Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2023, 12:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3f3e5ef3e12d6508d62a1f3551ee0313_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
3f3e5ef3e12d6508d62a1f3551ee0313_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
3f3e5ef3e12d6508d62a1f3551ee0313_mafia_JC.exe
-
Size
486KB
-
MD5
3f3e5ef3e12d6508d62a1f3551ee0313
-
SHA1
a4feb3c71771f7bb9731f67273968fc1353e571a
-
SHA256
302cc53a353c711b3cc92c20bf797a88d0b7fbfdcea9a9fd409298bec65c80d7
-
SHA512
0d5f28ad33a8430b1fb08b8f7fbe7b0c7ee1a868129b277a59c3dcf7b0b484bedfbb412483d4c394a1e7ad4460ea12325912b20733705423aa563ca27d7d12ed
-
SSDEEP
12288:UU5rCOTeiDkKUKKfb9H01Q0s16srxFECNZ:UUQOJDsKKNQQ6wxXN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5108 788B.tmp 980 7947.tmp 3284 7A41.tmp 4012 7B1B.tmp 432 7C06.tmp 1620 7D0F.tmp 3052 7DBB.tmp 4896 7EF4.tmp 3628 801D.tmp 4884 8126.tmp 4384 81F1.tmp 1496 831A.tmp 3768 83D6.tmp 3716 84B1.tmp 4980 857C.tmp 2088 8637.tmp 5100 8722.tmp 2732 87FC.tmp 2648 88A8.tmp 4780 8973.tmp 3464 8A10.tmp 3328 8ACB.tmp 2704 8B67.tmp 4360 8C23.tmp 1840 8D1D.tmp 4220 8E07.tmp 5064 8EE2.tmp 312 8F9D.tmp 4580 9069.tmp 3060 9163.tmp 3432 925D.tmp 5036 9308.tmp 5056 93A5.tmp 4664 9441.tmp 2840 949F.tmp 2620 950C.tmp 3044 9579.tmp 1804 9635.tmp 4412 96C2.tmp 1684 976D.tmp 2940 97DB.tmp 4592 9887.tmp 1852 9913.tmp 2104 9990.tmp 1108 9A1D.tmp 4300 9A9A.tmp 2156 9B17.tmp 4576 9B94.tmp 4984 9C11.tmp 1216 9CAD.tmp 2368 9D2A.tmp 980 9DB7.tmp 396 9E43.tmp 2564 9EC0.tmp 3732 9F2E.tmp 1152 9FBA.tmp 368 A047.tmp 3800 A0E3.tmp 3276 A160.tmp 3940 A1ED.tmp 3824 A27A.tmp 1464 A316.tmp 3232 A393.tmp 2436 A42F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1676 wrote to memory of 5108 1676 3f3e5ef3e12d6508d62a1f3551ee0313_mafia_JC.exe 81 PID 1676 wrote to memory of 5108 1676 3f3e5ef3e12d6508d62a1f3551ee0313_mafia_JC.exe 81 PID 1676 wrote to memory of 5108 1676 3f3e5ef3e12d6508d62a1f3551ee0313_mafia_JC.exe 81 PID 5108 wrote to memory of 980 5108 788B.tmp 82 PID 5108 wrote to memory of 980 5108 788B.tmp 82 PID 5108 wrote to memory of 980 5108 788B.tmp 82 PID 980 wrote to memory of 3284 980 7947.tmp 83 PID 980 wrote to memory of 3284 980 7947.tmp 83 PID 980 wrote to memory of 3284 980 7947.tmp 83 PID 3284 wrote to memory of 4012 3284 7A41.tmp 84 PID 3284 wrote to memory of 4012 3284 7A41.tmp 84 PID 3284 wrote to memory of 4012 3284 7A41.tmp 84 PID 4012 wrote to memory of 432 4012 7B1B.tmp 85 PID 4012 wrote to memory of 432 4012 7B1B.tmp 85 PID 4012 wrote to memory of 432 4012 7B1B.tmp 85 PID 432 wrote to memory of 1620 432 7C06.tmp 86 PID 432 wrote to memory of 1620 432 7C06.tmp 86 PID 432 wrote to memory of 1620 432 7C06.tmp 86 PID 1620 wrote to memory of 3052 1620 7D0F.tmp 87 PID 1620 wrote to memory of 3052 1620 7D0F.tmp 87 PID 1620 wrote to memory of 3052 1620 7D0F.tmp 87 PID 3052 wrote to memory of 4896 3052 7DBB.tmp 88 PID 3052 wrote to memory of 4896 3052 7DBB.tmp 88 PID 3052 wrote to memory of 4896 3052 7DBB.tmp 88 PID 4896 wrote to memory of 3628 4896 7EF4.tmp 89 PID 4896 wrote to memory of 3628 4896 7EF4.tmp 89 PID 4896 wrote to memory of 3628 4896 7EF4.tmp 89 PID 3628 wrote to memory of 4884 3628 801D.tmp 90 PID 3628 wrote to memory of 4884 3628 801D.tmp 90 PID 3628 wrote to memory of 4884 3628 801D.tmp 90 PID 4884 wrote to memory of 4384 4884 8126.tmp 91 PID 4884 wrote to memory of 4384 4884 8126.tmp 91 PID 4884 wrote to memory of 4384 4884 8126.tmp 91 PID 4384 wrote to memory of 1496 4384 81F1.tmp 92 PID 4384 wrote to memory of 1496 4384 81F1.tmp 92 PID 4384 wrote to memory of 1496 4384 81F1.tmp 92 PID 1496 wrote to memory of 3768 1496 831A.tmp 93 PID 1496 wrote to memory of 3768 1496 831A.tmp 93 PID 1496 wrote to memory of 3768 1496 831A.tmp 93 PID 3768 wrote to memory of 3716 3768 83D6.tmp 94 PID 3768 wrote to memory of 3716 3768 83D6.tmp 94 PID 3768 wrote to memory of 3716 3768 83D6.tmp 94 PID 3716 wrote to memory of 4980 3716 84B1.tmp 95 PID 3716 wrote to memory of 4980 3716 84B1.tmp 95 PID 3716 wrote to memory of 4980 3716 84B1.tmp 95 PID 4980 wrote to memory of 2088 4980 857C.tmp 96 PID 4980 wrote to memory of 2088 4980 857C.tmp 96 PID 4980 wrote to memory of 2088 4980 857C.tmp 96 PID 2088 wrote to memory of 5100 2088 8637.tmp 98 PID 2088 wrote to memory of 5100 2088 8637.tmp 98 PID 2088 wrote to memory of 5100 2088 8637.tmp 98 PID 5100 wrote to memory of 2732 5100 8722.tmp 99 PID 5100 wrote to memory of 2732 5100 8722.tmp 99 PID 5100 wrote to memory of 2732 5100 8722.tmp 99 PID 2732 wrote to memory of 2648 2732 87FC.tmp 100 PID 2732 wrote to memory of 2648 2732 87FC.tmp 100 PID 2732 wrote to memory of 2648 2732 87FC.tmp 100 PID 2648 wrote to memory of 4780 2648 88A8.tmp 101 PID 2648 wrote to memory of 4780 2648 88A8.tmp 101 PID 2648 wrote to memory of 4780 2648 88A8.tmp 101 PID 4780 wrote to memory of 3464 4780 8973.tmp 102 PID 4780 wrote to memory of 3464 4780 8973.tmp 102 PID 4780 wrote to memory of 3464 4780 8973.tmp 102 PID 3464 wrote to memory of 3328 3464 8A10.