Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231025-en -
resource tags
arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system -
submitted
02/11/2023, 01:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
530e82208f740b304841144c2513463b.exe
Resource
win7-20231020-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
530e82208f740b304841144c2513463b.exe
Resource
win10v2004-20231025-en
2 signatures
150 seconds
General
-
Target
530e82208f740b304841144c2513463b.exe
-
Size
488KB
-
MD5
530e82208f740b304841144c2513463b
-
SHA1
270568d458dce053743106ce7d3a9c7078f1ff7c
-
SHA256
5ec1c9bd82291f1fc64242b89c9bcb3c52c4e17fce2d9cadc7b6b34d5d091936
-
SHA512
1c3e8ca00cae2f5f81912e638a2bdcd0ccd98e025c20be5f32163eb5c32f408afc0fe7fc806c27cfce22f4786f5df86e2130d8245740e605757d4736b573be6d
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7M1D3psSSrtC5qbtXvL6SCHlvhGn6WmlRcFhH:/U5rCOTeiDsDMoqbhD6zHlsnFhV1NZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1888 6968.tmp 4540 6A14.tmp 1996 6AA1.tmp 1408 6B4D.tmp 848 6C08.tmp 2656 6CB4.tmp 2720 6D8F.tmp 4636 7280.tmp 3812 732C.tmp 4532 75AD.tmp 2552 7743.tmp 4832 77C0.tmp 2008 82AD.tmp 4044 831A.tmp 388 83A7.tmp 3056 8405.tmp 2304 8482.tmp 4236 853D.tmp 2752 85AB.tmp 4404 8666.tmp 2220 8722.tmp 1400 8A9C.tmp 3856 8C90.tmp 4820 8D3C.tmp 4584 8DD8.tmp 4284 8E65.tmp 5104 8F01.tmp 528 8F8E.tmp 4560 902A.tmp 3224 9357.tmp 4252 93D4.tmp 1408 947F.tmp 3232 951C.tmp 4040 9599.tmp 4596 97BC.tmp 1284 9839.tmp 1572 98A6.tmp 3760 9904.tmp 4552 99A0.tmp 3188 9A1D.tmp 1328 9E43.tmp 2552 A028.tmp 3096 A103.tmp 4120 A18F.tmp 1104 A20C.tmp 2424 A2A8.tmp 4328 A316.tmp 3268 A393.tmp 3056 A400.tmp 3684 A46E.tmp 1828 A4EB.tmp 4692 A568.tmp 1180 A604.tmp 1388 A76B.tmp 944 A7F8.tmp 1028 A875.tmp 3656 A901.tmp 4776 A97E.tmp 844 AA0B.tmp 3836 AAA7.tmp 4768 AB24.tmp 3212 AB82.tmp 5104 ACDA.tmp 2204 AD57.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1232 wrote to memory of 1888 1232 530e82208f740b304841144c2513463b.exe 86 PID 1232 wrote to memory of 1888 1232 530e82208f740b304841144c2513463b.exe 86 PID 1232 wrote to memory of 1888 1232 530e82208f740b304841144c2513463b.exe 86 PID 1888 wrote to memory of 4540 1888 6968.tmp 87 PID 1888 wrote to memory of 4540 1888 6968.tmp 87 PID 1888 wrote to memory of 4540 1888 6968.tmp 87 PID 4540 wrote to memory of 1996 4540 6A14.tmp 88 PID 4540 wrote to memory of 1996 4540 6A14.tmp 88 PID 4540 wrote to memory of 1996 4540 6A14.tmp 88 PID 1996 wrote to memory of 1408 1996 6AA1.tmp 90 PID 1996 wrote to memory of 1408 1996 6AA1.tmp 90 PID 1996 wrote to memory of 1408 1996 6AA1.tmp 90 PID 1408 wrote to memory of 848 1408 6B4D.tmp 91 PID 1408 wrote to memory of 848 1408 6B4D.tmp 91 PID 1408 wrote to memory of 848 1408 6B4D.tmp 91 PID 848 wrote to memory of 2656 848 6C08.tmp 92 PID 848 wrote to memory of 2656 848 6C08.tmp 92 PID 848 wrote to memory of 2656 848 6C08.tmp 92 PID 2656 wrote to memory of 2720 2656 6CB4.tmp 93 PID 2656 wrote to memory of 2720 2656 6CB4.tmp 93 PID 2656 wrote to memory of 2720 2656 6CB4.tmp 93 PID 2720 wrote to memory of 4636 2720 6D8F.tmp 95 PID 2720 wrote to memory of 4636 2720 6D8F.tmp 95 PID 2720 wrote to memory of 4636 2720 6D8F.tmp 95 PID 4636 wrote to memory of 3812 4636 7280.tmp 96 PID 4636 wrote to memory of 3812 4636 7280.tmp 96 PID 4636 wrote to memory of 3812 4636 7280.tmp 96 PID 3812 wrote to memory of 4532 3812 732C.tmp 97 PID 3812 wrote to memory of 4532 3812 732C.tmp 97 PID 3812 wrote to memory of 4532 3812 732C.tmp 97 PID 4532 wrote to memory of 2552 4532 75AD.tmp 99 PID 4532 wrote to memory of 2552 4532 75AD.tmp 99 PID 4532 wrote to memory of 2552 4532 75AD.tmp 99 PID 2552 wrote to memory of 4832 2552 7743.tmp 100 PID 2552 wrote to memory of 4832 2552 7743.tmp 100 PID 2552 wrote to memory of 4832 2552 7743.tmp 100 PID 4832 wrote to memory of 2008 4832 77C0.tmp 101 PID 4832 wrote to memory of 2008 4832 77C0.tmp 101 PID 4832 wrote to memory of 2008 4832 77C0.tmp 101 PID 2008 wrote to memory of 4044 2008 82AD.tmp 102 PID 2008 wrote to memory of 4044 2008 82AD.tmp 102 PID 2008 wrote to memory of 4044 2008 82AD.tmp 102 PID 4044 wrote to memory of 388 4044 831A.tmp 103 PID 4044 wrote to memory of 388 4044 831A.tmp 103 PID 4044 wrote to memory of 388 4044 831A.tmp 103 PID 388 wrote to memory of 3056 388 83A7.tmp 104 PID 388 wrote to memory of 3056 388 83A7.tmp 104 PID 388 wrote to memory of 3056 388 83A7.tmp 104 PID 3056 wrote to memory of 2304 3056 8405.tmp 106 PID 3056 wrote to memory of 2304 3056 8405.tmp 106 PID 3056 wrote to memory of 2304 3056 8405.tmp 106 PID 2304 wrote to memory of 4236 2304 8482.tmp 107 PID 2304 wrote to memory of 4236 2304 8482.tmp 107 PID 2304 wrote to memory of 4236 2304 8482.tmp 107 PID 4236 wrote to memory of 2752 4236 853D.tmp 108 PID 4236 wrote to memory of 2752 4236 853D.tmp 108 PID 4236 wrote to memory of 2752 4236 853D.tmp 108 PID 2752 wrote to memory of 4404 2752 85AB.tmp 111 PID 2752 wrote to memory of 4404 2752 85AB.tmp 111 PID 2752 wrote to memory of 4404 2752 85AB.tmp 111 PID 4404 wrote to memory of 2220 4404 8666.tmp 112 PID 4404 wrote to memory of 2220 4404 8666.tmp 112 PID 4404 wrote to memory of 2220 4404 8666.tmp 112 PID 2220 wrote to memory of 1400 2220 8722.tmp 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\530e82208f740b304841144c2513463b.exe"C:\Users\Admin\AppData\Local\Temp\530e82208f740b304841144c2513463b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\7743.tmp"C:\Users\Admin\AppData\Local\Temp\7743.