Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
02-10-2023 18:01
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-27_4088c3d85bae88e2e20bd3f642be3b41_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-27_4088c3d85bae88e2e20bd3f642be3b41_mafia_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2023-08-27_4088c3d85bae88e2e20bd3f642be3b41_mafia_JC.exe
-
Size
486KB
-
MD5
4088c3d85bae88e2e20bd3f642be3b41
-
SHA1
6eee60463206ffca2d5ade315fd8eb39730ad2ef
-
SHA256
ebdb8f76f41aeb45a7c7b0b8c4704a4623fc676a64c71157d684c7a24719c80b
-
SHA512
ab4bb6ff7de1740af2ccbd0bcde35ba16a0a84bc29e967998f057169303cdc4618dcfabb722e5c6720bee7a1e1174a36cd5a098867e80dbc1ea708ab341743d0
-
SSDEEP
6144:Borf3lPvovsgZnqG2C7mOTeiLfD7VaTtwQ3i+TctHvGn8cQz7ou3jdZmmh3/xN5a:oU5rCOTeiDVKtzS+evFcQz7ouTmmwNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2608 6215.tmp 3352 62E0.tmp 4596 637D.tmp 4440 6467.tmp 4852 64F4.tmp 2624 6590.tmp 3360 665B.tmp 4844 66C8.tmp 4160 6784.tmp 3304 6801.tmp 3680 68AD.tmp 1424 6968.tmp 4984 6A24.tmp 5088 6AA1.tmp 1156 6B3D.tmp 3496 6BCA.tmp 776 6CF2.tmp 3856 6D8F.tmp 2300 6E1B.tmp 1276 6ED7.tmp 2424 6F63.tmp 4540 6FF0.tmp 3848 7138.tmp 4508 71F4.tmp 3932 72AF.tmp 4032 733C.tmp 4988 73C8.tmp 4236 7474.tmp 1144 7520.tmp 2016 75DC.tmp 4116 7688.tmp 4924 7733.tmp 4112 780E.tmp 2608 787C.tmp 2876 78E9.tmp 4440 7985.tmp 1780 7A02.tmp 2884 7A7F.tmp 2496 7AFC.tmp 2516 7BA8.tmp 4512 7D5E.tmp 2804 7DFA.tmp 5004 7E67.tmp 3324 7EF4.tmp 2348 7F61.tmp 1424 7FDE.tmp 1896 807A.tmp 668 80F7.tmp 1580 8184.tmp 4516 8220.tmp 1056 82BD.tmp 5000 8349.tmp 4684 83D6.tmp 2228 8462.tmp 4788 84EF.tmp 2300 858B.tmp 1276 8608.tmp 2424 8685.tmp 4212 8702.tmp 4456 877F.tmp 3948 881C.tmp 4808 88A8.tmp 3768 8925.tmp 2040 89A2.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4324 wrote to memory of 2608 4324 2023-08-27_4088c3d85bae88e2e20bd3f642be3b41_mafia_JC.exe 86 PID 4324 wrote to memory of 2608 4324 2023-08-27_4088c3d85bae88e2e20bd3f642be3b41_mafia_JC.exe 86 PID 4324 wrote to memory of 2608 4324 2023-08-27_4088c3d85bae88e2e20bd3f642be3b41_mafia_JC.exe 86 PID 2608 wrote to memory of 3352 2608 6215.tmp 87 PID 2608 wrote to memory of 3352 2608 6215.tmp 87 PID 2608 wrote to memory of 3352 2608 6215.tmp 87 PID 3352 wrote to memory of 4596 3352 62E0.tmp 88 PID 3352 wrote to memory of 4596 3352 62E0.tmp 88 PID 3352 wrote to memory of 4596 3352 62E0.tmp 88 PID 4596 wrote to memory of 4440 4596 637D.tmp 89 PID 4596 wrote to memory of 4440 4596 637D.tmp 89 PID 4596 wrote to memory of 4440 4596 637D.tmp 89 PID 4440 wrote to memory of 4852 4440 6467.tmp 90 PID 4440 wrote to memory of 4852 4440 6467.tmp 90 PID 4440 wrote to memory of 4852 4440 6467.tmp 90 PID 4852 wrote to memory of 2624 4852 64F4.tmp 91 PID 4852 wrote to memory of 2624 4852 64F4.tmp 91 PID 4852 wrote to memory of 2624 4852 64F4.tmp 91 PID 2624 wrote to memory of 3360 2624 6590.tmp 92 PID 2624 wrote to memory of 3360 2624 6590.tmp 92 PID 2624 wrote to memory of 3360 2624 6590.tmp 92 PID 3360 wrote to memory of 4844 3360 665B.tmp 93 PID 3360 wrote to memory of 4844 3360 665B.tmp 93 PID 3360 wrote to memory of 4844 3360 665B.tmp 93 PID 4844 wrote to memory of 4160 4844 66C8.tmp 94 PID 4844 wrote to memory of 4160 4844 66C8.tmp 94 PID 4844 wrote to memory of 4160 4844 66C8.tmp 94 PID 4160 wrote to memory of 3304 4160 6784.tmp 95 PID 4160 wrote to memory of 3304 4160 6784.tmp 95 PID 4160 wrote to memory of 3304 4160 6784.tmp 95 PID 3304 wrote to memory of 3680 3304 6801.tmp 96 PID 3304 wrote to memory of 3680 3304 6801.tmp 96 PID 3304 wrote to memory of 3680 3304 6801.tmp 96 PID 3680 wrote to memory of 1424 3680 68AD.tmp 97 PID 3680 wrote to memory of 1424 3680 68AD.tmp 97 PID 3680 wrote to memory of 1424 3680 68AD.tmp 97 PID 1424 wrote to memory of 4984 1424 6968.tmp 98 PID 1424 wrote to memory of 4984 1424 6968.tmp 98 PID 1424 wrote to memory of 4984 1424 6968.tmp 98 PID 4984 wrote to memory of 5088 4984 6A24.tmp 99 PID 4984 wrote to memory of 5088 4984 6A24.tmp 99 PID 4984 wrote to memory of 5088 4984 6A24.tmp 99 PID 5088 wrote to memory of 1156 5088 6AA1.tmp 100 PID 5088 wrote to memory of 1156 5088 6AA1.tmp 100 PID 5088 wrote to memory of 1156 5088 6AA1.tmp 100 PID 1156 wrote to memory of 3496 1156 6B3D.tmp 101 PID 1156 wrote to memory of 3496 1156 6B3D.tmp 101 PID 1156 wrote to memory of 3496 1156 6B3D.tmp 101 PID 3496 wrote to memory of 776 3496 6BCA.tmp 102 PID 3496 wrote to memory of 776 3496 6BCA.tmp 102 PID 3496 wrote to memory of 776 3496 6BCA.tmp 102 PID 776 wrote to memory of 3856 776 6CF2.tmp 103 PID 776 wrote to memory of 3856 776 6CF2.tmp 103 PID 776 wrote to memory of 3856 776 6CF2.tmp 103 PID 3856 wrote to memory of 2300 3856 6D8F.tmp 106 PID 3856 wrote to memory of 2300 3856 6D8F.tmp 106 PID 3856 wrote to memory of 2300 3856 6D8F.tmp 106 PID 2300 wrote to memory of 1276 2300 6E1B.tmp 107 PID 2300 wrote to memory of 1276 2300 6E1B.tmp 107 PID 2300 wrote to memory of 1276 2300 6E1B.tmp 107 PID 1276 wrote to memory of 2424 1276 6ED7.tmp 108 PID 1276 wrote to memory of 2424 1276 6ED7.tmp 108 PID 1276 wrote to memory of 2424 1276 6ED7.tmp 108 PID 2424 wrote to memory of 4540 2424 6F63.