Analysis
-
max time kernel
151s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
04/08/2023, 15:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5a9b2a7d34ff6708dee8dc33bb090b66_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
5a9b2a7d34ff6708dee8dc33bb090b66_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
5a9b2a7d34ff6708dee8dc33bb090b66_mafia_JC.exe
-
Size
486KB
-
MD5
5a9b2a7d34ff6708dee8dc33bb090b66
-
SHA1
8bb1007c0ecc2aaa2f51f33de9bc618b36b6c231
-
SHA256
98ce041f4375ec2dace817c24039ea9431f46668b621207718dde63fd0530e3a
-
SHA512
c9c4bde56866f3bf462d29ccfa320493c75dbdde8a3f815483c78213845802d49a6247cb16265145bad34cdd33ed1991b8970b04a8e6cf638a605a727736f8d8
-
SSDEEP
12288:/U5rCOTeiD6xuAxVGLI/RN30U3DhGMVYW9xVbVNZ:/UQOJD6xN9j3DQ+hN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3948 F9B.tmp 3196 1940.tmp 1704 19EC.tmp 4244 1AE6.tmp 2468 1B72.tmp 4792 1C4D.tmp 400 1D47.tmp 956 1E12.tmp 4564 1EFD.tmp 632 1FA8.tmp 3760 20A2.tmp 4756 217D.tmp 4624 2229.tmp 4996 2304.tmp 3860 23EE.tmp 4952 24B9.tmp 1592 25A4.tmp 1976 272A.tmp 5084 28B1.tmp 2552 298C.tmp 3872 2A47.tmp 4404 2B32.tmp 4036 2C1C.tmp 4416 2CC8.tmp 1228 2D93.tmp 1956 2E3F.tmp 1676 2EEB.tmp 4788 314C.tmp 3920 364D.tmp 5064 3832.tmp 2052 39E7.tmp 3552 3AC2.tmp 1452 3CC6.tmp 2956 3E4C.tmp 4524 4002.tmp 4716 409E.tmp 836 412B.tmp 1404 42D0.tmp 3720 433E.tmp 4828 4428.tmp 2100 44E4.tmp 1524 4551.tmp 3620 45BE.tmp 1720 4707.tmp 1040 47F1.tmp 1200 489D.tmp 3724 4968.tmp 4200 49E5.tmp 4776 4AEF.tmp 1000 4B5C.tmp 2232 4C27.tmp 3912 4C94.tmp 4340 4DAE.tmp 4280 4E4A.tmp 1028 4ED7.tmp 3300 4F54.tmp 1724 50CB.tmp 4564 5148.tmp 692 51D4.tmp 1056 5261.tmp 4508 52DE.tmp 4212 53C8.tmp 4204 5455.tmp 1700 54C2.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5004 wrote to memory of 3948 5004 5a9b2a7d34ff6708dee8dc33bb090b66_mafia_JC.exe 86 PID 5004 wrote to memory of 3948 5004 5a9b2a7d34ff6708dee8dc33bb090b66_mafia_JC.exe 86 PID 5004 wrote to memory of 3948 5004 5a9b2a7d34ff6708dee8dc33bb090b66_mafia_JC.exe 86 PID 3948 wrote to memory of 3196 3948 F9B.tmp 87 PID 3948 wrote to memory of 3196 3948 F9B.tmp 87 PID 3948 wrote to memory of 3196 3948 F9B.tmp 87 PID 3196 wrote to memory of 1704 3196 1940.tmp 88 PID 3196 wrote to memory of 1704 3196 1940.tmp 88 PID 3196 wrote to memory of 1704 3196 1940.tmp 88 PID 1704 wrote to memory of 4244 1704 19EC.tmp 89 PID 1704 wrote to memory of 4244 1704 19EC.tmp 89 PID 1704 wrote to memory of 4244 1704 19EC.tmp 89 PID 4244 wrote to memory of 2468 4244 1AE6.tmp 90 PID 4244 wrote to memory of 2468 4244 1AE6.tmp 90 PID 4244 wrote to memory of 2468 4244 1AE6.tmp 90 PID 2468 wrote to memory of 4792 2468 1B72.tmp 91 PID 2468 wrote to memory of 4792 2468 1B72.tmp 91 PID 2468 wrote to memory of 4792 2468 1B72.tmp 91 PID 4792 wrote to memory of 400 4792 1C4D.tmp 92 PID 4792 wrote to memory of 400 4792 1C4D.tmp 92 PID 4792 wrote to memory of 400 4792 1C4D.tmp 92 PID 400 wrote to memory of 956 400 1D47.tmp 93 PID 400 wrote to memory of 956 400 1D47.tmp 93 PID 400 wrote to memory of 956 400 1D47.tmp 93 PID 956 wrote to memory of 4564 956 1E12.tmp 94 PID 956 wrote to memory of 4564 956 1E12.tmp 94 PID 956 wrote to memory of 4564 956 1E12.tmp 94 PID 4564 wrote to memory of 632 4564 1EFD.tmp 95 PID 4564 wrote to memory of 632 4564 1EFD.tmp 95 PID 4564 wrote to memory of 632 4564 1EFD.tmp 95 PID 632 wrote to memory of 3760 632 1FA8.tmp 96 PID 632 wrote to memory of 3760 632 1FA8.tmp 96 PID 632 wrote to memory of 3760 632 1FA8.tmp 96 PID 3760 wrote to memory of 4756 3760 20A2.tmp 97 PID 3760 wrote to memory of 4756 3760 20A2.tmp 97 PID 3760 wrote to memory of 4756 3760 20A2.tmp 97 PID 4756 wrote to memory of 4624 