Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
29-08-2023 19:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
da82fd85f2527292a78df09c28fc5671_mafia_JC.exe
Resource
win7-20230824-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
da82fd85f2527292a78df09c28fc5671_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
da82fd85f2527292a78df09c28fc5671_mafia_JC.exe
-
Size
488KB
-
MD5
da82fd85f2527292a78df09c28fc5671
-
SHA1
457605314dc95a362c40738bfac7ae7bdc9f2cee
-
SHA256
ddfb355a49ecc0b2811bea0dceb0c4a3eedc1a4feabe8281d0c6461ae05fa3fc
-
SHA512
bf3a9a53d67d4e7939b11ea03ad38fe584cfc37409d46e7ce8794cad2cea04c46cf9ff2d4c51d1e1ccd93cfb1d5e63eda938d62afbc9203a2f4513c2526b7472
-
SSDEEP
12288:/U5rCOTeiDQ8IMPsHdJVLJmHxgoDci3ENZ:/UQOJDDV0HfVL4HBp3EN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4320 9933.tmp 4860 99EE.tmp 1588 9AAA.tmp 5072 9BD2.tmp 1816 9C9E.tmp 2944 9D59.tmp 2156 9E05.tmp 3604 9EC0.tmp 2324 9F5D.tmp 4688 A316.tmp 4824 A3D1.tmp 2764 A539.tmp 5056 A5D5.tmp 5048 A671.tmp 2816 A70D.tmp 4516 A7D9.tmp 3748 A875.tmp 3796 A95F.tmp 4340 AA3A.tmp 3348 AAD6.tmp 2392 ABB1.tmp 4964 AC6C.tmp 2744 ACF9.tmp 3328 ADB5.tmp 2424 AE32.tmp 2516 AECE.tmp 4152 AF7A.tmp 468 B064.tmp 4548 B20A.tmp 3656 B2C5.tmp 1320 B381.tmp 1596 B3FE.tmp 3788 B4D9.tmp 5100 B556.tmp 1380 B5E2.tmp 1684 B66F.tmp 1332 B6FC.tmp 3944 B779.tmp 1376 B7E6.tmp 1000 B892.tmp 3860 B91E.tmp 2192 B98C.tmp 3732 BA18.tmp 2844 BAC4.tmp 208 BB70.tmp 1108 BBED.tmp 3320 BC7A.tmp 3600 BD26.tmp 4560 BDC2.tmp 3084 BE3F.tmp 1356 BECC.tmp 2180 BF58.tmp 4692 BFF4.tmp 5076 C091.tmp 428 C12D.tmp 2216 C1BA.tmp 3736 C246.tmp 4864 C2E2.tmp 4236 C35F.tmp 1508 C3CD.tmp 4200 C43A.tmp 2156 C4A8.tmp 4172 C4F6.tmp 4708 C592.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3736 wrote to memory of 4320 3736 da82fd85f2527292a78df09c28fc5671_mafia_JC.exe 82 PID 3736 wrote to memory of 4320 3736 da82fd85f2527292a78df09c28fc5671_mafia_JC.exe 82 PID 3736 wrote to memory of 4320 3736 da82fd85f2527292a78df09c28fc5671_mafia_JC.exe 82 PID 4320 wrote to memory of 4860 4320 9933.tmp 83 PID 4320 wrote to memory of 4860 4320 9933.tmp 83 PID 4320 wrote to memory of 4860 4320 9933.tmp 83 PID 4860 wrote to memory of 1588 4860 99EE.tmp 84 PID 4860 wrote to memory of 1588 4860 99EE.tmp 84 PID 4860 wrote to memory of 1588 4860 99EE.tmp 84 PID 1588 wrote to memory of 5072 1588 9AAA.tmp 85 PID 1588 wrote to memory of 5072 1588 9AAA.tmp 85 PID 1588 wrote to memory of 5072 1588 9AAA.tmp 85 PID 5072 wrote to memory of 1816 5072 9BD2.tmp 86 PID 5072 wrote to memory of 1816 5072 9BD2.tmp 86 PID 5072 wrote to memory of 1816 5072 9BD2.tmp 86 PID 1816 wrote to memory of 2944 1816 9C9E.tmp 87 PID 1816 wrote to memory of 2944 1816 9C9E.tmp 87 PID 1816 wrote to memory of 2944 1816 9C9E.tmp 87 PID 2944 wrote to memory of 2156 2944 9D59.tmp 88 PID 2944 wrote to memory of 2156 2944 9D59.tmp 88 PID 2944 wrote to memory of 2156 2944 9D59.tmp 88 PID 2156 wrote to memory of 3604 2156 9E05.tmp 89 PID 2156 wrote to memory of 3604 2156 9E05.tmp 89 PID 2156 wrote to memory of 3604 2156 9E05.tmp 89 PID 3604 wrote to memory of 2324 3604 9EC0.tmp 90 PID 3604 wrote to memory of 2324 3604 9EC0.tmp 90 PID 3604 wrote to memory of 2324 3604 9EC0.tmp 90 PID 2324 wrote to memory of 4688 2324 9F5D.tmp 91 PID 2324 wrote to memory of 4688 2324 9F5D.tmp 91 PID 2324 wrote to memory of 4688 2324 9F5D.tmp 91 PID 4688 wrote to memory of 4824 4688 A316.tmp 92 PID 4688 wrote to memory of 4824 4688 A316.tmp 92 PID 4688 wrote to memory of 4824 4688 A316.tmp 92 PID 4824 wrote to memory of 2764 4824 A3D1.tmp 93 PID 4824 wrote to memory of 2764 4824 A3D1.tmp 93 PID 4824 wrote to memory of 2764 4824 A3D1.tmp 93 PID 2764 wrote to memory of 5056 2764 A539.tmp 94 PID 2764 wrote to memory of 5056 2764 A539.tmp 94 PID 2764 wrote