Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17/07/2023, 17:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9cf27bc8a60e0c_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
9cf27bc8a60e0c_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
9cf27bc8a60e0c_JC.exe
-
Size
486KB
-
MD5
9cf27bc8a60e0caf1fe1768d61700e6d
-
SHA1
6ad73b7533896baf4fb80700b682a802ce0d62b3
-
SHA256
83772e68e5a262af1316f13102a99f7c77b810d43f503839b1dd0c1efa3cacd5
-
SHA512
c789428bb9d8f4201ea725e2be24cc9f01c7ab0aa49cdafd9b3930d24f8e8434fe1b656b28538e867f97fb700a028687772e9a701eae35c9fa5bf89fe25bee49
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7fmylcpIv31SCE+kBIk9VldVjRCXneR80cA+3:/U5rCOTeiDSIvlVE+u59rdVNgin4NZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2060 F08A.tmp 3408 F1B3.tmp 1408 F24F.tmp 3068 F339.tmp 2704 F414.tmp 440 F4D0.tmp 3940 F59B.tmp 2268 F647.tmp 3608 F712.tmp 2396 F7AE.tmp 4520 F8C7.tmp 1864 F9B2.tmp 3452 FA8C.tmp 1812 FB19.tmp 4028 FBC5.tmp 368 FC80.tmp 2008 FD6B.tmp 4212 FE17.tmp 1184 FEC3.tmp 1528 FF6E.tmp 3000 1A.tmp 776 182.tmp 552 23D.tmp 1116 2E9.tmp 3196 3B4.tmp 1240 47F.tmp 1284 54A.tmp 4820 5F6.tmp 4144 710.tmp 1876 7EA.tmp 3612 8C5.tmp 4632 981.tmp 4224 A5B.tmp 4956 AF8.tmp 4992 B94.tmp 2536 C20.tmp 2164 CAD.tmp 4016 D2A.tmp 752 E53.tmp 404 ED0.tmp 452 F6C.tmp 2060 FF9.tmp 1148 1066.tmp 4804 10E3.tmp 2908 11CE.tmp 3168 124B.tmp 3368 12C8.tmp 4816 1335.tmp 4508 13C2.tmp 4780 147D.tmp 3576 1519.tmp 4852 15A6.tmp 3212 1613.tmp 4952 16BF.tmp 4884 174C.tmp 3836 17D8.tmp 4028 1846.tmp 448 1901.tmp 4812 198E.tmp 5072 1A1B.tmp 4588 1A98.tmp 1628 1B34.tmp 1744 1BD0.tmp 1824 1C5D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1952 wrote to memory of 2060 1952 9cf27bc8a60e0c_JC.exe 87 PID 1952 wrote to memory of 2060 1952 9cf27bc8a60e0c_JC.exe 87 PID 1952 wrote to memory of 2060 1952 9cf27bc8a60e0c_JC.exe 87 PID 2060 wrote to memory of 3408 2060 F08A.tmp 88 PID 2060 wrote to memory of 3408 2060 F08A.tmp 88 PID 2060 wrote to memory of 3408 2060 F08A.tmp 88 PID 3408 wrote to memory of 1408 3408 F1B3.tmp 89 PID 3408 wrote to memory of 1408 3408 F1B3.tmp 89 PID 3408 wrote to memory of 1408 3408 F1B3.tmp 89 PID 1408 wrote to memory of 3068 1408 F24F.tmp 90 PID 1408 wrote to memory of 3068 1408 F24F.tmp 90 PID 1408 wrote to memory of 3068 1408 F24F.tmp 90 PID 3068 wrote to memory of 2704 3068 F339.tmp 91 PID 3068 wrote to memory of 2704 3068 F339.tmp 91 PID 3068 wrote to memory of 2704 3068 F339.tmp 91 PID 2704 wrote to memory of 440 2704 F414.tmp 93 PID 2704 wrote to memory of 440 2704 F414.tmp 93 PID 2704 wrote to memory of 440 2704 F414.tmp 93 PID 440 wrote to memory of 3940 440 F4D0.tmp 94 PID 440 wrote to memory of 3940 440 F4D0.tmp 94 PID 440 wrote to memory of 3940 440 F4D0.tmp 94 PID 3940 wrote to memory of 2268 3940 F59B.tmp 95 PID 3940 wrote to memory of 2268 3940 F59B.tmp 95 PID 3940 wrote to memory of 2268 3940 F59B.tmp 95 PID 2268 wrote to memory of 3608 2268 F647.tmp 96 PID 2268 wrote to memory of 3608 2268 F647.tmp 96 PID 2268 wrote to memory of 3608 2268 F647.tmp 96 PID 3608 wrote to memory of 2396 3608 F712.tmp 97 PID 3608 wrote to memory of 2396 3608 F712.tmp 97 PID 3608 wrote to memory of 2396 3608 F712.tmp 97 PID 2396 wrote to memory of 4520 2396 F7AE.tmp 98 PID 2396 wrote to memory of 4520 2396 F7AE.tmp 98 PID 2396 wrote to memory of 4520 2396 F7AE.tmp 98 PID 4520 wrote to memory of 1864 4520 F8C7.tmp 99 PID 4520 wrote to memory of 1864 4520 F8C7.tmp 99 PID 4520 wrote to memory of 1864 4520 F8C7.tmp 99 PID 1864 wrote to memory of 3452 1864 F9B2.tmp 100 PID 1864 wrote to memory of 3452 1864 F9B2.tmp 100 PID 1864 wrote to memory of 3452 1864 F9B2.tmp 100 PID 3452 wrote to memory of 1812 3452 FA8C.tmp 101 PID 3452 wrote to memory of 1812 3452 FA8C.tmp 101 PID 3452 wrote to memory of 1812 3452 FA8C.tmp 101 PID 1812 wrote to memory of 4028 1812 FB19.tmp 102 PID 1812 wrote to memory of 4028 1812 FB19.tmp 102 PID 1812 wrote to memory of 4028 1812 FB19.tmp 102 PID 4028 wrote to memory of 368 4028 FBC5.tmp 103 PID 4028 wrote to memory of 368 4028 FBC5.tmp 103 PID 4028 wrote to memory of 368 4028 FBC5.tmp 103 PID 368 wrote to memory of 2008 368 FC80.tmp 104 PID 368 wrote to memory of 2008 368 FC80.tmp 104 PID 368 wrote to memory of 2008 368 FC80.tmp 104 PID 2008 wrote to memory of 4212 2008 FD6B.tmp 105 PID 2008 wrote to memory of 4212 2008 FD6B.tmp 105 PID 2008 wrote to memory of 4212 2008 FD6B.tmp 105 PID 4212 wrote to memory of 1184 4212 FE17.tmp 106 PID 4212 wrote to memory of 1184 4212 FE17.tmp 106 PID 4212 wrote to memory of 1184 4212 FE17.tmp 106 PID 1184 wrote to memory of 1528 1184 FEC3.tmp 107 PID 1184 wrote to memory of 1528 1184 FEC3.tmp 107 PID 1184 wrote to memory of 1528 1184 FEC3.tmp 107 PID 1528 wrote to memory of 3000 1528 FF6E.tmp 108 PID 1528 wrote to memory of 3000 1528 FF6E.tmp 108 PID 1528 wrote to memory of 3000 1528 FF6E.tmp 108 PID 3000 wrote to memory of 776 3000 1A.