Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/04/2024, 00:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ba9c99b51299948e69e344f564e56db2fbd1f32b8968d749cd9e628b5a8528db.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
ba9c99b51299948e69e344f564e56db2fbd1f32b8968d749cd9e628b5a8528db.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
ba9c99b51299948e69e344f564e56db2fbd1f32b8968d749cd9e628b5a8528db.exe
-
Size
488KB
-
MD5
15939752e06b44a9e9a1ca142a5e7373
-
SHA1
d8ff4e60385ad61d7b69ca411236cf3086b78f5e
-
SHA256
ba9c99b51299948e69e344f564e56db2fbd1f32b8968d749cd9e628b5a8528db
-
SHA512
d23e6ddda85c3e2a5b72443b9df4f244b8013474da037293ce1e4f09e59bc3990d615cf08a6b71939b03c82524cd004c9e740a43740d2e5cdfb6ab3dfb925f8d
-
SSDEEP
12288:/U5rCOTeiDT18Z5DD/dwZ7gvxe6M4NuNZ:/UQOJDTSXDD1wZ70sp9N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1012 AB9.tmp 1368 C01.tmp 2672 CDC.tmp 4664 DF5.tmp 1572 EEF.tmp 4736 FAB.tmp 2464 1085.tmp 1752 1170.tmp 1532 1279.tmp 3016 1316.tmp 996 13C2.tmp 1860 148D.tmp 3620 1529.tmp 4532 1613.tmp 3708 16BF.tmp 2072 179A.tmp 2104 1894.tmp 4612 194F.tmp 4496 1A2A.tmp 4788 1AF5.tmp 1944 1BB1.tmp 4432 1C5D.tmp 1076 1DC4.tmp 4760 1E80.tmp 1672 1F2B.tmp 2484 2006.tmp 5104 20A2.tmp 1116 2342.tmp 1016 23EE.tmp 1948 248A.tmp 4944 2546.tmp 4676 2640.tmp 1712 26DC.tmp 4136 2769.tmp 2432 2882.tmp 1776 298C.tmp 3516 2A66.tmp 4668 2B70.tmp 4428 2C0C.tmp 3884 2CB8.tmp 3588 2D45.tmp 4988 2DE1.tmp 1860 2EBC.tmp 904 2F39.tmp 4712 2FB6.tmp 968 3052.tmp 2348 30DF.tmp 4612 318B.tmp 2248 3265.tmp 4436 3311.tmp 3960 340B.tmp 1076 3488.tmp 1632 3515.tmp 3108 3582.tmp 4760 364D.tmp 4132 36DA.tmp 3352 3776.tmp 3720 3812.tmp 4120 389F.tmp 1356 394B.tmp 2908 39D8.tmp 1392 3A93.tmp 2780 3B20.tmp 644 3B8D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2840 wrote to memory of 1012 2840 ba9c99b51299948e69e344f564e56db2fbd1f32b8968d749cd9e628b5a8528db.exe 96 PID 2840 wrote to memory of 1012 2840 ba9c99b51299948e69e344f564e56db2fbd1f32b8968d749cd9e628b5a8528db.exe 96 PID 2840 wrote to memory of 1012 2840 ba9c99b51299948e69e344f564e56db2fbd1f32b8968d749cd9e628b5a8528db.exe 96 PID 1012 wrote to memory of 1368 1012 AB9.tmp 97 PID 1012 wrote to memory of 1368 1012 AB9.tmp 97 PID 1012 wrote to memory of 1368 1012 AB9.tmp 97 PID 1368 wrote to memory of 2672 1368 C01.tmp 98 PID 1368 wrote to memory of 2672 1368 C01.tmp 98 PID 1368 wrote to memory of 2672 1368 C01.tmp 98 PID 2672 wrote to memory of 4664 2672 CDC.tmp 99 PID 2672 wrote to memory of 4664 2672 CDC.tmp 99 PID 2672 wrote to memory of 4664 2672 CDC.tmp 99 PID 4664 wrote to memory of 1572 4664 DF5.tmp 100 PID 4664 wrote to memory of 1572 4664 DF5.tmp 100 PID 4664 wrote to memory of 1572 4664 DF5.tmp 100 PID 1572 wrote to memory of 4736 1572 EEF.tmp 101 PID 1572 wrote to memory of 4736 1572 EEF.tmp 101 PID 1572 wrote to memory of 4736 1572 EEF.tmp 101 PID 4736 wrote to memory of 2464 4736 FAB.tmp 102 PID 4736 wrote to memory of 2464 4736 FAB.tmp 102 PID 4736 wrote to memory of 2464 4736 FAB.tmp 102 PID 2464 wrote to memory of 1752 2464 1085.tmp 103 PID 2464 wrote to memory of 1752 2464 1085.tmp 103 PID 2464 wrote to memory of 1752 2464 1085.tmp 103 PID 1752 wrote to memory of 1532 1752 1170.tmp 104 PID 1752 wrote to memory of 1532 1752 1170.tmp 104 PID 1752 wrote to memory of 1532 1752 1170.tmp 104 PID 1532 wrote to memory of 3016 1532 1279.tmp 105 PID 1532 wrote to memory of 3016 1532 1279.tmp 105 PID 1532 wrote to memory of 3016 1532 1279.tmp 105 PID 3016 wrote to memory of 996 3016 1316.tmp 106 PID 3016 wrote to memory of 996 3016 1316.tmp 106 PID 3016 wrote to memory of 996 3016 1316.tmp 106 PID 996 wrote to