Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
03-09-2023 09:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2023-08-22_79151796d46daf4b4de86347a903c844_mafia_JC.exe
Resource
win7-20230831-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2023-08-22_79151796d46daf4b4de86347a903c844_mafia_JC.exe
Resource
win10v2004-20230831-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2023-08-22_79151796d46daf4b4de86347a903c844_mafia_JC.exe
-
Size
520KB
-
MD5
79151796d46daf4b4de86347a903c844
-
SHA1
1147a085411d5bc0c3912485dcbd4d4b139c28dc
-
SHA256
18f9b43bf19d4e1a885954bbf7664fedc02d07840dc6b0b96e4ad2073d266666
-
SHA512
f5e7001bd855bbbb09c14ea5919ff202a9c73fc3008d00ab89724391b23dae5fb4f5f0ceb62d107c86988f4be8103934b80895ec43f690de4ca2db45fea9820d
-
SSDEEP
12288:roRXOQjmOy2HsS/oLj+XCtUtBxMolQbNZ:rogQ9y2HYGmVXbN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1444 8FEC.tmp 4628 9097.tmp 3048 9172.tmp 1380 920E.tmp 4112 92DA.tmp 1416 9431.tmp 4288 94ED.tmp 2816 9579.tmp 3356 9645.tmp 2460 96D1.tmp 4368 975E.tmp 4840 98E4.tmp 208 99B0.tmp 1124 9A3C.tmp 1776 9AF8.tmp 2876 9BD2.tmp 116 9C8E.tmp 1084 9D0B.tmp 2388 9DC6.tmp 4116 9E82.tmp 1212 9F6C.tmp 4000 A028.tmp 2856 A112.tmp 5032 A1CE.tmp 5080 A289.tmp 2784 A325.tmp 1716 A3F1.tmp 4528 A4EB.tmp 3184 A577.tmp 4436 A623.tmp 1420 A71D.tmp 1640 A807.tmp 1836 A8E2.tmp 1796 A95F.tmp 3008 A9DC.tmp 1900 AA69.tmp 2812 AB05.tmp 1412 AB82.tmp 4372 AC1E.tmp 2400 ACBB.tmp 3032 AD57.tmp 3088 AE32.tmp 2224 AECE.tmp 4916 AF6A.tmp 2672 AFD7.tmp 1944 B074.tmp 4212 B120.tmp 4824 B1AC.tmp 1040 B239.tmp 3948 B2D5.tmp 4216 B352.tmp 972 B3DF.tmp 3396 B47B.tmp 3204 B508.tmp 4296 B594.tmp 432 B630.tmp 2108 B6AD.tmp 468 B72A.tmp 3940 B7B7.tmp 4728 B853.tmp 916 B8D0.tmp 4288 B95D.tmp 5072 B9F9.tmp 3300 BA86.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4408 wrote to memory of 1444 4408 2023-08-22_79151796d46daf4b4de86347a903c844_mafia_JC.exe 85 PID 4408 wrote to memory of 1444 4408 2023-08-22_79151796d46daf4b4de86347a903c844_mafia_JC.exe 85 PID 4408 wrote to memory of 1444 4408 2023-08-22_79151796d46daf4b4de86347a903c844_mafia_JC.exe 85 PID 1444 wrote to memory of 4628 1444 8FEC.tmp 86 PID 1444 wrote to memory of 4628 1444 8FEC.tmp 86 PID 1444 wrote to memory of 4628 1444 8FEC.tmp 86 PID 4628 wrote to memory of 3048 4628 9097.tmp 87 PID 4628 wrote to memory of 3048 4628 9097.tmp 87 PID 4628 wrote to memory of 3048 4628 9097.tmp 87 PID 3048 wrote to memory of 1380 3048 9172.tmp 88 PID 3048 wrote to memory of 1380 3048 9172.tmp 88 PID 3048 wrote to memory of 1380 3048 9172.tmp 88 PID 1380 wrote to memory of 4112 1380 920E.tmp 89 PID 1380 wrote to memory of 4112 1380 920E.tmp 89 PID 1380 wrote to memory of 4112 1380 920E.tmp 89 PID 4112 wrote to memory of 1416 4112 92DA.tmp 90 PID 4112 wrote to memory of 1416 4112 92DA.tmp 90 PID 4112 wrote to memory of 1416 4112 92DA.tmp 90 PID 1416 wrote to memory of 4288 1416 9431.tmp 91 PID 1416 wrote to memory of 4288 1416 9431.tmp 91 PID 1416 wrote to memory of 4288 1416 9431.tmp 91 PID 4288 wrote to memory of 2816 4288 94ED.tmp 92 PID 4288 wrote to memory of 2816 4288 94ED.tmp 92 PID 4288 wrote to memory of 2816 4288 94ED.tmp 92 PID 2816 wrote to memory of 3356 2816 9579.tmp 93 PID 2816 wrote to memory of 3356 2816 9579.tmp 93 PID 2816 wrote to memory of 3356 2816 9579.tmp 93 PID 3356 wrote to memory of 2460 3356 9645.tmp 94 PID 3356 wrote to memory of 2460 3356 9645.tmp 94 PID 3356 wrote to memory of 2460 3356 9645.tmp 94 PID 2460 wrote to memory of 4368 2460 96D1.tmp 96 PID 2460 wrote to memory of 4368 2460 96D1.tmp 96 PID 2460 wrote to memory of 4368 2460 96D1.tmp 96 PID 4368 wrote to memory of 4840 4368 975E.tmp 97 PID 4368 wrote to memory of 4840 4368 975E.tmp 97 PID 4368 wrote to memory of 4840 4368 975E.tmp 97 PID 4840 wrote to memory of 208 4840 98E4.tmp 98 PID 4840 wrote to memory of 208 4840 98E4.tmp 98 PID 4840 wrote to memory of 208 4840 98E4.tmp 98 PID 208 wrote to memory of 1124 208 99B0.tmp 100 PID 208 wrote to memory of 1124 208 99B0.tmp 100 PID 208 wrote to memory of 1124 208 99B0.tmp 100 PID 1124 wrote to memory of 1776 1124 9A3C.tmp 101 PID 1124 wrote to memory of 1776 1124 9A3C.tmp 101 PID 1124 wrote to memory of 1776 1124 9A3C.tmp 101 PID 1776 wrote to memory of 2876 1776 9AF8.tmp 102 PID 1776 wrote to memory of 2876 1776 9AF8.tmp 102 PID 1776 wrote to memory of 2876 1776 9AF8.tmp 102 PID 2876 wrote to memory of 116 2876 9BD2.tmp 103 PID 2876 wrote to memory of 116 2876 9BD2.tmp 103 PID 2876 wrote to memory of 116 2876 9BD2.tmp 103 PID 116 wrote to memory of 1084 116 9C8E.tmp 104 PID 116 wrote to memory of 1084 116 9C8E.tmp 104 PID 116 wrote to memory of 1084 116 9C8E.tmp 104 PID 1084 wrote to memory of 2388 1084 9D0B.tmp 105 PID 1084 wrote to memory of 2388 1084 9D0B.tmp 105 PID 1084 wrote to memory of 2388 1084 9D0B.tmp 105 PID 2388 wrote to memory of 4116 2388 9DC6.tmp 106 PID 2388 wrote to memory of 4116 2388 9DC6.tmp 106 PID 2388 wrote to memory of 4116 2388 9DC6.tmp 106 PID 4116 wrote to memory of 1212 4116 9E82.tmp 107 PID 4116 wrote to memory of 1212 4116 9E82.tmp 107 PID 4116 wrote to memory of 1212 4116 9E82.tmp 107 PID 1212 wrote to memory of 4000 1212 9F6C.