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-27_4088c3d85bae88e2e20bd3f642be3b41_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-27_4088c3d85bae88e2e20bd3f642be3b41_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\6F63.tmp"C:\Users\Admin\AppData\Local\Temp\6F63.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"23⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"24⤵
- Executes dropped EXE
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"25⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"26⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"27⤵
- Executes dropped EXE
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"28⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"29⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"30⤵
- Executes dropped EXE
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"31⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"32⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"33⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\780E.tmp"C:\Users\Admin\AppData\Local\Temp\780E.tmp"34⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"35⤵
- Executes dropped EXE
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"36⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"37⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\7A02.tmp"C:\Users\Admin\AppData\Local\Temp\7A02.tmp"38⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"39⤵
- Executes dropped EXE
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"40⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"41⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"42⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"43⤵
- Executes dropped EXE
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\7E67.tmp"C:\Users\Admin\AppData\Local\Temp\7E67.tmp"44⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"45⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\7F61.tmp"C:\Users\Admin\AppData\Local\Temp\7F61.tmp"46⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"47⤵
- Executes dropped EXE
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\807A.tmp"C:\Users\Admin\AppData\Local\Temp\807A.tmp"48⤵
- Executes dropped EXE
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\80F7.tmp"C:\Users\Admin\AppData\Local\Temp\80F7.tmp"49⤵
- Executes dropped EXE
PID:668 -
C:\Users\Admin\AppData\Local\Temp\8184.tmp"C:\Users\Admin\AppData\Local\Temp\8184.tmp"50⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\8220.tmp"C:\Users\Admin\AppData\Local\Temp\8220.tmp"51⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\82BD.tmp"C:\Users\Admin\AppData\Local\Temp\82BD.tmp"52⤵
- Executes dropped EXE
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\8349.tmp"C:\Users\Admin\AppData\Local\Temp\8349.tmp"53⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\83D6.tmp"C:\Users\Admin\AppData\Local\Temp\83D6.tmp"54⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\8462.tmp"C:\Users\Admin\AppData\Local\Temp\8462.tmp"55⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\84EF.tmp"C:\Users\Admin\AppData\Local\Temp\84EF.tmp"56⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\858B.tmp"C:\Users\Admin\AppData\Local\Temp\858B.tmp"57⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\8608.tmp"C:\Users\Admin\AppData\Local\Temp\8608.tmp"58⤵
- Executes dropped EXE
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\8685.tmp"C:\Users\Admin\AppData\Local\Temp\8685.tmp"59⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\8702.tmp"C:\Users\Admin\AppData\Local\Temp\8702.tmp"60⤵
- Executes dropped EXE
