Analysis
-
max time kernel
151s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
01/08/2023, 15:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2aca2a6d51d5c4941c1a46cd0b04fa5c_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2aca2a6d51d5c4941c1a46cd0b04fa5c_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
2aca2a6d51d5c4941c1a46cd0b04fa5c_mafia_JC.exe
-
Size
486KB
-
MD5
2aca2a6d51d5c4941c1a46cd0b04fa5c
-
SHA1
a4a0840f6dbd55f0fc078630e3c787491012c3a5
-
SHA256
9f979338b27cb1a986603b40c7044bffb8ac22690faf98e7598864aecab6a4fa
-
SHA512
dfd6f90815bf613c6984348d4d8a0a45ae4b99262100ab86e4d1c89395848969cdc73a6cac0c5f5fb718904cf442e2afa59b6704fcbb8ab4ed8a2041f12a46d1
-
SSDEEP
12288:/U5rCOTeiDHFm44PrOaXinmOjUXdbUcZNZ:/UQOJDHFhFaXiHUXdNZN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 920 F1C2.tmp 4176 F3A7.tmp 4804 F491.tmp 1692 F58B.tmp 2908 F656.tmp 2700 F731.tmp 3668 F80C.tmp 1588 F915.tmp 1944 F9F0.tmp 3608 FAAC.tmp 2396 FB96.tmp 4520 FCCF.tmp 4780 FDB9.tmp 1380 FF40.tmp 3804 1A.tmp 1940 F5.tmp 3952 1D0.tmp 1216 366.tmp 1088 49F.tmp 2412 5A8.tmp 4160 838.tmp 4500 9AF.tmp 548 A9A.tmp 4496 BB3.tmp 3624 CCC.tmp 1308 E43.tmp 4764 F4D.tmp 336 1085.tmp 3284 118F.tmp 3356 121C.tmp 1400 12A8.tmp 3784 1373.tmp 3404 1410.tmp 4672 14CB.tmp 1572 1577.tmp 2552 1623.tmp 1936 16A0.tmp 4584 176B.tmp 568 1807.tmp 668 1884.tmp 544 18F2.tmp 1424 195F.tmp 3564 19EC.tmp 4240 1A69.tmp 1164 1BE0.tmp 1828 1C4D.tmp 1408 1CF9.tmp 4176 1D86.tmp 3812 1E22.tmp 4124 1ECE.tmp 4568 1F7A.tmp 1756 2035.tmp 2380 20A2.tmp 1584 22B6.tmp 3668 2333.tmp 4196 23CF.tmp 3432 245C.tmp 4244 24F8.tmp 3608 2584.tmp 1976 2611.tmp 2148 267E.tmp 3720 2769.tmp 4780 27F5.tmp 3576 2882.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4356 wrote to memory of 920 4356 2aca2a6d51d5c4941c1a46cd0b04fa5c_mafia_JC.exe 87 PID 4356 wrote to memory of 920 4356 2aca2a6d51d5c4941c1a46cd0b04fa5c_mafia_JC.exe 87 PID 4356 wrote to memory of 920 4356 2aca2a6d51d5c4941c1a46cd0b04fa5c_mafia_JC.exe 87 PID 920 wrote to memory of 4176 920 F1C2.tmp 88 PID 920 wrote to memory of 4176 920 F1C2.tmp 88 PID 920 wrote to memory of 4176 920 F1C2.tmp 88 PID 4176 wrote to memory of 4804 4176 F3A7.tmp 89 PID 4176 wrote to memory of 4804 4176 F3A7.tmp 89 PID 4176 wrote to memory of 4804 4176 F3A7.tmp 89 PID 4804 wrote to memory of 1692 4804 F491.tmp 90 PID 4804 wrote to memory of 1692 4804 F491.tmp 90 PID 4804 wrote to memory of 1692 4804 F491.tmp 90 PID 1692 wrote to memory of 2908 1692 F58B.tmp 91 PID 1692 wrote to memory of 2908 1692 F58B.tmp 91 PID 1692 wrote to memory of 2908 1692 F58B.tmp 91 PID 2908 wrote to memory of 2700 2908 F656.tmp 93 PID 2908 wrote to memory of 2700 2908 F656.tmp 93 PID 2908 wrote to memory of 2700 2908 F656.tmp 93 PID 2700 wrote to memory of 3668 2700 F731.tmp 94 PID 2700 wrote to memory of 3668 2700 F731.tmp 94 PID 2700 wrote to memory of 3668 2700 F731.tmp 94 PID 3668 wrote to memory of 1588 3668 F80C.tmp 95 PID 3668 wrote to memory of 1588 3668 F80C.tmp 95 PID 3668 wrote to memory of 1588 3668 F80C.tmp 95 PID 1588 wrote to memory of 1944 1588 F915.tmp 96 PID 1588 wrote to memory of 1944 1588 F915.tmp 96 PID 1588 wrote to memory of 1944 1588 F915.tmp 96 PID 1944 wrote to memory of 3608 1944 F9F0.tmp 97 PID 1944 wrote to memory of 3608 1944 F9F0.tmp 97 PID 1944 wrote to memory of 3608 1944 F9F0.tmp 97 PID 3608 wrote to memory of 2396 3608 FAAC.tmp 98 PID 3608 wrote to memory of 2396 3608 FAAC.tmp 98 PID 3608 wrote to memory of 2396 3608 FAAC.tmp 98 PID 2396 wrote to memory of 4520 2396 FB96.tmp 99 PID 2396 wrote to memory of 4520 2396 FB96.tmp 99 PID 2396 wrote to