Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2023, 15:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
32d8abdad0ec3d06be3e0d85b8847480_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
32d8abdad0ec3d06be3e0d85b8847480_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
32d8abdad0ec3d06be3e0d85b8847480_mafia_JC.exe
-
Size
520KB
-
MD5
32d8abdad0ec3d06be3e0d85b8847480
-
SHA1
fd19424ae75d9a75143f8be46328c1a185fbb83d
-
SHA256
3e846a557d0ab66e875e39daf81ed3761fe2d31f5e858cec87ee6eb4555887b2
-
SHA512
217f7fdee92a1c2ec04e53d28227471f495c60be835ba0e2ccc0e33c05e6b2934aa1688fdc8be5ad55b3e86b4ed4c31df1479ef1ef75768dab10aabba84564c6
-
SSDEEP
12288:roRXOQjmOy10K4xJ+SPximHCwxDf7xNZ:rogQ9y10/J+SPxB3zxN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1692 67A3.tmp 4676 684F.tmp 4700 6968.tmp 2780 6A72.tmp 4644 6B5C.tmp 2392 6C18.tmp 824 6CA4.tmp 1288 6D9E.tmp 864 6E1B.tmp 2552 6F54.tmp 4028 704E.tmp 2468 7109.tmp 2888 71C5.tmp 4988 7280.tmp 224 734B.tmp 5104 7407.tmp 2908 74F1.tmp 3348 758E.tmp 464 7688.tmp 1524 7772.tmp 1048 786C.tmp 4860 7947.tmp 2556 79D3.tmp 2704 7A70.tmp 3812 7B2B.tmp 2988 7BB8.tmp 2804 7C73.tmp 368 7D0F.tmp 5032 7D8C.tmp 1608 7E77.tmp 1364 7F32.tmp 3588 7FDE.tmp 4956 80F7.tmp 2184 8184.tmp 4984 8211.tmp 3728 82AD.tmp 1776 8349.tmp 1824 83E5.tmp 3244 8472.tmp 4664 850E.tmp 1596 85E9.tmp 2872 8695.tmp 216 8722.tmp 4876 879F.tmp 3852 884A.tmp 932 88D7.tmp 4472 8944.tmp 2060 89F0.tmp 700 8A6D.tmp 3300 8B0A.tmp 2120 8B87.tmp 2036 8C23.tmp 1912 8CAF.tmp 4040 8D4C.tmp 3172 8DD8.tmp 4700 8E65.tmp 2404 8EF2.tmp 5072 8F7E.tmp 1996 8FFB.tmp 3720 9088.tmp 4392 9105.tmp 452 91B1.tmp 3416 921E.tmp 2468 929B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5052 wrote to memory of 1692 5052 32d8abdad0ec3d06be3e0d85b8847480_mafia_JC.exe 82 PID 5052 wrote to memory of 1692 5052 32d8abdad0ec3d06be3e0d85b8847480_mafia_JC.exe 82 PID 5052 wrote to memory of 1692 5052 32d8abdad0ec3d06be3e0d85b8847480_mafia_JC.exe 82 PID 1692 wrote to memory of 4676 1692 67A3.tmp 83 PID 1692 wrote to memory of 4676 1692 67A3.tmp 83 PID 1692 wrote to memory of 4676 1692 67A3.tmp 83 PID 4676 wrote to memory of 4700 4676 684F.tmp 84 PID 4676 wrote to memory of 4700 4676 684F.tmp 84 PID 4676 wrote to memory of 4700 4676 684F.tmp 84 PID 4700 wrote to memory of 2780 4700 6968.tmp 85 PID 4700 wrote to memory of 2780 4700 6968.tmp 85 PID 4700 wrote to memory of 2780 4700 6968.tmp 85 PID 2780 wrote to memory of 4644 2780 6A72.tmp 86 PID 2780 wrote to memory of 4644 2780 6A72.tmp 86 PID 2780 wrote to memory of 4644 2780 6A72.tmp 86 PID 4644 wrote to memory of 2392 4644 6B5C.tmp 87 PID 4644 wrote to memory of 2392 4644 6B5C.tmp 87 PID 4644 wrote to memory of 2392 4644 6B5C.tmp 87 PID 2392 wrote to memory of 824 2392 6C18.tmp 88 PID 2392 wrote to memory of 824 2392 6C18.tmp 88 PID 2392 wrote to memory of 824 2392 6C18.tmp 88 PID 824 wrote to memory of 1288 824 6CA4.tmp 90 PID 824 wrote to memory of 1288 824 6CA4.tmp 90 PID 824 wrote to memory of 1288 824 6CA4.tmp 90 PID 1288 wrote to memory of 864 1288 6D9E.tmp 91 PID 1288 wrote to memory of 864 1288 6D9E.tmp 91 PID 1288 wrote to memory of 864 1288 6D9E.tmp 91 PID 864 wrote to memory of 2552 864 6E1B.tmp 92 PID 864 wrote to memory of 2552 864 6E1B.tmp 92 PID 864 wrote to memory of 2552 864 6E1B.tmp 92 PID 2552 wrote to memory of 4028 2552 6F54.tmp 93 PID 2552 wrote to memory of 4028 2552 6F54.tmp 93 PID 2552 wrote to memory of 4028 2552 6F54.tmp 93 PID 4028 wrote to memory of 2468 4028 704E.tmp 94 PID 4028 wrote to memory of 2468 4028 704E.tmp 94 PID 4028 wrote to memory of 2468 4028 704E.tmp 94 PID 2468 wrote to memory of 2888 2468 7109.tmp 95 PID 2468 wrote to memory of 2888 2468 7109.tmp 95 PID 2468 wrote to memory of 2888 2468 7109.tmp 95 PID 2888 wrote to memory of 4988 2888 71C5.tmp 96 PID 2888 wrote to memory of 4988 2888 71C5.tmp 96 PID 2888 wrote to memory of 4988 2888 71C5.tmp 96 PID 4988 wrote to memory of 224 4988 7280.tmp 97 PID 4988 wrote to memory of 224 4988 7280.tmp 97 PID 4988 wrote to memory of 224 4988 7280.tmp 97 PID 224 wrote to memory of 5104 224 734B.tmp 98 PID 224 wrote to memory of 5104 224 734B.tmp 98 PID 224 wrote to memory of 5104 224 734B.tmp 98 PID 5104 wrote to memory of 2908 5104 7407.tmp 101 PID 5104 wrote to memory of 2908 5104 7407.tmp 101 PID 5104 wrote to memory of 2908 5104 7407.tmp 101 PID 2908 wrote to memory of 3348 2908 74F1.tmp 102 PID 2908 wrote to memory of 3348 2908 74F1.tmp 102 PID 2908 wrote to memory of 3348 2908 74F1.tmp 102 PID 3348 wrote to memory of 464 3348 758E.tmp 103 PID 3348 wrote to memory of 464 3348 758E.tmp 103 PID 3348 wrote to memory of 464 3348 758E.tmp 103 PID 464 wrote to memory of 1524 464 7688.tmp 104 PID 464 wrote to memory of 1524 464 7688.tmp 104 PID 464 wrote to memory of 1524 464 7688.tmp 104 PID 1524 wrote to memory of 1048 1524 7772.tmp 105 PID 1524 wrote to memory of 1048 1524 7772.tmp 105 PID 1524 wrote to memory of 1048 1524 7772.tmp 105 PID 1048 wrote to memory of 4860 1048 786C.