Analysis
-
max time kernel
151s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
02/08/2023, 19:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
43f38a1f8c63d1c8e1873899039f9655_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
43f38a1f8c63d1c8e1873899039f9655_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
43f38a1f8c63d1c8e1873899039f9655_mafia_JC.exe
-
Size
486KB
-
MD5
43f38a1f8c63d1c8e1873899039f9655
-
SHA1
633cdd74a869da5e125de75be6971b39d00e1010
-
SHA256
7c3537b8e4a61fad401173468a15ce0fa642a1113d7489e6071dde6ff34ce442
-
SHA512
d68f17662ce254d089c322da02ca570e567d2c54b7ebdd9ff6babcf1362dcc6059926b66d0aa0d0996afa7b2259bfd88b0adc6c85963847cedcf00c2811c21dd
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7Yu1FZvwaOVC4hKzkF6Uo1dz/WyLawiOjUjFc:/U5rCOTeiDYu1FlXgvJbOjyF3qNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5060 942.tmp 4472 1028.tmp 2692 1102.tmp 1108 11CE.tmp 4392 12A8.tmp 4904 1383.tmp 4092 143F.tmp 1612 14DB.tmp 4384 1577.tmp 4696 1623.tmp 2876 16DE.tmp 3780 177B.tmp 1472 1894.tmp 1408 1930.tmp 372 1A1B.tmp 2816 1AE6.tmp 1648 1BB1.tmp 2700 1C4D.tmp 4856 1D18.tmp 4464 1E03.tmp 4612 1EDD.tmp 1308 1FE7.tmp 2244 2093.tmp 860 21AC.tmp 2336 22A6.tmp 1448 23BF.tmp 1392 245C.tmp 3988 24E8.tmp 228 25F2.tmp 1476 26DC.tmp 4400 27C7.tmp 2760 2853.tmp 2080 28FF.tmp 3980 296C.tmp 2000 29E9.tmp 1692 2A76.tmp 3444 2B32.tmp 3984 2BCE.tmp 5000 2C6A.tmp 3264 2D16.tmp 2992 2DE1.tmp 4380 2E5E.tmp 3280 2EFA.tmp 400 2FA6.tmp 1700 3062.tmp 4028 30FE.tmp 4008 31AA.tmp 2228 3246.tmp 2936 3311.tmp 4492 337F.tmp 1304 340B.tmp 1820 34B7.tmp 2304 3534.tmp 3336 367C.tmp 3312 36EA.tmp 4476 3786.tmp 4992 3812.tmp 4084 3880.tmp 3168 392C.tmp 3468 3999.tmp 2132 3A06.tmp 4292 3A93.tmp 1564 3B5E.tmp 964 3C0A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3812 wrote to memory of 5060 3812 43f38a1f8c63d1c8e1873899039f9655_mafia_JC.exe 80 PID 3812 wrote to memory of 5060 3812 43f38a1f8c63d1c8e1873899039f9655_mafia_JC.exe 80 PID 3812 wrote to memory of 5060 3812 43f38a1f8c63d1c8e1873899039f9655_mafia_JC.exe 80 PID 5060 wrote to memory of 4472 5060 942.tmp 81 PID 5060 wrote to memory of 4472 5060 942.tmp 81 PID 5060 wrote to memory of 4472 5060 942.tmp 81 PID 4472 wrote to memory of 2692 4472 1028.tmp 82 PID 4472 wrote to memory of 2692 4472 1028.tmp 82 PID 4472 wrote to memory of 2692 4472 1028.tmp 82 PID 2692 wrote to memory of 1108 2692 1102.tmp 83 PID 2692 wrote to memory of 1108 2692 1102.tmp 83 PID 2692 wrote to memory of 1108 2692 1102.tmp 83 PID 1108 wrote to memory of 4392 1108 11CE.tmp 84 PID 1108 wrote to memory of 4392 1108 11CE.tmp 84 PID 1108 wrote to memory of 4392 1108 11CE.tmp 84 PID 4392 wrote to memory of 4904 4392 12A8.tmp 85 PID 4392 wrote to memory of 4904 4392 12A8.tmp 85 PID 4392 wrote to memory of 4904 4392 12A8.tmp 85 PID 4904 wrote to memory of 4092 4904 1383.tmp 86 PID 4904 wrote to memory of 4092 4904 1383.tmp 86 PID 4904 wrote to memory of 4092 4904 1383.tmp 86 PID 4092 wrote to memory of 1612 4092 143F.tmp 87 PID 4092 wrote to memory of 1612 4092 143F.tmp 87 PID 4092 wrote to memory of 1612 4092 143F.tmp 87 PID 1612 wrote to memory of 4384 1612 14DB.tmp 88 PID 1612 wrote to memory of 4384 1612 14DB.tmp 88 PID 1612 wrote to memory of 4384 1612 14DB.tmp 88 PID 4384 wrote to memory of 4696 4384 1577.tmp 89 PID 4384 wrote to memory of 4696 4384 1577.tmp 89 PID 4384 wrote to memory of 4696 4384 1577.tmp 89 PID 4696 wrote to memory of 2876 4696 1623.tmp 90 PID 4696 wrote to memory of 2876 4696 1623.tmp 90 PID 4696 wrote to memory of 2876 4696 1623.tmp 90 PID 2876 wrote to memory of 3780 2876 16DE.tmp 91 PID 2876 wrote to memory of 3780 