Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
05-08-2023 14:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7532ccfb08d4785163d62e93e1aaf125_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
7532ccfb08d4785163d62e93e1aaf125_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
7532ccfb08d4785163d62e93e1aaf125_mafia_JC.exe
-
Size
486KB
-
MD5
7532ccfb08d4785163d62e93e1aaf125
-
SHA1
4b0046982a573a8ee7f0188e5341a15487b1d416
-
SHA256
c79248cedc0d46e27368b124f603aa261df03b3bc3998966336bcdd538186743
-
SHA512
e41c219b411ba56e17df00362e8e414dba4aababcc5154728cd7dfc19b4fbb200e77d1832f5f4bc45ccc648e7ab6374c991b380592e830996f38b15961223537
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7dlSJ5f9pE8tTHvBHbeOiEdvwgTOkzzMJTWq4:/U5rCOTeiDQ99pEgHvBKO5VtMJyNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4240 5F66.tmp 2560 6012.tmp 2244 60EC.tmp 4192 61E6.tmp 2428 6457.tmp 1212 6532.tmp 400 65CE.tmp 1920 666B.tmp 1392 6716.tmp 2680 6987.tmp 2236 6A81.tmp 2988 6B6C.tmp 2060 6C27.tmp 4816 6DDD.tmp 1112 6EC7.tmp 3700 6FD1.tmp 5056 70BB.tmp 4564 7167.tmp 4976 71D4.tmp 4736 7290.tmp 3236 737A.tmp 1480 7455.tmp 5036 74F1.tmp 656 758E.tmp 1640 761A.tmp 2792 76B6.tmp 3692 77D0.tmp 3424 7966.tmp 408 7A31.tmp 880 7AED.tmp 4448 7BF6.tmp 1532 7CF0.tmp 2168 7DFA.tmp 416 7E96.tmp 3684 7F23.tmp 552 7FBF.tmp 5024 803C.tmp 4252 80B9.tmp 3004 8155.tmp 1164 81F1.tmp 468 829D.tmp 4920 8397.tmp 1780 8443.tmp 3440 84DF.tmp 2904 856C.tmp 1804 8608.tmp 5044 8685.tmp 4968 8712.tmp 5016 87AE.tmp 3908 881C.tmp 1344 88B8.tmp 4324 8944.tmp 2728 89B2.tmp 1408 8A5E.tmp 2952 8AFA.tmp 2752 8B87.tmp 4320 8BE4.tmp 3820 8C52.tmp 5048 8CBF.tmp 4848 8D5B.tmp 2556 8E36.tmp 3480 8ED2.tmp 4916 8F5F.tmp 2596 8FFB.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4936 wrote to memory of 4240 4936 7532ccfb08d4785163d62e93e1aaf125_mafia_JC.exe 82 PID 4936 wrote to memory of 4240 4936 7532ccfb08d4785163d62e93e1aaf125_mafia_JC.exe 82 PID 4936 wrote to memory of 4240 4936 7532ccfb08d4785163d62e93e1aaf125_mafia_JC.exe 82 PID 4240 wrote to memory of 2560 4240 5F66.tmp 83 PID 4240 wrote to memory of 2560 4240 5F66.tmp 83 PID 4240 wrote to memory of 2560 4240 5F66.tmp 83 PID 2560 wrote to memory of 2244 2560 6012.tmp 84 PID 2560 wrote to memory of 2244 2560 6012.tmp 84 PID 2560 wrote to memory of 2244 2560 6012.tmp 84 PID 2244 wrote to memory of 4192 2244 60EC.tmp 85 PID 2244 wrote to memory of 4192 2244 60EC.tmp 85 PID 2244 wrote to memory of 4192 2244 60EC.tmp 85 PID 4192 wrote to memory of 2428 4192 61E6.tmp 86 PID 4192 wrote to memory of 2428 4192 61E6.tmp 86 PID 4192 wrote to memory of 2428 4192 61E6.tmp 86 PID 2428 wrote to memory of 1212 2428 6457.tmp 87 PID 2428 wrote to memory of 1212 2428 6457.tmp 87 PID 2428 wrote to memory of 1212 2428 6457.tmp 87 PID 1212 wrote to memory of 400 1212 6532.tmp 88 PID 1212 wrote to memory of 400 1212 6532.tmp 88 PID 1212 wrote to memory of 400 1212 6532.tmp 88 PID 400 wrote to memory of 1920 400 65CE.tmp 89 PID 400 wrote to memory of 1920 400 65CE.tmp 89 PID 400 wrote to memory of 1920 400 65CE.tmp 89 PID 1920 wrote to memory of 1392 1920 666B.tmp 90 PID 1920 wrote to memory of 1392 1920 666B.tmp 90 PID 1920 wrote to memory of 1392 1920 666B.tmp 90 PID 1392 wrote to memory of 2680 1392 6716.tmp 91 PID 1392 wrote to memory of 2680 1392 6716.tmp 91 PID 1392 wrote to memory of 2680 1392 6716.tmp 91 PID 2680 wrote to memory of 2236 2680 6987.tmp 92 PID 2680 wrote to memory of 2236 2680 6987.tmp 92 PID 2680 wrote to memory of 2236 2680 6987.tmp 92 PID 2236 wrote to memory of 2988 2236 6A81.tmp 93 PID 2236 wrote to memory of 2988 2236 6A81.tmp 93 PID 2236 wrote to memory of 2988 2236 6A81.tmp 93 PID 2988 wrote to memory of 2060 2988 6B6C.tmp 94 PID 2988 wrote to memory of 2060 2988 6B6C.tmp 94 PID 2988 wrote to memory of 2060 2988 6B6C.tmp 94 PID 2060 wrote to memory of 4816 2060 6C27.tmp 97 PID 2060 wrote to memory of 4816 2060 6C27.tmp 97 PID 2060 wrote to memory of 4816 2060 6C27.tmp 97 PID 4816 wrote to memory of 1112 4816 6DDD.tmp 98 PID 4816 wrote to memory of 1112 4816 6DDD.tmp 98 PID 4816 wrote to memory of 1112 4816 6DDD.tmp 98 PID 1112 wrote to memory of 3700 1112 6EC7.tmp 99 PID 1112 wrote to memory of 3700 1112 6EC7.tmp 99 PID 1112 wrote to memory of 3700 1112 6EC7.tmp 99 PID 3700 wrote to memory of 5056 3700 6FD1.tmp 100 PID 3700 wrote to memory of 5056 3700 6FD1.tmp 100 PID 3700 wrote to memory of 5056 3700 6FD1.tmp 100 PID 5056 wrote to memory of 4564 5056 70BB.tmp 101 PID 5056 wrote to memory of 4564 5056 70BB.tmp 101 PID 5056 wrote to memory of 4564 5056 70BB.tmp 101 PID 4564 wrote to memory of 4976 4564 7167.tmp 102 PID 4564 wrote to memory of 4976 4564 7167.tmp 102 PID 4564 wrote to memory of 4976 4564 7167.tmp 102 PID 4976 wrote to memory of 4736 4976 71D4.tmp 104 PID 4976 wrote to memory of 4736 4976 71D4.tmp 104 PID 4976 wrote to memory of 4736 4976 71D4.tmp 104 PID 4736 wrote to memory of 3236 4736 7290.tmp 105 PID 4736 wrote to memory of 3236 4736 7290.tmp 105 PID 4736 wrote to memory of 3236 4736 7290.tmp 105 PID 3236 wrote to memory of 1480 3236 737A.