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\32d8abdad0ec3d06be3e0d85b8847480_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\32d8abdad0ec3d06be3e0d85b8847480_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\74F1.tmp"C:\Users\Admin\AppData\Local\Temp\74F1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\7772.tmp"C:\Users\Admin\AppData\Local\Temp\7772.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\786C.tmp"C:\Users\Admin\AppData\Local\Temp\786C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"23⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\79D3.tmp"C:\Users\Admin\AppData\Local\Temp\79D3.tmp"24⤵
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\7A70.tmp"C:\Users\Admin\AppData\Local\Temp\7A70.tmp"25⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"26⤵
- Executes dropped EXE
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"27⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\7C73.tmp"C:\Users\Admin\AppData\Local\Temp\7C73.tmp"28⤵
- Executes dropped EXE
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"29⤵
- Executes dropped EXE
PID:368 -
C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"30⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\7E77.tmp"C:\Users\Admin\AppData\Local\Temp\7E77.tmp"31⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\7F32.tmp"C:\Users\Admin\AppData\Local\Temp\7F32.tmp"32⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"33⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\80F7.tmp"C:\Users\Admin\AppData\Local\Temp\80F7.tmp"34⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\8184.tmp"C:\Users\Admin\AppData\Local\Temp\8184.tmp"35⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"36⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\82AD.tmp"C:\Users\Admin\AppData\Local\Temp\82AD.tmp"37⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\8349.tmp"C:\Users\Admin\AppData\Local\Temp\8349.tmp"38⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\83E5.tmp"C:\Users\Admin\AppData\Local\Temp\83E5.tmp"39⤵
- Executes dropped EXE
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\8472.tmp"C:\Users\Admin\AppData\Local\Temp\8472.tmp"40⤵
- Executes dropped EXE
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\850E.tmp"C:\Users\Admin\AppData\Local\Temp\850E.tmp"41⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"42⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\8695.tmp"C:\Users\Admin\AppData\Local\Temp\8695.tmp"43⤵
- Executes dropped EXE
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\8722.tmp"C:\Users\Admin\AppData\Local\Temp\8722.tmp"44⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\879F.tmp"C:\Users\Admin\AppData\Local\Temp\879F.tmp"45⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"46⤵
- Executes dropped EXE
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"47⤵
- Executes dropped EXE
PID:932 -
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"48⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\89F0.tmp"C:\Users\Admin\AppData\Local\Temp\89F0.tmp"49⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"50⤵
- Executes dropped EXE
PID:700 -
C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"51⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\8B87.tmp"C:\Users\Admin\AppData\Local\Temp\8B87.tmp"52⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\8C23.tmp"C:\Users\Admin\AppData\Local\Temp\8C23.tmp"53⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"54⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"55⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"56⤵
