Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18/07/2023, 12:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b17c2c1ce140c0_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
b17c2c1ce140c0_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
b17c2c1ce140c0_JC.exe
-
Size
487KB
-
MD5
b17c2c1ce140c0c9f50eb9308fb9ce7c
-
SHA1
b02ec82f6705caac4786ee063825812d3a310539
-
SHA256
41160b46364d60016b12b776d31033338f3d5edb1b69bd4e2c3c9f718d66c35e
-
SHA512
a0d6769643b126d6bce3e83220068746c9fc602734abcc7000aa8e30c3879a31843949ea8a53d37a44a62a9eae1d2c242093759d92ecf91ab770ddb9a4e1c099
-
SSDEEP
12288:HU5rCOTeiJ7H0ryCePbK3JBpYXzMwzwfRNNZ:HUQOJJQr7e2JBpYXV6NN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1636 6B8B.tmp 344 6C37.tmp 4504 6D02.tmp 4268 6DBE.tmp 3336 6EA8.tmp 4932 6F44.tmp 3184 7000.tmp 2764 70FA.tmp 4928 71A6.tmp 4244 7242.tmp 368 72DE.tmp 744 737A.tmp 4284 7455.tmp 2112 754F.tmp 1000 75FB.tmp 4684 7688.tmp 5036 7743.tmp 664 77D0.tmp 3680 786C.tmp 4924 78F9.tmp 2224 79B4.tmp 4280 7A31.tmp 552 7AFC.tmp 4596 7BB8.tmp 4532 7C44.tmp 2992 7CD1.tmp 1404 7D6D.tmp 2716 7E38.tmp 3324 7F13.tmp 4484 7FCF.tmp 4500 824F.tmp 1008 830B.tmp 2072 83E5.tmp 4932 8443.tmp 1372 84B1.tmp 2280 857C.tmp 3444 85E9.tmp 4204 8656.tmp 2712 86A5.tmp 4056 8731.tmp 4296 878F.tmp 4188 87ED.tmp 3352 883B.tmp 5036 8899.tmp 4496 88F6.tmp 1056 8954.tmp 3792 89B2.tmp 5056 8A1F.tmp 1112 8A9C.tmp 468 8B0A.tmp 552 8B77.tmp 1288 8BF4.tmp 3652 8C61.tmp 2232 8CCF.tmp 3420 8D3C.tmp 3004 8DC9.tmp 5016 8E36.tmp 4488 8EB3.tmp 344 8F11.tmp 4904 8F6F.tmp 4404 8FEC.tmp 4392 9059.tmp 2504 90C6.tmp 5108 9124.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4940 wrote to memory of 1636 4940 b17c2c1ce140c0_JC.exe 85 PID 4940 wrote to memory of 1636 4940 b17c2c1ce140c0_JC.exe 85 PID 4940 wrote to memory of 1636 4940 b17c2c1ce140c0_JC.exe 85 PID 1636 wrote to memory of 344 1636 6B8B.tmp 86 PID 1636 wrote to memory of 344 1636 6B8B.tmp 86 PID 1636 wrote to memory of 344 1636 6B8B.tmp 86 PID 344 wrote to memory of 4504 344 6C37.tmp 87 PID 344 wrote to memory of 4504 344 6C37.tmp 87 PID 344 wrote to memory of 4504 344 6C37.tmp 87 PID 4504 wrote to memory of 4268 4504 6D02.tmp 88 PID 4504 wrote to memory of 4268 4504 6D02.tmp 88 PID 4504 wrote to memory of 4268 4504 6D02.tmp 88 PID 4268 wrote to memory of 3336 4268 6DBE.tmp 89 PID 4268 wrote to memory of 3336 4268 6DBE.tmp 89 PID 4268 wrote to memory of 3336 4268 6DBE.tmp 89 PID 3336 wrote to memory of 4932 3336 6EA8.tmp 90 PID 3336 wrote to memory of 4932 3336 6EA8.tmp 90 PID 3336 wrote to memory of 4932 3336 6EA8.tmp 90 PID 4932 wrote to memory of 3184 4932 6F44.tmp 91 PID 4932 wrote to memory of 3184 4932 6F44.tmp 91 PID 4932 wrote to memory of 3184 4932 6F44.tmp 91 PID 3184 wrote to memory of 2764 3184 7000.tmp 92 PID 3184 wrote to memory of 2764 3184 7000.tmp 92 PID 3184 wrote to memory of 2764 3184 7000.tmp 92 PID 2764 wrote to memory of 4928 2764 70FA.tmp 93 PID 2764 wrote to memory of 4928 2764 70FA.tmp 93 PID 2764 wrote to memory of 4928 2764 70FA.tmp 93 PID 4928 wrote to memory of 4244 4928 71A6.tmp 94 PID 4928 wrote to memory of 4244 4928 71A6.tmp 94 PID 4928 wrote to memory of 4244 4928 71A6.tmp 94 PID 4244 wrote to memory of 368 4244 7242.tmp 95 PID 4244 wrote to memory of 368 4244 7242.tmp 95 PID 4244 wrote to memory of 368 4244 7242.tmp 95 PID 368 wrote to memory of 744 368 72DE.tmp 98 PID 368 wrote to memory of 744 368 72DE.tmp 98 PID 368 wrote to memory of 744 368 72DE.tmp 98 PID 744 wrote to memory of 4284 744 737A.tmp 99 PID 744 wrote to memory of 4284 744 737A.tmp 99 PID 744 wrote to memory of 4284 744 737A.tmp 99 PID 4284 wrote to memory of 2112 4284 7455.tmp 101 PID 4284 wrote to memory of 2112 4284 7455.tmp 101 PID 4284 wrote to memory of 2112 4284 7455.tmp 101 PID 2112 wrote to memory of 1000 2112 754F.tmp 102 PID 2112 wrote to memory of 1000 2112 754F.tmp 102 PID 2112 wrote to memory of 1000 2112 754F.tmp 102 PID 1000 wrote to memory of 4684 1000 75FB.tmp 103 PID 1000 wrote to memory of 4684 1000 75FB.tmp 103 PID 1000 wrote to memory of 4684 1000 75FB.tmp 103 PID 4684 wrote to memory of 5036 4684 7688.tmp 104 PID 4684 wrote to memory of 5036 4684 7688.tmp 104 PID 4684 wrote to memory of 5036 4684 7688.tmp 104 PID 5036 wrote to memory of 664 5036 7743.tmp 106 PID 5036 wrote to memory of 664 5036 7743.tmp 106 PID 5036 wrote to memory of 664 5036 7743.tmp 106 PID 664 wrote to memory of 3680 664 77D0.tmp 107 PID 664 wrote to memory of 3680 664 77D0.tmp 107 PID 664 wrote to memory of 3680 664 77D0.tmp 107 PID 3680 wrote to memory of 4924 3680 786C.tmp 108 PID 3680 wrote to memory of 4924 3680 786C.tmp 108 PID 3680 wrote to memory of 4924 3680 786C.tmp 108 PID 4924 wrote to memory of 2224 4924 78F9.tmp 110 PID 4924 wrote to memory of 2224 4924 78F9.tmp 110 PID 4924 wrote to memory of 2224 4924 78F9.tmp 110 PID 2224 wrote to memory of 4280 2224 79B4.