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\7532ccfb08d4785163d62e93e1aaf125_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\7532ccfb08d4785163d62e93e1aaf125_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\7290.tmp"C:\Users\Admin\AppData\Local\Temp\7290.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"23⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\74F1.tmp"C:\Users\Admin\AppData\Local\Temp\74F1.tmp"24⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"25⤵
- Executes dropped EXE
PID:656 -
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"26⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"27⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"28⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\7966.tmp"C:\Users\Admin\AppData\Local\Temp\7966.tmp"29⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"30⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\7AED.tmp"C:\Users\Admin\AppData\Local\Temp\7AED.tmp"31⤵
- Executes dropped EXE
PID:880 -
C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"32⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"33⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"34⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\7E96.tmp"C:\Users\Admin\AppData\Local\Temp\7E96.tmp"35⤵
- Executes dropped EXE
PID:416 -
C:\Users\Admin\AppData\Local\Temp\7F23.tmp"C:\Users\Admin\AppData\Local\Temp\7F23.tmp"36⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"37⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\803C.tmp"C:\Users\Admin\AppData\Local\Temp\803C.tmp"38⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\80B9.tmp"C:\Users\Admin\AppData\Local\Temp\80B9.tmp"39⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\8155.tmp"C:\Users\Admin\AppData\Local\Temp\8155.tmp"40⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\81F1.tmp"C:\Users\Admin\AppData\Local\Temp\81F1.tmp"41⤵
- Executes dropped EXE
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\829D.tmp"C:\Users\Admin\AppData\Local\Temp\829D.tmp"42⤵
- Executes dropped EXE
PID:468 -
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"43⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"44⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\84DF.tmp"C:\Users\Admin\AppData\Local\Temp\84DF.tmp"45⤵
- Executes dropped EXE
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\856C.tmp"C:\Users\Admin\AppData\Local\Temp\856C.tmp"46⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\8608.tmp"C:\Users\Admin\AppData\Local\Temp\8608.tmp"47⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\8685.tmp"C:\Users\Admin\AppData\Local\Temp\8685.tmp"48⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\8712.tmp"C:\Users\Admin\AppData\Local\Temp\8712.tmp"49⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\87AE.tmp"C:\Users\Admin\AppData\Local\Temp\87AE.tmp"50⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\881C.tmp"C:\Users\Admin\AppData\Local\Temp\881C.tmp"51⤵
- Executes dropped EXE
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\88B8.tmp"C:\Users\Admin\AppData\Local\Temp\88B8.tmp"52⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"53⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\89B2.tmp"C:\Users\Admin\AppData\Local\Temp\89B2.tmp"54⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"55⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"56⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\8B87.tmp"C:\Users\Admin\AppData\Local\Temp\8B87.tmp"57⤵
- Executes dropped EXE
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"58⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"59⤵
- Executes dropped EXE
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"60⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"61⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp"62⤵
