Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
22-08-2023 15:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
691c13c3045a8b14644c9854a38a3ee9_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
691c13c3045a8b14644c9854a38a3ee9_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
691c13c3045a8b14644c9854a38a3ee9_mafia_JC.exe
-
Size
486KB
-
MD5
691c13c3045a8b14644c9854a38a3ee9
-
SHA1
62923aec66044848c21d033027976df724b5ad9f
-
SHA256
8ac46b8b98bbd45e77dd2ec529ada397dcfa866473e80529d151e4fcd14d243b
-
SHA512
f92788befd50afecc3d50027bf0a26ada6eb6136d908b21f1d40a456ae8c6284510bf854198d0ab48f68f5b2f585d9eff748880fb25031d024feda5c9312b29a
-
SSDEEP
12288:oU5rCOTeiDnVd1tjCyFm6yiIL2YWD4DNZ:oUQOJD9jYW4N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1492 9097.tmp 2916 9163.tmp 2928 922E.tmp 3780 9328.tmp 4404 93D4.tmp 2104 9441.tmp 2372 952B.tmp 4132 9625.tmp 4908 96D1.tmp 2200 97CB.tmp 4108 99CF.tmp 5000 9A3C.tmp 1844 9B17.tmp 2272 9C01.tmp 4520 9D88.tmp 4332 9E43.tmp 4872 9EEF.tmp 4496 9F5D.tmp 4832 A028.tmp 4116 A0C4.tmp 4016 A180.tmp 3376 A22B.tmp 4844 A2E7.tmp 1504 A3B2.tmp 3252 A49C.tmp 3396 A529.tmp 1840 A604.tmp 3328 A6BF.tmp 1832 A78A.tmp 3828 A8A4.tmp 4036 A95F.tmp 2028 AA4A.tmp 1148 AAF5.tmp 4552 ABA1.tmp 4796 AC4D.tmp 3864 ACDA.tmp 1076 AD66.tmp 4440 AE12.tmp 4972 AECE.tmp 4728 AF7A.tmp 2360 B026.tmp 756 B0C2.tmp 4484 B14E.tmp 1708 B1DB.tmp 4336 B268.tmp 3020 B2F4.tmp 4268 B381.tmp 2984 B3EE.tmp 4360 B48B.tmp 1548 B517.tmp 1712 B594.tmp 472 B630.tmp 2808 B69E.tmp 4976 B71B.tmp 1360 B7A7.tmp 1448 B844.tmp 2716 B8B1.tmp 4760 B95D.tmp 1736 B9EA.tmp 4716 BA86.tmp 3780 BB12.tmp 1348 BBCE.tmp 2404 BC4B.tmp 1956 BCC8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 472 wrote to memory of 1492 472 691c13c3045a8b14644c9854a38a3ee9_mafia_JC.exe 81 PID 472 wrote to memory of 1492 472 691c13c3045a8b14644c9854a38a3ee9_mafia_JC.exe 81 PID 472 wrote to memory of 1492 472 691c13c3045a8b14644c9854a38a3ee9_mafia_JC.exe 81 PID 1492 wrote to memory of 2916 1492 9097.tmp 82 PID 1492 wrote to memory of 2916 1492 9097.tmp 82 PID 1492 wrote to memory of 2916 1492 9097.tmp 82 PID 2916 wrote to memory of 2928 2916 9163.tmp 83 PID 2916 wrote to memory of 2928 2916 9163.tmp 83 PID 2916 wrote to memory of 2928 2916 9163.tmp 83 PID 2928 wrote to memory of 3780 2928 922E.tmp 84 PID 2928 wrote to memory of 3780 2928 922E.tmp 84 PID 2928 wrote to memory of 3780 2928 922E.tmp 84 PID 3780 wrote to memory of 4404 3780 9328.tmp 85 PID 3780 wrote to memory of 4404 3780 9328.tmp 85 PID 3780 wrote to memory of 4404 3780 9328.tmp 85 PID 4404 wrote to memory of 2104 4404 93D4.tmp 86 PID 4404 wrote to memory of 2104 4404 93D4.tmp 86 PID 4404 wrote to memory of 2104 4404 93D4.tmp 86 PID 2104 wrote to memory of 2372 2104 9441.tmp 87 PID 2104 wrote to memory of 2372 2104 9441.tmp 87 PID 2104 wrote to memory of 2372 2104 9441.tmp 87 PID 2372 wrote to memory of 4132 2372 952B.tmp 88 PID 2372 wrote to memory of 4132 2372 952B.tmp 88 PID 2372 wrote to memory of 4132 2372 952B.tmp 88 PID 4132 wrote to memory of 4908 4132 9625.tmp 89 PID 4132 wrote to memory of 4908 4132 9625.tmp 89 PID 4132 wrote to memory of 4908 4132 9625.tmp 89 PID 4908 wrote to memory of 2200 4908 96D1.tmp 90 PID 4908 wrote to memory of 2200 4908 96D1.tmp 90 PID 4908 wrote to memory of 2200 4908 96D1.tmp 90 PID 2200 wrote to memory of 4108 2200 97CB.tmp 93 PID 2200 wrote to memory of 4108 2200 97CB.tmp 93 PID 2200 wrote to memory of 4108 2200 97CB.tmp 93 PID 4108 wrote to memory of 5000 4108 99CF.tmp 94 PID 4108 wrote to memory of 5000 4108 99CF.tmp 94 PID 4108 wrote to memory of 5000 4108 99CF.tmp 94 PID 5000 wrote to memory of 1844 5000 9A3C.tmp 95 PID 5000 wrote to memory of 1844 5000 9A3C.tmp 95 PID 5000 wrote to memory of 1844 5000 9A3C.tmp 95 PID 1844 wrote to memory of 2272 1844 9B17.tmp 96 PID 1844 wrote to memory of 2272 1844 9B17.tmp 96 PID 1844 wrote to memory of 2272 1844 9B17.tmp 96 PID 2272 wrote to memory of 4520 2272 9C01.tmp 97 PID 2272 wrote to memory of 4520 2272 9C01.tmp 97 PID 2272 wrote to memory of 4520 2272 9C01.tmp 97 PID 4520 wrote to memory of 4332 4520 9D88.tmp 99 PID 4520 wrote to memory of 4332 4520 9D88.tmp 99 PID 4520 wrote to memory of 4332 4520 9D88.tmp 99 PID 4332 wrote to memory of 4872 4332 9E43.tmp 100 PID 4332 wrote to memory of 4872 4332 9E43.tmp 100 PID 4332 wrote to memory of 4872 4332 9E43.tmp 100 PID 4872 wrote to memory of 4496 4872 9EEF.tmp 101 PID 4872 wrote to memory of 4496 4872 9EEF.tmp 101 PID 4872 wrote to memory of 4496 4872 9EEF.tmp 101 PID 4496 wrote to memory of 4832 4496 9F5D.tmp 103 PID 4496 wrote to memory of 4832 4496 9F5D.tmp 103 PID 4496 wrote to memory of 4832 4496 9F5D.tmp 103 PID 4832 wrote to memory of 4116 4832 A028.tmp 104 PID 4832 wrote to memory of 4116 4832 A028.tmp 104 PID 4832 wrote to memory of 4116 4832 A028.tmp 104 PID 4116 wrote to memory of 4016 4116 A0C4.tmp 105 PID 4116 wrote to memory of 4016 4116 A0C4.tmp 105 PID 4116 wrote to memory of 4016 4116 A0C4.tmp 105 PID 4016 wrote to memory of 3376 4016 A180.