Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
27-08-2023 16:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b2ffe6e8a0c9272d768dd00b23c1f674_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
b2ffe6e8a0c9272d768dd00b23c1f674_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
b2ffe6e8a0c9272d768dd00b23c1f674_mafia_JC.exe
-
Size
486KB
-
MD5
b2ffe6e8a0c9272d768dd00b23c1f674
-
SHA1
385a0e0c7c21d334510b9013cd4aa09bc23fe928
-
SHA256
047c70b310c1bfe15b80f8697838c6343c9b55dd12df61337331206d2d10e55e
-
SHA512
144ec88681c8c61b266466dee4cf2f4f5bb63f370ae8e929dbe180ec7f3e7d80ee6095ff25fa228a0e1254f92a5fa44020b396cc6c878b9e5b00d66141f6e219
-
SSDEEP
12288:UU5rCOTeiDL/Q1HJaA9BIXwoo8Kcxeb7jQNZ:UUQOJD7Q1pVf78FgvQN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3212 D958.tmp 3860 DA04.tmp 2560 DED7.tmp 2932 DFA2.tmp 2628 E05D.tmp 4996 E0FA.tmp 3020 E1A5.tmp 4592 E242.tmp 1200 E2EE.tmp 60 E38A.tmp 3876 E436.tmp 4116 E520.tmp 380 E5EB.tmp 4848 E6B6.tmp 4520 E772.tmp 3788 E81E.tmp 2956 E8D9.tmp 4368 E9D3.tmp 1688 EA9E.tmp 1148 EB3B.tmp 3012 EBF6.tmp 3392 ECA2.tmp 2116 ED3E.tmp 4792 EDFA.tmp 4288 EEB5.tmp 3580 EF51.tmp 4292 EFFD.tmp 760 F09A.tmp 776 F165.tmp 4260 F220.tmp 2988 F2BC.tmp 3696 F349.tmp 4152 F414.tmp 312 F491.tmp 1904 F52D.tmp 4824 F59B.tmp 5064 F618.tmp 1784 F695.tmp 2492 F712.tmp 2200 F77F.tmp 4692 F7FC.tmp 3384 F86A.tmp 1716 F8D7.tmp 1360 F954.tmp 3448 F9F0.tmp 2132 FA9C.tmp 3584 FB19.tmp 1396 FB96.tmp 1564 FC23.tmp 4828 FCAF.tmp 4872 FD2C.tmp 1072 FDA9.tmp 3852 FE46.tmp 2236 FED2.tmp 4184 FF5F.tmp 5004 FFFB.tmp 3900 59.tmp 4248 105.tmp 3212 1A1.tmp 4856 21E.tmp 4528 2AB.tmp 1900 328.tmp 2316 3C4.tmp 988 450.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3268 wrote to memory of 3212 3268 b2ffe6e8a0c9272d768dd00b23c1f674_mafia_JC.exe 80 PID 3268 wrote to memory of 3212 3268 b2ffe6e8a0c9272d768dd00b23c1f674_mafia_JC.exe 80 PID 3268 wrote to memory of 3212 3268 b2ffe6e8a0c9272d768dd00b23c1f674_mafia_JC.exe 80 PID 3212 wrote to memory of 3860 3212 D958.tmp 81 PID 3212 wrote to memory of 3860 3212 D958.tmp 81 PID 3212 wrote to memory of 3860 3212 D958.tmp 81 PID 3860 wrote to memory of 2560 3860 DA04.tmp 82 PID 3860 wrote to memory of 2560 3860 DA04.tmp 82 PID 3860 wrote to memory of 2560 3860 DA04.tmp 82 PID 2560 wrote to memory of 2932 2560 DED7.tmp 83 PID 2560 wrote to memory of 2932 2560 DED7.tmp 83 PID 2560 wrote to memory of 2932 2560 DED7.tmp 83 PID 2932 wrote to memory of 2628 2932 DFA2.tmp 84 PID 2932 wrote to memory of 2628 2932 DFA2.tmp 84 PID 2932 wrote to memory of 2628 2932 DFA2.tmp 84 PID 2628 wrote to memory of 4996 2628 E05D.tmp 85 PID 2628 wrote to memory of 4996 2628 E05D.tmp 85 PID 2628 wrote to memory of 4996 2628 E05D.tmp 85 PID 4996 wrote to memory of 3020 4996 E0FA.tmp 86 PID 4996 wrote to memory of 3020 4996 E0FA.tmp 86 PID 4996 wrote to memory of 3020 4996 E0FA.tmp 86 PID 3020 wrote to memory of 4592 3020 E1A5.tmp 87 PID 3020 wrote to memory of 4592 3020 E1A5.tmp 87 PID 3020 wrote to memory of 4592 3020 E1A5.tmp 87 PID 4592 wrote to memory of 1200 4592 E242.tmp 88 PID 4592 wrote to memory of 1200 4592 E242.tmp 88 PID 4592 wrote to memory of 1200 4592 E242.tmp 88 PID 1200 wrote to memory of 60 1200 E2EE.tmp 89 PID 1200 wrote to memory of 60 1200 E2EE.tmp 89 PID 1200 wrote to memory of 60 1200 E2EE.tmp 89 PID 60 wrote to memory of 3876 60 E38A.tmp 90 PID 60 wrote to memory of 3876 60 E38A.tmp 90 PID 60 wrote to memory of 3876 60 E38A.tmp 90 PID 3876 wrote to memory of 4116 3876 E436.tmp 92 PID 3876 wrote to memory of 4116 3876 E436.tmp 92 PID 3876 wrote to memory of 4116 3876 E436.tmp 92 PID 4116 wrote to memory of 380 4116 E520.tmp 93 PID 4116 wrote to memory of 380 4116 E520.tmp 93 PID 4116 wrote to memory of 380 4116 E520.tmp 93 PID 380 wrote to memory of 4848 380 E5EB.tmp 94 PID 380 wrote to memory of 4848 380 E5EB.tmp 94 PID 380 wrote to memory of 4848 380 E5EB.tmp 94 PID 4848 wrote to memory of 4520 4848 E6B6.tmp 95 PID 4848 wrote to memory of 4520 4848 E6B6.tmp 95 PID 4848 wrote to memory of 4520 4848 E6B6.tmp 95 PID 4520 wrote to memory of 3788 4520 E772.tmp 96 PID 4520 wrote to memory of 3788 4520 E772.tmp 96 PID 4520 wrote to memory of 3788 4520 E772.tmp 96 PID 3788 wrote to memory of 2956 3788 E81E.tmp 97 PID 3788 wrote to memory of 2956 3788 E81E.tmp 97 PID 3788 wrote to memory of 2956 3788 E81E.tmp 97 PID 2956 wrote to memory of 4368 2956 E8D9.tmp 98 PID 2956 wrote to memory of 4368 2956 E8D9.tmp 98 PID 2956 wrote to memory of 4368 2956 E8D9.tmp 98 PID 4368 wrote to memory of 1688 4368 E9D3.tmp 99 PID 4368 wrote to memory of 1688 4368 E9D3.tmp 99 PID 4368 wrote to memory of 1688 4368 E9D3.tmp 99 PID 1688 wrote to memory of 1148 1688 EA9E.tmp 100 PID 1688 wrote to memory of 1148 1688 EA9E.tmp 100 PID 1688 wrote to memory of 1148 1688 EA9E.tmp 100 PID 1148 wrote to memory of 3012 1148 EB3B.tmp 101 PID 1148 wrote to memory of 3012 1148 EB3B.tmp 101 PID 1148 wrote to memory of 3012 1148 EB3B.tmp 101 PID 3012 wrote to memory of 3392 3012 EBF6.