memory of 4520 2396 FB96.tmp 99 PID 4520 wrote to memory of 4780 4520 FCCF.tmp 100 PID 4520 wrote to memory of 4780 4520 FCCF.tmp 100 PID 4520 wrote to memory of 4780 4520 FCCF.tmp 100 PID 4780 wrote to memory of 1380 4780 FDB9.tmp 101 PID 4780 wrote to memory of 1380 4780 FDB9.tmp 101 PID 4780 wrote to memory of 1380 4780 FDB9.tmp 101 PID 1380 wrote to memory of 3804 1380 FF40.tmp 102 PID 1380 wrote to memory of 3804 1380 FF40.tmp 102 PID 1380 wrote to memory of 3804 1380 FF40.tmp 102 PID 3804 wrote to memory of 1940 3804 1A.tmp 103 PID 3804 wrote to memory of 1940 3804 1A.tmp 103 PID 3804 wrote to memory of 1940 3804 1A.tmp 103 PID 1940 wrote to memory of 3952 1940 F5.tmp 104 PID 1940 wrote to memory of 3952 1940 F5.tmp 104 PID 1940 wrote to memory of 3952 1940 F5.tmp 104 PID 3952 wrote to memory of 1216 3952 1D0.tmp 105 PID 3952 wrote to memory of 1216 3952 1D0.tmp 105 PID 3952 wrote to memory of 1216 3952 1D0.tmp 105 PID 1216 wrote to memory of 1088 1216 366.tmp 106 PID 1216 wrote to memory of 1088 1216 366.tmp 106 PID 1216 wrote to memory of 1088 1216 366.tmp 106 PID 1088 wrote to memory of 2412 1088 49F.tmp 107 PID 1088 wrote to memory of 2412 1088 49F.tmp 107 PID 1088 wrote to memory of 2412 1088 49F.tmp 107 PID 2412 wrote to memory of 4160 2412 5A8.tmp 108 PID 2412 wrote to memory of 4160 2412 5A8.tmp 108 PID 2412 wrote to memory of 4160 2412 5A8.tmp 108 PID 4160 wrote to memory of 4500 4160 838.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2aca2a6d51d5c4941c1a46cd0b04fa5c_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2aca2a6d51d5c4941c1a46cd0b04fa5c_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\F3A7.tmp"C:\Users\Admin\AppData\Local\Temp\F3A7.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\F491.tmp"C:\Users\Admin\AppData\Local\Temp\F491.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\F58B.tmp"C:\Users\Admin\AppData\Local\Temp\F58B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\F656.tmp"C:\Users\Admin\AppData\Local\Temp\F656.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\F731.tmp"C:\Users\Admin\AppData\Local\Temp\F731.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\F80C.tmp"C:\Users\Admin\AppData\Local\Temp\F80C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\F915.tmp"C:\Users\Admin\AppData\Local\Temp\F915.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\F9F0.tmp"C:\Users\Admin\AppData\Local\Temp\F9F0.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\FAAC.tmp"C:\Users\Admin\AppData\Local\Temp\FAAC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\FB96.tmp"C:\Users\Admin\AppData\Local\Temp\FB96.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\FDB9.tmp"C:\Users\Admin\AppData\Local\Temp\FDB9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\FF40.tmp"C:\Users\Admin\AppData\Local\Temp\FF40.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\1A.tmp"C:\Users\Admin\AppData\Local\Temp\1A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\F5.tmp"C:\Users\Admin\AppData\Local\Temp\F5.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\1D0.tmp"C:\Users\Admin\AppData\Local\Temp\1D0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\366.tmp"C:\Users\Admin\AppData\Local\Temp\366.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\49F.tmp"C:\Users\Admin\AppData\Local\Temp\49F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\5A8.tmp"C:\Users\Admin\AppData\Local\Temp\5A8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\838.tmp"C:\Users\Admin\AppData\Local\Temp\838.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\9AF.tmp"C:\Users\Admin\AppData\Local\Temp\9AF.tmp"23⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\A9A.tmp"C:\Users\Admin\AppData\Local\Temp\A9A.tmp"24⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\BB3.tmp"C:\Users\Admin\AppData\Local\Temp\BB3.tmp"25⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\CCC.tmp"C:\Users\Admin\AppData\Local\Temp\CCC.tmp"26⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\E43.tmp"C:\Users\Admin\AppData\Local\Temp\E43.tmp"27⤵
