Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
158s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/02/2024, 01:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
483528eade19ee389d95eb919f308b9f.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
483528eade19ee389d95eb919f308b9f.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
483528eade19ee389d95eb919f308b9f.exe
-
Size
486KB
-
MD5
483528eade19ee389d95eb919f308b9f
-
SHA1
2701c2a4f8cd5c677c4509e20b30bad6623d72f7
-
SHA256
cb38a53122cca6ebba599ef2bf9dd6d0fe5e3e3990cea6a0e94772a94f1e7b59
-
SHA512
fb226f2f55c875e8a8bd900ef1a8e8e06e40696e69f763b11554072bdedb90f0172e534d7fb7c0aa0d6b6d681b001dd48347ee8e588d3811029dfaca5243b98b
-
SSDEEP
6144:Borf3lPvovsgZnqG2C7mOTeiLfD7McY5Cy5ReMj85vf6of0zHxKB5E+y/qo7/sHT:oU5rCOTeiDzICxMM36jw3EgoYNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3124 BE10.tmp 4440 BF68.tmp 1408 C033.tmp 1120 C12D.tmp 3664 C1D9.tmp 2484 C311.tmp 3052 C3FC.tmp 1680 C553.tmp 1896 C66D.tmp 5004 C796.tmp 3608 C880.tmp 2824 C9C8.tmp 3792 CA64.tmp 4984 CB4F.tmp 1624 CC29.tmp 1908 CCD5.tmp 4948 CDCF.tmp 3188 CEBA.tmp 2880 CF85.tmp 5072 D050.tmp 2600 D11B.tmp 4684 D205.tmp 5064 D292.tmp 2056 D36D.tmp 3684 D419.tmp 5036 D4B5.tmp 3532 D590.tmp 2356 D60D.tmp 4660 D6B9.tmp 216 D7D2.tmp 1416 DA72.tmp 4936 DB4C.tmp 2276 DC75.tmp 2700 DD02.tmp 3960 DDBD.tmp 1100 DE98.tmp 1448 DF73.tmp 3352 E0CB.tmp 3888 E1A5.tmp 836 E222.tmp 2444 E37A.tmp 4080 E407.tmp 3656 E484.tmp 2748 E501.tmp 1216 E58D.tmp 4028 E5FB.tmp 1048 E678.tmp 3340 E6F5.tmp 3588 E781.tmp 4796 E86C.tmp 4628 E908.tmp 4732 E995.tmp 4740 EA12.tmp 364 EACD.tmp 3620 EB4A.tmp 3176 EBB8.tmp 488 ED3E.tmp 3172 EDBB.tmp 3324 EE29.tmp 4024 EEC5.tmp 4468 EF42.tmp 2984 EFAF.tmp 4388 F02C.tmp 4540 F0C8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 944 wrote to memory of 3124 944 483528eade19ee389d95eb919f308b9f.exe 84 PID 944 wrote to memory of 3124 944 483528eade19ee389d95eb919f308b9f.exe 84 PID 944 wrote to memory of 3124 944 483528eade19ee389d95eb919f308b9f.exe 84 PID 3124 wrote to memory of 4440 3124 BE10.tmp 85 PID 3124 wrote to memory of 4440 3124 BE10.tmp 85 PID 3124 wrote to memory of 4440 3124 BE10.tmp 85 PID 4440 wrote to memory of 1408 4440 BF68.tmp 86 PID 4440 wrote to memory of 1408 4440 BF68.tmp 86 PID 4440 wrote to memory of 1408 4440 BF68.tmp 86 PID 1408 wrote to memory of 1120 1408 C033.tmp 87 PID 1408 wrote to memory of 1120 1408 C033.tmp 87 PID 1408 wrote to memory of 1120 1408 C033.tmp 87 PID 1120 wrote to memory of 3664 1120 C12D.tmp 88 PID 1120 wrote to memory of 3664 1120 C12D.tmp 88 PID 1120 wrote to memory of 3664 1120 C12D.tmp 88 PID 3664 wrote to memory of 2484 3664 C1D9.tmp 89 PID 3664 wrote to memory of 2484 3664 C1D9.tmp 89 PID 3664 wrote to memory of 2484 3664 C1D9.tmp 89 PID 2484 wrote to memory of 3052 2484 C311.tmp 90 PID 2484 wrote to memory of 3052 2484 C311.tmp 90 PID 2484 wrote to memory of 3052 2484 C311.tmp 90 PID 3052 wrote to memory of 1680 3052 C3FC.tmp 91 PID 3052 wrote to memory of 1680 3052 C3FC.tmp 91 PID 3052 wrote to memory of 1680 3052 C3FC.tmp 91 PID 1680 wrote to memory of 1896 1680 C553.tmp 92 PID 1680 wrote to memory of 1896 1680 C553.tmp 92 PID 1680 wrote to memory of 1896 1680 C553.tmp 92 PID 1896 wrote to memory of 5004 1896 C66D.tmp 93 PID 1896 wrote to memory of 5004 1896 C66D.tmp 93 PID 1896 wrote to memory of 5004 1896 C66D.tmp 93 PID 5004 wrote to memory of 3608 5004 C796.tmp 94 PID 5004 wrote to memory of 3608 5004 C796.tmp 94 PID 5004 wrote to memory of 3608 5004 C796.tmp 94 PID 3608 wrote to memory of 2824 3608 C880.tmp 95 PID 3608 wrote to memory of 2824 3608 C880.tmp 95 PID 3608 wrote to memory of 2824 3608 C880.tmp 95 PID 2824 wrote to memory of 3792 2824 C9C8.tmp 96 PID 2824 wrote to memory of 3792 2824 C9C8.tmp 96 PID 2824 wrote to memory of 3792 2824 C9C8.tmp 96 PID 3792 wrote to memory of 4984 3792 CA64.tmp 97 PID 3792 wrote to memory of 4984 3792 CA64.tmp 97 PID 3792 wrote to memory of 4984 3792 CA64.tmp 97 PID 4984 wrote to memory of 1624 4984 CB4F.tmp 98 PID 4984 wrote to memory of 1624 4984 CB4F.tmp 98 PID 4984 wrote to memory of 1624 4984 CB4F.tmp 98 PID 1624 wrote to memory of 1908 1624 CC29.tmp 99 PID 1624 wrote to memory of 1908 1624 CC29.tmp 99 PID 1624 wrote to memory of 1908 1624 CC29.tmp 99 PID 1908 wrote to