Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
19/07/2023, 17:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fac7998655b110exe_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
fac7998655b110exe_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
fac7998655b110exe_JC.exe
-
Size
486KB
-
MD5
fac7998655b110d2f42b42568be26c54
-
SHA1
e1de132ec081b8dcfdfdb9b43a53d3c9d9750215
-
SHA256
43d2d45183c89ce1519ae2ef8bdf995a933987aa7c73ce5397b3deaa4ab4cac0
-
SHA512
88912a11eb0b16638d797785045352bdff7e7ea005155f58efb2d62e4bcc2ab7d6e5bf4b7c1b33440acaeee58c5db2ab52252f8e688a7767d168b5949c7458ee
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7PJUybJGOHEK2ddVjNwp6EM6mA3eeSGNq4sHT:/U5rCOTeiDPe2HhmQlihNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4788 AF99.tmp 1036 B0A3.tmp 2160 B13F.tmp 1928 B239.tmp 4084 B304.tmp 4016 B3CF.tmp 3372 B49A.tmp 1876 B565.tmp 3556 B640.tmp 2236 B6DC.tmp 560 B788.tmp 452 B844.tmp 3496 BA09.tmp 2040 BAB5.tmp 3428 BB70.tmp 4808 BC2C.tmp 2632 BCC8.tmp 4528 BD74.tmp 4728 BE4F.tmp 3704 BF1A.tmp 1680 BF97.tmp 5080 C043.tmp 1520 C0DF.tmp 4200 C1AA.tmp 4532 C256.tmp 1424 C302.tmp 1572 C3DC.tmp 1580 C469.tmp 1700 C4F6.tmp 2212 C592.tmp 2272 C66D.tmp 4752 C709.tmp 1936 C7D4.tmp 1392 C861.tmp 4292 C8FD.tmp 1172 C98A.tmp 2684 C9F7.tmp 2036 CA74.tmp 3064 CB01.tmp 5040 CB7E.tmp 1568 CC1A.tmp 5004 CD43.tmp 1776 CE2D.tmp 2112 CF75.tmp 916 D002.tmp 4288 D0BD.tmp 4968 D12B.tmp 2004 D225.tmp 4864 D292.tmp 2100 D32E.tmp 3636 D39C.tmp 2236 D419.tmp 3472 D476.tmp 5064 D4E4.tmp 1952 D580.tmp 1364 D61C.tmp 4440 D699.tmp 4528 D707.tmp 3708 D793.tmp 2836 D810.tmp 924 D89D.tmp 3324 D9F5.tmp 180 DA91.tmp 348 DB1E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 652 wrote to memory of 4788 652 fac7998655b110exe_JC.exe 85 PID 652 wrote to memory of 4788 652 fac7998655b110exe_JC.exe 85 PID 652 wrote to memory of 4788 652 fac7998655b110exe_JC.exe 85 PID 4788 wrote to memory of 1036 4788 AF99.tmp 86 PID 4788 wrote to memory of 1036 4788 AF99.tmp 86 PID 4788 wrote to memory of 1036 4788 AF99.tmp 86 PID 1036 wrote to memory of 2160 1036 B0A3.tmp 87 PID 1036 wrote to memory of 2160 1036 B0A3.tmp 87 PID 1036 wrote to memory of 2160 1036 B0A3.tmp 87 PID 2160 wrote to memory of 1928 2160 B13F.tmp 88 PID 2160 wrote to memory of 1928 2160 B13F.tmp 88 PID 2160 wrote to memory of 1928 2160 B13F.tmp 88 PID 1928 wrote to memory of 4084 1928 B239.tmp 89 PID 1928 wrote to memory of 4084 1928 B239.tmp 89 PID 1928 wrote to memory of 4084 1928 B239.tmp 89 PID 4084 wrote to memory of 4016 4084 B304.tmp 90 PID 4084 wrote to memory of 4016 4084 B304.tmp 90 PID 4084 wrote to memory of 4016 4084 B304.tmp 90 PID 4016 wrote to memory of 3372 4016 B3CF.tmp 91 PID 4016 wrote to memory of 3372 4016 B3CF.tmp 91 PID 4016 wrote to memory of 3372 4016 B3CF.tmp 91 PID 3372 wrote to memory of 1876 3372 B49A.tmp 92 PID 3372 wrote to memory of 1876 3372 B49A.tmp 92 PID 3372 wrote to memory of 1876 3372 B49A.tmp 92 PID 1876 wrote to memory of 3556 1876 B565.tmp 94 PID 1876 wrote to memory of 3556 1876 B565.tmp 94 PID 1876 wrote to memory of 3556 1876 B565.tmp 94 PID 3556 wrote to memory of 2236 3556 B640.tmp 95 PID 3556 wrote to memory of 2236 3556 B640.tmp 95 PID 3556 wrote to memory of 2236 3556 B640.tmp 95 PID 2236 wrote to memory of 560 2236 B6DC.tmp 96 PID 2236 wrote to memory of 560 2236 B6DC.tmp 96 PID 2236 wrote to memory of 560 2236 B6DC.tmp 96 PID 560 wrote to memory of 452 560 B788.tmp 97 PID 560 wrote to memory of 452 560 B788.tmp 97 PID 560 wrote to memory of 452 560 B788.tmp 97 PID 452 wrote to memory of 3496 452 B844.tmp 98 PID 452 wrote to memory of 3496 452 B844.tmp 98 PID 452 wrote to memory of 3496 452 B844.tmp 98 PID 3496 wrote to memory of 2040 3496 BA09.tmp 99 PID 3496 wrote to memory of 2040 3496 BA09.tmp 99 PID 3496 wrote to memory of 2040 3496 BA09.tmp 99 PID 2040 wrote to memory of 3428 2040 BAB5.tmp 100 PID 2040 wrote to memory of 3428 2040 BAB5.tmp 100 PID 2040 wrote to memory of 3428 2040 BAB5.tmp 100 PID 3428 wrote to memory of 4808 3428 BB70.tmp 101 PID 3428 wrote to memory of 4808 3428 