Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
24-08-2023 17:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
85ea42913963c3d15b2283ee5162ed16_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
85ea42913963c3d15b2283ee5162ed16_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
85ea42913963c3d15b2283ee5162ed16_mafia_JC.exe
-
Size
486KB
-
MD5
85ea42913963c3d15b2283ee5162ed16
-
SHA1
e425e6cba05f36dec87104a98e301605d5237b53
-
SHA256
009353bf2fa8f69fd519b7d3993a4e37c3f92f5d4324685ea0b3d4c09edaa53f
-
SHA512
fba3dab72068d180911e176cd3a4a3d03d55ba151346163fc65db5c585cfdcf46a6be39bd676091a992e45cbd8363b8a49d40e029603747d6e2d9faac85075f6
-
SSDEEP
6144:Forf3lPvovsgZnqG2C7mOTeiLfD7zl8VmONsHwFUhhCHaew9Ye+11aoi1dvqqr5a:UU5rCOTeiD2VRuwFzaeTe+11fin3yNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2480 97.tmp 1984 153.tmp 3656 26C.tmp 3116 328.tmp 3972 422.tmp 2836 4DD.tmp 1852 589.tmp 4984 644.tmp 3000 6B2.tmp 60 72F.tmp 4336 7DB.tmp 3552 8D5.tmp 4644 971.tmp 3556 A1D.tmp 2956 A8A.tmp 3572 BA3.tmp 2336 C4F.tmp 2548 D1A.tmp 3196 E24.tmp 4236 EFF.tmp 4368 1047.tmp 2696 10D4.tmp 2356 1170.tmp 1016 121C.tmp 2896 12B8.tmp 4560 1393.tmp 4924 145E.tmp 3996 1519.tmp 3184 1613.tmp 528 16BF.tmp 4684 179A.tmp 2080 1855.tmp 4664 1901.tmp 1580 198E.tmp 4852 1A0B.tmp 1688 1A98.tmp 3384 1B53.tmp 1660 1BEF.tmp 4256 1C6C.tmp 4652 1D09.tmp 4776 1DB4.tmp 4080 1E60.tmp 2828 1EFD.tmp 3264 1FA8.tmp 4424 2025.tmp 4472 20C2.tmp 1340 216E.tmp 2588 2219.tmp 4216 22B6.tmp 948 2362.tmp 2392 23FE.tmp 1676 248A.tmp 5088 2527.tmp 3120 25B3.tmp 2656 2640.tmp 2632 26AD.tmp 884 2759.tmp 5108 27E6.tmp 4252 2853.tmp 4484 28C1.tmp 3700 293E.tmp 2496 29AB.tmp 3584 2A28.tmp 3000 2AA5.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3728 wrote to memory of 2480 3728 85ea42913963c3d15b2283ee5162ed16_mafia_JC.exe 82 PID 3728 wrote to memory of 2480 3728 85ea42913963c3d15b2283ee5162ed16_mafia_JC.exe 82 PID 3728 wrote to memory of 2480 3728 85ea42913963c3d15b2283ee5162ed16_mafia_JC.exe 82 PID 2480 wrote to memory of 1984 2480 97.tmp 83 PID 2480 wrote to memory of 1984 2480 97.tmp 83 PID 2480 wrote to memory of 1984 2480 97.tmp 83 PID 1984 wrote to memory of 3656 1984 153.tmp 84 PID 1984 wrote to memory of 3656 1984 153.tmp 84 PID 1984 wrote to memory of 3656 1984 153.tmp 84 PID 3656 wrote to memory of 3116 3656 26C.tmp 85 PID 3656 wrote to memory of 3116 3656 26C.tmp 85 PID 3656 wrote to memory of 3116 3656 26C.tmp 85 PID 3116 wrote to memory of 3972 3116 328.tmp 86 PID 3116 wrote to memory of 3972 3116 328.tmp 86 PID 3116 wrote to memory of 3972 3116 328.tmp 86 PID 3972 wrote to memory of 2836 3972 422.tmp 87 PID 3972 wrote to memory of 2836 3972 422.tmp 87 PID 3972 wrote to memory of 2836 3972 422.tmp 87 PID 2836 wrote to memory of 1852 2836 4DD.tmp 88 PID 2836 wrote to memory of 1852 2836 4DD.tmp 88 PID 2836 wrote to memory of 1852 2836 4DD.tmp 88 PID 1852 wrote to memory of 4984 1852 589.tmp 89 PID 1852 wrote to memory of 4984 1852 589.tmp 89 PID 1852 wrote to memory of 4984 1852 589.tmp 89 PID 4984 wrote to memory of 3000 4984 644.tmp 90 PID 4984 wrote to memory of 3000 4984 644.tmp 90 PID 4984 wrote to memory of 3000 4984 644.tmp 90 PID 3000 wrote to memory of 60 3000 6B2.tmp 91 PID 3000 wrote to memory of 60 3000 6B2.tmp 91 PID 3000 wrote to memory of 60 3000 6B2.tmp 91 PID 60 wrote to memory of 4336 60 72F.tmp 92 PID 60 wrote to memory of 4336 60 72F.tmp 92 PID 60 wrote to memory of 4336 60 72F.tmp 92 PID 4336 wrote to memory of 3552 4336 7DB.tmp 93 PID 4336 wrote to memory of 3552 4336 7DB.tmp 93 PID 4336 wrote to memory of 3552 4336 7DB.tmp 93 PID 3552 wrote to memory of 4644 3552 8D5.tmp 94 PID 3552 wrote to memory of 4644 3552 8D5.tmp 94 PID 3552 wrote to memory of 4644 3552 8D5.tmp 94 PID 4644 wrote to memory of 3556 4644 971.tmp 95 PID 4644 wrote to memory of 3556 4644 971.tmp 95 PID 4644 wrote to memory of 3556 4644 971.tmp 95 PID 3556 wrote to memory of 2956 3556 A1D.tmp 96 PID 3556 wrote to memory of 2956 3556 A1D.tmp 96 PID 3556 wrote to memory of 2956 3556 A1D.tmp 96 PID 2956 wrote to memory of 3572 2956 A8A.tmp 97 PID 2956 wrote to memory of 3572 2956 A8A.tmp 97 PID 2956 wrote to memory of 3572 2956 A8A.tmp 97 PID 3572 wrote to memory of 2336 3572 BA3.tmp 100 PID 3572 wrote to memory of 2336 3572 BA3.tmp 100 PID 3572 wrote to memory of 2336 3572 BA3.tmp 100 PID 2336 wrote to memory of 2548 2336 C4F.tmp 101 PID 2336 wrote to memory of 2548 2336 C4F.tmp 101 PID 2336 wrote to memory of 2548 2336 C4F.tmp 101 PID 2548 wrote to memory of 3196 2548 D1A.tmp 102 PID 2548 wrote to memory of 3196 2548 D1A.tmp 102 PID 2548 wrote to memory of 3196 2548 D1A.tmp 102 PID 3196 wrote to memory of 4236 3196 E24.tmp 103 PID 3196 wrote to memory of 4236 3196 E24.tmp 103 PID 3196 wrote to memory of 4236 3196 E24.tmp 103 PID 4236 wrote to memory of 4368 4236 EFF.tmp 105 PID 4236 wrote to memory of 4368 4236 EFF.tmp 105 PID 4236 wrote to memory of 4368 4236 EFF.tmp 105 PID 4368 wrote to memory of 2696 4368 1047.