Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
13/07/2023, 17:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
01895c96b421d0exe_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
01895c96b421d0exe_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
01895c96b421d0exe_JC.exe
-
Size
487KB
-
MD5
01895c96b421d0d7baa7aa47043cefcc
-
SHA1
fdfa2fb88e0bd8b52528bac926392ac77d6b3dc4
-
SHA256
0b9b18ecbca42eacee562a7b5a9c94ae685e97135e6d30bd2ec1924d9441b3a9
-
SHA512
6a34321bd706977b5be35d524685ee332707565dd601cabf1928067c938949e5d95093e5b7d523c3c676a0a6d25eace36025c33f4c82abcca216e97f996d7db6
-
SSDEEP
12288:HU5rCOTeiJfnGYvua0O4K8FzwAaFW18YSuCshIoSvNZ:HUQOJJfG60O4K71DJoSvN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2064 1EF.tmp 1472 BB3.tmp 2088 D49.tmp 2672 E24.tmp 1228 EE0.tmp 1888 F8B.tmp 880 1076.tmp 2208 117F.tmp 5116 124B.tmp 100 1354.tmp 1484 1400.tmp 3036 149C.tmp 712 1539.tmp 228 1681.tmp 116 175B.tmp 4784 1817.tmp 4820 18E2.tmp 1224 19AD.tmp 4704 1A78.tmp 2932 1B53.tmp 4672 1C1E.tmp 3912 1CDA.tmp 1728 1D95.tmp 3648 1E70.tmp 1140 1F5A.tmp 2876 2035.tmp 2524 20D1.tmp 1300 218D.tmp 4252 2248.tmp 3900 2323.tmp 2852 23EE.tmp 1776 247B.tmp 3056 2536.tmp 1700 25E2.tmp 628 269E.tmp 4276 2759.tmp 3768 27E6.tmp 1692 2892.tmp 3888 28FF.tmp 2516 297C.tmp 4060 2A09.tmp 3360 2A76.tmp 4012 2AE3.tmp 2736 2B70.tmp 1060 2BFD.tmp 492 2CA9.tmp 4524 2D16.tmp 864 2DC2.tmp 1200 2E7D.tmp 4868 2F0A.tmp 1076 2FA6.tmp 2960 3023.tmp 3408 30B0.tmp 1104 312D.tmp 4736 31B9.tmp 4980 3236.tmp 3424 32F2.tmp 4224 335F.tmp 2256 33FC.tmp 776 3479.tmp 4404 3505.tmp 1804 35A1.tmp 3220 362E.tmp 1328 36BB.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1464 wrote to memory of 2064 1464 01895c96b421d0exe_JC.exe 86 PID 1464 wrote to memory of 2064 1464 01895c96b421d0exe_JC.exe 86 PID 1464 wrote to memory of 2064 1464 01895c96b421d0exe_JC.exe 86 PID 2064 wrote to memory of 1472 2064 1EF.tmp 87 PID 2064 wrote to memory of 1472 2064 1EF.tmp 87 PID 2064 wrote to memory of 1472 2064 1EF.tmp 87 PID 1472 wrote to memory of 2088 1472 BB3.tmp 88 PID 1472 wrote to memory of 2088 1472 BB3.tmp 88 PID 1472 wrote to memory of 2088 1472 BB3.tmp 88 PID 2088 wrote to memory of 2672 2088 D49.tmp 89 PID 2088 wrote to memory of 2672 2088 D49.tmp 89 PID 2088 wrote to memory of 2672 2088 D49.tmp 89 PID 2672 wrote to memory of 1228 2672 E24.tmp 90 PID 2672 wrote to memory of 1228 2672 E24.tmp 90 PID 2672 wrote to memory of 1228 2672 E24.tmp 90 PID 1228 wrote to memory of 1888 1228 EE0.tmp 91 PID 1228 wrote to memory of 1888 1228 EE0.tmp 91 PID 1228 wrote to memory of 1888 1228 EE0.tmp 91 PID 1888 wrote to memory of 880 1888 F8B.tmp 92 PID 1888 wrote to memory of 880 1888 F8B.tmp 92 PID 1888 wrote to memory of 880 1888 F8B.tmp 92 PID 880 wrote to memory of 2208 880 1076.tmp 93 PID 880 wrote to memory of 2208 880 1076.tmp 93 PID 880 wrote to memory of 2208 880 1076.tmp 93 PID 2208 wrote to memory of 5116 2208 117F.tmp 94 PID 2208 wrote to memory of 5116 2208 117F.tmp 94 PID 2208 wrote to memory of 5116 2208 117F.tmp 94 PID 5116 wrote to memory of 100 5116 124B.tmp 95 PID 5116 wrote to memory of 100 5116 124B.tmp 95 PID 5116 wrote to memory of 100 5116 124B.tmp 95 PID 100 wrote to memory of 1484 100 1354.tmp 96 PID 100 wrote to memory of 1484 100 1354.tmp 96 PID 100 wrote to memory of 1484 100 1354.tmp 96 PID 1484 wrote to memory of 3036 1484 1400.tmp 97 PID 1484 wrote to memory of 3036 1484 1400.tmp 97 PID 1484 wrote to memory of 3036 1484 1400.tmp 97 PID 3036 wrote to memory of 712 3036 149C.tmp 98 PID 3036 wrote to memory of 712 3036 149C.tmp 98 PID 3036 wrote to memory of 712 3036 149C.tmp 98 PID 712 wrote to memory of 228 712 1539.tmp 99 PID 712 wrote to memory of 228 712 1539.tmp 99 PID 712 wrote to memory of 228 712 1539.tmp 99 PID 228 wrote to memory of 116 228 1681.tmp 100 PID 228 wrote to memory of 116 228 1681.tmp 100 PID 228 wrote to memory of 116 228 1681.tmp 100 PID 116 wrote to memory of 4784 116 175B.tmp 101 PID 116 wrote to memory of 4784 116 175B.tmp 101 PID 116 wrote to memory of 4784 116 175B.tmp 101 PID 4784 wrote to memory of 4820 4784 1817.tmp 102 PID 4784 wrote to memory of 4820 4784 1817.tmp 102 PID 4784 wrote to memory of 4820 4784 1817.tmp 102 PID 4820 wrote to memory of 1224 4820 18E2.tmp 103 PID 4820 wrote to memory of 1224 4820 18E2.tmp 103 PID 4820 wrote to memory of 1224 4820 18E2.tmp 103 PID 1224 wrote to memory of 4704 1224 19AD.tmp 104 PID 1224 wrote to memory of 4704 1224 19AD.tmp 104 PID 1224 wrote to memory of 4704 1224 19AD.tmp 104 PID 4704 wrote to memory of 2932 4704 1A78.tmp 105 PID 4704 wrote to memory of 2932 4704 1A78.tmp 105 PID 4704 wrote to memory of 2932 4704 1A78.tmp 105 PID 2932 wrote to memory of 4672 2932 1B53.tmp 106 PID 2932 wrote to memory of 4672 2932 1B53.tmp 106 PID 2932 wrote to memory of 4672 2932 1B53.tmp 106 PID 4672 wrote to memory of 3912 4672 1C1E.