BB70.tmp 101 PID 3428 wrote to memory of 4808 3428 BB70.tmp 101 PID 4808 wrote to memory of 2632 4808 BC2C.tmp 102 PID 4808 wrote to memory of 2632 4808 BC2C.tmp 102 PID 4808 wrote to memory of 2632 4808 BC2C.tmp 102 PID 2632 wrote to memory of 4528 2632 BCC8.tmp 103 PID 2632 wrote to memory of 4528 2632 BCC8.tmp 103 PID 2632 wrote to memory of 4528 2632 BCC8.tmp 103 PID 4528 wrote to memory of 4728 4528 BD74.tmp 104 PID 4528 wrote to memory of 4728 4528 BD74.tmp 104 PID 4528 wrote to memory of 4728 4528 BD74.tmp 104 PID 4728 wrote to memory of 3704 4728 BE4F.tmp 106 PID 4728 wrote to memory of 3704 4728 BE4F.tmp 106 PID 4728 wrote to memory of 3704 4728 BE4F.tmp 106 PID 3704 wrote to memory of 1680 3704 BF1A.tmp 107 PID 3704 wrote to memory of 1680 3704 BF1A.tmp 107 PID 3704 wrote to memory of 1680 3704 BF1A.tmp 107 PID 1680 wrote to memory of 5080 1680 BF97.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\fac7998655b110exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\fac7998655b110exe_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Users\Admin\AppData\Local\Temp\AF99.tmp"C:\Users\Admin\AppData\Local\Temp\AF99.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\B239.tmp"C:\Users\Admin\AppData\Local\Temp\B239.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\B304.tmp"C:\Users\Admin\AppData\Local\Temp\B304.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\B49A.tmp"C:\Users\Admin\AppData\Local\Temp\B49A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\B565.tmp"C:\Users\Admin\AppData\Local\Temp\B565.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\B640.tmp"C:\Users\Admin\AppData\Local\Temp\B640.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\B788.tmp"C:\Users\Admin\AppData\Local\Temp\B788.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\B844.tmp"C:\Users\Admin\AppData\Local\Temp\B844.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\BA09.tmp"C:\Users\Admin\AppData\Local\Temp\BA09.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\BB70.tmp"C:\Users\Admin\AppData\Local\Temp\BB70.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\BD74.tmp"C:\Users\Admin\AppData\Local\Temp\BD74.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\BF97.tmp"C:\Users\Admin\AppData\Local\Temp\BF97.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\C043.tmp"C:\Users\Admin\AppData\Local\Temp\C043.tmp"23⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"24⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"25⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\C256.tmp"C:\Users\Admin\AppData\Local\Temp\C256.tmp"26⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\C302.tmp"C:\Users\Admin\AppData\Local\Temp\C302.tmp"27⤵
- Executes dropped EXE
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\C3DC.tmp"C:\Users\Admin\AppData\Local\Temp\C3DC.tmp"28⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\C469.tmp"C:\Users\Admin\AppData\Local\Temp\C469.tmp"29⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"30⤵
- Executes dropped EXE
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\C592.tmp"C:\Users\Admin\AppData\Local\Temp\C592.tmp"31⤵
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\C66D.tmp"C:\Users\Admin\AppData\Local\Temp\C66D.tmp"32⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\C709.tmp"C:\Users\Admin\AppData\Local\Temp\C709.tmp"33⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"34⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\C861.tmp"C:\Users\Admin\AppData\Local\Temp\C861.tmp"35⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"36⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\C98A.tmp"C:\Users\Admin\AppData\Local\Temp\C98A.tmp"37⤵
- Executes dropped EXE
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"38⤵
- Executes dropped EXE
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\CA74.tmp"C:\Users\Admin\AppData\Local\Temp\CA74.tmp"39⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\CB01.tmp"C:\Users\Admin\AppData\Local\Temp\CB01.tmp"40⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"41⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"42⤵
