Analysis
-
max time kernel
157s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
02/09/2023, 15:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2023-08-22_1993309efa71c6de9c5cb5af3bb59e84_mafia_JC.exe
Resource
win7-20230831-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2023-08-22_1993309efa71c6de9c5cb5af3bb59e84_mafia_JC.exe
Resource
win10v2004-20230831-en
2 signatures
150 seconds
General
-
Target
2023-08-22_1993309efa71c6de9c5cb5af3bb59e84_mafia_JC.exe
-
Size
520KB
-
MD5
1993309efa71c6de9c5cb5af3bb59e84
-
SHA1
8467cf087d2c24c746fd0fe095b5fdb8db317bcb
-
SHA256
ddf35769ae03708fb3b999a1b95adcff435063bfbd9ca7eef31255fd35ff239c
-
SHA512
7899e850810ddbdd031b04a4124d9e15d8e497b4491db03c9e9f8118e48d1f3d377312dadf7d54a636f8fcc228c323f8e0ea81c95c10f4957fc35d49682ac591
-
SSDEEP
6144:lLvd/XzCjUIF1UuXLyQjmOH+JjLBtp2lCtpXTlL91BOEdfsSTsKSKaRS+AZ8Nhja:roRXOQjmOyLMCvXxBtdkSfXNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 208 DBAA.tmp 1500 DD40.tmp 1788 DDFC.tmp 1608 DF63.tmp 864 E02E.tmp 1956 E1C5.tmp 5048 E280.tmp 4024 E34B.tmp 4352 E416.tmp 1740 E4E2.tmp 4416 E5AD.tmp 900 E714.tmp 4496 E7B0.tmp 528 E8D9.tmp 2460 E9E3.tmp 1036 EA7F.tmp 704 EB69.tmp 4700 EC35.tmp 4272 ECC1.tmp 972 ED5D.tmp 5056 EE48.tmp 4748 EEF4.tmp 3932 EFAF.tmp 1040 F06B.tmp 1400 F145.tmp 4688 F220.tmp 3340 F2FB.tmp 4624 F3D6.tmp 228 F472.tmp 4220 F4FF.tmp 2636 F608.tmp 3512 F6B4.tmp 2792 F77F.tmp 4580 F81B.tmp 2756 F8A8.tmp 5068 F915.tmp 4676 F9B2.tmp 416 FA2F.tmp 4448 FABB.tmp 1892 FB48.tmp 3144 FBC5.tmp 2180 FC42.tmp 3680 FCDE.tmp 4188 FD7A.tmp 2424 FE07.tmp 456 FE84.tmp 5076 FF20.tmp 1260 FFEB.tmp 352 78.tmp 2036 105.tmp 224 1A1.tmp 180 23D.tmp 4632 2AB.tmp 4804 366.tmp 644 402.tmp 1060 460.tmp 4880 4ED.tmp 4692 55A.tmp 4140 5D7.tmp 4928 664.tmp 2488 6F0.tmp 2548 76D.tmp 3280 819.tmp 4476 887.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2036 wrote to memory of 208 2036 2023-08-22_1993309efa71c6de9c5cb5af3bb59e84_mafia_JC.exe 85 PID 2036 wrote to memory of 208 2036 2023-08-22_1993309efa71c6de9c5cb5af3bb59e84_mafia_JC.exe 85 PID 2036 wrote to memory of 208 2036 2023-08-22_1993309efa71c6de9c5cb5af3bb59e84_mafia_JC.exe 85 PID 208 wrote to memory of 1500 208 DBAA.tmp 86 PID 208 wrote to memory of 1500 208 DBAA.tmp 86 PID 208 wrote to memory of 1500 208 DBAA.tmp 86 PID 1500 wrote to memory of 1788 1500 DD40.tmp 87 PID 1500 wrote to memory of 1788 1500 DD40.tmp 87 PID 1500 wrote to memory of 1788 1500 DD40.tmp 87 PID 1788 wrote to memory of 1608 1788 DDFC.tmp 89 PID 1788 wrote to memory of 1608 1788 DDFC.tmp 89 PID 1788 wrote to memory of 1608 1788 DDFC.tmp 89 PID 1608 wrote to memory of 864 1608 DF63.tmp 90 PID 1608 wrote to memory of 864 1608 DF63.tmp 90 PID 1608 wrote to memory of 864 1608 DF63.tmp 90 PID 864 wrote to memory of 1956 864 E02E.tmp 91 PID 864 wrote to memory of 1956 864 E02E.tmp 91 PID 864 wrote to memory of 1956 864 E02E.tmp 91 PID 1956 wrote to memory of 5048 1956 E1C5.tmp 93 PID 1956 wrote to memory of 5048 1956 E1C5.tmp 93 PID 1956 wrote to memory of 5048 1956 E1C5.tmp 93 PID 5048 wrote to memory of 4024 5048 E280.tmp 94 PID 5048 wrote to memory of 4024 5048 E280.tmp 94 PID 5048 wrote to memory of 4024 5048 E280.tmp 94 PID 4024 wrote to memory of 4352 4024 E34B.tmp 95 PID 4024 wrote to memory of 4352 4024 E34B.tmp 95 PID 4024 wrote to memory of 4352 4024 E34B.tmp 95 PID 4352 wrote to memory of 1740 4352 E416.tmp 96 PID 4352 wrote to memory of 1740 4352 E416.tmp 96 PID 4352 wrote to memory of 1740 4352 E416.tmp 96 PID 1740 wrote to memory of 4416 1740 E4E2.tmp 97 PID 1740 wrote to memory of 4416 1740 E4E2.tmp 97 PID 1740 wrote to memory of 4416 1740 E4E2.tmp 97 PID 4416 wrote to memory of 900 4416 E5AD.tmp 98 PID 4416 wrote to memory of 900 4416 E5AD.tmp 98 PID 4416 wrote to memory of 900 4416 E5AD.tmp 98 PID 900 wrote to memory of 4496 900 E714.tmp 99 PID 900 wrote to memory of 4496 900 E714.tmp 99 PID 900 wrote to memory of 4496 900 E714.tmp 99 PID 4496 wrote to memory of 528 4496 E7B0.tmp 100 PID 4496 wrote to memory of 528 4496 E7B0.tmp 100 PID 4496 wrote to memory of 528 4496 E7B0.tmp 100 PID 528 wrote to memory of 2460 528 E8D9.tmp 101 PID 528 wrote to memory of 2460 528 E8D9.tmp 101 PID 528 wrote to memory of 2460 528 E8D9.tmp 101 PID 2460 wrote to memory of 1036 2460 E9E3.tmp 102 PID 2460 wrote to memory of 1036 2460 E9E3.tmp 102 PID 2460 wrote to