Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
16/07/2023, 10:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6326307757ff08_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
6326307757ff08_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
6326307757ff08_JC.exe
-
Size
486KB
-
MD5
6326307757ff08eb40ae979c1327665d
-
SHA1
3322428dcb3c4fa99ac3b1f7e6028bbc08f41f4e
-
SHA256
d04ed57edc76fcbe092640cfa67104d47711055065fe8f623e7500c2865c4aff
-
SHA512
855a4d302cb8f1e97e98355ab56c4b78eced13bda62f02e559c297b5c0f19d107c6dfd07d8d6931d8c9267ccf1c528c7698a3fc20abe514b0abc8c527e6e93fd
-
SSDEEP
12288:/U5rCOTeiDcAEtMOs7O9Q0ymovpfHezXSF1NZ:/UQOJDc/1sS9AGzoN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3292 E261.tmp 2556 E36B.tmp 4172 E445.tmp 3732 E54F.tmp 3852 E668.tmp 3688 E762.tmp 4684 E7FE.tmp 1812 E8BA.tmp 5000 E985.tmp 5020 EA31.tmp 4192 EAEC.tmp 3864 EBA8.tmp 1544 EC54.tmp 1064 ED00.tmp 4812 ED9C.tmp 4744 EEB5.tmp 1504 EFA0.tmp 4908 F05B.tmp 4268 F126.tmp 216 F1F1.tmp 4012 F2BC.tmp 2896 F388.tmp 368 F433.tmp 4652 F50E.tmp 4100 F5D9.tmp 4248 F695.tmp 1644 F760.tmp 2692 F80C.tmp 1584 F8E7.tmp 3448 F9D1.tmp 2328 FA6D.tmp 2020 FB38.tmp 4168 FC32.tmp 3648 FCCF.tmp 3392 FDA9.tmp 4576 FE55.tmp 1264 FF01.tmp 3996 FF6E.tmp 4464 1A.tmp 2888 A7.tmp 3816 162.tmp 2916 23D.tmp 4084 2F9.tmp 4228 395.tmp 3972 441.tmp 1020 4ED.tmp 2076 579.tmp 3908 606.tmp 4060 6B2.tmp 3992 74E.tmp 3720 7DB.tmp 3900 896.tmp 4172 923.tmp 316 9BF.tmp 2492 A4C.tmp 1408 AF8.tmp 2412 B75.tmp 1668 BF2.tmp 4404 C5F.tmp 1812 CDC.tmp 5000 D88.tmp 4960 E05.tmp 4644 E82.tmp 3540 EFF.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 856 wrote to memory of 3292 856 6326307757ff08_JC.exe 84 PID 856 wrote to memory of 3292 856 6326307757ff08_JC.exe 84 PID 856 wrote to memory of 3292 856 6326307757ff08_JC.exe 84 PID 3292 wrote to memory of 2556 3292 E261.tmp 85 PID 3292 wrote to memory of 2556 3292 E261.tmp 85 PID 3292 wrote to memory of 2556 3292 E261.tmp 85 PID 2556 wrote to memory of 4172 2556 E36B.tmp 86 PID 2556 wrote to memory of 4172 2556 E36B.tmp 86 PID 2556 wrote to memory of 4172 2556 E36B.tmp 86 PID 4172 wrote to memory of 3732 4172 E445.tmp 87 PID 4172 wrote to memory of 3732 4172 E445.tmp 87 PID 4172 wrote to memory of 3732 4172 E445.tmp 87 PID 3732 wrote to memory of 3852 3732 E54F.tmp 89 PID 3732 wrote to memory of 3852 3732 E54F.tmp 89 PID 3732 wrote to memory of 3852 3732 E54F.tmp 89 PID 3852 wrote to memory of 3688 3852 E668.tmp 90 PID 3852 wrote to memory of 3688 3852 E668.tmp 90 PID 3852 wrote to memory of 3688 3852 E668.tmp 90 PID 3688 wrote to memory of 4684 3688 E762.tmp 91 PID 3688 wrote to memory of 4684 3688 E762.tmp 91 PID 3688 wrote to memory of 4684 3688 E762.tmp 91 PID 4684 wrote to memory of 1812 4684 E7FE.tmp 92 PID 4684 wrote to memory of 1812 4684 E7FE.tmp 92 PID 4684 wrote to memory of 1812 4684 E7FE.tmp 92 PID 1812 wrote to memory of 5000 1812 E8BA.tmp 93 PID 1812 wrote to memory of 5000 1812 E8BA.tmp 93 PID 1812 wrote to memory of 5000 1812 E8BA.tmp 93 PID 5000 wrote to memory of 5020 5000 E985.tmp 95 PID 5000 wrote to memory of 5020 5000 E985.tmp 95 PID 5000 wrote to memory of 5020 5000 E985.tmp 95 PID 5020 wrote to memory of 4192 5020 EA31.tmp 96 PID 5020 wrote to memory of 4192 5020 EA31.tmp 96 PID 5020 wrote to memory of 4192 5020 EA31.tmp 96 PID 4192 wrote to memory of 3864 4192 EAEC.tmp 97 PID 4192 wrote to memory of 3864 4192 EAEC.tmp 97 PID 4192 wrote to memory of 3864 4192 EAEC.tmp 97 PID 3864 wrote to memory of 1544 3864 EBA8.tmp 98 PID 3864 wrote to memory of 1544 3864 EBA8.tmp 98 PID 3864 wrote to memory of 1544 3864 EBA8.tmp 98 PID 1544 wrote to memory of 1064 1544 EC54.tmp 99 PID 1544 wrote to memory of 1064 1544 EC54.tmp 99 PID 1544 wrote to memory of 1064 1544 EC54.tmp 99 PID 1064 wrote to memory of 4812 1064 ED00.tmp 100 PID 1064 wrote to memory of 4812 1064 ED00.tmp 100 PID 1064 wrote to memory of 4812 1064 ED00.tmp 100 PID 4812 wrote to memory of 4744 4812 ED9C.tmp 101 PID 4812 wrote to memory of 4744 4812 ED9C.tmp 101 PID 4812 wrote to memory of 4744 4812 ED9C.tmp 101 PID 4744 wrote to memory of 1504 4744 EEB5.tmp 102 PID 4744 wrote to memory of 1504 4744 EEB5.tmp 102 PID 4744 wrote to memory of 1504 4744 EEB5.tmp 102 PID 1504 wrote to memory of 4908 1504 EFA0.tmp 103 PID 1504 wrote to memory of 4908 1504 EFA0.tmp 103 PID 1504 wrote to memory of 4908 1504 EFA0.tmp 103 PID 4908 wrote to memory of 4268 4908 F05B.tmp 104 PID 4908 wrote to memory of 4268 4908 F05B.tmp 104 PID 4908 wrote to memory of 4268 4908 F05B.tmp 104 PID 4268 wrote to memory of 216 4268 F126.tmp 105 PID 4268 wrote to memory of 216 4268 F126.tmp 105 PID 4268 wrote to memory of 216 4268 F126.tmp 105 PID 216 wrote to memory of 4012 216 F1F1.tmp 106 PID 216 wrote to memory of 4012 216 F1F1.tmp 106 PID 216 wrote to memory of 4012 216 F1F1.tmp 106 PID 4012 wrote to memory of 2896 4012 F2BC.