Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
08/08/2023, 16:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9ad1c398e7a19f6c09f76bdf229185c1_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
9ad1c398e7a19f6c09f76bdf229185c1_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
9ad1c398e7a19f6c09f76bdf229185c1_mafia_JC.exe
-
Size
486KB
-
MD5
9ad1c398e7a19f6c09f76bdf229185c1
-
SHA1
a2acbee8930e7a8cac8e12bad2e3e912dbb4506b
-
SHA256
2d0e3e854cc6bdd43de1a1f3d8eaa9a15ba31fff87594501e636e5a0827b82fd
-
SHA512
bac1c0f436da40824025d71894e01cb1b6d2d7f18a0c37e12178311090223475f7615b4be83e8e3c5ac69d5ee79d1d8208805d25ad009bce838b04dae4ddf4bf
-
SSDEEP
12288:UU5rCOTeiDfpKUm25HWeb/KbB2x15+tNZ:UUQOJDfMVPBm1gtN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4812 E60A.tmp 5096 E697.tmp 2408 E762.tmp 4328 E84D.tmp 4904 E8E9.tmp 3812 E9B4.tmp 2052 EA9E.tmp 3284 EB4A.tmp 3760 EC44.tmp 1352 ECE0.tmp 2928 ED7D.tmp 2224 EE19.tmp 264 EEB5.tmp 1508 F02C.tmp 680 F0B9.tmp 2892 F1A3.tmp 4224 F23F.tmp 1760 F2FB.tmp 5000 F3B6.tmp 4668 F4DF.tmp 4400 F58B.tmp 3136 F627.tmp 4736 F6D3.tmp 928 F77F.tmp 5080 F86A.tmp 4128 F944.tmp 4844 FA1F.tmp 3868 FB09.tmp 888 FBD5.tmp 1868 FC61.tmp 3372 FCFD.tmp 384 FDC9.tmp 3952 FE84.tmp 3644 FF01.tmp 5040 FFAD.tmp 1952 59.tmp 1808 114.tmp 4324 1A1.tmp 2736 24D.tmp 4752 2CA.tmp 1520 347.tmp 4688 3F3.tmp 1704 47F.tmp 2624 579.tmp 4684 616.tmp 1148 6B2.tmp 1676 71F.tmp 4856 7AC.tmp 1480 838.tmp 3332 8D5.tmp 2124 961.tmp 4272 9DE.tmp 2364 A7B.tmp 452 AF8.tmp 4352 B75.tmp 1768 BF2.tmp 1644 C7E.tmp 744 D1A.tmp 3492 DC6.tmp 1856 E63.tmp 1800 EFF.tmp 3608 FBA.tmp 3284 1047.tmp 4512 10E3.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4944 wrote to memory of 4812 4944 9ad1c398e7a19f6c09f76bdf229185c1_mafia_JC.exe 81 PID 4944 wrote to memory of 4812 4944 9ad1c398e7a19f6c09f76bdf229185c1_mafia_JC.exe 81 PID 4944 wrote to memory of 4812 4944 9ad1c398e7a19f6c09f76bdf229185c1_mafia_JC.exe 81 PID 4812 wrote to memory of 5096 4812 E60A.tmp 82 PID 4812 wrote to memory of 5096 4812 E60A.tmp 82 PID 4812 wrote to memory of 5096 4812 E60A.tmp 82 PID 5096 wrote to memory of 2408 5096 E697.tmp 83 PID 5096 wrote to memory of 2408 5096 E697.tmp 83 PID 5096 wrote to memory of 2408 5096 E697.tmp 83 PID 2408 wrote to memory of 4328 2408 E762.tmp 84 PID 2408 wrote to memory of 4328 2408 E762.tmp 84 PID 2408 wrote to memory of 4328 2408 E762.tmp 84 PID 4328 wrote to memory of 4904 4328 E84D.tmp 85 PID 4328 wrote to memory of 4904 4328 E84D.tmp 85 PID 4328 wrote to memory of 4904 4328 E84D.tmp 85 PID 4904 wrote to memory of 3812 4904 E8E9.tmp 86 PID 4904 wrote to memory of 3812 4904 E8E9.tmp 86 PID 4904 wrote to memory of 3812 4904 E8E9.tmp 86 PID 3812 wrote to memory of 2052 3812 E9B4.tmp 87 PID 3812 wrote to memory of 2052 3812 E9B4.tmp 87 PID 3812 wrote to memory of 2052 3812 E9B4.tmp 87 PID 2052 wrote to memory of 3284 2052 EA9E.tmp 88 PID 2052 wrote to memory of 3284 2052 EA9E.tmp 88 PID 2052 wrote to memory of 3284 2052 EA9E.tmp 88 PID 3284 wrote to memory of 3760 3284 EB4A.tmp 89 PID 3284 wrote to memory of 3760 3284 EB4A.tmp 89 PID 3284 wrote to memory of 3760 3284 EB4A.tmp 89 PID 3760 wrote to memory of 1352 3760 EC44.tmp 91 PID 3760 wrote to memory of 1352 3760 EC44.tmp 91 PID 3760 wrote to memory of 1352 3760 EC44.tmp 91 PID 1352 wrote to memory of 2928 1352 ECE0.tmp 92 PID 1352 wrote to memory of 2928 1352 ECE0.tmp 92 PID 1352 wrote to memory of 2928 1352 ECE0.tmp 92 PID 2928 wrote to memory of 2224 2928 ED7D.tmp 93 PID 2928 wrote to memory of 2224 2928 ED7D.tmp 93 PID 2928 wrote to memory of 2224 2928 ED7D.tmp 93 PID 2224 wrote to memory of 264 2224 EE19.tmp 94 PID 2224 wrote to memory of 264 2224 EE19.tmp 94 PID 2224 wrote to memory of 264 2224 EE19.tmp 94 PID 264 wrote to memory of 1508 264 EEB5.tmp 95 PID 264 wrote to memory of 1508 264 EEB5.tmp 95 PID 264 wrote to memory of 1508 264 EEB5.tmp 95 PID 1508 wrote to memory of 680 1508 F02C.tmp 96 PID 1508 wrote to memory of 680 1508 F02C.tmp 96 PID 1508 wrote to memory of 680 1508 F02C.tmp 96 PID 680 wrote to memory of 2892 680 F0B9.tmp 97 PID 680 wrote to memory of 2892 680 F0B9.tmp 97 PID 680 wrote to memory of 2892 680 F0B9.tmp 97 PID 2892 wrote to memory of 4224 2892 F1A3.tmp 98 PID 2892 wrote to memory of 4224 2892 F1A3.tmp 98 PID 2892 wrote to memory of 4224 2892 F1A3.tmp 98 PID 4224 wrote to memory of 1760 4224 F23F.tmp 99 PID 4224 wrote to memory of 1760 4224 F23F.tmp 99 PID 4224 wrote to memory of 1760 4224 F23F.tmp 99 PID 1760 wrote to memory of 5000 1760 F2FB.tmp 100 PID 1760 wrote to memory of 5000 1760 F2FB.tmp 100 PID 1760 wrote to memory of 5000 1760 F2FB.tmp 100 PID 5000 wrote to memory of 4668 5000 F3B6.tmp 101 PID 5000 wrote to memory of 4668 5000 F3B6.tmp 101 PID 5000 wrote to memory of 4668 5000 F3B6.tmp 101 PID 4668 wrote to memory of 4400 4668 F4DF.tmp 102 PID 4668 wrote to memory of 4400 4668 F4DF.tmp 102 PID 4668 wrote to memory of 4400 4668 F4DF.tmp 102 PID 4400 wrote to memory of 3136 4400 F58B.