Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2023, 17:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NA_NA_1f06054aa6cb1aexeexe_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
NA_NA_1f06054aa6cb1aexeexe_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
NA_NA_1f06054aa6cb1aexeexe_JC.exe
-
Size
486KB
-
MD5
1f06054aa6cb1a61b85456ac1f2f1ded
-
SHA1
56b72612be96c897527701ca648972496b8e0059
-
SHA256
8d49d86c84987b8fce8e67f4a0ee0cbe1debf5ca4b1904c10fdd5e1154f78fef
-
SHA512
2d26decdb697d6f4dcc2bd0197bdb329a46a026db64d6fba1c4e1dbe03a81afd3759dd97558fdfe1373b744caed5168cae67c4db5aaae9d619c9b167d204319e
-
SSDEEP
12288:/U5rCOTeiDeIBxB0/X7QPdcPqJh6vtwHQNZ:/UQOJDekSX7QPdcPq/YJN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3940 80A9.tmp 3788 8184.tmp 2868 8240.tmp 4148 830B.tmp 2700 8397.tmp 1832 8453.tmp 1248 84FF.tmp 4060 859B.tmp 1096 8656.tmp 2284 8702.tmp 232 879F.tmp 5036 885A.tmp 4136 8944.tmp 3948 89F0.tmp 4444 8B48.tmp 4492 8BD5.tmp 4532 8C52.tmp 3744 8D0D.tmp 668 8DA9.tmp 4936 8E26.tmp 4672 8EC3.tmp 1592 8FBD.tmp 1232 903A.tmp 336 90C6.tmp 544 9153.tmp 4576 91EF.tmp 1916 927C.tmp 4280 9357.tmp 2812 9645.tmp 4052 974E.tmp 1504 97EA.tmp 2052 9896.tmp 592 9961.tmp 4660 9A0D.tmp 3220 9A6B.tmp 3088 9AE8.tmp 4640 9B55.tmp 512 9BD2.tmp 836 9C4F.tmp 4984 9CCC.tmp 3900 9D3A.tmp 2028 9D98.tmp 2312 9E15.tmp 4744 9EB1.tmp 2472 9F3D.tmp 3896 9FE9.tmp 5012 A066.tmp 5004 A0F3.tmp 3176 A18F.tmp 4168 A21C.tmp 4644 A2B8.tmp 3992 A354.tmp 4312 A3E1.tmp 548 A46E.tmp 2964 A4FA.tmp 3384 A587.tmp 1340 A604.tmp 4524 A6B0.tmp 2020 A72D.tmp 1656 A79A.tmp 4672 A836.tmp 428 A8B3.tmp 2620 A950.tmp 3464 A9FB.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2052 wrote to memory of 3940 2052 NA_NA_1f06054aa6cb1aexeexe_JC.exe 86 PID 2052 wrote to memory of 3940 2052 NA_NA_1f06054aa6cb1aexeexe_JC.exe 86 PID 2052 wrote to memory of 3940 2052 NA_NA_1f06054aa6cb1aexeexe_JC.exe 86 PID 3940 wrote to memory of 3788 3940 80A9.tmp 87 PID 3940 wrote to memory of 3788 3940 80A9.tmp 87 PID 3940 wrote to memory of 3788 3940 80A9.tmp 87 PID 3788 wrote to memory of 2868 3788 8184.tmp 88 PID 3788 wrote to memory of 2868 3788 8184.tmp 88 PID 3788 wrote to memory of 2868 3788 8184.tmp 88 PID 2868 wrote to memory of 4148 2868 8240.tmp 89 PID 2868 wrote to memory of 4148 2868 8240.tmp 89 PID 2868 wrote to memory of 4148 2868 8240.tmp 89 PID 4148 wrote to memory of 2700 4148 830B.tmp 90 PID 4148 wrote to memory of 2700 4148 830B.tmp 90 PID 4148 wrote to memory of 2700 4148 830B.tmp 90 PID 2700 wrote to memory of 1832 2700 8397.tmp 91 PID 2700 wrote to memory of 1832 2700 8397.tmp 91 PID 2700 wrote to memory of 1832 2700 8397.tmp 91 PID 1832 wrote to memory of 1248 1832 8453.tmp 92 PID 1832 wrote to memory of 1248 1832 8453.tmp 92 PID 1832 wrote to memory of 1248 1832 8453.tmp 92 PID 1248 wrote to memory of 4060 1248 84FF.tmp 93 PID 1248 wrote to memory of 4060 1248 84FF.tmp 93 PID 1248 wrote to memory of 4060 1248 84FF.tmp 93 PID 4060 wrote to memory of 1096 4060 859B.tmp 94 PID 4060 wrote to memory of 1096 4060 859B.tmp 94 PID 4060 wrote to memory of 1096 4060 859B.tmp 94 PID 1096 wrote to memory of 2284 1096 8656.tmp 95 PID 1096 wrote to memory of 2284 1096 8656.tmp 95 PID 1096 wrote to memory of 2284 1096 8656.tmp 95 PID 2284 wrote to memory of 232 2284 8702.tmp 96 PID 2284 wrote to memory of 232 2284 8702.tmp 96 PID 2284 wrote to memory of 232 2284 8702.tmp 96 PID 232 wrote to memory of 5036 232 879F.tmp 97 PID 232 wrote to memory of 5036 232 879F.tmp 97 PID 232 wrote to memory of 5036 232 879F.tmp 97 PID 5036 wrote to memory of 4136 5036 885A.tmp 98 PID 5036 wrote to memory of 4136 5036 885A.tmp 98 PID 5036 wrote to memory of 4136 5036 885A.tmp 98 PID 4136 wrote to memory of 3948 4136 8944.tmp 99 PID 4136 wrote to memory of 3948 4136 8944.tmp 99 PID 4136 wrote to memory of 3948 4136 8944.tmp 99 PID 3948 wrote to memory of 4444 3948 89F0.tmp 101 PID 3948 wrote to memory of 4444 3948 89F0.tmp 101 PID 3948 wrote to memory of 4444 3948 89F0.tmp 101 PID 4444 wrote to memory of 4492 4444 8B48.tmp 102 PID 4444 wrote to memory of 4492 4444 8B48.tmp 102 PID 4444 wrote to memory of 4492 4444 8B48.tmp 102 PID 4492 wrote to memory of 4532 4492 8BD5.tmp 103 PID 4492 wrote to memory of 4532 4492 8BD5.tmp 103 PID 4492 wrote to memory of 4532 4492 8BD5.tmp 103 PID 4532 wrote to memory of 3744 4532 8C52.tmp 104 PID 4532 wrote to memory of 3744 4532 8C52.tmp 104 PID 4532 wrote to memory of 3744 4532 8C52.tmp 104 PID 3744 wrote to memory of 668 3744 8D0D.tmp 105 PID 3744 wrote to memory of 668 3744 8D0D.tmp 105 PID 3744 wrote to memory of 668 3744 8D0D.tmp 105 PID 668 wrote to memory of 4936 668 8DA9.tmp 106 PID 668 wrote to memory of 4936 668 8DA9.tmp 106 PID 668 wrote to memory of 4936 668 8DA9.tmp 106 PID 4936 wrote to memory of 4672 4936 8E26.tmp 107 PID 4936 wrote to memory of 4672 4936 8E26.tmp 107 PID 4936 wrote to memory of 4672 4936 8E26.tmp 107 PID 4672 wrote to memory of 1592 4672 8EC3.