Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18-08-2023 14:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2e9f0f0d2b659b3daf143848f0d1027d_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2e9f0f0d2b659b3daf143848f0d1027d_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2e9f0f0d2b659b3daf143848f0d1027d_mafia_JC.exe
-
Size
520KB
-
MD5
2e9f0f0d2b659b3daf143848f0d1027d
-
SHA1
14db8c8a5876c6fe366788e4694aba454e75a876
-
SHA256
2372ed3504550c16c393cc81409a88e54f2bc2f23b66c62bf0c934f1c1102378
-
SHA512
c5f2fcbe5ac4dfb90f00c00f6ec3c032d9299cc76ce44afc396d9d7bbcfefedf5a43052de90db3c34862400449ee3c164f09b62213332cc24e2035521ff18423
-
SSDEEP
12288:roRXOQjmOyJa18kDE9RvWvWrNhDnV+jNZ:rogQ9yJa1TDE95WvWJhDnV+jN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3780 E232.tmp 4568 E2CE.tmp 1032 E38A.tmp 4724 E445.tmp 372 E510.tmp 1400 E60A.tmp 2552 E6B6.tmp 4436 E762.tmp 1636 E80E.tmp 636 E8AA.tmp 3760 E937.tmp 4964 E9E3.tmp 4764 EA60.tmp 4936 EC06.tmp 1432 ECF0.tmp 4904 ED9C.tmp 4704 EF23.tmp 1220 EFBF.tmp 4404 F0F7.tmp 2884 F1D2.tmp 4632 F2AD.tmp 3452 F359.tmp 3936 F405.tmp 1200 F4B0.tmp 1160 F52D.tmp 4144 F5CA.tmp 4460 F666.tmp 4880 F702.tmp 3112 F7DD.tmp 4888 F8A8.tmp 992 F973.tmp 952 FA3E.tmp 1020 FB38.tmp 416 FBA6.tmp 4116 FC32.tmp 3920 FCCF.tmp 3020 FD5B.tmp 4324 FDF7.tmp 2272 FE84.tmp 4356 FF11.tmp 4920 FFBD.tmp 2460 114.tmp 2748 182.tmp 2764 23D.tmp 4640 2CA.tmp 5036 385.tmp 1604 422.tmp 3224 4BE.tmp 1668 5F6.tmp 4464 683.tmp 1300 710.tmp 1904 7BB.tmp 600 838.tmp 4968 8C5.tmp 3904 961.tmp 1076 A0D.tmp 440 AB9.tmp 1540 B36.tmp 4320 BE2.tmp 4024 C5F.tmp 1688 CBD.tmp 1872 D2A.tmp 2588 DB7.tmp 3756 E34.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3312 wrote to memory of 3780 3312 2e9f0f0d2b659b3daf143848f0d1027d_mafia_JC.exe 80 PID 3312 wrote to memory of 3780 3312 2e9f0f0d2b659b3daf143848f0d1027d_mafia_JC.exe 80 PID 3312 wrote to memory of 3780 3312 2e9f0f0d2b659b3daf143848f0d1027d_mafia_JC.exe 80 PID 3780 wrote to memory of 4568 3780 E232.tmp 81 PID 3780 wrote to memory of 4568 3780 E232.tmp 81 PID 3780 wrote to memory of 4568 3780 E232.tmp 81 PID 4568 wrote to memory of 1032 4568 E2CE.tmp 82 PID 4568 wrote to memory of 1032 4568 E2CE.tmp 82 PID 4568 wrote to memory of 1032 4568 E2CE.tmp 82 PID 1032 wrote to memory of 4724 1032 E38A.tmp 83 PID 1032 wrote to memory of 4724 1032 E38A.tmp 83 PID 1032 wrote to memory of 4724 1032 E38A.tmp 83 PID 4724 wrote to memory of 372 4724 E445.tmp 84 PID 4724 wrote to memory of 372 4724 E445.tmp 84 PID 4724 wrote to memory of 372 4724 E445.tmp 84 PID 372 wrote to memory of 1400 372 E510.tmp 85 PID 372 wrote to memory of 1400 372 E510.tmp 85 PID 372 wrote to memory of 1400 372 E510.tmp 85 PID 1400 wrote to memory of 2552 1400 E60A.tmp 86 PID 1400 wrote to memory of 2552 1400 E60A.tmp 86 PID 1400 wrote to memory of 2552 1400 E60A.tmp 86 PID 2552 wrote to memory of 4436 2552 E6B6.tmp 87 PID 2552 wrote to memory of 4436 2552 E6B6.tmp 87 PID 2552 wrote to memory of 4436 2552 E6B6.tmp 87 PID 4436 wrote to memory of 1636 4436 E762.tmp 88 PID 4436 wrote to memory of 1636 4436 E762.tmp 88 PID 4436 wrote to memory of 1636 4436 E762.tmp 88 PID 1636 wrote to memory of 636 1636 E80E.tmp 89 PID 1636 wrote to memory of 636 1636 E80E.tmp 89 PID 1636 wrote to memory of 636 1636 E80E.tmp 89 PID 636 wrote to memory of 3760 636 E8AA.tmp 90 PID 636 wrote to memory of 3760 636 E8AA.tmp 90 PID 636 wrote to memory of 3760 636 E8AA.tmp 90 PID 3760 wrote to memory of 4964 3760 E937.tmp 92 PID 3760 wrote to memory of 4964 3760 E937.tmp 92 PID 3760 wrote to memory of 4964 3760 E937.tmp 92 PID 4964 wrote to memory of 4764 4964 E9E3.tmp 93 PID 4964 wrote to memory of 4764 4964 E9E3.tmp 93 PID 4964 wrote to memory of 4764 4964 E9E3.tmp 93 PID 4764 wrote to memory of 4936 4764 EA60.tmp 94 PID 4764 wrote to memory of 4936 4764 EA60.tmp 94 PID 4764 wrote to memory of 4936 4764 EA60.tmp 94 PID 4936 wrote to memory of 1432 4936 EC06.tmp 95 PID 4936 wrote to memory of 1432 4936 EC06.tmp 95 PID 4936 wrote to memory of 1432 4936 EC06.tmp 95 PID 1432 wrote to memory of 4904 1432 ECF0.tmp 96 PID 1432 wrote to memory of 4904 1432 ECF0.tmp 96 PID 1432 wrote to memory of 4904 1432 ECF0.tmp 96 PID 4904 wrote to memory of 4704 4904 ED9C.tmp 97 PID 4904 wrote to memory of 4704 4904 ED9C.tmp 97 PID 4904 wrote to memory of 4704 4904 ED9C.tmp 97 PID 4704 wrote to memory of 1220 4704 EF23.tmp 100 PID 4704 wrote to memory of 1220 4704 EF23.tmp 100 PID 4704 wrote to memory of 1220 4704 EF23.tmp 100 PID 1220 wrote to memory of 4404 1220 EFBF.tmp 101 PID 1220 wrote to memory of 4404 1220 EFBF.tmp 101 PID 1220 wrote to memory of 4404 1220 EFBF.tmp 101 PID 4404 wrote to memory of 2884 4404 F0F7.tmp 102 PID 4404 wrote to memory of 2884 4404 F0F7.tmp 102 PID 4404 wrote to memory of 2884 4404 F0F7.tmp 102 PID 2884 wrote to memory of 4632 2884 F1D2.tmp 103 PID 2884 wrote to memory of 4632 2884 F1D2.tmp 103 PID 2884 wrote to memory of 4632 2884 F1D2.tmp 103 PID 4632 wrote to memory of 3452 4632 F2AD.