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ad1c398e7a19f6c09f76bdf229185c1_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\9ad1c398e7a19f6c09f76bdf229185c1_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\E60A.tmp"C:\Users\Admin\AppData\Local\Temp\E60A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\E697.tmp"C:\Users\Admin\AppData\Local\Temp\E697.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\E762.tmp"C:\Users\Admin\AppData\Local\Temp\E762.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\E84D.tmp"C:\Users\Admin\AppData\Local\Temp\E84D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\EA9E.tmp"C:\Users\Admin\AppData\Local\Temp\EA9E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\EB4A.tmp"C:\Users\Admin\AppData\Local\Temp\EB4A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\EC44.tmp"C:\Users\Admin\AppData\Local\Temp\EC44.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\ECE0.tmp"C:\Users\Admin\AppData\Local\Temp\ECE0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\ED7D.tmp"C:\Users\Admin\AppData\Local\Temp\ED7D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\EE19.tmp"C:\Users\Admin\AppData\Local\Temp\EE19.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Users\Admin\AppData\Local\Temp\F02C.tmp"C:\Users\Admin\AppData\Local\Temp\F02C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\F0B9.tmp"C:\Users\Admin\AppData\Local\Temp\F0B9.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\F1A3.tmp"C:\Users\Admin\AppData\Local\Temp\F1A3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\F23F.tmp"C:\Users\Admin\AppData\Local\Temp\F23F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\F2FB.tmp"C:\Users\Admin\AppData\Local\Temp\F2FB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\F4DF.tmp"C:\Users\Admin\AppData\Local\Temp\F4DF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\F58B.tmp"C:\Users\Admin\AppData\Local\Temp\F58B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\F627.tmp"C:\Users\Admin\AppData\Local\Temp\F627.tmp"23⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"24⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\F77F.tmp"C:\Users\Admin\AppData\Local\Temp\F77F.tmp"25⤵
- Executes dropped EXE
PID:928 -
C:\Users\Admin\AppData\Local\Temp\F86A.tmp"C:\Users\Admin\AppData\Local\Temp\F86A.tmp"26⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\F944.tmp"C:\Users\Admin\AppData\Local\Temp\F944.tmp"27⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\FA1F.tmp"C:\Users\Admin\AppData\Local\Temp\FA1F.tmp"28⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\FB09.tmp"C:\Users\Admin\AppData\Local\Temp\FB09.tmp"29⤵
- Executes dropped EXE
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"30⤵
- Executes dropped EXE
PID:888 -
C:\Users\Admin\AppData\Local\Temp\FC61.tmp"C:\Users\Admin\AppData\Local\Temp\FC61.tmp"31⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\FCFD.tmp"C:\Users\Admin\AppData\Local\Temp\FCFD.tmp"32⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"33⤵
- Executes dropped EXE
PID:384 -
C:\Users\Admin\AppData\Local\Temp\FE84.tmp"C:\Users\Admin\AppData\Local\Temp\FE84.tmp"34⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\FF01.tmp"C:\Users\Admin\AppData\Local\Temp\FF01.tmp"35⤵
- Executes dropped EXE
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"36⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\59.tmp"C:\Users\Admin\AppData\Local\Temp\59.tmp"37⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\114.tmp"C:\Users\Admin\AppData\Local\Temp\114.tmp"38⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\1A1.tmp"C:\Users\Admin\AppData\Local\Temp\1A1.tmp"39⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\24D.tmp"C:\Users\Admin\AppData\Local\Temp\24D.tmp"40⤵
- Executes dropped EXE