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\6326307757ff08_JC.exe"C:\Users\Admin\AppData\Local\Temp\6326307757ff08_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\E261.tmp"C:\Users\Admin\AppData\Local\Temp\E261.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\E36B.tmp"C:\Users\Admin\AppData\Local\Temp\E36B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\E445.tmp"C:\Users\Admin\AppData\Local\Temp\E445.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\E54F.tmp"C:\Users\Admin\AppData\Local\Temp\E54F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\E668.tmp"C:\Users\Admin\AppData\Local\Temp\E668.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\E762.tmp"C:\Users\Admin\AppData\Local\Temp\E762.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\E985.tmp"C:\Users\Admin\AppData\Local\Temp\E985.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\EA31.tmp"C:\Users\Admin\AppData\Local\Temp\EA31.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\EC54.tmp"C:\Users\Admin\AppData\Local\Temp\EC54.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\ED00.tmp"C:\Users\Admin\AppData\Local\Temp\ED00.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\ED9C.tmp"C:\Users\Admin\AppData\Local\Temp\ED9C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\EFA0.tmp"C:\Users\Admin\AppData\Local\Temp\EFA0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\F05B.tmp"C:\Users\Admin\AppData\Local\Temp\F05B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\F126.tmp"C:\Users\Admin\AppData\Local\Temp\F126.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\F1F1.tmp"C:\Users\Admin\AppData\Local\Temp\F1F1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\F388.tmp"C:\Users\Admin\AppData\Local\Temp\F388.tmp"23⤵
- Executes dropped EXE
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\F433.tmp"C:\Users\Admin\AppData\Local\Temp\F433.tmp"24⤵
- Executes dropped EXE
PID:368 -
C:\Users\Admin\AppData\Local\Temp\F50E.tmp"C:\Users\Admin\AppData\Local\Temp\F50E.tmp"25⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"26⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\F695.tmp"C:\Users\Admin\AppData\Local\Temp\F695.tmp"27⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\F760.tmp"C:\Users\Admin\AppData\Local\Temp\F760.tmp"28⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\F80C.tmp"C:\Users\Admin\AppData\Local\Temp\F80C.tmp"29⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"30⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"31⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"32⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\FB38.tmp"C:\Users\Admin\AppData\Local\Temp\FB38.tmp"33⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\FC32.tmp"C:\Users\Admin\AppData\Local\Temp\FC32.tmp"34⤵
- Executes dropped EXE
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"35⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"36⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\FE55.tmp"C:\Users\Admin\AppData\Local\Temp\FE55.tmp"37⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\FF01.tmp"C:\Users\Admin\AppData\Local\Temp\FF01.tmp"38⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"39⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\1A.tmp"C:\Users\Admin\AppData\Local\Temp\1A.tmp"40⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\A7.tmp"C:\Users\Admin\AppData\Local\Temp\A7.tmp"41⤵
- Executes dropped EXE
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\162.tmp"C:\Users\Admin\AppData\Local\Temp\162.tmp"42⤵
- Executes dropped EXE
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\23D.tmp"C:\Users\Admin\AppData\Local\Temp\23D.tmp"43⤵
