Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
04/08/2023, 15:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5bab0d3dae9e8a24bacf3187aff322fe_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
5bab0d3dae9e8a24bacf3187aff322fe_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
5bab0d3dae9e8a24bacf3187aff322fe_mafia_JC.exe
-
Size
486KB
-
MD5
5bab0d3dae9e8a24bacf3187aff322fe
-
SHA1
1e5f5e24e5298f86ad2297c7f27941f6f59b8cb9
-
SHA256
15b8370ae97af8e15c22607d24e1308d0a380c96c8319be12cf14b354537ce7d
-
SHA512
9dccde56ad50bed3c83419638130882220510e07be068964501c656d6f98f867521a400d98d5b32cb7d26386eca7026c92cd985f4380142cae83f2c08d363cea
-
SSDEEP
12288:/U5rCOTeiDp1zbmgHPQeuDumx8RKZzSv3MNZ:/UQOJDp1xP9ineoZS/MN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2484 DFE0.tmp 1708 E0AB.tmp 2872 E196.tmp 832 E280.tmp 4484 E33C.tmp 836 E3E8.tmp 4928 E4D2.tmp 864 E55F.tmp 4996 E5FB.tmp 1252 E6E5.tmp 3728 E791.tmp 4376 E84D.tmp 2868 E8E9.tmp 1240 E9B4.tmp 744 EA7F.tmp 1596 EAFC.tmp 4084 EB98.tmp 1856 EC92.tmp 1928 ED8C.tmp 4524 EE67.tmp 4380 EF71.tmp 4880 F02C.tmp 1536 F0C8.tmp 472 F1A3.tmp 4252 F23F.tmp 2676 F2CC.tmp 3208 F3B6.tmp 3584 F482.tmp 568 F55C.tmp 4344 F647.tmp 4244 F6F3.tmp 876 F79E.tmp 3184 F898.tmp 2180 F925.tmp 2260 FA0F.tmp 2372 FA9C.tmp 456 FB38.tmp 5108 FBB5.tmp 4828 FC52.tmp 2976 FCCF.tmp 3236 FD5B.tmp 3032 FE07.tmp 4020 FEB3.tmp 4940 FF40.tmp 4040 FFEB.tmp 4820 78.tmp 4432 114.tmp 4364 1C0.tmp 2536 24D.tmp 4984 2D9.tmp 2524 356.tmp 2148 402.tmp 3412 470.tmp 408 4ED.tmp 208 579.tmp 3808 616.tmp 3424 6C1.tmp 1048 73E.tmp 3964 7AC.tmp 4992 819.tmp 3328 8A6.tmp 836 932.tmp 416 9CF.tmp 3956 A6B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4080 wrote to memory of 2484 4080 5bab0d3dae9e8a24bacf3187aff322fe_mafia_JC.exe 80 PID 4080 wrote to memory of 2484 4080 5bab0d3dae9e8a24bacf3187aff322fe_mafia_JC.exe 80 PID 4080 wrote to memory of 2484 4080 5bab0d3dae9e8a24bacf3187aff322fe_mafia_JC.exe 80 PID 2484 wrote to memory of 1708 2484 DFE0.tmp 81 PID 2484 wrote to memory of 1708 2484 DFE0.tmp 81 PID 2484 wrote to memory of 1708 2484 DFE0.tmp 81 PID 1708 wrote to memory of 2872 1708 E0AB.tmp 82 PID 1708 wrote to memory of 2872 1708 E0AB.tmp 82 PID 1708 wrote to memory of 2872 1708 E0AB.tmp 82 PID 2872 wrote to memory of 832 2872 E196.tmp 83 PID 2872 wrote to memory of 832 2872 E196.tmp 83 PID 2872 wrote to memory of 832 2872 E196.tmp 83 PID 832 wrote to memory of 4484 832 E280.tmp 84 PID 832 wrote to memory of 4484 832 E280.tmp 84 PID 832 wrote to memory of 4484 832 E280.tmp 84 PID 4484 wrote to memory of 836 4484 E33C.tmp 85 PID 4484 wrote to memory of 836 4484 E33C.tmp 85 PID 4484 wrote to memory of 836 4484 E33C.tmp 85 PID 836 wrote to memory of 4928 836 E3E8.tmp 87 PID 836 wrote to memory of 4928 836 E3E8.tmp 87 PID 836 wrote to memory of 4928 836 E3E8.tmp 87 PID 4928 wrote to memory of 864 4928 E4D2.tmp 88 PID 4928 wrote to memory of 864 4928 E4D2.tmp 88 PID 4928 wrote to memory of 864 4928 E4D2.tmp 88 PID 864 wrote to memory of 4996 864 E55F.tmp 89 PID 864 wrote to memory of 4996 864 E55F.tmp 89 PID 864 wrote to memory of 4996 864 E55F.tmp 89 PID 4996 wrote to memory of 1252 4996 E5FB.tmp 90 PID 4996 wrote to memory of 1252 4996 E5FB.tmp 90 PID 4996 wrote to memory of 1252 4996 E5FB.tmp 90 PID 1252 wrote to memory of 3728 1252 E6E5.tmp 91 PID 1252 wrote to memory of 3728 1252 E6E5.tmp 91 PID 1252 wrote to memory of 3728 1252 E6E5.tmp 91 PID 3728 wrote to memory of 4376 3728 E791.tmp 92 PID 3728 wrote to memory of 4376 3728 E791.tmp 92 PID 3728 wrote to memory of 4376 3728 E791.tmp 92 PID 4376 wrote to memory of 2868 4376 E84D.tmp 93 PID 4376 wrote to memory of 2868 4376 E84D.tmp 93 PID 4376 wrote to memory of 2868 4376 E84D.tmp 93 PID 2868 wrote to memory of 1240 2868 E8E9.tmp 94 PID 2868 wrote to memory of 1240 2868 E8E9.tmp 94 PID 2868 wrote to memory of 1240 2868 E8E9.tmp 94 PID 1240 wrote to memory of 744 1240 E9B4.tmp 95 PID 1240 wrote to memory of 744 1240 E9B4.tmp 95 PID 1240 wrote to memory of 744 1240 E9B4.tmp 95 PID 744 wrote to memory of 1596 744 EA7F.tmp 97 PID 744 wrote to memory of 1596 744 EA7F.tmp 97 PID 744 wrote to memory of 1596 744 EA7F.tmp 97 PID 1596 wrote to memory of 4084 1596 EAFC.tmp 99 PID 1596 wrote to memory of 4084 1596 EAFC.tmp 99 PID 1596 wrote to memory of 4084 1596 EAFC.tmp 99 PID 4084 wrote to memory of 1856 4084 EB98.tmp 100 PID 4084 wrote to memory of 1856 4084 EB98.tmp 100 PID 4084 wrote to memory of 1856 4084 EB98.tmp 100 PID 1856 wrote to memory of 1928 1856 EC92.tmp 101 PID 1856 wrote to memory of 1928 1856 EC92.tmp 101 PID 1856 wrote to memory of 1928 1856 EC92.tmp 101 PID 1928 wrote to memory of 4524 1928 ED8C.tmp 102 PID 1928 wrote to memory of 4524 1928 ED8C.tmp 102 PID 1928 wrote to memory of 4524 1928 ED8C.tmp 102 PID 4524 wrote to memory of 4380 4524 EE67.tmp 104 PID 4524 wrote to memory of 4380 4524 EE67.tmp 104 PID 4524 wrote to memory of 4380 4524 EE67.tmp 104 PID 4380 wrote to memory of 4880 4380 EF71.