4756 217D.tmp 98 PID 4756 wrote to memory of 4624 4756 217D.tmp 98 PID 4756 wrote to memory of 4624 4756 217D.tmp 98 PID 4624 wrote to memory of 4996 4624 2229.tmp 99 PID 4624 wrote to memory of 4996 4624 2229.tmp 99 PID 4624 wrote to memory of 4996 4624 2229.tmp 99 PID 4996 wrote to memory of 3860 4996 2304.tmp 100 PID 4996 wrote to memory of 3860 4996 2304.tmp 100 PID 4996 wrote to memory of 3860 4996 2304.tmp 100 PID 3860 wrote to memory of 4952 3860 23EE.tmp 101 PID 3860 wrote to memory of 4952 3860 23EE.tmp 101 PID 3860 wrote to memory of 4952 3860 23EE.tmp 101 PID 4952 wrote to memory of 1592 4952 24B9.tmp 102 PID 4952 wrote to memory of 1592 4952 24B9.tmp 102 PID 4952 wrote to memory of 1592 4952 24B9.tmp 102 PID 1592 wrote to memory of 1976 1592 25A4.tmp 103 PID 1592 wrote to memory of 1976 1592 25A4.tmp 103 PID 1592 wrote to memory of 1976 1592 25A4.tmp 103 PID 1976 wrote to memory of 5084 1976 272A.tmp 104 PID 1976 wrote to memory of 5084 1976 272A.tmp 104 PID 1976 wrote to memory of 5084 1976 272A.tmp 104 PID 5084 wrote to memory of 2552 5084 28B1.tmp 105 PID 5084 wrote to memory of 2552 5084 28B1.tmp 105 PID 5084 wrote to memory of 2552 5084 28B1.tmp 105 PID 2552 wrote to memory of 3872 2552 298C.tmp 106 PID 2552 wrote to memory of 3872 2552 298C.tmp 106 PID 2552 wrote to memory of 3872 2552 298C.tmp 106 PID 3872 wrote to memory of 4404 3872 2A47.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a9b2a7d34ff6708dee8dc33bb090b66_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\5a9b2a7d34ff6708dee8dc33bb090b66_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\F9B.tmp"C:\Users\Admin\AppData\Local\Temp\F9B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\1940.tmp"C:\Users\Admin\AppData\Local\Temp\1940.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\19EC.tmp"C:\Users\Admin\AppData\Local\Temp\19EC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\1AE6.tmp"C:\Users\Admin\AppData\Local\Temp\1AE6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\1B72.tmp"C:\Users\Admin\AppData\Local\Temp\1B72.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\1C4D.tmp"C:\Users\Admin\AppData\Local\Temp\1C4D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\1D47.tmp"C:\Users\Admin\AppData\Local\Temp\1D47.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\1E12.tmp"C:\Users\Admin\AppData\Local\Temp\1E12.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\20A2.tmp"C:\Users\Admin\AppData\Local\Temp\20A2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\217D.tmp"C:\Users\Admin\AppData\Local\Temp\217D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\2229.tmp"C:\Users\Admin\AppData\Local\Temp\2229.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\2304.tmp"C:\Users\Admin\AppData\Local\Temp\2304.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\23EE.tmp"C:\Users\Admin\AppData\Local\Temp\23EE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\24B9.tmp"C:\Users\Admin\AppData\Local\Temp\24B9.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\25A4.tmp"C:\Users\Admin\AppData\Local\Temp\25A4.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\272A.tmp"C:\Users\Admin\AppData\Local\Temp\272A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\28B1.tmp"C:\Users\Admin\AppData\Local\Temp\28B1.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\298C.tmp"C:\Users\Admin\AppData\Local\Temp\298C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\2A47.tmp"C:\Users\Admin\AppData\Local\Temp\2A47.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\2B32.tmp"C:\Users\Admin\AppData\Local\Temp\2B32.tmp"23⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\2C1C.tmp"C:\Users\Admin\AppData\Local\Temp\2C1C.tmp"24⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"25⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\2D93.tmp"C:\Users\Admin\AppData\Local\Temp\2D93.tmp"26⤵
