Analysis
-
max time kernel
150s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
15-07-2023 13:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4af0f5346d2ec9exeexe_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
4af0f5346d2ec9exeexe_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
4af0f5346d2ec9exeexe_JC.exe
-
Size
486KB
-
MD5
4af0f5346d2ec990aedbea9238492995
-
SHA1
3ae44535a7129fed101e75048560f3d6aa54cdeb
-
SHA256
ccb52eaabd83c921948a5eb94b1b37a5bc5fd3e62fa843a6b2809ff6d796689d
-
SHA512
1bee730664a7af930c1270ab94edf625c59db0f4f7a7b97251e42c196f2e5c2d28f54490375a19b90bea456b2ee59855412c74add95b9597b33019374a8eb96f
-
SSDEEP
12288:/U5rCOTeiD3pYo5YGuEdvf/bejPVkBK7uklNZ:/UQOJDKo5k6DejVkA7u8N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2008 CF75.tmp 4204 D002.tmp 1808 D09E.tmp 2608 D179.tmp 3124 D215.tmp 1868 D2E0.tmp 1864 D37C.tmp 2336 D457.tmp 3976 D522.tmp 4816 D5AF.tmp 2544 D62C.tmp 1828 D6C8.tmp 2416 D774.tmp 2096 D7F1.tmp 1712 D88D.tmp 3836 D9D5.tmp 3276 DAA1.tmp 1960 DB5C.tmp 2392 DBF8.tmp 3940 DCF2.tmp 4436 DE1B.tmp 2400 DEE6.tmp 4072 DFD1.tmp 2328 E0AB.tmp 1704 E167.tmp 1316 E232.tmp 2052 E2EE.tmp 3376 E3B9.tmp 3408 E493.tmp 1252 E54F.tmp 2144 E639.tmp 1608 E6D6.tmp 4396 E762.tmp 4732 E7EF.tmp 1196 E87B.tmp 2552 E8F8.tmp 3540 E9B4.tmp 3136 EA60.tmp 4960 EAEC.tmp 3396 EB79.tmp 3148 EBF6.tmp 2816 EC83.tmp 920 ECE0.tmp 2596 ED4E.tmp 2000 EDEA.tmp 3792 EE67.tmp 3592 EF03.tmp 4796 EFA0.tmp 2864 F01D.tmp 4444 F0C8.tmp 4412 F165.tmp 2928 F201.tmp 3092 F28E.tmp 448 F31A.tmp 1640 F388.tmp 3852 F405.tmp 3400 F4A1.tmp 916 F53D.tmp 4204 F5AA.tmp 3652 F608.tmp 2484 F685.tmp 4328 F721.tmp 4136 F78F.tmp 4128 F81B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1028 wrote to memory of 2008 1028 4af0f5346d2ec9exeexe_JC.exe 85 PID 1028 wrote to memory of 2008 1028 4af0f5346d2ec9exeexe_JC.exe 85 PID 1028 wrote to memory of 2008 1028 4af0f5346d2ec9exeexe_JC.exe 85 PID 2008 wrote to memory of 4204 2008 CF75.tmp 86 PID 2008 wrote to memory of 4204 2008 CF75.tmp 86 PID 2008 wrote to memory of 4204 2008 CF75.tmp 86 PID 4204 wrote to memory of 1808 4204 D002.tmp 87 PID 4204 wrote to memory of 1808 4204 D002.tmp 87 PID 4204 wrote to memory of 1808 4204 D002.tmp 87 PID 1808 wrote to memory of 2608 1808 D09E.tmp 88 PID 1808 wrote to memory of 2608 1808 D09E.tmp 88 PID 1808 wrote to memory of 2608 1808 D09E.tmp 88 PID 2608 wrote to memory of 3124 2608 D179.tmp 89 PID 2608 wrote to memory of 3124 2608 D179.tmp 89 PID 2608 wrote to memory of 3124 2608 D179.tmp 89 PID 3124 wrote to memory of 1868 3124 D215.tmp 90 PID 3124 wrote to memory of 1868 3124 D215.tmp 90 PID 3124 wrote to memory of 1868 3124 D215.tmp 90 PID 1868 wrote to memory of 1864 1868 D2E0.tmp 91 PID 1868 wrote to memory of 1864 1868 D2E0.tmp 91 PID 1868 wrote to memory of 1864 1868 D2E0.tmp 91 PID 1864 wrote to memory of 2336 1864 D37C.tmp 92 PID 1864 wrote to memory of 2336 1864 D37C.tmp 92 PID 1864 wrote to memory of 2336 1864 D37C.tmp 92 PID 2336 wrote to memory of 3976 2336 D457.tmp 93 PID 2336 wrote to memory of 3976 2336 D457.tmp 93 PID 2336 wrote to memory of 3976 2336 D457.tmp 93 PID 3976 wrote to memory of 4816 3976 D522.tmp 94 PID 3976 wrote to memory of 4816 3976 D522.tmp 94 PID 3976 wrote to memory of 4816 3976 D522.tmp 94 PID 4816 wrote to memory of 2544 4816 D5AF.tmp 95 PID 4816 wrote to memory of 2544 4816 D5AF.tmp 95 PID 4816 wrote to memory of 2544 4816 D5AF.tmp 95 PID 2544 wrote to memory of 1828 2544 D62C.tmp 96 PID 2544 wrote to memory of 1828 2544 D62C.tmp 96 PID 2544 wrote to memory of 1828 2544 D62C.tmp 96 PID 1828 wrote to memory of 2416 1828 D6C8.tmp 97 PID 1828 wrote to memory of 2416 1828 D6C8.tmp 97 PID 1828 wrote to memory of 2416 1828 D6C8.tmp 97 PID 2416 wrote to memory of 2096 2416 D774.tmp 98 PID 2416 wrote to memory of 2096 2416 D774.tmp 98 PID 2416 wrote to memory of 2096 2416 D774.tmp 98 PID 2096 wrote to memory of 1712 2096 D7F1.tmp 99 PID 2096 wrote to memory of 1712 2096 D7F1.tmp 99 PID 2096 wrote to memory of 1712 2096 D7F1.tmp 99 PID 1712 wrote to memory of 3836 1712 D88D.tmp 100 PID 1712 wrote to memory of 3836 1712 D88D.tmp 100 PID 1712 wrote to memory of 3836 1712 D88D.tmp 100 PID 3836 wrote to memory