Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
02/09/2023, 16:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2023-08-22_462c7b48bb2c3b97e2a1e3256a25a6cc_mafia_JC.exe
Resource
win7-20230831-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2023-08-22_462c7b48bb2c3b97e2a1e3256a25a6cc_mafia_JC.exe
Resource
win10v2004-20230831-en
2 signatures
150 seconds
General
-
Target
2023-08-22_462c7b48bb2c3b97e2a1e3256a25a6cc_mafia_JC.exe
-
Size
486KB
-
MD5
462c7b48bb2c3b97e2a1e3256a25a6cc
-
SHA1
341d79d2d0739c922df25a653fc140faddb8e764
-
SHA256
0290ec65b3ec6657f61fbc157a56b442bf2f910176f0e03889606332f1ba594a
-
SHA512
3b00b015d5c156084024fb87a9c9e30c779cda201292a7cf36d2a831431f061e86e57491c6771d60e000bf16b7f5a3b1e4ceffa6cdf7075b8f2b97bc101c6106
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7RXDSr7FJMK+cpa0utG+d3aa+evGqrp7lW0qR:/U5rCOTeiDVe7FNPSGq364RQNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4004 82EB.tmp 960 83B7.tmp 4148 8453.tmp 1092 850E.tmp 2388 85BA.tmp 2228 8666.tmp 4652 86E3.tmp 3948 87DD.tmp 3724 886A.tmp 4964 8944.tmp 3332 89F0.tmp 540 8A6D.tmp 1040 8B19.tmp 852 8BE4.tmp 1984 8D0D.tmp 3836 8DC9.tmp 3712 8E75.tmp 2488 8F11.tmp 3052 8FAD.tmp 3568 9078.tmp 1932 9105.tmp 1528 9182.tmp 2032 920E.tmp 4432 92E9.tmp 1688 93D4.tmp 1284 949F.tmp 4712 95A8.tmp 4912 9693.tmp 2256 973F.tmp 3852 9839.tmp 3092 9904.tmp 4812 99DE.tmp 4888 9AB9.tmp 2536 9B46.tmp 1680 9BE2.tmp 3220 9C8E.tmp 4484 9D2A.tmp 2444 9DB7.tmp 4292 9E34.tmp 3200 9EB1.tmp 2116 9F5D.tmp 4592 9FF9.tmp 4528 A086.tmp 1620 A122.tmp 2596 A18F.tmp 4992 A21C.tmp 640 A2B8.tmp 3172 A335.tmp 1956 A3D1.tmp 1664 A47D.tmp 1436 A4FA.tmp 2212 A577.tmp 4652 A5F4.tmp 1352 A690.tmp 3128 A73C.tmp 4840 A7E8.tmp 4564 A856.tmp 112 A8E2.tmp 232 A95F.tmp 3960 A9EC.tmp 1452 AA78.tmp 3496 AAE6.tmp 3004 AB92.tmp 3240 AC1E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2116 wrote to memory of 4004 2116 2023-08-22_462c7b48bb2c3b97e2a1e3256a25a6cc_mafia_JC.exe 84 PID 2116 wrote to memory of 4004 2116 2023-08-22_462c7b48bb2c3b97e2a1e3256a25a6cc_mafia_JC.exe 84 PID 2116 wrote to memory of 4004 2116 2023-08-22_462c7b48bb2c3b97e2a1e3256a25a6cc_mafia_JC.exe 84 PID 4004 wrote to memory of 960 4004 82EB.tmp 85 PID 4004 wrote to memory of 960 4004 82EB.tmp 85 PID 4004 wrote to memory of 960 4004 82EB.tmp 85 PID 960 wrote to memory of 4148 960 83B7.tmp 86 PID 960 wrote to memory of 4148 960 83B7.tmp 86 PID 960 wrote to memory of 4148 960 83B7.tmp 86 PID 4148 wrote to memory of 1092 4148 8453.tmp 88 PID 4148 wrote to memory of 1092 4148 8453.tmp 88 PID 4148 wrote to memory of 1092 4148 8453.tmp 88 PID 1092 wrote to memory of 2388 1092 850E.tmp 89 PID 1092 wrote to memory of 2388 1092 850E.tmp 89 PID 1092 wrote to memory of 2388 1092 850E.tmp 89 PID 2388 wrote to memory of 2228 2388 85BA.tmp 90 PID 2388 wrote to memory of 2228 2388 85BA.tmp 90 PID 2388 wrote to memory of 2228 2388 85BA.tmp 90 PID 2228 wrote to memory of 4652 2228 8666.tmp 91 PID 2228 wrote to memory of 4652 2228 8666.tmp 91 PID 2228 wrote to memory of 4652 2228 8666.tmp 91 PID 4652 wrote to memory of 3948 4652 86E3.tmp 92 PID 4652 wrote to memory of 3948 4652 86E3.tmp 92 PID 4652 wrote to memory of 3948 4652 86E3.tmp 92 PID 3948 wrote to memory of 3724 3948 87DD.tmp 93 PID 3948 wrote to memory of 3724 3948 87DD.tmp 93 PID 3948 wrote to memory of 3724 3948 87DD.tmp 93 PID 3724 wrote to memory of 4964 3724 886A.tmp 94 PID 3724 wrote to memory of 4964 3724 886A.tmp 94 PID 3724 wrote to memory of 4964 3724 886A.tmp 94 PID 4964 wrote to memory of 3332 4964 8944.tmp 95 PID 4964 wrote to memory of 3332 4964 8944.tmp 95 PID 4964 wrote to memory of 3332 4964 8944.tmp 95 PID 3332 wrote to memory of 540 3332 89F0.tmp 96 PID 3332 wrote to memory of 540 3332 89F0.tmp 96 PID 3332 wrote to memory of 540 3332 89F0.tmp 96 PID 540 wrote to memory of 1040 540 8A6D.tmp 97 PID 540 wrote to memory of 1040 540 8A6D.tmp 97 PID 540 wrote to memory of 1040 540 8A6D.tmp 97 PID 1040 wrote to memory of 852 1040 8B19.tmp 98 PID 1040 wrote to memory of 852 1040 8B19.tmp 98 PID 1040 wrote to memory of 852 1040 8B19.tmp 98 PID 852 wrote to memory of 1984 852 8BE4.tmp 99 PID 852 wrote to memory of 1984 852 8BE4.tmp 99 PID 852 wrote to memory of 1984 852 8BE4.tmp 99 PID 1984 wrote to memory of 3836 1984 8D0D.tmp 100 PID 1984 wrote to memory of 3836 1984 8D0D.tmp 100 PID 1984 wrote to memory of 3836 1984 8D0D.tmp 100 PID 3836 wrote to memory of 3712 3836 8DC9.tmp 102 PID 3836 wrote to memory of 3712 3836 8DC9.tmp 102 PID 3836 wrote to memory of 3712 3836 8DC9.tmp 102 PID 3712 wrote to memory of 2488 3712 8E75.tmp 103 PID 3712 wrote to memory of 2488 3712 8E75.tmp 103 PID 3712 wrote to memory of 2488 3712 8E75.tmp 103 PID 2488 wrote to memory of 3052 2488 8F11.tmp 104 PID 2488 wrote to memory of 3052 2488 8F11.tmp 104 PID 2488 wrote to memory of 3052 2488 8F11.tmp 104 PID 3052 wrote to memory of 3568 3052 8FAD.tmp 105 PID 3052 wrote to memory of 3568 3052 8FAD.tmp 105 PID 3052 wrote to memory of 3568 3052 8FAD.tmp 105 PID 3568 wrote to memory of 1932 3568 9078.tmp 107 PID 3568 wrote to memory of 1932 3568 9078.tmp 107 PID 3568 wrote to memory of 1932 3568 9078.tmp 107 PID 1932 wrote to memory of 1528 1932 9105.