Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2023, 17:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NA_NA_1ad0a78a516778exeexe_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
NA_NA_1ad0a78a516778exeexe_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
NA_NA_1ad0a78a516778exeexe_JC.exe
-
Size
486KB
-
MD5
1ad0a78a516778af952883ddab45df5f
-
SHA1
926704978cfa30e95d0d8ffbdf6a82da68212ea9
-
SHA256
7b6a0e96fba69b69c403a0a1065d9f8a9b872a4171dac113e082342536bf1d93
-
SHA512
47646da5932bbb1d861825b577694847539994a4827f2a46dc3cfd72e698efe826c914a3481d6b53b401c1bc2ae3fd3ff0f064bd20aaa6eaf07ae30759e7fe18
-
SSDEEP
12288:/U5rCOTeiDo9NPlh6fAK+mJCnz/HAhW2HhpEpNZ:/UQOJDoflYAgsTHP0kN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3096 82AD.tmp 1644 8359.tmp 3716 8405.tmp 4296 84DF.tmp 1400 85AB.tmp 3132 8647.tmp 4784 86F3.tmp 2940 87BE.tmp 4800 88D7.tmp 2056 89A2.tmp 2080 8A3E.tmp 2412 8ACB.tmp 3560 8B67.tmp 4176 8BD5.tmp 2904 8C81.tmp 4808 8D4C.tmp 4128 8DF8.tmp 3044 8E84.tmp 2096 8F11.tmp 1148 8FEC.tmp 2556 90B7.tmp 4928 9163.tmp 456 920E.tmp 5060 9904.tmp 1456 99B0.tmp 4876 9A5B.tmp 4456 9AF8.tmp 3908 9B94.tmp 1768 9C6F.tmp 4680 9CFB.tmp 4768 9D69.tmp 1872 9E43.tmp 2256 9EFF.tmp 3112 9F6C.tmp 4364 9FE9.tmp 5008 A086.tmp 4548 A122.tmp 3968 A1AE.tmp 2660 A22B.tmp 4020 A2B8.tmp 8 A364.tmp 4956 A400.tmp 440 A48D.tmp 3340 A4FA.tmp 1228 A596.tmp 3716 A604.tmp 4256 A681.tmp 2756 A6EE.tmp 1188 A78A.tmp 4688 A7F8.tmp 2036 A884.tmp 3080 A8F2.tmp 3544 A96F.tmp 2000 A9CD.tmp 4764 AA3A.tmp 4064 AA98.tmp 2668 AB05.tmp 2524 AB82.tmp 228 AC0F.tmp 3748 ACAB.tmp 216 AD28.tmp 868 AD95.tmp 4176 AE12.tmp 4192 AEAF.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2040 wrote to memory of 3096 2040 NA_NA_1ad0a78a516778exeexe_JC.exe 85 PID 2040 wrote to memory of 3096 2040 NA_NA_1ad0a78a516778exeexe_JC.exe 85 PID 2040 wrote to memory of 3096 2040 NA_NA_1ad0a78a516778exeexe_JC.exe 85 PID 3096 wrote to memory of 1644 3096 82AD.tmp 86 PID 3096 wrote to memory of 1644 3096 82AD.tmp 86 PID 3096 wrote to memory of 1644 3096 82AD.tmp 86 PID 1644 wrote to memory of 3716 1644 8359.tmp 87 PID 1644 wrote to memory of 3716 1644 8359.tmp 87 PID 1644 wrote to memory of 3716 1644 8359.tmp 87 PID 3716 wrote to memory of 4296 3716 8405.tmp 88 PID 3716 wrote to memory of 4296 3716 8405.tmp 88 PID 3716 wrote to memory of 4296 3716 8405.tmp 88 PID 4296 wrote to memory of 1400 4296 84DF.tmp 89 PID 4296 wrote to memory of 1400 4296 84DF.tmp 89 PID 4296 wrote to memory of 1400 4296 84DF.tmp 89 PID 1400 wrote to memory of 3132 1400 85AB.tmp 90 PID 1400 wrote to memory of 3132 1400 85AB.tmp 90 PID 1400 wrote to memory of 3132 1400 85AB.tmp 90 PID 3132 wrote to memory of 4784 3132 8647.tmp 91 PID 3132 wrote to memory of 4784 3132 8647.tmp 91 PID 3132 wrote to memory of 4784 3132 8647.tmp 91 PID 4784 wrote to memory of 2940 4784 86F3.tmp 92 PID 4784 wrote to memory of 2940 4784 86F3.tmp 92 PID 4784 wrote to memory of 2940 4784 86F3.tmp 92 PID 2940 wrote to memory of 4800 2940 87BE.tmp 93 PID 2940 wrote to memory of 4800 2940 87BE.tmp 93 PID 2940 wrote to memory of 4800 2940 87BE.tmp 93 PID 4800 wrote to memory of 2056 4800 88D7.tmp 94 PID 4800 wrote to memory of 2056 4800 88D7.tmp 94 PID 4800 wrote to memory of 2056 4800 88D7.tmp 94 PID 2056 wrote to memory of 2080 2056 89A2.tmp 95 PID 2056 wrote to memory of 2080 2056 89A2.tmp 95 PID 2056 wrote to memory of 2080 2056 89A2.tmp 95 PID 2080 wrote to memory of 2412 2080 8A3E.tmp 96 PID 2080 wrote to memory of 2412 2080 8A3E.tmp 96 PID 2080 wrote to memory of 2412 2080 8A3E.tmp 96 PID 2412 wrote to memory of 3560 2412 8ACB.tmp 97 PID 2412 wrote to memory of 3560 2412 8ACB.tmp 97 PID 2412 wrote to memory of 3560 2412 8ACB.tmp 97 PID 3560 wrote to memory of 4176 3560 8B67.tmp 98 PID 3560 wrote to memory of 4176 3560 8B67.tmp 98 PID 3560 wrote to memory of 4176 3560 8B67.tmp 98 PID 4176 wrote to memory of 2904 4176 8BD5.tmp 99 PID 4176 wrote to memory of 2904 4176 8BD5.tmp 99 PID 4176 wrote to memory of 2904 4176 8BD5.tmp 99 PID 2904 wrote to memory of 4808 2904 8C81.tmp 100 PID 2904 wrote to memory of 4808 2904 8C81.tmp 100 PID 2904 wrote to memory of 4808 2904 8C81.tmp 100 PID 4808 wrote to memory of 4128 4808 8D4C.tmp 101 PID 4808 wrote to memory of 4128 4808 8D4C.tmp 101 PID 4808 wrote to memory of 4128 4808 8D4C.tmp 101 PID 4128 wrote to memory of 3044 4128 8DF8.tmp 102 PID 4128 wrote to memory of 3044 4128 8DF8.tmp 102 PID 4128 wrote to memory of 3044 4128 8DF8.tmp 102 PID 3044 wrote to memory of 2096 3044 8E84.tmp 103 PID 3044 wrote to memory of 2096 3044 8E84.tmp 103 PID 3044 wrote to memory of 2096 3044 8E84.tmp 103 PID 2096 wrote to memory of 1148 2096 8F11.tmp 104 PID 2096 wrote to memory of 1148 2096 8F11.tmp 104 PID 2096 wrote to memory of 1148 2096 8F11.tmp 104 PID 1148 wrote to memory of 2556 1148 8FEC.tmp 105 PID 1148 wrote to memory of 2556 1148 8FEC.tmp 105 PID 1148 wrote to memory of 2556 1148 8FEC.tmp 105 PID 2556 wrote to memory of 4928 2556 90B7.