Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
16/08/2023, 19:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
115d1026b9d8b58a4bf9ebcc98db2a1b_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
115d1026b9d8b58a4bf9ebcc98db2a1b_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
115d1026b9d8b58a4bf9ebcc98db2a1b_mafia_JC.exe
-
Size
527KB
-
MD5
115d1026b9d8b58a4bf9ebcc98db2a1b
-
SHA1
34deacfa5546326b4dda63d444ff3712c37037c4
-
SHA256
c5dcb2ded1614c72284cf0a1c0a3fb219bf180b0f45c9e600a057d03ecb7fdf6
-
SHA512
d77a9700a0d285e3d9af4b0e22c276a873a11fd1ec9abf6221dc81d4fb4330ca0185243f823bea1a26d9392d511d8cdaf7e9ef31fa503bb0937d1ba92f4407e5
-
SSDEEP
12288:fU5rCOTeidkRt/9Mdl8T3d0YFifafguoe5Cy5DZu:fUQOJd0Qdla2YFzr5Cy5Do
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1732 61B7.tmp 3396 6283.tmp 4736 634E.tmp 1348 6448.tmp 1824 64E4.tmp 3692 6580.tmp 5108 664B.tmp 4876 66D8.tmp 4480 6784.tmp 1804 6830.tmp 4556 68CC.tmp 3316 6997.tmp 832 6A81.tmp 3920 6B9B.tmp 2944 6C47.tmp 4820 6D21.tmp 1056 6DDD.tmp 876 6EC7.tmp 3892 6F92.tmp 2840 709C.tmp 4748 7186.tmp 4940 7223.tmp 4108 72CE.tmp 1044 73A9.tmp 4980 7426.tmp 384 74A3.tmp 3528 753F.tmp 4476 762A.tmp 4800 7743.tmp 3616 780E.tmp 2236 78AA.tmp 4496 7947.tmp 1544 7A50.tmp 4948 7AED.tmp 4624 7B6A.tmp 4152 7C15.tmp 5012 7CB2.tmp 4436 7D3E.tmp 2816 7DCB.tmp 4348 7E38.tmp 3176 7ED5.tmp 2584 7F52.tmp 1648 7FDE.tmp 376 807A.tmp 5048 8126.tmp 544 81B3.tmp 4780 8240.tmp 4824 82CC.tmp 1872 8368.tmp 2184 83F5.tmp 928 8491.tmp 1352 853D.tmp 3020 85CA.tmp 3396 8637.tmp 788 86C4.tmp 3984 8741.tmp 4888 87DD.tmp 220 886A.tmp 1224 8916.tmp 2728 89A2.tmp 4876 8A2F.tmp 4056 8ACB.tmp 4220 8B48.tmp 4860 8BB5.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2124 wrote to memory of 1732 2124 115d1026b9d8b58a4bf9ebcc98db2a1b_mafia_JC.exe 82 PID 2124 wrote to memory of 1732 2124 115d1026b9d8b58a4bf9ebcc98db2a1b_mafia_JC.exe 82 PID 2124 wrote to memory of 1732 2124 115d1026b9d8b58a4bf9ebcc98db2a1b_mafia_JC.exe 82 PID 1732 wrote to memory of 3396 1732 61B7.tmp 83 PID 1732 wrote to memory of 3396 1732 61B7.tmp 83 PID 1732 wrote to memory of 3396 1732 61B7.tmp 83 PID 3396 wrote to memory of 4736 3396 6283.tmp 84 PID 3396 wrote to memory of 4736 3396 6283.tmp 84 PID 3396 wrote to memory of 4736 3396 6283.tmp 84 PID 4736 wrote to memory of 1348 4736 634E.tmp 85 PID 4736 wrote to memory of 1348 4736 634E.tmp 85 PID 4736 wrote to memory of 1348 4736 634E.tmp 85 PID 1348 wrote to memory of 1824 1348 6448.tmp 86 PID 1348 wrote to memory of 1824 1348 6448.tmp 86 PID 1348 wrote to memory of 1824 1348 6448.tmp 86 PID 1824 wrote to memory of 3692 1824 64E4.tmp 87 PID 1824 wrote to memory of 3692 1824 64E4.tmp 87 PID 1824 wrote to memory of 3692 1824 64E4.tmp 87 PID 3692 wrote to memory of 5108 3692 6580.tmp 88 PID 3692 wrote to memory of 5108 3692 6580.tmp 88 PID 3692 wrote to memory of 5108 3692 6580.tmp 88 PID 5108 wrote to memory of 4876 5108 664B.tmp 89 PID 5108 wrote to memory of 4876 5108 664B.tmp 89 PID 5108 wrote to memory of 4876 5108 664B.tmp 89 PID 4876 wrote to memory of 4480 4876 66D8.tmp 90 PID 4876 wrote to memory of 4480 4876 66D8.tmp 90 PID 4876 wrote to memory of 4480 4876 66D8.tmp 90 PID 4480 wrote to memory of 1804 4480 6784.tmp 91 PID 4480 wrote to memory of 1804 4480 6784.tmp 91 PID 4480 wrote to memory of 1804 4480 6784.tmp 91 PID 1804 wrote to memory of 4556 1804 6830.tmp 92 PID 1804 wrote to memory of 4556 1804 6830.tmp 92 PID 1804 wrote to memory of 4556 1804 6830.tmp 92 PID 4556 wrote to memory of 3316 4556 68CC.tmp 93 PID 4556 wrote to memory of 3316 4556 68CC.tmp 93 PID 4556 wrote to memory of 3316 4556 68CC.tmp 93 PID 3316 wrote to memory of 832 3316 6997.tmp 94 PID 3316 wrote to memory of 832 3316 6997.tmp 94 PID 3316 wrote to memory of 832 3316 6997.tmp 94 PID 832 wrote to memory of 3920 832 6A81.tmp 95 PID 832 wrote to memory of 3920 832 6A81.tmp 95 PID 832 wrote to memory of 3920 832 6A81.tmp 95 PID 3920 wrote to memory of 2944 3920 6B9B.tmp 96 PID 3920 wrote to memory of 2944 3920 6B9B.tmp 96 PID 3920 wrote to memory of 2944 3920 6B9B.tmp 96 PID 2944 wrote to memory of 4820 2944 6C47.tmp 99 PID 2944 wrote to memory of 4820 2944 6C47.tmp 99 PID 2944 wrote to memory of 4820 2944 6C47.tmp 99 PID 4820 wrote to memory of 1056 4820 6D21.tmp 100 PID 4820 wrote to memory of 1056 4820 6D21.tmp 100 PID 4820 wrote to memory of 1056 4820 6D21.tmp 100 PID 1056 wrote to memory of 876 1056 6DDD.tmp 101 PID 1056 wrote to memory of 876 1056 6DDD.tmp 101 PID 1056 wrote to memory of 876 1056 6DDD.tmp 101 PID 876 wrote to memory of 3892 876 6EC7.tmp 102 PID 876 wrote to memory of 3892 876 6EC7.tmp 102 PID 876 wrote to memory of 3892 876 6EC7.tmp 102 PID 3892 wrote to memory of 2840 3892 6F92.tmp 103 PID 3892 wrote to memory of 2840 3892 6F92.tmp 103 PID 3892 wrote to memory of 2840 3892 6F92.tmp 103 PID 2840 wrote to memory of 4748 2840 709C.tmp 104 PID 2840 wrote to memory of 4748 2840 709C.tmp 104 PID 2840 wrote to memory of 4748 2840 709C.tmp 104 PID 4748 wrote to memory of 4940 4748 7186.