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-22_79151796d46daf4b4de86347a903c844_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-22_79151796d46daf4b4de86347a903c844_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\9097.tmp"C:\Users\Admin\AppData\Local\Temp\9097.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\92DA.tmp"C:\Users\Admin\AppData\Local\Temp\92DA.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\94ED.tmp"C:\Users\Admin\AppData\Local\Temp\94ED.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\9579.tmp"C:\Users\Admin\AppData\Local\Temp\9579.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\96D1.tmp"C:\Users\Admin\AppData\Local\Temp\96D1.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\98E4.tmp"C:\Users\Admin\AppData\Local\Temp\98E4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\A028.tmp"C:\Users\Admin\AppData\Local\Temp\A028.tmp"23⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\A112.tmp"C:\Users\Admin\AppData\Local\Temp\A112.tmp"24⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"25⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"26⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\A325.tmp"C:\Users\Admin\AppData\Local\Temp\A325.tmp"27⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"28⤵
- Executes dropped EXE
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"29⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\A577.tmp"C:\Users\Admin\AppData\Local\Temp\A577.tmp"30⤵
- Executes dropped EXE
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"31⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"32⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"33⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"34⤵
- Executes dropped EXE
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"35⤵
- Executes dropped EXE
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"36⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\AA69.tmp"C:\Users\Admin\AppData\Local\Temp\AA69.tmp"37⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\AB05.tmp"C:\Users\Admin\AppData\Local\Temp\AB05.tmp"38⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\AB82.tmp"C:\Users\Admin\AppData\Local\Temp\AB82.tmp"39⤵
- Executes dropped EXE
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"40⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"41⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\AD57.tmp"C:\Users\Admin\AppData\Local\Temp\AD57.tmp"42⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"43⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\AECE.tmp"C:\Users\Admin\AppData\Local\Temp\AECE.tmp"44⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"45⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"46⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\B074.tmp"C:\Users\Admin\AppData\Local\Temp\B074.tmp"47⤵
- Executes dropped EXE
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\B120.tmp"C:\Users\Admin\AppData\Local\Temp\B120.tmp"48⤵
- Executes dropped EXE
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"49⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\B239.tmp"C:\Users\Admin\AppData\Local\Temp\B239.tmp"50⤵
- Executes dropped EXE
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"51⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\B352.tmp"C:\Users\Admin\AppData\Local\Temp\B352.tmp"52⤵
- Executes dropped EXE
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"53⤵
- Executes dropped EXE
PID:972 -
C:\Users\Admin\AppData\Local\Temp\B47B.tmp"C:\Users\Admin\AppData\Local\Temp\B47B.tmp"54⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\B508.tmp"C:\Users\Admin\AppData\Local\Temp\B508.tmp"55⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\B594.tmp"C:\Users\Admin\AppData\Local\Temp\B594.tmp"56⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"57⤵
- Executes dropped EXE
PID:432 -
C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"58⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\B72A.tmp"C:\Users\Admin\AppData\Local\Temp\B72A.tmp"59⤵
- Executes dropped EXE
PID:468 -
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"60⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\B853.tmp"C:\Users\Admin\AppData\Local\Temp\B853.tmp"61⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"62⤵
- Executes dropped EXE
PID:916 -