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f3e5ef3e12d6508d62a1f3551ee0313_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\3f3e5ef3e12d6508d62a1f3551ee0313_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\788B.tmp"C:\Users\Admin\AppData\Local\Temp\788B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\7C06.tmp"C:\Users\Admin\AppData\Local\Temp\7C06.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\801D.tmp"C:\Users\Admin\AppData\Local\Temp\801D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\8126.tmp"C:\Users\Admin\AppData\Local\Temp\8126.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\81F1.tmp"C:\Users\Admin\AppData\Local\Temp\81F1.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\83D6.tmp"C:\Users\Admin\AppData\Local\Temp\83D6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\84B1.tmp"C:\Users\Admin\AppData\Local\Temp\84B1.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\857C.tmp"C:\Users\Admin\AppData\Local\Temp\857C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\8637.tmp"C:\Users\Admin\AppData\Local\Temp\8637.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\8722.tmp"C:\Users\Admin\AppData\Local\Temp\8722.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\87FC.tmp"C:\Users\Admin\AppData\Local\Temp\87FC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\88A8.tmp"C:\Users\Admin\AppData\Local\Temp\88A8.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\8973.tmp"C:\Users\Admin\AppData\Local\Temp\8973.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\8A10.tmp"C:\Users\Admin\AppData\Local\Temp\8A10.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"23⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\8B67.tmp"C:\Users\Admin\AppData\Local\Temp\8B67.tmp"24⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\8C23.tmp"C:\Users\Admin\AppData\Local\Temp\8C23.tmp"25⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"26⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\8E07.tmp"C:\Users\Admin\AppData\Local\Temp\8E07.tmp"27⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"28⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"29⤵
- Executes dropped EXE
PID:312 -
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"30⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\9163.tmp"C:\Users\Admin\AppData\Local\Temp\9163.tmp"31⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"32⤵
- Executes dropped EXE
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\9308.tmp"C:\Users\Admin\AppData\Local\Temp\9308.tmp"33⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\93A5.tmp"C:\Users\Admin\AppData\Local\Temp\93A5.tmp"34⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\9441.tmp"C:\Users\Admin\AppData\Local\Temp\9441.tmp"35⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"36⤵
- Executes dropped EXE
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\950C.tmp"C:\Users\Admin\AppData\Local\Temp\950C.tmp"37⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\9579.tmp"C:\Users\Admin\AppData\Local\Temp\9579.tmp"38⤵
- Executes dropped EXE
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"39⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\96C2.tmp"C:\Users\Admin\AppData\Local\Temp\96C2.tmp"40⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\976D.tmp"C:\Users\Admin\AppData\Local\Temp\976D.tmp"41⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\97DB.tmp"C:\Users\Admin\AppData\Local\Temp\97DB.tmp"42⤵
- Executes dropped EXE
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"43⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"44⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"45⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"46⤵
- Executes dropped EXE
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"47⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"48⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"49⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"50⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"51⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"52⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"53⤵
- Executes dropped EXE
PID:980 -
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"54⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"55⤵
- Executes dropped EXE
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"56⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"57⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\A047.tmp"C:\Users\Admin\AppData\Local\Temp\A047.tmp"58⤵
- Executes dropped EXE
PID:368 -
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"59⤵
- Executes dropped EXE