2876 16DE.tmp 91 PID 2876 wrote to memory of 3780 2876 16DE.tmp 91 PID 3780 wrote to memory of 1472 3780 177B.tmp 92 PID 3780 wrote to memory of 1472 3780 177B.tmp 92 PID 3780 wrote to memory of 1472 3780 177B.tmp 92 PID 1472 wrote to memory of 1408 1472 1894.tmp 93 PID 1472 wrote to memory of 1408 1472 1894.tmp 93 PID 1472 wrote to memory of 1408 1472 1894.tmp 93 PID 1408 wrote to memory of 372 1408 1930.tmp 95 PID 1408 wrote to memory of 372 1408 1930.tmp 95 PID 1408 wrote to memory of 372 1408 1930.tmp 95 PID 372 wrote to memory of 2816 372 1A1B.tmp 96 PID 372 wrote to memory of 2816 372 1A1B.tmp 96 PID 372 wrote to memory of 2816 372 1A1B.tmp 96 PID 2816 wrote to memory of 1648 2816 1AE6.tmp 97 PID 2816 wrote to memory of 1648 2816 1AE6.tmp 97 PID 2816 wrote to memory of 1648 2816 1AE6.tmp 97 PID 1648 wrote to memory of 2700 1648 1BB1.tmp 98 PID 1648 wrote to memory of 2700 1648 1BB1.tmp 98 PID 1648 wrote to memory of 2700 1648 1BB1.tmp 98 PID 2700 wrote to memory of 4856 2700 1C4D.tmp 99 PID 2700 wrote to memory of 4856 2700 1C4D.tmp 99 PID 2700 wrote to memory of 4856 2700 1C4D.tmp 99 PID 4856 wrote to memory of 4464 4856 1D18.tmp 100 PID 4856 wrote to memory of 4464 4856 1D18.tmp 100 PID 4856 wrote to memory of 4464 4856 1D18.tmp 100 PID 4464 wrote to memory of 4612 4464 1E03.tmp 101 PID 4464 wrote to memory of 4612 4464 1E03.tmp 101 PID 4464 wrote to memory of 4612 4464 1E03.tmp 101 PID 4612 wrote to memory of 1308 4612 1EDD.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\43f38a1f8c63d1c8e1873899039f9655_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\43f38a1f8c63d1c8e1873899039f9655_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\942.tmp"C:\Users\Admin\AppData\Local\Temp\942.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\1028.tmp"C:\Users\Admin\AppData\Local\Temp\1028.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\1102.tmp"C:\Users\Admin\AppData\Local\Temp\1102.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\11CE.tmp"C:\Users\Admin\AppData\Local\Temp\11CE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\12A8.tmp"C:\Users\Admin\AppData\Local\Temp\12A8.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\1383.tmp"C:\Users\Admin\AppData\Local\Temp\1383.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\143F.tmp"C:\Users\Admin\AppData\Local\Temp\143F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\14DB.tmp"C:\Users\Admin\AppData\Local\Temp\14DB.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\1577.tmp"C:\Users\Admin\AppData\Local\Temp\1577.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\1623.tmp"C:\Users\Admin\AppData\Local\Temp\1623.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\16DE.tmp"C:\Users\Admin\AppData\Local\Temp\16DE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\177B.tmp"C:\Users\Admin\AppData\Local\Temp\177B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\1894.tmp"C:\Users\Admin\AppData\Local\Temp\1894.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\1930.tmp"C:\Users\Admin\AppData\Local\Temp\1930.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Users\Admin\AppData\Local\Temp\1AE6.tmp"C:\Users\Admin\AppData\Local\Temp\1AE6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\1C4D.tmp"C:\Users\Admin\AppData\Local\Temp\1C4D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\1D18.tmp"C:\Users\Admin\AppData\Local\Temp\1D18.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\1E03.tmp"C:\Users\Admin\AppData\Local\Temp\1E03.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\1EDD.tmp"C:\Users\Admin\AppData\Local\Temp\1EDD.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"23⤵