memory of 1860 996 13C2.tmp 107 PID 996 wrote to memory of 1860 996 13C2.tmp 107 PID 996 wrote to memory of 1860 996 13C2.tmp 107 PID 1860 wrote to memory of 3620 1860 148D.tmp 108 PID 1860 wrote to memory of 3620 1860 148D.tmp 108 PID 1860 wrote to memory of 3620 1860 148D.tmp 108 PID 3620 wrote to memory of 4532 3620 1529.tmp 109 PID 3620 wrote to memory of 4532 3620 1529.tmp 109 PID 3620 wrote to memory of 4532 3620 1529.tmp 109 PID 4532 wrote to memory of 3708 4532 1613.tmp 110 PID 4532 wrote to memory of 3708 4532 1613.tmp 110 PID 4532 wrote to memory of 3708 4532 1613.tmp 110 PID 3708 wrote to memory of 2072 3708 16BF.tmp 111 PID 3708 wrote to memory of 2072 3708 16BF.tmp 111 PID 3708 wrote to memory of 2072 3708 16BF.tmp 111 PID 2072 wrote to memory of 2104 2072 179A.tmp 112 PID 2072 wrote to memory of 2104 2072 179A.tmp 112 PID 2072 wrote to memory of 2104 2072 179A.tmp 112 PID 2104 wrote to memory of 4612 2104 1894.tmp 113 PID 2104 wrote to memory of 4612 2104 1894.tmp 113 PID 2104 wrote to memory of 4612 2104 1894.tmp 113 PID 4612 wrote to memory of 4496 4612 194F.tmp 114 PID 4612 wrote to memory of 4496 4612 194F.tmp 114 PID 4612 wrote to memory of 4496 4612 194F.tmp 114 PID 4496 wrote to memory of 4788 4496 1A2A.tmp 115 PID 4496 wrote to memory of 4788 4496 1A2A.tmp 115 PID 4496 wrote to memory of 4788 4496 1A2A.tmp 115 PID 4788 wrote to memory of 1944 4788 1AF5.tmp 116 PID 4788 wrote to memory of 1944 4788 1AF5.tmp 116 PID 4788 wrote to memory of 1944 4788 1AF5.tmp 116 PID 1944 wrote to memory of 4432 1944 1BB1.tmp 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba9c99b51299948e69e344f564e56db2fbd1f32b8968d749cd9e628b5a8528db.exe"C:\Users\Admin\AppData\Local\Temp\ba9c99b51299948e69e344f564e56db2fbd1f32b8968d749cd9e628b5a8528db.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\AB9.tmp"C:\Users\Admin\AppData\Local\Temp\AB9.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\C01.tmp"C:\Users\Admin\AppData\Local\Temp\C01.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\CDC.tmp"C:\Users\Admin\AppData\Local\Temp\CDC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\DF5.tmp"C:\Users\Admin\AppData\Local\Temp\DF5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\EEF.tmp"C:\Users\Admin\AppData\Local\Temp\EEF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\FAB.tmp"C:\Users\Admin\AppData\Local\Temp\FAB.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\1085.tmp"C:\Users\Admin\AppData\Local\Temp\1085.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\1170.tmp"C:\Users\Admin\AppData\Local\Temp\1170.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\1279.tmp"C:\Users\Admin\AppData\Local\Temp\1279.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\1316.tmp"C:\Users\Admin\AppData\Local\Temp\1316.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\13C2.tmp"C:\Users\Admin\AppData\Local\Temp\13C2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\148D.tmp"C:\Users\Admin\AppData\Local\Temp\148D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\1529.tmp"C:\Users\Admin\AppData\Local\Temp\1529.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\1613.tmp"C:\Users\Admin\AppData\Local\Temp\1613.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\16BF.tmp"C:\Users\Admin\AppData\Local\Temp\16BF.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\179A.tmp"C:\Users\Admin\AppData\Local\Temp\179A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\1894.tmp"C:\Users\Admin\AppData\Local\Temp\1894.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\194F.tmp"C:\Users\Admin\AppData\Local\Temp\194F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\1A2A.tmp"C:\Users\Admin\AppData\Local\Temp\1A2A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"23⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\1DC4.tmp"C:\Users\Admin\AppData\Local\Temp\1DC4.tmp"24⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\1E80.tmp"C:\Users\Admin\AppData\Local\Temp\1E80.tmp"25⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\1F2B.tmp"C:\Users\Admin\AppData\Local\Temp\1F2B.tmp"26⤵
