Analysis
-
max time kernel
151s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17-08-2023 14:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1256da3ad6f7e09ae42cfc050de1a706_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
1256da3ad6f7e09ae42cfc050de1a706_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
1256da3ad6f7e09ae42cfc050de1a706_mafia_JC.exe
-
Size
488KB
-
MD5
1256da3ad6f7e09ae42cfc050de1a706
-
SHA1
188695fc994b8c2bb3e5a972806b42523a17292d
-
SHA256
68056b5c630d22b6158aa6ab90bcf77cc2d2a4b61551dcf6fe2ca1a3322205e6
-
SHA512
b3f3ab6539835fc36fe389dca95ebf14923841025a2591722ed221b83cd53677506cecedbc4f883961e8c4f8760287863f28687ae3c60668169c27866ffad00d
-
SSDEEP
12288:/U5rCOTeiDFkNDfZmg3QFvWyCNM2YK8lU5vffjSNZ:/UQOJDuNtmgAQyl6v3jSN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3772 45FD.tmp 2108 4726.tmp 1112 4810.tmp 1628 48DB.tmp 3904 49F5.tmp 3876 4AB0.tmp 5048 4BAA.tmp 4436 4C75.tmp 2224 4D60.tmp 2812 4E4A.tmp 728 4F25.tmp 4764 4FD1.tmp 1044 509C.tmp 3792 5157.tmp 5008 5203.tmp 1376 52AF.tmp 3728 535B.tmp 2452 5474.tmp 1916 556E.tmp 4524 5649.tmp 4452 56F5.tmp 208 57B0.tmp 4752 587B.tmp 1088 5946.tmp 4164 5A60.tmp 1092 5B1B.tmp 3992 5C25.tmp 1032 5CD1.tmp 4892 5D7D.tmp 3524 5E28.tmp 5096 5F42.tmp 1304 6126.tmp 1140 62DC.tmp 3024 6387.tmp 4604 6433.tmp 2036 64EF.tmp 3700 658B.tmp 4632 6618.tmp 1424 66B4.tmp 3240 6750.tmp 2852 681B.tmp 1612 68A8.tmp 1396 6925.tmp 2280 69B2.tmp 3976 6A5D.tmp 2856 6AEA.tmp 1572 6B96.tmp 3004 6C51.tmp 3376 6CDE.tmp 4160 6D8A.tmp 2652 6E36.tmp 3880 6EC2.tmp 3488 6F4F.tmp 4320 700B.tmp 4016 7078.tmp 3032 7114.tmp 3772 71A1.tmp 2108 723D.tmp 1340 72BA.tmp 2312 7356.tmp 4608 73D3.tmp 4292 7460.tmp 3732 74FC.tmp 1120 7579.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2916 wrote to memory of 3772 2916 1256da3ad6f7e09ae42cfc050de1a706_mafia_JC.exe 81 PID 2916 wrote to memory of 3772 2916 1256da3ad6f7e09ae42cfc050de1a706_mafia_JC.exe 81 PID 2916 wrote to memory of 3772 2916 1256da3ad6f7e09ae42cfc050de1a706_mafia_JC.exe 81 PID 3772 wrote to memory of 2108 3772 45FD.tmp 82 PID 3772 wrote to memory of 2108 3772 45FD.tmp 82 PID 3772 wrote to memory of 2108 3772 45FD.tmp 82 PID 2108 wrote to memory of 1112 2108 4726.tmp 83 PID 2108 wrote to memory of 1112 2108 4726.tmp 83 PID 2108 wrote to memory of 1112 2108 4726.tmp 83 PID 1112 wrote to memory of 1628 1112 4810.tmp 84 PID 1112 wrote to memory of 1628 1112 4810.tmp 84 PID 1112 wrote to memory of 1628 1112 4810.tmp 84 PID 1628 wrote to memory of 3904 1628 48DB.tmp 85 PID 1628 wrote to memory of 3904 1628 48DB.tmp 85 PID 1628 wrote to memory of 3904 1628 48DB.tmp 85 PID 3904 wrote to memory of 3876 3904 49F5.tmp 86 PID 3904 wrote to memory of 3876 3904 49F5.tmp 86 PID 3904 wrote to memory of 3876 3904 49F5.tmp 86 PID 3876 wrote to memory of 5048 3876 4AB0.tmp 87 PID 3876 wrote to memory of 5048 3876 4AB0.tmp 87 PID 3876 wrote to memory of 5048 3876 4AB0.tmp 87 PID 5048 wrote to memory of 4436 5048 4BAA.tmp 88 PID 5048 wrote to memory of 4436 5048 4BAA.tmp 88 PID 5048 wrote to memory of 4436 5048 4BAA.tmp 88 PID 4436 wrote to memory of 2224 4436 4C75.tmp 89 PID 4436 wrote to memory of 2224 4436 4C75.tmp 89 PID 4436 wrote to memory of 2224 4436 4C75.tmp 89 PID 2224 wrote to memory of 2812 2224 4D60.tmp 90 PID 2224 wrote to memory of 2812 2224 4D60.tmp 90 PID 2224 wrote to memory of 2812 2224 4D60.tmp 90 PID 2812 wrote to memory of 728 2812 4E4A.tmp 91 PID 2812 wrote to memory of 728 2812 4E4A.tmp 91 PID 2812 wrote to memory of 728 2812 4E4A.tmp 91 PID 728 wrote to memory of 4764 728 4F25.tmp 92 PID 728 wrote to memory of 4764 728 4F25.tmp 92 PID 728 wrote to memory of 4764 728 4F25.tmp 92 PID 4764 wrote to memory