Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
22-08-2023 15:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
692f2a76d77e91a55a7bcd1b7ad6a064_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
692f2a76d77e91a55a7bcd1b7ad6a064_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
692f2a76d77e91a55a7bcd1b7ad6a064_mafia_JC.exe
-
Size
520KB
-
MD5
692f2a76d77e91a55a7bcd1b7ad6a064
-
SHA1
a1078f7b4f7d55798c564380550aaa7a39257c58
-
SHA256
30ee53de3fde28ee4f7b9a9eab5866dbe12e3b82b508a559105aac8d259dd0fb
-
SHA512
87c59eab83932c625e443163837bc27050e8fd270157421cd2a4a13035418c9c88df53151fea5b658d1439cd7478aee3a0c940657fb0ffd5819ced108e1d33b9
-
SSDEEP
6144:lLvd/XzCjUIF1UuXLyQjmOH+JjLRtw8RjVBq/MHbs3XXop3sCrXnyrgrYqWsH3dZ:roRXOQjmOyDwmjV2MHbs/WCrkYUNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3428 DEA8.tmp 5008 DF63.tmp 3320 E03E.tmp 4964 E148.tmp 4520 E1E4.tmp 416 E290.tmp 4664 E31C.tmp 2064 E3C8.tmp 4764 E4B3.tmp 5096 E55F.tmp 2868 E5FB.tmp 4148 E6C6.tmp 5072 E791.tmp 1680 E84D.tmp 808 E927.tmp 1856 E9D3.tmp 1644 EA50.tmp 2924 EB5A.tmp 628 EC35.tmp 4420 ECF0.tmp 4688 EDBB.tmp 1136 EE77.tmp 2356 EF71.tmp 3288 F03C.tmp 4288 F0B9.tmp 568 F174.tmp 4344 F230.tmp 4244 F30B.tmp 876 F3D6.tmp 3184 F4A1.tmp 756 F57C.tmp 4392 F685.tmp 456 F750.tmp 4548 F7DD.tmp 2488 F889.tmp 4372 F935.tmp 4784 F992.tmp 3140 FA3E.tmp 4020 FA9C.tmp 4696 FB29.tmp 2816 FB96.tmp 2824 FC23.tmp 4864 FCCF.tmp 1472 FD5B.tmp 4124 FE07.tmp 3648 FEB3.tmp 1088 FF40.tmp 3816 FFCC.tmp 4984 59.tmp 4144 105.tmp 208 1A1.tmp 3876 23D.tmp 5064 2E9.tmp 2588 412.tmp 3964 4AE.tmp 2072 52B.tmp 1656 5B8.tmp 4928 644.tmp 768 6B2.tmp 4664 71F.tmp 2940 77D.tmp 3728 7EA.tmp 3700 877.tmp 1208 913.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4832 wrote to memory of 3428 4832 692f2a76d77e91a55a7bcd1b7ad6a064_mafia_JC.exe 80 PID 4832 wrote to memory of 3428 4832 692f2a76d77e91a55a7bcd1b7ad6a064_mafia_JC.exe 80 PID 4832 wrote to memory of 3428 4832 692f2a76d77e91a55a7bcd1b7ad6a064_mafia_JC.exe 80 PID 3428 wrote to memory of 5008 3428 DEA8.tmp 81 PID 3428 wrote to memory of 5008 3428 DEA8.tmp 81 PID 3428 wrote to memory of 5008 3428 DEA8.tmp 81 PID 5008 wrote to memory of 3320 5008 DF63.tmp 82 PID 5008 wrote to memory of 3320 5008 DF63.tmp 82 PID 5008 wrote to memory of 3320 5008 DF63.tmp 82 PID 3320 wrote to memory of 4964 3320 E03E.tmp 83 PID 3320 wrote to memory of 4964 3320 E03E.tmp 83 PID 3320 wrote to memory of 4964 3320 E03E.tmp 83 PID 4964 wrote to memory of 4520 4964 E148.tmp 84 PID 4964 wrote to memory of 4520 4964 E148.tmp 84 PID 4964 wrote to memory of 4520 4964 E148.tmp 84 PID 4520 wrote to memory of 416 4520 E1E4.tmp 85 PID 4520 wrote to memory of 416 4520 E1E4.tmp 85 PID 4520 wrote to memory of 416 4520 E1E4.tmp 85 PID 416 wrote to memory of 4664 416 E290.tmp 87 PID 416 wrote to memory of 4664 416 E290.tmp 87 PID 416 wrote to memory of 4664 416 E290.tmp 87 PID 4664 wrote to memory of 2064 4664 E31C.tmp 88 PID 4664 wrote to memory of 2064 4664 E31C.tmp 88 PID 4664 wrote to memory of 2064 4664 E31C.tmp 88 PID 2064 wrote to memory of 4764 2064 E3C8.tmp 89 PID 2064 wrote to memory of 4764 2064 E3C8.tmp 89 PID 2064 wrote to memory of 4764 2064 E3C8.tmp 89 PID 4764 wrote to memory of 5096 4764 E4B3.tmp 90 PID 4764 wrote to memory of 5096 4764 E4B3.tmp 90 PID 4764 wrote to memory of 5096 4764 E4B3.tmp 90 PID 5096 wrote to memory of 2868 5096 E55F.tmp 91 PID 5096 wrote to memory of 2868 5096 E55F.tmp 91 PID 5096 wrote to memory of 2868 5096 E55F.tmp 91 PID 2868 wrote to memory of 4148 2868 E5FB.tmp 92 PID 2868 wrote to memory of 4148 2868 E5FB.tmp 92 PID 2868 wrote to memory of 4148 2868 E5FB.tmp 92 PID 4148 wrote to memory of 5072 4148 E6C6.tmp 93 PID 4148 wrote to memory of 5072 4148 E6C6.tmp 93 PID 4148 wrote to memory of 5072 4148 E6C6.tmp 93 PID 5072 wrote to memory of 1680 5072 E791.tmp 94 PID 5072 wrote to memory of 1680 5072 E791.tmp 94 PID 5072 wrote to memory of 1680 5072 E791.tmp 94 PID 1680 wrote to memory of 808 1680 E84D.tmp 95 PID 1680 wrote to memory of 808 1680 E84D.tmp 95 PID 1680 wrote to memory of 808 1680 E84D.tmp 95 PID 808 wrote to memory of 1856 808 E927.tmp 98 PID 808 wrote to memory of 1856 808 E927.tmp 98 PID 808 wrote to memory of 1856 808 E927.tmp 98 PID 1856 wrote to memory of 