Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
03/08/2023, 18:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
54acf2d08dc113a5a8a0b9ef262c4035_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
54acf2d08dc113a5a8a0b9ef262c4035_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
54acf2d08dc113a5a8a0b9ef262c4035_mafia_JC.exe
-
Size
486KB
-
MD5
54acf2d08dc113a5a8a0b9ef262c4035
-
SHA1
6ac690d51e5985178fd6fd8bee85ef59f31f8656
-
SHA256
01fae7bf00f3cef4e7c116b6287a3efb3ed5c976d8cac8c56406995f2016bd98
-
SHA512
ba4a49128fadc405cc4a80ca458db2f9c8040ebc02fae0a5062fa68b9131716f4ba80e7447290d9331b2ec74ba427371b635c11056b0ce16f1ad7479ec631452
-
SSDEEP
12288:/U5rCOTeiD7jhHuVd3fMfVgX2hWqVJblFBeyCNZ:/UQOJD7jhOd3fT2wqdPeyCN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2504 B248.tmp 2388 B314.tmp 2288 B3BF.tmp 4856 B45C.tmp 884 B508.tmp 1512 B5B3.tmp 3460 B66F.tmp 556 BCB8.tmp 1200 BD83.tmp 1164 BE2F.tmp 2024 BEEB.tmp 1716 BF87.tmp 3120 C052.tmp 1788 C0FE.tmp 4492 C1C9.tmp 408 C265.tmp 4324 C331.tmp 2096 C41B.tmp 4956 C505.tmp 2908 C5C1.tmp 1188 C69C.tmp 2000 C796.tmp 3276 C861.tmp 4216 C8FD.tmp 3772 C9E7.tmp 4100 CA84.tmp 3204 CB2F.tmp 4236 CBAC.tmp 4432 CC49.tmp 4212 CD14.tmp 1288 CDB0.tmp 2756 CF66.tmp 4272 D050.tmp 1648 D198.tmp 2440 D225.tmp 4952 D2C1.tmp 1608 D32E.tmp 3868 D39C.tmp 1268 D409.tmp 1404 D4B5.tmp 3320 D551.tmp 2748 D5CE.tmp 2456 D65B.tmp 3796 D6F7.tmp 1956 D774.tmp 392 D7E1.tmp 1088 D85E.tmp 5012 D8EB.tmp 4872 D968.tmp 4192 D9E5.tmp 4440 DA91.tmp 4736 DB1E.tmp 1292 DBAA.tmp 4120 DC18.tmp 2376 DCB4.tmp 1040 DD31.tmp 3168 DDDD.tmp 1484 DE5A.tmp 2340 DEE6.tmp 1184 DF83.tmp 1516 E02E.tmp 1860 E0BB.tmp 2208 E157.tmp 1656 E1E4.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4716 wrote to memory of 2504 4716 54acf2d08dc113a5a8a0b9ef262c4035_mafia_JC.exe 83 PID 4716 wrote to memory of 2504 4716 54acf2d08dc113a5a8a0b9ef262c4035_mafia_JC.exe 83 PID 4716 wrote to memory of 2504 4716 54acf2d08dc113a5a8a0b9ef262c4035_mafia_JC.exe 83 PID 2504 wrote to memory of 2388 2504 B248.tmp 84 PID 2504 wrote to memory of 2388 2504 B248.tmp 84 PID 2504 wrote to memory of 2388 2504 B248.tmp 84 PID 2388 wrote to memory of 2288 2388 B314.tmp 85 PID 2388 wrote to memory of 2288 2388 B314.tmp 85 PID 2388 wrote to memory of 2288 2388 B314.tmp 85 PID 2288 wrote to memory of 4856 2288 B3BF.tmp 87 PID 2288 wrote to memory of 4856 2288 B3BF.tmp 87 PID 2288 wrote to memory of 4856 2288 B3BF.tmp 87 PID 4856 wrote to memory of 884 4856 B45C.tmp 88 PID 4856 wrote to memory of 884 4856 B45C.tmp 88 PID 4856 wrote to memory of 884 4856 B45C.tmp 88 PID 884 wrote to memory of 1512 884 B508.tmp 89 PID 884 wrote to memory of 1512 884 B508.tmp 89 PID 884 wrote to memory of 1512 884 B508.tmp 89 PID 1512 wrote to memory of 3460 1512 B5B3.tmp 90 PID 1512 wrote to memory of 3460 1512 B5B3.tmp 90 PID 1512 wrote to memory of 3460 1512 B5B3.tmp 90 PID 3460 wrote to memory of 556 3460 B66F.tmp 91 PID 3460 wrote to memory of 556 3460 B66F.tmp 91 PID 3460 wrote to memory of 556 3460 B66F.tmp 91 PID 556 wrote to memory of 1200 556 BCB8.tmp 92 PID 556 wrote to memory of 1200 556 BCB8.tmp 92 PID 556 wrote to memory of 1200 556 BCB8.tmp 92 PID 1200 wrote to memory of 1164 1200 BD83.tmp 93 PID 1200 wrote to memory of 1164 1200 BD83.tmp 93 PID 1200 wrote to memory of 1164 1200 BD83.tmp 93 PID 1164 wrote to memory of 2024 1164 BE2F.tmp 94 PID 1164 wrote to memory of 2024 1164 BE2F.tmp 94 PID 1164 wrote to memory of 2024 1164 BE2F.tmp 94 PID 2024 wrote to memory of 1716 2024 BEEB.tmp 95 PID 2024 wrote to memory of 1716 2024 BEEB.tmp 95 PID 2024 wrote to memory of 1716 2024 BEEB.tmp 95 PID 1716 wrote to memory of 3120 1716 BF87.tmp 96 PID 1716 wrote to memory of 3120 1716 BF87.tmp 96 PID 1716 wrote to memory of 3120 1716 BF87.tmp 96 PID 3120 wrote to memory of 1788 3120 C052.tmp 97 PID 3120 wrote to memory of 1788 3120 C052.tmp 97 PID 3120 wrote to memory of 1788 3120 C052.tmp 97 PID 1788 wrote to memory of 4492 1788 C0FE.tmp 98 PID 1788 wrote to memory of 4492 1788 C0FE.tmp 98 PID 1788 wrote to memory of 4492 1788 C0FE.tmp 98 PID 4492 wrote to memory