- Executes dropped EXE
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\2006.tmp"C:\Users\Admin\AppData\Local\Temp\2006.tmp"27⤵
- Executes dropped EXE
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\20A2.tmp"C:\Users\Admin\AppData\Local\Temp\20A2.tmp"28⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\2342.tmp"C:\Users\Admin\AppData\Local\Temp\2342.tmp"29⤵
- Executes dropped EXE
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\23EE.tmp"C:\Users\Admin\AppData\Local\Temp\23EE.tmp"30⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\248A.tmp"C:\Users\Admin\AppData\Local\Temp\248A.tmp"31⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\2546.tmp"C:\Users\Admin\AppData\Local\Temp\2546.tmp"32⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\2640.tmp"C:\Users\Admin\AppData\Local\Temp\2640.tmp"33⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\26DC.tmp"C:\Users\Admin\AppData\Local\Temp\26DC.tmp"34⤵
- Executes dropped EXE
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\2769.tmp"C:\Users\Admin\AppData\Local\Temp\2769.tmp"35⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\2882.tmp"C:\Users\Admin\AppData\Local\Temp\2882.tmp"36⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\298C.tmp"C:\Users\Admin\AppData\Local\Temp\298C.tmp"37⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\2A66.tmp"C:\Users\Admin\AppData\Local\Temp\2A66.tmp"38⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\2B70.tmp"C:\Users\Admin\AppData\Local\Temp\2B70.tmp"39⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\2C0C.tmp"C:\Users\Admin\AppData\Local\Temp\2C0C.tmp"40⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\2CB8.tmp"C:\Users\Admin\AppData\Local\Temp\2CB8.tmp"41⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\2D45.tmp"C:\Users\Admin\AppData\Local\Temp\2D45.tmp"42⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\2DE1.tmp"C:\Users\Admin\AppData\Local\Temp\2DE1.tmp"43⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"44⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\2F39.tmp"C:\Users\Admin\AppData\Local\Temp\2F39.tmp"45⤵
- Executes dropped EXE
PID:904 -
C:\Users\Admin\AppData\Local\Temp\2FB6.tmp"C:\Users\Admin\AppData\Local\Temp\2FB6.tmp"46⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\3052.tmp"C:\Users\Admin\AppData\Local\Temp\3052.tmp"47⤵
- Executes dropped EXE
PID:968 -
C:\Users\Admin\AppData\Local\Temp\30DF.tmp"C:\Users\Admin\AppData\Local\Temp\30DF.tmp"48⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\318B.tmp"C:\Users\Admin\AppData\Local\Temp\318B.tmp"49⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\3265.tmp"C:\Users\Admin\AppData\Local\Temp\3265.tmp"50⤵
- Executes dropped EXE
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\3311.tmp"C:\Users\Admin\AppData\Local\Temp\3311.tmp"51⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"52⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"53⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\3515.tmp"C:\Users\Admin\AppData\Local\Temp\3515.tmp"54⤵
- Executes dropped EXE