to memory of 5056 2764 A539.tmp 94 PID 5056 wrote to memory of 5048 5056 A5D5.tmp 95 PID 5056 wrote to memory of 5048 5056 A5D5.tmp 95 PID 5056 wrote to memory of 5048 5056 A5D5.tmp 95 PID 5048 wrote to memory of 2816 5048 A671.tmp 98 PID 5048 wrote to memory of 2816 5048 A671.tmp 98 PID 5048 wrote to memory of 2816 5048 A671.tmp 98 PID 2816 wrote to memory of 4516 2816 A70D.tmp 99 PID 2816 wrote to memory of 4516 2816 A70D.tmp 99 PID 2816 wrote to memory of 4516 2816 A70D.tmp 99 PID 4516 wrote to memory of 3748 4516 A7D9.tmp 100 PID 4516 wrote to memory of 3748 4516 A7D9.tmp 100 PID 4516 wrote to memory of 3748 4516 A7D9.tmp 100 PID 3748 wrote to memory of 3796 3748 A875.tmp 101 PID 3748 wrote to memory of 3796 3748 A875.tmp 101 PID 3748 wrote to memory of 3796 3748 A875.tmp 101 PID 3796 wrote to memory of 4340 3796 A95F.tmp 102 PID 3796 wrote to memory of 4340 3796 A95F.tmp 102 PID 3796 wrote to memory of 4340 3796 A95F.tmp 102 PID 4340 wrote to memory of 3348 4340 AA3A.tmp 103 PID 4340 wrote to memory of 3348 4340 AA3A.tmp 103 PID 4340 wrote to memory of 3348 4340 AA3A.tmp 103 PID 3348 wrote to memory of 2392 3348 AAD6.tmp 105 PID 3348 wrote to memory of 2392 3348 AAD6.tmp 105 PID 3348 wrote to memory of 2392 3348 AAD6.tmp 105 PID 2392 wrote to memory of 4964 2392 ABB1.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\da82fd85f2527292a78df09c28fc5671_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\da82fd85f2527292a78df09c28fc5671_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\99EE.tmp"C:\Users\Admin\AppData\Local\Temp\99EE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\9D59.tmp"C:\Users\Admin\AppData\Local\Temp\9D59.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\A539.tmp"C:\Users\Admin\AppData\Local\Temp\A539.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\A671.tmp"C:\Users\Admin\AppData\Local\Temp\A671.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"23⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"24⤵
- Executes dropped EXE
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"25⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"26⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\AECE.tmp"C:\Users\Admin\AppData\Local\Temp\AECE.tmp"27⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"28⤵
- Executes dropped EXE
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\B064.tmp"C:\Users\Admin\AppData\Local\Temp\B064.tmp"29⤵
- Executes dropped EXE
PID:468 -
C:\Users\Admin\AppData\Local\Temp\B20A.tmp"C:\Users\Admin\AppData\Local\Temp\B20A.tmp"30⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"31⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\B381.tmp"C:\Users\Admin\AppData\Local\Temp\B381.tmp"32⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"33⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"34⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"35⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"36⤵
- Executes dropped EXE
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\B66F.tmp"C:\Users\Admin\AppData\Local\Temp\B66F.tmp"37⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"38⤵
- Executes dropped EXE
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\B779.tmp"C:\Users\Admin\AppData\Local\Temp\B779.tmp"39⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"40⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\B892.tmp"C:\Users\Admin\AppData\Local\Temp\B892.tmp"41⤵
- Executes dropped EXE
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\B91E.tmp"C:\Users\Admin\AppData\Local\Temp\B91E.tmp"42⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\B98C.tmp"C:\Users\Admin\AppData\Local\Temp\B98C.tmp"43⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\BA18.tmp"C:\Users\Admin\AppData\Local\Temp\BA18.tmp"44⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"45⤵