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\82AD.tmp"C:\Users\Admin\AppData\Local\Temp\82AD.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\83A7.tmp"C:\Users\Admin\AppData\Local\Temp\83A7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Users\Admin\AppData\Local\Temp\8405.tmp"C:\Users\Admin\AppData\Local\Temp\8405.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\8482.tmp"C:\Users\Admin\AppData\Local\Temp\8482.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\853D.tmp"C:\Users\Admin\AppData\Local\Temp\853D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\85AB.tmp"C:\Users\Admin\AppData\Local\Temp\85AB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\8666.tmp"C:\Users\Admin\AppData\Local\Temp\8666.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\8722.tmp"C:\Users\Admin\AppData\Local\Temp\8722.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"23⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"24⤵
- Executes dropped EXE
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"25⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"26⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"27⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\8F01.tmp"C:\Users\Admin\AppData\Local\Temp\8F01.tmp"28⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"29⤵
- Executes dropped EXE
PID:528 -
C:\Users\Admin\AppData\Local\Temp\902A.tmp"C:\Users\Admin\AppData\Local\Temp\902A.tmp"30⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"31⤵
- Executes dropped EXE
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"32⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\947F.tmp"C:\Users\Admin\AppData\Local\Temp\947F.tmp"33⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\951C.tmp"C:\Users\Admin\AppData\Local\Temp\951C.tmp"34⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\9599.tmp"C:\Users\Admin\AppData\Local\Temp\9599.tmp"35⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\97BC.tmp"C:\Users\Admin\AppData\Local\Temp\97BC.tmp"36⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\9839.tmp"C:\Users\Admin\AppData\Local\Temp\9839.tmp"37⤵
- Executes dropped EXE
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\98A6.tmp"C:\Users\Admin\AppData\Local\Temp\98A6.tmp"38⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\9904.tmp"C:\Users\Admin\AppData\Local\Temp\9904.tmp"39⤵
- Executes dropped EXE
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\99A0.tmp"C:\Users\Admin\AppData\Local\Temp\99A0.tmp"40⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"41⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"42⤵
- Executes dropped EXE
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\A028.tmp"C:\Users\Admin\AppData\Local\Temp\A028.tmp"43⤵
- Executes dropped EXE
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\A103.tmp"C:\Users\Admin\AppData\Local\Temp\A103.tmp"44⤵
- Executes dropped EXE
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\A18F.tmp"C:\Users\Admin\AppData\Local\Temp\A18F.tmp"45⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\A20C.tmp"C:\Users\Admin\AppData\Local\Temp\A20C.tmp"46⤵
- Executes dropped EXE
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"47⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"48⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"49⤵
- Executes dropped EXE
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"50⤵
- Executes dropped EXE
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\A46E.tmp"C:\Users\Admin\AppData\Local\Temp\A46E.tmp"51⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"52⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"53⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"54⤵
- Executes dropped EXE
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\A76B.tmp"C:\Users\Admin\AppData\Local\Temp\A76B.tmp"55⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"56⤵
- Executes dropped EXE
PID:944 -
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"57⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"58⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"59⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"60⤵
- Executes dropped EXE
PID:844 -
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"61⤵
- Executes dropped EXE