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"63⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"64⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"65⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"66⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"67⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\91E0.tmp"C:\Users\Admin\AppData\Local\Temp\91E0.tmp"68⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"69⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\9308.tmp"C:\Users\Admin\AppData\Local\Temp\9308.tmp"70⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\93A5.tmp"C:\Users\Admin\AppData\Local\Temp\93A5.tmp"71⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\9441.tmp"C:\Users\Admin\AppData\Local\Temp\9441.tmp"72⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\94AE.tmp"C:\Users\Admin\AppData\Local\Temp\94AE.tmp"73⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"74⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\9599.tmp"C:\Users\Admin\AppData\Local\Temp\9599.tmp"75⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"76⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\96E1.tmp"C:\Users\Admin\AppData\Local\Temp\96E1.tmp"77⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"78⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"79⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"80⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\98C5.tmp"C:\Users\Admin\AppData\Local\Temp\98C5.tmp"81⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"82⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"83⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"84⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"85⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"86⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"87⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"88⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"89⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\9D69.tmp"C:\Users\Admin\AppData\Local\Temp\9D69.tmp"90⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"91⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\9E72.tmp"C:\Users\Admin\AppData\Local\Temp\9E72.tmp"92⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"93⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"94⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\A028.tmp"C:\Users\Admin\AppData\Local\Temp\A028.tmp"95⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"96⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"97⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\A19F.tmp"C:\Users\Admin\AppData\Local\Temp\A19F.tmp"98⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\A20C.tmp"C:\Users\Admin\AppData\Local\Temp\A20C.tmp"99⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"100⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"101⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\A410.tmp"C:\Users\Admin\AppData\Local\Temp\A410.tmp"102⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"103⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"104⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"105⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"106⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"107⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"108⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\A884.tmp"C:\Users\Admin\AppData\Local\Temp\A884.tmp"109⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\A911.tmp"C:\Users\Admin\AppData\Local\Temp\A911.tmp"110⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"111⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"112⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"113⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"114⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"115⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"116⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"117⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\AD38.tmp"C:\Users\Admin\AppData\Local\Temp\AD38.tmp"118⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"119⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"120⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"121⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"122⤵PID:884
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-