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\NA_NA_1f06054aa6cb1aexeexe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NA_NA_1f06054aa6cb1aexeexe_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\80A9.tmp"C:\Users\Admin\AppData\Local\Temp\80A9.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\8184.tmp"C:\Users\Admin\AppData\Local\Temp\8184.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\8240.tmp"C:\Users\Admin\AppData\Local\Temp\8240.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\830B.tmp"C:\Users\Admin\AppData\Local\Temp\830B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\8453.tmp"C:\Users\Admin\AppData\Local\Temp\8453.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\84FF.tmp"C:\Users\Admin\AppData\Local\Temp\84FF.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\859B.tmp"C:\Users\Admin\AppData\Local\Temp\859B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\8702.tmp"C:\Users\Admin\AppData\Local\Temp\8702.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\879F.tmp"C:\Users\Admin\AppData\Local\Temp\879F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Users\Admin\AppData\Local\Temp\885A.tmp"C:\Users\Admin\AppData\Local\Temp\885A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\89F0.tmp"C:\Users\Admin\AppData\Local\Temp\89F0.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\8B48.tmp"C:\Users\Admin\AppData\Local\Temp\8B48.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Users\Admin\AppData\Local\Temp\8E26.tmp"C:\Users\Admin\AppData\Local\Temp\8E26.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"23⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\903A.tmp"C:\Users\Admin\AppData\Local\Temp\903A.tmp"24⤵
- Executes dropped EXE
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"25⤵
- Executes dropped EXE
PID:336 -
C:\Users\Admin\AppData\Local\Temp\9153.tmp"C:\Users\Admin\AppData\Local\Temp\9153.tmp"26⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\91EF.tmp"C:\Users\Admin\AppData\Local\Temp\91EF.tmp"27⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\927C.tmp"C:\Users\Admin\AppData\Local\Temp\927C.tmp"28⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"29⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"30⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"31⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\97EA.tmp"C:\Users\Admin\AppData\Local\Temp\97EA.tmp"32⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\9896.tmp"C:\Users\Admin\AppData\Local\Temp\9896.tmp"33⤵
- Executes dropped EXE
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"34⤵
- Executes dropped EXE
PID:592 -
C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"35⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"36⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"37⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"38⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"39⤵
- Executes dropped EXE
PID:512 -
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"40⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"41⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"42⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"43⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\9E15.tmp"C:\Users\Admin\AppData\Local\Temp\9E15.tmp"44⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"45⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"46⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"47⤵
- Executes dropped EXE
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\A066.tmp"C:\Users\Admin\AppData\Local\Temp\A066.tmp"48⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"49⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\A18F.tmp"C:\Users\Admin\AppData\Local\Temp\A18F.tmp"50⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\A21C.tmp"C:\Users\Admin\AppData\Local\Temp\A21C.tmp"51⤵
- Executes dropped EXE
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"52⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\A354.tmp"C:\Users\Admin\AppData\Local\Temp\A354.tmp"53⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"54⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\A46E.tmp"C:\Users\Admin\AppData\Local\Temp\A46E.tmp"55⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"56⤵
- Executes dropped EXE
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"57⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"58⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"59⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"60⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"61⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\A836.tmp"C:\Users\Admin\AppData\Local\Temp\A836.tmp"62⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"63⤵