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\NA_NA_1ad0a78a516778exeexe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NA_NA_1ad0a78a516778exeexe_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\82AD.tmp"C:\Users\Admin\AppData\Local\Temp\82AD.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\8359.tmp"C:\Users\Admin\AppData\Local\Temp\8359.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\8405.tmp"C:\Users\Admin\AppData\Local\Temp\8405.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\84DF.tmp"C:\Users\Admin\AppData\Local\Temp\84DF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\85AB.tmp"C:\Users\Admin\AppData\Local\Temp\85AB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\8647.tmp"C:\Users\Admin\AppData\Local\Temp\8647.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\86F3.tmp"C:\Users\Admin\AppData\Local\Temp\86F3.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\87BE.tmp"C:\Users\Admin\AppData\Local\Temp\87BE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\89A2.tmp"C:\Users\Admin\AppData\Local\Temp\89A2.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\8B67.tmp"C:\Users\Admin\AppData\Local\Temp\8B67.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\8C81.tmp"C:\Users\Admin\AppData\Local\Temp\8C81.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\8E84.tmp"C:\Users\Admin\AppData\Local\Temp\8E84.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\90B7.tmp"C:\Users\Admin\AppData\Local\Temp\90B7.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\9163.tmp"C:\Users\Admin\AppData\Local\Temp\9163.tmp"23⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"24⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\9904.tmp"C:\Users\Admin\AppData\Local\Temp\9904.tmp"25⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"26⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"27⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"28⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"29⤵
- Executes dropped EXE
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"30⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"31⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\9D69.tmp"C:\Users\Admin\AppData\Local\Temp\9D69.tmp"32⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"33⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"34⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"35⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"36⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\A086.tmp"C:\Users\Admin\AppData\Local\Temp\A086.tmp"37⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"38⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"39⤵
- Executes dropped EXE
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"40⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"41⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\A364.tmp"C:\Users\Admin\AppData\Local\Temp\A364.tmp"42⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"43⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"44⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"45⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"46⤵
- Executes dropped EXE
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"47⤵
- Executes dropped EXE
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"48⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"49⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\A78A.tmp"C:\Users\Admin\AppData\Local\Temp\A78A.tmp"50⤵
- Executes dropped EXE
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"51⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\A884.tmp"C:\Users\Admin\AppData\Local\Temp\A884.tmp"52⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"53⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\A96F.tmp"C:\Users\Admin\AppData\Local\Temp\A96F.tmp"54⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"55⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"56⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"57⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\AB05.tmp"C:\Users\Admin\AppData\Local\Temp\AB05.tmp"58⤵
- Executes dropped EXE
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\AB82.tmp"C:\Users\Admin\AppData\Local\Temp\AB82.tmp"59⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"60⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"61⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"62⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\AD95.tmp"C:\Users\Admin\AppData\Local\Temp\AD95.tmp"63⤵
- Executes dropped EXE
PID:868 -