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\877F.tmp"C:\Users\Admin\AppData\Local\Temp\877F.tmp"61⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\881C.tmp"C:\Users\Admin\AppData\Local\Temp\881C.tmp"62⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\88A8.tmp"C:\Users\Admin\AppData\Local\Temp\88A8.tmp"63⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\8925.tmp"C:\Users\Admin\AppData\Local\Temp\8925.tmp"64⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\89A2.tmp"C:\Users\Admin\AppData\Local\Temp\89A2.tmp"65⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"66⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"67⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\8B19.tmp"C:\Users\Admin\AppData\Local\Temp\8B19.tmp"68⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"69⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"70⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"71⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"72⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"73⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\8E55.tmp"C:\Users\Admin\AppData\Local\Temp\8E55.tmp"74⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"75⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"76⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"77⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"78⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"79⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\9153.tmp"C:\Users\Admin\AppData\Local\Temp\9153.tmp"80⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\91C0.tmp"C:\Users\Admin\AppData\Local\Temp\91C0.tmp"81⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\921E.tmp"C:\Users\Admin\AppData\Local\Temp\921E.tmp"82⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"83⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"84⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\9385.tmp"C:\Users\Admin\AppData\Local\Temp\9385.tmp"85⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\9412.tmp"C:\Users\Admin\AppData\Local\Temp\9412.tmp"86⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\94BE.tmp"C:\Users\Admin\AppData\Local\Temp\94BE.tmp"87⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"88⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\95B8.tmp"C:\Users\Admin\AppData\Local\Temp\95B8.tmp"89⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\9625.tmp"C:\Users\Admin\AppData\Local\Temp\9625.tmp"90⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\9693.tmp"C:\Users\Admin\AppData\Local\Temp\9693.tmp"91⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\9700.tmp"C:\Users\Admin\AppData\Local\Temp\9700.tmp"92⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\976D.tmp"C:\Users\Admin\AppData\Local\Temp\976D.tmp"93⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\97DB.tmp"C:\Users\Admin\AppData\Local\Temp\97DB.tmp"94⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\9848.tmp"C:\Users\Admin\AppData\Local\Temp\9848.tmp"95⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\98C5.tmp"C:\Users\Admin\AppData\Local\Temp\98C5.tmp"96⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\9942.tmp"C:\Users\Admin\AppData\Local\Temp\9942.tmp"97⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\99BF.tmp"C:\Users\Admin\AppData\Local\Temp\99BF.tmp"98⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"99⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"100⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"101⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"102⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"103⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"104⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"105⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"106⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\9E72.tmp"C:\Users\Admin\AppData\Local\Temp\9E72.tmp"107⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"108⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"109⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"110⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"111⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\A141.tmp"C:\Users\Admin\AppData\Local\Temp\A141.tmp"112⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"113⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"114⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"115⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"116⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"117⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\A47D.tmp"C:\Users\Admin\AppData\Local\Temp\A47D.tmp"118⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"119⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"120⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"121⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\A671.tmp"C:\Users\Admin\AppData\Local\Temp\A671.tmp"122⤵PID:1676
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-