- Executes dropped EXE
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\2E3F.tmp"C:\Users\Admin\AppData\Local\Temp\2E3F.tmp"27⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\2EEB.tmp"C:\Users\Admin\AppData\Local\Temp\2EEB.tmp"28⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\314C.tmp"C:\Users\Admin\AppData\Local\Temp\314C.tmp"29⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\364D.tmp"C:\Users\Admin\AppData\Local\Temp\364D.tmp"30⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\3832.tmp"C:\Users\Admin\AppData\Local\Temp\3832.tmp"31⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\39E7.tmp"C:\Users\Admin\AppData\Local\Temp\39E7.tmp"32⤵
- Executes dropped EXE
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\3AC2.tmp"C:\Users\Admin\AppData\Local\Temp\3AC2.tmp"33⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\3CC6.tmp"C:\Users\Admin\AppData\Local\Temp\3CC6.tmp"34⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\3E4C.tmp"C:\Users\Admin\AppData\Local\Temp\3E4C.tmp"35⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\4002.tmp"C:\Users\Admin\AppData\Local\Temp\4002.tmp"36⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\409E.tmp"C:\Users\Admin\AppData\Local\Temp\409E.tmp"37⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\412B.tmp"C:\Users\Admin\AppData\Local\Temp\412B.tmp"38⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\42D0.tmp"C:\Users\Admin\AppData\Local\Temp\42D0.tmp"39⤵
- Executes dropped EXE
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\433E.tmp"C:\Users\Admin\AppData\Local\Temp\433E.tmp"40⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\4428.tmp"C:\Users\Admin\AppData\Local\Temp\4428.tmp"41⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\44E4.tmp"C:\Users\Admin\AppData\Local\Temp\44E4.tmp"42⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\4551.tmp"C:\Users\Admin\AppData\Local\Temp\4551.tmp"43⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\45BE.tmp"C:\Users\Admin\AppData\Local\Temp\45BE.tmp"44⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\464B.tmp"C:\Users\Admin\AppData\Local\Temp\464B.tmp"45⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\4707.tmp"C:\Users\Admin\AppData\Local\Temp\4707.tmp"46⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\47F1.tmp"C:\Users\Admin\AppData\Local\Temp\47F1.tmp"47⤵
- Executes dropped EXE
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\489D.tmp"C:\Users\Admin\AppData\Local\Temp\489D.tmp"48⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\4968.tmp"C:\Users\Admin\AppData\Local\Temp\4968.tmp"49⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\49E5.tmp"C:\Users\Admin\AppData\Local\Temp\49E5.tmp"50⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\4AEF.tmp"C:\Users\Admin\AppData\Local\Temp\4AEF.tmp"51⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\4B5C.tmp"C:\Users\Admin\AppData\Local\Temp\4B5C.tmp"52⤵
- Executes dropped EXE
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\4C27.tmp"C:\Users\Admin\AppData\Local\Temp\4C27.tmp"53⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\4C94.tmp"C:\Users\Admin\AppData\Local\Temp\4C94.tmp"54⤵
- Executes dropped EXE