of 408 4492 C1C9.tmp 99 PID 4492 wrote to memory of 408 4492 C1C9.tmp 99 PID 4492 wrote to memory of 408 4492 C1C9.tmp 99 PID 408 wrote to memory of 4324 408 C265.tmp 100 PID 408 wrote to memory of 4324 408 C265.tmp 100 PID 408 wrote to memory of 4324 408 C265.tmp 100 PID 4324 wrote to memory of 2096 4324 C331.tmp 101 PID 4324 wrote to memory of 2096 4324 C331.tmp 101 PID 4324 wrote to memory of 2096 4324 C331.tmp 101 PID 2096 wrote to memory of 4956 2096 C41B.tmp 102 PID 2096 wrote to memory of 4956 2096 C41B.tmp 102 PID 2096 wrote to memory of 4956 2096 C41B.tmp 102 PID 4956 wrote to memory of 2908 4956 C505.tmp 103 PID 4956 wrote to memory of 2908 4956 C505.tmp 103 PID 4956 wrote to memory of 2908 4956 C505.tmp 103 PID 2908 wrote to memory of 1188 2908 C5C1.tmp 104 PID 2908 wrote to memory of 1188 2908 C5C1.tmp 104 PID 2908 wrote to memory of 1188 2908 C5C1.tmp 104 PID 1188 wrote to memory of 2000 1188 C69C.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\54acf2d08dc113a5a8a0b9ef262c4035_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\54acf2d08dc113a5a8a0b9ef262c4035_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\B314.tmp"C:\Users\Admin\AppData\Local\Temp\B314.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\B45C.tmp"C:\Users\Admin\AppData\Local\Temp\B45C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\B508.tmp"C:\Users\Admin\AppData\Local\Temp\B508.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\B66F.tmp"C:\Users\Admin\AppData\Local\Temp\B66F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\BD83.tmp"C:\Users\Admin\AppData\Local\Temp\BD83.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\BEEB.tmp"C:\Users\Admin\AppData\Local\Temp\BEEB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\BF87.tmp"C:\Users\Admin\AppData\Local\Temp\BF87.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\C052.tmp"C:\Users\Admin\AppData\Local\Temp\C052.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\C331.tmp"C:\Users\Admin\AppData\Local\Temp\C331.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\C41B.tmp"C:\Users\Admin\AppData\Local\Temp\C41B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\C505.tmp"C:\Users\Admin\AppData\Local\Temp\C505.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\C69C.tmp"C:\Users\Admin\AppData\Local\Temp\C69C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\C796.tmp"C:\Users\Admin\AppData\Local\Temp\C796.tmp"23⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\C861.tmp"C:\Users\Admin\AppData\Local\Temp\C861.tmp"24⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"25⤵
- Executes dropped EXE
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"26⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\CA84.tmp"C:\Users\Admin\AppData\Local\Temp\CA84.tmp"27⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"28⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\CBAC.tmp"C:\Users\Admin\AppData\Local\Temp\CBAC.tmp"29⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\CC49.tmp"C:\Users\Admin\AppData\Local\Temp\CC49.tmp"30⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\CD14.tmp"C:\Users\Admin\AppData\Local\Temp\CD14.tmp"31⤵
- Executes dropped EXE
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"32⤵
- Executes dropped EXE
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\CF66.tmp"C:\Users\Admin\AppData\Local\Temp\CF66.tmp"33⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\D050.tmp"C:\Users\Admin\AppData\Local\Temp\D050.tmp"34⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\D198.tmp"C:\Users\Admin\AppData\Local\Temp\D198.tmp"35⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\D225.tmp"C:\Users\Admin\AppData\Local\Temp\D225.tmp"36⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\D2C1.tmp"C:\Users\Admin\AppData\Local\Temp\D2C1.tmp"37⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\D32E.tmp"C:\Users\Admin\AppData\Local\Temp\D32E.tmp"38⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\D39C.tmp"C:\Users\Admin\AppData\Local\Temp\D39C.tmp"39⤵
- Executes dropped EXE