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\85ea42913963c3d15b2283ee5162ed16_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\85ea42913963c3d15b2283ee5162ed16_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\97.tmp"C:\Users\Admin\AppData\Local\Temp\97.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\153.tmp"C:\Users\Admin\AppData\Local\Temp\153.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\26C.tmp"C:\Users\Admin\AppData\Local\Temp\26C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\328.tmp"C:\Users\Admin\AppData\Local\Temp\328.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\422.tmp"C:\Users\Admin\AppData\Local\Temp\422.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\4DD.tmp"C:\Users\Admin\AppData\Local\Temp\4DD.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\589.tmp"C:\Users\Admin\AppData\Local\Temp\589.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\644.tmp"C:\Users\Admin\AppData\Local\Temp\644.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\6B2.tmp"C:\Users\Admin\AppData\Local\Temp\6B2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\72F.tmp"C:\Users\Admin\AppData\Local\Temp\72F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\7DB.tmp"C:\Users\Admin\AppData\Local\Temp\7DB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\8D5.tmp"C:\Users\Admin\AppData\Local\Temp\8D5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\971.tmp"C:\Users\Admin\AppData\Local\Temp\971.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\A1D.tmp"C:\Users\Admin\AppData\Local\Temp\A1D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\A8A.tmp"C:\Users\Admin\AppData\Local\Temp\A8A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\BA3.tmp"C:\Users\Admin\AppData\Local\Temp\BA3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\C4F.tmp"C:\Users\Admin\AppData\Local\Temp\C4F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\D1A.tmp"C:\Users\Admin\AppData\Local\Temp\D1A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\EFF.tmp"C:\Users\Admin\AppData\Local\Temp\EFF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\1047.tmp"C:\Users\Admin\AppData\Local\Temp\1047.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\10D4.tmp"C:\Users\Admin\AppData\Local\Temp\10D4.tmp"23⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\1170.tmp"C:\Users\Admin\AppData\Local\Temp\1170.tmp"24⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\121C.tmp"C:\Users\Admin\AppData\Local\Temp\121C.tmp"25⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\12B8.tmp"C:\Users\Admin\AppData\Local\Temp\12B8.tmp"26⤵
- Executes dropped EXE
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\1393.tmp"C:\Users\Admin\AppData\Local\Temp\1393.tmp"27⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\145E.tmp"C:\Users\Admin\AppData\Local\Temp\145E.tmp"28⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\1519.tmp"C:\Users\Admin\AppData\Local\Temp\1519.tmp"29⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\1613.tmp"C:\Users\Admin\AppData\Local\Temp\1613.tmp"30⤵
- Executes dropped EXE
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\16BF.tmp"C:\Users\Admin\AppData\Local\Temp\16BF.tmp"31⤵
- Executes dropped EXE
PID:528 -
C:\Users\Admin\AppData\Local\Temp\179A.tmp"C:\Users\Admin\AppData\Local\Temp\179A.tmp"32⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\1855.tmp"C:\Users\Admin\AppData\Local\Temp\1855.tmp"33⤵
- Executes dropped EXE
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\1901.tmp"C:\Users\Admin\AppData\Local\Temp\1901.tmp"34⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\198E.tmp"C:\Users\Admin\AppData\Local\Temp\198E.tmp"35⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"36⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\1A98.tmp"C:\Users\Admin\AppData\Local\Temp\1A98.tmp"37⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\1B53.tmp"C:\Users\Admin\AppData\Local\Temp\1B53.tmp"38⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"39⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"40⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\1D09.tmp"C:\Users\Admin\AppData\Local\Temp\1D09.tmp"41⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\1DB4.tmp"C:\Users\Admin\AppData\Local\Temp\1DB4.tmp"42⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\1E60.tmp"C:\Users\Admin\AppData\Local\Temp\1E60.tmp"43⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"44⤵