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\2CA.tmp"C:\Users\Admin\AppData\Local\Temp\2CA.tmp"41⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\347.tmp"C:\Users\Admin\AppData\Local\Temp\347.tmp"42⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\3F3.tmp"C:\Users\Admin\AppData\Local\Temp\3F3.tmp"43⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\47F.tmp"C:\Users\Admin\AppData\Local\Temp\47F.tmp"44⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\579.tmp"C:\Users\Admin\AppData\Local\Temp\579.tmp"45⤵
- Executes dropped EXE
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\616.tmp"C:\Users\Admin\AppData\Local\Temp\616.tmp"46⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\6B2.tmp"C:\Users\Admin\AppData\Local\Temp\6B2.tmp"47⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\71F.tmp"C:\Users\Admin\AppData\Local\Temp\71F.tmp"48⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\7AC.tmp"C:\Users\Admin\AppData\Local\Temp\7AC.tmp"49⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\838.tmp"C:\Users\Admin\AppData\Local\Temp\838.tmp"50⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\8D5.tmp"C:\Users\Admin\AppData\Local\Temp\8D5.tmp"51⤵
- Executes dropped EXE
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\961.tmp"C:\Users\Admin\AppData\Local\Temp\961.tmp"52⤵
- Executes dropped EXE
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\9DE.tmp"C:\Users\Admin\AppData\Local\Temp\9DE.tmp"53⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\A7B.tmp"C:\Users\Admin\AppData\Local\Temp\A7B.tmp"54⤵
- Executes dropped EXE
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\AF8.tmp"C:\Users\Admin\AppData\Local\Temp\AF8.tmp"55⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\B75.tmp"C:\Users\Admin\AppData\Local\Temp\B75.tmp"56⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"57⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\C7E.tmp"C:\Users\Admin\AppData\Local\Temp\C7E.tmp"58⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\D1A.tmp"C:\Users\Admin\AppData\Local\Temp\D1A.tmp"59⤵
- Executes dropped EXE
PID:744 -
C:\Users\Admin\AppData\Local\Temp\DC6.tmp"C:\Users\Admin\AppData\Local\Temp\DC6.tmp"60⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\E63.tmp"C:\Users\Admin\AppData\Local\Temp\E63.tmp"61⤵
- Executes dropped EXE
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\EFF.tmp"C:\Users\Admin\AppData\Local\Temp\EFF.tmp"62⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"63⤵
- Executes dropped EXE
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\1047.tmp"C:\Users\Admin\AppData\Local\Temp\1047.tmp"64⤵
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\10E3.tmp"C:\Users\Admin\AppData\Local\Temp\10E3.tmp"65⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\1170.tmp"C:\Users\Admin\AppData\Local\Temp\1170.tmp"66⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\11FC.tmp"C:\Users\Admin\AppData\Local\Temp\11FC.tmp"67⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\126A.tmp"C:\Users\Admin\AppData\Local\Temp\126A.tmp"68⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\12E7.tmp"C:\Users\Admin\AppData\Local\Temp\12E7.tmp"69⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\1373.tmp"C:\Users\Admin\AppData\Local\Temp\1373.tmp"70⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\1410.tmp"C:\Users\Admin\AppData\Local\Temp\1410.tmp"71⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\149C.tmp"C:\Users\Admin\AppData\Local\Temp\149C.tmp"72⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\1519.tmp"C:\Users\Admin\AppData\Local\Temp\1519.tmp"73⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\1577.tmp"C:\Users\Admin\AppData\Local\Temp\1577.tmp"74⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\15E4.tmp"C:\Users\Admin\AppData\Local\Temp\15E4.tmp"75⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\1671.tmp"C:\Users\Admin\AppData\Local\Temp\1671.tmp"76⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\170D.tmp"C:\Users\Admin\AppData\Local\Temp\170D.tmp"77⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\177B.tmp"C:\Users\Admin\AppData\Local\Temp\177B.tmp"78⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\1817.tmp"C:\Users\Admin\AppData\Local\Temp\1817.tmp"79⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\18A4.tmp"C:\Users\Admin\AppData\Local\Temp\18A4.tmp"80⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