of 3276 3836 D9D5.tmp 101 PID 3836 wrote to memory of 3276 3836 D9D5.tmp 101 PID 3836 wrote to memory of 3276 3836 D9D5.tmp 101 PID 3276 wrote to memory of 1960 3276 DAA1.tmp 102 PID 3276 wrote to memory of 1960 3276 DAA1.tmp 102 PID 3276 wrote to memory of 1960 3276 DAA1.tmp 102 PID 1960 wrote to memory of 2392 1960 DB5C.tmp 103 PID 1960 wrote to memory of 2392 1960 DB5C.tmp 103 PID 1960 wrote to memory of 2392 1960 DB5C.tmp 103 PID 2392 wrote to memory of 3940 2392 DBF8.tmp 104 PID 2392 wrote to memory of 3940 2392 DBF8.tmp 104 PID 2392 wrote to memory of 3940 2392 DBF8.tmp 104 PID 3940 wrote to memory of 4436 3940 DCF2.tmp 105 PID 3940 wrote to memory of 4436 3940 DCF2.tmp 105 PID 3940 wrote to memory of 4436 3940 DCF2.tmp 105 PID 4436 wrote to memory of 2400 4436 DE1B.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\4af0f5346d2ec9exeexe_JC.exe"C:\Users\Admin\AppData\Local\Temp\4af0f5346d2ec9exeexe_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\CF75.tmp"C:\Users\Admin\AppData\Local\Temp\CF75.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\D002.tmp"C:\Users\Admin\AppData\Local\Temp\D002.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\D09E.tmp"C:\Users\Admin\AppData\Local\Temp\D09E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\D179.tmp"C:\Users\Admin\AppData\Local\Temp\D179.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\D215.tmp"C:\Users\Admin\AppData\Local\Temp\D215.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\D37C.tmp"C:\Users\Admin\AppData\Local\Temp\D37C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\D457.tmp"C:\Users\Admin\AppData\Local\Temp\D457.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\D522.tmp"C:\Users\Admin\AppData\Local\Temp\D522.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\D62C.tmp"C:\Users\Admin\AppData\Local\Temp\D62C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\D774.tmp"C:\Users\Admin\AppData\Local\Temp\D774.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\D7F1.tmp"C:\Users\Admin\AppData\Local\Temp\D7F1.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\D88D.tmp"C:\Users\Admin\AppData\Local\Temp\D88D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\DAA1.tmp"C:\Users\Admin\AppData\Local\Temp\DAA1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\DBF8.tmp"C:\Users\Admin\AppData\Local\Temp\DBF8.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\DCF2.tmp"C:\Users\Admin\AppData\Local\Temp\DCF2.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"23⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"24⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\E0AB.tmp"C:\Users\Admin\AppData\Local\Temp\E0AB.tmp"25⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\E167.tmp"C:\Users\Admin\AppData\Local\Temp\E167.tmp"26⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\E232.tmp"C:\Users\Admin\AppData\Local\Temp\E232.tmp"27⤵
- Executes dropped EXE
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\E2EE.tmp"C:\Users\Admin\AppData\Local\Temp\E2EE.tmp"28⤵
- Executes dropped EXE
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"29⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\E493.tmp"C:\Users\Admin\AppData\Local\Temp\E493.tmp"30⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\E54F.tmp"C:\Users\Admin\AppData\Local\Temp\E54F.tmp"31⤵
- Executes dropped EXE
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\E639.tmp"C:\Users\Admin\AppData\Local\Temp\E639.tmp"32⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"33⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\E762.tmp"C:\Users\Admin\AppData\Local\Temp\E762.tmp"34⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"35⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\E87B.tmp"C:\Users\Admin\AppData\Local\Temp\E87B.tmp"36⤵
- Executes dropped EXE
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"37⤵
- Executes dropped EXE
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"38⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\EA60.tmp"C:\Users\Admin\AppData\Local\Temp\EA60.tmp"39⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"40⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\EB79.tmp"C:\Users\Admin\AppData\Local\Temp\EB79.tmp"41⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"42⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\EC83.tmp"C:\Users\Admin\AppData\Local\Temp\EC83.tmp"43⤵
