Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
14/07/2023, 16:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
30807d2ff5940fexeexe_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
30807d2ff5940fexeexe_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
30807d2ff5940fexeexe_JC.exe
-
Size
486KB
-
MD5
30807d2ff5940f0050b51b1166a3f350
-
SHA1
9eebe61eeb27c598cd7f39c74db9fd9a03a786c1
-
SHA256
fd2024fa32f3d8c73557702773ffe5e314752207091f56501bc4a59567e6e02b
-
SHA512
3f542e2d5c2028b639de38d2d35ef87687617622a28b60750215d56dc97cfb5d9bca6be3d88532fe365fc667ec754c57c6ecfc12d7a8c1413a9d34f4ee3c35f3
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7TlTFaDp+j4amgbwSeAv1qhxGggLuZhHV5lfC:/U5rCOTeiDNqp+vbRqhxjAufHABNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 860 7639.tmp 432 76F5.tmp 628 77A1.tmp 4608 785C.tmp 3856 78E9.tmp 4524 7995.tmp 1548 7A41.tmp 3680 7ADD.tmp 4880 7B6A.tmp 3972 830B.tmp 1596 83C6.tmp 1412 8462.tmp 1208 851E.tmp 1400 85AB.tmp 3032 8695.tmp 1260 8741.tmp 800 87ED.tmp 1252 88B8.tmp 4108 8993.tmp 4876 8A6D.tmp 1908 8AEA.tmp 4392 8BB5.tmp 4364 8C90.tmp 2672 8D5B.tmp 5048 8E26.tmp 3056 8F20.tmp 3456 8FEC.tmp 1056 90B7.tmp 3872 91B1.tmp 2220 9328.tmp 888 93D4.tmp 3712 94CE.tmp 448 95D7.tmp 4072 96B2.tmp 1136 975E.tmp 4960 97FA.tmp 4480 9913.tmp 568 99BF.tmp 3788 9A4C.tmp 3804 9B07.tmp 4608 9B94.tmp 4916 9C21.tmp 1032 9CCC.tmp 5084 9D88.tmp 1364 9E05.tmp 5108 9ED0.tmp 1548 9F7C.tmp 3700 A028.tmp 5096 A0D4.tmp 3516 A18F.tmp 5012 A22B.tmp 4504 A2E7.tmp 3868 A383.tmp 2156 A41F.tmp 4216 A4AC.tmp 4060 A519.tmp 208 A587.tmp 1972 A623.tmp 2228 A6B0.tmp 1408 A72D.tmp 3672 A79A.tmp 2628 A827.tmp 3424 A9DC.tmp 2060 AA78.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 552 wrote to memory of 860 552 30807d2ff5940fexeexe_JC.exe 86 PID 552 wrote to memory of 860 552 30807d2ff5940fexeexe_JC.exe 86 PID 552 wrote to memory of 860 552 30807d2ff5940fexeexe_JC.exe 86 PID 860 wrote to memory of 432 860 7639.tmp 87 PID 860 wrote to memory of 432 860 7639.tmp 87 PID 860 wrote to memory of 432 860 7639.tmp 87 PID 432 wrote to memory of 628 432 76F5.tmp 88 PID 432 wrote to memory of 628 432 76F5.tmp 88 PID 432 wrote to memory of 628 432 76F5.tmp 88 PID 628 wrote to memory of 4608 628 77A1.tmp 90 PID 628 wrote to memory of 4608 628 77A1.tmp 90 PID 628 wrote to memory of 4608 628 77A1.tmp 90 PID 4608 wrote to memory of 3856 4608 785C.tmp 91 PID 4608 wrote to memory of 3856 4608 785C.tmp 91 PID 4608 wrote to memory of 3856 4608 785C.tmp 91 PID 3856 wrote to memory of 4524 3856 78E9.tmp 92 PID 3856 wrote to memory of 4524 3856 78E9.tmp 92 PID 3856 wrote to memory of 4524 3856 78E9.tmp 92 PID 4524 wrote to memory of 1548 4524 7995.tmp 93 PID 4524 wrote to memory of 1548 4524 7995.tmp 93 PID 4524 wrote to memory of 1548 4524 7995.tmp 93 PID 1548 wrote to memory of 3680 1548 7A41.tmp 94 PID 1548 wrote to memory of 3680 1548 7A41.tmp 94 PID 1548 wrote to memory of 3680 1548 7A41.tmp 94 PID 3680 wrote to memory of 4880 3680 7ADD.tmp 95 PID 3680 wrote to memory of 4880 3680 7ADD.tmp 95 PID 3680 wrote to memory of 4880 3680 7ADD.tmp 95 PID 4880 wrote to memory of 3972 4880 7B6A.tmp 96 PID 4880 wrote to memory of 3972 4880 7B6A.tmp 96 PID 4880 wrote to memory of 3972 4880 7B6A.tmp 96 PID 3972 wrote to memory of 1596 3972 830B.tmp 97 PID 3972 wrote to memory of 1596 3972 830B.tmp 97 PID 3972 wrote to memory of 1596 3972 830B.tmp 97 PID 1596 wrote to memory of 1412 1596 83C6.tmp 98 PID 1596 wrote to memory of 1412 1596 83C6.tmp 98 PID 1596 wrote to memory of 1412 1596 83C6.tmp 98 PID 1412 wrote to memory of 1208 1412 8462.tmp 99 PID 1412 wrote to memory of 1208 1412 8462.tmp 99 PID 1412 wrote to memory of 1208 1412 8462.tmp 99 PID 1208 wrote to memory of 1400 1208 851E.tmp 100 PID 1208 wrote to memory of 1400 1208 851E.tmp 100 PID 1208 wrote to memory of 1400 1208 851E.tmp 100 PID 1400 wrote to memory of 3032 1400 85AB.tmp 101 PID 1400 wrote to memory of 3032 1400 85AB.tmp 101 PID 1400 wrote to memory of 3032 1400 85AB.tmp 101 PID 3032 wrote to memory of 1260 3032 8695.tmp 102 PID 3032 wrote to memory of 1260 3032 8695.tmp 102 PID 3032 wrote to memory of 1260 3032 8695.tmp 102 PID 1260 wrote to memory of 800 1260 8741.tmp 104 PID 1260 wrote to memory of 800 1260 8741.tmp 104 PID 1260 wrote to memory of 800 1260 8741.tmp 104 PID 800 wrote to memory of 1252 800 87ED.tmp 105 PID 800 wrote to memory of 1252 800 87ED.tmp 105 PID 800 wrote to memory of 1252 800 87ED.tmp 105 PID 1252 wrote to memory of 4108 1252 88B8.tmp 106 PID 1252 wrote to memory of 4108 1252 88B8.tmp 106 PID 1252 wrote to memory of 4108 1252 88B8.tmp 106 PID 4108 wrote to memory of 4876 4108 8993.tmp 108 PID 4108 wrote to memory of 4876 4108 8993.tmp 108 PID 4108 wrote to memory of 4876 4108 8993.tmp 108 PID 4876 wrote to memory of 1908 4876 8A6D.tmp 109 PID 4876 wrote to memory of 1908 4876 8A6D.tmp 109 PID 4876 wrote to memory of 1908 4876 8A6D.tmp 109 PID 1908 wrote to memory of 4392 1908 8AEA.