Analysis
-
max time kernel
151s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
02-10-2023 17:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2023-08-27_34b5a0a2ad0f6ea88be4a4d4f65a61e1_mafia_JC.exe
Resource
win7-20230831-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2023-08-27_34b5a0a2ad0f6ea88be4a4d4f65a61e1_mafia_JC.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2023-08-27_34b5a0a2ad0f6ea88be4a4d4f65a61e1_mafia_JC.exe
-
Size
486KB
-
MD5
34b5a0a2ad0f6ea88be4a4d4f65a61e1
-
SHA1
123dacc8d60ed7de1079b33ed96df9f59462a27a
-
SHA256
58ab9a1710ae7430b5add7a0479ef11c979fc07b38c2771a800066a2abd1eb57
-
SHA512
139442d292b9bfd82777f36b676d3ab25ec54b52e1c99414bfcce89a02ae9c6f53ba5533e0549fbc6562ccadb68b9d74f74692664175b7edb6c8478f8bf08def
-
SSDEEP
12288:/U5rCOTeiDXfpgyinBb9zI3vKuYtydVPCQNCiKsNZ:/UQOJDXUnBb9zIFdh+sN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3852 B2F4.tmp 2152 B3EE.tmp 400 B48B.tmp 2096 B556.tmp 4764 B5E2.tmp 4120 B66F.tmp 4296 B759.tmp 3640 BE00.tmp 2080 BF1A.tmp 5028 C033.tmp 1924 C0EE.tmp 2644 C1BA.tmp 4420 C2A4.tmp 1940 C37F.tmp 4044 C42B.tmp 3764 C4F6.tmp 4172 C5F0.tmp 2720 C6DA.tmp 1364 C796.tmp 2592 C851.tmp 3456 C91C.tmp 1252 C999.tmp 496 CA45.tmp 3440 CAF1.tmp 1340 CB6E.tmp 4352 CC97.tmp 1116 CD62.tmp 1292 CE2D.tmp 2512 CEAA.tmp 4304 CF46.tmp 4536 CFD3.tmp 3204 D0AE.tmp 824 D15A.tmp 4264 D1E6.tmp 4932 D2E0.tmp 2472 D35D.tmp 4152 D409.tmp 1232 D4B5.tmp 4844 D532.tmp 752 D5BF.tmp 2776 D6D8.tmp 4236 D784.tmp 4444 D830.tmp 2028 D8DB.tmp 500 D958.tmp 3208 D9E5.tmp 3640 DA62.tmp 1240 DACF.tmp 2620 DB5C.tmp 5028 DBE9.tmp 1924 DC75.tmp 4892 DD02.tmp 2732 DD9E.tmp 4300 DE1B.tmp 1552 DE98.tmp 1164 DF15.tmp 4384 DFD1.tmp 3764 E03E.tmp 3912 E0BB.tmp 2648 E128.tmp 3328 E1F4.tmp 3752 E290.tmp 3064 E34B.tmp 2188 E3C8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3892 wrote to memory of 3852 3892 2023-08-27_34b5a0a2ad0f6ea88be4a4d4f65a61e1_mafia_JC.exe 87 PID 3892 wrote to memory of 3852 3892 2023-08-27_34b5a0a2ad0f6ea88be4a4d4f65a61e1_mafia_JC.exe 87 PID 3892 wrote to memory of 3852 3892 2023-08-27_34b5a0a2ad0f6ea88be4a4d4f65a61e1_mafia_JC.exe 87 PID 3852 wrote to memory of 2152 3852 B2F4.tmp 88 PID 3852 wrote to memory of 2152 3852 B2F4.tmp 88 PID 3852 wrote to memory of 2152 3852 B2F4.tmp 88 PID 2152 wrote to memory of 400 2152 B3EE.tmp 89 PID 2152 wrote to memory of 400 2152 B3EE.tmp 89 PID 2152 wrote to memory of 400 2152 B3EE.tmp 89 PID 400 wrote to memory of 2096 400 B48B.tmp 92 PID 400 wrote to memory of 2096 400 B48B.tmp 92 PID 400 wrote to memory of 2096 400 B48B.tmp 92 PID 2096 wrote to memory of 4764 2096 B556.tmp 93 PID 2096 wrote to memory of 4764 2096 B556.tmp 93 PID 2096 wrote to memory of 4764 2096 B556.tmp 93 PID 4764 wrote to memory of 4120 4764 B5E2.tmp 94 PID 4764 wrote to memory of 4120 4764 B5E2.tmp 94 PID 4764 wrote to memory of 4120 4764 B5E2.tmp 94 PID 4120 wrote to memory of 4296 4120 B66F.tmp 95 PID 4120 wrote to memory of 4296 4120 B66F.tmp 95 PID 4120 wrote to memory of 4296 4120 B66F.tmp 95 PID 4296 wrote to memory of 3640 4296 B759.tmp 96 PID 4296 wrote to memory of 3640 4296 B759.tmp 96 PID 4296 wrote to memory of 3640 4296 B759.tmp 96 PID 3640 wrote to memory of 2080 3640 BE00.tmp 97 PID 3640 wrote to memory of 2080 3640 BE00.tmp 97 PID 3640 wrote to memory of 2080 3640 BE00.tmp 97 PID 2080 wrote to memory of 5028 2080 BF1A.tmp 99 PID 2080 wrote to memory of 5028 2080 BF1A.tmp 99 PID 2080 wrote to memory of 5028 2080 BF1A.tmp 99 PID 5028 wrote to memory of 1924 5028 C033.tmp 100 PID 5028 wrote to memory of 1924 5028 C033.tmp 100 PID 5028 wrote to memory of 1924 5028 C033.tmp 100 PID 1924 wrote to memory of 2644 1924 C0EE.tmp 101 PID 1924 wrote to memory of 2644 1924 C0EE.tmp 101 PID 1924 wrote to memory of 2644 1924 C0EE.tmp 101 PID 2644 wrote to memory of 4420 2644 C1BA.tmp 102 PID 2644 wrote to memory of 4420 2644 C1BA.tmp 102 PID 2644 wrote to memory of 4420 2644 C1BA.tmp 102 PID 4420 wrote to memory of 1940 4420 C2A4.tmp 103 PID 4420 wrote to memory of 1940 4420 C2A4.tmp 103 PID 4420 wrote to memory of 1940 4420 C2A4.tmp 103 PID 1940 wrote to memory of 4044 1940 C37F.tmp 104 PID 1940 wrote to memory of 4044 