- Executes dropped EXE
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\F4D.tmp"C:\Users\Admin\AppData\Local\Temp\F4D.tmp"28⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\1085.tmp"C:\Users\Admin\AppData\Local\Temp\1085.tmp"29⤵
- Executes dropped EXE
PID:336 -
C:\Users\Admin\AppData\Local\Temp\118F.tmp"C:\Users\Admin\AppData\Local\Temp\118F.tmp"30⤵
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\121C.tmp"C:\Users\Admin\AppData\Local\Temp\121C.tmp"31⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\12A8.tmp"C:\Users\Admin\AppData\Local\Temp\12A8.tmp"32⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\1373.tmp"C:\Users\Admin\AppData\Local\Temp\1373.tmp"33⤵
- Executes dropped EXE
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\1410.tmp"C:\Users\Admin\AppData\Local\Temp\1410.tmp"34⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\14CB.tmp"C:\Users\Admin\AppData\Local\Temp\14CB.tmp"35⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\1577.tmp"C:\Users\Admin\AppData\Local\Temp\1577.tmp"36⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\1623.tmp"C:\Users\Admin\AppData\Local\Temp\1623.tmp"37⤵
- Executes dropped EXE
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\16A0.tmp"C:\Users\Admin\AppData\Local\Temp\16A0.tmp"38⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\176B.tmp"C:\Users\Admin\AppData\Local\Temp\176B.tmp"39⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\1807.tmp"C:\Users\Admin\AppData\Local\Temp\1807.tmp"40⤵
- Executes dropped EXE
PID:568 -
C:\Users\Admin\AppData\Local\Temp\1884.tmp"C:\Users\Admin\AppData\Local\Temp\1884.tmp"41⤵
- Executes dropped EXE
PID:668 -
C:\Users\Admin\AppData\Local\Temp\18F2.tmp"C:\Users\Admin\AppData\Local\Temp\18F2.tmp"42⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\195F.tmp"C:\Users\Admin\AppData\Local\Temp\195F.tmp"43⤵
- Executes dropped EXE
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\19EC.tmp"C:\Users\Admin\AppData\Local\Temp\19EC.tmp"44⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\1A69.tmp"C:\Users\Admin\AppData\Local\Temp\1A69.tmp"45⤵
- Executes dropped EXE
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"46⤵
- Executes dropped EXE
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\1C4D.tmp"C:\Users\Admin\AppData\Local\Temp\1C4D.tmp"47⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"48⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\1D86.tmp"C:\Users\Admin\AppData\Local\Temp\1D86.tmp"49⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\1E22.tmp"C:\Users\Admin\AppData\Local\Temp\1E22.tmp"50⤵
- Executes dropped EXE
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\1ECE.tmp"C:\Users\Admin\AppData\Local\Temp\1ECE.tmp"51⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\1F7A.tmp"C:\Users\Admin\AppData\Local\Temp\1F7A.tmp"52⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\2035.tmp"C:\Users\Admin\AppData\Local\Temp\2035.tmp"53⤵
- Executes dropped EXE