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\30807d2ff5940fexeexe_JC.exe"C:\Users\Admin\AppData\Local\Temp\30807d2ff5940fexeexe_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\76F5.tmp"C:\Users\Admin\AppData\Local\Temp\76F5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\77A1.tmp"C:\Users\Admin\AppData\Local\Temp\77A1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\785C.tmp"C:\Users\Admin\AppData\Local\Temp\785C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\7995.tmp"C:\Users\Admin\AppData\Local\Temp\7995.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\830B.tmp"C:\Users\Admin\AppData\Local\Temp\830B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\83C6.tmp"C:\Users\Admin\AppData\Local\Temp\83C6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\8462.tmp"C:\Users\Admin\AppData\Local\Temp\8462.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\851E.tmp"C:\Users\Admin\AppData\Local\Temp\851E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\85AB.tmp"C:\Users\Admin\AppData\Local\Temp\85AB.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\8695.tmp"C:\Users\Admin\AppData\Local\Temp\8695.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\8741.tmp"C:\Users\Admin\AppData\Local\Temp\8741.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\88B8.tmp"C:\Users\Admin\AppData\Local\Temp\88B8.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\8993.tmp"C:\Users\Admin\AppData\Local\Temp\8993.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"23⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"24⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"25⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\8E26.tmp"C:\Users\Admin\AppData\Local\Temp\8E26.tmp"26⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\8F20.tmp"C:\Users\Admin\AppData\Local\Temp\8F20.tmp"27⤵
- Executes dropped EXE
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"28⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\90B7.tmp"C:\Users\Admin\AppData\Local\Temp\90B7.tmp"29⤵
- Executes dropped EXE
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\91B1.tmp"C:\Users\Admin\AppData\Local\Temp\91B1.tmp"30⤵
- Executes dropped EXE
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\9328.tmp"C:\Users\Admin\AppData\Local\Temp\9328.tmp"31⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"32⤵
- Executes dropped EXE
PID:888 -
C:\Users\Admin\AppData\Local\Temp\94CE.tmp"C:\Users\Admin\AppData\Local\Temp\94CE.tmp"33⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"34⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\95D7.tmp"C:\Users\Admin\AppData\Local\Temp\95D7.tmp"35⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\96B2.tmp"C:\Users\Admin\AppData\Local\Temp\96B2.tmp"36⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"37⤵
- Executes dropped EXE
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\97FA.tmp"C:\Users\Admin\AppData\Local\Temp\97FA.tmp"38⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"39⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\99BF.tmp"C:\Users\Admin\AppData\Local\Temp\99BF.tmp"40⤵
- Executes dropped EXE
PID:568 -
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"41⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"42⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"43⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\9C21.tmp"C:\Users\Admin\AppData\Local\Temp\9C21.tmp"44⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"45⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"46⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"47⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"48⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"49⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\A028.tmp"C:\Users\Admin\AppData\Local\Temp\A028.tmp"50⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"51⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\A18F.tmp"C:\Users\Admin\AppData\Local\Temp\A18F.tmp"52⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"53⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"54⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\A383.tmp"C:\Users\Admin\AppData\Local\Temp\A383.tmp"55⤵
- Executes dropped EXE
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\A41F.tmp"C:\Users\Admin\AppData\Local\Temp\A41F.tmp"56⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"57⤵
- Executes dropped EXE
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\A519.tmp"C:\Users\Admin\AppData\Local\Temp\A519.tmp"58⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"59⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"60⤵
- Executes dropped EXE
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"61⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"62⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"63⤵
