Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
06/06/2024, 08:54
Static task
static1
Behavioral task
behavioral1
Sample
fc83cd5af474fd286cd1aebfe600572cd10716eaaeddc5038c4252873297225c.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
fc83cd5af474fd286cd1aebfe600572cd10716eaaeddc5038c4252873297225c.exe
Resource
win10v2004-20240508-en
General
-
Target
fc83cd5af474fd286cd1aebfe600572cd10716eaaeddc5038c4252873297225c.exe
-
Size
520KB
-
MD5
adb9f05c0dbbb881767f4ca0a67ae3b6
-
SHA1
cfdd5a18f7390e2a2e7bc24422ced78f88117865
-
SHA256
fc83cd5af474fd286cd1aebfe600572cd10716eaaeddc5038c4252873297225c
-
SHA512
d9bd187a0f14cf67cacba2d432aa9a6e7e3aa38f2373e20d57eaa18b208ff94d2527321117ca560915f3c95032728cab76fea8cf9125953825d8ec7b3b57ea14
-
SSDEEP
12288:roRXOQjmOykIOJujYNF6RUKvoXxJpzdNZ:rogQ9yQQjHhvohJpzdN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 764 E196.tmp 4808 E213.tmp 3980 E29F.tmp 1932 E31C.tmp 3244 E38A.tmp 3352 E416.tmp 4804 E493.tmp 2644 E520.tmp 968 E59D.tmp 4976 E5FB.tmp 3764 E697.tmp 3912 E724.tmp 2324 E791.tmp 888 E7FE.tmp 3116 E87B.tmp 1972 E8E9.tmp 4216 E947.tmp 3488 E995.tmp 2196 EA02.tmp 1236 EA6F.tmp 4772 EAFC.tmp 876 EB4A.tmp 4556 EBC7.tmp 4072 EC35.tmp 3336 ECA2.tmp 2752 ED00.tmp 3664 ED8C.tmp 1512 EDDA.tmp 2936 EE38.tmp 3056 EE96.tmp 4220 EF03.tmp 3180 EF71.tmp 5064 EFBF.tmp 4068 F01D.tmp 856 F08A.tmp 2660 F0D8.tmp 4312 F126.tmp 4484 F174.tmp 3048 F1C2.tmp 4660 F220.tmp 4416 F26E.tmp 3728 F2BC.tmp 3116 F30B.tmp 3036 F368.tmp 2408 F3B6.tmp 4592 F414.tmp 4448 F472.tmp 1948 F4D0.tmp 3300 F51E.tmp 4844 F57C.tmp 3820 F5D9.tmp 4556 F637.tmp 4072 F695.tmp 4676 F6F3.tmp 4808 F741.tmp 1556 F78F.tmp 3056 F7DD.tmp 4616 F82B.tmp 660 F879.tmp 744 F8D7.tmp 2156 F925.tmp 3756 F973.tmp 4804 F9D1.tmp 4312 FA2F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4524 wrote to memory of 764 4524 fc83cd5af474fd286cd1aebfe600572cd10716eaaeddc5038c4252873297225c.exe 90 PID 4524 wrote to memory of 764 4524 fc83cd5af474fd286cd1aebfe600572cd10716eaaeddc5038c4252873297225c.exe 90 PID 4524 wrote to memory of 764 4524 fc83cd5af474fd286cd1aebfe600572cd10716eaaeddc5038c4252873297225c.exe 90 PID 764 wrote to memory of 4808 764 E196.tmp 91 PID 764 wrote to memory of 4808 764 E196.tmp 91 PID 764 wrote to memory of 4808 764 E196.tmp 91 PID 4808 wrote to memory of 3980 4808 E213.tmp 92 PID 4808 wrote to memory of 3980 4808 E213.tmp 92 PID 4808 wrote to memory of 3980 4808 E213.tmp 92 PID 3980 wrote to memory of 1932 3980 E29F.tmp 93 PID 3980 wrote to memory of 1932 3980 E29F.tmp 93 PID 3980 wrote to memory of 1932 3980 E29F.tmp 93 PID 1932 wrote to memory of 3244 1932 E31C.tmp 94 PID 1932 wrote to memory of 3244 1932 E31C.tmp 94 PID 1932 wrote to memory of 3244 1932 E31C.tmp 94 PID 3244 wrote to memory of 3352 3244 E38A.tmp 95 PID 3244 wrote to memory of 3352 3244 E38A.tmp 95 PID 3244 wrote to memory of 3352 3244 E38A.tmp 95 PID 3352 wrote to memory of 4804 3352 E416.tmp 97 PID 3352 wrote to memory of 4804 3352 E416.tmp 97 PID 3352 wrote to memory of 4804 3352 E416.tmp 97 PID 4804 wrote to memory of 2644 4804 E493.tmp 99 PID 4804 wrote to memory of 2644 4804 E493.tmp 99 PID 4804 wrote to memory of 2644 4804 E493.tmp 99 PID 2644 wrote to memory of 968 2644 E520.tmp 100 PID 2644 wrote to memory of 968 2644 E520.tmp 100 PID 2644 wrote to memory of 968 2644 E520.tmp 100 PID 968 wrote to memory of 4976 968 E59D.tmp 101 PID 968 wrote to memory of 4976 968 E59D.tmp 101 PID 968 wrote to memory of 4976 968 E59D.tmp 101 PID 4976 wrote to memory of 3764 4976 E5FB.tmp 103 PID 4976 wrote to memory of 3764 4976 E5FB.tmp 103 PID 4976 wrote to memory of 3764 4976 E5FB.tmp 103 PID 3764 wrote to memory of 3912 3764 E697.tmp 104 PID 3764 wrote to memory of 3912 3764 E697.tmp 104 PID 3764 wrote to memory of 3912 3764 E697.tmp 104 PID 3912 wrote to memory of 2324 3912 E724.tmp 105 PID 3912 wrote to memory of 2324 3912 E724.tmp 105 PID 3912 wrote to memory of 2324 3912 E724.tmp 105 PID 2324 wrote to memory of 888 2324 E791.tmp 106 PID 2324 wrote to memory of 888 2324 E791.tmp 106 PID 2324 wrote to memory of 888 2324 E791.tmp 106 PID 888 wrote to memory of 3116 888 E7FE.tmp 107 PID 888 wrote to memory of 3116 888 E7FE.tmp 107 PID 888 wrote to memory of 3116 888 E7FE.tmp 107 PID 3116 wrote to memory of 1972 3116 E87B.tmp 108 PID 3116 wrote to memory of 1972 3116 E87B.tmp 108 PID 3116 wrote to memory of 