99ef90d73c8081285e4c8698e772d78bdc340b668cfd955fb19d64db8d05aebe

Analysis

max time kernel
144s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2023, 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
Size

343KB
MD5

1be315a12dc5accb6994f156aff85bd0
SHA1

c9d6f74a053e1b2aa5d1e4f111b0ae93d78eab68
SHA256

99ef90d73c8081285e4c8698e772d78bdc340b668cfd955fb19d64db8d05aebe
SHA512

7de51aa85839a183cb49967116e56573e86b3fb325c0192bb4b1b7f6ba10b5cb87ede7b006c2f3ac5373dbcf98c7463684519624a8639d42be8d953d9b149de7
SSDEEP

6144:JjluyDM3Io5R4nM/40yJN804J5HfAW/HXPF4gbXnr8+2kvrHflmf6EvRwaPv2yp3:JEyDMhqh2JhfA+Db8+2kjHflraPJB

Score

7^/10

persistence spyware stealer upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4456-0-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/files/0x000300000001e5a2-5.dat	upx
behavioral2/memory/1376-27-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/4456-32-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/3712-33-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/4456-62-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/2188-63-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/4872-64-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/4264-65-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/3436-66-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/2708-68-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/1376-67-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/3712-70-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/1104-69-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/4476-71-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/4440-72-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/2188-73-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/4624-74-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/2396-75-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/4628-76-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/4872-77-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/1076-78-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/2092-79-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/516-80-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/2200-81-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/1288-84-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/3624-83-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/3436-82-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/2912-85-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/4080-86-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/1104-88-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/2568-89-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/4296-87-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/3408-90-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/4616-92-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/3852-91-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/3088-94-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/4656-95-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/1076-96-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/3552-97-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/2104-98-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/2092-99-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/4708-100-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/920-101-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/4968-102-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/2632-103-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/1964-104-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/4296-105-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/5196-107-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/5136-108-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/5160-109-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/4488-106-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/5248-110-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/5240-111-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/5292-112-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/5356-115-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/5500-117-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/5424-116-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/5756-118-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/5696-119-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/5776-121-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/6108-123-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/6060-122-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/5768-120-0x0000000000400000-0x000000000041E000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File opened (read-only)	\??\M:	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File opened (read-only)	\??\H:	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File opened (read-only)	\??\U:	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File opened (read-only)	\??\V:	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File opened (read-only)	\??\W:	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File opened (read-only)	\??\X:	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File opened (read-only)	\??\Z:	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File opened (read-only)	\??\B:	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File opened (read-only)	\??\K:	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File opened (read-only)	\??\L:	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File opened (read-only)	\??\O:	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File opened (read-only)	\??\J:	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File opened (read-only)	\??\E:	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File opened (read-only)	\??\G:	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File opened (read-only)	\??\N:	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File opened (read-only)	\??\P:	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File opened (read-only)	\??\Q:	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File opened (read-only)	\??\R:	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File opened (read-only)	\??\S:	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File opened (read-only)	\??\A:	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File opened (read-only)	\??\Y:	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File opened (read-only)	\??\T:	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\Updates\Download\russian cum horse voyeur latex .mpeg.exe	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\british fetish action lesbian beautyfull (Sylvia).mpg.exe	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\chinese beast horse uncut boobs .mpg.exe	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\hardcore girls .rar.exe	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\handjob catfight (Sonja).rar.exe	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\indian beast fetish licking (Anniston,Sonja).mpeg.exe	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File created	C:\Program Files\Microsoft Office\root\Templates\american gay hot (!) girly .rar.exe	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\tyrkish kicking trambling hot (!) titts .zip.exe	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\gang bang action girls .zip.exe	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\kicking hidden vagina .mpeg.exe	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File created	C:\Program Files (x86)\Google\Temp\beastiality licking legs black hairunshaved (Karin,Melissa).mpeg.exe	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File created	C:\Program Files (x86)\Google\Update\Download\fucking voyeur .mpg.exe	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\british horse hot (!) balls .mpeg.exe	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File created	C:\Program Files\Common Files\microsoft shared\animal cum [free] .avi.exe	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\asian trambling voyeur .zip.exe	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\tyrkish beast fucking girls traffic .mpeg.exe	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\mssrv.exe	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
4456	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
4456	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
4264	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
4264	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
4456	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
4456	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
1376	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
1376	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
4456	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
4456	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
3712	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
3712	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
4264	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
4264	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
2188	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
2188	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
4456	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
4456	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
4624	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
4624	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
1376	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
4628	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
1376	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
4628	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
4264	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
4264	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
4872	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
4872	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
3712	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
3712	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 4264	4456	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	83
PID 4456 wrote to memory of 4264	4456	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	83
PID 4456 wrote to memory of 4264	4456	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	83
PID 4456 wrote to memory of 1376	4456	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	87
PID 4456 wrote to memory of 1376	4456	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	87
PID 4456 wrote to memory of 1376	4456	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	87
PID 4264 wrote to memory of 3712	4264	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	88
PID 4264 wrote to memory of 3712	4264	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	88
PID 4264 wrote to memory of 3712	4264	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	88
PID 4456 wrote to memory of 2188	4456	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	90
PID 4456 wrote to memory of 2188	4456	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	90
PID 4456 wrote to memory of 2188	4456	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	90
PID 1376 wrote to memory of 4624	1376	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	91
PID 1376 wrote to memory of 4624	1376	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	91
PID 1376 wrote to memory of 4624	1376	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	91
PID 4264 wrote to memory of 4628	4264	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	92
PID 4264 wrote to memory of 4628	4264	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	92
PID 4264 wrote to memory of 4628	4264	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	92
PID 3712 wrote to memory of 4872	3712	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	93
PID 3712 wrote to memory of 4872	3712	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	93
PID 3712 wrote to memory of 4872	3712	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	93
PID 4456 wrote to memory of 2200	4456	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	95
PID 4456 wrote to memory of 2200	4456	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	95
PID 4456 wrote to memory of 2200	4456	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	95
PID 1376 wrote to memory of 3436	1376	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	97
PID 1376 wrote to memory of 3436	1376	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	97
PID 1376 wrote to memory of 3436	1376	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	97
PID 4624 wrote to memory of 2708	4624	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	96
PID 4624 wrote to memory of 2708	4624	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	96
PID 4624 wrote to memory of 2708	4624	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	96
PID 2188 wrote to memory of 1104	2188	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	98
PID 2188 wrote to memory of 1104	2188	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	98
PID 2188 wrote to memory of 1104	2188	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	98
PID 4264 wrote to memory of 4476	4264	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	99
PID 4264 wrote to memory of 4476	4264	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	99
PID 4264 wrote to memory of 4476	4264	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	99
PID 3712 wrote to memory of 4440	3712	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	100
PID 3712 wrote to memory of 4440	3712	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	100
PID 3712 wrote to memory of 4440	3712	1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe	100