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\9cf27bc8a60e0c_JC.exe"C:\Users\Admin\AppData\Local\Temp\9cf27bc8a60e0c_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\F08A.tmp"C:\Users\Admin\AppData\Local\Temp\F08A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\F1B3.tmp"C:\Users\Admin\AppData\Local\Temp\F1B3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\F24F.tmp"C:\Users\Admin\AppData\Local\Temp\F24F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\F339.tmp"C:\Users\Admin\AppData\Local\Temp\F339.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\F414.tmp"C:\Users\Admin\AppData\Local\Temp\F414.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\F59B.tmp"C:\Users\Admin\AppData\Local\Temp\F59B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\F647.tmp"C:\Users\Admin\AppData\Local\Temp\F647.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\F712.tmp"C:\Users\Admin\AppData\Local\Temp\F712.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\F7AE.tmp"C:\Users\Admin\AppData\Local\Temp\F7AE.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\F8C7.tmp"C:\Users\Admin\AppData\Local\Temp\F8C7.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\FB19.tmp"C:\Users\Admin\AppData\Local\Temp\FB19.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\FC80.tmp"C:\Users\Admin\AppData\Local\Temp\FC80.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\FD6B.tmp"C:\Users\Admin\AppData\Local\Temp\FD6B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\FE17.tmp"C:\Users\Admin\AppData\Local\Temp\FE17.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\FEC3.tmp"C:\Users\Admin\AppData\Local\Temp\FEC3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\1A.tmp"C:\Users\Admin\AppData\Local\Temp\1A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\182.tmp"C:\Users\Admin\AppData\Local\Temp\182.tmp"23⤵
- Executes dropped EXE
PID:776 -
C:\Users\Admin\AppData\Local\Temp\23D.tmp"C:\Users\Admin\AppData\Local\Temp\23D.tmp"24⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\2E9.tmp"C:\Users\Admin\AppData\Local\Temp\2E9.tmp"25⤵
- Executes dropped EXE
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\3B4.tmp"C:\Users\Admin\AppData\Local\Temp\3B4.tmp"26⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\47F.tmp"C:\Users\Admin\AppData\Local\Temp\47F.tmp"27⤵
- Executes dropped EXE
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\54A.tmp"C:\Users\Admin\AppData\Local\Temp\54A.tmp"28⤵
- Executes dropped EXE
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\5F6.tmp"C:\Users\Admin\AppData\Local\Temp\5F6.tmp"29⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\710.tmp"C:\Users\Admin\AppData\Local\Temp\710.tmp"30⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\7EA.tmp"C:\Users\Admin\AppData\Local\Temp\7EA.tmp"31⤵
- Executes dropped EXE
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\8C5.tmp"C:\Users\Admin\AppData\Local\Temp\8C5.tmp"32⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\981.tmp"C:\Users\Admin\AppData\Local\Temp\981.tmp"33⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\A5B.tmp"C:\Users\Admin\AppData\Local\Temp\A5B.tmp"34⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\AF8.tmp"C:\Users\Admin\AppData\Local\Temp\AF8.tmp"35⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\B94.tmp"C:\Users\Admin\AppData\Local\Temp\B94.tmp"36⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\C20.tmp"C:\Users\Admin\AppData\Local\Temp\C20.tmp"37⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\CAD.tmp"C:\Users\Admin\AppData\Local\Temp\CAD.tmp"38⤵
- Executes dropped EXE
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\D2A.tmp"C:\Users\Admin\AppData\Local\Temp\D2A.tmp"39⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\E53.tmp"C:\Users\Admin\AppData\Local\Temp\E53.tmp"40⤵