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\A160.tmp"C:\Users\Admin\AppData\Local\Temp\A160.tmp"60⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"61⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"62⤵
- Executes dropped EXE
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"63⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"64⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"65⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"66⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\A539.tmp"C:\Users\Admin\AppData\Local\Temp\A539.tmp"67⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"68⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\A662.tmp"C:\Users\Admin\AppData\Local\Temp\A662.tmp"69⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"70⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"71⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\A827.tmp"C:\Users\Admin\AppData\Local\Temp\A827.tmp"72⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"73⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\A950.tmp"C:\Users\Admin\AppData\Local\Temp\A950.tmp"74⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"75⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"76⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"77⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"78⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"79⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"80⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"81⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\AD57.tmp"C:\Users\Admin\AppData\Local\Temp\AD57.tmp"82⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"83⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\AE41.tmp"C:\Users\Admin\AppData\Local\Temp\AE41.tmp"84⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"85⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"86⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"87⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\B045.tmp"C:\Users\Admin\AppData\Local\Temp\B045.tmp"88⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"89⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\B110.tmp"C:\Users\Admin\AppData\Local\Temp\B110.tmp"90⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"91⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"92⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"93⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\B304.tmp"C:\Users\Admin\AppData\Local\Temp\B304.tmp"94⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\B391.tmp"C:\Users\Admin\AppData\Local\Temp\B391.tmp"95⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"96⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"97⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\B527.tmp"C:\Users\Admin\AppData\Local\Temp\B527.tmp"98⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"99⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\B611.tmp"C:\Users\Admin\AppData\Local\Temp\B611.tmp"100⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\B67F.tmp"C:\Users\Admin\AppData\Local\Temp\B67F.tmp"101⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"102⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\B73A.tmp"C:\Users\Admin\AppData\Local\Temp\B73A.tmp"103⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\B788.tmp"C:\Users\Admin\AppData\Local\Temp\B788.tmp"104⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"105⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\B892.tmp"C:\Users\Admin\AppData\Local\Temp\B892.tmp"106⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\B90F.tmp"C:\Users\Admin\AppData\Local\Temp\B90F.tmp"107⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\B99B.tmp"C:\Users\Admin\AppData\Local\Temp\B99B.tmp"108⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\BA47.tmp"C:\Users\Admin\AppData\Local\Temp\BA47.tmp"109⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"110⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"111⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"112⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"113⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"114⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\BD45.tmp"C:\Users\Admin\AppData\Local\Temp\BD45.tmp"115⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"116⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"117⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"118⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"119⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\BF77.tmp"C:\Users\Admin\AppData\Local\Temp\BF77.tmp"120⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\C004.tmp"C:\Users\Admin\AppData\Local\Temp\C004.tmp"121⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\C071.tmp"C:\Users\Admin\AppData\Local\Temp\C071.tmp"122⤵PID:2000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-