Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
05/08/2023, 14:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
74c627df8fd489bd29d4a53d6424a300_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
74c627df8fd489bd29d4a53d6424a300_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
74c627df8fd489bd29d4a53d6424a300_mafia_JC.exe
-
Size
486KB
-
MD5
74c627df8fd489bd29d4a53d6424a300
-
SHA1
39c99678d956e1f40a7e08955d9ccf6126a00623
-
SHA256
4a803f225d3fad1fdb6b59c20ca5a1b9b255f119c981069563d99024811075b9
-
SHA512
d7b96a611dc320a3b17a597120f3f52b55cec554335dfbbed601b6515b11412225ede641126f4a289236dcb509b97ba1420f51877fd28f65dc3af52009fb204c
-
SSDEEP
12288:/U5rCOTeiD31LhlaO5EsRNe53VC0sfukrwSABNZ:/UQOJD31gs6537sfzABN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1828 1CAB.tmp 1236 1DF3.tmp 3276 1EAE.tmp 2820 1F6A.tmp 1140 2025.tmp 1896 216E.tmp 4468 2268.tmp 2724 2362.tmp 4968 246B.tmp 4624 2556.tmp 1748 267E.tmp 4444 274A.tmp 4036 2824.tmp 2016 28D0.tmp 4224 29BB.tmp 224 2A86.tmp 5076 2B22.tmp 380 2C0C.tmp 2916 2CF7.tmp 2128 2DE1.tmp 3936 2ECB.tmp 1112 2FC5.tmp 3864 3081.tmp 1960 310E.tmp 756 31C9.tmp 1248 32B3.tmp 4380 335F.tmp 5092 344A.tmp 672 3515.tmp 3860 360F.tmp 1492 36F9.tmp 860 3803.tmp 1256 38ED.tmp 3600 39A9.tmp 2940 3A93.tmp 4092 3B20.tmp 2040 3C0A.tmp 4676 3C97.tmp 4124 3D14.tmp 4892 3DFE.tmp 4352 3EAA.tmp 772 3F27.tmp 4476 3F94.tmp 3888 4011.tmp 3892 409E.tmp 4584 411B.tmp 2496 4198.tmp 1464 4244.tmp 1584 42E0.tmp 4340 435D.tmp 5012 43F9.tmp 4028 4486.tmp 1596 4541.tmp 4164 460D.tmp 4156 468A.tmp 5084 4735.tmp 4684 47B2.tmp 2564 485E.tmp 3276 48FB.tmp 1080 49C6.tmp 892 4AEF.tmp 4372 4B5C.tmp 1896 4BC9.tmp 5004 4C37.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1004 wrote to memory of 1828 1004 74c627df8fd489bd29d4a53d6424a300_mafia_JC.exe 81 PID 1004 wrote to memory of 1828 1004 74c627df8fd489bd29d4a53d6424a300_mafia_JC.exe 81 PID 1004 wrote to memory of 1828 1004 74c627df8fd489bd29d4a53d6424a300_mafia_JC.exe 81 PID 1828 wrote to memory of 1236 1828 1CAB.tmp 82 PID 1828 wrote to memory of 1236 1828 1CAB.tmp 82 PID 1828 wrote to memory of 1236 1828 1CAB.tmp 82 PID 1236 wrote to memory of 3276 1236 1DF3.tmp 83 PID 1236 wrote to memory of 3276 1236 1DF3.tmp 83 PID 1236 wrote to memory of 3276 1236 1DF3.tmp 83 PID 3276 wrote to memory of 2820 3276 1EAE.tmp 84 PID 3276 wrote to memory of 2820 3276 1EAE.tmp 84 PID 3276 wrote to memory of 2820 3276 1EAE.tmp 84 PID 2820 wrote to memory of 1140 2820 1F6A.tmp 85 PID 2820 wrote to memory of 1140 2820 1F6A.tmp 85 PID 2820 wrote to memory of 1140 2820 1F6A.tmp 85 PID 1140 wrote to memory of 1896 1140 2025.tmp 86 PID 1140 wrote to memory of 1896 1140 2025.tmp 86 PID 1140 wrote to memory of 1896 1140 2025.tmp 86 PID 1896 wrote to memory of 4468 1896 216E.tmp 87 PID 1896 wrote to memory of 4468 1896 216E.tmp 87 PID 1896 wrote to memory of 4468 1896 216E.tmp 87 PID 4468 wrote to memory of 2724 4468 2268.tmp 88 PID 4468 wrote to memory of 2724 4468 2268.tmp 88 PID 4468 wrote to memory of 2724 4468 2268.tmp 88 PID 2724 wrote to memory of 4968 2724 2362.tmp 89 PID 2724 wrote to memory of 4968 2724 2362.tmp 89 PID 2724 wrote to memory of 4968 2724 2362.tmp 89 PID 4968 wrote to memory of 4624 4968 246B.tmp 90 PID 4968 wrote to memory of 4624 4968 246B.tmp 90 PID 4968 wrote to memory of 4624 4968 246B.tmp 90 PID 4624 wrote to memory of 1748 4624 2556.tmp 91 PID 4624 wrote to memory of 1748 4624 2556.tmp 91 PID 4624 wrote to memory of 1748 4624 2556.tmp 91 PID 1748 wrote to memory of 4444 1748 267E.tmp 92 PID 1748 wrote to memory of 4444 1748 267E.tmp 92 PID 1748 wrote to memory of 4444 1748 267E.tmp 92 PID 4444 wrote to