Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2023, 21:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NA_008b1b1d831bfaexe_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
NA_008b1b1d831bfaexe_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
NA_008b1b1d831bfaexe_JC.exe
-
Size
520KB
-
MD5
008b1b1d831bfafd222a7e65e00b2597
-
SHA1
be400f2fd7d1d3f532fc0c3b3d2404aee366e2f9
-
SHA256
d538ee74966ce76e88365b7c3333bfc5826b42886d04b045e42bff38cc714848
-
SHA512
9eb73e120f4ff7abcb130368f446572a71f87fe1cee8130d3a47bc4cce7cb682ecd73d62893aa7f87c726df3f9545593bbd588fa84ff7dae98f4d892cb47a6d0
-
SSDEEP
12288:N1BgMWXtBmkl+WrD5DEGtYMdmxTQQeeNZ:N1qX2ksa9DEuw9eeN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4444 8695.tmp 1492 877F.tmp 4168 882B.tmp 4980 88F6.tmp 2396 89E1.tmp 4396 8ACB.tmp 2040 8BA6.tmp 3580 8CA0.tmp 368 8D4C.tmp 3856 8DF8.tmp 532 8E94.tmp 972 8F40.tmp 4500 9059.tmp 3084 9143.tmp 1368 91E0.tmp 4360 92CA.tmp 4316 9366.tmp 2408 9402.tmp 4492 94FC.tmp 4988 95B8.tmp 2512 9664.tmp 1920 971F.tmp 2032 97BC.tmp 320 9896.tmp 4564 9990.tmp 2584 9A1D.tmp 4752 9B55.tmp 1644 9BE2.tmp 880 9CCC.tmp 3420 9D49.tmp 3060 9E43.tmp 1560 9F2E.tmp 1372 9FF9.tmp 2300 A086.tmp 3400 A0E3.tmp 1320 A170.tmp 1492 A20C.tmp 816 A2B8.tmp 3524 A335.tmp 1836 A3C2.tmp 1764 A46E.tmp 4636 A4EB.tmp 4980 A596.tmp 1356 A604.tmp 2780 A6B0.tmp 3864 A71D.tmp 4600 A7B9.tmp 224 A846.tmp 2040 A8E2.tmp 4504 A96F.tmp 4612 A9EC.tmp 2732 AA78.tmp 4108 AB05.tmp 1224 ABA1.tmp 4296 AC3E.tmp 3252 ACDA.tmp 2084 AD38.tmp 2176 ADA5.tmp 4460 AE32.tmp 60 AE9F.tmp 1056 AEFD.tmp 5012 AF5A.tmp 2628 AFD7.tmp 3536 B054.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1932 wrote to memory of 4444 1932 NA_008b1b1d831bfaexe_JC.exe 85 PID 1932 wrote to memory of 4444 1932 NA_008b1b1d831bfaexe_JC.exe 85 PID 1932 wrote to memory of 4444 1932 NA_008b1b1d831bfaexe_JC.exe 85 PID 4444 wrote to memory of 1492 4444 8695.tmp 86 PID 4444 wrote to memory of 1492 4444 8695.tmp 86 PID 4444 wrote to memory of 1492 4444 8695.tmp 86 PID 1492 wrote to memory of 4168 1492 877F.tmp 87 PID 1492 wrote to memory of 4168 1492 877F.tmp 87 PID 1492 wrote to memory of 4168 1492 877F.tmp 87 PID 4168 wrote to memory of 4980 4168 882B.tmp 88 PID 4168 wrote to memory of 4980 4168 882B.tmp 88 PID 4168 wrote to memory of 4980 4168 882B.tmp 88 PID 4980 wrote to memory of 2396 4980 88F6.tmp 89 PID 4980 wrote to memory of 2396 4980 88F6.tmp 89 PID 4980 wrote to memory of 2396 4980 88F6.tmp 89 PID 2396 wrote to memory of 4396 2396 89E1.tmp 90 PID 2396 wrote to memory of 4396 2396 89E1.tmp 90 PID 2396 wrote to memory of 4396 2396 89E1.tmp 90 PID 4396 wrote to memory of 2040 4396 8ACB.tmp 91 PID 4396 wrote to memory of 2040 4396 8ACB.tmp 91 PID 4396 wrote to memory of 2040 4396 8ACB.tmp 91 PID 2040 wrote to memory of 3580 2040 8BA6.tmp 92 PID 2040 wrote to memory of 3580 2040 8BA6.tmp 92 PID 2040 wrote to memory of 3580 2040 8BA6.tmp 92 PID 3580 wrote to memory of 368 3580 8CA0.tmp 93 PID 3580 wrote to memory of 368 3580 8CA0.tmp 93 PID 3580 wrote to memory of 368 3580 8CA0.tmp 93 PID 368 wrote to memory of 3856 368 8D4C.tmp 94 PID 368 wrote to memory of 3856 368 8D4C.tmp 94 PID 368 wrote to memory of 3856 368 8D4C.tmp 94 PID 3856 wrote to memory of 532 3856 8DF8.tmp 95 PID 3856 wrote to memory of 532 3856 8DF8.tmp 95 PID 3856 wrote to memory of 532 3856 8DF8.tmp 95 PID 532 wrote to memory of 972 532 8E94.tmp 96 PID 532 wrote to memory of 972 532 8E94.tmp 96 PID 532 wrote to memory of 972 532 8E94.tmp 96 PID 972 wrote to memory of 4500 972 8F40.tmp 97 PID 972 wrote to memory of 4500 972 8F40.tmp 97 PID 972 wrote to memory of 4500 972 8F40.tmp 97 PID 4500 wrote to memory of 3084 4500 9059.tmp 100 PID 4500 wrote to memory of 3084 4500 9059.tmp 100 PID 4500 wrote to memory of 3084 4500 9059.tmp 100 PID 3084 wrote to memory of 1368 3084 9143.tmp 101 PID 3084 wrote to memory of 1368 3084 9143.tmp 101 PID 3084 wrote to memory of 1368 3084 9143.tmp 101 PID 1368 wrote to memory of 4360 1368 91E0.tmp 102 PID 1368 wrote to memory of 4360 1368 91E0.tmp 102 PID 1368 wrote to memory of 4360 1368 91E0.tmp 102 PID 4360 wrote to memory of 4316 4360 92CA.tmp 103 PID 4360 wrote to memory of 4316 4360 92CA.tmp 103 PID 4360 wrote to memory of 4316 4360 92CA.tmp 103 PID 4316 wrote to memory of 2408 4316 9366.tmp 104 PID 4316 wrote to memory of 2408 4316 9366.tmp 104 PID 4316 wrote to memory of 2408 4316 9366.tmp 104 PID 2408 wrote to memory of 4492 2408 9402.tmp 105 PID 2408 wrote to memory of 4492 2408 9402.tmp 105 PID 2408 wrote to memory of 4492 2408 9402.tmp 105 PID 4492 wrote to memory of 4988 4492 94FC.tmp 107 PID 4492 wrote to memory of 4988 4492 94FC.tmp 107 PID 4492 wrote to memory of 4988 4492 94FC.tmp 107 PID 4988 wrote to memory of 2512 4988 95B8.tmp 108 PID 4988 wrote to memory of 2512 4988 95B8.tmp 108 PID 4988 wrote to memory of 2512 4988 95B8.tmp 108 PID 2512 wrote to memory of 1920 2512 9664.