- Executes dropped EXE
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\2F9.tmp"C:\Users\Admin\AppData\Local\Temp\2F9.tmp"44⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\395.tmp"C:\Users\Admin\AppData\Local\Temp\395.tmp"45⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\441.tmp"C:\Users\Admin\AppData\Local\Temp\441.tmp"46⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\4ED.tmp"C:\Users\Admin\AppData\Local\Temp\4ED.tmp"47⤵
- Executes dropped EXE
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\579.tmp"C:\Users\Admin\AppData\Local\Temp\579.tmp"48⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\606.tmp"C:\Users\Admin\AppData\Local\Temp\606.tmp"49⤵
- Executes dropped EXE
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\6B2.tmp"C:\Users\Admin\AppData\Local\Temp\6B2.tmp"50⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\74E.tmp"C:\Users\Admin\AppData\Local\Temp\74E.tmp"51⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\7DB.tmp"C:\Users\Admin\AppData\Local\Temp\7DB.tmp"52⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\896.tmp"C:\Users\Admin\AppData\Local\Temp\896.tmp"53⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\923.tmp"C:\Users\Admin\AppData\Local\Temp\923.tmp"54⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\9BF.tmp"C:\Users\Admin\AppData\Local\Temp\9BF.tmp"55⤵
- Executes dropped EXE
PID:316 -
C:\Users\Admin\AppData\Local\Temp\A4C.tmp"C:\Users\Admin\AppData\Local\Temp\A4C.tmp"56⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\AF8.tmp"C:\Users\Admin\AppData\Local\Temp\AF8.tmp"57⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\B75.tmp"C:\Users\Admin\AppData\Local\Temp\B75.tmp"58⤵
- Executes dropped EXE
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"59⤵
- Executes dropped EXE
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\C5F.tmp"C:\Users\Admin\AppData\Local\Temp\C5F.tmp"60⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\CDC.tmp"C:\Users\Admin\AppData\Local\Temp\CDC.tmp"61⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\D88.tmp"C:\Users\Admin\AppData\Local\Temp\D88.tmp"62⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\E05.tmp"C:\Users\Admin\AppData\Local\Temp\E05.tmp"63⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\E82.tmp"C:\Users\Admin\AppData\Local\Temp\E82.tmp"64⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\EFF.tmp"C:\Users\Admin\AppData\Local\Temp\EFF.tmp"65⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\F7C.tmp"C:\Users\Admin\AppData\Local\Temp\F7C.tmp"66⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"67⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\1066.tmp"C:\Users\Admin\AppData\Local\Temp\1066.tmp"68⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\10E3.tmp"C:\Users\Admin\AppData\Local\Temp\10E3.tmp"69⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\117F.tmp"C:\Users\Admin\AppData\Local\Temp\117F.tmp"70⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\124B.tmp"C:\Users\Admin\AppData\Local\Temp\124B.tmp"71⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\12E7.tmp"C:\Users\Admin\AppData\Local\Temp\12E7.tmp"72⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\1373.tmp"C:\Users\Admin\AppData\Local\Temp\1373.tmp"73⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\1410.tmp"C:\Users\Admin\AppData\Local\Temp\1410.tmp"74⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\14AC.tmp"C:\Users\Admin\AppData\Local\Temp\14AC.tmp"75⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\1519.tmp"C:\Users\Admin\AppData\Local\Temp\1519.tmp"76⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\15A6.tmp"C:\Users\Admin\AppData\Local\Temp\15A6.tmp"77⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\1623.tmp"C:\Users\Admin\AppData\Local\Temp\1623.tmp"78⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\16A0.tmp"C:\Users\Admin\AppData\Local\Temp\16A0.tmp"79⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\174C.tmp"C:\Users\Admin\AppData\Local\Temp\174C.tmp"80⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\17B9.tmp"C:\Users\Admin\AppData\Local\Temp\17B9.tmp"81⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\1865.tmp"C:\Users\Admin\AppData\