C:\Users\Admin\AppData\Local\Temp\B95D.tmp"C:\Users\Admin\AppData\Local\Temp\B95D.tmp"63⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"64⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\BA86.tmp"C:\Users\Admin\AppData\Local\Temp\BA86.tmp"65⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\BB12.tmp"C:\Users\Admin\AppData\Local\Temp\BB12.tmp"66⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"67⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"68⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"69⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\BD45.tmp"C:\Users\Admin\AppData\Local\Temp\BD45.tmp"70⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"71⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"72⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"73⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\BF49.tmp"C:\Users\Admin\AppData\Local\Temp\BF49.tmp"74⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"75⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\C043.tmp"C:\Users\Admin\AppData\Local\Temp\C043.tmp"76⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"77⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"78⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"79⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"80⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\C302.tmp"C:\Users\Admin\AppData\Local\Temp\C302.tmp"81⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\C37F.tmp"C:\Users\Admin\AppData\Local\Temp\C37F.tmp"82⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\C41B.tmp"C:\Users\Admin\AppData\Local\Temp\C41B.tmp"83⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"84⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\C534.tmp"C:\Users\Admin\AppData\Local\Temp\C534.tmp"85⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"86⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\C64D.tmp"C:\Users\Admin\AppData\Local\Temp\C64D.tmp"87⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"88⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\C747.tmp"C:\Users\Admin\AppData\Local\Temp\C747.tmp"89⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"90⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\C832.tmp"C:\Users\Admin\AppData\Local\Temp\C832.tmp"91⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"92⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\C95B.tmp"C:\Users\Admin\AppData\Local\Temp\C95B.tmp"93⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\C9D8.tmp"C:\Users\Admin\AppData\Local\Temp\C9D8.tmp"94⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\CA84.tmp"C:\Users\Admin\AppData\Local\Temp\CA84.tmp"95⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"96⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"97⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"98⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"99⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\CD33.tmp"C:\Users\Admin\AppData\Local\Temp\CD33.tmp"100⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\CDC0.tmp"C:\Users\Admin\AppData\Local\Temp\CDC0.tmp"101⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"102⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\CF08.tmp"C:\Users\Admin\AppData\Local\Temp\CF08.tmp"103⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"104⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\D040.tmp"C:\Users\Admin\AppData\Local\Temp\D040.tmp"105⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"106⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\D11B.tmp"C:\Users\Admin\AppData\Local\Temp\D11B.tmp"107⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\D1B7.tmp"C:\Users\Admin\AppData\Local\Temp\D1B7.tmp"108⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\D244.tmp"C:\Users\Admin\AppData\Local\Temp\D244.tmp"109⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\D2C1.tmp"C:\Users\Admin\AppData\Local\Temp\D2C1.tmp"110⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\D33E.tmp"C:\Users\Admin\AppData\Local\Temp\D33E.tmp"111⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"112⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\D438.tmp"C:\Users\Admin\AppData\Local\Temp\D438.tmp"113⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"114⤵PID:180
-
C:\Users\Admin\AppData\Local\Temp\D580.tmp"C:\Users\Admin\AppData\Local\Temp\D580.tmp"115⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\D61C.tmp"C:\Users\Admin\AppData\Local\Temp\D61C.tmp"116⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\D6A9.tmp"C:\Users\Admin\AppData\Local\Temp\D6A9.tmp"117⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\D736.tmp"C:\Users\Admin\AppData\Local\Temp\D736.tmp"118⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"119⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\D83F.tmp"C:\Users\Admin\AppData\Local\Temp\D83F.tmp"120⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"121⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\D939.tmp"C:\Users\Admin\AppData\Local\Temp\D939.tmp"122⤵PID:3108
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-