Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
97s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2024, 05:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
659b2dfea28f2d8ed928b12ba0dd9b90N.exe
Resource
win7-20240704-en
3 signatures
120 seconds
Behavioral task
behavioral2
Sample
659b2dfea28f2d8ed928b12ba0dd9b90N.exe
Resource
win10v2004-20240709-en
2 signatures
120 seconds
General
-
Target
659b2dfea28f2d8ed928b12ba0dd9b90N.exe
-
Size
527KB
-
MD5
659b2dfea28f2d8ed928b12ba0dd9b90
-
SHA1
d2c884e10781a023e58e0b9dba075d1f5f331129
-
SHA256
2a706e4bd48131ed1d661ab5b5698cfc50e95ed67392050abc6b9d6ea5e898bd
-
SHA512
43c042a1623999272796f3ae616c9586a67c3afdbd5be2919fef197d23b931df924d5d4f7e3b8454b168d835d9b40fc520ece780e2966550ca4fa57a416d0e04
-
SSDEEP
12288:fU5rCOTeid1NyrH1A5d8y5L8yAUc8YK7WDZu:fUQOJd1NyrVAn8mc7K7WDo
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 548 B323.tmp 4416 B391.tmp 1608 B42D.tmp 4948 B4AA.tmp 1048 B508.tmp 4272 B67F.tmp 2124 B6DC.tmp 384 B73A.tmp 2840 B798.tmp 2016 B805.tmp 1040 B863.tmp 2224 B8F0.tmp 1156 B95D.tmp 4788 B9CA.tmp 3652 BA47.tmp 3784 BAB5.tmp 3520 BB22.tmp 3976 BB80.tmp 3584 BC0C.tmp 1620 BC7A.tmp 2656 BCF7.tmp 4552 BD55.tmp 3640 BDE1.tmp 3488 BE4F.tmp 2396 BE9D.tmp 4804 BF0A.tmp 1788 BF77.tmp 552 BFD5.tmp 696 C033.tmp 2764 C081.tmp 4188 C0DF.tmp 2980 C14C.tmp 5004 C19A.tmp 4564 C208.tmp 4972 C285.tmp 2784 C2E2.tmp 1948 C331.tmp 4344 C37F.tmp 1264 C3CD.tmp 4452 C41B.tmp 3824 C469.tmp 4904 C4B7.tmp 4416 C505.tmp 2288 C553.tmp 1828 C5B1.tmp 1608 C5FF.tmp 2388 C65D.tmp 4840 C6BB.tmp 1428 C719.tmp 2428 C767.tmp 1852 C7B5.tmp 2452 C803.tmp 2016 C861.tmp 3868 C8BE.tmp 1568 C91C.tmp 4964 C97A.tmp 1360 C9D8.tmp 4816 CA35.tmp 4260 CA93.tmp 2180 CAE1.tmp 4788 CB2F.tmp 1776 CB8D.tmp 3148 CBEB.tmp 804 CC49.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3344 wrote to memory of 548 3344 659b2dfea28f2d8ed928b12ba0dd9b90N.exe 84 PID 3344 wrote to memory of 548 3344 659b2dfea28f2d8ed928b12ba0dd9b90N.exe 84 PID 3344 wrote to memory of 548 3344 659b2dfea28f2d8ed928b12ba0dd9b90N.exe 84 PID 548 wrote to memory of 4416 548 B323.tmp 85 PID 548 wrote to memory of 4416 548 B323.tmp 85 PID 548 wrote to memory of 4416 548 B323.tmp 85 PID 4416 wrote to memory of 1608 4416 B391.tmp 86 PID 4416 wrote to memory of 1608 4416 B391.tmp 86 PID 4416 wrote to memory of 1608 4416 B391.tmp 86 PID 1608 wrote to memory of 4948 1608 B42D.tmp 88 PID 1608 wrote to memory of 4948 1608 B42D.tmp 88 PID 1608 wrote to memory of 4948 1608 B42D.tmp 88 PID 4948 wrote to memory of 1048 4948 B4AA.tmp 90 PID 4948 wrote to memory of 1048 4948 B4AA.tmp 90 PID 4948 wrote to memory of 1048 4948 B4AA.tmp 90 PID 1048 wrote to memory of 4272 1048 B508.tmp 92 PID 1048 wrote to memory of 4272 1048 B508.tmp 92 PID 1048 wrote to memory of 4272 1048 B508.tmp 92 PID 4272 wrote to memory of 2124 4272 B67F.tmp 94 PID 4272 wrote to memory of 2124 4272 B67F.tmp 94 PID 4272 wrote to memory of 2124 4272 B67F.tmp 94 PID 2124 wrote to memory of 384 2124 B6DC.tmp 95 PID 2124 wrote to memory of 384 2124 B6DC.tmp 95 PID 2124 wrote to memory of 384 2124 B6DC.tmp 95 PID 384 wrote to memory of 2840 384 B73A.tmp 96 PID 384 wrote to memory of 2840 384 B73A.tmp 96 PID 384 wrote to memory of 2840 384 B73A.tmp 96 PID 2840 wrote to memory of 2016 2840 B798.tmp 97 PID 2840 wrote to memory of 2016 2840 B798.tmp 97 PID 2840 wrote to memory of 2016 2840 B798.tmp 97 PID 2016 wrote to memory of 1040 2016 B805.tmp 98 PID 2016 wrote to memory of 1040 2016 B805.tmp 98 PID 2016 wrote to memory of 1040 2016 B805.tmp 98 PID 1040 wrote to memory of 2224 1040 B863.tmp 99 PID 1040 wrote to memory of 2224 1040 B863.tmp 99 PID 1040 wrote to memory of 2224 1040 B863.tmp 99 PID 2224 wrote to memory of 1156 2224 B8F0.tmp 100 PID 2224 wrote to memory of 1156 2224 B8F0.tmp 100 PID 2224 wrote to memory of 1156 2224 B8F0.tmp 100 PID 1156 wrote to memory of 4788 1156 B95D.tmp 101 PID 1156 wrote to memory of 4788 1156 B95D.tmp 101 PID 1156 wrote to memory of 4788 1156 B95D.tmp 101 PID 4788 