\1940.tmp"C:\Users\Admin\AppData\Local\Temp\1940.tmp"81⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\19AD.tmp"C:\Users\Admin\AppData\Local\Temp\19AD.tmp"82⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\1A3A.tmp"C:\Users\Admin\AppData\Local\Temp\1A3A.tmp"83⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\1A98.tmp"C:\Users\Admin\AppData\Local\Temp\1A98.tmp"84⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\1B24.tmp"C:\Users\Admin\AppData\Local\Temp\1B24.tmp"85⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"86⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\1C2E.tmp"C:\Users\Admin\AppData\Local\Temp\1C2E.tmp"87⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"88⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\1D66.tmp"C:\Users\Admin\AppData\Local\Temp\1D66.tmp"89⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\1DF3.tmp"C:\Users\Admin\AppData\Local\Temp\1DF3.tmp"90⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\1E51.tmp"C:\Users\Admin\AppData\Local\Temp\1E51.tmp"91⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\1ECE.tmp"C:\Users\Admin\AppData\Local\Temp\1ECE.tmp"92⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"93⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\1FC8.tmp"C:\Users\Admin\AppData\Local\Temp\1FC8.tmp"94⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\2035.tmp"C:\Users\Admin\AppData\Local\Temp\2035.tmp"95⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\20A2.tmp"C:\Users\Admin\AppData\Local\Temp\20A2.tmp"96⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\2110.tmp"C:\Users\Admin\AppData\Local\Temp\2110.tmp"97⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\219C.tmp"C:\Users\Admin\AppData\Local\Temp\219C.tmp"98⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\2239.tmp"C:\Users\Admin\AppData\Local\Temp\2239.tmp"99⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\22B6.tmp"C:\Users\Admin\AppData\Local\Temp\22B6.tmp"100⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\2362.tmp"C:\Users\Admin\AppData\Local\Temp\2362.tmp"101⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\23EE.tmp"C:\Users\Admin\AppData\Local\Temp\23EE.tmp"102⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\247B.tmp"C:\Users\Admin\AppData\Local\Temp\247B.tmp"103⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\2507.tmp"C:\Users\Admin\AppData\Local\Temp\2507.tmp"104⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\2575.tmp"C:\Users\Admin\AppData\Local\Temp\2575.tmp"105⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\2601.tmp"C:\Users\Admin\AppData\Local\Temp\2601.tmp"106⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\266F.tmp"C:\Users\Admin\AppData\Local\Temp\266F.tmp"107⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\26FB.tmp"C:\Users\Admin\AppData\Local\Temp\26FB.tmp"108⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\2788.tmp"C:\Users\Admin\AppData\Local\Temp\2788.tmp"109⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\2824.tmp"C:\Users\Admin\AppData\Local\Temp\2824.tmp"110⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\28B1.tmp"C:\Users\Admin\AppData\Local\Temp\28B1.tmp"111⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\291E.tmp"C:\Users\Admin\AppData\Local\Temp\291E.tmp"112⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\29BB.tmp"C:\Users\Admin\AppData\Local\Temp\29BB.tmp"113⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\2A47.tmp"C:\Users\Admin\AppData\Local\Temp\2A47.tmp"114⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\2AD4.tmp"C:\Users\Admin\AppData\Local\Temp\2AD4.tmp"115⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\2B60.tmp"C:\Users\Admin\AppData\Local\Temp\2B60.tmp"116⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"117⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"118⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\2CD7.tmp"C:\Users\Admin\AppData\Local\Temp\2CD7.tmp"119⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\2D54.tmp"C:\Users\Admin\AppData\Local\Temp\2D54.tmp"120⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\2DE1.tmp"C:\Users\Admin\AppData\Local\Temp\2DE1.tmp"121⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\2E7D.tmp"C:\Users\Admin\AppData\Local\Temp\2E7D.tmp"122⤵PID:1828
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-