1972 3116 E87B.tmp 108 PID 1972 wrote to memory of 4216 1972 E8E9.tmp 109 PID 1972 wrote to memory of 4216 1972 E8E9.tmp 109 PID 1972 wrote to memory of 4216 1972 E8E9.tmp 109 PID 4216 wrote to memory of 3488 4216 E947.tmp 110 PID 4216 wrote to memory of 3488 4216 E947.tmp 110 PID 4216 wrote to memory of 3488 4216 E947.tmp 110 PID 3488 wrote to memory of 2196 3488 E995.tmp 111 PID 3488 wrote to memory of 2196 3488 E995.tmp 111 PID 3488 wrote to memory of 2196 3488 E995.tmp 111 PID 2196 wrote to memory of 1236 2196 EA02.tmp 112 PID 2196 wrote to memory of 1236 2196 EA02.tmp 112 PID 2196 wrote to memory of 1236 2196 EA02.tmp 112 PID 1236 wrote to memory of 4772 1236 EA6F.tmp 113 PID 1236 wrote to memory of 4772 1236 EA6F.tmp 113 PID 1236 wrote to memory of 4772 1236 EA6F.tmp 113 PID 4772 wrote to memory of 876 4772 EAFC.tmp 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc83cd5af474fd286cd1aebfe600572cd10716eaaeddc5038c4252873297225c.exe"C:\Users\Admin\AppData\Local\Temp\fc83cd5af474fd286cd1aebfe600572cd10716eaaeddc5038c4252873297225c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\E196.tmp"C:\Users\Admin\AppData\Local\Temp\E196.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\E213.tmp"C:\Users\Admin\AppData\Local\Temp\E213.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\E29F.tmp"C:\Users\Admin\AppData\Local\Temp\E29F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\E31C.tmp"C:\Users\Admin\AppData\Local\Temp\E31C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\E38A.tmp"C:\Users\Admin\AppData\Local\Temp\E38A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\E416.tmp"C:\Users\Admin\AppData\Local\Temp\E416.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\E493.tmp"C:\Users\Admin\AppData\Local\Temp\E493.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\E520.tmp"C:\Users\Admin\AppData\Local\Temp\E520.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\E59D.tmp"C:\Users\Admin\AppData\Local\Temp\E59D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\E697.tmp"C:\Users\Admin\AppData\Local\Temp\E697.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\E724.tmp"C:\Users\Admin\AppData\Local\Temp\E724.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\E791.tmp"C:\Users\Admin\AppData\Local\Temp\E791.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\E87B.tmp"C:\Users\Admin\AppData\Local\Temp\E87B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\E947.tmp"C:\Users\Admin\AppData\Local\Temp\E947.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\E995.tmp"C:\Users\Admin\AppData\Local\Temp\E995.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\EA02.tmp"C:\Users\Admin\AppData\Local\Temp\EA02.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\EAFC.tmp"C:\Users\Admin\AppData\Local\Temp\EAFC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\EB4A.tmp"C:\Users\Admin\AppData\Local\Temp\EB4A.tmp"23⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\EBC7.tmp"C:\Users\Admin\AppData\Local\Temp\EBC7.tmp"24⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\EC35.tmp"C:\Users\Admin\AppData\Local\Temp\EC35.tmp"25⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\ECA2.tmp"C:\Users\Admin\AppData\Local\Temp\ECA2.tmp"26⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\ED00.tmp"C:\Users\Admin\AppData\Local\Temp\ED00.tmp"27⤵
- Executes dropped EXE
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"28⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\EDDA.tmp"C:\Users\Admin\AppData\Local\Temp\EDDA.tmp"29⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\EE38.tmp"C:\Users\Admin\AppData\Local\Temp\EE38.tmp"30⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\EE96.tmp"C:\Users\Admin\AppData\Local\Temp\EE96.tmp"31⤵
- Executes dropped EXE
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\EF03.tmp"C:\Users\Admin\AppData\Local\Temp\EF03.tmp"32⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\EF71.tmp"C:\Users\Admin\AppData\Local\Temp\EF71.tmp"33⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\EFBF.tmp"C:\Users\Admin\AppData\Local\Temp\EFBF.tmp"34⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\F01D.tmp"C:\Users\Admin\AppData\Local\Temp\F01D.tmp"35⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\F08A.tmp"C:\Users\Admin\AppData\Local\Temp\F08A.tmp"36⤵
- Executes dropped EXE
PID:856 -