- Executes dropped EXE
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\2093.tmp"C:\Users\Admin\AppData\Local\Temp\2093.tmp"24⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\21AC.tmp"C:\Users\Admin\AppData\Local\Temp\21AC.tmp"25⤵
- Executes dropped EXE
PID:860 -
C:\Users\Admin\AppData\Local\Temp\22A6.tmp"C:\Users\Admin\AppData\Local\Temp\22A6.tmp"26⤵
- Executes dropped EXE
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\23BF.tmp"C:\Users\Admin\AppData\Local\Temp\23BF.tmp"27⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\245C.tmp"C:\Users\Admin\AppData\Local\Temp\245C.tmp"28⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\24E8.tmp"C:\Users\Admin\AppData\Local\Temp\24E8.tmp"29⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\25F2.tmp"C:\Users\Admin\AppData\Local\Temp\25F2.tmp"30⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\26DC.tmp"C:\Users\Admin\AppData\Local\Temp\26DC.tmp"31⤵
- Executes dropped EXE
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\27C7.tmp"C:\Users\Admin\AppData\Local\Temp\27C7.tmp"32⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\2853.tmp"C:\Users\Admin\AppData\Local\Temp\2853.tmp"33⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\28FF.tmp"C:\Users\Admin\AppData\Local\Temp\28FF.tmp"34⤵
- Executes dropped EXE
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\296C.tmp"C:\Users\Admin\AppData\Local\Temp\296C.tmp"35⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\29E9.tmp"C:\Users\Admin\AppData\Local\Temp\29E9.tmp"36⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\2A76.tmp"C:\Users\Admin\AppData\Local\Temp\2A76.tmp"37⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\2B32.tmp"C:\Users\Admin\AppData\Local\Temp\2B32.tmp"38⤵
- Executes dropped EXE
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\2BCE.tmp"C:\Users\Admin\AppData\Local\Temp\2BCE.tmp"39⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\2C6A.tmp"C:\Users\Admin\AppData\Local\Temp\2C6A.tmp"40⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\2D16.tmp"C:\Users\Admin\AppData\Local\Temp\2D16.tmp"41⤵
- Executes dropped EXE
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\2DE1.tmp"C:\Users\Admin\AppData\Local\Temp\2DE1.tmp"42⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\2E5E.tmp"C:\Users\Admin\AppData\Local\Temp\2E5E.tmp"43⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\2EFA.tmp"C:\Users\Admin\AppData\Local\Temp\2EFA.tmp"44⤵
- Executes dropped EXE
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"45⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\3062.tmp"C:\Users\Admin\AppData\Local\Temp\3062.tmp"46⤵
- Executes dropped EXE
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\30FE.tmp"C:\Users\Admin\AppData\Local\Temp\30FE.tmp"47⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\31AA.tmp"C:\Users\Admin\AppData\Local\Temp\31AA.tmp"48⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\3246.tmp"C:\Users\Admin\AppData\Local\Temp\3246.tmp"49⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\3311.tmp"C:\Users\Admin\AppData\Local\Temp\3311.tmp"50⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"51⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"52⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"53⤵
- Executes dropped EXE