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\b17c2c1ce140c0_JC.exe"C:\Users\Admin\AppData\Local\Temp\b17c2c1ce140c0_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\754F.tmp"C:\Users\Admin\AppData\Local\Temp\754F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\7743.tmp"C:\Users\Admin\AppData\Local\Temp\7743.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Users\Admin\AppData\Local\Temp\786C.tmp"C:\Users\Admin\AppData\Local\Temp\786C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\78F9.tmp"C:\Users\Admin\AppData\Local\Temp\78F9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\79B4.tmp"C:\Users\Admin\AppData\Local\Temp\79B4.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"23⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"24⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"25⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\7C44.tmp"C:\Users\Admin\AppData\Local\Temp\7C44.tmp"26⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"27⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"28⤵
- Executes dropped EXE
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\7E38.tmp"C:\Users\Admin\AppData\Local\Temp\7E38.tmp"29⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\7F13.tmp"C:\Users\Admin\AppData\Local\Temp\7F13.tmp"30⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"31⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\824F.tmp"C:\Users\Admin\AppData\Local\Temp\824F.tmp"32⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\830B.tmp"C:\Users\Admin\AppData\Local\Temp\830B.tmp"33⤵
- Executes dropped EXE
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\83E5.tmp"C:\Users\Admin\AppData\Local\Temp\83E5.tmp"34⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"35⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\84B1.tmp"C:\Users\Admin\AppData\Local\Temp\84B1.tmp"36⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\857C.tmp"C:\Users\Admin\AppData\Local\Temp\857C.tmp"37⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"38⤵
- Executes dropped EXE
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"39⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\86A5.tmp"C:\Users\Admin\AppData\Local\Temp\86A5.tmp"40⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\8731.tmp"C:\Users\Admin\AppData\Local\Temp\8731.tmp"41⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\878F.tmp"C:\Users\Admin\AppData\Local\Temp\878F.tmp"42⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"43⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\883B.tmp"C:\Users\Admin\AppData\Local\Temp\883B.tmp"44⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\8899.tmp"C:\Users\Admin\AppData\Local\Temp\8899.tmp"45⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\88F6.tmp"C:\Users\Admin\AppData\Local\Temp\88F6.tmp"46⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\8954.tmp"C:\Users\Admin\AppData\Local\Temp\8954.tmp"47⤵
- Executes dropped EXE
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\89B2.tmp"C:\Users\Admin\AppData\Local\Temp\89B2.tmp"48⤵
- Executes dropped EXE
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"49⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"50⤵
- Executes dropped EXE
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"51⤵
- Executes dropped EXE
PID:468 -
C:\Users\Admin\AppData\Local\Temp\8B77.tmp"C:\Users\Admin\AppData\Local\Temp\8B77.tmp"52⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"53⤵
- Executes dropped EXE
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\8C61.tmp"C:\Users\Admin\AppData\Local\Temp\8C61.tmp"54⤵
- Executes dropped EXE
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"55⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"56⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"57⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp"58⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"59⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"60⤵
- Executes dropped EXE
PID:344 -