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\D409.tmp"C:\Users\Admin\AppData\Local\Temp\D409.tmp"40⤵
- Executes dropped EXE
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\D4B5.tmp"C:\Users\Admin\AppData\Local\Temp\D4B5.tmp"41⤵
- Executes dropped EXE
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\D551.tmp"C:\Users\Admin\AppData\Local\Temp\D551.tmp"42⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\D5CE.tmp"C:\Users\Admin\AppData\Local\Temp\D5CE.tmp"43⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\D65B.tmp"C:\Users\Admin\AppData\Local\Temp\D65B.tmp"44⤵
- Executes dropped EXE
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"45⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\D774.tmp"C:\Users\Admin\AppData\Local\Temp\D774.tmp"46⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\D7E1.tmp"C:\Users\Admin\AppData\Local\Temp\D7E1.tmp"47⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\D85E.tmp"C:\Users\Admin\AppData\Local\Temp\D85E.tmp"48⤵
- Executes dropped EXE
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"49⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\D968.tmp"C:\Users\Admin\AppData\Local\Temp\D968.tmp"50⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\D9E5.tmp"C:\Users\Admin\AppData\Local\Temp\D9E5.tmp"51⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\DA91.tmp"C:\Users\Admin\AppData\Local\Temp\DA91.tmp"52⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"53⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\DBAA.tmp"C:\Users\Admin\AppData\Local\Temp\DBAA.tmp"54⤵
- Executes dropped EXE
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\DC18.tmp"C:\Users\Admin\AppData\Local\Temp\DC18.tmp"55⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"56⤵
- Executes dropped EXE
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\DD31.tmp"C:\Users\Admin\AppData\Local\Temp\DD31.tmp"57⤵
- Executes dropped EXE
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\DDDD.tmp"C:\Users\Admin\AppData\Local\Temp\DDDD.tmp"58⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\DE5A.tmp"C:\Users\Admin\AppData\Local\Temp\DE5A.tmp"59⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"60⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\DF83.tmp"C:\Users\Admin\AppData\Local\Temp\DF83.tmp"61⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\E02E.tmp"C:\Users\Admin\AppData\Local\Temp\E02E.tmp"62⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\E0BB.tmp"C:\Users\Admin\AppData\Local\Temp\E0BB.tmp"63⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\E157.tmp"C:\Users\Admin\AppData\Local\Temp\E157.tmp"64⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"65⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\E280.tmp"C:\Users\Admin\AppData\Local\Temp\E280.tmp"66⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\E2FD.tmp"C:\Users\Admin\AppData\Local\Temp\E2FD.tmp"67⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\E399.tmp"C:\Users\Admin\AppData\Local\Temp\E399.tmp"68⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\E426.tmp"C:\Users\Admin\AppData\Local\Temp\E426.tmp"69⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\E4C2.tmp"C:\Users\Admin\AppData\Local\Temp\E4C2.tmp"70⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\E53F.tmp"C:\Users\Admin\AppData\Local\Temp\E53F.tmp"71⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"72⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\E678.tmp"C:\Users\Admin\AppData\Local\Temp\E678.tmp"73⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"74⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\E762.tmp"C:\Users\Admin\AppData\Local\Temp\E762.tmp"75⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"76⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\E84D.tmp"C:\Users\Admin\AppData\Local\Temp\E84D.tmp"77⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"78⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\E966.tmp"C:\Users\Admin\AppData\Local\Temp\E966.tmp"79⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\EA02.tmp"C:\Users\Admin\AppData\Local\Temp\EA02.tmp"80⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