp\D9F5.tmp"113⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\DA81.tmp"C:\Users\Admin\AppData\Local\Temp\DA81.tmp"114⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\DAFE.tmp"C:\Users\Admin\AppData\Local\Temp\DAFE.tmp"115⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"116⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\DC27.tmp"C:\Users\Admin\AppData\Local\Temp\DC27.tmp"117⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"118⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\DD40.tmp"C:\Users\Admin\AppData\Local\Temp\DD40.tmp"119⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"120⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\DE3A.tmp"C:\Users\Admin\AppData\Local\Temp\DE3A.tmp"121⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\DED7.tmp"C:\Users\Admin\AppData\Local\Temp\DED7.tmp"122⤵PID:3828
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-