Analysis
-
max time kernel
153s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2023, 15:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2023-08-27_1348dbc45b5ebd8b017a8a4ea9df372b_mafia_JC.exe
Resource
win7-20230831-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2023-08-27_1348dbc45b5ebd8b017a8a4ea9df372b_mafia_JC.exe
Resource
win10v2004-20230915-en
2 signatures
150 seconds
General
-
Target
2023-08-27_1348dbc45b5ebd8b017a8a4ea9df372b_mafia_JC.exe
-
Size
527KB
-
MD5
1348dbc45b5ebd8b017a8a4ea9df372b
-
SHA1
57578d6178828e304fa560c7817c197e16279356
-
SHA256
129f4ace2959f19e3346e093413cf2a07dd67c269be987def5e2a6a4ae78fc61
-
SHA512
ae2978093c76ebe10b861690dca7bf8c59a43a4b74011142aaa8178289c3c19e45ec7653bc2b84a5a46936c1041d0304dba655f7ab0511e0461113de6bb55ef2
-
SSDEEP
12288:fU5rCOTeidziHgJTSpwu5AlGT1f9lDZu:fUQOJdGK3EnDo
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3248 2F58.tmp 3500 30A0.tmp 4632 315C.tmp 4524 3236.tmp 3264 3302.tmp 4716 33FC.tmp 1616 34B7.tmp 3488 3563.tmp 3200 360F.tmp 1716 36EA.tmp 3268 3795.tmp 3844 3880.tmp 3940 392C.tmp 3880 39E7.tmp 4900 3B7D.tmp 2280 3C58.tmp 3160 3CF4.tmp 1272 3DC0.tmp 3312 3EAA.tmp 3752 3F56.tmp 1484 4031.tmp 552 40EC.tmp 5116 4188.tmp 2132 4215.tmp 3980 42F0.tmp 792 439C.tmp 3632 44C4.tmp 4120 459F.tmp 3192 464B.tmp 2464 46F7.tmp 1868 4793.tmp 4536 48AC.tmp 860 49C6.tmp 4940 4A43.tmp 4212 4AEF.tmp 2156 4BAA.tmp 3772 4C37.tmp 4684 4CD3.tmp 3024 4D6F.tmp 568 4E0B.tmp 4860 4E79.tmp 1264 4EF6.tmp 3524 4F63.tmp 4824 4FF0.tmp 3840 507C.tmp 3888 50F9.tmp 2496 5196.tmp 2576 5232.tmp 236 52BF.tmp 2044 532C.tmp 4336 53C8.tmp 2360 54E1.tmp 2840 555E.tmp 4900 585C.tmp 1260 58E9.tmp 3216 5975.tmp 3728 59F2.tmp 3312 5A6F.tmp 2020 5B0C.tmp 4244 5B89.tmp 3332 5C06.tmp 552 5CA2.tmp 4468 5D1F.tmp 748 5DAB.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2660 wrote to memory of 3248 2660 2023-08-27_1348dbc45b5ebd8b017a8a4ea9df372b_mafia_JC.exe 86 PID 2660 wrote to memory of 3248 2660 2023-08-27_1348dbc45b5ebd8b017a8a4ea9df372b_mafia_JC.exe 86 PID 2660 wrote to memory of 3248 2660 2023-08-27_1348dbc45b5ebd8b017a8a4ea9df372b_mafia_JC.exe 86 PID 3248 wrote to memory of 3500 3248 2F58.tmp 87 PID 3248 wrote to memory of 3500 3248 2F58.tmp 87 PID 3248 wrote to memory of 3500 3248 2F58.tmp 87 PID 3500 wrote to memory of 4632 3500 30A0.tmp 89 PID 3500 wrote to memory of 4632 3500 30A0.tmp 89 PID 3500 wrote to memory of 4632 3500 30A0.tmp 89 PID 4632 wrote to memory of 4524 4632 315C.tmp 90 PID 4632 wrote to memory of 4524 4632 315C.tmp 90 PID 4632 wrote to memory of 4524 4632 315C.tmp 90 PID 4524 wrote to memory of 3264 4524 3236.tmp 91 PID 4524 wrote to memory of 3264 4524 3236.tmp 91 PID 4524 wrote to memory of 3264 4524 3236.tmp 91 PID 3264 wrote to memory of 4716 3264 3302.tmp 92 PID 3264 wrote to memory of 4716 3264 3302.tmp 92 PID 3264 wrote to memory of 4716 3264 3302.tmp 92 PID 4716 wrote to memory of 1616 4716 33FC.tmp 94 PID 4716 wrote to memory of 1616 4716 33FC.tmp 94 PID 4716 wrote to memory of 1616 4716 33FC.tmp 94 PID 1616 wrote to memory of 3488 1616 34B7.tmp 95 PID 1616 wrote to memory of 3488 1616 34B7.tmp 95 PID 1616 wrote to memory of 3488 1616 34B7.tmp 95 PID 3488 wrote to memory of 3200 3488 3563.tmp 96 PID 3488 wrote to memory of 3200 3488 3563.tmp 96 PID 3488 wrote to memory of 3200 3488 3563.tmp 96 PID 3200 wrote to memory of 1716 3200 360F.tmp 97 PID 3200 wrote to memory of 1716 3200 360F.tmp 97 PID 3200 wrote to memory of 1716 3200 360F.tmp 97 PID 1716 wrote to memory of 3268 1716 36EA.tmp 98 PID 1716 wrote to memory of 3268 1716 36EA.tmp 98 PID 1716 wrote to memory of 3268 1716 36EA.tmp 98 PID 3268 wrote to memory of 3844 