Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2023, 17:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3ab6d72fc4acd5117dbda8e4ec2ea13b_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
3ab6d72fc4acd5117dbda8e4ec2ea13b_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
3ab6d72fc4acd5117dbda8e4ec2ea13b_mafia_JC.exe
-
Size
487KB
-
MD5
3ab6d72fc4acd5117dbda8e4ec2ea13b
-
SHA1
4f5902fea0ed5493b193148d6396f2b7318cd265
-
SHA256
42514086f08b6e7617b5f9f6a59cd40e5746109605d46d4d0384c1cadf854937
-
SHA512
3b2bef1daa9f94c25c41c7c6c5b781a681480bfdcf79e58547541d84062366ef75a0e98937b51a462e6cae31cfafb374aef4c60a976488fc421004f30fc22d97
-
SSDEEP
12288:HU5rCOTeiJLUIYDLFQJXKoVKWrvvETNZ:HUQOJJBaZpoVFrvvmN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2856 7E38.tmp 396 7ED5.tmp 1572 7F80.tmp 228 80A9.tmp 3404 8165.tmp 2880 8201.tmp 928 82CC.tmp 2156 8388.tmp 2640 84D0.tmp 1616 857C.tmp 992 8676.tmp 5020 8712.tmp 2568 87AE.tmp 4944 88F6.tmp 1568 89C1.tmp 548 8A5E.tmp 3216 8AEA.tmp 4168 8B77.tmp 4344 8C13.tmp 5044 8CEE.tmp 4056 8E17.tmp 5084 8EF2.tmp 2976 8F9D.tmp 3572 9069.tmp 2816 9105.tmp 4272 91B1.tmp 1468 923D.tmp 4680 92F9.tmp 4408 93B4.tmp 2876 947F.tmp 1372 951C.tmp 4768 9606.tmp 3488 96B2.tmp 4656 971F.tmp 4740 97AC.tmp 4440 9858.tmp 1060 9913.tmp 2548 99BF.tmp 1792 9A6B.tmp 3940 9AE8.tmp 3824 9B65.tmp 4900 9BE2.tmp 3348 9C6F.tmp 3284 9CFB.tmp 2844 9D88.tmp 2068 9E15.tmp 2796 9E92.tmp 4752 9F1E.tmp 4180 9F8C.tmp 4520 A009.tmp 4160 A0A5.tmp 4668 A141.tmp 3040 A1CE.tmp 1408 A27A.tmp 2240 A2F7.tmp 3220 A374.tmp 928 A400.tmp 4396 A48D.tmp 4984 A50A.tmp 2244 A587.tmp 2848 A613.tmp 5036 A6B0.tmp 2964 A71D.tmp 4596 A79A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4972 wrote to memory of 2856 4972 3ab6d72fc4acd5117dbda8e4ec2ea13b_mafia_JC.exe 82 PID 4972 wrote to memory of 2856 4972 3ab6d72fc4acd5117dbda8e4ec2ea13b_mafia_JC.exe 82 PID 4972 wrote to memory of 2856 4972 3ab6d72fc4acd5117dbda8e4ec2ea13b_mafia_JC.exe 82 PID 2856 wrote to memory of 396 2856 7E38.tmp 83 PID 2856 wrote to memory of 396 2856 7E38.tmp 83 PID 2856 wrote to memory of 396 2856 7E38.tmp 83 PID 396 wrote to memory of 1572 396 7ED5.tmp 84 PID 396 wrote to memory of 1572 396 7ED5.tmp 84 PID 396 wrote to memory of 1572 396 7ED5.tmp 84 PID 1572 wrote to memory of 228 1572 7F80.tmp 85 PID 1572 wrote to memory of 228 1572 7F80.tmp 85 PID 1572 wrote to memory of 228 1572 7F80.tmp 85 PID 228 wrote to memory of 3404 228 80A9.tmp 86 PID 228 wrote to memory of 3404 228 80A9.tmp 86 PID 228 wrote to memory of 3404 228 80A9.tmp 86 PID 3404 wrote to memory of 2880 3404 8165.tmp 87 PID 3404 wrote to memory of 2880 3404 8165.tmp 87 PID 3404 wrote to memory of 2880 3404 8165.tmp 87 PID 2880 wrote to memory of 928 2880 8201.tmp 88 PID 2880 wrote to memory of 928 2880 8201.tmp 88 PID 2880 wrote to memory of 928 2880 8201.tmp 88 PID 928 wrote to memory of 2156 928 82CC.tmp 89 PID 928 wrote to memory of 2156 928 82CC.tmp 89 PID 928 wrote to memory of 2156 928 82CC.tmp 89 PID 2156 wrote to memory of 2640 2156 8388.tmp 90 PID 2156 wrote to memory of 2640 2156 8388.tmp 90 PID 2156 wrote to memory of 2640 2156 8388.tmp 90 PID 2640 wrote to memory of 1616 2640 84D0.tmp 91 PID 2640 wrote to memory of 1616 2640 84D0.tmp 91 PID 2640 wrote to memory of 1616 2640 84D0.tmp 91 PID 1616 wrote to memory of 992 1616 857C.tmp 92 PID 1616 wrote to memory of 992 1616 857C.tmp 92 PID 1616 wrote to memory of 992 1616 857C.tmp 92 PID 992 wrote to memory of 5020 992 8676.tmp 93 PID 992 wrote to memory of 5020 992 8676.tmp 93 PID 992 wrote to memory of 5020 992 8676.tmp 93 PID 5020 wrote to memory of 2568 5020 8712.tmp 94 PID 5020 wrote to memory of 2568 5020 8712.tmp 94 PID 5020 wrote to memory of 2568 5020 8712.tmp 94 PID 2568 wrote to memory of 4944 2568 87AE.tmp 95 PID 2568 wrote to memory of 4944 2568 87AE.tmp 95 PID 2568 wrote to memory of 4944 2568 87AE.tmp 95 PID 4944 wrote to memory of 1568 4944 88F6.tmp 96 PID 4944 wrote to memory of 1568 4944 88F6.tmp 96 PID 4944 wrote to memory of 1568 4944 88F6.tmp 96 PID 1568 wrote to memory of 548 1568 89C1.tmp 97 PID 1568 wrote to memory of 548 1568 89C1.tmp 97 PID 1568 wrote to memory of 548 1568 89C1.tmp 97 PID 548 wrote to memory of 3216 548 8A5E.tmp 98 PID 548 wrote to memory of 3216 548 8A5E.tmp 98 PID 548 wrote to memory of 3216 548 8A5E.tmp 98 PID 3216 wrote to memory of 4168 3216 8AEA.tmp 99 PID 3216 wrote to memory of 4168 3216 8AEA.tmp 99 PID 3216 wrote to memory of 4168 3216 8AEA.tmp 99 PID 4168 wrote to memory of 4344 4168 8B77.tmp 102 PID 4168 wrote to memory of 4344 4168 8B77.tmp 102 PID 4168 wrote to memory of 4344 4168 8B77.tmp 102 PID 4344 wrote to memory of 5044 4344 8C13.tmp 103 PID 4344 wrote to memory of 5044 4344 8C13.tmp 103 PID 4344 wrote to memory of 5044 4344 8C13.tmp 103 PID 5044 wrote to memory of 4056 5044 8CEE.tmp 104 PID 5044 wrote to memory of 4056 5044 8CEE.tmp 104 PID 5044 wrote to memory of 4056 5044 8CEE.tmp 104 PID 4056 wrote to memory of 5084 4056 8E17.