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\4DAE.tmp"C:\Users\Admin\AppData\Local\Temp\4DAE.tmp"55⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\4E4A.tmp"C:\Users\Admin\AppData\Local\Temp\4E4A.tmp"56⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\4ED7.tmp"C:\Users\Admin\AppData\Local\Temp\4ED7.tmp"57⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\4F54.tmp"C:\Users\Admin\AppData\Local\Temp\4F54.tmp"58⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\50CB.tmp"C:\Users\Admin\AppData\Local\Temp\50CB.tmp"59⤵
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\5148.tmp"C:\Users\Admin\AppData\Local\Temp\5148.tmp"60⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\51D4.tmp"C:\Users\Admin\AppData\Local\Temp\51D4.tmp"61⤵
- Executes dropped EXE
PID:692 -
C:\Users\Admin\AppData\Local\Temp\5261.tmp"C:\Users\Admin\AppData\Local\Temp\5261.tmp"62⤵
- Executes dropped EXE
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\52DE.tmp"C:\Users\Admin\AppData\Local\Temp\52DE.tmp"63⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\53C8.tmp"C:\Users\Admin\AppData\Local\Temp\53C8.tmp"64⤵
- Executes dropped EXE
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\5455.tmp"C:\Users\Admin\AppData\Local\Temp\5455.tmp"65⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\54C2.tmp"C:\Users\Admin\AppData\Local\Temp\54C2.tmp"66⤵
- Executes dropped EXE
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\553F.tmp"C:\Users\Admin\AppData\Local\Temp\553F.tmp"67⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\55AD.tmp"C:\Users\Admin\AppData\Local\Temp\55AD.tmp"68⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\5639.tmp"C:\Users\Admin\AppData\Local\Temp\5639.tmp"69⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\5791.tmp"C:\Users\Admin\AppData\Local\Temp\5791.tmp"70⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\57FE.tmp"C:\Users\Admin\AppData\Local\Temp\57FE.tmp"71⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\586C.tmp"C:\Users\Admin\AppData\Local\Temp\586C.tmp"72⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\58D9.tmp"C:\Users\Admin\AppData\Local\Temp\58D9.tmp"73⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\59A4.tmp"C:\Users\Admin\AppData\Local\Temp\59A4.tmp"74⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\5A12.tmp"C:\Users\Admin\AppData\Local\Temp\5A12.tmp"75⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\5ABD.tmp"C:\Users\Admin\AppData\Local\Temp\5ABD.tmp"76⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\5B5A.tmp"C:\Users\Admin\AppData\Local\Temp\5B5A.tmp"77⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\5BC7.tmp"C:\Users\Admin\AppData\Local\Temp\5BC7.tmp"78⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\5C83.tmp"C:\Users\Admin\AppData\Local\Temp\5C83.tmp"79⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\5D00.tmp"C:\Users\Admin\AppData\Local\Temp\5D00.tmp"80⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\5D7D.tmp"C:\Users\Admin\AppData\Local\Temp\5D7D.tmp"81⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\5E19.tmp"C:\Users\Admin\AppData\Local\Temp\5E19.tmp"82⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\5E86.tmp"C:\Users\Admin\AppData\Local\Temp\5E86.tmp"83⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\5F03.tmp"C:\Users\Admin\AppData\Local\Temp\5F03.tmp"84⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\5F80.tmp"C:\Users\Admin\AppData\Local\Temp\5F80.tmp"85⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\600D.tmp"C:\Users\Admin\AppData\Local\Temp\600D.tmp"86⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\608A.tmp"C:\Users\Admin\AppData\Local\Temp\608A.tmp"87⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\6116.tmp"C:\Users\Admin\AppData\Local\Temp\6116.tmp"88⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\61D2.tmp"C:\Users\Admin\AppData\Local\Temp\61D2.tmp"89⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