C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
"C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    - Checks computer location settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:2396
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        7⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        8⤵
        
        PID:9856
        
        C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        8⤵
        
        PID:10276
        
        C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        8⤵
        
        PID:11004
        
        C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        7⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        7⤵
        
        PID:9784
        
        C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        7⤵
        
        PID:10324
        
        C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        7⤵
        
        PID:11028
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        7⤵
        
        PID:9584
        
        C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        7⤵
        
        PID:9240
        
        C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        7⤵
        
        PID:10828
        
        C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        7⤵
        
        PID:11524
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:7304
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:9480
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:10172
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:10784
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:11460
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:920
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        7⤵
        
        PID:9720
        
        C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        7⤵
        
        PID:10292
        
        C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        7⤵
        
        PID:11012
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:7716
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:9544
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:10220
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:10852
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:11540
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:8888
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:9944
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:10500
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:11204
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:9896
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:10452
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:11260
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:8396
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:9816
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10404
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:11116
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        7⤵
        
        PID:9640
        
        C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        7⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        7⤵
        
        PID:11100
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:7984
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:9704
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:10540
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:11164
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:9392
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:10060
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:10664
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:11396
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:7104
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:9448
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10092
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10708
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:11372
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:9520
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:10180
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:10752
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:11404
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:7180
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:9488
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10100
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10716
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:11444
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:9164
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10004
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10576
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:1000
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:9848
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10268
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10976
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:8288
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:9792
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:10364
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:10916
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4628
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:3852
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:4656
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        7⤵
        
        PID:9624
        
        C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        7⤵
        
        PID:10244
        
        C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        7⤵
        
        PID:10940
        
        C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        7⤵
        
        PID:11560
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:7732
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:9552
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:10188
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:10808
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:11452
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:9504
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:10156
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:10776
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:11468
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:7072
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:9408
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10068
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10672
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:11356
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:9664
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:11092
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:7992
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:9712
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10340
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:9464
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10124
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10740
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:11380
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:6624
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:9888
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10444
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:11252
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:8404
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:9824
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:10532
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:11212
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:9632
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:9356
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:10884
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:11532
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:7632
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:9536
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10164
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10792
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:11420
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:9068
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:9980
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10508
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:11188
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:21312
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:6932
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:9248
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:10020
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:10592
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:11296
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:4080
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:9600
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10236
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10868
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:11516
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:7296
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:9472
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:10116
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:10724
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:11364
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:9088
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:9988
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:10564
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:11124
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:6556
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:9864
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:10284
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:10996
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:8564
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:9800
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:10356
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:11044
- C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    - Checks computer location settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        7⤵
        