memory of 4036 4444 274A.tmp 93 PID 4444 wrote to memory of 4036 4444 274A.tmp 93 PID 4444 wrote to memory of 4036 4444 274A.tmp 93 PID 4036 wrote to memory of 2016 4036 2824.tmp 94 PID 4036 wrote to memory of 2016 4036 2824.tmp 94 PID 4036 wrote to memory of 2016 4036 2824.tmp 94 PID 2016 wrote to memory of 4224 2016 28D0.tmp 95 PID 2016 wrote to memory of 4224 2016 28D0.tmp 95 PID 2016 wrote to memory of 4224 2016 28D0.tmp 95 PID 4224 wrote to memory of 224 4224 29BB.tmp 96 PID 4224 wrote to memory of 224 4224 29BB.tmp 96 PID 4224 wrote to memory of 224 4224 29BB.tmp 96 PID 224 wrote to memory of 5076 224 2A86.tmp 98 PID 224 wrote to memory of 5076 224 2A86.tmp 98 PID 224 wrote to memory of 5076 224 2A86.tmp 98 PID 5076 wrote to memory of 380 5076 2B22.tmp 99 PID 5076 wrote to memory of 380 5076 2B22.tmp 99 PID 5076 wrote to memory of 380 5076 2B22.tmp 99 PID 380 wrote to memory of 2916 380 2C0C.tmp 100 PID 380 wrote to memory of 2916 380 2C0C.tmp 100 PID 380 wrote to memory of 2916 380 2C0C.tmp 100 PID 2916 wrote to memory of 2128 2916 2CF7.tmp 101 PID 2916 wrote to memory of 2128 2916 2CF7.tmp 101 PID 2916 wrote to memory of 2128 2916 2CF7.tmp 101 PID 2128 wrote to memory of 3936 2128 2DE1.tmp 102 PID 2128 wrote to memory of 3936 2128 2DE1.tmp 102 PID 2128 wrote to memory of 3936 2128 2DE1.tmp 102 PID 3936 wrote to memory of 1112 3936 2ECB.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\74c627df8fd489bd29d4a53d6424a300_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\74c627df8fd489bd29d4a53d6424a300_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\1DF3.tmp"C:\Users\Admin\AppData\Local\Temp\1DF3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\1F6A.tmp"C:\Users\Admin\AppData\Local\Temp\1F6A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\2025.tmp"C:\Users\Admin\AppData\Local\Temp\2025.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\216E.tmp"C:\Users\Admin\AppData\Local\Temp\216E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\2268.tmp"C:\Users\Admin\AppData\Local\Temp\2268.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\2362.tmp"C:\Users\Admin\AppData\Local\Temp\2362.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\246B.tmp"C:\Users\Admin\AppData\Local\Temp\246B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\2556.tmp"C:\Users\Admin\AppData\Local\Temp\2556.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\267E.tmp"C:\Users\Admin\AppData\Local\Temp\267E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\274A.tmp"C:\Users\Admin\AppData\Local\Temp\274A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\2824.tmp"C:\Users\Admin\AppData\Local\Temp\2824.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\28D0.tmp"C:\Users\Admin\AppData\Local\Temp\28D0.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\29BB.tmp"C:\Users\Admin\AppData\Local\Temp\29BB.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\2A86.tmp"C:\Users\Admin\AppData\Local\Temp\2A86.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\2B22.tmp"C:\Users\Admin\AppData\Local\Temp\2B22.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\2C0C.tmp"C:\Users\Admin\AppData\Local\Temp\2C0C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\2CF7.tmp"C:\Users\Admin\AppData\Local\Temp\2CF7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\2DE1.tmp"C:\Users\Admin\AppData\Local\Temp\2DE1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\2ECB.tmp"C:\Users\Admin\AppData\Local\Temp\2ECB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\2FC5.tmp"C:\Users\Admin\AppData\Local\Temp\2FC5.tmp"23⤵
- Executes dropped EXE