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"54⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\35E0.tmp"C:\Users\Admin\AppData\Local\Temp\35E0.tmp"55⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\367C.tmp"C:\Users\Admin\AppData\Local\Temp\367C.tmp"56⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\36EA.tmp"C:\Users\Admin\AppData\Local\Temp\36EA.tmp"57⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\3786.tmp"C:\Users\Admin\AppData\Local\Temp\3786.tmp"58⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\3812.tmp"C:\Users\Admin\AppData\Local\Temp\3812.tmp"59⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\3880.tmp"C:\Users\Admin\AppData\Local\Temp\3880.tmp"60⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\392C.tmp"C:\Users\Admin\AppData\Local\Temp\392C.tmp"61⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\3999.tmp"C:\Users\Admin\AppData\Local\Temp\3999.tmp"62⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\3A06.tmp"C:\Users\Admin\AppData\Local\Temp\3A06.tmp"63⤵
- Executes dropped EXE
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\3A93.tmp"C:\Users\Admin\AppData\Local\Temp\3A93.tmp"64⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\3B5E.tmp"C:\Users\Admin\AppData\Local\Temp\3B5E.tmp"65⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\3C0A.tmp"C:\Users\Admin\AppData\Local\Temp\3C0A.tmp"66⤵
- Executes dropped EXE
PID:964 -
C:\Users\Admin\AppData\Local\Temp\3C87.tmp"C:\Users\Admin\AppData\Local\Temp\3C87.tmp"67⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\3D04.tmp"C:\Users\Admin\AppData\Local\Temp\3D04.tmp"68⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\3DA0.tmp"C:\Users\Admin\AppData\Local\Temp\3DA0.tmp"69⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\3E0E.tmp"C:\Users\Admin\AppData\Local\Temp\3E0E.tmp"70⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\3E7B.tmp"C:\Users\Admin\AppData\Local\Temp\3E7B.tmp"71⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\3EF8.tmp"C:\Users\Admin\AppData\Local\Temp\3EF8.tmp"72⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\3F85.tmp"C:\Users\Admin\AppData\Local\Temp\3F85.tmp"73⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\4011.tmp"C:\Users\Admin\AppData\Local\Temp\4011.tmp"74⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\40BD.tmp"C:\Users\Admin\AppData\Local\Temp\40BD.tmp"75⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\412B.tmp"C:\Users\Admin\AppData\Local\Temp\412B.tmp"76⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\4198.tmp"C:\Users\Admin\AppData\Local\Temp\4198.tmp"77⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\4215.tmp"C:\Users\Admin\AppData\Local\Temp\4215.tmp"78⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\42A2.tmp"C:\Users\Admin\AppData\Local\Temp\42A2.tmp"79⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\431F.tmp"C:\Users\Admin\AppData\Local\Temp\431F.tmp"80⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\43AB.tmp"C:\Users\Admin\AppData\Local\Temp\43AB.tmp"81⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\4428.tmp"C:\Users\Admin\AppData\Local\Temp\4428.tmp"82⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\44C4.tmp"C:\Users\Admin\AppData\Local\Temp\44C4.tmp"83⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\45BE.tmp"C:\Users\Admin\AppData\Local\Temp\45BE.tmp"84⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\465B.tmp"C:\Users\Admin\AppData\Local\Temp\465B.tmp"85⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\46E7.tmp"C:\Users\Admin\AppData\Local\Temp\46E7.tmp"86⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\4764.tmp"C:\Users\Admin\AppData\Local\Temp\4764.tmp"87⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\47F1.tmp"C:\Users\Admin\AppData\Local\Temp\47F1.tmp"88⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\485E.tmp"C:\Users\Admin\AppData\Local\Temp\485E.tmp"89⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