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bab0d3dae9e8a24bacf3187aff322fe_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\5bab0d3dae9e8a24bacf3187aff322fe_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\DFE0.tmp"C:\Users\Admin\AppData\Local\Temp\DFE0.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\E0AB.tmp"C:\Users\Admin\AppData\Local\Temp\E0AB.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\E196.tmp"C:\Users\Admin\AppData\Local\Temp\E196.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\E280.tmp"C:\Users\Admin\AppData\Local\Temp\E280.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\E33C.tmp"C:\Users\Admin\AppData\Local\Temp\E33C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\E3E8.tmp"C:\Users\Admin\AppData\Local\Temp\E3E8.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\E4D2.tmp"C:\Users\Admin\AppData\Local\Temp\E4D2.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\E55F.tmp"C:\Users\Admin\AppData\Local\Temp\E55F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\E791.tmp"C:\Users\Admin\AppData\Local\Temp\E791.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\E84D.tmp"C:\Users\Admin\AppData\Local\Temp\E84D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\EAFC.tmp"C:\Users\Admin\AppData\Local\Temp\EAFC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\EB98.tmp"C:\Users\Admin\AppData\Local\Temp\EB98.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\EC92.tmp"C:\Users\Admin\AppData\Local\Temp\EC92.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\EE67.tmp"C:\Users\Admin\AppData\Local\Temp\EE67.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\EF71.tmp"C:\Users\Admin\AppData\Local\Temp\EF71.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\F02C.tmp"C:\Users\Admin\AppData\Local\Temp\F02C.tmp"23⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"24⤵
- Executes dropped EXE
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\F1A3.tmp"C:\Users\Admin\AppData\Local\Temp\F1A3.tmp"25⤵
- Executes dropped EXE
PID:472 -
C:\Users\Admin\AppData\Local\Temp\F23F.tmp"C:\Users\Admin\AppData\Local\Temp\F23F.tmp"26⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\F2CC.tmp"C:\Users\Admin\AppData\Local\Temp\F2CC.tmp"27⤵
- Executes dropped EXE
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"28⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\F482.tmp"C:\Users\Admin\AppData\Local\Temp\F482.tmp"29⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\F55C.tmp"C:\Users\Admin\AppData\Local\Temp\F55C.tmp"30⤵
- Executes dropped EXE
PID:568 -
C:\Users\Admin\AppData\Local\Temp\F647.tmp"C:\Users\Admin\AppData\Local\Temp\F647.tmp"31⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"32⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\F79E.tmp"C:\Users\Admin\AppData\Local\Temp\F79E.tmp"33⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\F898.tmp"C:\Users\Admin\AppData\Local\Temp\F898.tmp"34⤵
- Executes dropped EXE
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\F925.tmp"C:\Users\Admin\AppData\Local\Temp\F925.tmp"35⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\FA0F.tmp"C:\Users\Admin\AppData\Local\Temp\FA0F.tmp"36⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"37⤵
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\FB38.tmp"C:\Users\Admin\AppData\Local\Temp\FB38.tmp"38⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"39⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\FC52.tmp"C:\Users\Admin\AppData\Local\Temp\FC52.tmp"40⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"41⤵
- Executes dropped EXE