memory of 4948 1908 CCD5.tmp 100 PID 1908 wrote to memory of 4948 1908 CCD5.tmp 100 PID 1908 wrote to memory of 4948 1908 CCD5.tmp 100 PID 4948 wrote to memory of 3188 4948 CDCF.tmp 101 PID 4948 wrote to memory of 3188 4948 CDCF.tmp 101 PID 4948 wrote to memory of 3188 4948 CDCF.tmp 101 PID 3188 wrote to memory of 2880 3188 CEBA.tmp 102 PID 3188 wrote to memory of 2880 3188 CEBA.tmp 102 PID 3188 wrote to memory of 2880 3188 CEBA.tmp 102 PID 2880 wrote to memory of 5072 2880 CF85.tmp 103 PID 2880 wrote to memory of 5072 2880 CF85.tmp 103 PID 2880 wrote to memory of 5072 2880 CF85.tmp 103 PID 5072 wrote to memory of 2600 5072 D050.tmp 104 PID 5072 wrote to memory of 2600 5072 D050.tmp 104 PID 5072 wrote to memory of 2600 5072 D050.tmp 104 PID 2600 wrote to memory of 4684 2600 D11B.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\483528eade19ee389d95eb919f308b9f.exe"C:\Users\Admin\AppData\Local\Temp\483528eade19ee389d95eb919f308b9f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\BE10.tmp"C:\Users\Admin\AppData\Local\Temp\BE10.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\BF68.tmp"C:\Users\Admin\AppData\Local\Temp\BF68.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\C311.tmp"C:\Users\Admin\AppData\Local\Temp\C311.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\C553.tmp"C:\Users\Admin\AppData\Local\Temp\C553.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\C66D.tmp"C:\Users\Admin\AppData\Local\Temp\C66D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\C796.tmp"C:\Users\Admin\AppData\Local\Temp\C796.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\C880.tmp"C:\Users\Admin\AppData\Local\Temp\C880.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\C9C8.tmp"C:\Users\Admin\AppData\Local\Temp\C9C8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\CA64.tmp"C:\Users\Admin\AppData\Local\Temp\CA64.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\CC29.tmp"C:\Users\Admin\AppData\Local\Temp\CC29.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\CCD5.tmp"C:\Users\Admin\AppData\Local\Temp\CCD5.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\CF85.tmp"C:\Users\Admin\AppData\Local\Temp\CF85.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\D050.tmp"C:\Users\Admin\AppData\Local\Temp\D050.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\D11B.tmp"C:\Users\Admin\AppData\Local\Temp\D11B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\D205.tmp"C:\Users\Admin\AppData\Local\Temp\D205.tmp"23⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\D292.tmp"C:\Users\Admin\AppData\Local\Temp\D292.tmp"24⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\D36D.tmp"C:\Users\Admin\AppData\Local\Temp\D36D.tmp"25⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\D419.tmp"C:\Users\Admin\AppData\Local\Temp\D419.tmp"26⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\D4B5.tmp"C:\Users\Admin\AppData\Local\Temp\D4B5.tmp"27⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\D590.tmp"C:\Users\Admin\AppData\Local\Temp\D590.tmp"28⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\D60D.tmp"C:\Users\Admin\AppData\Local\Temp\D60D.tmp"29⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\D6B9.tmp"C:\Users\Admin\AppData\Local\Temp\D6B9.tmp"30⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"31⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\DA72.tmp"C:\Users\Admin\AppData\Local\Temp\DA72.tmp"32⤵
- Executes dropped EXE
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\DB4C.tmp"C:\Users\Admin\AppData\Local\Temp\DB4C.tmp"33⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\DC75.tmp"C:\Users\Admin\AppData\Local\Temp\DC75.tmp"34⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\DD02.tmp"C:\Users\Admin\AppData\Local\Temp\DD02.tmp"35⤵
- Executes dropped EXE
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\DDBD.tmp"C:\Users\Admin\AppData\Local\Temp\DDBD.tmp"36⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\DE98.tmp"C:\Users\Admin\AppData\Local\Temp\DE98.tmp"37⤵
- Executes dropped EXE