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\115d1026b9d8b58a4bf9ebcc98db2a1b_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\115d1026b9d8b58a4bf9ebcc98db2a1b_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"23⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"24⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"25⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"26⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"27⤵
- Executes dropped EXE
PID:384 -
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"28⤵
- Executes dropped EXE
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"29⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\7743.tmp"C:\Users\Admin\AppData\Local\Temp\7743.tmp"30⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\780E.tmp"C:\Users\Admin\AppData\Local\Temp\780E.tmp"31⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"32⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"33⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\7A50.tmp"C:\Users\Admin\AppData\Local\Temp\7A50.tmp"34⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\7AED.tmp"C:\Users\Admin\AppData\Local\Temp\7AED.tmp"35⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"36⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\7C15.tmp"C:\Users\Admin\AppData\Local\Temp\7C15.tmp"37⤵
- Executes dropped EXE
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"38⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"39⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"40⤵
- Executes dropped EXE
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\7E38.tmp"C:\Users\Admin\AppData\Local\Temp\7E38.tmp"41⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"42⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\7F52.tmp"C:\Users\Admin\AppData\Local\Temp\7F52.tmp"43⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"44⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\807A.tmp"C:\Users\Admin\AppData\Local\Temp\807A.tmp"45⤵
- Executes dropped EXE
PID:376 -
C:\Users\Admin\AppData\Local\Temp\8126.tmp"C:\Users\Admin\AppData\Local\Temp\8126.tmp"46⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\81B3.tmp"C:\Users\Admin\AppData\Local\Temp\81B3.tmp"47⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\8240.tmp"C:\Users\Admin\AppData\Local\Temp\8240.tmp"48⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"49⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\8368.tmp"C:\Users\Admin\AppData\Local\Temp\8368.tmp"50⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\83F5.tmp"C:\Users\Admin\AppData\Local\Temp\83F5.tmp"51⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\8491.tmp"C:\Users\Admin\AppData\Local\Temp\8491.tmp"52⤵
- Executes dropped EXE
PID:928 -
C:\Users\Admin\AppData\Local\Temp\853D.tmp"C:\Users\Admin\AppData\Local\Temp\853D.tmp"53⤵
- Executes dropped EXE
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\85CA.tmp"C:\Users\Admin\AppData\Local\Temp\85CA.tmp"54⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\8637.tmp"C:\Users\Admin\AppData\Local\Temp\8637.tmp"55⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\86C4.tmp"C:\Users\Admin\AppData\Local\Temp\86C4.tmp"56⤵
- Executes dropped EXE
PID:788 -
C:\Users\Admin\AppData\Local\Temp\8741.tmp"C:\Users\Admin\AppData\Local\Temp\8741.tmp"57⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\87DD.tmp"C:\Users\Admin\AppData\Local\Temp\87DD.tmp"58⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\886A.tmp"C:\Users\Admin\AppData\Local\Temp\886A.tmp"59⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\8916.tmp"C:\Users\Admin\AppData\Local\Temp\8916.tmp"60⤵
- Executes dropped EXE