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e9f0f0d2b659b3daf143848f0d1027d_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2e9f0f0d2b659b3daf143848f0d1027d_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\E232.tmp"C:\Users\Admin\AppData\Local\Temp\E232.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\E38A.tmp"C:\Users\Admin\AppData\Local\Temp\E38A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\E445.tmp"C:\Users\Admin\AppData\Local\Temp\E445.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\E510.tmp"C:\Users\Admin\AppData\Local\Temp\E510.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Users\Admin\AppData\Local\Temp\E60A.tmp"C:\Users\Admin\AppData\Local\Temp\E60A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\E762.tmp"C:\Users\Admin\AppData\Local\Temp\E762.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\E80E.tmp"C:\Users\Admin\AppData\Local\Temp\E80E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\E8AA.tmp"C:\Users\Admin\AppData\Local\Temp\E8AA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\E937.tmp"C:\Users\Admin\AppData\Local\Temp\E937.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\E9E3.tmp"C:\Users\Admin\AppData\Local\Temp\E9E3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\EA60.tmp"C:\Users\Admin\AppData\Local\Temp\EA60.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\EC06.tmp"C:\Users\Admin\AppData\Local\Temp\EC06.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\ED9C.tmp"C:\Users\Admin\AppData\Local\Temp\ED9C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\EF23.tmp"C:\Users\Admin\AppData\Local\Temp\EF23.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\EFBF.tmp"C:\Users\Admin\AppData\Local\Temp\EFBF.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\F0F7.tmp"C:\Users\Admin\AppData\Local\Temp\F0F7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\F1D2.tmp"C:\Users\Admin\AppData\Local\Temp\F1D2.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\F2AD.tmp"C:\Users\Admin\AppData\Local\Temp\F2AD.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\F359.tmp"C:\Users\Admin\AppData\Local\Temp\F359.tmp"23⤵
- Executes dropped EXE
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\F405.tmp"C:\Users\Admin\AppData\Local\Temp\F405.tmp"24⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\F4B0.tmp"C:\Users\Admin\AppData\Local\Temp\F4B0.tmp"25⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\F52D.tmp"C:\Users\Admin\AppData\Local\Temp\F52D.tmp"26⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"27⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\F666.tmp"C:\Users\Admin\AppData\Local\Temp\F666.tmp"28⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\F702.tmp"C:\Users\Admin\AppData\Local\Temp\F702.tmp"29⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"30⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"31⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\F973.tmp"C:\Users\Admin\AppData\Local\Temp\F973.tmp"32⤵
- Executes dropped EXE
PID:992 -
C:\Users\Admin\AppData\Local\Temp\FA3E.tmp"C:\Users\Admin\AppData\Local\Temp\FA3E.tmp"33⤵
- Executes dropped EXE
PID:952 -
C:\Users\Admin\AppData\Local\Temp\FB38.tmp"C:\Users\Admin\AppData\Local\Temp\FB38.tmp"34⤵
- Executes dropped EXE
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"35⤵
- Executes dropped EXE
PID:416 -
