Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
10/07/2023, 17:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d7424f330980e4exeexeexeex.exe
Resource
win7-20230703-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
d7424f330980e4exeexeexeex.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
d7424f330980e4exeexeexeex.exe
-
Size
486KB
-
MD5
d7424f330980e4b4b8af6e628e9909d6
-
SHA1
6d5fac93bd34b7b91840c2c8cc267050d485acca
-
SHA256
f0952a9a40db53ce0e46d576950dca4a5f2595d7ebf108a3a56d8198efa8d5d0
-
SHA512
785f55a07e13f01d922cfa65fde38aa2e7b948c52346a1c9b2f328007e2a1798b7fae06b79e7cfc9b8fc61aa31efddfaca83dfb3348c36a3c3a3a7ef30893291
-
SSDEEP
12288:/U5rCOTeiD5R1Lr/nzOI/FaEwcwLsENZ:/UQOJD5fLrztbw0EN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4044 9C5F.tmp 1412 9D69.tmp 3280 9E43.tmp 3504 9F1E.tmp 560 9FCA.tmp 1784 A095.tmp 4092 A122.tmp 564 A1DD.tmp 2108 A2C8.tmp 4060 A383.tmp 432 A45E.tmp 4768 AC3E.tmp 4852 AE03.tmp 640 AEFD.tmp 1712 AFE7.tmp 1012 B093.tmp 2852 B1FA.tmp 3276 B2B6.tmp 4128 B381.tmp 2308 B44C.tmp 3748 B517.tmp 4572 B5E2.tmp 2236 B6BD.tmp 3816 B759.tmp 2096 B824.tmp 2596 B8E0.tmp 4704 B96D.tmp 3912 BA09.tmp 1940 BAD4.tmp 3236 BBBE.tmp 4112 BC5B.tmp 4408 BD06.tmp 5040 BDE1.tmp 4516 BE8D.tmp 3248 BF1A.tmp 2244 BFE5.tmp 1604 C062.tmp 1672 C0DF.tmp 2560 C14C.tmp 2304 C1D9.tmp 3556 C246.tmp 4396 C2D3.tmp 1964 C340.tmp 4844 C3FC.tmp 4756 C498.tmp 3944 C515.tmp 4272 C592.tmp 1556 C62E.tmp 4956 C6DA.tmp 4980 C757.tmp 4712 C7F3.tmp 8 C89F.tmp 492 C97A.tmp 2144 CA16.tmp 4368 CA84.tmp 1796 CB2F.tmp 544 CBDB.tmp 1032 CC58.tmp 1644 CCF5.tmp 3996 CD81.tmp 524 CE0E.tmp 2164 CEBA.tmp 4540 CF46.tmp 4544 CFD3.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4816 wrote to memory of 4044 4816 d7424f330980e4exeexeexeex.exe 84 PID 4816 wrote to memory of 4044 4816 d7424f330980e4exeexeexeex.exe 84 PID 4816 wrote to memory of 4044 4816 d7424f330980e4exeexeexeex.exe 84 PID 4044 wrote to memory of 1412 4044 9C5F.tmp 85 PID 4044 wrote to memory of 1412 4044 9C5F.tmp 85 PID 4044 wrote to memory of 1412 4044 9C5F.tmp 85 PID 1412 wrote to memory of 3280 1412 9D69.tmp 86 PID 1412 wrote to memory of 3280 1412 9D69.tmp 86 PID 1412 wrote to memory of 3280 1412 9D69.tmp 86 PID 3280 wrote to memory of 3504 3280 9E43.tmp 87 PID 3280 wrote to memory of 3504 3280 9E43.tmp 87 PID 3280 wrote to memory of 3504 3280 9E43.tmp 87 PID 3504 wrote to memory of 560 3504 9F1E.tmp 88 PID 3504 wrote to memory of 560 3504 9F1E.tmp 88 PID 3504 wrote to memory of 560 3504 9F1E.tmp 88 PID 560 wrote to memory of 1784 560 9FCA.tmp 89 PID 560 wrote to memory of 1784 560 9FCA.tmp 89 PID 560 wrote to memory of 1784 560 9FCA.tmp 89 PID 1784 wrote to memory of 4092 1784 A095.tmp 90 PID 1784 wrote to memory of 4092 1784 A095.tmp 90 PID 1784 wrote to memory of 4092 1784 A095.tmp 90 PID 4092 wrote to memory of 564 4092 A122.tmp 91 PID 4092 wrote to memory of 564 4092 A122.tmp 91 PID 4092 wrote to memory of 564 4092 A122.tmp 91 PID 564 wrote to memory of 2108 564 A1DD.tmp 92 PID 564 wrote to memory of 2108 564 A1DD.tmp 92 PID 564 wrote to memory of 2108 564 A1DD.tmp 92 PID 2108 wrote to memory of 4060 2108 A2C8.tmp 93 PID 2108 wrote to memory of 4060 2108 A2C8.tmp 93 PID 2108 wrote to memory of 4060 2108 A2C8.tmp 93 PID 4060 wrote to memory of 432 4060 A383.tmp 94 PID 4060 wrote to memory of 432 4060 A383.tmp 94 PID 4060 wrote to memory of 432 4060 A383.tmp 94 PID 432 wrote to memory of 4768 432 A45E.tmp 95 PID 432 wrote to memory of 4768 432 A45E.tmp 95 PID 432 wrote to memory of 4768 432 A45E.tmp 95 PID 4768 wrote to memory of 4852 4768 AC3E.tmp 96 PID 4768 wrote to memory of 4852 4768 AC3E.tmp 96 PID 4768 wrote to memory of 4852 4768 AC3E.tmp 96 PID 4852 wrote to memory of 640 4852 AE03.tmp 97 PID 4852 wrote to memory of 640 4852 AE03.tmp 97 PID 4852 wrote to memory of 640 