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\20A2.tmp"C:\Users\Admin\AppData\Local\Temp\20A2.tmp"54⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\22B6.tmp"C:\Users\Admin\AppData\Local\Temp\22B6.tmp"55⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\2333.tmp"C:\Users\Admin\AppData\Local\Temp\2333.tmp"56⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\23CF.tmp"C:\Users\Admin\AppData\Local\Temp\23CF.tmp"57⤵
- Executes dropped EXE
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\245C.tmp"C:\Users\Admin\AppData\Local\Temp\245C.tmp"58⤵
- Executes dropped EXE
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\24F8.tmp"C:\Users\Admin\AppData\Local\Temp\24F8.tmp"59⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\2584.tmp"C:\Users\Admin\AppData\Local\Temp\2584.tmp"60⤵
- Executes dropped EXE
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\2611.tmp"C:\Users\Admin\AppData\Local\Temp\2611.tmp"61⤵
- Executes dropped EXE
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\267E.tmp"C:\Users\Admin\AppData\Local\Temp\267E.tmp"62⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\2769.tmp"C:\Users\Admin\AppData\Local\Temp\2769.tmp"63⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\27F5.tmp"C:\Users\Admin\AppData\Local\Temp\27F5.tmp"64⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\2882.tmp"C:\Users\Admin\AppData\Local\Temp\2882.tmp"65⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\28FF.tmp"C:\Users\Admin\AppData\Local\Temp\28FF.tmp"66⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\299B.tmp"C:\Users\Admin\AppData\Local\Temp\299B.tmp"67⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\2A09.tmp"C:\Users\Admin\AppData\Local\Temp\2A09.tmp"68⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\2AD4.tmp"C:\Users\Admin\AppData\Local\Temp\2AD4.tmp"69⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\2B41.tmp"C:\Users\Admin\AppData\Local\Temp\2B41.tmp"70⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\2BBE.tmp"C:\Users\Admin\AppData\Local\Temp\2BBE.tmp"71⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\2C6A.tmp"C:\Users\Admin\AppData\Local\Temp\2C6A.tmp"72⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\2CF7.tmp"C:\Users\Admin\AppData\Local\Temp\2CF7.tmp"73⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\2D64.tmp"C:\Users\Admin\AppData\Local\Temp\2D64.tmp"74⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"75⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\2E6E.tmp"C:\Users\Admin\AppData\Local\Temp\2E6E.tmp"76⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\2EEB.tmp"C:\Users\Admin\AppData\Local\Temp\2EEB.tmp"77⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\2F58.tmp"C:\Users\Admin\AppData\Local\Temp\2F58.tmp"78⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\2FF4.tmp"C:\Users\Admin\AppData\Local\Temp\2FF4.tmp"79⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\30A0.tmp"C:\Users\Admin\AppData\Local\Temp\30A0.tmp"80⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\311D.tmp"C:\Users\Admin\AppData\Local\Temp\311D.tmp"81⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\31B9.tmp"C:\Users\Admin\AppData\Local\Temp\31B9.tmp"82⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"83⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\32E2.tmp"C:\Users\Admin\AppData\Local\Temp\32E2.tmp"84⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"85⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"86⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"87⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\34C7.tmp"C:\Users\Admin\AppData\Local\Temp\34C7.tmp"88⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"89⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\35D0.tmp"C:\Users\Admin\AppData