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\NA_008b1b1d831bfaexe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NA_008b1b1d831bfaexe_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\8695.tmp"C:\Users\Admin\AppData\Local\Temp\8695.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\877F.tmp"C:\Users\Admin\AppData\Local\Temp\877F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\882B.tmp"C:\Users\Admin\AppData\Local\Temp\882B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\88F6.tmp"C:\Users\Admin\AppData\Local\Temp\88F6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\89E1.tmp"C:\Users\Admin\AppData\Local\Temp\89E1.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\8E94.tmp"C:\Users\Admin\AppData\Local\Temp\8E94.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Users\Admin\AppData\Local\Temp\8F40.tmp"C:\Users\Admin\AppData\Local\Temp\8F40.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\9143.tmp"C:\Users\Admin\AppData\Local\Temp\9143.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\91E0.tmp"C:\Users\Admin\AppData\Local\Temp\91E0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\92CA.tmp"C:\Users\Admin\AppData\Local\Temp\92CA.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\9366.tmp"C:\Users\Admin\AppData\Local\Temp\9366.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\9402.tmp"C:\Users\Admin\AppData\Local\Temp\9402.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\94FC.tmp"C:\Users\Admin\AppData\Local\Temp\94FC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\95B8.tmp"C:\Users\Admin\AppData\Local\Temp\95B8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\9664.tmp"C:\Users\Admin\AppData\Local\Temp\9664.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"23⤵
- Executes dropped EXE
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\97BC.tmp"C:\Users\Admin\AppData\Local\Temp\97BC.tmp"24⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\9896.tmp"C:\Users\Admin\AppData\Local\Temp\9896.tmp"25⤵
- Executes dropped EXE
PID:320 -
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"26⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"27⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"28⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"29⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"30⤵
- Executes dropped EXE
PID:880 -
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"31⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"32⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"33⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"34⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\A086.tmp"C:\Users\Admin\AppData\Local\Temp\A086.tmp"35⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"36⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"37⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\A20C.tmp"C:\Users\Admin\AppData\Local\Temp\A20C.tmp"38⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"39⤵
- Executes dropped EXE
PID:816 -
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"40⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"41⤵
- Executes dropped EXE
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\A46E.tmp"C:\Users\Admin\AppData\Local\Temp\A46E.tmp"42⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"43⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"44⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"45⤵
- Executes dropped EXE
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"46⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"47⤵
- Executes dropped EXE
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"48⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"49⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"50⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\A96F.tmp"C:\Users\Admin\AppData\Local\Temp\A96F.tmp"51⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"52⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"53⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\AB05.tmp"C:\Users\Admin\AppData\Local\Temp\AB05.tmp"54⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"55⤵
- Executes dropped EXE
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"56⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"57⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\AD38.tmp"C:\Users\Admin\AppData\Local\Temp\AD38.tmp"58⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"59⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"60⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"61⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"62⤵
- Executes dropped EXE
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"63⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"64⤵
- Executes dropped EXE
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\B054.tmp"C:\Users\Admin\AppData\Local\Temp\B054.tmp"65⤵
- Executes dropped EXE