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"42⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\FE07.tmp"C:\Users\Admin\AppData\Local\Temp\FE07.tmp"43⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\FEB3.tmp"C:\Users\Admin\AppData\Local\Temp\FEB3.tmp"44⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\FF40.tmp"C:\Users\Admin\AppData\Local\Temp\FF40.tmp"45⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\FFEB.tmp"C:\Users\Admin\AppData\Local\Temp\FFEB.tmp"46⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\78.tmp"C:\Users\Admin\AppData\Local\Temp\78.tmp"47⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\114.tmp"C:\Users\Admin\AppData\Local\Temp\114.tmp"48⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\1C0.tmp"C:\Users\Admin\AppData\Local\Temp\1C0.tmp"49⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\24D.tmp"C:\Users\Admin\AppData\Local\Temp\24D.tmp"50⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\2D9.tmp"C:\Users\Admin\AppData\Local\Temp\2D9.tmp"51⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\356.tmp"C:\Users\Admin\AppData\Local\Temp\356.tmp"52⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\402.tmp"C:\Users\Admin\AppData\Local\Temp\402.tmp"53⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\470.tmp"C:\Users\Admin\AppData\Local\Temp\470.tmp"54⤵
- Executes dropped EXE
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\4ED.tmp"C:\Users\Admin\AppData\Local\Temp\4ED.tmp"55⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\579.tmp"C:\Users\Admin\AppData\Local\Temp\579.tmp"56⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\616.tmp"C:\Users\Admin\AppData\Local\Temp\616.tmp"57⤵
- Executes dropped EXE
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\6C1.tmp"C:\Users\Admin\AppData\Local\Temp\6C1.tmp"58⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\73E.tmp"C:\Users\Admin\AppData\Local\Temp\73E.tmp"59⤵
- Executes dropped EXE
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\7AC.tmp"C:\Users\Admin\AppData\Local\Temp\7AC.tmp"60⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\819.tmp"C:\Users\Admin\AppData\Local\Temp\819.tmp"61⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\8A6.tmp"C:\Users\Admin\AppData\Local\Temp\8A6.tmp"62⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\932.tmp"C:\Users\Admin\AppData\Local\Temp\932.tmp"63⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\9CF.tmp"C:\Users\Admin\AppData\Local\Temp\9CF.tmp"64⤵
- Executes dropped EXE
PID:416 -
C:\Users\Admin\AppData\Local\Temp\A6B.tmp"C:\Users\Admin\AppData\Local\Temp\A6B.tmp"65⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\AF8.tmp"C:\Users\Admin\AppData\Local\Temp\AF8.tmp"66⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\B84.tmp"C:\Users\Admin\AppData\Local\Temp\B84.tmp"67⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\C01.tmp"C:\Users\Admin\AppData\Local\Temp\C01.tmp"68⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\C9D.tmp"C:\Users\Admin\AppData\Local\Temp\C9D.tmp"69⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\CFB.tmp"C:\Users\Admin\AppData\Local\Temp\CFB.tmp"70⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\D59.tmp"C:\Users\Admin\AppData\Local\Temp\D59.tmp"71⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\DE6.tmp"C:\Users\Admin\AppData\Local\Temp\DE6.tmp"72⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\E82.tmp"C:\Users\Admin\AppData\Local\Temp\E82.tmp"73⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\F0E.tmp"C:\Users\Admin\AppData\Local\Temp\F0E.tmp"74⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\FCA.tmp"C:\Users\Admin\AppData\Local\Temp\FCA.tmp"75⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\1047.tmp"C:\Users\Admin\AppData\Local\Temp\1047.tmp"76⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\10B4.tmp"C:\Users\Admin\AppData\Local\Temp\10B4.tmp"77⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\1122.tmp"C:\Users\Admin\AppData\Local\Temp\1122.tmp"78⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\11AE.tmp"C:\Users\Admin\AppData\Local\Temp\11AE.tmp"79⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\123B.tmp"C:\Users\Admin\AppData\Local\Temp\123B.tmp"80⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\12C8.tmp"C:\Users\Admin\AppData\Local\Temp\12C8.tmp"81⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\1354.tmp"C:\Users\Admin\AppData\Local\Temp\1354.tmp"82⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\13D1.tmp"C:\Users\Admin\AppData\Local\Temp\13D1.tmp"83⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\144E.tmp"C:\Users\Admin\AppData\Local\Temp\144E.tmp"84⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\14BC.tmp"C:\Users\Admin\AppData\Local\Temp\14BC.tmp"85⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\1529.tmp"C:\Users\Admin\AppData\Local\Temp\1529.tmp"86⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\15B6.tmp"C:\Users\Admin\AppData\Local\Temp\15B6.tmp"87⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\1652.tmp"C:\Users\Admin\AppData\Local\Temp\1652.tmp"88⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\16DE.tmp"C:\Users\Admin\AppData\Local\Temp\16DE.tmp"89⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\178A.tmp"C:\Users\Admin\AppData\Local\Temp\178A.tmp"90⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\1817.tmp"C:\Users\Admin\AppData\Local\Temp\1817.tmp"91⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\18B3.tmp"C:\Users\Admin\AppData\Local\Temp\18B3.tmp"92⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\1921.tmp"C:\Users\Admin\AppData\Local\Temp\1921.tmp"93⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\19BD.tmp"C:\Users\Admin\AppData\Local\Temp\19BD.tmp"94⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\1A69.tmp"C:\Users\Admin\AppData\Local\Temp\1A69.tmp"95⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\1B05.tmp"C:\Users\Admin\AppData\Local\Temp\1B05.tmp"96⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"97⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\1C2E.tmp"C:\Users\Admin\AppData\Local\Temp\1C2E.tmp"98⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"99⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\1D37.tmp"C:\Users\Admin\AppData\Local\Temp\1D37.tmp"100⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\1DB4.tmp"C:\Users\Admin\AppData\Local\Temp\1DB4.tmp"101⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\1E60.tmp"C:\Users\Admin\AppData\Local\Temp\1E60.tmp"102⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\1EDD.tmp"C:\Users\Admin\AppData\Local\Temp\1EDD.tmp"103⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\1F6A.tmp"C:\Users\Admin\AppData\Local\Temp\1F6A.tmp"104⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"105⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\2093.tmp"C:\Users\Admin\AppData\Local\Temp\2093.tmp"106⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\2100.tmp"C:\Users\Admin\AppData\Local\Temp\2100.tmp"107⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\219C.tmp"C:\Users\Admin\AppData\Local\Temp\219C.tmp"108⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\2239.tmp"C:\Users\Admin\AppData\Local\Temp\2239.tmp"109⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\22D5.tmp"C:\Users\Admin\AppData\Local\Temp\22D5.tmp"110⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\2390.tmp"C:\Users\Admin\AppData\Local\Temp\2390.tmp"111⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\243C.tmp"C:\Users\Admin\AppData\Local\Temp\243C.tmp"112⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\24D9.tmp"C:\Users\Admin\AppData\Local\Temp\24D9.tmp"113⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\2565.tmp"C:\Users\Admin\AppData\Local\Temp\2565.tmp"114⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\25E2.tmp"C:\Users\Admin\AppData\Local\Temp\25E2.tmp"115⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\2650.tmp"C:\Users\Admin\AppData\Local\Temp\2650.tmp"116⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\26CD.tmp"C:\Users\Admin\AppData\Local\Temp\26CD.tmp"117⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\2769.tmp"C:\Users\Admin\AppData\Local\Temp\2769.tmp"118⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\27E6.tmp"C:\Users\Admin\AppData\Local\Temp\27E6.tmp"119⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\2892.tmp"C:\Users\Admin\AppData\Local\Temp\2892.tmp"120⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\290F.tmp"C:\Users\Admin\AppData\Local\Temp\290F.tmp"121⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\299B.tmp"C:\Users\Admin\AppData\Local\Temp\299B.tmp"122⤵PID:4356
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-