C:\Users\Admin\AppData\Local\Temp\FC32.tmp"C:\Users\Admin\AppData\Local\Temp\FC32.tmp"36⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"37⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"38⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\FDF7.tmp"C:\Users\Admin\AppData\Local\Temp\FDF7.tmp"39⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\FE84.tmp"C:\Users\Admin\AppData\Local\Temp\FE84.tmp"40⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\FF11.tmp"C:\Users\Admin\AppData\Local\Temp\FF11.tmp"41⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"42⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\114.tmp"C:\Users\Admin\AppData\Local\Temp\114.tmp"43⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\182.tmp"C:\Users\Admin\AppData\Local\Temp\182.tmp"44⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\23D.tmp"C:\Users\Admin\AppData\Local\Temp\23D.tmp"45⤵
- Executes dropped EXE
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\2CA.tmp"C:\Users\Admin\AppData\Local\Temp\2CA.tmp"46⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\385.tmp"C:\Users\Admin\AppData\Local\Temp\385.tmp"47⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\422.tmp"C:\Users\Admin\AppData\Local\Temp\422.tmp"48⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\4BE.tmp"C:\Users\Admin\AppData\Local\Temp\4BE.tmp"49⤵
- Executes dropped EXE
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\5F6.tmp"C:\Users\Admin\AppData\Local\Temp\5F6.tmp"50⤵
- Executes dropped EXE
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\683.tmp"C:\Users\Admin\AppData\Local\Temp\683.tmp"51⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\710.tmp"C:\Users\Admin\AppData\Local\Temp\710.tmp"52⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\7BB.tmp"C:\Users\Admin\AppData\Local\Temp\7BB.tmp"53⤵
- Executes dropped EXE
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\838.tmp"C:\Users\Admin\AppData\Local\Temp\838.tmp"54⤵
- Executes dropped EXE
PID:600 -
C:\Users\Admin\AppData\Local\Temp\8C5.tmp"C:\Users\Admin\AppData\Local\Temp\8C5.tmp"55⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\961.tmp"C:\Users\Admin\AppData\Local\Temp\961.tmp"56⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\A0D.tmp"C:\Users\Admin\AppData\Local\Temp\A0D.tmp"57⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\AB9.tmp"C:\Users\Admin\AppData\Local\Temp\AB9.tmp"58⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\B36.tmp"C:\Users\Admin\AppData\Local\Temp\B36.tmp"59⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\BE2.tmp"C:\Users\Admin\AppData\Local\Temp\BE2.tmp"60⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\C5F.tmp"C:\Users\Admin\AppData\Local\Temp\C5F.tmp"61⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\CBD.tmp"C:\Users\Admin\AppData\Local\Temp\CBD.tmp"62⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\D2A.tmp"C:\Users\Admin\AppData\Local\Temp\D2A.tmp"63⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\DB7.tmp"C:\Users\Admin\AppData\Local\Temp\DB7.tmp"64⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"65⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\EA1.tmp"C:\Users\Admin\AppData\Local\Temp\EA1.tmp"66⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"67⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"68⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\1066.tmp"C:\Users\Admin\AppData\Local\Temp\1066.tmp"69⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\10F3.tmp"C:\Users\Admin\AppData\Local\Temp\10F3.tmp"70⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\1170.tmp"C:\Users\Admin\AppData\Local\Temp\1170.tmp"71⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\11ED.tmp"C:\Users\Admin\AppData\Local\Temp\11ED.tmp"72⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\125A.tmp"C:\Users\Admin\AppData\Local\Temp\125A.tmp"73⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\12D7.tmp"C:\Users\Admin\AppData\Local\Temp\12D7.tmp"74⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\1354.tmp"C:\Users\Admin\AppData\Local\Temp\1354.tmp"75⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\13C2.tmp"C:\Users\Admin\AppData\Local\Temp\13C2.tmp"76⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\142F.tmp"C:\Users\Admin\AppData\Local\Temp\142F.tmp"77⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\1567.tmp"C:\Users\Admin\AppData\Local\Temp\1567.tmp"78⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\1671.tmp"C:\Users\Admin\AppData\Local\Temp\1671.tmp"79⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\178A.tmp"C:\Users\Admin\AppData\Local\Temp\178A.tmp"80⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\1817.tmp"C:\Users\Admin\AppData\Local\Temp\1