        PID:9680
        
        C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        7⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        7⤵
        
        PID:10932
        
        C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        7⤵
        
        PID:11548
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:7800
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:9568
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:10204
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:10860
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:11508
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:9512
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:10132
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:10760
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:11412
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:9952
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:10472
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:2772
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:8556
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:9808
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10556
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:11156
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:2092
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:8964
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:9972
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:10484
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:11228
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:9880
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:10460
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:11244
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:8032
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:9736
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10396
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:11076
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:7452
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:9496
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10148
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10732
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:11476
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:9832
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10388
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:11084
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:7968
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:9688
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:10412
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:11132
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:3436
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:9616
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:10260
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:10988
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:9400
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10052
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10656
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:11324
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:7624
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:9528
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10140
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10768
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:11388
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:6336
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:9744
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10380
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:11068
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:8040
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:9728
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:10348
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:11036
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:2104
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:9608
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10228
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10836
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:11492
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:7056
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:9416
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:10084
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:10688
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:11340
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:6940
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:9332
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:10036
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:10608
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:11312
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:6228
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:9672
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:10252
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:10960
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:11572
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:7976
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:9696
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:10332
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:11272
- C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:1104
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:6264
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:9840
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:10420
      - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        6⤵
        
        PID:11140
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:8048
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:9776
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10308
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:11052
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:9384
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10076
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10680
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:11348
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:6784
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:9928
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10548
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:11180
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:8836
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:9920
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:10468
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:11236
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:1288
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:9592
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:8240
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10876
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:11500
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:7220
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:9456
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:10108
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:10700
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:11436
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:5248
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:8980
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:9964
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:10492
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:11220
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:6564
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:9912
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:10516
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:11196
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:8248
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:9752
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:10300
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:11020
- C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
  2⤵
  PID:2200
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:516
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:8896
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:9936
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10436
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:4332
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:9872
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:10428
    - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
        5⤵
        
        PID:11280
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:8212
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:9760
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:10316
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:2504
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:1964
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:6956
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:9256
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:10028
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:10600
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:11304
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:6280
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:9904
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:10524
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:11172
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:21304
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:8204
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:9768
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:10372
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:11060
- C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
  2⤵
  PID:1076
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:6948
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:9340
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:10044
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:10616
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:11332
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:9656
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:4552
  - - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
      4⤵
      PID:11108
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:7808
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:9576
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:10212
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:10844
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:11484
- C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
  2⤵
  PID:3552
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:6900
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:8180
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:10012
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:10584
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:11288
- C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
  2⤵
  PID:6060
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:9648
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:2544
- - C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
    3⤵
    PID:11148
- C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
  2⤵
  PID:7724
- C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
  2⤵
  PID:9560
- C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
  2⤵
  PID:10196
- C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
  2⤵
  PID:10800
- C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\1be315a12dc5accb6994f156aff85bd0_exe32_JC.exe"
  2⤵
  PID:11428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\gang bang action girls .zip.exe

Filesize
1.4MB

MD5
6e2de7ff2110abea9ab14ad9492993ac

SHA1
bbb9d5aa0425561b45c045827b36f60305c5d49d

SHA256
2ae73c6fb18f95282aa00bf56840da176de49026cb4ad5052a8d95b2e7a84389

SHA512
c53bcf025880ae8b4c3bed658578ca9a6d63c322f6644014b039a0f79bc8b3c4cc7afecd95a2c73977739acb464958e49f5fd4fcbbf5d16efc87ba1602426594

Download Submit
memory/516-80-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/920-101-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1076-78-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1076-96-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1104-88-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1104-69-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1288-84-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1376-67-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1376-27-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1964-104-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2092-79-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2092-99-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2104-98-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2188-73-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2188-63-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2200-81-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2396-75-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2568-89-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2632-103-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2708-68-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2912-85-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3088-94-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3408-90-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3436-66-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3436-82-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3552-97-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3624-83-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3712-33-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3712-70-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3852-91-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4080-86-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4264-65-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4296-105-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4296-87-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4440-72-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4456-62-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4456-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4456-32-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4476-71-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4488-106-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4616-92-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4616-164-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4624-74-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4628-76-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4656-95-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4708-100-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4872-64-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4872-77-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4968-102-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/5136-108-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/5160-109-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/5196-107-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/5240-111-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/5248-110-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/5292-112-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/5356-115-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/5424-116-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/5500-117-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/5696-119-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/5756-118-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/5768-120-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/5776-121-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/6060-122-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/6108-123-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/6116-125-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/6136-126-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download