memory of 1036 2460 E9E3.tmp 102 PID 1036 wrote to memory of 704 1036 EA7F.tmp 103 PID 1036 wrote to memory of 704 1036 EA7F.tmp 103 PID 1036 wrote to memory of 704 1036 EA7F.tmp 103 PID 704 wrote to memory of 4700 704 EB69.tmp 104 PID 704 wrote to memory of 4700 704 EB69.tmp 104 PID 704 wrote to memory of 4700 704 EB69.tmp 104 PID 4700 wrote to memory of 4272 4700 EC35.tmp 105 PID 4700 wrote to memory of 4272 4700 EC35.tmp 105 PID 4700 wrote to memory of 4272 4700 EC35.tmp 105 PID 4272 wrote to memory of 972 4272 ECC1.tmp 106 PID 4272 wrote to memory of 972 4272 ECC1.tmp 106 PID 4272 wrote to memory of 972 4272 ECC1.tmp 106 PID 972 wrote to memory of 5056 972 ED5D.tmp 107 PID 972 wrote to memory of 5056 972 ED5D.tmp 107 PID 972 wrote to memory of 5056 972 ED5D.tmp 107 PID 5056 wrote to memory of 4748 5056 EE48.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-22_1993309efa71c6de9c5cb5af3bb59e84_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-22_1993309efa71c6de9c5cb5af3bb59e84_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\DBAA.tmp"C:\Users\Admin\AppData\Local\Temp\DBAA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\DD40.tmp"C:\Users\Admin\AppData\Local\Temp\DD40.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\DF63.tmp"C:\Users\Admin\AppData\Local\Temp\DF63.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\E02E.tmp"C:\Users\Admin\AppData\Local\Temp\E02E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\E280.tmp"C:\Users\Admin\AppData\Local\Temp\E280.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\E34B.tmp"C:\Users\Admin\AppData\Local\Temp\E34B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\E416.tmp"C:\Users\Admin\AppData\Local\Temp\E416.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\E4E2.tmp"C:\Users\Admin\AppData\Local\Temp\E4E2.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\E714.tmp"C:\Users\Admin\AppData\Local\Temp\E714.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Users\Admin\AppData\Local\Temp\E9E3.tmp"C:\Users\Admin\AppData\Local\Temp\E9E3.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\EB69.tmp"C:\Users\Admin\AppData\Local\Temp\EB69.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\EC35.tmp"C:\Users\Admin\AppData\Local\Temp\EC35.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\EE48.tmp"C:\Users\Admin\AppData\Local\Temp\EE48.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\EEF4.tmp"C:\Users\Admin\AppData\Local\Temp\EEF4.tmp"23⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\EFAF.tmp"C:\Users\Admin\AppData\Local\Temp\EFAF.tmp"24⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\F06B.tmp"C:\Users\Admin\AppData\Local\Temp\F06B.tmp"25⤵
- Executes dropped EXE
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\F145.tmp"C:\Users\Admin\AppData\Local\Temp\F145.tmp"26⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\F220.tmp"C:\Users\Admin\AppData\Local\Temp\F220.tmp"27⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\F2FB.tmp"C:\Users\Admin\AppData\Local\Temp\F2FB.tmp"28⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\F3D6.tmp"C:\Users\Admin\AppData\Local\Temp\F3D6.tmp"29⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\F472.tmp"C:\Users\Admin\AppData\Local\Temp\F472.tmp"30⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"31⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\F608.tmp"C:\Users\Admin\AppData\Local\Temp\F608.tmp"32⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\F6B4.tmp"C:\Users\Admin\AppData\Local\Temp\F6B4.tmp"33⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\F77F.tmp"C:\Users\Admin\AppData\Local\Temp\F77F.tmp"34⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\F81B.tmp"C:\Users\Admin\AppData\Local\Temp\F81B.tmp"35⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"36⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\F915.tmp"C:\Users\Admin\AppData\Local\Temp\F915.tmp"37⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"38⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\FA2F.tmp"C:\Users\Admin\AppData\Local\Temp\FA2F.tmp"39⤵
- Executes dropped EXE
PID:416 -
C:\Users\Admin\AppData\Local\Temp\FABB.tmp"C:\Users\Admin\AppData\Local\Temp\FABB.tmp"40⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\FB48.tmp"C:\Users\Admin\AppData\Local\Temp\FB48.tmp"41⤵
- Executes dropped EXE