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\DF73.tmp"C:\Users\Admin\AppData\Local\Temp\DF73.tmp"38⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\E0CB.tmp"C:\Users\Admin\AppData\Local\Temp\E0CB.tmp"39⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\E1A5.tmp"C:\Users\Admin\AppData\Local\Temp\E1A5.tmp"40⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\E222.tmp"C:\Users\Admin\AppData\Local\Temp\E222.tmp"41⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\E37A.tmp"C:\Users\Admin\AppData\Local\Temp\E37A.tmp"42⤵
- Executes dropped EXE
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\E407.tmp"C:\Users\Admin\AppData\Local\Temp\E407.tmp"43⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\E484.tmp"C:\Users\Admin\AppData\Local\Temp\E484.tmp"44⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\E501.tmp"C:\Users\Admin\AppData\Local\Temp\E501.tmp"45⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\E58D.tmp"C:\Users\Admin\AppData\Local\Temp\E58D.tmp"46⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"47⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\E678.tmp"C:\Users\Admin\AppData\Local\Temp\E678.tmp"48⤵
- Executes dropped EXE
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"49⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\E781.tmp"C:\Users\Admin\AppData\Local\Temp\E781.tmp"50⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\E86C.tmp"C:\Users\Admin\AppData\Local\Temp\E86C.tmp"51⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\E908.tmp"C:\Users\Admin\AppData\Local\Temp\E908.tmp"52⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\E995.tmp"C:\Users\Admin\AppData\Local\Temp\E995.tmp"53⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\EA12.tmp"C:\Users\Admin\AppData\Local\Temp\EA12.tmp"54⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\EACD.tmp"C:\Users\Admin\AppData\Local\Temp\EACD.tmp"55⤵
- Executes dropped EXE
PID:364 -
C:\Users\Admin\AppData\Local\Temp\EB4A.tmp"C:\Users\Admin\AppData\Local\Temp\EB4A.tmp"56⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"57⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\ED3E.tmp"C:\Users\Admin\AppData\Local\Temp\ED3E.tmp"58⤵
- Executes dropped EXE
PID:488 -
C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"59⤵
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\EE29.tmp"C:\Users\Admin\AppData\Local\Temp\EE29.tmp"60⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\EEC5.tmp"C:\Users\Admin\AppData\Local\Temp\EEC5.tmp"61⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\EF42.tmp"C:\Users\Admin\AppData\Local\Temp\EF42.tmp"62⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\EFAF.tmp"C:\Users\Admin\AppData\Local\Temp\EFAF.tmp"63⤵
- Executes dropped EXE
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\F02C.tmp"C:\Users\Admin\AppData\Local\Temp\F02C.tmp"64⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"65⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\F145.tmp"C:\Users\Admin\AppData\Local\Temp\F145.tmp"66⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"67⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\F230.tmp"C:\Users\Admin\AppData\Local\Temp\F230.tmp"68⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\F2CC.tmp"C:\Users\Admin\AppData\Local\Temp\F2CC.tmp"69⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\F339.tmp"C:\Users\Admin\AppData\Local\Temp\F339.tmp"70⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\F3A7.tmp"C:\Users\Admin\AppData\Local\Temp\F3A7.tmp"71⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\F424.tmp"C:\Users\Admin\AppData\Local\Temp\F424.tmp"72⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"73⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\F54D.tmp"C:\Users\Admin\AppData\Local\Temp\F54D.tmp"74⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\F5BA.tmp"C:\Users\Admin\AppData\Local\Temp\F5BA.tmp"75⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\F637.tmp"C:\Users\Admin\AppData\Local\Temp\F637.tmp"76⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\F6B4.tmp"C:\Users\Admin\AppData\Local\Temp\F6B4.tmp"77⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\F731.tmp"C:\Users\Admin\AppData\Local\Temp\F731.tmp"78⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\F79E.tmp"C:\Users\Admin\AppData\Local\Temp\F79E.tmp"79⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\F81B.tmp"C:\Users\Admin\AppData\Local\Temp\F81B.tmp"80⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"81⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\F935