Local\Temp\1865.tmp"82⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\1940.tmp"C:\Users\Admin\AppData\Local\Temp\1940.tmp"83⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\19EC.tmp"C:\Users\Admin\AppData\Local\Temp\19EC.tmp"84⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\1AB7.tmp"C:\Users\Admin\AppData\Local\Temp\1AB7.tmp"85⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\1B63.tmp"C:\Users\Admin\AppData\Local\Temp\1B63.tmp"86⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\1C0F.tmp"C:\Users\Admin\AppData\Local\Temp\1C0F.tmp"87⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"88⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\1D37.tmp"C:\Users\Admin\AppData\Local\Temp\1D37.tmp"89⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\1DF3.tmp"C:\Users\Admin\AppData\Local\Temp\1DF3.tmp"90⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"91⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\1F3B.tmp"C:\Users\Admin\AppData\Local\Temp\1F3B.tmp"92⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\1FD7.tmp"C:\Users\Admin\AppData\Local\Temp\1FD7.tmp"93⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\2074.tmp"C:\Users\Admin\AppData\Local\Temp\2074.tmp"94⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\213F.tmp"C:\Users\Admin\AppData\Local\Temp\213F.tmp"95⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\21CB.tmp"C:\Users\Admin\AppData\Local\Temp\21CB.tmp"96⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\2277.tmp"C:\Users\Admin\AppData\Local\Temp\2277.tmp"97⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\2313.tmp"C:\Users\Admin\AppData\Local\Temp\2313.tmp"98⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\23A0.tmp"C:\Users\Admin\AppData\Local\Temp\23A0.tmp"99⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\242D.tmp"C:\Users\Admin\AppData\Local\Temp\242D.tmp"100⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\24F8.tmp"C:\Users\Admin\AppData\Local\Temp\24F8.tmp"101⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\25B3.tmp"C:\Users\Admin\AppData\Local\Temp\25B3.tmp"102⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\265F.tmp"C:\Users\Admin\AppData\Local\Temp\265F.tmp"103⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\26FB.tmp"C:\Users\Admin\AppData\Local\Temp\26FB.tmp"104⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\27B7.tmp"C:\Users\Admin\AppData\Local\Temp\27B7.tmp"105⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\2824.tmp"C:\Users\Admin\AppData\Local\Temp\2824.tmp"106⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\28B1.tmp"C:\Users\Admin\AppData\Local\Temp\28B1.tmp"107⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\293E.tmp"C:\Users\Admin\AppData\Local\Temp\293E.tmp"108⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\29E9.tmp"C:\Users\Admin\AppData\Local\Temp\29E9.tmp"109⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\2AA5.tmp"C:\Users\Admin\AppData\Local\Temp\2AA5.tmp"110⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\2B51.tmp"C:\Users\Admin\AppData\Local\Temp\2B51.tmp"111⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"112⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\2C6A.tmp"C:\Users\Admin\AppData\Local\Temp\2C6A.tmp"113⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\2D16.tmp"C:\Users\Admin\AppData\Local\Temp\2D16.tmp"114⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\2D93.tmp"C:\Users\Admin\AppData\Local\Temp\2D93.tmp"115⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"116⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\2EEB.tmp"C:\Users\Admin\AppData\Local\Temp\2EEB.tmp"117⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\2F77.tmp"C:\Users\Admin\AppData\Local\Temp\2F77.tmp"118⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\3014.tmp"C:\Users\Admin\AppData\Local\Temp\3014.tmp"119⤵PID:180
-
C:\Users\Admin\AppData\Local\Temp\30A0.tmp"C:\Users\Admin\AppData\Local\Temp\30A0.tmp"120⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\311D.tmp"C:\Users\Admin\AppData\Local\Temp\311D.tmp"121⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\319A.tmp"C:\Users\Admin\AppData\Local\Temp\319A.tmp"122⤵PID:4744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-