- Executes dropped EXE
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\BB70.tmp"C:\Users\Admin\AppData\Local\Temp\BB70.tmp"46⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\BBED.tmp"C:\Users\Admin\AppData\Local\Temp\BBED.tmp"47⤵
- Executes dropped EXE
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"48⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\BD26.tmp"C:\Users\Admin\AppData\Local\Temp\BD26.tmp"49⤵
- Executes dropped EXE
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"50⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"51⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"52⤵
- Executes dropped EXE
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\BF58.tmp"C:\Users\Admin\AppData\Local\Temp\BF58.tmp"53⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"54⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\C091.tmp"C:\Users\Admin\AppData\Local\Temp\C091.tmp"55⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"56⤵
- Executes dropped EXE
PID:428 -
C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"57⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\C246.tmp"C:\Users\Admin\AppData\Local\Temp\C246.tmp"58⤵
- Executes dropped EXE
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"59⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\C35F.tmp"C:\Users\Admin\AppData\Local\Temp\C35F.tmp"60⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"61⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\C43A.tmp"C:\Users\Admin\AppData\Local\Temp\C43A.tmp"62⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"63⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"64⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\C592.tmp"C:\Users\Admin\AppData\Local\Temp\C592.tmp"65⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\C60F.tmp"C:\Users\Admin\AppData\Local\Temp\C60F.tmp"66⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"67⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\C738.tmp"C:\Users\Admin\AppData\Local\Temp\C738.tmp"68⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"69⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\C841.tmp"C:\Users\Admin\AppData\Local\Temp\C841.tmp"70⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"71⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\C90D.tmp"C:\Users\Admin\AppData\Local\Temp\C90D.tmp"72⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\C98A.tmp"C:\Users\Admin\AppData\Local\Temp\C98A.tmp"73⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\CA07.tmp"C:\Users\Admin\AppData\Local\Temp\CA07.tmp"74⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\CA93.tmp"C:\Users\Admin\AppData\Local\Temp\CA93.tmp"75⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"76⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"77⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\CC39.tmp"C:\Users\Admin\AppData\Local\Temp\CC39.tmp"78⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\CCD5.tmp"C:\Users\Admin\AppData\Local\Temp\CCD5.tmp"79⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\CD81.tmp"C:\Users\Admin\AppData\Local\Temp\CD81.tmp"80⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"81⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"82⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\CF17.tmp"C:\Users\Admin\AppData\Local\Temp\CF17.tmp"83⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\CF85.tmp"C:\Users\Admin\AppData\Local\Temp\CF85.tmp"84⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\CFF2.tmp"C:\Users\Admin\AppData\Local\Temp\CFF2.tmp"85⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\D050.tmp"C:\Users\Admin\AppData\Local\Temp\D050.tmp"86⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