817.tmp"81⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\18D2.tmp"C:\Users\Admin\AppData\Local\Temp\18D2.tmp"82⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\19AD.tmp"C:\Users\Admin\AppData\Local\Temp\19AD.tmp"83⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\1A49.tmp"C:\Users\Admin\AppData\Local\Temp\1A49.tmp"84⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\1B24.tmp"C:\Users\Admin\AppData\Local\Temp\1B24.tmp"85⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"86⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"87⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\1D66.tmp"C:\Users\Admin\AppData\Local\Temp\1D66.tmp"88⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\1E51.tmp"C:\Users\Admin\AppData\Local\Temp\1E51.tmp"89⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\1EBE.tmp"C:\Users\Admin\AppData\Local\Temp\1EBE.tmp"90⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\1F3B.tmp"C:\Users\Admin\AppData\Local\Temp\1F3B.tmp"91⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\1FD7.tmp"C:\Users\Admin\AppData\Local\Temp\1FD7.tmp"92⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\20A2.tmp"C:\Users\Admin\AppData\Local\Temp\20A2.tmp"93⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\213F.tmp"C:\Users\Admin\AppData\Local\Temp\213F.tmp"94⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\2277.tmp"C:\Users\Admin\AppData\Local\Temp\2277.tmp"95⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\2362.tmp"C:\Users\Admin\AppData\Local\Temp\2362.tmp"96⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\240D.tmp"C:\Users\Admin\AppData\Local\Temp\240D.tmp"97⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\24B9.tmp"C:\Users\Admin\AppData\Local\Temp\24B9.tmp"98⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\2556.tmp"C:\Users\Admin\AppData\Local\Temp\2556.tmp"99⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\25D3.tmp"C:\Users\Admin\AppData\Local\Temp\25D3.tmp"100⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\266F.tmp"C:\Users\Admin\AppData\Local\Temp\266F.tmp"101⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\26EC.tmp"C:\Users\Admin\AppData\Local\Temp\26EC.tmp"102⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\2788.tmp"C:\Users\Admin\AppData\Local\Temp\2788.tmp"103⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\2834.tmp"C:\Users\Admin\AppData\Local\Temp\2834.tmp"104⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\28A1.tmp"C:\Users\Admin\AppData\Local\Temp\28A1.tmp"105⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\293E.tmp"C:\Users\Admin\AppData\Local\Temp\293E.tmp"106⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\29BB.tmp"C:\Users\Admin\AppData\Local\Temp\29BB.tmp"107⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\2A57.tmp"C:\Users\Admin\AppData\Local\Temp\2A57.tmp"108⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\2AE3.tmp"C:\Users\Admin\AppData\Local\Temp\2AE3.tmp"109⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\2B60.tmp"C:\Users\Admin\AppData\Local\Temp\2B60.tmp"110⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"111⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\2C5A.tmp"C:\Users\Admin\AppData\Local\Temp\2C5A.tmp"112⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"113⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\2D64.tmp"C:\Users\Admin\AppData\Local\Temp\2D64.tmp"114⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\2DE1.tmp"C:\Users\Admin\AppData\Local\Temp\2DE1.tmp"115⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\2E6E.tmp"C:\Users\Admin\AppData\Local\Temp\2E6E.tmp"116⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\2EDB.tmp"C:\Users\Admin\AppData\Local\Temp\2EDB.tmp"117⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\2F87.tmp"C:\Users\Admin\AppData\Local\Temp\2F87.tmp"118⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\30EE.tmp"C:\Users\Admin\AppData\Local\Temp\30EE.tmp"119⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\318B.tmp"C:\Users\Admin\AppData\Local\Temp\318B.tmp"120⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\3227.tmp"C:\Users\Admin\AppData\Local\Temp\3227.tmp"121⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\32A4.tmp"C:\Users\Admin\AppData\Local\Temp\32A4.tmp"122⤵PID:1748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-