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"42⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\FC42.tmp"C:\Users\Admin\AppData\Local\Temp\FC42.tmp"43⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\FCDE.tmp"C:\Users\Admin\AppData\Local\Temp\FCDE.tmp"44⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\FD7A.tmp"C:\Users\Admin\AppData\Local\Temp\FD7A.tmp"45⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\FE07.tmp"C:\Users\Admin\AppData\Local\Temp\FE07.tmp"46⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\FE84.tmp"C:\Users\Admin\AppData\Local\Temp\FE84.tmp"47⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\FF20.tmp"C:\Users\Admin\AppData\Local\Temp\FF20.tmp"48⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\FFEB.tmp"C:\Users\Admin\AppData\Local\Temp\FFEB.tmp"49⤵
- Executes dropped EXE
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\78.tmp"C:\Users\Admin\AppData\Local\Temp\78.tmp"50⤵
- Executes dropped EXE
PID:352 -
C:\Users\Admin\AppData\Local\Temp\105.tmp"C:\Users\Admin\AppData\Local\Temp\105.tmp"51⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\1A1.tmp"C:\Users\Admin\AppData\Local\Temp\1A1.tmp"52⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\23D.tmp"C:\Users\Admin\AppData\Local\Temp\23D.tmp"53⤵
- Executes dropped EXE
PID:180 -
C:\Users\Admin\AppData\Local\Temp\2AB.tmp"C:\Users\Admin\AppData\Local\Temp\2AB.tmp"54⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\366.tmp"C:\Users\Admin\AppData\Local\Temp\366.tmp"55⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\402.tmp"C:\Users\Admin\AppData\Local\Temp\402.tmp"56⤵
- Executes dropped EXE
PID:644 -
C:\Users\Admin\AppData\Local\Temp\460.tmp"C:\Users\Admin\AppData\Local\Temp\460.tmp"57⤵
- Executes dropped EXE
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\4ED.tmp"C:\Users\Admin\AppData\Local\Temp\4ED.tmp"58⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\55A.tmp"C:\Users\Admin\AppData\Local\Temp\55A.tmp"59⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\5D7.tmp"C:\Users\Admin\AppData\Local\Temp\5D7.tmp"60⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\664.tmp"C:\Users\Admin\AppData\Local\Temp\664.tmp"61⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\6F0.tmp"C:\Users\Admin\AppData\Local\Temp\6F0.tmp"62⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\76D.tmp"C:\Users\Admin\AppData\Local\Temp\76D.tmp"63⤵
- Executes dropped EXE
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\819.tmp"C:\Users\Admin\AppData\Local\Temp\819.tmp"64⤵
- Executes dropped EXE
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\887.tmp"C:\Users\Admin\AppData\Local\Temp\887.tmp"65⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\8F4.tmp"C:\Users\Admin\AppData\Local\Temp\8F4.tmp"66⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\961.tmp"C:\Users\Admin\AppData\Local\Temp\961.tmp"67⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\9CF.tmp"C:\Users\Admin\AppData\Local\Temp\9CF.tmp"68⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\A2C.tmp"C:\Users\Admin\AppData\Local\Temp\A2C.tmp"69⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\AA9.tmp"C:\Users\Admin\AppData\Local\Temp\AA9.tmp"70⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\B46.tmp"C:\Users\Admin\AppData\Local\Temp\B46.tmp"71⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\BB3.tmp"C:\Users\Admin\AppData\Local\Temp\BB3.tmp"72⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\C30.tmp"C:\Users\Admin\AppData\Local\Temp\C30.tmp"73⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\CBD.tmp"C:\Users\Admin\AppData\Local\Temp\CBD.tmp"74⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\D3A.tmp"C:\Users\Admin\AppData\Local\Temp\D3A.tmp"75⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\DB7.tmp"C:\Users\Admin\AppData\Local\Temp\DB7.tmp"76⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"77⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\EB1.tmp"C:\Users\Admin\AppData\Local\Temp\EB1.tmp"78⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\F3D.tmp"C:\Users\Admin\AppData\Local\Temp\F3D.tmp"79⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\FCA.tmp"C:\Users\Admin\AppData\Local\Temp\FCA.tmp"80⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\1066.tmp"C:\Users\Admin\AppData\Local\Temp\1066.tmp"81⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