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"62⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\AB82.tmp"C:\Users\Admin\AppData\Local\Temp\AB82.tmp"63⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"64⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\AD57.tmp"C:\Users\Admin\AppData\Local\Temp\AD57.tmp"65⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"66⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"67⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\B006.tmp"C:\Users\Admin\AppData\Local\Temp\B006.tmp"68⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\B074.tmp"C:\Users\Admin\AppData\Local\Temp\B074.tmp"69⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"70⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\B287.tmp"C:\Users\Admin\AppData\Local\Temp\B287.tmp"71⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"72⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\B352.tmp"C:\Users\Admin\AppData\Local\Temp\B352.tmp"73⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"74⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"75⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"76⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"77⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"78⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"79⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"80⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\B769.tmp"C:\Users\Admin\AppData\Local\Temp\B769.tmp"81⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"82⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\B844.tmp"C:\Users\Admin\AppData\Local\Temp\B844.tmp"83⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"84⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\BBED.tmp"C:\Users\Admin\AppData\Local\Temp\BBED.tmp"85⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\BD74.tmp"C:\Users\Admin\AppData\Local\Temp\BD74.tmp"86⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"87⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"88⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"89⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"90⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\C505.tmp"C:\Users\Admin\AppData\Local\Temp\C505.tmp"91⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\C95B.tmp"C:\Users\Admin\AppData\Local\Temp\C95B.tmp"92⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\CA16.tmp"C:\Users\Admin\AppData\Local\Temp\CA16.tmp"93⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\CB10.tmp"C:\Users\Admin\AppData\Local\Temp\CB10.tmp"94⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\CD23.tmp"C:\Users\Admin\AppData\Local\Temp\CD23.tmp"95⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"96⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"97⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\D031.tmp"C:\Users\Admin\AppData\Local\Temp\D031.tmp"98⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\D1F6.tmp"C:\Users\Admin\AppData\Local\Temp\D1F6.tmp"99⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\D438.tmp"C:\Users\Admin\AppData\Local\Temp\D438.tmp"100⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\D522.tmp"C:\Users\Admin\AppData\Local\Temp\D522.tmp"101⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\D65B.tmp"C:\Users\Admin\AppData\Local\Temp\D65B.tmp"102⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\D89D.tmp"C:\Users\Admin\AppData\Local\Temp\D89D.tmp"103⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\D9F5.tmp"C:\Users\Admin\AppData\Local\Temp\D9F5.tmp"104⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"105⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"106⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\DF44.tmp"C:\Users\Admin\AppData\Local\Temp\DF44.tmp"107⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\E00F.tmp"C:\Users\Admin\AppData\Local\Temp\E00F.tmp"108⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\E0BB.tmp"C:\Users\Admin\AppData\Local\Temp\E0BB.tmp"109⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"110⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\E261.tmp"C:\Users\Admin\AppData\Local\Temp\E261.tmp"111⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\E34B.tmp"C:\Users\Admin\AppData\Local\Temp\E34B.tmp"112⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\E455.tmp"C:\Users\Admin\AppData\Local\Temp\E455.tmp"113⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\E5CC.tmp"C:\Users\Admin\AppData\Local\Temp\E5CC.tmp"114⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\E649.tmp"C:\Users\Admin\AppData\Local\Temp\E649.tmp"115⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"116⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\E87B.tmp"C:\Users\Admin\AppData\Local\Temp\E87B.tmp"117⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\E956.tmp"C:\Users\Admin\AppData\Local\Temp\E956.tmp"118⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\EA50.tmp"C:\Users\Admin\AppData\Local\Temp\EA50.tmp"119⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\EABE.tmp"C:\Users\Admin\AppData\Local\Temp\EABE.tmp"120⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\EB69.tmp"C:\Users\Admin\AppData\Local\Temp\EB69.tmp"121⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\EBE6.tmp"C:\Users\Admin\AppData\Local\Temp\EBE6.tmp"122⤵PID:1556
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-