1644 1856 E9D3.tmp 99 PID 1856 wrote to memory of 1644 1856 E9D3.tmp 99 PID 1856 wrote to memory of 1644 1856 E9D3.tmp 99 PID 1644 wrote to memory of 2924 1644 EA50.tmp 100 PID 1644 wrote to memory of 2924 1644 EA50.tmp 100 PID 1644 wrote to memory of 2924 1644 EA50.tmp 100 PID 2924 wrote to memory of 628 2924 EB5A.tmp 101 PID 2924 wrote to memory of 628 2924 EB5A.tmp 101 PID 2924 wrote to memory of 628 2924 EB5A.tmp 101 PID 628 wrote to memory of 4420 628 EC35.tmp 102 PID 628 wrote to memory of 4420 628 EC35.tmp 102 PID 628 wrote to memory of 4420 628 EC35.tmp 102 PID 4420 wrote to memory of 4688 4420 ECF0.tmp 103 PID 4420 wrote to memory of 4688 4420 ECF0.tmp 103 PID 4420 wrote to memory of 4688 4420 ECF0.tmp 103 PID 4688 wrote to memory of 1136 4688 EDBB.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\692f2a76d77e91a55a7bcd1b7ad6a064_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\692f2a76d77e91a55a7bcd1b7ad6a064_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\DF63.tmp"C:\Users\Admin\AppData\Local\Temp\DF63.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\E03E.tmp"C:\Users\Admin\AppData\Local\Temp\E03E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\E148.tmp"C:\Users\Admin\AppData\Local\Temp\E148.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\E290.tmp"C:\Users\Admin\AppData\Local\Temp\E290.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Users\Admin\AppData\Local\Temp\E31C.tmp"C:\Users\Admin\AppData\Local\Temp\E31C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\E4B3.tmp"C:\Users\Admin\AppData\Local\Temp\E4B3.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\E55F.tmp"C:\Users\Admin\AppData\Local\Temp\E55F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\E791.tmp"C:\Users\Admin\AppData\Local\Temp\E791.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\E84D.tmp"C:\Users\Admin\AppData\Local\Temp\E84D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\E927.tmp"C:\Users\Admin\AppData\Local\Temp\E927.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\EA50.tmp"C:\Users\Admin\AppData\Local\Temp\EA50.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\EC35.tmp"C:\Users\Admin\AppData\Local\Temp\EC35.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\EE77.tmp"C:\Users\Admin\AppData\Local\Temp\EE77.tmp"23⤵
- Executes dropped EXE
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\EF71.tmp"C:\Users\Admin\AppData\Local\Temp\EF71.tmp"24⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\F03C.tmp"C:\Users\Admin\AppData\Local\Temp\F03C.tmp"25⤵
- Executes dropped EXE
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\F0B9.tmp"C:\Users\Admin\AppData\Local\Temp\F0B9.tmp"26⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\F174.tmp"C:\Users\Admin\AppData\Local\Temp\F174.tmp"27⤵
- Executes dropped EXE
PID:568 -
C:\Users\Admin\AppData\Local\Temp\F230.tmp"C:\Users\Admin\AppData\Local\Temp\F230.tmp"28⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\F30B.tmp"C:\Users\Admin\AppData\Local\Temp\F30B.tmp"29⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\F3D6.tmp"C:\Users\Admin\AppData\Local\Temp\F3D6.tmp"30⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"31⤵
- Executes dropped EXE
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\F57C.tmp"C:\Users\Admin\AppData\Local\Temp\F57C.tmp"32⤵
- Executes dropped EXE
PID:756 -
C:\Users\Admin\AppData\Local\Temp\F685.tmp"C:\Users\Admin\AppData\Local\Temp\F685.tmp"33⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\F750.tmp"C:\Users\Admin\AppData\Local\Temp\F750.tmp"34⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"35⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\F889.tmp"C:\Users\Admin\AppData\Local\Temp\F889.tmp"36⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\F935.tmp"C:\Users\Admin\AppData\Local\Temp\F935.tmp"37⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\F992.tmp"C:\Users\Admin\AppData\Local\Temp\F992.tmp"38⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\FA3E.tmp"C:\Users\Admin\AppData\Local\Temp\FA3E.tmp"39⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"40⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\FB29.tmp"C:\Users\Admin\AppData\Local\Temp\FB29.tmp"41⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\FB96.tmp"C:\Users\Admin\AppData\Local\Temp\FB96.tmp"42⤵