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ab6d72fc4acd5117dbda8e4ec2ea13b_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\3ab6d72fc4acd5117dbda8e4ec2ea13b_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\7E38.tmp"C:\Users\Admin\AppData\Local\Temp\7E38.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\7F80.tmp"C:\Users\Admin\AppData\Local\Temp\7F80.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\80A9.tmp"C:\Users\Admin\AppData\Local\Temp\80A9.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\8165.tmp"C:\Users\Admin\AppData\Local\Temp\8165.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\8201.tmp"C:\Users\Admin\AppData\Local\Temp\8201.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Users\Admin\AppData\Local\Temp\8388.tmp"C:\Users\Admin\AppData\Local\Temp\8388.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\84D0.tmp"C:\Users\Admin\AppData\Local\Temp\84D0.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\857C.tmp"C:\Users\Admin\AppData\Local\Temp\857C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\8676.tmp"C:\Users\Admin\AppData\Local\Temp\8676.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\8712.tmp"C:\Users\Admin\AppData\Local\Temp\8712.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\87AE.tmp"C:\Users\Admin\AppData\Local\Temp\87AE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\88F6.tmp"C:\Users\Admin\AppData\Local\Temp\88F6.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\89C1.tmp"C:\Users\Admin\AppData\Local\Temp\89C1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\8B77.tmp"C:\Users\Admin\AppData\Local\Temp\8B77.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\8C13.tmp"C:\Users\Admin\AppData\Local\Temp\8C13.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\8E17.tmp"C:\Users\Admin\AppData\Local\Temp\8E17.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"23⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"24⤵
- Executes dropped EXE
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"25⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"26⤵
- Executes dropped EXE
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\91B1.tmp"C:\Users\Admin\AppData\Local\Temp\91B1.tmp"27⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\923D.tmp"C:\Users\Admin\AppData\Local\Temp\923D.tmp"28⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\92F9.tmp"C:\Users\Admin\AppData\Local\Temp\92F9.tmp"29⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\93B4.tmp"C:\Users\Admin\AppData\Local\Temp\93B4.tmp"30⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\947F.tmp"C:\Users\Admin\AppData\Local\Temp\947F.tmp"31⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\951C.tmp"C:\Users\Admin\AppData\Local\Temp\951C.tmp"32⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\9606.tmp"C:\Users\Admin\AppData\Local\Temp\9606.tmp"33⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\96B2.tmp"C:\Users\Admin\AppData\Local\Temp\96B2.tmp"34⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"35⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"36⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"37⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"38⤵
- Executes dropped EXE
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\99BF.tmp"C:\Users\Admin\AppData\Local\Temp\99BF.tmp"39⤵
- Executes dropped EXE
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"40⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"41⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"42⤵
- Executes dropped EXE
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"43⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"44⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"45⤵
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"46⤵
- Executes dropped EXE
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\9E15.tmp"C:\Users\Admin\AppData\Local\Temp\9E15.tmp"47⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"48⤵
- Executes dropped EXE
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"49⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"50⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"51⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"52⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\A141.tmp"C:\Users\Admin\AppData\Local\Temp\A141.tmp"53⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"54⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"55⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"56⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\A374.tmp"C:\Users\Admin\AppData\Local\Temp\A374.tmp"57⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"58⤵
- Executes dropped EXE
PID:928 -
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"59⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\A50A.tmp"C:\Users\Admin\AppData\Local\Temp\A50A.tmp"60⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"61⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\A613.tmp"C:\Users\Admin\AppData\Local\Temp\A613.tmp"62⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"63⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"64⤵