3268 3795.tmp 99 PID 3268 wrote to memory of 3844 3268 3795.tmp 99 PID 3268 wrote to memory of 3844 3268 3795.tmp 99 PID 3844 wrote to memory of 3940 3844 3880.tmp 100 PID 3844 wrote to memory of 3940 3844 3880.tmp 100 PID 3844 wrote to memory of 3940 3844 3880.tmp 100 PID 3940 wrote to memory of 3880 3940 392C.tmp 101 PID 3940 wrote to memory of 3880 3940 392C.tmp 101 PID 3940 wrote to memory of 3880 3940 392C.tmp 101 PID 3880 wrote to memory of 4900 3880 39E7.tmp 102 PID 3880 wrote to memory of 4900 3880 39E7.tmp 102 PID 3880 wrote to memory of 4900 3880 39E7.tmp 102 PID 4900 wrote to memory of 2280 4900 3B7D.tmp 103 PID 4900 wrote to memory of 2280 4900 3B7D.tmp 103 PID 4900 wrote to memory of 2280 4900 3B7D.tmp 103 PID 2280 wrote to memory of 3160 2280 3C58.tmp 104 PID 2280 wrote to memory of 3160 2280 3C58.tmp 104 PID 2280 wrote to memory of 3160 2280 3C58.tmp 104 PID 3160 wrote to memory of 1272 3160 3CF4.tmp 105 PID 3160 wrote to memory of 1272 3160 3CF4.tmp 105 PID 3160 wrote to memory of 1272 3160 3CF4.tmp 105 PID 1272 wrote to memory of 3312 1272 3DC0.tmp 106 PID 1272 wrote to memory of 3312 1272 3DC0.tmp 106 PID 1272 wrote to memory of 3312 1272 3DC0.tmp 106 PID 3312 wrote to memory of 3752 3312 3EAA.tmp 107 PID 3312 wrote to memory of 3752 3312 3EAA.tmp 107 PID 3312 wrote to memory of 3752 3312 3EAA.tmp 107 PID 3752 wrote to memory of 1484 3752 3F56.tmp 108 PID 3752 wrote to memory of 1484 3752 3F56.tmp 108 PID 3752 wrote to memory of 1484 3752 3F56.tmp 108 PID 1484 wrote to memory of 552 1484 4031.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-27_1348dbc45b5ebd8b017a8a4ea9df372b_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-27_1348dbc45b5ebd8b017a8a4ea9df372b_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\2F58.tmp"C:\Users\Admin\AppData\Local\Temp\2F58.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\30A0.tmp"C:\Users\Admin\AppData\Local\Temp\30A0.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\315C.tmp"C:\Users\Admin\AppData\Local\Temp\315C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\3236.tmp"C:\Users\Admin\AppData\Local\Temp\3236.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\3563.tmp"C:\Users\Admin\AppData\Local\Temp\3563.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\360F.tmp"C:\Users\Admin\AppData\Local\Temp\360F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\36EA.tmp"C:\Users\Admin\AppData\Local\Temp\36EA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\3795.tmp"C:\Users\Admin\AppData\Local\Temp\3795.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\3880.tmp"C:\Users\Admin\AppData\Local\Temp\3880.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\392C.tmp"C:\Users\Admin\AppData\Local\Temp\392C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\39E7.tmp"C:\Users\Admin\AppData\Local\Temp\39E7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\3B7D.tmp"C:\Users\Admin\AppData\Local\Temp\3B7D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\3C58.tmp"C:\Users\Admin\AppData\Local\Temp\3C58.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\3CF4.tmp"C:\Users\Admin\AppData\Local\Temp\3CF4.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\3DC0.tmp"C:\Users\Admin\AppData\Local\Temp\3DC0.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\3F56.tmp"C:\Users\Admin\AppData\Local\Temp\3F56.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\4031.tmp"C:\Users\Admin\AppData\Local\Temp\4031.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\40EC.tmp"C:\Users\Admin\AppData\Local\Temp\40EC.tmp"23⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\4188.tmp"C:\Users\Admin\AppData\Local\Temp\4188.tmp"24⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\4215.tmp"C:\Users\Admin\AppData\Local\Temp\4215.tmp"25⤵