- Executes dropped EXE
PID:428 -
C:\Users\Admin\AppData\Local\Temp\A950.tmp"C:\Users\Admin\AppData\Local\Temp\A950.tmp"64⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"65⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"66⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\AB05.tmp"C:\Users\Admin\AppData\Local\Temp\AB05.tmp"67⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"68⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"69⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"70⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"71⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\AE12.tmp"C:\Users\Admin\AppData\Local\Temp\AE12.tmp"72⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"73⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"74⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"75⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\B035.tmp"C:\Users\Admin\AppData\Local\Temp\B035.tmp"76⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"77⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\B15E.tmp"C:\Users\Admin\AppData\Local\Temp\B15E.tmp"78⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"79⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\B268.tmp"C:\Users\Admin\AppData\Local\Temp\B268.tmp"80⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"81⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\B371.tmp"C:\Users\Admin\AppData\Local\Temp\B371.tmp"82⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"83⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"84⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"85⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\B565.tmp"C:\Users\Admin\AppData\Local\Temp\B565.tmp"86⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"87⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\B66F.tmp"C:\Users\Admin\AppData\Local\Temp\B66F.tmp"88⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"89⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\B759.tmp"C:\Users\Admin\AppData\Local\Temp\B759.tmp"90⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"91⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\B844.tmp"C:\Users\Admin\AppData\Local\Temp\B844.tmp"92⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"93⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\B93E.tmp"C:\Users\Admin\AppData\Local\Temp\B93E.tmp"94⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"95⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\BA67.tmp"C:\Users\Admin\AppData\Local\Temp\BA67.tmp"96⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"97⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"98⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"99⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"100⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"101⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\BD26.tmp"C:\Users\Admin\AppData\Local\Temp\BD26.tmp"102⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"103⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"104⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"105⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\BF77.tmp"C:\Users\Admin\AppData\Local\Temp\BF77.tmp"106⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"107⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"108⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"109⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"110⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\C256.tmp"C:\Users\Admin\AppData\Local\Temp\C256.tmp"111⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"112⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\C37F.tmp"C:\Users\Admin\AppData\Local\Temp\C37F.tmp"113⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\C41B.tmp"C:\Users\Admin\AppData\Local\Temp\C41B.tmp"114⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"115⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\C544.tmp"C:\Users\Admin\AppData\Local\Temp\C544.tmp"116⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"117⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\C63E.tmp"C:\Users\Admin\AppData\Local\Temp\C63E.tmp"118⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"119⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\C747.tmp"C:\Users\Admin\AppData\Local\Temp\C747.tmp"120⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"121⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\C851.tmp"C:\Users\Admin\AppData\Local\Temp\C851.tmp"122⤵PID:3408
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-