wrote to memory of 3652 4788 B9CA.tmp 102 PID 4788 wrote to memory of 3652 4788 B9CA.tmp 102 PID 4788 wrote to memory of 3652 4788 B9CA.tmp 102 PID 3652 wrote to memory of 3784 3652 BA47.tmp 103 PID 3652 wrote to memory of 3784 3652 BA47.tmp 103 PID 3652 wrote to memory of 3784 3652 BA47.tmp 103 PID 3784 wrote to memory of 3520 3784 BAB5.tmp 104 PID 3784 wrote to memory of 3520 3784 BAB5.tmp 104 PID 3784 wrote to memory of 3520 3784 BAB5.tmp 104 PID 3520 wrote to memory of 3976 3520 BB22.tmp 105 PID 3520 wrote to memory of 3976 3520 BB22.tmp 105 PID 3520 wrote to memory of 3976 3520 BB22.tmp 105 PID 3976 wrote to memory of 3584 3976 BB80.tmp 106 PID 3976 wrote to memory of 3584 3976 BB80.tmp 106 PID 3976 wrote to memory of 3584 3976 BB80.tmp 106 PID 3584 wrote to memory of 1620 3584 BC0C.tmp 107 PID 3584 wrote to memory of 1620 3584 BC0C.tmp 107 PID 3584 wrote to memory of 1620 3584 BC0C.tmp 107 PID 1620 wrote to memory of 2656 1620 BC7A.tmp 108 PID 1620 wrote to memory of 2656 1620 BC7A.tmp 108 PID 1620 wrote to memory of 2656 1620 BC7A.tmp 108 PID 2656 wrote to memory of 4552 2656 BCF7.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\659b2dfea28f2d8ed928b12ba0dd9b90N.exe"C:\Users\Admin\AppData\Local\Temp\659b2dfea28f2d8ed928b12ba0dd9b90N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\B323.tmp"C:\Users\Admin\AppData\Local\Temp\B323.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\B391.tmp"C:\Users\Admin\AppData\Local\Temp\B391.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\B42D.tmp"C:\Users\Admin\AppData\Local\Temp\B42D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\B508.tmp"C:\Users\Admin\AppData\Local\Temp\B508.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\B67F.tmp"C:\Users\Admin\AppData\Local\Temp\B67F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\B73A.tmp"C:\Users\Admin\AppData\Local\Temp\B73A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\AppData\Local\Temp\B798.tmp"C:\Users\Admin\AppData\Local\Temp\B798.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\B805.tmp"C:\Users\Admin\AppData\Local\Temp\B805.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\B863.tmp"C:\Users\Admin\AppData\Local\Temp\B863.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\B95D.tmp"C:\Users\Admin\AppData\Local\Temp\B95D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\BA47.tmp"C:\Users\Admin\AppData\Local\Temp\BA47.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\BB22.tmp"C:\Users\Admin\AppData\Local\Temp\BB22.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\BB80.tmp"C:\Users\Admin\AppData\Local\Temp\BB80.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\BD55.tmp"C:\Users\Admin\AppData\Local\Temp\BD55.tmp"23⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"24⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"25⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"26⤵
- Executes dropped EXE
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"27⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\BF77.tmp"C:\Users\Admin\AppData\Local\Temp\BF77.tmp"28⤵
- Executes dropped EXE
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"29⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"30⤵
- Executes dropped EXE
PID:696 -
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"31⤵
- Executes dropped EXE
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"32⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"33⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"34⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\C208.tmp"C:\Users\Admin\AppData\Local\Temp\C208.tmp"35⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\C285.tmp"C:\Users\Admin\AppData\Local\Temp\C285.tmp"36⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"37⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\C331.tmp"C:\Users\Admin\AppData\Local\Temp\C331.tmp"38⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\C37F.tmp"C:\Users\Admin\AppData\Local\Temp\C37F.tmp"39⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"40⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\C41B.tmp"C:\Users\Admin\AppData\Local\Temp\C41B.tmp"41⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\C469.tmp"C:\Users\Admin\AppData\Local\Temp\C469.tmp"42⤵