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-22_462c7b48bb2c3b97e2a1e3256a25a6cc_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-22_462c7b48bb2c3b97e2a1e3256a25a6cc_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\82EB.tmp"C:\Users\Admin\AppData\Local\Temp\82EB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\83B7.tmp"C:\Users\Admin\AppData\Local\Temp\83B7.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\8453.tmp"C:\Users\Admin\AppData\Local\Temp\8453.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\850E.tmp"C:\Users\Admin\AppData\Local\Temp\850E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\85BA.tmp"C:\Users\Admin\AppData\Local\Temp\85BA.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\8666.tmp"C:\Users\Admin\AppData\Local\Temp\8666.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\86E3.tmp"C:\Users\Admin\AppData\Local\Temp\86E3.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\87DD.tmp"C:\Users\Admin\AppData\Local\Temp\87DD.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\886A.tmp"C:\Users\Admin\AppData\Local\Temp\886A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\89F0.tmp"C:\Users\Admin\AppData\Local\Temp\89F0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\8B19.tmp"C:\Users\Admin\AppData\Local\Temp\8B19.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\8E75.tmp"C:\Users\Admin\AppData\Local\Temp\8E75.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\9078.tmp"C:\Users\Admin\AppData\Local\Temp\9078.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\9182.tmp"C:\Users\Admin\AppData\Local\Temp\9182.tmp"23⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"24⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"25⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"26⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"27⤵
- Executes dropped EXE
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"28⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\9693.tmp"C:\Users\Admin\AppData\Local\Temp\9693.tmp"29⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"30⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\9839.tmp"C:\Users\Admin\AppData\Local\Temp\9839.tmp"31⤵
- Executes dropped EXE
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\9904.tmp"C:\Users\Admin\AppData\Local\Temp\9904.tmp"32⤵
- Executes dropped EXE
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"33⤵
- Executes dropped EXE
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"34⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"35⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"36⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"37⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"38⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"39⤵
- Executes dropped EXE
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"40⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"41⤵
- Executes dropped EXE
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"42⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"43⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\A086.tmp"C:\Users\Admin\AppData\Local\Temp\A086.tmp"44⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"45⤵
- Executes dropped EXE
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\A18F.tmp"C:\Users\Admin\AppData\Local\Temp\A18F.tmp"46⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\A21C.tmp"C:\Users\Admin\AppData\Local\Temp\A21C.tmp"47⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"48⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"49⤵
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"50⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\A47D.tmp"C:\Users\Admin\AppData\Local\Temp\A47D.tmp"51⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"52⤵
- Executes dropped EXE
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\A577.tmp"C:\Users\Admin\AppData\Local\Temp\A577.tmp"53⤵
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"54⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"55⤵
- Executes dropped EXE
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\A73C.tmp"C:\Users\Admin\AppData\Local\Temp\A73C.tmp"56⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"57⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\A856.tmp"C:\Users\Admin\AppData\Local\Temp\A856.tmp"58⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"59⤵
- Executes dropped EXE
PID:112 -