4852 AE03.tmp 97 PID 640 wrote to memory of 1712 640 AEFD.tmp 98 PID 640 wrote to memory of 1712 640 AEFD.tmp 98 PID 640 wrote to memory of 1712 640 AEFD.tmp 98 PID 1712 wrote to memory of 1012 1712 AFE7.tmp 99 PID 1712 wrote to memory of 1012 1712 AFE7.tmp 99 PID 1712 wrote to memory of 1012 1712 AFE7.tmp 99 PID 1012 wrote to memory of 2852 1012 B093.tmp 100 PID 1012 wrote to memory of 2852 1012 B093.tmp 100 PID 1012 wrote to memory of 2852 1012 B093.tmp 100 PID 2852 wrote to memory of 3276 2852 B1FA.tmp 101 PID 2852 wrote to memory of 3276 2852 B1FA.tmp 101 PID 2852 wrote to memory of 3276 2852 B1FA.tmp 101 PID 3276 wrote to memory of 4128 3276 B2B6.tmp 102 PID 3276 wrote to memory of 4128 3276 B2B6.tmp 102 PID 3276 wrote to memory of 4128 3276 B2B6.tmp 102 PID 4128 wrote to memory of 2308 4128 B381.tmp 103 PID 4128 wrote to memory of 2308 4128 B381.tmp 103 PID 4128 wrote to memory of 2308 4128 B381.tmp 103 PID 2308 wrote to memory of 3748 2308 B44C.tmp 104 PID 2308 wrote to memory of 3748 2308 B44C.tmp 104 PID 2308 wrote to memory of 3748 2308 B44C.tmp 104 PID 3748 wrote to memory of 4572 3748 B517.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7424f330980e4exeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\d7424f330980e4exeexeexeex.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\9D69.tmp"C:\Users\Admin\AppData\Local\Temp\9D69.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\A095.tmp"C:\Users\Admin\AppData\Local\Temp\A095.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\A383.tmp"C:\Users\Admin\AppData\Local\Temp\A383.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\B093.tmp"C:\Users\Admin\AppData\Local\Temp\B093.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\B381.tmp"C:\Users\Admin\AppData\Local\Temp\B381.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\B517.tmp"C:\Users\Admin\AppData\Local\Temp\B517.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"23⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"24⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\B759.tmp"C:\Users\Admin\AppData\Local\Temp\B759.tmp"25⤵
- Executes dropped EXE
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\B824.tmp"C:\Users\Admin\AppData\Local\Temp\B824.tmp"26⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"27⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\B96D.tmp"C:\Users\Admin\AppData\Local\Temp\B96D.tmp"28⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\BA09.tmp"C:\Users\Admin\AppData\Local\Temp\BA09.tmp"29⤵
- Executes dropped EXE
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"30⤵
- Executes dropped EXE
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"31⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"32⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\BD06.tmp"C:\Users\Admin\AppData\Local\Temp\BD06.tmp"33⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"34⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"35⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"36⤵
- Executes dropped EXE
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"37⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\C062.tmp"C:\Users\Admin\AppData\Local\Temp\C062.tmp"38⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"39⤵
- Executes dropped EXE
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"40⤵
- Executes dropped EXE