- Executes dropped EXE
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"43⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\C505.tmp"C:\Users\Admin\AppData\Local\Temp\C505.tmp"44⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\C553.tmp"C:\Users\Admin\AppData\Local\Temp\C553.tmp"45⤵
- Executes dropped EXE
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"46⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"47⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\C65D.tmp"C:\Users\Admin\AppData\Local\Temp\C65D.tmp"48⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"49⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\C719.tmp"C:\Users\Admin\AppData\Local\Temp\C719.tmp"50⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\C767.tmp"C:\Users\Admin\AppData\Local\Temp\C767.tmp"51⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"52⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\C803.tmp"C:\Users\Admin\AppData\Local\Temp\C803.tmp"53⤵
- Executes dropped EXE
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\C861.tmp"C:\Users\Admin\AppData\Local\Temp\C861.tmp"54⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"55⤵
- Executes dropped EXE
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\C91C.tmp"C:\Users\Admin\AppData\Local\Temp\C91C.tmp"56⤵
- Executes dropped EXE
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\C97A.tmp"C:\Users\Admin\AppData\Local\Temp\C97A.tmp"57⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\C9D8.tmp"C:\Users\Admin\AppData\Local\Temp\C9D8.tmp"58⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\CA35.tmp"C:\Users\Admin\AppData\Local\Temp\CA35.tmp"59⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\CA93.tmp"C:\Users\Admin\AppData\Local\Temp\CA93.tmp"60⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"61⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"62⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"63⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"64⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\CC49.tmp"C:\Users\Admin\AppData\Local\Temp\CC49.tmp"65⤵
- Executes dropped EXE
PID:804 -
C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"66⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\CD04.tmp"C:\Users\Admin\AppData\Local\Temp\CD04.tmp"67⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\CD62.tmp"C:\Users\Admin\AppData\Local\Temp\CD62.tmp"68⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\CDC0.tmp"C:\Users\Admin\AppData\Local\Temp\CDC0.tmp"69⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"70⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"71⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\CED9.tmp"C:\Users\Admin\AppData\Local\Temp\CED9.tmp"72⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\CF37.tmp"C:\Users\Admin\AppData\Local\Temp\CF37.tmp"73⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"74⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\D002.tmp"C:\Users\Admin\AppData\Local\Temp\D002.tmp"75⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\D060.tmp"C:\Users\Admin\AppData\Local\Temp\D060.tmp"76⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"77⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\D10B.tmp"C:\Users\Admin\AppData\Local\Temp\D10B.tmp"78⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\D169.tmp"C:\Users\Admin\AppData\Local\Temp\D169.tmp"79⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"80⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\D215.tmp"C:\Users\Admin\AppData\Local\Temp\D215.tmp"81⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\D273.tmp"C:\Users\Admin\AppData\Local\Temp\D273.tmp"82⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"83⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