of 1044 4764 4FD1.tmp 93 PID 4764 wrote to memory of 1044 4764 4FD1.tmp 93 PID 4764 wrote to memory of 1044 4764 4FD1.tmp 93 PID 1044 wrote to memory of 3792 1044 509C.tmp 94 PID 1044 wrote to memory of 3792 1044 509C.tmp 94 PID 1044 wrote to memory of 3792 1044 509C.tmp 94 PID 3792 wrote to memory of 5008 3792 5157.tmp 96 PID 3792 wrote to memory of 5008 3792 5157.tmp 96 PID 3792 wrote to memory of 5008 3792 5157.tmp 96 PID 5008 wrote to memory of 1376 5008 5203.tmp 97 PID 5008 wrote to memory of 1376 5008 5203.tmp 97 PID 5008 wrote to memory of 1376 5008 5203.tmp 97 PID 1376 wrote to memory of 3728 1376 52AF.tmp 98 PID 1376 wrote to memory of 3728 1376 52AF.tmp 98 PID 1376 wrote to memory of 3728 1376 52AF.tmp 98 PID 3728 wrote to memory of 2452 3728 535B.tmp 99 PID 3728 wrote to memory of 2452 3728 535B.tmp 99 PID 3728 wrote to memory of 2452 3728 535B.tmp 99 PID 2452 wrote to memory of 1916 2452 5474.tmp 100 PID 2452 wrote to memory of 1916 2452 5474.tmp 100 PID 2452 wrote to memory of 1916 2452 5474.tmp 100 PID 1916 wrote to memory of 4524 1916 556E.tmp 101 PID 1916 wrote to memory of 4524 1916 556E.tmp 101 PID 1916 wrote to memory of 4524 1916 556E.tmp 101 PID 4524 wrote to memory of 4452 4524 5649.tmp 102 PID 4524 wrote to memory of 4452 4524 5649.tmp 102 PID 4524 wrote to memory of 4452 4524 5649.tmp 102 PID 4452 wrote to memory of 208 4452 56F5.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\1256da3ad6f7e09ae42cfc050de1a706_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\1256da3ad6f7e09ae42cfc050de1a706_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\45FD.tmp"C:\Users\Admin\AppData\Local\Temp\45FD.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\4726.tmp"C:\Users\Admin\AppData\Local\Temp\4726.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\4810.tmp"C:\Users\Admin\AppData\Local\Temp\4810.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\48DB.tmp"C:\Users\Admin\AppData\Local\Temp\48DB.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\49F5.tmp"C:\Users\Admin\AppData\Local\Temp\49F5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\4BAA.tmp"C:\Users\Admin\AppData\Local\Temp\4BAA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\4C75.tmp"C:\Users\Admin\AppData\Local\Temp\4C75.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\4D60.tmp"C:\Users\Admin\AppData\Local\Temp\4D60.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\4E4A.tmp"C:\Users\Admin\AppData\Local\Temp\4E4A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\4F25.tmp"C:\Users\Admin\AppData\Local\Temp\4F25.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Users\Admin\AppData\Local\Temp\4FD1.tmp"C:\Users\Admin\AppData\Local\Temp\4FD1.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\509C.tmp"C:\Users\Admin\AppData\Local\Temp\509C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\5157.tmp"C:\Users\Admin\AppData\Local\Temp\5157.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\5203.tmp"C:\Users\Admin\AppData\Local\Temp\5203.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\52AF.tmp"C:\Users\Admin\AppData\Local\Temp\52AF.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\535B.tmp"C:\Users\Admin\AppData\Local\Temp\535B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\5474.tmp"C:\Users\Admin\AppData\Local\Temp\5474.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\556E.tmp"C:\Users\Admin\AppData\Local\Temp\556E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\5649.tmp"C:\Users\Admin\AppData\Local\Temp\5649.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\56F5.tmp"C:\Users\Admin\AppData\Local\Temp\56F5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\57B0.tmp"C:\Users\Admin\AppData\Local\Temp\57B0.tmp"23⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\587B.tmp"C:\Users\Admin\AppData\Local\Temp\587B.tmp"24⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\5946.tmp"C:\Users\Admin\AppData\Local\Temp\5946.tmp"25⤵