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"41⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\C246.tmp"C:\Users\Admin\AppData\Local\Temp\C246.tmp"42⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"43⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\C340.tmp"C:\Users\Admin\AppData\Local\Temp\C340.tmp"44⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"45⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\C498.tmp"C:\Users\Admin\AppData\Local\Temp\C498.tmp"46⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\C515.tmp"C:\Users\Admin\AppData\Local\Temp\C515.tmp"47⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\C592.tmp"C:\Users\Admin\AppData\Local\Temp\C592.tmp"48⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\C62E.tmp"C:\Users\Admin\AppData\Local\Temp\C62E.tmp"49⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\C6DA.tmp"C:\Users\Admin\AppData\Local\Temp\C6DA.tmp"50⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\C757.tmp"C:\Users\Admin\AppData\Local\Temp\C757.tmp"51⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"52⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\C89F.tmp"C:\Users\Admin\AppData\Local\Temp\C89F.tmp"53⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\C97A.tmp"C:\Users\Admin\AppData\Local\Temp\C97A.tmp"54⤵
- Executes dropped EXE
PID:492 -
C:\Users\Admin\AppData\Local\Temp\CA16.tmp"C:\Users\Admin\AppData\Local\Temp\CA16.tmp"55⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\CA84.tmp"C:\Users\Admin\AppData\Local\Temp\CA84.tmp"56⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"57⤵
- Executes dropped EXE
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"58⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\CC58.tmp"C:\Users\Admin\AppData\Local\Temp\CC58.tmp"59⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"60⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\CD81.tmp"C:\Users\Admin\AppData\Local\Temp\CD81.tmp"61⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\CE0E.tmp"C:\Users\Admin\AppData\Local\Temp\CE0E.tmp"62⤵
- Executes dropped EXE
PID:524 -
C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"63⤵
- Executes dropped EXE
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\CF46.tmp"C:\Users\Admin\AppData\Local\Temp\CF46.tmp"64⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"65⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\D060.tmp"C:\Users\Admin\AppData\Local\Temp\D060.tmp"66⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"67⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\D188.tmp"C:\Users\Admin\AppData\Local\Temp\D188.tmp"68⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\D215.tmp"C:\Users\Admin\AppData\Local\Temp\D215.tmp"69⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\D2A2.tmp"C:\Users\Admin\AppData\Local\Temp\D2A2.tmp"70⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\D30F.tmp"C:\Users\Admin\AppData\Local\Temp\D30F.tmp"71⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\D496.tmp"C:\Users\Admin\AppData\Local\Temp\D496.tmp"72⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\D542.tmp"C:\Users\Admin\AppData\Local\Temp\D542.tmp"73⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"74⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\D62C.tmp"C:\Users\Admin\AppData\Local\Temp\D62C.tmp"75⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\D6B9.tmp"C:\Users\Admin\AppData\Local\Temp\D6B9.tmp"76⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\D745.tmp"C:\Users\Admin\AppData\Local\Temp\D745.tmp"77⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"78⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\D83F.tmp"C:\Users\Admin\AppData\Local\Temp\D83F.tmp"79⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\D8FB.tmp"C:\Users\Admin\AppData\Local\Temp\D8FB.tmp"80⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\D9C6.tmp"C:\Users\Admin\AppData\Local\Temp\D9C6.tmp"81⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\DA43.tmp"C:\Users\Admin\AppData\Local\Temp\DA43.tmp"82⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\DADF.tmp"C:\Users\Admin\AppData\Local\Temp\DADF.tmp"83⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\DB6C.tmp"C:\Users\Admin\AppData\Local\Temp\DB6C.tmp"84⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\DC18.tmp"C:\Users\Admin\AppData\Local\Temp\DC18.tmp"85⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\DC95.tmp"C:\Users\Admin\AppData\Local\Temp\DC95.tmp"86⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\DDBD.tmp"C:\Users\Admin\AppData\Local\Temp\DDBD.tmp"87⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\DE3A.tmp"C:\Users\Admin\AppData\Local\Temp\DE3A.tmp"88⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"89⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\DF73.tmp"C:\Users\Admin\AppData\Local\Temp\DF73.tmp"90⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\E000.tmp"C:\Users\Admin\AppData\Local\Temp\E000.tmp"91⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\E08C.tmp"C:\Users\Admin\AppData\Local\Temp\E08C.tmp"92⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\E177.tmp"C:\Users\Admin\AppData\Local\Temp\E177.tmp"93⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\E3A9.tmp"C:\Users\Admin\AppData\Local\Temp\E3A9.tmp"94⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\E436.tmp"C:\Users\Admin\AppData\Local\Temp\E436.tmp"95⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\E4B3.tmp"C:\Users\Admin\AppData\Local\Temp\E4B3.tmp"96⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\E55F.tmp"C:\Users\Admin\AppData\Local\Temp\E55F.tmp"97⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"98⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\E649.tmp"C:\Users\Admin\AppData\Local\Temp\E649.tmp"99⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"100⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"101⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\E84D.tmp"C:\Users\Admin\AppData\Local\Temp\E84D.tmp"102⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\E966.tmp"C:\Users\Admin\AppData\Local\Temp\E966.tmp"103⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"104⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\EA41.tmp"C:\Users\Admin\AppData\Local\Temp\EA41.tmp"105⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"106⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"107⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"108⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\EC63.tmp"C:\Users\Admin\AppData\Local\Temp\EC63.tmp"109⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\ECE0.tmp"C:\Users\Admin\AppData\Local\Temp\ECE0.tmp"110⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\ED4E.tmp"C:\Users\Admin\AppData\Local\Temp\ED4E.tmp"111⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\EDCB.tmp"C:\Users\Admin\AppData\Local\Temp\EDCB.tmp"112⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\EE57.tmp"C:\Users\Admin\AppData\Local\Temp\EE57.tmp"113⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\EEF4.tmp"C:\Users\Admin\AppData\Local\Temp\EEF4.tmp"114⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\EF80.tmp"C:\Users\Admin\AppData\Local\Temp\EF80.tmp"115⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\F126.tmp"C:\Users\Admin\AppData\Local\Temp\F126.tmp"116⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\F1A3.tmp"C:\Users\Admin\AppData\Local\Temp\F1A3.tmp"117⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\F23F.tmp"C:\Users\Admin\AppData\Local\Temp\F23F.tmp"118⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\F2AD.tmp"C:\Users\Admin\AppData\Local\Temp\F2AD.tmp"119⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\F31A.tmp"C:\Users\Admin\AppData\Local\Temp\F31A.tmp"120⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\F397.tmp"C:\Users\Admin\AppData\Local\Temp\F397.tmp"121⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\F424.tmp"C:\Users\Admin\AppData\Local\Temp\F424.tmp"122⤵PID:4052
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-