- Executes dropped EXE
PID:752 -
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"41⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"42⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\FF9.tmp"C:\Users\Admin\AppData\Local\Temp\FF9.tmp"43⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\1066.tmp"C:\Users\Admin\AppData\Local\Temp\1066.tmp"44⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\10E3.tmp"C:\Users\Admin\AppData\Local\Temp\10E3.tmp"45⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\11CE.tmp"C:\Users\Admin\AppData\Local\Temp\11CE.tmp"46⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\124B.tmp"C:\Users\Admin\AppData\Local\Temp\124B.tmp"47⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\12C8.tmp"C:\Users\Admin\AppData\Local\Temp\12C8.tmp"48⤵
- Executes dropped EXE
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\1335.tmp"C:\Users\Admin\AppData\Local\Temp\1335.tmp"49⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\13C2.tmp"C:\Users\Admin\AppData\Local\Temp\13C2.tmp"50⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\147D.tmp"C:\Users\Admin\AppData\Local\Temp\147D.tmp"51⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\1519.tmp"C:\Users\Admin\AppData\Local\Temp\1519.tmp"52⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\15A6.tmp"C:\Users\Admin\AppData\Local\Temp\15A6.tmp"53⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\1613.tmp"C:\Users\Admin\AppData\Local\Temp\1613.tmp"54⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\16BF.tmp"C:\Users\Admin\AppData\Local\Temp\16BF.tmp"55⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\174C.tmp"C:\Users\Admin\AppData\Local\Temp\174C.tmp"56⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\17D8.tmp"C:\Users\Admin\AppData\Local\Temp\17D8.tmp"57⤵
- Executes dropped EXE
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\1846.tmp"C:\Users\Admin\AppData\Local\Temp\1846.tmp"58⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\1901.tmp"C:\Users\Admin\AppData\Local\Temp\1901.tmp"59⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\198E.tmp"C:\Users\Admin\AppData\Local\Temp\198E.tmp"60⤵
- Executes dropped EXE
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"61⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\1A98.tmp"C:\Users\Admin\AppData\Local\Temp\1A98.tmp"62⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\1B34.tmp"C:\Users\Admin\AppData\Local\Temp\1B34.tmp"63⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\1BD0.tmp"C:\Users\Admin\AppData\Local\Temp\1BD0.tmp"64⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"65⤵
- Executes dropped EXE
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"66⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\1D47.tmp"C:\Users\Admin\AppData\Local\Temp\1D47.tmp"67⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\1DC4.tmp"C:\Users\Admin\AppData\Local\Temp\1DC4.tmp"68⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\1E51.tmp"C:\Users\Admin\AppData\Local\Temp\1E51.tmp"69⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\1EDD.tmp"C:\Users\Admin\AppData\Local\Temp\1EDD.tmp"70⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\1F7A.tmp"C:\Users\Admin\AppData\Local\Temp\1F7A.tmp"71⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\2006.tmp"C:\Users\Admin\AppData\Local\Temp\2006.tmp"72⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\2074.tmp"C:\Users\Admin\AppData\Local\Temp\2074.tmp"73⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\20F1.tmp"C:\Users\Admin\AppData\Local\Temp\20F1.tmp"74⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\215E.tmp"C:\Users\Admin\AppData\Local\Temp\215E.tmp"75⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\21CB.tmp"C:\Users\Admin\AppData\Local\Temp\21CB.tmp"76⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\2239.tmp"C:\Users\Admin\AppData\Local\Temp\2239.tmp"77⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\22A6.tmp"C:\Users\Admin\AppData\Local\Temp\22A6.tmp"78⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\2313.tmp"C:\Users\Admin\AppData\Local\Temp\2313.tmp"79⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\23CF.tmp"C:\Users\Admin\AppData\Local\Temp\