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2ffe6e8a0c9272d768dd00b23c1f674_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\b2ffe6e8a0c9272d768dd00b23c1f674_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\D958.tmp"C:\Users\Admin\AppData\Local\Temp\D958.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\DA04.tmp"C:\Users\Admin\AppData\Local\Temp\DA04.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\DED7.tmp"C:\Users\Admin\AppData\Local\Temp\DED7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\DFA2.tmp"C:\Users\Admin\AppData\Local\Temp\DFA2.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\E05D.tmp"C:\Users\Admin\AppData\Local\Temp\E05D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\E1A5.tmp"C:\Users\Admin\AppData\Local\Temp\E1A5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\E242.tmp"C:\Users\Admin\AppData\Local\Temp\E242.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\E2EE.tmp"C:\Users\Admin\AppData\Local\Temp\E2EE.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\E38A.tmp"C:\Users\Admin\AppData\Local\Temp\E38A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\E436.tmp"C:\Users\Admin\AppData\Local\Temp\E436.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\E520.tmp"C:\Users\Admin\AppData\Local\Temp\E520.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\E5EB.tmp"C:\Users\Admin\AppData\Local\Temp\E5EB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\E772.tmp"C:\Users\Admin\AppData\Local\Temp\E772.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\E81E.tmp"C:\Users\Admin\AppData\Local\Temp\E81E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\EA9E.tmp"C:\Users\Admin\AppData\Local\Temp\EA9E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\EB3B.tmp"C:\Users\Admin\AppData\Local\Temp\EB3B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\ECA2.tmp"C:\Users\Admin\AppData\Local\Temp\ECA2.tmp"23⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\ED3E.tmp"C:\Users\Admin\AppData\Local\Temp\ED3E.tmp"24⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\EDFA.tmp"C:\Users\Admin\AppData\Local\Temp\EDFA.tmp"25⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"26⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\EF51.tmp"C:\Users\Admin\AppData\Local\Temp\EF51.tmp"27⤵
- Executes dropped EXE
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"28⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\F09A.tmp"C:\Users\Admin\AppData\Local\Temp\F09A.tmp"29⤵
- Executes dropped EXE
PID:760 -
C:\Users\Admin\AppData\Local\Temp\F165.tmp"C:\Users\Admin\AppData\Local\Temp\F165.tmp"30⤵
- Executes dropped EXE
PID:776 -
C:\Users\Admin\AppData\Local\Temp\F220.tmp"C:\Users\Admin\AppData\Local\Temp\F220.tmp"31⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"32⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\F349.tmp"C:\Users\Admin\AppData\Local\Temp\F349.tmp"33⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\F414.tmp"C:\Users\Admin\AppData\Local\Temp\F414.tmp"34⤵
- Executes dropped EXE
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\F491.tmp"C:\Users\Admin\AppData\Local\Temp\F491.tmp"35⤵
- Executes dropped EXE
PID:312 -
C:\Users\Admin\AppData\Local\Temp\F52D.tmp"C:\Users\Admin\AppData\Local\Temp\F52D.tmp"36⤵
- Executes dropped EXE
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\F59B.tmp"C:\Users\Admin\AppData\Local\Temp\F59B.tmp"37⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\F618.tmp"C:\Users\Admin\AppData\Local\Temp\F618.tmp"38⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\F695.tmp"C:\Users\Admin\AppData\Local\Temp\F695.tmp"39⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\F712.tmp"C:\Users\Admin\AppData\Local\Temp\F712.tmp"40⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\F77F.tmp"C:\Users\Admin\AppData\Local\Temp\F77F.tmp"41⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\F7FC.tmp"C:\Users\Admin\AppData\Local\Temp\F7FC.tmp"42⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\F86A.tmp"C:\Users\Admin\AppData\Local\Temp\F86A.tmp"43⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\F8D7.tmp"C:\Users\Admin\AppData\Local\Temp\F8D7.tmp"44⤵