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\3081.tmp"C:\Users\Admin\AppData\Local\Temp\3081.tmp"24⤵
- Executes dropped EXE
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\310E.tmp"C:\Users\Admin\AppData\Local\Temp\310E.tmp"25⤵
- Executes dropped EXE
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\31C9.tmp"C:\Users\Admin\AppData\Local\Temp\31C9.tmp"26⤵
- Executes dropped EXE
PID:756 -
C:\Users\Admin\AppData\Local\Temp\32B3.tmp"C:\Users\Admin\AppData\Local\Temp\32B3.tmp"27⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\335F.tmp"C:\Users\Admin\AppData\Local\Temp\335F.tmp"28⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"29⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\3515.tmp"C:\Users\Admin\AppData\Local\Temp\3515.tmp"30⤵
- Executes dropped EXE
PID:672 -
C:\Users\Admin\AppData\Local\Temp\360F.tmp"C:\Users\Admin\AppData\Local\Temp\360F.tmp"31⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\36F9.tmp"C:\Users\Admin\AppData\Local\Temp\36F9.tmp"32⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\3803.tmp"C:\Users\Admin\AppData\Local\Temp\3803.tmp"33⤵
- Executes dropped EXE
PID:860 -
C:\Users\Admin\AppData\Local\Temp\38ED.tmp"C:\Users\Admin\AppData\Local\Temp\38ED.tmp"34⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\39A9.tmp"C:\Users\Admin\AppData\Local\Temp\39A9.tmp"35⤵
- Executes dropped EXE
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\3A93.tmp"C:\Users\Admin\AppData\Local\Temp\3A93.tmp"36⤵
- Executes dropped EXE
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\3B20.tmp"C:\Users\Admin\AppData\Local\Temp\3B20.tmp"37⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\3C0A.tmp"C:\Users\Admin\AppData\Local\Temp\3C0A.tmp"38⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\3C97.tmp"C:\Users\Admin\AppData\Local\Temp\3C97.tmp"39⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\3D14.tmp"C:\Users\Admin\AppData\Local\Temp\3D14.tmp"40⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\3DFE.tmp"C:\Users\Admin\AppData\Local\Temp\3DFE.tmp"41⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"42⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\3F27.tmp"C:\Users\Admin\AppData\Local\Temp\3F27.tmp"43⤵
- Executes dropped EXE
PID:772 -
C:\Users\Admin\AppData\Local\Temp\3F94.tmp"C:\Users\Admin\AppData\Local\Temp\3F94.tmp"44⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\4011.tmp"C:\Users\Admin\AppData\Local\Temp\4011.tmp"45⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\409E.tmp"C:\Users\Admin\AppData\Local\Temp\409E.tmp"46⤵
- Executes dropped EXE
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\411B.tmp"C:\Users\Admin\AppData\Local\Temp\411B.tmp"47⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\4198.tmp"C:\Users\Admin\AppData\Local\Temp\4198.tmp"48⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\4244.tmp"C:\Users\Admin\AppData\Local\Temp\4244.tmp"49⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\42E0.tmp"C:\Users\Admin\AppData\Local\Temp\42E0.tmp"50⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\435D.tmp"C:\Users\Admin\AppData\Local\Temp\435D.tmp"51⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\43F9.tmp"C:\Users\Admin\AppData\Local\Temp\43F9.tmp"52⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\4486.tmp"C:\Users\Admin\AppData\Local\Temp\4486.tmp"53⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\4541.tmp"C:\Users\Admin\AppData\Local\Temp\4541.tmp"54⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\460D.tmp"C:\Users\Admin\AppData\Local\Temp\460D.tmp"55⤵
- Executes dropped EXE
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\468A.tmp"C:\Users\Admin\AppData\Local\Temp\468A.tmp"56⤵