- Executes dropped EXE
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\5A60.tmp"C:\Users\Admin\AppData\Local\Temp\5A60.tmp"26⤵
- Executes dropped EXE
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\5B1B.tmp"C:\Users\Admin\AppData\Local\Temp\5B1B.tmp"27⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\5C25.tmp"C:\Users\Admin\AppData\Local\Temp\5C25.tmp"28⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\5CD1.tmp"C:\Users\Admin\AppData\Local\Temp\5CD1.tmp"29⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\5D7D.tmp"C:\Users\Admin\AppData\Local\Temp\5D7D.tmp"30⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\5E28.tmp"C:\Users\Admin\AppData\Local\Temp\5E28.tmp"31⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\5F42.tmp"C:\Users\Admin\AppData\Local\Temp\5F42.tmp"32⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\6126.tmp"C:\Users\Admin\AppData\Local\Temp\6126.tmp"33⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\62DC.tmp"C:\Users\Admin\AppData\Local\Temp\62DC.tmp"34⤵
- Executes dropped EXE
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\6387.tmp"C:\Users\Admin\AppData\Local\Temp\6387.tmp"35⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\6433.tmp"C:\Users\Admin\AppData\Local\Temp\6433.tmp"36⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\64EF.tmp"C:\Users\Admin\AppData\Local\Temp\64EF.tmp"37⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\658B.tmp"C:\Users\Admin\AppData\Local\Temp\658B.tmp"38⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\6618.tmp"C:\Users\Admin\AppData\Local\Temp\6618.tmp"39⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\66B4.tmp"C:\Users\Admin\AppData\Local\Temp\66B4.tmp"40⤵
- Executes dropped EXE
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\6750.tmp"C:\Users\Admin\AppData\Local\Temp\6750.tmp"41⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\681B.tmp"C:\Users\Admin\AppData\Local\Temp\681B.tmp"42⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\68A8.tmp"C:\Users\Admin\AppData\Local\Temp\68A8.tmp"43⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\6925.tmp"C:\Users\Admin\AppData\Local\Temp\6925.tmp"44⤵
- Executes dropped EXE
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\69B2.tmp"C:\Users\Admin\AppData\Local\Temp\69B2.tmp"45⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\6A5D.tmp"C:\Users\Admin\AppData\Local\Temp\6A5D.tmp"46⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\6AEA.tmp"C:\Users\Admin\AppData\Local\Temp\6AEA.tmp"47⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\6B96.tmp"C:\Users\Admin\AppData\Local\Temp\6B96.tmp"48⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\6C51.tmp"C:\Users\Admin\AppData\Local\Temp\6C51.tmp"49⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\6CDE.tmp"C:\Users\Admin\AppData\Local\Temp\6CDE.tmp"50⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\6D8A.tmp"C:\Users\Admin\AppData\Local\Temp\6D8A.tmp"51⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\6E36.tmp"C:\Users\Admin\AppData\Local\Temp\6E36.tmp"52⤵
- Executes dropped EXE