- Executes dropped EXE
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\F954.tmp"C:\Users\Admin\AppData\Local\Temp\F954.tmp"45⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\F9F0.tmp"C:\Users\Admin\AppData\Local\Temp\F9F0.tmp"46⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"47⤵
- Executes dropped EXE
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\FB19.tmp"C:\Users\Admin\AppData\Local\Temp\FB19.tmp"48⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\FB96.tmp"C:\Users\Admin\AppData\Local\Temp\FB96.tmp"49⤵
- Executes dropped EXE
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\FC23.tmp"C:\Users\Admin\AppData\Local\Temp\FC23.tmp"50⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"51⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"52⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"53⤵
- Executes dropped EXE
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\FE46.tmp"C:\Users\Admin\AppData\Local\Temp\FE46.tmp"54⤵
- Executes dropped EXE
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\FED2.tmp"C:\Users\Admin\AppData\Local\Temp\FED2.tmp"55⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\FF5F.tmp"C:\Users\Admin\AppData\Local\Temp\FF5F.tmp"56⤵
- Executes dropped EXE
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\FFFB.tmp"C:\Users\Admin\AppData\Local\Temp\FFFB.tmp"57⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\59.tmp"C:\Users\Admin\AppData\Local\Temp\59.tmp"58⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\105.tmp"C:\Users\Admin\AppData\Local\Temp\105.tmp"59⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\1A1.tmp"C:\Users\Admin\AppData\Local\Temp\1A1.tmp"60⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\21E.tmp"C:\Users\Admin\AppData\Local\Temp\21E.tmp"61⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\2AB.tmp"C:\Users\Admin\AppData\Local\Temp\2AB.tmp"62⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\328.tmp"C:\Users\Admin\AppData\Local\Temp\328.tmp"63⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\3C4.tmp"C:\Users\Admin\AppData\Local\Temp\3C4.tmp"64⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\450.tmp"C:\Users\Admin\AppData\Local\Temp\450.tmp"65⤵
- Executes dropped EXE
PID:988 -
C:\Users\Admin\AppData\Local\Temp\4DD.tmp"C:\Users\Admin\AppData\Local\Temp\4DD.tmp"66⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\56A.tmp"C:\Users\Admin\AppData\Local\Temp\56A.tmp"67⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\606.tmp"C:\Users\Admin\AppData\Local\Temp\606.tmp"68⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\673.tmp"C:\Users\Admin\AppData\Local\Temp\673.tmp"69⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\71F.tmp"C:\Users\Admin\AppData\Local\Temp\71F.tmp"70⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\7AC.tmp"C:\Users\Admin\AppData\Local\Temp\7AC.tmp"71⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\848.tmp"C:\Users\Admin\AppData\Local\Temp\848.tmp"72⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\913.tmp"C:\Users\Admin\AppData\Local\Temp\913.tmp"73⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\9A0.tmp"C:\Users\Admin\AppData\Local\Temp\9A0.tmp"74⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\A2C.tmp"C:\Users\Admin\AppData\Local\Temp\A2C.tmp"75⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\AB9.tmp"C:\Users\Admin\AppData\Local\Temp\AB9.tmp"76⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\B46.tmp"C:\Users\Admin\AppData\Local\Temp\B46.tmp"77⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\BC3.tmp"C:\Users\Admin\AppData\Local\Temp\BC3.tmp"78⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\C9D.tmp"C:\Users\Admin\AppData\Local\Temp\C9D.tmp"79⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\D2A.tmp"C:\Users\Admin\AppData\Local\Temp\D2A.tmp"80⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\DD6.tmp"C:\Users\Admin\AppData\Local\Temp\DD6.tmp"81⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