- Executes dropped EXE
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\42F0.tmp"C:\Users\Admin\AppData\Local\Temp\42F0.tmp"26⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\439C.tmp"C:\Users\Admin\AppData\Local\Temp\439C.tmp"27⤵
- Executes dropped EXE
PID:792 -
C:\Users\Admin\AppData\Local\Temp\44C4.tmp"C:\Users\Admin\AppData\Local\Temp\44C4.tmp"28⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\459F.tmp"C:\Users\Admin\AppData\Local\Temp\459F.tmp"29⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\464B.tmp"C:\Users\Admin\AppData\Local\Temp\464B.tmp"30⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\46F7.tmp"C:\Users\Admin\AppData\Local\Temp\46F7.tmp"31⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\4793.tmp"C:\Users\Admin\AppData\Local\Temp\4793.tmp"32⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\48AC.tmp"C:\Users\Admin\AppData\Local\Temp\48AC.tmp"33⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\49C6.tmp"C:\Users\Admin\AppData\Local\Temp\49C6.tmp"34⤵
- Executes dropped EXE
PID:860 -
C:\Users\Admin\AppData\Local\Temp\4A43.tmp"C:\Users\Admin\AppData\Local\Temp\4A43.tmp"35⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\4AEF.tmp"C:\Users\Admin\AppData\Local\Temp\4AEF.tmp"36⤵
- Executes dropped EXE
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\4BAA.tmp"C:\Users\Admin\AppData\Local\Temp\4BAA.tmp"37⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\4C37.tmp"C:\Users\Admin\AppData\Local\Temp\4C37.tmp"38⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\4CD3.tmp"C:\Users\Admin\AppData\Local\Temp\4CD3.tmp"39⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\4D6F.tmp"C:\Users\Admin\AppData\Local\Temp\4D6F.tmp"40⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\4E0B.tmp"C:\Users\Admin\AppData\Local\Temp\4E0B.tmp"41⤵
- Executes dropped EXE
PID:568 -
C:\Users\Admin\AppData\Local\Temp\4E79.tmp"C:\Users\Admin\AppData\Local\Temp\4E79.tmp"42⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\4EF6.tmp"C:\Users\Admin\AppData\Local\Temp\4EF6.tmp"43⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\4F63.tmp"C:\Users\Admin\AppData\Local\Temp\4F63.tmp"44⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\4FF0.tmp"C:\Users\Admin\AppData\Local\Temp\4FF0.tmp"45⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\507C.tmp"C:\Users\Admin\AppData\Local\Temp\507C.tmp"46⤵
- Executes dropped EXE
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\50F9.tmp"C:\Users\Admin\AppData\Local\Temp\50F9.tmp"47⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\5196.tmp"C:\Users\Admin\AppData\Local\Temp\5196.tmp"48⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\5232.tmp"C:\Users\Admin\AppData\Local\Temp\5232.tmp"49⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\52BF.tmp"C:\Users\Admin\AppData\Local\Temp\52BF.tmp"50⤵
- Executes dropped EXE
PID:236 -
C:\Users\Admin\AppData\Local\Temp\532C.tmp"C:\Users\Admin\AppData\Local\Temp\532C.tmp"51⤵
- Executes dropped EXE
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\53C8.tmp"C:\Users\Admin\AppData\Local\Temp\53C8.tmp"52⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\54E1.tmp"C:\Users\Admin\AppData\Local\Temp\54E1.tmp"53⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\555E.tmp"C:\Users\Admin\AppData\Local\Temp\555E.tmp"54⤵
- Executes dropped EXE
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\585C.tmp"C:\Users\Admin\AppData\Local\Temp\585C.tmp"55⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\58E9.tmp"C:\Users\Admin\AppData\Local\Temp\58E9.tmp"56⤵