23CF.tmp"80⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\246B.tmp"C:\Users\Admin\AppData\Local\Temp\246B.tmp"81⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\24E8.tmp"C:\Users\Admin\AppData\Local\Temp\24E8.tmp"82⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\2594.tmp"C:\Users\Admin\AppData\Local\Temp\2594.tmp"83⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\2621.tmp"C:\Users\Admin\AppData\Local\Temp\2621.tmp"84⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\268E.tmp"C:\Users\Admin\AppData\Local\Temp\268E.tmp"85⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\272A.tmp"C:\Users\Admin\AppData\Local\Temp\272A.tmp"86⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\27A7.tmp"C:\Users\Admin\AppData\Local\Temp\27A7.tmp"87⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\2834.tmp"C:\Users\Admin\AppData\Local\Temp\2834.tmp"88⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\28EF.tmp"C:\Users\Admin\AppData\Local\Temp\28EF.tmp"89⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\297C.tmp"C:\Users\Admin\AppData\Local\Temp\297C.tmp"90⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\2A28.tmp"C:\Users\Admin\AppData\Local\Temp\2A28.tmp"91⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"92⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"93⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\2BFD.tmp"C:\Users\Admin\AppData\Local\Temp\2BFD.tmp"94⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"95⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\2D64.tmp"C:\Users\Admin\AppData\Local\Temp\2D64.tmp"96⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\2DE1.tmp"C:\Users\Admin\AppData\Local\Temp\2DE1.tmp"97⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"98⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\2ECB.tmp"C:\Users\Admin\AppData\Local\Temp\2ECB.tmp"99⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\2F77.tmp"C:\Users\Admin\AppData\Local\Temp\2F77.tmp"100⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\3023.tmp"C:\Users\Admin\AppData\Local\Temp\3023.tmp"101⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\30CF.tmp"C:\Users\Admin\AppData\Local\Temp\30CF.tmp"102⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\313C.tmp"C:\Users\Admin\AppData\Local\Temp\313C.tmp"103⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\31E8.tmp"C:\Users\Admin\AppData\Local\Temp\31E8.tmp"104⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"105⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\32E2.tmp"C:\Users\Admin\AppData\Local\Temp\32E2.tmp"106⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"107⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\33BD.tmp"C:\Users\Admin\AppData\Local\Temp\33BD.tmp"108⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\342A.tmp"C:\Users\Admin\AppData\Local\Temp\342A.tmp"109⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\34D6.tmp"C:\Users\Admin\AppData\Local\Temp\34D6.tmp"110⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"111⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\35F0.tmp"C:\Users\Admin\AppData\Local\Temp\35F0.tmp"112⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\366D.tmp"C:\Users\Admin\AppData\Local\Temp\366D.tmp"113⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\36EA.tmp"C:\Users\Admin\AppData\Local\Temp\36EA.tmp"114⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\3776.tmp"C:\Users\Admin\AppData\Local\Temp\3776.tmp"115⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\37F3.tmp"C:\Users\Admin\AppData\Local\Temp\37F3.tmp"116⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\3870.tmp"C:\Users\Admin\AppData\Local\Temp\3870.tmp"117⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\38FD.tmp"C:\Users\Admin\AppData\Local\Temp\38FD.tmp"118⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\3989.tmp"C:\Users\Admin\AppData\Local\Temp\3989.tmp"119⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\3A16.tmp"C:\Users\Admin\AppData\Local\Temp\3A16.tmp"120⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\3A93.tmp"C:\Users\Admin\AppData\Local\Temp\3A93.tmp"121⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\3B4F.tmp"C:\Users\Admin\AppData\Local\Temp\3B4F.tmp"122⤵PID:4820
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-