\10F3.tmp"C:\Users\Admin\AppData\Local\Temp\10F3.tmp"82⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\117F.tmp"C:\Users\Admin\AppData\Local\Temp\117F.tmp"83⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\11ED.tmp"C:\Users\Admin\AppData\Local\Temp\11ED.tmp"84⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\1289.tmp"C:\Users\Admin\AppData\Local\Temp\1289.tmp"85⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\12F6.tmp"C:\Users\Admin\AppData\Local\Temp\12F6.tmp"86⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\1373.tmp"C:\Users\Admin\AppData\Local\Temp\1373.tmp"87⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\1400.tmp"C:\Users\Admin\AppData\Local\Temp\1400.tmp"88⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\146D.tmp"C:\Users\Admin\AppData\Local\Temp\146D.tmp"89⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\14EA.tmp"C:\Users\Admin\AppData\Local\Temp\14EA.tmp"90⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\1567.tmp"C:\Users\Admin\AppData\Local\Temp\1567.tmp"91⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\15C5.tmp"C:\Users\Admin\AppData\Local\Temp\15C5.tmp"92⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\1642.tmp"C:\Users\Admin\AppData\Local\Temp\1642.tmp"93⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\16B0.tmp"C:\Users\Admin\AppData\Local\Temp\16B0.tmp"94⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\171D.tmp"C:\Users\Admin\AppData\Local\Temp\171D.tmp"95⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\17AA.tmp"C:\Users\Admin\AppData\Local\Temp\17AA.tmp"96⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\1807.tmp"C:\Users\Admin\AppData\Local\Temp\1807.tmp"97⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\1894.tmp"C:\Users\Admin\AppData\Local\Temp\1894.tmp"98⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\1901.tmp"C:\Users\Admin\AppData\Local\Temp\1901.tmp"99⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\19BD.tmp"C:\Users\Admin\AppData\Local\Temp\19BD.tmp"100⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\1A3A.tmp"C:\Users\Admin\AppData\Local\Temp\1A3A.tmp"101⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"102⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\1B34.tmp"C:\Users\Admin\AppData\Local\Temp\1B34.tmp"103⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\1BD0.tmp"C:\Users\Admin\AppData\Local\Temp\1BD0.tmp"104⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"105⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"106⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\1D47.tmp"C:\Users\Admin\AppData\Local\Temp\1D47.tmp"107⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\1DE3.tmp"C:\Users\Admin\AppData\Local\Temp\1DE3.tmp"108⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\1E70.tmp"C:\Users\Admin\AppData\Local\Temp\1E70.tmp"109⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\1EDD.tmp"C:\Users\Admin\AppData\Local\Temp\1EDD.tmp"110⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\1F7A.tmp"C:\Users\Admin\AppData\Local\Temp\1F7A.tmp"111⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"112⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\2054.tmp"C:\Users\Admin\AppData\Local\Temp\2054.tmp"113⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\20F1.tmp"C:\Users\Admin\AppData\Local\Temp\20F1.tmp"114⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\217D.tmp"C:\Users\Admin\AppData\Local\Temp\217D.tmp"115⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\21FA.tmp"C:\Users\Admin\AppData\Local\Temp\21FA.tmp"116⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\2287.tmp"C:\Users\Admin\AppData\Local\Temp\2287.tmp"117⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\22F4.tmp"C:\Users\Admin\AppData\Local\Temp\22F4.tmp"118⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\2362.tmp"C:\Users\Admin\AppData\Local\Temp\2362.tmp"119⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\23EE.tmp"C:\Users\Admin\AppData\Local\Temp\23EE.tmp"120⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\245C.tmp"C:\Users\Admin\AppData\Local\Temp\245C.tmp"121⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\24C9.tmp"C:\Users\Admin\AppData\Local\Temp\24C9.tmp"122⤵PID:3768
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-