- Executes dropped EXE
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\5975.tmp"C:\Users\Admin\AppData\Local\Temp\5975.tmp"57⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\59F2.tmp"C:\Users\Admin\AppData\Local\Temp\59F2.tmp"58⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"59⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\5B0C.tmp"C:\Users\Admin\AppData\Local\Temp\5B0C.tmp"60⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\5B89.tmp"C:\Users\Admin\AppData\Local\Temp\5B89.tmp"61⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\5C06.tmp"C:\Users\Admin\AppData\Local\Temp\5C06.tmp"62⤵
- Executes dropped EXE
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\5CA2.tmp"C:\Users\Admin\AppData\Local\Temp\5CA2.tmp"63⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\5D1F.tmp"C:\Users\Admin\AppData\Local\Temp\5D1F.tmp"64⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\5DAB.tmp"C:\Users\Admin\AppData\Local\Temp\5DAB.tmp"65⤵
- Executes dropped EXE
PID:748 -
C:\Users\Admin\AppData\Local\Temp\5E38.tmp"C:\Users\Admin\AppData\Local\Temp\5E38.tmp"66⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\5EB5.tmp"C:\Users\Admin\AppData\Local\Temp\5EB5.tmp"67⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\5F32.tmp"C:\Users\Admin\AppData\Local\Temp\5F32.tmp"68⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\5FAF.tmp"C:\Users\Admin\AppData\Local\Temp\5FAF.tmp"69⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\604B.tmp"C:\Users\Admin\AppData\Local\Temp\604B.tmp"70⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\60C8.tmp"C:\Users\Admin\AppData\Local\Temp\60C8.tmp"71⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\6136.tmp"C:\Users\Admin\AppData\Local\Temp\6136.tmp"72⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\61A3.tmp"C:\Users\Admin\AppData\Local\Temp\61A3.tmp"73⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\623F.tmp"C:\Users\Admin\AppData\Local\Temp\623F.tmp"74⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\62FB.tmp"C:\Users\Admin\AppData\Local\Temp\62FB.tmp"75⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\6387.tmp"C:\Users\Admin\AppData\Local\Temp\6387.tmp"76⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\6404.tmp"C:\Users\Admin\AppData\Local\Temp\6404.tmp"77⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\64B0.tmp"C:\Users\Admin\AppData\Local\Temp\64B0.tmp"78⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\655C.tmp"C:\Users\Admin\AppData\Local\Temp\655C.tmp"79⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\65F8.tmp"C:\Users\Admin\AppData\Local\Temp\65F8.tmp"80⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\6675.tmp"C:\Users\Admin\AppData\Local\Temp\6675.tmp"81⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\6712.tmp"C:\Users\Admin\AppData\Local\Temp\6712.tmp"82⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\677F.tmp"C:\Users\Admin\AppData\Local\Temp\677F.tmp"83⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\67FC.tmp"C:\Users\Admin\AppData\Local\Temp\67FC.tmp"84⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\6898.tmp"C:\Users\Admin\AppData\Local\Temp\6898.tmp"85⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\6915.tmp"C:\Users\Admin\AppData\Local\Temp\6915.tmp"86⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\6983.tmp"C:\Users\Admin\AppData\Local\Temp\6983.tmp"87⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\69F0.tmp"C:\Users\Admin\AppData\Local\Temp\69F0.tmp"88⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\6A7D.tmp"C:\Users\Admin\AppData\Local\Temp\6A7D.tmp"89⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