"81⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"82⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\EB89.tmp"C:\Users\Admin\AppData\Local\Temp\EB89.tmp"83⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\EC25.tmp"C:\Users\Admin\AppData\Local\Temp\EC25.tmp"84⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\EC92.tmp"C:\Users\Admin\AppData\Local\Temp\EC92.tmp"85⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\ED00.tmp"C:\Users\Admin\AppData\Local\Temp\ED00.tmp"86⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"87⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\EE57.tmp"C:\Users\Admin\AppData\Local\Temp\EE57.tmp"88⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\EED4.tmp"C:\Users\Admin\AppData\Local\Temp\EED4.tmp"89⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\EF51.tmp"C:\Users\Admin\AppData\Local\Temp\EF51.tmp"90⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\EFEE.tmp"C:\Users\Admin\AppData\Local\Temp\EFEE.tmp"91⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\F07A.tmp"C:\Users\Admin\AppData\Local\Temp\F07A.tmp"92⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\F126.tmp"C:\Users\Admin\AppData\Local\Temp\F126.tmp"93⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\F1D2.tmp"C:\Users\Admin\AppData\Local\Temp\F1D2.tmp"94⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\F26E.tmp"C:\Users\Admin\AppData\Local\Temp\F26E.tmp"95⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\F2FB.tmp"C:\Users\Admin\AppData\Local\Temp\F2FB.tmp"96⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\F397.tmp"C:\Users\Admin\AppData\Local\Temp\F397.tmp"97⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\F424.tmp"C:\Users\Admin\AppData\Local\Temp\F424.tmp"98⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\F4B0.tmp"C:\Users\Admin\AppData\Local\Temp\F4B0.tmp"99⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\F53D.tmp"C:\Users\Admin\AppData\Local\Temp\F53D.tmp"100⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"101⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\F647.tmp"C:\Users\Admin\AppData\Local\Temp\F647.tmp"102⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"103⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\F760.tmp"C:\Users\Admin\AppData\Local\Temp\F760.tmp"104⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"105⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\F84A.tmp"C:\Users\Admin\AppData\Local\Temp\F84A.tmp"106⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\F8D7.tmp"C:\Users\Admin\AppData\Local\Temp\F8D7.tmp"107⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\F973.tmp"C:\Users\Admin\AppData\Local\Temp\F973.tmp"108⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\F9F0.tmp"C:\Users\Admin\AppData\Local\Temp\F9F0.tmp"109⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"110⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\FACB.tmp"C:\Users\Admin\AppData\Local\Temp\FACB.tmp"111⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\FB48.tmp"C:\Users\Admin\AppData\Local\Temp\FB48.tmp"112⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"113⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\FC61.tmp"C:\Users\Admin\AppData\Local\Temp\FC61.tmp"114⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\FCDE.tmp"C:\Users\Admin\AppData\Local\Temp\FCDE.tmp"115⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"116⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\FDF7.tmp"C:\Users\Admin\AppData\Local\Temp\FDF7.tmp"117⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\FE74.tmp"C:\Users\Admin\AppData\Local\Temp\FE74.tmp"118⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"119⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\FF8E.tmp"C:\Users\Admin\AppData\Local\Temp\FF8E.tmp"120⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\B.tmp"C:\Users\Admin\AppData\Local\Temp\B.tmp"121⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7.tmp"122⤵PID:1884
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-