- Executes dropped EXE
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\A827.tmp"C:\Users\Admin\AppData\Local\Temp\A827.tmp"64⤵
- Executes dropped EXE
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"65⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"66⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\AB15.tmp"C:\Users\Admin\AppData\Local\Temp\AB15.tmp"67⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\AB92.tmp"C:\Users\Admin\AppData\Local\Temp\AB92.tmp"68⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"69⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"70⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"71⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"72⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\AE41.tmp"C:\Users\Admin\AppData\Local\Temp\AE41.tmp"73⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\AECE.tmp"C:\Users\Admin\AppData\Local\Temp\AECE.tmp"74⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"75⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"76⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"77⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"78⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\B12F.tmp"C:\Users\Admin\AppData\Local\Temp\B12F.tmp"79⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"80⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\B258.tmp"C:\Users\Admin\AppData\Local\Temp\B258.tmp"81⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"82⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\B352.tmp"C:\Users\Admin\AppData\Local\Temp\B352.tmp"83⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"84⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\B45C.tmp"C:\Users\Admin\AppData\Local\Temp\B45C.tmp"85⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"86⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\B575.tmp"C:\Users\Admin\AppData\Local\Temp\B575.tmp"87⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\B611.tmp"C:\Users\Admin\AppData\Local\Temp\B611.tmp"88⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\B69E.tmp"C:\Users\Admin\AppData\Local\Temp\B69E.tmp"89⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\B73A.tmp"C:\Users\Admin\AppData\Local\Temp\B73A.tmp"90⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"91⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\B853.tmp"C:\Users\Admin\AppData\Local\Temp\B853.tmp"92⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"93⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\B93E.tmp"C:\Users\Admin\AppData\Local\Temp\B93E.tmp"94⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"95⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\BA86.tmp"C:\Users\Admin\AppData\Local\Temp\BA86.tmp"96⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\BB22.tmp"C:\Users\Admin\AppData\Local\Temp\BB22.tmp"97⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"98⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"99⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"100⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\BD35.tmp"C:\Users\Admin\AppData\Local\Temp\BD35.tmp"101⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"102⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"103⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"104⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"105⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\C014.tmp"C:\Users\Admin\AppData\Local\Temp\C014.tmp"106⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"107⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"108⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"109⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"110⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"111⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\C35F.tmp"C:\Users\Admin\AppData\Local\Temp\C35F.tmp"112⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"113⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\C488.tmp"C:\Users\Admin\AppData\Local\Temp\C488.tmp"114⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\C525.tmp"C:\Users\Admin\AppData\Local\Temp\C525.tmp"115⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"116⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\C62E.tmp"C:\Users\Admin\AppData\Local\Temp\C62E.tmp"117⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"118⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\C728.tmp"C:\Users\Admin\AppData\Local\Temp\C728.tmp"119⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\C786.tmp"C:\Users\Admin\AppData\Local\Temp\C786.tmp"120⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\C822.tmp"C:\Users\Admin\AppData\Local\Temp\C822.tmp"121⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\C89F.tmp"C:\Users\Admin\AppData\Local\Temp\C89F.tmp"122⤵PID:3492
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-