1940 C37F.tmp 104 PID 1940 wrote to memory of 4044 1940 C37F.tmp 104 PID 4044 wrote to memory of 3764 4044 C42B.tmp 105 PID 4044 wrote to memory of 3764 4044 C42B.tmp 105 PID 4044 wrote to memory of 3764 4044 C42B.tmp 105 PID 3764 wrote to memory of 4172 3764 C4F6.tmp 106 PID 3764 wrote to memory of 4172 3764 C4F6.tmp 106 PID 3764 wrote to memory of 4172 3764 C4F6.tmp 106 PID 4172 wrote to memory of 2720 4172 C5F0.tmp 107 PID 4172 wrote to memory of 2720 4172 C5F0.tmp 107 PID 4172 wrote to memory of 2720 4172 C5F0.tmp 107 PID 2720 wrote to memory of 1364 2720 C6DA.tmp 108 PID 2720 wrote to memory of 1364 2720 C6DA.tmp 108 PID 2720 wrote to memory of 1364 2720 C6DA.tmp 108 PID 1364 wrote to memory of 2592 1364 C796.tmp 109 PID 1364 wrote to memory of 2592 1364 C796.tmp 109 PID 1364 wrote to memory of 2592 1364 C796.tmp 109 PID 2592 wrote to memory of 3456 2592 C851.tmp 110 PID 2592 wrote to memory of 3456 2592 C851.tmp 110 PID 2592 wrote to memory of 3456 2592 C851.tmp 110 PID 3456 wrote to memory of 1252 3456 C91C.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-27_34b5a0a2ad0f6ea88be4a4d4f65a61e1_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-27_34b5a0a2ad0f6ea88be4a4d4f65a61e1_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\B48B.tmp"C:\Users\Admin\AppData\Local\Temp\B48B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\B66F.tmp"C:\Users\Admin\AppData\Local\Temp\B66F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\B759.tmp"C:\Users\Admin\AppData\Local\Temp\B759.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\BE00.tmp"C:\Users\Admin\AppData\Local\Temp\BE00.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\C37F.tmp"C:\Users\Admin\AppData\Local\Temp\C37F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\C42B.tmp"C:\Users\Admin\AppData\Local\Temp\C42B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\C5F0.tmp"C:\Users\Admin\AppData\Local\Temp\C5F0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\C6DA.tmp"C:\Users\Admin\AppData\Local\Temp\C6DA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\C796.tmp"C:\Users\Admin\AppData\Local\Temp\C796.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\C851.tmp"C:\Users\Admin\AppData\Local\Temp\C851.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\C91C.tmp"C:\Users\Admin\AppData\Local\Temp\C91C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\C999.tmp"C:\Users\Admin\AppData\Local\Temp\C999.tmp"23⤵
- Executes dropped EXE
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\CA45.tmp"C:\Users\Admin\AppData\Local\Temp\CA45.tmp"24⤵
- Executes dropped EXE
PID:496 -
C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"25⤵
- Executes dropped EXE
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"26⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\CC97.tmp"C:\Users\Admin\AppData\Local\Temp\CC97.tmp"27⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\CD62.tmp"C:\Users\Admin\AppData\Local\Temp\CD62.tmp"28⤵
- Executes dropped EXE
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"29⤵
- Executes dropped EXE
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\CEAA.tmp"C:\Users\Admin\AppData\Local\Temp\CEAA.tmp"30⤵
- Executes dropped EXE
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\CF46.tmp"C:\Users\Admin\AppData\Local\Temp\CF46.tmp"31⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"32⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"33⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\D15A.tmp"C:\Users\Admin\AppData\Local\Temp\D15A.tmp"34⤵
- Executes dropped EXE
PID:824 -
C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"35⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"36⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\D35D.tmp"C:\Users\Admin\AppData\Local\Temp\D35D.tmp"37⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\D409.tmp"C:\Users\Admin\AppData\Local\Temp\D409.tmp"38⤵
- Executes dropped EXE
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\D4B5.tmp"C:\Users\Admin\AppData\Local\Temp\D4B5.tmp"39⤵
- Executes dropped EXE