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\01895c96b421d0exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\01895c96b421d0exe_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\1EF.tmp"C:\Users\Admin\AppData\Local\Temp\1EF.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\BB3.tmp"C:\Users\Admin\AppData\Local\Temp\BB3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\D49.tmp"C:\Users\Admin\AppData\Local\Temp\D49.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\EE0.tmp"C:\Users\Admin\AppData\Local\Temp\EE0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\1076.tmp"C:\Users\Admin\AppData\Local\Temp\1076.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\117F.tmp"C:\Users\Admin\AppData\Local\Temp\117F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\124B.tmp"C:\Users\Admin\AppData\Local\Temp\124B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\1354.tmp"C:\Users\Admin\AppData\Local\Temp\1354.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100 -
C:\Users\Admin\AppData\Local\Temp\1400.tmp"C:\Users\Admin\AppData\Local\Temp\1400.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\149C.tmp"C:\Users\Admin\AppData\Local\Temp\149C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\1539.tmp"C:\Users\Admin\AppData\Local\Temp\1539.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Users\Admin\AppData\Local\Temp\1681.tmp"C:\Users\Admin\AppData\Local\Temp\1681.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\175B.tmp"C:\Users\Admin\AppData\Local\Temp\175B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\1817.tmp"C:\Users\Admin\AppData\Local\Temp\1817.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\18E2.tmp"C:\Users\Admin\AppData\Local\Temp\18E2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\19AD.tmp"C:\Users\Admin\AppData\Local\Temp\19AD.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\1A78.tmp"C:\Users\Admin\AppData\Local\Temp\1A78.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\1B53.tmp"C:\Users\Admin\AppData\Local\Temp\1B53.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"23⤵
- Executes dropped EXE
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\1D95.tmp"C:\Users\Admin\AppData\Local\Temp\1D95.tmp"24⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\1E70.tmp"C:\Users\Admin\AppData\Local\Temp\1E70.tmp"25⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\1F5A.tmp"C:\Users\Admin\AppData\Local\Temp\1F5A.tmp"26⤵
- Executes dropped EXE
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\2035.tmp"C:\Users\Admin\AppData\Local\Temp\2035.tmp"27⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\20D1.tmp"C:\Users\Admin\AppData\Local\Temp\20D1.tmp"28⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\218D.tmp"C:\Users\Admin\AppData\Local\Temp\218D.tmp"29⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\2248.tmp"C:\Users\Admin\AppData\Local\Temp\2248.tmp"30⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\2323.tmp"C:\Users\Admin\AppData\Local\Temp\2323.tmp"31⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\23EE.tmp"C:\Users\Admin\AppData\Local\Temp\23EE.tmp"32⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\247B.tmp"C:\Users\Admin\AppData\Local\Temp\247B.tmp"33⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\2536.tmp"C:\Users\Admin\AppData\Local\Temp\2536.tmp"34⤵
- Executes dropped EXE
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\25E2.tmp"C:\Users\Admin\AppData\Local\Temp\25E2.tmp"35⤵
- Executes dropped EXE
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\269E.tmp"C:\Users\Admin\AppData\Local\Temp\269E.tmp"36⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\2759.tmp"C:\Users\Admin\AppData\Local\Temp\2759.tmp"37⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\27E6.tmp"C:\Users\Admin\AppData\Local\Temp\27E6.tmp"38⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\2892.tmp"C:\Users\Admin\AppData\Local\Temp\2892.tmp"39⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\28FF.tmp"C:\Users\Admin\AppData\Local\Temp\28FF.tmp"40⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\297C.tmp"C:\Users\Admin\AppData\Local\Temp\297C.tmp"41⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\2A09.tmp"C:\Users\Admin\AppData\Local\Temp\2A09.tmp"42⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\2A76.tmp"C:\Users\Admin\AppData\Local\Temp\2A76.tmp"43⤵
