Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
28-08-2023 16:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bfcc68313e2a95f408f9abd18b7404cb_mafia_JC.exe
Resource
win7-20230824-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
bfcc68313e2a95f408f9abd18b7404cb_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
bfcc68313e2a95f408f9abd18b7404cb_mafia_JC.exe
-
Size
486KB
-
MD5
bfcc68313e2a95f408f9abd18b7404cb
-
SHA1
6be56ec32737071a586badf776046215c4ba4e65
-
SHA256
80055258ac2813b5f322988b20e199be0169418a57d7a5625da5fd8b3bb5ef0a
-
SHA512
6afdf9b535a13c3365c6b0ade5a106241d2ceb7e7ce882901ecbc86d09b3b6e6c83a2ccdf9e90d2cf72910d610543ae4a97a949143f31cfeed71e6da6df3ca79
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7QQwDC6W2Iyse9+ydCToUxSKCWcsH3dZ:/U5rCOTeiDQQwDfsekXNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3136 6467.tmp 4696 6532.tmp 2272 65DE.tmp 4616 668A.tmp 1000 6765.tmp 4716 67D2.tmp 4708 688D.tmp 1068 692A.tmp 872 69A7.tmp 3060 6A91.tmp 3400 6B1E.tmp 1336 6BF8.tmp 3896 6CA4.tmp 3492 6E1B.tmp 3596 6EC7.tmp 2540 6F73.tmp 852 702F.tmp 4388 70CB.tmp 1612 7157.tmp 1248 7290.tmp 1268 732C.tmp 220 73C8.tmp 4824 7484.tmp 4252 7520.tmp 4016 759D.tmp 2772 762A.tmp 4676 76E5.tmp 4644 77D0.tmp 2040 784D.tmp 3776 79C4.tmp 4636 7A8F.tmp 408 7B1B.tmp 920 7C06.tmp 4416 7C83.tmp 1768 7D00.tmp 216 7D7D.tmp 4452 7E77.tmp 2112 7F03.tmp 4856 7F71.tmp 2188 7FEE.tmp 3864 806B.tmp 4816 8107.tmp 2252 8194.tmp 2856 8201.tmp 1344 828E.tmp 4872 8397.tmp 2992 8424.tmp 4348 84C0.tmp 4092 855C.tmp 596 8685.tmp 2552 8702.tmp 3744 878F.tmp 4204 880C.tmp 1080 8899.tmp 3588 8925.tmp 4132 89C1.tmp 3700 8A4E.tmp 2440 8ADB.tmp 4380 8B48.tmp 1076 8BB5.tmp 456 8C23.tmp 2000 8C81.tmp 4732 8D0D.tmp 2316 8DA9.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4164 wrote to memory of 3136 4164 bfcc68313e2a95f408f9abd18b7404cb_mafia_JC.exe 83 PID 4164 wrote to memory of 3136 4164 bfcc68313e2a95f408f9abd18b7404cb_mafia_JC.exe 83 PID 4164 wrote to memory of 3136 4164 bfcc68313e2a95f408f9abd18b7404cb_mafia_JC.exe 83 PID 3136 wrote to memory of 4696 3136 6467.tmp 84 PID 3136 wrote to memory of 4696 3136 6467.tmp 84 PID 3136 wrote to memory of 4696 3136 6467.tmp 84 PID 4696 wrote to memory of 2272 4696 6532.tmp 85 PID 4696 wrote to memory of 2272 4696 6532.tmp 85 PID 4696 wrote to memory of 2272 4696 6532.tmp 85 PID 2272 wrote to memory of 4616 2272 65DE.tmp 86 PID 2272 wrote to memory of 4616 2272 65DE.tmp 86 PID 2272 wrote to memory of 4616 2272 65DE.tmp 86 PID 4616 wrote to memory of 1000 4616 668A.tmp 87 PID 4616 wrote to memory of 1000 4616 668A.tmp 87 PID 4616 wrote to memory of 1000 4616 668A.tmp 87 PID 1000 wrote to memory of 4716 1000 6765.tmp 88 PID 1000 wrote to memory of 4716 1000 6765.tmp 88 PID 1000 wrote to memory of 4716 1000 6765.tmp 88 PID 4716 wrote to memory of 4708 4716 67D2.tmp 89 PID 4716 wrote to memory of 4708 4716 67D2.tmp 89 PID 4716 wrote to memory of 4708 4716 67D2.tmp 89 PID 4708 wrote to memory of 1068 4708 688D.tmp 90 PID 4708 wrote to memory of 1068 4708 688D.tmp 90 PID 4708 wrote to memory of 1068 4708 688D.tmp 90 PID 1068 wrote to memory of 872 1068 692A.tmp 91 PID 1068 wrote to memory of 872 1068 692A.tmp 91 PID 1068 wrote to memory of 872 1068 692A.tmp 91 PID 872 wrote to memory of 3060 872 69A7.tmp 92 PID 872 wrote to memory of 3060 872 69A7.tmp 92 PID 872 wrote to memory of 3060 872 69A7.tmp 92 PID 3060 wrote to memory of 3400 3060 6A91.tmp 93 PID 3060 wrote to memory of 3400 3060 6A91.tmp 93 PID 3060 wrote to memory of 3400 3060 6A91.tmp 93 PID 3400 wrote to memory of 1336 3400 6B1E.tmp 94 PID 3400 wrote to memory of 1336 3400 6B1E.tmp 94 PID 3400 wrote to memory of 1336 3400 6B1E.tmp 94 PID 1336 wrote to memory of 3896 1336 6BF8.tmp 95 PID 1336 wrote to memory of 3896 1336 6BF8.tmp 95 PID 1336 wrote to memory of 3896 1336 6BF8.tmp 95 PID 3896 wrote to memory of 3492 3896 6CA4.tmp 96 PID 3896 wrote to memory of 3492 3896 6CA4.tmp 96 PID 3896 wrote to memory of 3492 3896 6CA4.tmp 96 PID 3492 wrote to memory of 3596 3492 6E1B.tmp 97 PID 3492 wrote to memory of 3596 3492 6E1B.tmp 97 PID 3492 wrote to memory of 3596 3492 6E1B.tmp 97 PID 3596 wrote to memory of 2540 3596 6EC7.tmp 100 PID 3596 wrote to memory of 2540 3596 6EC7.tmp 100 PID 3596 wrote to memory of 2540 3596 6EC7.tmp 100 PID 2540 wrote to memory of 852 2540 6F73.tmp 101 PID 2540 wrote to memory of 852 2540 6F73.tmp 101 PID 2540 wrote to memory of 852 2540 6F73.tmp 101 PID 852 wrote to memory of 4388 852 702F.tmp 102 PID 852 wrote to memory of 4388 852 702F.tmp 102 PID 852 wrote to memory of 4388 852 702F.tmp 102 PID 4388 wrote to memory of 1612 4388 70CB.tmp 103 PID 4388 wrote to memory of 1612 4388 70CB.tmp 103 PID 4388 wrote to memory of 1612 4388 70CB.tmp 103 PID 1612 wrote to memory of 1248 1612 7157.tmp 104 PID 1612 wrote to memory of 1248 1612 7157.tmp 104 PID 1612 wrote to memory of 1248 1612 7157.tmp 104 PID 1248 wrote to memory of 1268 1248 7290.tmp 106 PID 1248 wrote to memory of 1268 1248 7290.tmp 106 PID 1248 wrote to memory of 1268 1248 7290.tmp 106 PID 1268 wrote to memory of 220 1268 732C.