- Executes dropped EXE
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\FC23.tmp"C:\Users\Admin\AppData\Local\Temp\FC23.tmp"43⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"44⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"45⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\FE07.tmp"C:\Users\Admin\AppData\Local\Temp\FE07.tmp"46⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\FEB3.tmp"C:\Users\Admin\AppData\Local\Temp\FEB3.tmp"47⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\FF40.tmp"C:\Users\Admin\AppData\Local\Temp\FF40.tmp"48⤵
- Executes dropped EXE
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\FFCC.tmp"C:\Users\Admin\AppData\Local\Temp\FFCC.tmp"49⤵
- Executes dropped EXE
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\59.tmp"C:\Users\Admin\AppData\Local\Temp\59.tmp"50⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\105.tmp"C:\Users\Admin\AppData\Local\Temp\105.tmp"51⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\1A1.tmp"C:\Users\Admin\AppData\Local\Temp\1A1.tmp"52⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\23D.tmp"C:\Users\Admin\AppData\Local\Temp\23D.tmp"53⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\2E9.tmp"C:\Users\Admin\AppData\Local\Temp\2E9.tmp"54⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\376.tmp"C:\Users\Admin\AppData\Local\Temp\376.tmp"55⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\412.tmp"C:\Users\Admin\AppData\Local\Temp\412.tmp"56⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\4AE.tmp"C:\Users\Admin\AppData\Local\Temp\4AE.tmp"57⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\52B.tmp"C:\Users\Admin\AppData\Local\Temp\52B.tmp"58⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\5B8.tmp"C:\Users\Admin\AppData\Local\Temp\5B8.tmp"59⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\644.tmp"C:\Users\Admin\AppData\Local\Temp\644.tmp"60⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\6B2.tmp"C:\Users\Admin\AppData\Local\Temp\6B2.tmp"61⤵
- Executes dropped EXE
PID:768 -
C:\Users\Admin\AppData\Local\Temp\71F.tmp"C:\Users\Admin\AppData\Local\Temp\71F.tmp"62⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\77D.tmp"C:\Users\Admin\AppData\Local\Temp\77D.tmp"63⤵
- Executes dropped EXE
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\7EA.tmp"C:\Users\Admin\AppData\Local\Temp\7EA.tmp"64⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\877.tmp"C:\Users\Admin\AppData\Local\Temp\877.tmp"65⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\913.tmp"C:\Users\Admin\AppData\Local\Temp\913.tmp"66⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\9BF.tmp"C:\Users\Admin\AppData\Local\Temp\9BF.tmp"67⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\A3C.tmp"C:\Users\Admin\AppData\Local\Temp\A3C.tmp"68⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\AB9.tmp"C:\Users\Admin\AppData\Local\Temp\AB9.tmp"69⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\B65.tmp"C:\Users\Admin\AppData\Local\Temp\B65.tmp"70⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"71⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\C8E.tmp"C:\Users\Admin\AppData\Local\Temp\C8E.tmp"72⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\D0B.tmp"C:\Users\Admin\AppData\Local\Temp\D0B.tmp"73⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"74⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\E14.tmp"C:\Users\Admin\AppData\Local\Temp\E14.tmp"75⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\E91.tmp"C:\Users\Admin\AppData\Local\Temp\E91.tmp"76⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\F0E.tmp"C:\Users\Admin\AppData\Local\Temp\F0E.tmp"77⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\F7C.tmp"C:\Users\Admin\AppData\Local\Temp\F7C.tmp"78⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\1018.tmp"C:\Users\Admin\AppData\Local\Temp\1018.tmp"79⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\10B4.tmp"C:\Users\Admin\AppData\Local\Temp\10B4.tmp"80⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\1151.tmp"C:\Users\Admin\AppData\Local\Temp\1151.tmp"81⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\11DD.tmp"C:\Users\Admin\AppData\Local\Temp\11DD.tmp"82⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\1279.tmp"C:\Users\Admin\AppData\Local\Temp\1279.tmp"83⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\12E7.tmp"C:\Users\Admin\AppData\Local\Temp\12E7.tmp"84⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\1373.tmp"C:\Users\Admin\AppData\Local\Temp\1373.tmp"85⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\13E1.tmp"C:\Users\Admin\AppData\Local\Temp\13E1.tmp"86⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\145E.tmp"C:\Users\Admin\AppData\Local\Temp\145E.tmp"87⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\14CB.tmp"C:\Users\Admin\AppData\Local\Temp\14CB.tmp"88⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\1548.tmp"C:\Users\Admin\AppData\Local\Temp\1548.tmp"89⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\15B6.tmp"C:\Users\Admin\AppData\Local\Temp\15B6.tmp"90⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\1613.tmp"C:\Users\Admin\AppData\Local\Temp\1613.tmp"91⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\1690.tmp"C:\Users\Admin\AppData\Local\Temp\1690.tmp"92⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\16FE.tmp"C:\Users\Admin\AppData\Local\Temp\16FE.tmp"93⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\176B.tmp"C:\Users\Admin\AppData\Local\Temp\176B.tmp"94⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\17F8.tmp"C:\Users\Admin\AppData\Local\Temp\17F8.tmp"95⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\18A4.tmp"C:\Users\Admin\AppData\Local\Temp\18A4.tmp"96⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\1921.tmp"C:\Users\Admin\AppData\Local\Temp\1921.tmp"97⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\19CC.tmp"C:\Users\Admin\AppData\Local\Temp\19CC.tmp"98⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\1A59.tmp"C:\Users\Admin\AppData\Local\Temp\1A59.tmp"99⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"100⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\1B24.tmp"C:\Users\Admin\AppData\Local\Temp\1B24.tmp"101⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\1B92.tmp"C:\Users\Admin\AppData\Local\Temp\1B92.tmp"102⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"103⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"104⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\1CE9.tmp"C:\Users\Admin\AppData\Local\Temp\1CE9.tmp"105⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\1D76.tmp"C:\Users\Admin\AppData\Local\Temp\1D76.tmp"106⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\1E03.tmp"C:\Users\Admin\AppData\Local\Temp\1E03.tmp"107⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\1E70.tmp"C:\Users\Admin\AppData\Local\Temp\1E70.tmp"108⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\1EDD.tmp"C:\Users\Admin\AppData\Local\Temp\1EDD.tmp"109⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\1F7A.tmp"C:\Users\Admin\AppData\Local\Temp\1F7A.tmp"110⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"111⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\20A2.tmp"C:\Users\Admin\AppData\Local\Temp\20A2.tmp"112⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\211F.tmp"C:\Users\Admin\AppData\Local\Temp\211F.tmp"113⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\21BC.tmp"C:\Users\Admin\AppData\Local\Temp\21BC.tmp"114⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\2248.tmp"C:\Users\Admin\AppData\Local\Temp\2248.tmp"115⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\22C5.tmp"C:\Users\Admin\AppData\Local\Temp\22C5.tmp"116⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\2342.tmp"C:\Users\Admin\AppData\Local\Temp\2342.tmp"117⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\23BF.tmp"C:\Users\Admin\AppData\Local\Temp\23BF.tmp"118⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\246B.tmp"C:\Users\Admin\AppData\Local\Temp\246B.tmp"119⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\2507.tmp"C:\Users\Admin\AppData\Local\Temp\2507.tmp"120⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\2594.tmp"C:\Users\Admin\AppData\Local\Temp\2594.tmp"121⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\2621.tmp"C:\Users\Admin\AppData\Local\Temp\2621.tmp"122⤵PID:2868
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-