C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"37⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\F126.tmp"C:\Users\Admin\AppData\Local\Temp\F126.tmp"38⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\F174.tmp"C:\Users\Admin\AppData\Local\Temp\F174.tmp"39⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"40⤵
- Executes dropped EXE
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\F220.tmp"C:\Users\Admin\AppData\Local\Temp\F220.tmp"41⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\F26E.tmp"C:\Users\Admin\AppData\Local\Temp\F26E.tmp"42⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"43⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\F30B.tmp"C:\Users\Admin\AppData\Local\Temp\F30B.tmp"44⤵
- Executes dropped EXE
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\F368.tmp"C:\Users\Admin\AppData\Local\Temp\F368.tmp"45⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"46⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\F414.tmp"C:\Users\Admin\AppData\Local\Temp\F414.tmp"47⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\F472.tmp"C:\Users\Admin\AppData\Local\Temp\F472.tmp"48⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"49⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\F51E.tmp"C:\Users\Admin\AppData\Local\Temp\F51E.tmp"50⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\F57C.tmp"C:\Users\Admin\AppData\Local\Temp\F57C.tmp"51⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"52⤵
- Executes dropped EXE
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\F637.tmp"C:\Users\Admin\AppData\Local\Temp\F637.tmp"53⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\F695.tmp"C:\Users\Admin\AppData\Local\Temp\F695.tmp"54⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"55⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\F741.tmp"C:\Users\Admin\AppData\Local\Temp\F741.tmp"56⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\F78F.tmp"C:\Users\Admin\AppData\Local\Temp\F78F.tmp"57⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"58⤵
- Executes dropped EXE
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\F82B.tmp"C:\Users\Admin\AppData\Local\Temp\F82B.tmp"59⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\F879.tmp"C:\Users\Admin\AppData\Local\Temp\F879.tmp"60⤵
- Executes dropped EXE
PID:660 -
C:\Users\Admin\AppData\Local\Temp\F8D7.tmp"C:\Users\Admin\AppData\Local\Temp\F8D7.tmp"61⤵
- Executes dropped EXE
PID:744 -
C:\Users\Admin\AppData\Local\Temp\F925.tmp"C:\Users\Admin\AppData\Local\Temp\F925.tmp"62⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\F973.tmp"C:\Users\Admin\AppData\Local\Temp\F973.tmp"63⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"64⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\FA2F.tmp"C:\Users\Admin\AppData\Local\Temp\FA2F.tmp"65⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"66⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"67⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\FB48.tmp"C:\Users\Admin\AppData\Local\Temp\FB48.tmp"68⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"69⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"70⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\FC52.tmp"C:\Users\Admin\AppData\Local\Temp\FC52.tmp"71⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\FCBF.tmp"C:\Users\Admin\AppData\Local\Temp\FCBF.tmp"72⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\FD1D.tmp"C:\Users\Admin\AppData\Local\Temp\FD1D.tmp"73⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\FD6B.tmp"C:\Users\Admin\AppData\Local\Temp\FD6B.tmp"74⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"75⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\FE26.tmp"C:\Users\Admin\AppData\Local\Temp\FE26.tmp"76⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\FE84.tmp"C:\Users\Admin\AppData\Local\Temp\FE84.tmp"77⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\FEE2.tmp"C:\Users\Admin\AppData\Local\Temp\FEE2.tmp"78⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\FF40.tmp"C:\Users\Admin\AppData\Local\Temp\FF40.tmp"79⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\FF9D.tmp"C:\Users\Admin\AppData\Local\Temp\FF9D.tmp"80⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\FFFB.tmp"C:\Users\Admin\AppData\Local\Temp\FFFB.tmp"81⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\59.tmp"C:\Users