"87⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\D11B.tmp"C:\Users\Admin\AppData\Local\Temp\D11B.tmp"88⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\D198.tmp"C:\Users\Admin\AppData\Local\Temp\D198.tmp"89⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\D215.tmp"C:\Users\Admin\AppData\Local\Temp\D215.tmp"90⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\D292.tmp"C:\Users\Admin\AppData\Local\Temp\D292.tmp"91⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\D2FF.tmp"C:\Users\Admin\AppData\Local\Temp\D2FF.tmp"92⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\D37C.tmp"C:\Users\Admin\AppData\Local\Temp\D37C.tmp"93⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\D428.tmp"C:\Users\Admin\AppData\Local\Temp\D428.tmp"94⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\D4B5.tmp"C:\Users\Admin\AppData\Local\Temp\D4B5.tmp"95⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\D542.tmp"C:\Users\Admin\AppData\Local\Temp\D542.tmp"96⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\D5BF.tmp"C:\Users\Admin\AppData\Local\Temp\D5BF.tmp"97⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\D63C.tmp"C:\Users\Admin\AppData\Local\Temp\D63C.tmp"98⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"99⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\D764.tmp"C:\Users\Admin\AppData\Local\Temp\D764.tmp"100⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\D7F1.tmp"C:\Users\Admin\AppData\Local\Temp\D7F1.tmp"101⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\D88D.tmp"C:\Users\Admin\AppData\Local\Temp\D88D.tmp"102⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\D91A.tmp"C:\Users\Admin\AppData\Local\Temp\D91A.tmp"103⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\D9C6.tmp"C:\Users\Admin\AppData\Local\Temp\D9C6.tmp"104⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\DA62.tmp"C:\Users\Admin\AppData\Local\Temp\DA62.tmp"105⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\DADF.tmp"C:\Users\Admin\AppData\Local\Temp\DADF.tmp"106⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\DB7B.tmp"C:\Users\Admin\AppData\Local\Temp\DB7B.tmp"107⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\DC08.tmp"C:\Users\Admin\AppData\Local\Temp\DC08.tmp"108⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\DC75.tmp"C:\Users\Admin\AppData\Local\Temp\DC75.tmp"109⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\DD02.tmp"C:\Users\Admin\AppData\Local\Temp\DD02.tmp"110⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\DD9E.tmp"C:\Users\Admin\AppData\Local\Temp\DD9E.tmp"111⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\DE4A.tmp"C:\Users\Admin\AppData\Local\Temp\DE4A.tmp"112⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\DEC7.tmp"C:\Users\Admin\AppData\Local\Temp\DEC7.tmp"113⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\DF44.tmp"C:\Users\Admin\AppData\Local\Temp\DF44.tmp"114⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\DFC1.tmp"C:\Users\Admin\AppData\Local\Temp\DFC1.tmp"115⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\E04E.tmp"C:\Users\Admin\AppData\Local\Temp\E04E.tmp"116⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"117⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\E167.tmp"C:\Users\Admin\AppData\Local\Temp\E167.tmp"118⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\E213.tmp"C:\Users\Admin\AppData\Local\Temp\E213.tmp"119⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\E29F.tmp"C:\Users\Admin\AppData\Local\Temp\E29F.tmp"120⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\E33C.tmp"C:\Users\Admin\AppData\Local\Temp\E33C.tmp"121⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"122⤵PID:3576
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-