- Executes dropped EXE
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"45⤵
- Executes dropped EXE
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\2025.tmp"C:\Users\Admin\AppData\Local\Temp\2025.tmp"46⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\20C2.tmp"C:\Users\Admin\AppData\Local\Temp\20C2.tmp"47⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\216E.tmp"C:\Users\Admin\AppData\Local\Temp\216E.tmp"48⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\2219.tmp"C:\Users\Admin\AppData\Local\Temp\2219.tmp"49⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\22B6.tmp"C:\Users\Admin\AppData\Local\Temp\22B6.tmp"50⤵
- Executes dropped EXE
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\2362.tmp"C:\Users\Admin\AppData\Local\Temp\2362.tmp"51⤵
- Executes dropped EXE
PID:948 -
C:\Users\Admin\AppData\Local\Temp\23FE.tmp"C:\Users\Admin\AppData\Local\Temp\23FE.tmp"52⤵
- Executes dropped EXE
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\248A.tmp"C:\Users\Admin\AppData\Local\Temp\248A.tmp"53⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\2527.tmp"C:\Users\Admin\AppData\Local\Temp\2527.tmp"54⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\25B3.tmp"C:\Users\Admin\AppData\Local\Temp\25B3.tmp"55⤵
- Executes dropped EXE
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\2640.tmp"C:\Users\Admin\AppData\Local\Temp\2640.tmp"56⤵
- Executes dropped EXE
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\26AD.tmp"C:\Users\Admin\AppData\Local\Temp\26AD.tmp"57⤵
- Executes dropped EXE
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\2759.tmp"C:\Users\Admin\AppData\Local\Temp\2759.tmp"58⤵
- Executes dropped EXE
PID:884 -
C:\Users\Admin\AppData\Local\Temp\27E6.tmp"C:\Users\Admin\AppData\Local\Temp\27E6.tmp"59⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\2853.tmp"C:\Users\Admin\AppData\Local\Temp\2853.tmp"60⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\28C1.tmp"C:\Users\Admin\AppData\Local\Temp\28C1.tmp"61⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\293E.tmp"C:\Users\Admin\AppData\Local\Temp\293E.tmp"62⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\29AB.tmp"C:\Users\Admin\AppData\Local\Temp\29AB.tmp"63⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\2A28.tmp"C:\Users\Admin\AppData\Local\Temp\2A28.tmp"64⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\2AA5.tmp"C:\Users\Admin\AppData\Local\Temp\2AA5.tmp"65⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\2B32.tmp"C:\Users\Admin\AppData\Local\Temp\2B32.tmp"66⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\2BCE.tmp"C:\Users\Admin\AppData\Local\Temp\2BCE.tmp"67⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\2C5A.tmp"C:\Users\Admin\AppData\Local\Temp\2C5A.tmp"68⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\2CD7.tmp"C:\Users\Admin\AppData\Local\Temp\2CD7.tmp"69⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\2D45.tmp"C:\Users\Admin\AppData\Local\Temp\2D45.tmp"70⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\2DB2.tmp"C:\Users\Admin\AppData\Local\Temp\2DB2.tmp"71⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\2E20.tmp"C:\Users\Admin\AppData\Local\Temp\2E20.tmp"72⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\2E9D.tmp"C:\Users\Admin\AppData\Local\Temp\2E9D.tmp"73⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\2F0A.tmp"C:\Users\Admin\AppData\Local\Temp\2F0A.tmp"74⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"75⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\3014.tmp"C:\Users\Admin\AppData\Local\Temp\3014.tmp"76⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\3071.tmp"C:\Users\Admin\AppData\Local\Temp\3071.tmp"77⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\310E.tmp"C:\Users\Admin\AppData\Local\Temp\310E.tmp"78⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\31AA.tmp"C:\Users\Admin\AppData\Local\Temp\31AA.tmp"79⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\3246