- Executes dropped EXE
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\CD43.tmp"C:\Users\Admin\AppData\Local\Temp\CD43.tmp"43⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"44⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\CF75.tmp"C:\Users\Admin\AppData\Local\Temp\CF75.tmp"45⤵
- Executes dropped EXE
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\D002.tmp"C:\Users\Admin\AppData\Local\Temp\D002.tmp"46⤵
- Executes dropped EXE
PID:916 -
C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"47⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\D12B.tmp"C:\Users\Admin\AppData\Local\Temp\D12B.tmp"48⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\D225.tmp"C:\Users\Admin\AppData\Local\Temp\D225.tmp"49⤵
- Executes dropped EXE
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\D292.tmp"C:\Users\Admin\AppData\Local\Temp\D292.tmp"50⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\D32E.tmp"C:\Users\Admin\AppData\Local\Temp\D32E.tmp"51⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\D39C.tmp"C:\Users\Admin\AppData\Local\Temp\D39C.tmp"52⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\D419.tmp"C:\Users\Admin\AppData\Local\Temp\D419.tmp"53⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\D476.tmp"C:\Users\Admin\AppData\Local\Temp\D476.tmp"54⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"55⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\D580.tmp"C:\Users\Admin\AppData\Local\Temp\D580.tmp"56⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\D61C.tmp"C:\Users\Admin\AppData\Local\Temp\D61C.tmp"57⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\D699.tmp"C:\Users\Admin\AppData\Local\Temp\D699.tmp"58⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\D707.tmp"C:\Users\Admin\AppData\Local\Temp\D707.tmp"59⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\D793.tmp"C:\Users\Admin\AppData\Local\Temp\D793.tmp"60⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\D810.tmp"C:\Users\Admin\AppData\Local\Temp\D810.tmp"61⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\D89D.tmp"C:\Users\Admin\AppData\Local\Temp\D89D.tmp"62⤵
- Executes dropped EXE
PID:924 -
C:\Users\Admin\AppData\Local\Temp\D9F5.tmp"C:\Users\Admin\AppData\Local\Temp\D9F5.tmp"63⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\DA91.tmp"C:\Users\Admin\AppData\Local\Temp\DA91.tmp"64⤵
- Executes dropped EXE
PID:180 -
C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"65⤵
- Executes dropped EXE
PID:348 -
C:\Users\Admin\AppData\Local\Temp\DB8B.tmp"C:\Users\Admin\AppData\Local\Temp\DB8B.tmp"66⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\DC27.tmp"C:\Users\Admin\AppData\Local\Temp\DC27.tmp"67⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\DCD3.tmp"C:\Users\Admin\AppData\Local\Temp\DCD3.tmp"68⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\DD50.tmp"C:\Users\Admin\AppData\Local\Temp\DD50.tmp"69⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\DDBD.tmp"C:\Users\Admin\AppData\Local\Temp\DDBD.tmp"70⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\DE3A.tmp"C:\Users\Admin\AppData\Local\Temp\DE3A.tmp"71⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"72⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\DF34.tmp"C:\Users\Admin\AppData\Local\Temp\DF34.tmp"73⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"74⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\E01F.tmp"C:\Users\Admin\AppData\Local\Temp\E01F.tmp"75⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\E07D.tmp"C:\Users\Admin\AppData\Local\Temp\E07D.tmp"76⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"77⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\E177.tmp"C:\Users\Admin\AppData\Local\Temp\E177.tmp"78⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"79⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\E261.tmp"C:\Users\Admin\AppData\Local\Temp\E261.tmp"80⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\E2EE.tmp"C:\Users\Admin\AppData\Local\Temp\E2EE.tmp"81⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