Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
16-08-2023 16:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
084197199e9c84cb53b3f957af8066d1_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
084197199e9c84cb53b3f957af8066d1_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
084197199e9c84cb53b3f957af8066d1_mafia_JC.exe
-
Size
486KB
-
MD5
084197199e9c84cb53b3f957af8066d1
-
SHA1
aef58b1c2d286c1d5a1040503796ceaf730ccb8b
-
SHA256
d5e05dab20cd0dec1fafc7ab1cc9d3499d15d705c127d7b7f29b9315928b0c6f
-
SHA512
47ba3c1b2ed30e694e846c01576e30c8578f3981690736060854d4abe39303cf3df8dff2f747e5a00b9dd34480977a6fbc8d1339be3d192f7d56c401b13658b8
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD72GtSDgf6l7xkvPuQXsKHijySatHoEako9sHm:/U5rCOTeiD3tSDgCl1tQhnImY2ENZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3312 903A.tmp 4288 90F5.tmp 560 91D0.tmp 2132 92BA.tmp 4392 9357.tmp 3964 9451.tmp 1932 94FC.tmp 4520 9616.tmp 3156 96B2.tmp 1320 979C.tmp 2864 9829.tmp 4264 98F4.tmp 1836 9990.tmp 224 9A5B.tmp 2632 9B36.tmp 4428 9C11.tmp 1660 9CAD.tmp 116 9D2A.tmp 4012 9DC6.tmp 3040 9E72.tmp 4212 9F2E.tmp 2040 9FE9.tmp 2728 A0D4.tmp 3124 A1BE.tmp 972 A24B.tmp 1800 A2E7.tmp 1464 A393.tmp 1604 A41F.tmp 3140 A4EB.tmp 2364 A5D5.tmp 4228 A6DF.tmp 4632 A77B.tmp 2684 A817.tmp 3516 A8A4.tmp 4276 A940.tmp 4280 A9FB.tmp 2304 AA98.tmp 2856 AB24.tmp 464 ABD0.tmp 2888 AC4D.tmp 4648 ACE9.tmp 4204 AD76.tmp 4456 AE12.tmp 3668 AE8F.tmp 1428 AF4B.tmp 1804 AFD7.tmp 3480 B074.tmp 4488 B100.tmp 4800 B16E.tmp 2268 B1FA.tmp 3616 B297.tmp 3312 B342.tmp 1716 B3A0.tmp 2876 B42D.tmp 4460 B4B9.tmp 3232 B536.tmp 4736 B5C3.tmp 2836 B650.tmp 1480 B6DC.tmp 3036 B779.tmp 5028 B7F6.tmp 4108 B882.tmp 3892 B8FF.tmp 4724 B96D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2980 wrote to memory of 3312 2980 084197199e9c84cb53b3f957af8066d1_mafia_JC.exe 81 PID 2980 wrote to memory of 3312 2980 084197199e9c84cb53b3f957af8066d1_mafia_JC.exe 81 PID 2980 wrote to memory of 3312 2980 084197199e9c84cb53b3f957af8066d1_mafia_JC.exe 81 PID 3312 wrote to memory of 4288 3312 903A.tmp 82 PID 3312 wrote to memory of 4288 3312 903A.tmp 82 PID 3312 wrote to memory of 4288 3312 903A.tmp 82 PID 4288 wrote to memory of 560 4288 90F5.tmp 83 PID 4288 wrote to memory of 560 4288 90F5.tmp 83 PID 4288 wrote to memory of 560 4288 90F5.tmp 83 PID 560 wrote to memory of 2132 560 91D0.tmp 84 PID 560 wrote to memory of 2132 560 91D0.tmp 84 PID 560 wrote to memory of 2132 560 91D0.tmp 84 PID 2132 wrote to memory of 4392 2132 92BA.tmp 85 PID 2132 wrote to memory of 4392 2132 92BA.tmp 85 PID 2132 wrote to memory of 4392 2132 92BA.tmp 85 PID 4392 wrote to memory of 3964 4392 9357.tmp 87 PID 4392 wrote to memory of 3964 4392 9357.tmp 87 PID 4392 wrote to memory of 3964 4392 9357.tmp 87 PID 3964 wrote to memory of 1932 3964 9451.tmp 88 PID 3964 wrote to memory of 1932 3964 9451.tmp 88 PID 3964 wrote to memory of 1932 3964 9451.tmp 88 PID 1932 wrote to memory of 4520 1932 94FC.tmp 89 PID 1932 wrote to memory of 4520 1932 94FC.tmp 89 PID 1932 wrote to memory of 4520 1932 94FC.tmp 89 PID 4520 wrote to memory of 3156 4520 9616.tmp 90 PID 4520 wrote to memory of 3156 4520 9616.tmp 90 PID 4520 wrote to memory of 3156 4520 9616.tmp 90 PID 3156 wrote to memory of 1320 3156 96B2.tmp 91 PID 3156 wrote to memory of 1320 3156 96B2.tmp 91 PID 3156 wrote to memory of 1320 3156 96B2.tmp 91 PID 1320 wrote to memory of 2864 1320 979C.tmp 92 PID 1320 wrote to memory of 2864 1320 979C.tmp 92 PID 1320 wrote to memory of 2864 1320 979C.tmp 92 PID 2864 wrote to memory of 4264 2864 9829.tmp 93 PID 2864 wrote to memory of 4264 2864 9829.tmp 93 PID 2864 wrote to memory of 4264 2864 9829.tmp 93 PID 4264 wrote to memory of 1836 4264 98F4.tmp 94 PID 4264 wrote to memory of 1836 4264 98F4.tmp 94 PID 4264 wrote to memory of 1836 4264 98F4.tmp 94 PID 1836 wrote to memory of 224 1836 9990.tmp 95 PID 1836 wrote to memory of 224 1836 9990.tmp 95 PID 1836 wrote to memory of 224 1836 9990.tmp 95 PID 224 wrote to memory of 2632 224 9A5B.tmp 96 PID 224 wrote to memory of 2632 224 9A5B.tmp 96 PID 224 wrote to memory of 2632 224 9A5B.tmp 96 PID 2632 wrote to memory of 4428 2632 9B36.tmp 97 PID 2632 wrote to memory of 4428 2632 9B36.tmp 97 PID 2632 wrote to memory of 4428 2632 9B36.tmp 97 PID 4428 wrote to memory of 1660 4428 9C11.tmp 98 PID 4428 wrote to memory of 1660 4428 9C11.tmp 98 PID 4428 wrote to memory of 1660 4428 9C11.tmp 98 PID 1660 wrote to memory of 116 1660 9CAD.tmp 99 PID 1660 wrote to memory of 116 1660 9CAD.tmp 99 PID 1660 wrote to memory of 116 1660 9CAD.tmp 99 PID 116 wrote to memory of 4012 116 9D2A.tmp 102 PID 116 wrote to memory of 4012 116 9D2A.tmp 102 PID 116 wrote to memory of 4012 116 9D2A.tmp 102 PID 4012 wrote to memory of 3040 4012 9DC6.tmp 103 PID 4012 wrote to memory of 3040 4012 9DC6.tmp 103 PID 4012 wrote to memory of 3040 4012 9DC6.tmp 103 PID 3040 wrote to memory of 4212 3040 9E72.tmp 104 PID 3040 wrote to memory of 4212 3040 9E72.tmp 104 PID 3040 wrote to memory of 4212 3040 9E72.tmp 104 PID 4212 wrote to memory of 2040 4212 9F2E.