- Executes dropped EXE
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\4735.tmp"C:\Users\Admin\AppData\Local\Temp\4735.tmp"57⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\47B2.tmp"C:\Users\Admin\AppData\Local\Temp\47B2.tmp"58⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\485E.tmp"C:\Users\Admin\AppData\Local\Temp\485E.tmp"59⤵
- Executes dropped EXE
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\48FB.tmp"C:\Users\Admin\AppData\Local\Temp\48FB.tmp"60⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\49C6.tmp"C:\Users\Admin\AppData\Local\Temp\49C6.tmp"61⤵
- Executes dropped EXE
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\4AEF.tmp"C:\Users\Admin\AppData\Local\Temp\4AEF.tmp"62⤵
- Executes dropped EXE
PID:892 -
C:\Users\Admin\AppData\Local\Temp\4B5C.tmp"C:\Users\Admin\AppData\Local\Temp\4B5C.tmp"63⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\4BC9.tmp"C:\Users\Admin\AppData\Local\Temp\4BC9.tmp"64⤵
- Executes dropped EXE
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\4C37.tmp"C:\Users\Admin\AppData\Local\Temp\4C37.tmp"65⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\4DAE.tmp"C:\Users\Admin\AppData\Local\Temp\4DAE.tmp"66⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\4E2B.tmp"C:\Users\Admin\AppData\Local\Temp\4E2B.tmp"67⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\4F34.tmp"C:\Users\Admin\AppData\Local\Temp\4F34.tmp"68⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\4FA2.tmp"C:\Users\Admin\AppData\Local\Temp\4FA2.tmp"69⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\501F.tmp"C:\Users\Admin\AppData\Local\Temp\501F.tmp"70⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\50CB.tmp"C:\Users\Admin\AppData\Local\Temp\50CB.tmp"71⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\5157.tmp"C:\Users\Admin\AppData\Local\Temp\5157.tmp"72⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\5203.tmp"C:\Users\Admin\AppData\Local\Temp\5203.tmp"73⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\5280.tmp"C:\Users\Admin\AppData\Local\Temp\5280.tmp"74⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\536A.tmp"C:\Users\Admin\AppData\Local\Temp\536A.tmp"75⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\53D8.tmp"C:\Users\Admin\AppData\Local\Temp\53D8.tmp"76⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\5474.tmp"C:\Users\Admin\AppData\Local\Temp\5474.tmp"77⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\5501.tmp"C:\Users\Admin\AppData\Local\Temp\5501.tmp"78⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\55AD.tmp"C:\Users\Admin\AppData\Local\Temp\55AD.tmp"79⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\5639.tmp"C:\Users\Admin\AppData\Local\Temp\5639.tmp"80⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\56D5.tmp"C:\Users\Admin\AppData\Local\Temp\56D5.tmp"81⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\5752.tmp"C:\Users\Admin\AppData\Local\Temp\5752.tmp"82⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\57DF.tmp"C:\Users\Admin\AppData\Local\Temp\57DF.tmp"83⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\585C.tmp"C:\Users\Admin\AppData\Local\Temp\585C.tmp"84⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\58E9.tmp"C:\Users\Admin\AppData\Local\Temp\58E9.tmp"85⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\5975.tmp"C:\Users\Admin\AppData\Local\Temp\5975.tmp"86⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\59F2.tmp"C:\Users\Admin\AppData\Local\Temp\59F2.tmp"87⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"88⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\5B1B.tmp"C:\Users\Admin\AppData\Local\Temp\5B1B.tmp"89⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\5B79.tmp"C:\Users\Admin\AppData\Local\Temp\5B79.tmp"90⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\5C44.tmp"C:\Users\Admin\AppData\Local\Temp\5C44.tmp"91⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\5CC1.tmp"C:\Users\Admin\AppData\Local\Temp\5CC1.tmp"92⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\5D2E.tmp"C:\Users\Admin\AppData\Local\Temp\5D2E.tmp"93⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\5DAB.tmp"C:\Users\Admin\AppData\Local\Temp\5DAB.tmp"94⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\5E67.tmp"C:\Users\Admin\AppData\Local\Temp\5E67.tmp"95⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"96⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\5F71.tmp"C:\Users\Admin\AppData\Local\Temp\5F71.tmp"97⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\5FEE.tmp"C:\Users\Admin\AppData\Local\Temp\5FEE.tmp"98⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\607A.tmp"C:\Users\Admin\AppData\Local\Temp\607A.tmp"99⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\6107.tmp"C:\Users\Admin\AppData\Local\Temp\6107.tmp"100⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\62CC.tmp"C:\Users\Admin\AppData\Local\Temp\62CC.tmp"101⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\6349.tmp"C:\Users\Admin\AppData\Local\Temp\6349.tmp"102⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\63F5.tmp"C:\Users\Admin\AppData\Local\Temp\63F5.tmp"103⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\6462.tmp"C:\Users\Admin\AppData\Local\Temp\6462.tmp"104⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\64DF.tmp"C:\Users\Admin\AppData\Local\Temp\64DF.tmp"105⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\655C.tmp"C:\Users\Admin\AppData\Local\Temp\655C.tmp"106⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\65CA.tmp"C:\Users\Admin\AppData\Local\Temp\65CA.tmp"107⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\6647.tmp"C:\Users\Admin\AppData\Local\Temp\6647.tmp"108⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\66C4.tmp"C:\Users\Admin\AppData\Local\Temp\66C4.tmp"109⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\6741.tmp"C:\Users\Admin\AppData\Local\Temp\6741.tmp"110⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\67DD.tmp"C:\Users\Admin\AppData\Local\Temp\67DD.tmp"111⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\685A.tmp"C:\Users\Admin\AppData\Local\Temp\685A.tmp"112⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\68F6.tmp"C:\Users\Admin\AppData\Local\Temp\68F6.tmp"113⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\6973.tmp"C:\Users\Admin\AppData\Local\Temp\6973.tmp"114⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\6A0F.tmp"C:\Users\Admin\AppData\Local\Temp\6A0F.tmp"115⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\6AAC.tmp"C:\Users\Admin\AppData\Local\Temp\6AAC.tmp"116⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\6B09.tmp"C:\Users\Admin\AppData\Local\Temp\6B09.tmp"117⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\6B96.tmp"C:\Users\Admin\AppData\Local\Temp\6B96.tmp"118⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\6C32.tmp"C:\Users\Admin\AppData\Local\Temp\6C32.tmp"119⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\6CBF.tmp"C:\Users\Admin\AppData\Local\Temp\6CBF.tmp"120⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\6D6B.tmp"C:\Users\Admin\AppData\Local\Temp\6D6B.tmp"121⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\6E07.tmp"C:\Users\Admin\AppData\Local\Temp\6E07.tmp"122⤵PID:1728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-