- Executes dropped EXE
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"65⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\A817.tmp"C:\Users\Admin\AppData\Local\Temp\A817.tmp"66⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\A884.tmp"C:\Users\Admin\AppData\Local\Temp\A884.tmp"67⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"68⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"69⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"70⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"71⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"72⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\AB53.tmp"C:\Users\Admin\AppData\Local\Temp\AB53.tmp"73⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"74⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"75⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"76⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\AD57.tmp"C:\Users\Admin\AppData\Local\Temp\AD57.tmp"77⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"78⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\AE12.tmp"C:\Users\Admin\AppData\Local\Temp\AE12.tmp"79⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\AE70.tmp"C:\Users\Admin\AppData\Local\Temp\AE70.tmp"80⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\AF99.tmp"C:\Users\Admin\AppData\Local\Temp\AF99.tmp"81⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"82⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"83⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"84⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"85⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"86⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"87⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\B314.tmp"C:\Users\Admin\AppData\Local\Temp\B314.tmp"88⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"89⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\B42D.tmp"C:\Users\Admin\AppData\Local\Temp\B42D.tmp"90⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\B49A.tmp"C:\Users\Admin\AppData\Local\Temp\B49A.tmp"91⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\B517.tmp"C:\Users\Admin\AppData\Local\Temp\B517.tmp"92⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\B594.tmp"C:\Users\Admin\AppData\Local\Temp\B594.tmp"93⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\B602.tmp"C:\Users\Admin\AppData\Local\Temp\B602.tmp"94⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\B68E.tmp"C:\Users\Admin\AppData\Local\Temp\B68E.tmp"95⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\B70B.tmp"C:\Users\Admin\AppData\Local\Temp\B70B.tmp"96⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\B798.tmp"C:\Users\Admin\AppData\Local\Temp\B798.tmp"97⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\B824.tmp"C:\Users\Admin\AppData\Local\Temp\B824.tmp"98⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"99⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\B93E.tmp"C:\Users\Admin\AppData\Local\Temp\B93E.tmp"100⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"101⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\BA38.tmp"C:\Users\Admin\AppData\Local\Temp\BA38.tmp"102⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"103⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\BB22.tmp"C:\Users\Admin\AppData\Local\Temp\BB22.tmp"104⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"105⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"106⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\BC99.tmp"C:\Users\Admin\AppData\Local\Temp\BC99.tmp"107⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\BD16.tmp"C:\Users\Admin\AppData\Local\Temp\BD16.tmp"108⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\BD93.tmp"C:\Users\Admin\AppData\Local\Temp\BD93.tmp"109⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\BE10.tmp"C:\Users\Admin\AppData\Local\Temp\BE10.tmp"110⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"111⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"112⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"113⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\C052.tmp"C:\Users\Admin\AppData\Local\Temp\C052.tmp"114⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"115⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"116⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"117⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\C246.tmp"C:\Users\Admin\AppData\Local\Temp\C246.tmp"118⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"119⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\C340.tmp"C:\Users\Admin\AppData\Local\Temp\C340.tmp"120⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"121⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\C42B.tmp"C:\Users\Admin\AppData\Local\Temp\C42B.tmp"122⤵PID:1708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-