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\084197199e9c84cb53b3f957af8066d1_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\084197199e9c84cb53b3f957af8066d1_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\903A.tmp"C:\Users\Admin\AppData\Local\Temp\903A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\91D0.tmp"C:\Users\Admin\AppData\Local\Temp\91D0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\9451.tmp"C:\Users\Admin\AppData\Local\Temp\9451.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\94FC.tmp"C:\Users\Admin\AppData\Local\Temp\94FC.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\96B2.tmp"C:\Users\Admin\AppData\Local\Temp\96B2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\98F4.tmp"C:\Users\Admin\AppData\Local\Temp\98F4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\9E72.tmp"C:\Users\Admin\AppData\Local\Temp\9E72.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"23⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"24⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"25⤵
- Executes dropped EXE
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\A24B.tmp"C:\Users\Admin\AppData\Local\Temp\A24B.tmp"26⤵
- Executes dropped EXE
PID:972 -
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"27⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"28⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\A41F.tmp"C:\Users\Admin\AppData\Local\Temp\A41F.tmp"29⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"30⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"31⤵
- Executes dropped EXE
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"32⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"33⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\A817.tmp"C:\Users\Admin\AppData\Local\Temp\A817.tmp"34⤵
- Executes dropped EXE
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"35⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\A940.tmp"C:\Users\Admin\AppData\Local\Temp\A940.tmp"36⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"37⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"38⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"39⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"40⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"41⤵
- Executes dropped EXE
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"42⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\AD76.tmp"C:\Users\Admin\AppData\Local\Temp\AD76.tmp"43⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\AE12.tmp"C:\Users\Admin\AppData\Local\Temp\AE12.tmp"44⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"45⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"46⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"47⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\B074.tmp"C:\Users\Admin\AppData\Local\Temp\B074.tmp"48⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\B100.tmp"C:\Users\Admin\AppData\Local\Temp\B100.tmp"49⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"50⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"51⤵
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"52⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\B342.tmp"C:\Users\Admin\AppData\Local\Temp\B342.tmp"53⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"54⤵
- Executes dropped EXE
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\B42D.tmp"C:\Users\Admin\AppData\Local\Temp\B42D.tmp"55⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"56⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\B536.tmp"C:\Users\Admin\AppData\Local\Temp\B536.tmp"57⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"58⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\B650.tmp"C:\Users\Admin\AppData\Local\Temp\B650.tmp"59⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"60⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\B779.tmp"C:\Users\Admin\AppData\Local\Temp\B779.tmp"61⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"62⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\B882.tmp"C:\Users\Admin\AppData\Local\Temp\B882.tmp"63⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"64⤵
- Executes dropped EXE