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfcc68313e2a95f408f9abd18b7404cb_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\bfcc68313e2a95f408f9abd18b7404cb_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\7157.tmp"C:\Users\Admin\AppData\Local\Temp\7157.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\7290.tmp"C:\Users\Admin\AppData\Local\Temp\7290.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"23⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"24⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"25⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"26⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"27⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"28⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"29⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"30⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\79C4.tmp"C:\Users\Admin\AppData\Local\Temp\79C4.tmp"31⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"32⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"33⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\7C06.tmp"C:\Users\Admin\AppData\Local\Temp\7C06.tmp"34⤵
- Executes dropped EXE
PID:920 -
C:\Users\Admin\AppData\Local\Temp\7C83.tmp"C:\Users\Admin\AppData\Local\Temp\7C83.tmp"35⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\7D00.tmp"C:\Users\Admin\AppData\Local\Temp\7D00.tmp"36⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"37⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\7E77.tmp"C:\Users\Admin\AppData\Local\Temp\7E77.tmp"38⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\7F03.tmp"C:\Users\Admin\AppData\Local\Temp\7F03.tmp"39⤵
- Executes dropped EXE
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\7F71.tmp"C:\Users\Admin\AppData\Local\Temp\7F71.tmp"40⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"41⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"42⤵
- Executes dropped EXE
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\8107.tmp"C:\Users\Admin\AppData\Local\Temp\8107.tmp"43⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\8194.tmp"C:\Users\Admin\AppData\Local\Temp\8194.tmp"44⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\8201.tmp"C:\Users\Admin\AppData\Local\Temp\8201.tmp"45⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\828E.tmp"C:\Users\Admin\AppData\Local\Temp\828E.tmp"46⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"47⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\8424.tmp"C:\Users\Admin\AppData\Local\Temp\8424.tmp"48⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\84C0.tmp"C:\Users\Admin\AppData\Local\Temp\84C0.tmp"49⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\855C.tmp"C:\Users\Admin\AppData\Local\Temp\855C.tmp"50⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\85F9.tmp"C:\Users\Admin\AppData\Local\Temp\85F9.tmp"51⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\8685.tmp"C:\Users\Admin\AppData\Local\Temp\8685.tmp"52⤵
- Executes dropped EXE
PID:596 -
C:\Users\Admin\AppData\Local\Temp\8702.tmp"C:\Users\Admin\AppData\Local\Temp\8702.tmp"53⤵
- Executes dropped EXE
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\878F.tmp"C:\Users\Admin\AppData\Local\Temp\878F.tmp"54⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\880C.tmp"C:\Users\Admin\AppData\Local\Temp\880C.tmp"55⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\8899.tmp"C:\Users\Admin\AppData\Local\Temp\8899.tmp"56⤵
- Executes dropped EXE
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\8925.tmp"C:\Users\Admin\AppData\Local\Temp\8925.tmp"57⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\89C1.tmp"C:\Users\Admin\AppData\Local\Temp\89C1.tmp"58⤵
- Executes dropped EXE