\E37A.tmp"C:\Users\Admin\AppData\Local\Temp\E37A.tmp"82⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\E407.tmp"C:\Users\Admin\AppData\Local\Temp\E407.tmp"83⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\E484.tmp"C:\Users\Admin\AppData\Local\Temp\E484.tmp"84⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\E510.tmp"C:\Users\Admin\AppData\Local\Temp\E510.tmp"85⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\E57E.tmp"C:\Users\Admin\AppData\Local\Temp\E57E.tmp"86⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\E60A.tmp"C:\Users\Admin\AppData\Local\Temp\E60A.tmp"87⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\E678.tmp"C:\Users\Admin\AppData\Local\Temp\E678.tmp"88⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"89⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\E762.tmp"C:\Users\Admin\AppData\Local\Temp\E762.tmp"90⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"91⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\E88B.tmp"C:\Users\Admin\AppData\Local\Temp\E88B.tmp"92⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\E908.tmp"C:\Users\Admin\AppData\Local\Temp\E908.tmp"93⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\E985.tmp"C:\Users\Admin\AppData\Local\Temp\E985.tmp"94⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\EA02.tmp"C:\Users\Admin\AppData\Local\Temp\EA02.tmp"95⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"96⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"97⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\EB89.tmp"C:\Users\Admin\AppData\Local\Temp\EB89.tmp"98⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\EC06.tmp"C:\Users\Admin\AppData\Local\Temp\EC06.tmp"99⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\EC73.tmp"C:\Users\Admin\AppData\Local\Temp\EC73.tmp"100⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"101⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"102⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\EDDA.tmp"C:\Users\Admin\AppData\Local\Temp\EDDA.tmp"103⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\EE48.tmp"C:\Users\Admin\AppData\Local\Temp\EE48.tmp"104⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"105⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\EF13.tmp"C:\Users\Admin\AppData\Local\Temp\EF13.tmp"106⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\EF71.tmp"C:\Users\Admin\AppData\Local\Temp\EF71.tmp"107⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"108⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\F06B.tmp"C:\Users\Admin\AppData\Local\Temp\F06B.tmp"109⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"110⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\F155.tmp"C:\Users\Admin\AppData\Local\Temp\F155.tmp"111⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\F1D2.tmp"C:\Users\Admin\AppData\Local\Temp\F1D2.tmp"112⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\F230.tmp"C:\Users\Admin\AppData\Local\Temp\F230.tmp"113⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\F29D.tmp"C:\Users\Admin\AppData\Local\Temp\F29D.tmp"114⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\F339.tmp"C:\Users\Admin\AppData\Local\Temp\F339.tmp"115⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\F3A7.tmp"C:\Users\Admin\AppData\Local\Temp\F3A7.tmp"116⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\F414.tmp"C:\Users\Admin\AppData\Local\Temp\F414.tmp"117⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\F491.tmp"C:\Users\Admin\AppData\Local\Temp\F491.tmp"118⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\F52D.tmp"C:\Users\Admin\AppData\Local\Temp\F52D.tmp"119⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\F59B.tmp"C:\Users\Admin\AppData\Local\Temp\F59B.tmp"120⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\F608.tmp"C:\Users\Admin\AppData\Local\Temp\F608.tmp"121⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\F685.tmp"C:\Users\Admin\AppData\Local\Temp\F685.tmp"122⤵PID:1584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-