\Local\Temp\35D0.tmp"90⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\365D.tmp"C:\Users\Admin\AppData\Local\Temp\365D.tmp"91⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\3709.tmp"C:\Users\Admin\AppData\Local\Temp\3709.tmp"92⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\3776.tmp"C:\Users\Admin\AppData\Local\Temp\3776.tmp"93⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\37E4.tmp"C:\Users\Admin\AppData\Local\Temp\37E4.tmp"94⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\3870.tmp"C:\Users\Admin\AppData\Local\Temp\3870.tmp"95⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\390C.tmp"C:\Users\Admin\AppData\Local\Temp\390C.tmp"96⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\397A.tmp"C:\Users\Admin\AppData\Local\Temp\397A.tmp"97⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\39F7.tmp"C:\Users\Admin\AppData\Local\Temp\39F7.tmp"98⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\3A64.tmp"C:\Users\Admin\AppData\Local\Temp\3A64.tmp"99⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\3AF1.tmp"C:\Users\Admin\AppData\Local\Temp\3AF1.tmp"100⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\3B5E.tmp"C:\Users\Admin\AppData\Local\Temp\3B5E.tmp"101⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\3C0A.tmp"C:\Users\Admin\AppData\Local\Temp\3C0A.tmp"102⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\3C97.tmp"C:\Users\Admin\AppData\Local\Temp\3C97.tmp"103⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\3D04.tmp"C:\Users\Admin\AppData\Local\Temp\3D04.tmp"104⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\3D91.tmp"C:\Users\Admin\AppData\Local\Temp\3D91.tmp"105⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\3E0E.tmp"C:\Users\Admin\AppData\Local\Temp\3E0E.tmp"106⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\3E9A.tmp"C:\Users\Admin\AppData\Local\Temp\3E9A.tmp"107⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\3F08.tmp"C:\Users\Admin\AppData\Local\Temp\3F08.tmp"108⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\3F85.tmp"C:\Users\Admin\AppData\Local\Temp\3F85.tmp"109⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\4031.tmp"C:\Users\Admin\AppData\Local\Temp\4031.tmp"110⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\40AE.tmp"C:\Users\Admin\AppData\Local\Temp\40AE.tmp"111⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\414A.tmp"C:\Users\Admin\AppData\Local\Temp\414A.tmp"112⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\4234.tmp"C:\Users\Admin\AppData\Local\Temp\4234.tmp"113⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\42A2.tmp"C:\Users\Admin\AppData\Local\Temp\42A2.tmp"114⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\436D.tmp"C:\Users\Admin\AppData\Local\Temp\436D.tmp"115⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\43EA.tmp"C:\Users\Admin\AppData\Local\Temp\43EA.tmp"116⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\4486.tmp"C:\Users\Admin\AppData\Local\Temp\4486.tmp"117⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\44F3.tmp"C:\Users\Admin\AppData\Local\Temp\44F3.tmp"118⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\4570.tmp"C:\Users\Admin\AppData\Local\Temp\4570.tmp"119⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\45DE.tmp"C:\Users\Admin\AppData\Local\Temp\45DE.tmp"120⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\466A.tmp"C:\Users\Admin\AppData\Local\Temp\466A.tmp"121⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\46F7.tmp"C:\Users\Admin\AppData\Local\Temp\46F7.tmp"122⤵PID:1856
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-