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"59⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"60⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\8B48.tmp"C:\Users\Admin\AppData\Local\Temp\8B48.tmp"61⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"62⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\8C23.tmp"C:\Users\Admin\AppData\Local\Temp\8C23.tmp"63⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\8C81.tmp"C:\Users\Admin\AppData\Local\Temp\8C81.tmp"64⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"65⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"66⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\8E46.tmp"C:\Users\Admin\AppData\Local\Temp\8E46.tmp"67⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"68⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\8F40.tmp"C:\Users\Admin\AppData\Local\Temp\8F40.tmp"69⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"70⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"71⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\90E6.tmp"C:\Users\Admin\AppData\Local\Temp\90E6.tmp"72⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp"73⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\91E0.tmp"C:\Users\Admin\AppData\Local\Temp\91E0.tmp"74⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"75⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"76⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\9366.tmp"C:\Users\Admin\AppData\Local\Temp\9366.tmp"77⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"78⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\9451.tmp"C:\Users\Admin\AppData\Local\Temp\9451.tmp"79⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\94AE.tmp"C:\Users\Admin\AppData\Local\Temp\94AE.tmp"80⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"81⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\96E1.tmp"C:\Users\Admin\AppData\Local\Temp\96E1.tmp"82⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\976D.tmp"C:\Users\Admin\AppData\Local\Temp\976D.tmp"83⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\97DB.tmp"C:\Users\Admin\AppData\Local\Temp\97DB.tmp"84⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\9848.tmp"C:\Users\Admin\AppData\Local\Temp\9848.tmp"85⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\9904.tmp"C:\Users\Admin\AppData\Local\Temp\9904.tmp"86⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\99BF.tmp"C:\Users\Admin\AppData\Local\Temp\99BF.tmp"87⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"88⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"89⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"90⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"91⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"92⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"93⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"94⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"95⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"96⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"97⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"98⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"99⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\A086.tmp"C:\Users\Admin\AppData\Local\Temp\A086.tmp"100⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"101⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\A18F.tmp"C:\Users\Admin\AppData\Local\Temp\A18F.tmp"102⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\A23B.tmp"C:\Users\Admin\AppData\Local\Temp\A23B.tmp"103⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"104⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\A383.tmp"C:\Users\Admin\AppData\Local\Temp\A383.tmp"105⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\A410.tmp"C:\Users\Admin\AppData\Local\Temp\A410.tmp"106⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"107⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"108⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"109⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\A633.tmp"C:\Users\Admin\AppData\Local\Temp\A633.tmp"110⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"111⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"112⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"113⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\A894.tmp"C:\Users\Admin\AppData\Local\Temp\A894.tmp"114⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\A911.tmp"C:\Users\Admin\AppData\Local\Temp\A911.tmp"115⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\A99E.tmp"C:\Users\Admin\AppData\Local\Temp\A99E.tmp"116⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"117⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"118⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\AB53.tmp"C:\Users\Admin\AppData\Local\Temp\AB53.tmp"119⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"120⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"121⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"122⤵PID:4844
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-