- Executes dropped EXE
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\2AE3.tmp"C:\Users\Admin\AppData\Local\Temp\2AE3.tmp"44⤵
- Executes dropped EXE
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\2B70.tmp"C:\Users\Admin\AppData\Local\Temp\2B70.tmp"45⤵
- Executes dropped EXE
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\2BFD.tmp"C:\Users\Admin\AppData\Local\Temp\2BFD.tmp"46⤵
- Executes dropped EXE
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\2CA9.tmp"C:\Users\Admin\AppData\Local\Temp\2CA9.tmp"47⤵
- Executes dropped EXE
PID:492 -
C:\Users\Admin\AppData\Local\Temp\2D16.tmp"C:\Users\Admin\AppData\Local\Temp\2D16.tmp"48⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"49⤵
- Executes dropped EXE
PID:864 -
C:\Users\Admin\AppData\Local\Temp\2E7D.tmp"C:\Users\Admin\AppData\Local\Temp\2E7D.tmp"50⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\2F0A.tmp"C:\Users\Admin\AppData\Local\Temp\2F0A.tmp"51⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"52⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\3023.tmp"C:\Users\Admin\AppData\Local\Temp\3023.tmp"53⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\30B0.tmp"C:\Users\Admin\AppData\Local\Temp\30B0.tmp"54⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\312D.tmp"C:\Users\Admin\AppData\Local\Temp\312D.tmp"55⤵
- Executes dropped EXE
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\31B9.tmp"C:\Users\Admin\AppData\Local\Temp\31B9.tmp"56⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\3236.tmp"C:\Users\Admin\AppData\Local\Temp\3236.tmp"57⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\32F2.tmp"C:\Users\Admin\AppData\Local\Temp\32F2.tmp"58⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\335F.tmp"C:\Users\Admin\AppData\Local\Temp\335F.tmp"59⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"60⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\3479.tmp"C:\Users\Admin\AppData\Local\Temp\3479.tmp"61⤵
- Executes dropped EXE
PID:776 -
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"62⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\35A1.tmp"C:\Users\Admin\AppData\Local\Temp\35A1.tmp"63⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\362E.tmp"C:\Users\Admin\AppData\Local\Temp\362E.tmp"64⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\36BB.tmp"C:\Users\Admin\AppData\Local\Temp\36BB.tmp"65⤵
- Executes dropped EXE
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\3747.tmp"C:\Users\Admin\AppData\Local\Temp\3747.tmp"66⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\37C4.tmp"C:\Users\Admin\AppData\Local\Temp\37C4.tmp"67⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\3870.tmp"C:\Users\Admin\AppData\Local\Temp\3870.tmp"68⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\38DE.tmp"C:\Users\Admin\AppData\Local\Temp\38DE.tmp"69⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\396A.tmp"C:\Users\Admin\AppData\Local\Temp\396A.tmp"70⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\39E7.tmp"C:\Users\Admin\AppData\Local\Temp\39E7.tmp"71⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\3A74.tmp"C:\Users\Admin\AppData\Local\Temp\3A74.tmp"72⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\3B10.tmp"C:\Users\Admin\AppData\Local\Temp\3B10.tmp"73⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\3BAC.tmp"C:\Users\Admin\AppData\Local\Temp\3BAC.tmp"74⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\3C77.tmp"C:\Users\Admin\AppData\Local\Temp\3C77.tmp"75⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\3D33.tmp"C:\Users\Admin\AppData\Local\Temp\3D33.tmp"76⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\3DA0.tmp"C:\Users\Admin\AppData\Local\Temp\3DA0.tmp"77⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\3E3D.tmp"C:\Users\Admin\AppData\Local\Temp\3E3D.tmp"78⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\3ED9.tmp"C:\Users\Admin\AppData\Local\Temp\3ED9.tmp"79⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\3FA4.tmp"C:\Users\Admin\AppData\Local\Temp\3FA4.tmp"80⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\4050.tmp"C:\Users\Admin\AppData\Local\Temp\4050.tmp"81⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\40FC.tmp"C:\Users