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\691c13c3045a8b14644c9854a38a3ee9_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\691c13c3045a8b14644c9854a38a3ee9_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Users\Admin\AppData\Local\Temp\9097.tmp"C:\Users\Admin\AppData\Local\Temp\9097.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\9163.tmp"C:\Users\Admin\AppData\Local\Temp\9163.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\922E.tmp"C:\Users\Admin\AppData\Local\Temp\922E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\9328.tmp"C:\Users\Admin\AppData\Local\Temp\9328.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\9441.tmp"C:\Users\Admin\AppData\Local\Temp\9441.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\9625.tmp"C:\Users\Admin\AppData\Local\Temp\9625.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\96D1.tmp"C:\Users\Admin\AppData\Local\Temp\96D1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\97CB.tmp"C:\Users\Admin\AppData\Local\Temp\97CB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\A028.tmp"C:\Users\Admin\AppData\Local\Temp\A028.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\A180.tmp"C:\Users\Admin\AppData\Local\Temp\A180.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"23⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"24⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"25⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"26⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"27⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"28⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"29⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\A78A.tmp"C:\Users\Admin\AppData\Local\Temp\A78A.tmp"30⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"31⤵
- Executes dropped EXE
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"32⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"33⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"34⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"35⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"36⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"37⤵
- Executes dropped EXE
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\AD66.tmp"C:\Users\Admin\AppData\Local\Temp\AD66.tmp"38⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\AE12.tmp"C:\Users\Admin\AppData\Local\Temp\AE12.tmp"39⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\AECE.tmp"C:\Users\Admin\AppData\Local\Temp\AECE.tmp"40⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"41⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"42⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"43⤵
- Executes dropped EXE
PID:756 -
C:\Users\Admin\AppData\Local\Temp\B14E.tmp"C:\Users\Admin\AppData\Local\Temp\B14E.tmp"44⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"45⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\B268.tmp"C:\Users\Admin\AppData\Local\Temp\B268.tmp"46⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"47⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\B381.tmp"C:\Users\Admin\AppData\Local\Temp\B381.tmp"48⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"49⤵
- Executes dropped EXE
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\B48B.tmp"C:\Users\Admin\AppData\Local\Temp\B48B.tmp"50⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\B517.tmp"C:\Users\Admin\AppData\Local\Temp\B517.tmp"51⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\B594.tmp"C:\Users\Admin\AppData\Local\Temp\B594.tmp"52⤵
- Executes dropped EXE
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"53⤵
- Executes dropped EXE
PID:472 -
C:\Users\Admin\AppData\Local\Temp\B69E.tmp"C:\Users\Admin\AppData\Local\Temp\B69E.tmp"54⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\B71B.tmp"C:\Users\Admin\AppData\Local\Temp\B71B.tmp"55⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"56⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\B844.tmp"C:\Users\Admin\AppData\Local\Temp\B844.tmp"57⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"58⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\B95D.tmp"C:\Users\Admin\AppData\Local\Temp\B95D.tmp"59⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"60⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\BA86.tmp"C:\Users\Admin\AppData\Local\Temp\BA86.tmp"61⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\BB12.tmp"C:\Users\Admin\AppData\Local\Temp\BB12.tmp"62⤵
- Executes dropped EXE
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"63⤵
- Executes dropped EXE