\E43.tmp"C:\Users\Admin\AppData\Local\Temp\E43.tmp"82⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"83⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\F4D.tmp"C:\Users\Admin\AppData\Local\Temp\F4D.tmp"84⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\FAB.tmp"C:\Users\Admin\AppData\Local\Temp\FAB.tmp"85⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\1018.tmp"C:\Users\Admin\AppData\Local\Temp\1018.tmp"86⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\10C4.tmp"C:\Users\Admin\AppData\Local\Temp\10C4.tmp"87⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\1160.tmp"C:\Users\Admin\AppData\Local\Temp\1160.tmp"88⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\120C.tmp"C:\Users\Admin\AppData\Local\Temp\120C.tmp"89⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\1289.tmp"C:\Users\Admin\AppData\Local\Temp\1289.tmp"90⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\1335.tmp"C:\Users\Admin\AppData\Local\Temp\1335.tmp"91⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\13B2.tmp"C:\Users\Admin\AppData\Local\Temp\13B2.tmp"92⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\144E.tmp"C:\Users\Admin\AppData\Local\Temp\144E.tmp"93⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\14AC.tmp"C:\Users\Admin\AppData\Local\Temp\14AC.tmp"94⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\1519.tmp"C:\Users\Admin\AppData\Local\Temp\1519.tmp"95⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\1577.tmp"C:\Users\Admin\AppData\Local\Temp\1577.tmp"96⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\1604.tmp"C:\Users\Admin\AppData\Local\Temp\1604.tmp"97⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\16A0.tmp"C:\Users\Admin\AppData\Local\Temp\16A0.tmp"98⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\178A.tmp"C:\Users\Admin\AppData\Local\Temp\178A.tmp"99⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\1807.tmp"C:\Users\Admin\AppData\Local\Temp\1807.tmp"100⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\1894.tmp"C:\Users\Admin\AppData\Local\Temp\1894.tmp"101⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\194F.tmp"C:\Users\Admin\AppData\Local\Temp\194F.tmp"102⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\19EC.tmp"C:\Users\Admin\AppData\Local\Temp\19EC.tmp"103⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\1A69.tmp"C:\Users\Admin\AppData\Local\Temp\1A69.tmp"104⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\1AE6.tmp"C:\Users\Admin\AppData\Local\Temp\1AE6.tmp"105⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\1B53.tmp"C:\Users\Admin\AppData\Local\Temp\1B53.tmp"106⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"107⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"108⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\1D18.tmp"C:\Users\Admin\AppData\Local\Temp\1D18.tmp"109⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\1DB4.tmp"C:\Users\Admin\AppData\Local\Temp\1DB4.tmp"110⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\1E41.tmp"C:\Users\Admin\AppData\Local\Temp\1E41.tmp"111⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\1EDD.tmp"C:\Users\Admin\AppData\Local\Temp\1EDD.tmp"112⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\1F6A.tmp"C:\Users\Admin\AppData\Local\Temp\1F6A.tmp"113⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\2006.tmp"C:\Users\Admin\AppData\Local\Temp\2006.tmp"114⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\20A2.tmp"C:\Users\Admin\AppData\Local\Temp\20A2.tmp"115⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\213F.tmp"C:\Users\Admin\AppData\Local\Temp\213F.tmp"116⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\245C.tmp"C:\Users\Admin\AppData\Local\Temp\245C.tmp"117⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\2507.tmp"C:\Users\Admin\AppData\Local\Temp\2507.tmp"118⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\2575.tmp"C:\Users\Admin\AppData\Local\Temp\2575.tmp"119⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\2621.tmp"C:\Users\Admin\AppData\Local\Temp\2621.tmp"120⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\26DC.tmp"C:\Users\Admin\AppData\Local\Temp\26DC.tmp"121⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\2769.tmp"C:\Users\Admin\AppData\Local\Temp\2769.tmp"122⤵PID:3112
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-