\Admin\AppData\Local\Temp\40FC.tmp"82⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\4188.tmp"C:\Users\Admin\AppData\Local\Temp\4188.tmp"83⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\4215.tmp"C:\Users\Admin\AppData\Local\Temp\4215.tmp"84⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\4292.tmp"C:\Users\Admin\AppData\Local\Temp\4292.tmp"85⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\432E.tmp"C:\Users\Admin\AppData\Local\Temp\432E.tmp"86⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\4428.tmp"C:\Users\Admin\AppData\Local\Temp\4428.tmp"87⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\44B5.tmp"C:\Users\Admin\AppData\Local\Temp\44B5.tmp"88⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\4532.tmp"C:\Users\Admin\AppData\Local\Temp\4532.tmp"89⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\45AF.tmp"C:\Users\Admin\AppData\Local\Temp\45AF.tmp"90⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\461C.tmp"C:\Users\Admin\AppData\Local\Temp\461C.tmp"91⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\4699.tmp"C:\Users\Admin\AppData\Local\Temp\4699.tmp"92⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\4735.tmp"C:\Users\Admin\AppData\Local\Temp\4735.tmp"93⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\47A3.tmp"C:\Users\Admin\AppData\Local\Temp\47A3.tmp"94⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\482F.tmp"C:\Users\Admin\AppData\Local\Temp\482F.tmp"95⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\489D.tmp"C:\Users\Admin\AppData\Local\Temp\489D.tmp"96⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\491A.tmp"C:\Users\Admin\AppData\Local\Temp\491A.tmp"97⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\4997.tmp"C:\Users\Admin\AppData\Local\Temp\4997.tmp"98⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\4A23.tmp"C:\Users\Admin\AppData\Local\Temp\4A23.tmp"99⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\4AC0.tmp"C:\Users\Admin\AppData\Local\Temp\4AC0.tmp"100⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\4B5C.tmp"C:\Users\Admin\AppData\Local\Temp\4B5C.tmp"101⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\4BF8.tmp"C:\Users\Admin\AppData\Local\Temp\4BF8.tmp"102⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\4C75.tmp"C:\Users\Admin\AppData\Local\Temp\4C75.tmp"103⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\4D02.tmp"C:\Users\Admin\AppData\Local\Temp\4D02.tmp"104⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\4D7F.tmp"C:\Users\Admin\AppData\Local\Temp\4D7F.tmp"105⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\4E0B.tmp"C:\Users\Admin\AppData\Local\Temp\4E0B.tmp"106⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\4EF6.tmp"C:\Users\Admin\AppData\Local\Temp\4EF6.tmp"107⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\4F82.tmp"C:\Users\Admin\AppData\Local\Temp\4F82.tmp"108⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\500F.tmp"C:\Users\Admin\AppData\Local\Temp\500F.tmp"109⤵PID:492
-
C:\Users\Admin\AppData\Local\Temp\508C.tmp"C:\Users\Admin\AppData\Local\Temp\508C.tmp"110⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\5138.tmp"C:\Users\Admin\AppData\Local\Temp\5138.tmp"111⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\51B5.tmp"C:\Users\Admin\AppData\Local\Temp\51B5.tmp"112⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\5242.tmp"C:\Users\Admin\AppData\Local\Temp\5242.tmp"113⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\531C.tmp"C:\Users\Admin\AppData\Local\Temp\531C.tmp"114⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\5399.tmp"C:\Users\Admin\AppData\Local\Temp\5399.tmp"115⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\5464.tmp"C:\Users\Admin\AppData\Local\Temp\5464.tmp"116⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\5501.tmp"C:\Users\Admin\AppData\Local\Temp\5501.tmp"117⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\559D.tmp"C:\Users\Admin\AppData\Local\Temp\559D.tmp"118⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\5658.tmp"C:\Users\Admin\AppData\Local\Temp\5658.tmp"119⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\5714.tmp"C:\Users\Admin\AppData\Local\Temp\5714.tmp"120⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\57C0.tmp"C:\Users\Admin\AppData\Local\Temp\57C0.tmp"121⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\582D.tmp"C:\Users\Admin\AppData\Local\Temp\582D.tmp"122⤵PID:3984
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-