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"66⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\B17D.tmp"C:\Users\Admin\AppData\Local\Temp\B17D.tmp"67⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\B20A.tmp"C:\Users\Admin\AppData\Local\Temp\B20A.tmp"68⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"69⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"70⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"71⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"72⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"73⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\B594.tmp"C:\Users\Admin\AppData\Local\Temp\B594.tmp"74⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\B602.tmp"C:\Users\Admin\AppData\Local\Temp\B602.tmp"75⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\B67F.tmp"C:\Users\Admin\AppData\Local\Temp\B67F.tmp"76⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"77⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\B759.tmp"C:\Users\Admin\AppData\Local\Temp\B759.tmp"78⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"79⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\B873.tmp"C:\Users\Admin\AppData\Local\Temp\B873.tmp"80⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"81⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\B98C.tmp"C:\Users\Admin\AppData\Local\Temp\B98C.tmp"82⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\BA09.tmp"C:\Users\Admin\AppData\Local\Temp\BA09.tmp"83⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\BA76.tmp"C:\Users\Admin\AppData\Local\Temp\BA76.tmp"84⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\BB12.tmp"C:\Users\Admin\AppData\Local\Temp\BB12.tmp"85⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"86⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"87⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"88⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\BD55.tmp"C:\Users\Admin\AppData\Local\Temp\BD55.tmp"89⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"90⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"91⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\BF29.tmp"C:\Users\Admin\AppData\Local\Temp\BF29.tmp"92⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"93⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\C052.tmp"C:\Users\Admin\AppData\Local\Temp\C052.tmp"94⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"95⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\C16B.tmp"C:\Users\Admin\AppData\Local\Temp\C16B.tmp"96⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"97⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\C275.tmp"C:\Users\Admin\AppData\Local\Temp\C275.tmp"98⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\C302.tmp"C:\Users\Admin\AppData\Local\Temp\C302.tmp"99⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\C39E.tmp"C:\Users\Admin\AppData\Local\Temp\C39E.tmp"100⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\C43A.tmp"C:\Users\Admin\AppData\Local\Temp\C43A.tmp"101⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"102⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\C534.tmp"C:\Users\Admin\AppData\Local\Temp\C534.tmp"103⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"104⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\C64D.tmp"C:\Users\Admin\AppData\Local\Temp\C64D.tmp"105⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\C6EA.tmp"C:\Users\Admin\AppData\Local\Temp\C6EA.tmp"106⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\C776.tmp"C:\Users\Admin\AppData\Local\Temp\C776.tmp"107⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\C7E4.tmp"C:\Users\Admin\AppData\Local\Temp\C7E4.tmp"108⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\C870.tmp"C:\Users\Admin\AppData\Local\Temp\C870.tmp"109⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"110⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\C97A.tmp"C:\Users\Admin\AppData\Local\Temp\C97A.tmp"111⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"112⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\CA55.tmp"C:\Users\Admin\AppData\Local\Temp\CA55.tmp"113⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\CB01.tmp"C:\Users\Admin\AppData\Local\Temp\CB01.tmp"114⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"115⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"116⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\CC78.tmp"C:\Users\Admin\AppData\Local\Temp\CC78.tmp"117⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\CD04.tmp"C:\Users\Admin\AppData\Local\Temp\CD04.tmp"118⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\CD91.tmp"C:\Users\Admin\AppData\Local\Temp\CD91.tmp"119⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"120⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\CEAA.tmp"C:\Users\Admin\AppData\Local\Temp\CEAA.tmp"121⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\CF27.tmp"C:\Users\Admin\AppData\Local\Temp\CF27.tmp"122⤵PID:696
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-