- Executes dropped EXE
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\ECE0.tmp"C:\Users\Admin\AppData\Local\Temp\ECE0.tmp"44⤵
- Executes dropped EXE
PID:920 -
C:\Users\Admin\AppData\Local\Temp\ED4E.tmp"C:\Users\Admin\AppData\Local\Temp\ED4E.tmp"45⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\EDEA.tmp"C:\Users\Admin\AppData\Local\Temp\EDEA.tmp"46⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\EE67.tmp"C:\Users\Admin\AppData\Local\Temp\EE67.tmp"47⤵
- Executes dropped EXE
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\EF03.tmp"C:\Users\Admin\AppData\Local\Temp\EF03.tmp"48⤵
- Executes dropped EXE
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\EFA0.tmp"C:\Users\Admin\AppData\Local\Temp\EFA0.tmp"49⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\F01D.tmp"C:\Users\Admin\AppData\Local\Temp\F01D.tmp"50⤵
- Executes dropped EXE
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"51⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\F165.tmp"C:\Users\Admin\AppData\Local\Temp\F165.tmp"52⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\F201.tmp"C:\Users\Admin\AppData\Local\Temp\F201.tmp"53⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\F28E.tmp"C:\Users\Admin\AppData\Local\Temp\F28E.tmp"54⤵
- Executes dropped EXE
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\F31A.tmp"C:\Users\Admin\AppData\Local\Temp\F31A.tmp"55⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\F388.tmp"C:\Users\Admin\AppData\Local\Temp\F388.tmp"56⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\F405.tmp"C:\Users\Admin\AppData\Local\Temp\F405.tmp"57⤵
- Executes dropped EXE
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"58⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\F53D.tmp"C:\Users\Admin\AppData\Local\Temp\F53D.tmp"59⤵
- Executes dropped EXE
PID:916 -
C:\Users\Admin\AppData\Local\Temp\F5AA.tmp"C:\Users\Admin\AppData\Local\Temp\F5AA.tmp"60⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\F608.tmp"C:\Users\Admin\AppData\Local\Temp\F608.tmp"61⤵
- Executes dropped EXE
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\F685.tmp"C:\Users\Admin\AppData\Local\Temp\F685.tmp"62⤵
- Executes dropped EXE
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\F721.tmp"C:\Users\Admin\AppData\Local\Temp\F721.tmp"63⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\F78F.tmp"C:\Users\Admin\AppData\Local\Temp\F78F.tmp"64⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\F81B.tmp"C:\Users\Admin\AppData\Local\Temp\F81B.tmp"65⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"66⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\F935.tmp"C:\Users\Admin\AppData\Local\Temp\F935.tmp"67⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\F9C1.tmp"C:\Users\Admin\AppData\Local\Temp\F9C1.tmp"68⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"69⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"70⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\FB67.tmp"C:\Users\Admin\AppData\Local\Temp\FB67.tmp"71⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\FC13.tmp"C:\Users\Admin\AppData\Local\Temp\FC13.tmp"72⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"73⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"74⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"75⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\FE46.tmp"C:\Users\Admin\AppData\Local\Temp\FE46.tmp"76⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"77⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\FF7E.tmp"C:\Users\Admin\AppData\Local\Temp\FF7E.tmp"78⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\1A.tmp"C:\Users\Admin\AppData\Local\Temp\1A.tmp"79⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7.tmp"80⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\143.tmp"C:\Users\Admin\AppData\Local\Temp\143.tmp"81⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\1B1.tmp"C:\Users\Admin\AppData\Local\Temp\1B1.tmp"82⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