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\89A2.tmp"C:\Users\Admin\AppData\Local\Temp\89A2.tmp"61⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"62⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"63⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\8B48.tmp"C:\Users\Admin\AppData\Local\Temp\8B48.tmp"64⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"65⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\8C23.tmp"C:\Users\Admin\AppData\Local\Temp\8C23.tmp"66⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"67⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"68⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"69⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\8E55.tmp"C:\Users\Admin\AppData\Local\Temp\8E55.tmp"70⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"71⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"72⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"73⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"74⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"75⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\9182.tmp"C:\Users\Admin\AppData\Local\Temp\9182.tmp"76⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"77⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\927C.tmp"C:\Users\Admin\AppData\Local\Temp\927C.tmp"78⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\9337.tmp"C:\Users\Admin\AppData\Local\Temp\9337.tmp"79⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"80⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\9460.tmp"C:\Users\Admin\AppData\Local\Temp\9460.tmp"81⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\94CE.tmp"C:\Users\Admin\AppData\Local\Temp\94CE.tmp"82⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"83⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\95D7.tmp"C:\Users\Admin\AppData\Local\Temp\95D7.tmp"84⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\9664.tmp"C:\Users\Admin\AppData\Local\Temp\9664.tmp"85⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\96C2.tmp"C:\Users\Admin\AppData\Local\Temp\96C2.tmp"86⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"87⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\97BC.tmp"C:\Users\Admin\AppData\Local\Temp\97BC.tmp"88⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"89⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\98A6.tmp"C:\Users\Admin\AppData\Local\Temp\98A6.tmp"90⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"91⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"92⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"93⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"94⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"95⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"96⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"97⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"98⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\9D69.tmp"C:\Users\Admin\AppData\Local\Temp\9D69.tmp"99⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"100⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\9E63.tmp"C:\Users\Admin\AppData\Local\Temp\9E63.tmp"101⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"102⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"103⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"104⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\A086.tmp"C:\Users\Admin\AppData\Local\Temp\A086.tmp"105⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\A112.tmp"C:\Users\Admin\AppData\Local\Temp\A112.tmp"106⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\A19F.tmp"C:\Users\Admin\AppData\Local\Temp\A19F.tmp"107⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"108⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"109⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\A306.tmp"C:\Users\Admin\AppData\Local\Temp\A306.tmp"110⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"111⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"112⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\A46E.tmp"C:\Users\Admin\AppData\Local\Temp\A46E.tmp"113⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"114⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"115⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\A633.tmp"C:\Users\Admin\AppData\Local\Temp\A633.tmp"116⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"117⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\A74C.tmp"C:\Users\Admin\AppData\Local\Temp\A74C.tmp"118⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"119⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"120⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"121⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"122⤵PID:832
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-