C:\Users\Admin\AppData\Local\Temp\AE12.tmp"C:\Users\Admin\AppData\Local\Temp\AE12.tmp"64⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"65⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"66⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"67⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\B035.tmp"C:\Users\Admin\AppData\Local\Temp\B035.tmp"68⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"69⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"70⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"71⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\B258.tmp"C:\Users\Admin\AppData\Local\Temp\B258.tmp"72⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"73⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\B391.tmp"C:\Users\Admin\AppData\Local\Temp\B391.tmp"74⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\B42D.tmp"C:\Users\Admin\AppData\Local\Temp\B42D.tmp"75⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"76⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"77⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"78⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"79⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"80⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\B73A.tmp"C:\Users\Admin\AppData\Local\Temp\B73A.tmp"81⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"82⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\B824.tmp"C:\Users\Admin\AppData\Local\Temp\B824.tmp"83⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"84⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"85⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"86⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\BA57.tmp"C:\Users\Admin\AppData\Local\Temp\BA57.tmp"87⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\BAF3.tmp"C:\Users\Admin\AppData\Local\Temp\BAF3.tmp"88⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"89⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"90⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"91⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\BD55.tmp"C:\Users\Admin\AppData\Local\Temp\BD55.tmp"92⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"93⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"94⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"95⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\BF68.tmp"C:\Users\Admin\AppData\Local\Temp\BF68.tmp"96⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\C004.tmp"C:\Users\Admin\AppData\Local\Temp\C004.tmp"97⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"98⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"99⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"100⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"101⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"102⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\C311.tmp"C:\Users\Admin\AppData\Local\Temp\C311.tmp"103⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\C39E.tmp"C:\Users\Admin\AppData\Local\Temp\C39E.tmp"104⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\C44A.tmp"C:\Users\Admin\AppData\Local\Temp\C44A.tmp"105⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\C4C7.tmp"C:\Users\Admin\AppData\Local\Temp\C4C7.tmp"106⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\C563.tmp"C:\Users\Admin\AppData\Local\Temp\C563.tmp"107⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"108⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\C69C.tmp"C:\Users\Admin\AppData\Local\Temp\C69C.tmp"109⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\C728.tmp"C:\Users\Admin\AppData\Local\Temp\C728.tmp"110⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\C796.tmp"C:\Users\Admin\AppData\Local\Temp\C796.tmp"111⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\C813.tmp"C:\Users\Admin\AppData\Local\Temp\C813.tmp"112⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\C890.tmp"C:\Users\Admin\AppData\Local\Temp\C890.tmp"113⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\C90D.tmp"C:\Users\Admin\AppData\Local\Temp\C90D.tmp"114⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\C96A.tmp"C:\Users\Admin\AppData\Local\Temp\C96A.tmp"115⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\C9C8.tmp"C:\Users\Admin\AppData\Local\Temp\C9C8.tmp"116⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\CA55.tmp"C:\Users\Admin\AppData\Local\Temp\CA55.tmp"117⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\CAD2.tmp"C:\Users\Admin\AppData\Local\Temp\CAD2.tmp"118⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"119⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"120⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\CC78.tmp"C:\Users\Admin\AppData\Local\Temp\CC78.tmp"121⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"122⤵PID:2552
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-