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"55⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\364D.tmp"C:\Users\Admin\AppData\Local\Temp\364D.tmp"56⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\36DA.tmp"C:\Users\Admin\AppData\Local\Temp\36DA.tmp"57⤵
- Executes dropped EXE
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\3776.tmp"C:\Users\Admin\AppData\Local\Temp\3776.tmp"58⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\3812.tmp"C:\Users\Admin\AppData\Local\Temp\3812.tmp"59⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\389F.tmp"C:\Users\Admin\AppData\Local\Temp\389F.tmp"60⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\394B.tmp"C:\Users\Admin\AppData\Local\Temp\394B.tmp"61⤵
- Executes dropped EXE
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\39D8.tmp"C:\Users\Admin\AppData\Local\Temp\39D8.tmp"62⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\3A93.tmp"C:\Users\Admin\AppData\Local\Temp\3A93.tmp"63⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\3B20.tmp"C:\Users\Admin\AppData\Local\Temp\3B20.tmp"64⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\3B8D.tmp"C:\Users\Admin\AppData\Local\Temp\3B8D.tmp"65⤵
- Executes dropped EXE
PID:644 -
C:\Users\Admin\AppData\Local\Temp\3BEB.tmp"C:\Users\Admin\AppData\Local\Temp\3BEB.tmp"66⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\3C58.tmp"C:\Users\Admin\AppData\Local\Temp\3C58.tmp"67⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\3D14.tmp"C:\Users\Admin\AppData\Local\Temp\3D14.tmp"68⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\3D81.tmp"C:\Users\Admin\AppData\Local\Temp\3D81.tmp"69⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\3E1D.tmp"C:\Users\Admin\AppData\Local\Temp\3E1D.tmp"70⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"71⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\3F17.tmp"C:\Users\Admin\AppData\Local\Temp\3F17.tmp"72⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"73⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\405F.tmp"C:\Users\Admin\AppData\Local\Temp\405F.tmp"74⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\40FC.tmp"C:\Users\Admin\AppData\Local\Temp\40FC.tmp"75⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\4179.tmp"C:\Users\Admin\AppData\Local\Temp\4179.tmp"76⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\41F6.tmp"C:\Users\Admin\AppData\Local\Temp\41F6.tmp"77⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\42B1.tmp"C:\Users\Admin\AppData\Local\Temp\42B1.tmp"78⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\431F.tmp"C:\Users\Admin\AppData\Local\Temp\431F.tmp"79⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\438C.tmp"C:\Users\Admin\AppData\Local\Temp\438C.tmp"80⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\4428.tmp"C:\Users\Admin\AppData\Local\Temp\4428.tmp"81⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\44B5.tmp"C:\Users\Admin\AppData\Local\Temp\44B5.tmp"82⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\4551.tmp"C:\Users\Admin\AppData\Local\Temp\4551.tmp"83⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\45CE.tmp"C:\Users\Admin\AppData\Local\Temp\45CE.tmp"84⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\466A.tmp"C:\Users\Admin\AppData\Local\Temp\466A.tmp"85⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\46F7.tmp"C:\Users\Admin\AppData\Local\Temp\46F7.tmp"86⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\4755.tmp"C:\Users\Admin\AppData\Local\Temp\4755.tmp"87⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\47D2.tmp"C:\Users\Admin\AppData\Local\Temp\47D2.tmp"88⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\483F.tmp"C:\Users\Admin\AppData\Local\Temp\483F.tmp"89⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\48CC.tmp"C:\Users\Admin\AppData\Local\Temp\48CC.tmp"90⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\4949.tmp"C:\Users\Admin\AppData\Local\Temp\4949.tmp"91⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\49C6.tmp"C:\Users\Admin\AppData\Local\Temp\49C6.tmp"92⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\4A62.tmp"C:\Users\Admin\AppData\Local\Temp\4A62.tmp"93⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\4ACF.tmp"C:\Users\Admin\AppData\Local\Temp\4ACF.tmp"94⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\4B6C.tmp"C:\Users\Admin\AppData\Local\Temp\4B6C.tmp"95⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\4BD9.tmp"C:\Users\Admin\AppData\Local\Temp\4BD9.tmp"96⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\4C56.tmp"C:\Users\Admin\AppData\Local\Temp\4C56.tmp"97⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\4CE3.tmp"C:\Users\Admin\AppData\Local\Temp\4CE3.tmp"98⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\4D60.tmp"C:\Users\Admin\AppData\Local\Temp\4D60.tmp"99⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\4DDD.tmp"C:\Users\Admin\AppData\Local\Temp\4DDD.tmp"100⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\4E79.tmp"C:\Users\Admin\AppData\Local\Temp\4E79.tmp"101⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\4F15.tmp"C:\Users\Admin\AppData\Local\Temp\4F15.tmp"102⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\4F92.tmp"C:\Users\Admin\AppData\Local\Temp\4F92.tmp"103⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\500F.tmp"C:\Users\Admin\AppData\Local\Temp\500F.tmp"104⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\507C.tmp"C:\Users\Admin\AppData\Local\Temp\507C.tmp"105⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\5109.tmp"C:\Users\Admin\AppData\Local\Temp\5109.tmp"106⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\5261.tmp"C:\Users\Admin\AppData\Local\Temp\5261.tmp"107⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\52ED.tmp"C:\Users\Admin\AppData\Local\Temp\52ED.tmp"108⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\535B.tmp"C:\Users\Admin\AppData\Local\Temp\535B.tmp"109⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\53E7.tmp"C:\Users\Admin\AppData\Local\Temp\53E7.tmp"110⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\5484.tmp"C:\Users\Admin\AppData\Local\Temp\5484.tmp"111⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\5501.tmp"C:\Users\Admin\AppData\Local\Temp\5501.tmp"112⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\556E.tmp"C:\Users\Admin\AppData\Local\Temp\556E.tmp"113⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\55DB.tmp"C:\Users\Admin\AppData\Local\Temp\55DB.tmp"114⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\5658.tmp"C:\Users\Admin\AppData\Local\Temp\5658.tmp"115⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\56C6.tmp"C:\Users\Admin\AppData\Local\Temp\56C6.tmp"116⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\5762.tmp"C:\Users\Admin\AppData\Local\Temp\5762.tmp"117⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\57EF.tmp"C:\Users\Admin\AppData\Local\Temp\57EF.tmp"118⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\589B.tmp"C:\Users\Admin\AppData\Local\Temp\589B.tmp"119⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\5918.tmp"C:\Users\Admin\AppData\Local\Temp\5918.tmp"120⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\59A4.tmp"C:\Users\Admin\AppData\Local\Temp\59A4.tmp"121⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\5A12.tmp"C:\Users\Admin\AppData\Local\Temp\5A12.tmp"122⤵PID:628
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-