\626E.tmp"C:\Users\Admin\AppData\Local\Temp\626E.tmp"90⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\62EB.tmp"C:\Users\Admin\AppData\Local\Temp\62EB.tmp"91⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\6387.tmp"C:\Users\Admin\AppData\Local\Temp\6387.tmp"92⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\63F5.tmp"C:\Users\Admin\AppData\Local\Temp\63F5.tmp"93⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\64FE.tmp"C:\Users\Admin\AppData\Local\Temp\64FE.tmp"94⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\657B.tmp"C:\Users\Admin\AppData\Local\Temp\657B.tmp"95⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\6675.tmp"C:\Users\Admin\AppData\Local\Temp\6675.tmp"96⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\6702.tmp"C:\Users\Admin\AppData\Local\Temp\6702.tmp"97⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\679E.tmp"C:\Users\Admin\AppData\Local\Temp\679E.tmp"98⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\682B.tmp"C:\Users\Admin\AppData\Local\Temp\682B.tmp"99⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\68A8.tmp"C:\Users\Admin\AppData\Local\Temp\68A8.tmp"100⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\6925.tmp"C:\Users\Admin\AppData\Local\Temp\6925.tmp"101⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\69D1.tmp"C:\Users\Admin\AppData\Local\Temp\69D1.tmp"102⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\6A6D.tmp"C:\Users\Admin\AppData\Local\Temp\6A6D.tmp"103⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\6AFA.tmp"C:\Users\Admin\AppData\Local\Temp\6AFA.tmp"104⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\6B86.tmp"C:\Users\Admin\AppData\Local\Temp\6B86.tmp"105⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\6C13.tmp"C:\Users\Admin\AppData\Local\Temp\6C13.tmp"106⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\6CA0.tmp"C:\Users\Admin\AppData\Local\Temp\6CA0.tmp"107⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\6D0D.tmp"C:\Users\Admin\AppData\Local\Temp\6D0D.tmp"108⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\6D7A.tmp"C:\Users\Admin\AppData\Local\Temp\6D7A.tmp"109⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\6DF7.tmp"C:\Users\Admin\AppData\Local\Temp\6DF7.tmp"110⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\6E65.tmp"C:\Users\Admin\AppData\Local\Temp\6E65.tmp"111⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\6EE2.tmp"C:\Users\Admin\AppData\Local\Temp\6EE2.tmp"112⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\6F4F.tmp"C:\Users\Admin\AppData\Local\Temp\6F4F.tmp"113⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\6FEB.tmp"C:\Users\Admin\AppData\Local\Temp\6FEB.tmp"114⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\7068.tmp"C:\Users\Admin\AppData\Local\Temp\7068.tmp"115⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\70F5.tmp"C:\Users\Admin\AppData\Local\Temp\70F5.tmp"116⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\7172.tmp"C:\Users\Admin\AppData\Local\Temp\7172.tmp"117⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\71DF.tmp"C:\Users\Admin\AppData\Local\Temp\71DF.tmp"118⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\725C.tmp"C:\Users\Admin\AppData\Local\Temp\725C.tmp"119⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\72E9.tmp"C:\Users\Admin\AppData\Local\Temp\72E9.tmp"120⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\7356.tmp"C:\Users\Admin\AppData\Local\Temp\7356.tmp"121⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\73D3.tmp"C:\Users\Admin\AppData\Local\Temp\73D3.tmp"122⤵PID:4440
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-