\22E.tmp"C:\Users\Admin\AppData\Local\Temp\22E.tmp"83⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\2AB.tmp"C:\Users\Admin\AppData\Local\Temp\2AB.tmp"84⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\308.tmp"C:\Users\Admin\AppData\Local\Temp\308.tmp"85⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\376.tmp"C:\Users\Admin\AppData\Local\Temp\376.tmp"86⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\3D3.tmp"C:\Users\Admin\AppData\Local\Temp\3D3.tmp"87⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\441.tmp"C:\Users\Admin\AppData\Local\Temp\441.tmp"88⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\4AE.tmp"C:\Users\Admin\AppData\Local\Temp\4AE.tmp"89⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\51C.tmp"C:\Users\Admin\AppData\Local\Temp\51C.tmp"90⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\599.tmp"C:\Users\Admin\AppData\Local\Temp\599.tmp"91⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\635.tmp"C:\Users\Admin\AppData\Local\Temp\635.tmp"92⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\6B2.tmp"C:\Users\Admin\AppData\Local\Temp\6B2.tmp"93⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\71F.tmp"C:\Users\Admin\AppData\Local\Temp\71F.tmp"94⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\78D.tmp"C:\Users\Admin\AppData\Local\Temp\78D.tmp"95⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\7EA.tmp"C:\Users\Admin\AppData\Local\Temp\7EA.tmp"96⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\858.tmp"C:\Users\Admin\AppData\Local\Temp\858.tmp"97⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\8F4.tmp"C:\Users\Admin\AppData\Local\Temp\8F4.tmp"98⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\990.tmp"C:\Users\Admin\AppData\Local\Temp\990.tmp"99⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\A2C.tmp"C:\Users\Admin\AppData\Local\Temp\A2C.tmp"100⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\AC9.tmp"C:\Users\Admin\AppData\Local\Temp\AC9.tmp"101⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\B55.tmp"C:\Users\Admin\AppData\Local\Temp\B55.tmp"102⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"103⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"104⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\CFB.tmp"C:\Users\Admin\AppData\Local\Temp\CFB.tmp"105⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\D97.tmp"C:\Users\Admin\AppData\Local\Temp\D97.tmp"106⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"107⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\EE0.tmp"C:\Users\Admin\AppData\Local\Temp\EE0.tmp"108⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\F5D.tmp"C:\Users\Admin\AppData\Local\Temp\F5D.tmp"109⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\FE9.tmp"C:\Users\Admin\AppData\Local\Temp\FE9.tmp"110⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\1076.tmp"C:\Users\Admin\AppData\Local\Temp\1076.tmp"111⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\10F3.tmp"C:\Users\Admin\AppData\Local\Temp\10F3.tmp"112⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\1170.tmp"C:\Users\Admin\AppData\Local\Temp\1170.tmp"113⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\11DD.tmp"C:\Users\Admin\AppData\Local\Temp\11DD.tmp"114⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\126A.tmp"C:\Users\Admin\AppData\Local\Temp\126A.tmp"115⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\12D7.tmp"C:\Users\Admin\AppData\Local\Temp\12D7.tmp"116⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\1354.tmp"C:\Users\Admin\AppData\Local\Temp\1354.tmp"117⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\13C2.tmp"C:\Users\Admin\AppData\Local\Temp\13C2.tmp"118⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\141F.tmp"C:\Users\Admin\AppData\Local\Temp\141F.tmp"119⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\14AC.tmp"C:\Users\Admin\AppData\Local\Temp\14AC.tmp"120⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\1567.tmp"C:\Users\Admin\AppData\Local\Temp\1567.tmp"121⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\15F4.tmp"C:\Users\Admin\AppData\Local\Temp\15F4.tmp"122⤵PID:3988
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-