C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"61⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"62⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"63⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"64⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"65⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"66⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"67⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"68⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\92F9.tmp"C:\Users\Admin\AppData\Local\Temp\92F9.tmp"69⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\9376.tmp"C:\Users\Admin\AppData\Local\Temp\9376.tmp"70⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"71⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\9470.tmp"C:\Users\Admin\AppData\Local\Temp\9470.tmp"72⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\950C.tmp"C:\Users\Admin\AppData\Local\Temp\950C.tmp"73⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\9579.tmp"C:\Users\Admin\AppData\Local\Temp\9579.tmp"74⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\95F6.tmp"C:\Users\Admin\AppData\Local\Temp\95F6.tmp"75⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"76⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\96E1.tmp"C:\Users\Admin\AppData\Local\Temp\96E1.tmp"77⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"78⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\97BC.tmp"C:\Users\Admin\AppData\Local\Temp\97BC.tmp"79⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\9839.tmp"C:\Users\Admin\AppData\Local\Temp\9839.tmp"80⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\98B6.tmp"C:\Users\Admin\AppData\Local\Temp\98B6.tmp"81⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"82⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"83⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"84⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"85⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"86⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"87⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\9C21.tmp"C:\Users\Admin\AppData\Local\Temp\9C21.tmp"88⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"89⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"90⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\9D69.tmp"C:\Users\Admin\AppData\Local\Temp\9D69.tmp"91⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"92⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\9E72.tmp"C:\Users\Admin\AppData\Local\Temp\9E72.tmp"93⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"94⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"95⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"96⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\A066.tmp"C:\Users\Admin\AppData\Local\Temp\A066.tmp"97⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"98⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"99⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"100⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"101⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"102⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\A383.tmp"C:\Users\Admin\AppData\Local\Temp\A383.tmp"103⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"104⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"105⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"106⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"107⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"108⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"109⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\A74C.tmp"C:\Users\Admin\AppData\Local\Temp\A74C.tmp"110⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"111⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\A884.tmp"C:\Users\Admin\AppData\Local\Temp\A884.tmp"112⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"113⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\A96F.tmp"C:\Users\Admin\AppData\Local\Temp\A96F.tmp"114⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"115⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"116⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"117⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"118⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"119⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"120⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"121⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\AD95.tmp"C:\Users\Admin\AppData\Local\Temp\AD95.tmp"122⤵PID:1888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-