\D32E.tmp"C:\Users\Admin\AppData\Local\Temp\D32E.tmp"84⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\D38C.tmp"C:\Users\Admin\AppData\Local\Temp\D38C.tmp"85⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\D3EA.tmp"C:\Users\Admin\AppData\Local\Temp\D3EA.tmp"86⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\D438.tmp"C:\Users\Admin\AppData\Local\Temp\D438.tmp"87⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\D496.tmp"C:\Users\Admin\AppData\Local\Temp\D496.tmp"88⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\D4F3.tmp"C:\Users\Admin\AppData\Local\Temp\D4F3.tmp"89⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\D551.tmp"C:\Users\Admin\AppData\Local\Temp\D551.tmp"90⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"91⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\D60D.tmp"C:\Users\Admin\AppData\Local\Temp\D60D.tmp"92⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\D65B.tmp"C:\Users\Admin\AppData\Local\Temp\D65B.tmp"93⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\D6B9.tmp"C:\Users\Admin\AppData\Local\Temp\D6B9.tmp"94⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\D716.tmp"C:\Users\Admin\AppData\Local\Temp\D716.tmp"95⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\D774.tmp"C:\Users\Admin\AppData\Local\Temp\D774.tmp"96⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"97⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\D830.tmp"C:\Users\Admin\AppData\Local\Temp\D830.tmp"98⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\D89D.tmp"C:\Users\Admin\AppData\Local\Temp\D89D.tmp"99⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"100⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\D939.tmp"C:\Users\Admin\AppData\Local\Temp\D939.tmp"101⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\D997.tmp"C:\Users\Admin\AppData\Local\Temp\D997.tmp"102⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\D9F5.tmp"C:\Users\Admin\AppData\Local\Temp\D9F5.tmp"103⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\DA52.tmp"C:\Users\Admin\AppData\Local\Temp\DA52.tmp"104⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\DAB0.tmp"C:\Users\Admin\AppData\Local\Temp\DAB0.tmp"105⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\DAFE.tmp"C:\Users\Admin\AppData\Local\Temp\DAFE.tmp"106⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\DB4C.tmp"C:\Users\Admin\AppData\Local\Temp\DB4C.tmp"107⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\DBAA.tmp"C:\Users\Admin\AppData\Local\Temp\DBAA.tmp"108⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\DC08.tmp"C:\Users\Admin\AppData\Local\Temp\DC08.tmp"109⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\DC56.tmp"C:\Users\Admin\AppData\Local\Temp\DC56.tmp"110⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"111⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\DD12.tmp"C:\Users\Admin\AppData\Local\Temp\DD12.tmp"112⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\DD60.tmp"C:\Users\Admin\AppData\Local\Temp\DD60.tmp"113⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"114⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\DE0C.tmp"C:\Users\Admin\AppData\Local\Temp\DE0C.tmp"115⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\DE69.tmp"C:\Users\Admin\AppData\Local\Temp\DE69.tmp"116⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\DEB7.tmp"C:\Users\Admin\AppData\Local\Temp\DEB7.tmp"117⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\DF15.tmp"C:\Users\Admin\AppData\Local\Temp\DF15.tmp"118⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\DF63.tmp"C:\Users\Admin\AppData\Local\Temp\DF63.tmp"119⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"120⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\E000.tmp"C:\Users\Admin\AppData\Local\Temp\E000.tmp"121⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\E05D.tmp"C:\Users\Admin\AppData\Local\Temp\E05D.tmp"122⤵PID:2256
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-