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"64⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"65⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\BD45.tmp"C:\Users\Admin\AppData\Local\Temp\BD45.tmp"66⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"67⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"68⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"69⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\BF29.tmp"C:\Users\Admin\AppData\Local\Temp\BF29.tmp"70⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\BF97.tmp"C:\Users\Admin\AppData\Local\Temp\BF97.tmp"71⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\C014.tmp"C:\Users\Admin\AppData\Local\Temp\C014.tmp"72⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"73⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\C10E.tmp"C:\Users\Admin\AppData\Local\Temp\C10E.tmp"74⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"75⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"76⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"77⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"78⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\C36F.tmp"C:\Users\Admin\AppData\Local\Temp\C36F.tmp"79⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"80⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\C469.tmp"C:\Users\Admin\AppData\Local\Temp\C469.tmp"81⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"82⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\C563.tmp"C:\Users\Admin\AppData\Local\Temp\C563.tmp"83⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"84⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\C65D.tmp"C:\Users\Admin\AppData\Local\Temp\C65D.tmp"85⤵PID:492
-
C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"86⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\C776.tmp"C:\Users\Admin\AppData\Local\Temp\C776.tmp"87⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\C7E4.tmp"C:\Users\Admin\AppData\Local\Temp\C7E4.tmp"88⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\C841.tmp"C:\Users\Admin\AppData\Local\Temp\C841.tmp"89⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"90⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\C91C.tmp"C:\Users\Admin\AppData\Local\Temp\C91C.tmp"91⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"92⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\CA26.tmp"C:\Users\Admin\AppData\Local\Temp\CA26.tmp"93⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\CAB2.tmp"C:\Users\Admin\AppData\Local\Temp\CAB2.tmp"94⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"95⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"96⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\CC29.tmp"C:\Users\Admin\AppData\Local\Temp\CC29.tmp"97⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\CC97.tmp"C:\Users\Admin\AppData\Local\Temp\CC97.tmp"98⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\CD23.tmp"C:\Users\Admin\AppData\Local\Temp\CD23.tmp"99⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"100⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"101⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\CEAA.tmp"C:\Users\Admin\AppData\Local\Temp\CEAA.tmp"102⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\CF27.tmp"C:\Users\Admin\AppData\Local\Temp\CF27.tmp"103⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"104⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\D021.tmp"C:\Users\Admin\AppData\Local\Temp\D021.tmp"105⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\D09E.tmp"C:\Users\Admin\AppData\Local\Temp\D09E.tmp"106⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\D13A.tmp"C:\Users\Admin\AppData\Local\Temp\D13A.tmp"107⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"108⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\D234.tmp"C:\Users\Admin\AppData\Local\Temp\D234.tmp"109⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\D292.tmp"C:\Users\Admin\AppData\Local\Temp\D292.tmp"110⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\D31F.tmp"C:\Users\Admin\AppData\Local\Temp\D31F.tmp"111⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\D39C.tmp"C:\Users\Admin\AppData\Local\Temp\D39C.tmp"112⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\D438.tmp"C:\Users\Admin\AppData\Local\Temp\D438.tmp"113⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"114⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\D532.tmp"C:\Users\Admin\AppData\Local\Temp\D532.tmp"115⤵PID:496
-
C:\Users\Admin\AppData\Local\Temp\D5BF.tmp"C:\Users\Admin\AppData\Local\Temp\D5BF.tmp"116⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\D63C.tmp"C:\Users\Admin\AppData\Local\Temp\D63C.tmp"117⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"118⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\D764.tmp"C:\Users\Admin\AppData\Local\Temp\D764.tmp"119⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\D7E1.tmp"C:\Users\Admin\AppData\Local\Temp\D7E1.tmp"120⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\D87E.tmp"C:\Users\Admin\AppData\Local\Temp\D87E.tmp"121⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\D8FB.tmp"C:\Users\Admin\AppData\Local\Temp\D8FB.tmp"122⤵PID:2104
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-