\48FB.tmp"C:\Users\Admin\AppData\Local\Temp\48FB.tmp"90⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\4978.tmp"C:\Users\Admin\AppData\Local\Temp\4978.tmp"91⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\49E5.tmp"C:\Users\Admin\AppData\Local\Temp\49E5.tmp"92⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\4A72.tmp"C:\Users\Admin\AppData\Local\Temp\4A72.tmp"93⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\4B1D.tmp"C:\Users\Admin\AppData\Local\Temp\4B1D.tmp"94⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\4BE9.tmp"C:\Users\Admin\AppData\Local\Temp\4BE9.tmp"95⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\4C75.tmp"C:\Users\Admin\AppData\Local\Temp\4C75.tmp"96⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\4D11.tmp"C:\Users\Admin\AppData\Local\Temp\4D11.tmp"97⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\4E1B.tmp"C:\Users\Admin\AppData\Local\Temp\4E1B.tmp"98⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\4EA8.tmp"C:\Users\Admin\AppData\Local\Temp\4EA8.tmp"99⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\4F15.tmp"C:\Users\Admin\AppData\Local\Temp\4F15.tmp"100⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\4F92.tmp"C:\Users\Admin\AppData\Local\Temp\4F92.tmp"101⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\4FFF.tmp"C:\Users\Admin\AppData\Local\Temp\4FFF.tmp"102⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\5119.tmp"C:\Users\Admin\AppData\Local\Temp\5119.tmp"103⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\5196.tmp"C:\Users\Admin\AppData\Local\Temp\5196.tmp"104⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\5213.tmp"C:\Users\Admin\AppData\Local\Temp\5213.tmp"105⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\5280.tmp"C:\Users\Admin\AppData\Local\Temp\5280.tmp"106⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\535B.tmp"C:\Users\Admin\AppData\Local\Temp\535B.tmp"107⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\5445.tmp"C:\Users\Admin\AppData\Local\Temp\5445.tmp"108⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\54D2.tmp"C:\Users\Admin\AppData\Local\Temp\54D2.tmp"109⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\556E.tmp"C:\Users\Admin\AppData\Local\Temp\556E.tmp"110⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\562A.tmp"C:\Users\Admin\AppData\Local\Temp\562A.tmp"111⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\56A7.tmp"C:\Users\Admin\AppData\Local\Temp\56A7.tmp"112⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\5724.tmp"C:\Users\Admin\AppData\Local\Temp\5724.tmp"113⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\57B0.tmp"C:\Users\Admin\AppData\Local\Temp\57B0.tmp"114⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\581E.tmp"C:\Users\Admin\AppData\Local\Temp\581E.tmp"115⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\58AA.tmp"C:\Users\Admin\AppData\Local\Temp\58AA.tmp"116⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\5937.tmp"C:\Users\Admin\AppData\Local\Temp\5937.tmp"117⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\59D3.tmp"C:\Users\Admin\AppData\Local\Temp\59D3.tmp"118⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\5A60.tmp"C:\Users\Admin\AppData\Local\Temp\5A60.tmp"119⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\5AEC.tmp"C:\Users\Admin\AppData\Local\Temp\5AEC.tmp"120⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\5B69.tmp"C:\Users\Admin\AppData\Local\Temp\5B69.tmp"121⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\5C06.tmp"C:\Users\Admin\AppData\Local\Temp\5C06.tmp"122⤵PID:5028
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-