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\D532.tmp"C:\Users\Admin\AppData\Local\Temp\D532.tmp"40⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\D5BF.tmp"C:\Users\Admin\AppData\Local\Temp\D5BF.tmp"41⤵
- Executes dropped EXE
PID:752 -
C:\Users\Admin\AppData\Local\Temp\D6D8.tmp"C:\Users\Admin\AppData\Local\Temp\D6D8.tmp"42⤵
- Executes dropped EXE
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\D784.tmp"C:\Users\Admin\AppData\Local\Temp\D784.tmp"43⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\D830.tmp"C:\Users\Admin\AppData\Local\Temp\D830.tmp"44⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"45⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\D958.tmp"C:\Users\Admin\AppData\Local\Temp\D958.tmp"46⤵
- Executes dropped EXE
PID:500 -
C:\Users\Admin\AppData\Local\Temp\D9E5.tmp"C:\Users\Admin\AppData\Local\Temp\D9E5.tmp"47⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\DA62.tmp"C:\Users\Admin\AppData\Local\Temp\DA62.tmp"48⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\DACF.tmp"C:\Users\Admin\AppData\Local\Temp\DACF.tmp"49⤵
- Executes dropped EXE
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"50⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\DBE9.tmp"C:\Users\Admin\AppData\Local\Temp\DBE9.tmp"51⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\DC75.tmp"C:\Users\Admin\AppData\Local\Temp\DC75.tmp"52⤵
- Executes dropped EXE
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\DD02.tmp"C:\Users\Admin\AppData\Local\Temp\DD02.tmp"53⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\DD9E.tmp"C:\Users\Admin\AppData\Local\Temp\DD9E.tmp"54⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"55⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\DE98.tmp"C:\Users\Admin\AppData\Local\Temp\DE98.tmp"56⤵
- Executes dropped EXE
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\DF15.tmp"C:\Users\Admin\AppData\Local\Temp\DF15.tmp"57⤵
- Executes dropped EXE
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"58⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\E03E.tmp"C:\Users\Admin\AppData\Local\Temp\E03E.tmp"59⤵
- Executes dropped EXE
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\E0BB.tmp"C:\Users\Admin\AppData\Local\Temp\E0BB.tmp"60⤵
- Executes dropped EXE
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\E128.tmp"C:\Users\Admin\AppData\Local\Temp\E128.tmp"61⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\E1F4.tmp"C:\Users\Admin\AppData\Local\Temp\E1F4.tmp"62⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\E290.tmp"C:\Users\Admin\AppData\Local\Temp\E290.tmp"63⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\E34B.tmp"C:\Users\Admin\AppData\Local\Temp\E34B.tmp"64⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"65⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\E493.tmp"C:\Users\Admin\AppData\Local\Temp\E493.tmp"66⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\E501.tmp"C:\Users\Admin\AppData\Local\Temp\E501.tmp"67⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\E58D.tmp"C:\Users\Admin\AppData\Local\Temp\E58D.tmp"68⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"69⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"70⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\E762.tmp"C:\Users\Admin\AppData\Local\Temp\E762.tmp"71⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"72⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\E88B.tmp"C:\Users\Admin\AppData\Local\Temp\E88B.tmp"73⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"74⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\EA31.tmp"C:\Users\Admin\AppData\Local\Temp\EA31.tmp"75⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\EACD.tmp"C:\Users\Admin\AppData\Local\Temp\EACD.tmp"76⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\EB2B.tmp"C:\Users\Admin\AppData\Local\Temp\EB2B.tmp"77⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\EBC7.tmp"C:\Users\Admin\AppData\Local\Temp\EBC7.tmp"78⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\EC54.tmp"C:\Users\Admin\AppData\Local\Temp\EC54.tmp"79⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"80⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"81⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\EDFA.tmp