Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
21-02-2022 23:11
Static task
static1
Behavioral task
behavioral1
Sample
orden pdf.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
orden pdf.exe
-
Size
1.5MB
-
MD5
4f1ad14256cc9c420d78d69b468bab48
-
SHA1
7734beec32b17c6ef0678533cc9634bd2c890c65
-
SHA256
1f05b369246b2867a66aba3cacd9da9c2f29c03adc4d45883c91054c35ac3345
-
SHA512
38dbbf685b18d2540d739b0ff74bb00f20a1e0b1c142e40b7bbb2e451f6d8ea9e992eb01f77eff945a47bc57fb6ada9e184dd9d6f07e732c253449509deeec71
Score
7/10
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
orden pdf.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.url orden pdf.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
Processes:
orden pdf.exepid process 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
orden pdf.exepid process 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
orden pdf.exepid process 1540 orden pdf.exe 1540 orden pdf.exe 1540 orden pdf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
orden pdf.exedescription pid process target process PID 1540 wrote to memory of 1680 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 1680 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 1680 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 1680 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 1628 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 1628 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 1628 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 1628 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 524 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 524 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 524 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 524 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 332 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 332 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 332 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 332 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 756 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 756 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 756 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 756 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 528 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 528 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 528 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 528 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 760 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 760 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 760 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 760 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 860 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 860 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 860 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 860 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 1388 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 1388 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 1388 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 1388 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 560 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 560 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 560 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 560 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 304 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 304 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 304 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 304 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 1644 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 1644 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 1644 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 1644 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 1368 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 1368 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 1368 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 1368 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 1372 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 1372 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 1372 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 1372 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 1104 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 1104 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 1104 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 1104 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 592 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 592 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 592 1540 orden pdf.exe orden pdf.exe PID 1540 wrote to memory of 592 1540 orden pdf.exe orden pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"1⤵
- Drops startup file
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\orden pdf.exe"2⤵