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\6EC2.tmp"C:\Users\Admin\AppData\Local\Temp\6EC2.tmp"53⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\6F4F.tmp"C:\Users\Admin\AppData\Local\Temp\6F4F.tmp"54⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\700B.tmp"C:\Users\Admin\AppData\Local\Temp\700B.tmp"55⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\7078.tmp"C:\Users\Admin\AppData\Local\Temp\7078.tmp"56⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\7114.tmp"C:\Users\Admin\AppData\Local\Temp\7114.tmp"57⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\71A1.tmp"C:\Users\Admin\AppData\Local\Temp\71A1.tmp"58⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\723D.tmp"C:\Users\Admin\AppData\Local\Temp\723D.tmp"59⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\72BA.tmp"C:\Users\Admin\AppData\Local\Temp\72BA.tmp"60⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\7356.tmp"C:\Users\Admin\AppData\Local\Temp\7356.tmp"61⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\73D3.tmp"C:\Users\Admin\AppData\Local\Temp\73D3.tmp"62⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\7460.tmp"C:\Users\Admin\AppData\Local\Temp\7460.tmp"63⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\74FC.tmp"C:\Users\Admin\AppData\Local\Temp\74FC.tmp"64⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\7579.tmp"C:\Users\Admin\AppData\Local\Temp\7579.tmp"65⤵
- Executes dropped EXE
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\75F6.tmp"C:\Users\Admin\AppData\Local\Temp\75F6.tmp"66⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\7683.tmp"C:\Users\Admin\AppData\Local\Temp\7683.tmp"67⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\772F.tmp"C:\Users\Admin\AppData\Local\Temp\772F.tmp"68⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\77BB.tmp"C:\Users\Admin\AppData\Local\Temp\77BB.tmp"69⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\7858.tmp"C:\Users\Admin\AppData\Local\Temp\7858.tmp"70⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\78E4.tmp"C:\Users\Admin\AppData\Local\Temp\78E4.tmp"71⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\7971.tmp"C:\Users\Admin\AppData\Local\Temp\7971.tmp"72⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\7A2C.tmp"C:\Users\Admin\AppData\Local\Temp\7A2C.tmp"73⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\7AB9.tmp"C:\Users\Admin\AppData\Local\Temp\7AB9.tmp"74⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\7B65.tmp"C:\Users\Admin\AppData\Local\Temp\7B65.tmp"75⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\7BF1.tmp"C:\Users\Admin\AppData\Local\Temp\7BF1.tmp"76⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\7C6E.tmp"C:\Users\Admin\AppData\Local\Temp\7C6E.tmp"77⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\7CFB.tmp"C:\Users\Admin\AppData\Local\Temp\7CFB.tmp"78⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\7D78.tmp"C:\Users\Admin\AppData\Local\Temp\7D78.tmp"79⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\7DF5.tmp"C:\Users\Admin\AppData\Local\Temp\7DF5.tmp"80⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\7E62.tmp"C:\Users\Admin\AppData\Local\Temp\7E62.tmp"81⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\7F0E.tmp"C:\Users\Admin\AppData\Local\Temp\7F0E.tmp"82⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\7F8B.tmp"C:\Users\Admin\AppData\Local\Temp\7F8B.tmp"83⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"84⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\8076.tmp"C:\Users\Admin\AppData\Local\Temp\8076.tmp"85⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\80E3.tmp"C:\Users\Admin\AppData\Local\Temp\80E3.tmp"86⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\817F.tmp"C:\Users\Admin\AppData\Local\Temp\817F.tmp"87⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\820C.tmp"C:\Users\Admin\AppData\Local\Temp\820C.tmp"88⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\8299.tmp"C:\Users\Admin\AppData\Local\Temp\8299.tmp"89⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