\6B29.tmp"C:\Users\Admin\AppData\Local\Temp\6B29.tmp"90⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\6BA6.tmp"C:\Users\Admin\AppData\Local\Temp\6BA6.tmp"91⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\6C42.tmp"C:\Users\Admin\AppData\Local\Temp\6C42.tmp"92⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\6CAF.tmp"C:\Users\Admin\AppData\Local\Temp\6CAF.tmp"93⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\6D3C.tmp"C:\Users\Admin\AppData\Local\Temp\6D3C.tmp"94⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\6DD8.tmp"C:\Users\Admin\AppData\Local\Temp\6DD8.tmp"95⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\6E65.tmp"C:\Users\Admin\AppData\Local\Temp\6E65.tmp"96⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\6EF1.tmp"C:\Users\Admin\AppData\Local\Temp\6EF1.tmp"97⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\6F8E.tmp"C:\Users\Admin\AppData\Local\Temp\6F8E.tmp"98⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\700B.tmp"C:\Users\Admin\AppData\Local\Temp\700B.tmp"99⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\70A7.tmp"C:\Users\Admin\AppData\Local\Temp\70A7.tmp"100⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\7133.tmp"C:\Users\Admin\AppData\Local\Temp\7133.tmp"101⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\71A1.tmp"C:\Users\Admin\AppData\Local\Temp\71A1.tmp"102⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\723D.tmp"C:\Users\Admin\AppData\Local\Temp\723D.tmp"103⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\72BA.tmp"C:\Users\Admin\AppData\Local\Temp\72BA.tmp"104⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\7337.tmp"C:\Users\Admin\AppData\Local\Temp\7337.tmp"105⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\7395.tmp"C:\Users\Admin\AppData\Local\Temp\7395.tmp"106⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\7412.tmp"C:\Users\Admin\AppData\Local\Temp\7412.tmp"107⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\74ED.tmp"C:\Users\Admin\AppData\Local\Temp\74ED.tmp"108⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\7589.tmp"C:\Users\Admin\AppData\Local\Temp\7589.tmp"109⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\7644.tmp"C:\Users\Admin\AppData\Local\Temp\7644.tmp"110⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\76D1.tmp"C:\Users\Admin\AppData\Local\Temp\76D1.tmp"111⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\778C.tmp"C:\Users\Admin\AppData\Local\Temp\778C.tmp"112⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\77FA.tmp"C:\Users\Admin\AppData\Local\Temp\77FA.tmp"113⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\7877.tmp"C:\Users\Admin\AppData\Local\Temp\7877.tmp"114⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\7913.tmp"C:\Users\Admin\AppData\Local\Temp\7913.tmp"115⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\79AF.tmp"C:\Users\Admin\AppData\Local\Temp\79AF.tmp"116⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\7A6B.tmp"C:\Users\Admin\AppData\Local\Temp\7A6B.tmp"117⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\7B17.tmp"C:\Users\Admin\AppData\Local\Temp\7B17.tmp"118⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\7BA3.tmp"C:\Users\Admin\AppData\Local\Temp\7BA3.tmp"119⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\7C20.tmp"C:\Users\Admin\AppData\Local\Temp\7C20.tmp"120⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\7CAD.tmp"C:\Users\Admin\AppData\Local\Temp\7CAD.tmp"121⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\7D49.tmp"C:\Users\Admin\AppData\Local\Temp\7D49.tmp"122⤵PID:4992
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-