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"57⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"58⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"59⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"60⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"61⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"62⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\91B1.tmp"C:\Users\Admin\AppData\Local\Temp\91B1.tmp"63⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\921E.tmp"C:\Users\Admin\AppData\Local\Temp\921E.tmp"64⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\929B.tmp"C:\Users\Admin\AppData\Local\Temp\929B.tmp"65⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\92F9.tmp"C:\Users\Admin\AppData\Local\Temp\92F9.tmp"66⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\9366.tmp"C:\Users\Admin\AppData\Local\Temp\9366.tmp"67⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"68⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\9460.tmp"C:\Users\Admin\AppData\Local\Temp\9460.tmp"69⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\94ED.tmp"C:\Users\Admin\AppData\Local\Temp\94ED.tmp"70⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\9599.tmp"C:\Users\Admin\AppData\Local\Temp\9599.tmp"71⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"72⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\96C2.tmp"C:\Users\Admin\AppData\Local\Temp\96C2.tmp"73⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"74⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\97DB.tmp"C:\Users\Admin\AppData\Local\Temp\97DB.tmp"75⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"76⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\98C5.tmp"C:\Users\Admin\AppData\Local\Temp\98C5.tmp"77⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"78⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"79⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"80⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"81⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"82⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"83⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"84⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"85⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\9D78.tmp"C:\Users\Admin\AppData\Local\Temp\9D78.tmp"86⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"87⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\9E72.tmp"C:\Users\Admin\AppData\Local\Temp\9E72.tmp"88⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"89⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"90⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"91⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"92⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"93⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"94⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"95⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\A26A.tmp"C:\Users\Admin\AppData\Local\Temp\A26A.tmp"96⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\A306.tmp"C:\Users\Admin\AppData\Local\Temp\A306.tmp"97⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"98⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"99⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"100⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"101⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"102⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\A671.tmp"C:\Users\Admin\AppData\Local\Temp\A671.tmp"103⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"104⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\A76B.tmp"C:\Users\Admin\AppData\Local\Temp\A76B.tmp"105⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"106⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"107⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\A911.tmp"C:\Users\Admin\AppData\Local\Temp\A911.tmp"108⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"109⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"110⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"111⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"112⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"113⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"114⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"115⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\AD76.tmp"C:\Users\Admin\AppData\Local\Temp\AD76.tmp"116⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"117⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\AE70.tmp"C:\Users\Admin\AppData\Local\Temp\AE70.tmp"118⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"119⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"120⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\B006.tmp"C:\Users\Admin\AppData\Local\Temp\B006.tmp"121⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\B074.tmp"C:\Users\Admin\AppData\Local\Temp\B074.tmp"122⤵PID:832
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-