.tmp"C:\Users\Admin\AppData\Local\Temp\F935.tmp"82⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\F9C1.tmp"C:\Users\Admin\AppData\Local\Temp\F9C1.tmp"83⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\FA2F.tmp"C:\Users\Admin\AppData\Local\Temp\FA2F.tmp"84⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\FABB.tmp"C:\Users\Admin\AppData\Local\Temp\FABB.tmp"85⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\FB48.tmp"C:\Users\Admin\AppData\Local\Temp\FB48.tmp"86⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"87⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\FC23.tmp"C:\Users\Admin\AppData\Local\Temp\FC23.tmp"88⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"89⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\FD1D.tmp"C:\Users\Admin\AppData\Local\Temp\FD1D.tmp"90⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\FDB9.tmp"C:\Users\Admin\AppData\Local\Temp\FDB9.tmp"91⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\FE46.tmp"C:\Users\Admin\AppData\Local\Temp\FE46.tmp"92⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\FEB3.tmp"C:\Users\Admin\AppData\Local\Temp\FEB3.tmp"93⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\FF30.tmp"C:\Users\Admin\AppData\Local\Temp\FF30.tmp"94⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\FFCC.tmp"C:\Users\Admin\AppData\Local\Temp\FFCC.tmp"95⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\49.tmp"C:\Users\Admin\AppData\Local\Temp\49.tmp"96⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7.tmp"97⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\124.tmp"C:\Users\Admin\AppData\Local\Temp\124.tmp"98⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\1C0.tmp"C:\Users\Admin\AppData\Local\Temp\1C0.tmp"99⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\22E.tmp"C:\Users\Admin\AppData\Local\Temp\22E.tmp"100⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\2CA.tmp"C:\Users\Admin\AppData\Local\Temp\2CA.tmp"101⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\356.tmp"C:\Users\Admin\AppData\Local\Temp\356.tmp"102⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\3C4.tmp"C:\Users\Admin\AppData\Local\Temp\3C4.tmp"103⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\422.tmp"C:\Users\Admin\AppData\Local\Temp\422.tmp"104⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\48F.tmp"C:\Users\Admin\AppData\Local\Temp\48F.tmp"105⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\50C.tmp"C:\Users\Admin\AppData\Local\Temp\50C.tmp"106⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\579.tmp"C:\Users\Admin\AppData\Local\Temp\579.tmp"107⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\606.tmp"C:\Users\Admin\AppData\Local\Temp\606.tmp"108⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\693.tmp"C:\Users\Admin\AppData\Local\Temp\693.tmp"109⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\700.tmp"C:\Users\Admin\AppData\Local\Temp\700.tmp"110⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\77D.tmp"C:\Users\Admin\AppData\Local\Temp\77D.tmp"111⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\7FA.tmp"C:\Users\Admin\AppData\Local\Temp\7FA.tmp"112⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\867.tmp"C:\Users\Admin\AppData\Local\Temp\867.tmp"113⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\8F4.tmp"C:\Users\Admin\AppData\Local\Temp\8F4.tmp"114⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\961.tmp"C:\Users\Admin\AppData\Local\Temp\961.tmp"115⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\9EE.tmp"C:\Users\Admin\AppData\Local\Temp\9EE.tmp"116⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\AF8.tmp"C:\Users\Admin\AppData\Local\Temp\AF8.tmp"117⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\B75.tmp"C:\Users\Admin\AppData\Local\Temp\B75.tmp"118⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\C01.tmp"C:\Users\Admin\AppData\Local\Temp\C01.tmp"119⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\C8E.tmp"C:\Users\Admin\AppData\Local\Temp\C8E.tmp"120⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\D1A.tmp"C:\Users\Admin\AppData\Local\Temp\D1A.tmp"121⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\D88.tmp"C:\Users\Admin\AppData\Local\Temp\D88.tmp"122⤵PID:4740
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-