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\B96D.tmp"C:\Users\Admin\AppData\Local\Temp\B96D.tmp"65⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"66⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\BA76.tmp"C:\Users\Admin\AppData\Local\Temp\BA76.tmp"67⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"68⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"69⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"70⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"71⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\BC99.tmp"C:\Users\Admin\AppData\Local\Temp\BC99.tmp"72⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\BD26.tmp"C:\Users\Admin\AppData\Local\Temp\BD26.tmp"73⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"74⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"75⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"76⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\BF29.tmp"C:\Users\Admin\AppData\Local\Temp\BF29.tmp"77⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"78⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\C052.tmp"C:\Users\Admin\AppData\Local\Temp\C052.tmp"79⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"80⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"81⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"82⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"83⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"84⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\C350.tmp"C:\Users\Admin\AppData\Local\Temp\C350.tmp"85⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"86⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\C479.tmp"C:\Users\Admin\AppData\Local\Temp\C479.tmp"87⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\C534.tmp"C:\Users\Admin\AppData\Local\Temp\C534.tmp"88⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"89⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\C64D.tmp"C:\Users\Admin\AppData\Local\Temp\C64D.tmp"90⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"91⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\C709.tmp"C:\Users\Admin\AppData\Local\Temp\C709.tmp"92⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"93⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\C813.tmp"C:\Users\Admin\AppData\Local\Temp\C813.tmp"94⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\C89F.tmp"C:\Users\Admin\AppData\Local\Temp\C89F.tmp"95⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\C92C.tmp"C:\Users\Admin\AppData\Local\Temp\C92C.tmp"96⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\C999.tmp"C:\Users\Admin\AppData\Local\Temp\C999.tmp"97⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\CA16.tmp"C:\Users\Admin\AppData\Local\Temp\CA16.tmp"98⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\CA84.tmp"C:\Users\Admin\AppData\Local\Temp\CA84.tmp"99⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\CB10.tmp"C:\Users\Admin\AppData\Local\Temp\CB10.tmp"100⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\CBAC.tmp"C:\Users\Admin\AppData\Local\Temp\CBAC.tmp"101⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\CC29.tmp"C:\Users\Admin\AppData\Local\Temp\CC29.tmp"102⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"103⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\CD43.tmp"C:\Users\Admin\AppData\Local\Temp\CD43.tmp"104⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\CDC0.tmp"C:\Users\Admin\AppData\Local\Temp\CDC0.tmp"105⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"106⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"107⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\CF37.tmp"C:\Users\Admin\AppData\Local\Temp\CF37.tmp"108⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"109⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\D040.tmp"C:\Users\Admin\AppData\Local\Temp\D040.tmp"110⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"111⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\D15A.tmp"C:\Users\Admin\AppData\Local\Temp\D15A.tmp"112⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\D1D7.tmp"C:\Users\Admin\AppData\Local\Temp\D1D7.tmp"113⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\D254.tmp"C:\Users\Admin\AppData\Local\Temp\D254.tmp"114⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"115⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\D37C.tmp"C:\Users\Admin\AppData\Local\Temp\D37C.tmp"116⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\D3F9.tmp"C:\Users\Admin\AppData\Local\Temp\D3F9.tmp"117⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\D476.tmp"C:\Users\Admin\AppData\Local\Temp\D476.tmp"118⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\D503.tmp"C:\Users\Admin\AppData\Local\Temp\D503.tmp"119⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\D59F.tmp"C:\Users\Admin\AppData\Local\Temp\D59F.tmp"120⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\D62C.tmp"C:\Users\Admin\AppData\Local\Temp\D62C.tmp"121⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"122⤵PID:3944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-