\Admin\AppData\Local\Temp\59.tmp"82⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\A7.tmp"C:\Users\Admin\AppData\Local\Temp\A7.tmp"83⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\105.tmp"C:\Users\Admin\AppData\Local\Temp\105.tmp"84⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\162.tmp"C:\Users\Admin\AppData\Local\Temp\162.tmp"85⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\1C0.tmp"C:\Users\Admin\AppData\Local\Temp\1C0.tmp"86⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\21E.tmp"C:\Users\Admin\AppData\Local\Temp\21E.tmp"87⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\26C.tmp"C:\Users\Admin\AppData\Local\Temp\26C.tmp"88⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\2CA.tmp"C:\Users\Admin\AppData\Local\Temp\2CA.tmp"89⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\328.tmp"C:\Users\Admin\AppData\Local\Temp\328.tmp"90⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\385.tmp"C:\Users\Admin\AppData\Local\Temp\385.tmp"91⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\3E3.tmp"C:\Users\Admin\AppData\Local\Temp\3E3.tmp"92⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\441.tmp"C:\Users\Admin\AppData\Local\Temp\441.tmp"93⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\49F.tmp"C:\Users\Admin\AppData\Local\Temp\49F.tmp"94⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\4FC.tmp"C:\Users\Admin\AppData\Local\Temp\4FC.tmp"95⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\56A.tmp"C:\Users\Admin\AppData\Local\Temp\56A.tmp"96⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\5C7.tmp"C:\Users\Admin\AppData\Local\Temp\5C7.tmp"97⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\625.tmp"C:\Users\Admin\AppData\Local\Temp\625.tmp"98⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\683.tmp"C:\Users\Admin\AppData\Local\Temp\683.tmp"99⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\6E1.tmp"C:\Users\Admin\AppData\Local\Temp\6E1.tmp"100⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\73E.tmp"C:\Users\Admin\AppData\Local\Temp\73E.tmp"101⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\78D.tmp"C:\Users\Admin\AppData\Local\Temp\78D.tmp"102⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\7DB.tmp"C:\Users\Admin\AppData\Local\Temp\7DB.tmp"103⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\829.tmp"C:\Users\Admin\AppData\Local\Temp\829.tmp"104⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\877.tmp"C:\Users\Admin\AppData\Local\Temp\877.tmp"105⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\8C5.tmp"C:\Users\Admin\AppData\Local\Temp\8C5.tmp"106⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\913.tmp"C:\Users\Admin\AppData\Local\Temp\913.tmp"107⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\961.tmp"C:\Users\Admin\AppData\Local\Temp\961.tmp"108⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\9AF.tmp"C:\Users\Admin\AppData\Local\Temp\9AF.tmp"109⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\9FE.tmp"C:\Users\Admin\AppData\Local\Temp\9FE.tmp"110⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\A4C.tmp"C:\Users\Admin\AppData\Local\Temp\A4C.tmp"111⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\A9A.tmp"C:\Users\Admin\AppData\Local\Temp\A9A.tmp"112⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\AE8.tmp"C:\Users\Admin\AppData\Local\Temp\AE8.tmp"113⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\B36.tmp"C:\Users\Admin\AppData\Local\Temp\B36.tmp"114⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\B94.tmp"C:\Users\Admin\AppData\Local\Temp\B94.tmp"115⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\C20.tmp"C:\Users\Admin\AppData\Local\Temp\C20.tmp"116⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\CCC.tmp"C:\Users\Admin\AppData\Local\Temp\CCC.tmp"117⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\D49.tmp"C:\Users\Admin\AppData\Local\Temp\D49.tmp"118⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"119⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\DF5.tmp"C:\Users\Admin\AppData\Local\Temp\DF5.tmp"120⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\E43.tmp"C:\Users\Admin\AppData\Local\Temp\E43.tmp"121⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\E91.tmp"C:\Users\Admin\AppData\Local\Temp\E91.tmp"122⤵PID:4944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-