"C:\Users\Admin\AppData\Local\Temp\EDFA.tmp"82⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\EE67.tmp"C:\Users\Admin\AppData\Local\Temp\EE67.tmp"83⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\EEF4.tmp"C:\Users\Admin\AppData\Local\Temp\EEF4.tmp"84⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\EF71.tmp"C:\Users\Admin\AppData\Local\Temp\EF71.tmp"85⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\F03C.tmp"C:\Users\Admin\AppData\Local\Temp\F03C.tmp"86⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\F0B9.tmp"C:\Users\Admin\AppData\Local\Temp\F0B9.tmp"87⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\F126.tmp"C:\Users\Admin\AppData\Local\Temp\F126.tmp"88⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\F1B3.tmp"C:\Users\Admin\AppData\Local\Temp\F1B3.tmp"89⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\F23F.tmp"C:\Users\Admin\AppData\Local\Temp\F23F.tmp"90⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"91⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\F339.tmp"C:\Users\Admin\AppData\Local\Temp\F339.tmp"92⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\F3A7.tmp"C:\Users\Admin\AppData\Local\Temp\F3A7.tmp"93⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\F424.tmp"C:\Users\Admin\AppData\Local\Temp\F424.tmp"94⤵PID:500
-
C:\Users\Admin\AppData\Local\Temp\F4C0.tmp"C:\Users\Admin\AppData\Local\Temp\F4C0.tmp"95⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\F5AA.tmp"C:\Users\Admin\AppData\Local\Temp\F5AA.tmp"96⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\F637.tmp"C:\Users\Admin\AppData\Local\Temp\F637.tmp"97⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\F6C4.tmp"C:\Users\Admin\AppData\Local\Temp\F6C4.tmp"98⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\F731.tmp"C:\Users\Admin\AppData\Local\Temp\F731.tmp"99⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\F7CD.tmp"C:\Users\Admin\AppData\Local\Temp\F7CD.tmp"100⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\F83B.tmp"C:\Users\Admin\AppData\Local\Temp\F83B.tmp"101⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"102⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\F915.tmp"C:\Users\Admin\AppData\Local\Temp\F915.tmp"103⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\F973.tmp"C:\Users\Admin\AppData\Local\Temp\F973.tmp"104⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\F9F0.tmp"C:\Users\Admin\AppData\Local\Temp\F9F0.tmp"105⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\FA7D.tmp"C:\Users\Admin\AppData\Local\Temp\FA7D.tmp"106⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"107⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\FB58.tmp"C:\Users\Admin\AppData\Local\Temp\FB58.tmp"108⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"109⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\FC32.tmp"C:\Users\Admin\AppData\Local\Temp\FC32.tmp"110⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\FCBF.tmp"C:\Users\Admin\AppData\Local\Temp\FCBF.tmp"111⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\FD7A.tmp"C:\Users\Admin\AppData\Local\Temp\FD7A.tmp"112⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\FE07.tmp"C:\Users\Admin\AppData\Local\Temp\FE07.tmp"113⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"114⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\FF20.tmp"C:\Users\Admin\AppData\Local\Temp\FF20.tmp"115⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"116⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\49.tmp"C:\Users\Admin\AppData\Local\Temp\49.tmp"117⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\105.tmp"C:\Users\Admin\AppData\Local\Temp\105.tmp"118⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\182.tmp"C:\Users\Admin\AppData\Local\Temp\182.tmp"119⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\1FF.tmp"C:\Users\Admin\AppData\Local\Temp\1FF.tmp"120⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\26C.tmp"C:\Users\Admin\AppData\Local\Temp\26C.tmp"121⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\2D9.tmp"C:\Users\Admin\AppData\Local\Temp\2D9.tmp"122⤵PID:1508
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-