.tmp"C:\Users\Admin\AppData\Local\Temp\3246.tmp"80⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\32B3.tmp"C:\Users\Admin\AppData\Local\Temp\32B3.tmp"81⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"82⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"83⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"84⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"85⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\3524.tmp"C:\Users\Admin\AppData\Local\Temp\3524.tmp"86⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"87⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\35E0.tmp"C:\Users\Admin\AppData\Local\Temp\35E0.tmp"88⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\365D.tmp"C:\Users\Admin\AppData\Local\Temp\365D.tmp"89⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\36DA.tmp"C:\Users\Admin\AppData\Local\Temp\36DA.tmp"90⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\3776.tmp"C:\Users\Admin\AppData\Local\Temp\3776.tmp"91⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\3803.tmp"C:\Users\Admin\AppData\Local\Temp\3803.tmp"92⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\3880.tmp"C:\Users\Admin\AppData\Local\Temp\3880.tmp"93⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\38FD.tmp"C:\Users\Admin\AppData\Local\Temp\38FD.tmp"94⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\397A.tmp"C:\Users\Admin\AppData\Local\Temp\397A.tmp"95⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\39E7.tmp"C:\Users\Admin\AppData\Local\Temp\39E7.tmp"96⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\3A74.tmp"C:\Users\Admin\AppData\Local\Temp\3A74.tmp"97⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\3B20.tmp"C:\Users\Admin\AppData\Local\Temp\3B20.tmp"98⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\3BAC.tmp"C:\Users\Admin\AppData\Local\Temp\3BAC.tmp"99⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\3C49.tmp"C:\Users\Admin\AppData\Local\Temp\3C49.tmp"100⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\3CC6.tmp"C:\Users\Admin\AppData\Local\Temp\3CC6.tmp"101⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\3D43.tmp"C:\Users\Admin\AppData\Local\Temp\3D43.tmp"102⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\3DCF.tmp"C:\Users\Admin\AppData\Local\Temp\3DCF.tmp"103⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\3E5C.tmp"C:\Users\Admin\AppData\Local\Temp\3E5C.tmp"104⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\3ED9.tmp"C:\Users\Admin\AppData\Local\Temp\3ED9.tmp"105⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\3F56.tmp"C:\Users\Admin\AppData\Local\Temp\3F56.tmp"106⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\3FD3.tmp"C:\Users\Admin\AppData\Local\Temp\3FD3.tmp"107⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\405F.tmp"C:\Users\Admin\AppData\Local\Temp\405F.tmp"108⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\40DC.tmp"C:\Users\Admin\AppData\Local\Temp\40DC.tmp"109⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\4159.tmp"C:\Users\Admin\AppData\Local\Temp\4159.tmp"110⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\41F6.tmp"C:\Users\Admin\AppData\Local\Temp\41F6.tmp"111⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\4282.tmp"C:\Users\Admin\AppData\Local\Temp\4282.tmp"112⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\42F0.tmp"C:\Users\Admin\AppData\Local\Temp\42F0.tmp"113⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\438C.tmp"C:\Users\Admin\AppData\Local\Temp\438C.tmp"114⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\43F9.tmp"C:\Users\Admin\AppData\Local\Temp\43F9.tmp"115⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\4476.tmp"C:\Users\Admin\AppData\Local\Temp\4476.tmp"116⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\4513.tmp"C:\Users\Admin\AppData\Local\Temp\4513.tmp"117⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\45BE.tmp"C:\Users\Admin\AppData\Local\Temp\45BE.tmp"118⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\463B.tmp"C:\Users\Admin\AppData\Local\Temp\463B.tmp"119⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\46D8.tmp"C:\Users\Admin\AppData\Local\Temp\46D8.tmp"120⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\4764.tmp"C:\Users\Admin\AppData\Local\Temp\4764.tmp"121⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\47E1.tmp"C:\Users\Admin\AppData\Local\Temp\47E1.tmp"122⤵PID:2232
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-