\8316.tmp"C:\Users\Admin\AppData\Local\Temp\8316.tmp"90⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\8393.tmp"C:\Users\Admin\AppData\Local\Temp\8393.tmp"91⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\842F.tmp"C:\Users\Admin\AppData\Local\Temp\842F.tmp"92⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\849C.tmp"C:\Users\Admin\AppData\Local\Temp\849C.tmp"93⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\8529.tmp"C:\Users\Admin\AppData\Local\Temp\8529.tmp"94⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\8623.tmp"C:\Users\Admin\AppData\Local\Temp\8623.tmp"95⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\86A0.tmp"C:\Users\Admin\AppData\Local\Temp\86A0.tmp"96⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\872C.tmp"C:\Users\Admin\AppData\Local\Temp\872C.tmp"97⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\87E8.tmp"C:\Users\Admin\AppData\Local\Temp\87E8.tmp"98⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\8865.tmp"C:\Users\Admin\AppData\Local\Temp\8865.tmp"99⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\88F2.tmp"C:\Users\Admin\AppData\Local\Temp\88F2.tmp"100⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\896F.tmp"C:\Users\Admin\AppData\Local\Temp\896F.tmp"101⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\8A0B.tmp"C:\Users\Admin\AppData\Local\Temp\8A0B.tmp"102⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\8AD6.tmp"C:\Users\Admin\AppData\Local\Temp\8AD6.tmp"103⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\8B53.tmp"C:\Users\Admin\AppData\Local\Temp\8B53.tmp"104⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\8BEF.tmp"C:\Users\Admin\AppData\Local\Temp\8BEF.tmp"105⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\8C7C.tmp"C:\Users\Admin\AppData\Local\Temp\8C7C.tmp"106⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\8CF9.tmp"C:\Users\Admin\AppData\Local\Temp\8CF9.tmp"107⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\8D95.tmp"C:\Users\Admin\AppData\Local\Temp\8D95.tmp"108⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\8E31.tmp"C:\Users\Admin\AppData\Local\Temp\8E31.tmp"109⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\8EAE.tmp"C:\Users\Admin\AppData\Local\Temp\8EAE.tmp"110⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\8F3B.tmp"C:\Users\Admin\AppData\Local\Temp\8F3B.tmp"111⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\8FD7.tmp"C:\Users\Admin\AppData\Local\Temp\8FD7.tmp"112⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\9064.tmp"C:\Users\Admin\AppData\Local\Temp\9064.tmp"113⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\9100.tmp"C:\Users\Admin\AppData\Local\Temp\9100.tmp"114⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\91AC.tmp"C:\Users\Admin\AppData\Local\Temp\91AC.tmp"115⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\9258.tmp"C:\Users\Admin\AppData\Local\Temp\9258.tmp"116⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\92E4.tmp"C:\Users\Admin\AppData\Local\Temp\92E4.tmp"117⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\9361.tmp"C:\Users\Admin\AppData\Local\Temp\9361.tmp"118⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\941D.tmp"C:\Users\Admin\AppData\Local\Temp\941D.tmp"119⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\94AA.tmp"C:\Users\Admin\AppData\Local\Temp\94AA.tmp"120⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\9527.tmp"C:\Users\Admin\AppData\Local\Temp\9527.tmp"121⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\95B3.tmp"C:\Users\Admin\AppData\Local\Temp\95B3.tmp"122⤵PID:4612
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-