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"60⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"61⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"62⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"63⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\AB92.tmp"C:\Users\Admin\AppData\Local\Temp\AB92.tmp"64⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"65⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"66⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\AD38.tmp"C:\Users\Admin\AppData\Local\Temp\AD38.tmp"67⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"68⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"69⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"70⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"71⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"72⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\B064.tmp"C:\Users\Admin\AppData\Local\Temp\B064.tmp"73⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"74⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\B15E.tmp"C:\Users\Admin\AppData\Local\Temp\B15E.tmp"75⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\B21A.tmp"C:\Users\Admin\AppData\Local\Temp\B21A.tmp"76⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"77⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\B352.tmp"C:\Users\Admin\AppData\Local\Temp\B352.tmp"78⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"79⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\B43C.tmp"C:\Users\Admin\AppData\Local\Temp\B43C.tmp"80⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"81⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\B575.tmp"C:\Users\Admin\AppData\Local\Temp\B575.tmp"82⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\B602.tmp"C:\Users\Admin\AppData\Local\Temp\B602.tmp"83⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\B69E.tmp"C:\Users\Admin\AppData\Local\Temp\B69E.tmp"84⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\B73A.tmp"C:\Users\Admin\AppData\Local\Temp\B73A.tmp"85⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"86⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\B853.tmp"C:\Users\Admin\AppData\Local\Temp\B853.tmp"87⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"88⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\B97C.tmp"C:\Users\Admin\AppData\Local\Temp\B97C.tmp"89⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"90⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\BA95.tmp"C:\Users\Admin\AppData\Local\Temp\BA95.tmp"91⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\BB03.tmp"C:\Users\Admin\AppData\Local\Temp\BB03.tmp"92⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"93⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"94⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"95⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\BD55.tmp"C:\Users\Admin\AppData\Local\Temp\BD55.tmp"96⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"97⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"98⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\BEEB.tmp"C:\Users\Admin\AppData\Local\Temp\BEEB.tmp"99⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\BF58.tmp"C:\Users\Admin\AppData\Local\Temp\BF58.tmp"100⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"101⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\C052.tmp"C:\Users\Admin\AppData\Local\Temp\C052.tmp"102⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"103⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\C17B.tmp"C:\Users\Admin\AppData\Local\Temp\C17B.tmp"104⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\C208.tmp"C:\Users\Admin\AppData\Local\Temp\C208.tmp"105⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\C294.tmp"C:\Users\Admin\AppData\Local\Temp\C294.tmp"106⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\C331.tmp"C:\Users\Admin\AppData\Local\Temp\C331.tmp"107⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\C3BD.tmp"C:\Users\Admin\AppData\Local\Temp\C3BD.tmp"108⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\C44A.tmp"C:\Users\Admin\AppData\Local\Temp\C44A.tmp"109⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"110⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\C553.tmp"C:\Users\Admin\AppData\Local\Temp\C553.tmp"111⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"112⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\C67C.tmp"C:\Users\Admin\AppData\Local\Temp\C67C.tmp"113⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\C709.tmp"C:\Users\Admin\AppData\Local\Temp\C709.tmp"114⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"115⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\C841.tmp"C:\Users\Admin\AppData\Local\Temp\C841.tmp"116⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"117⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\C92C.tmp"C:\Users\Admin\AppData\Local\Temp\C92C.tmp"118⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"119⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\CA35.tmp"C:\Users\Admin\AppData\Local\Temp\CA35.tmp"120⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"121⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"122⤵PID:2000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-