Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
20/08/2023, 11:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
55d2773ae6fca4573ac79e1571d3692e_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
55d2773ae6fca4573ac79e1571d3692e_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
55d2773ae6fca4573ac79e1571d3692e_mafia_JC.exe
-
Size
520KB
-
MD5
55d2773ae6fca4573ac79e1571d3692e
-
SHA1
d0bfbd8edabad30df85aacbf1542f623f770dc80
-
SHA256
070c5a527e6e97d4ef86e999c5a950662bce6e125f9feff49b4fa5e82278edb4
-
SHA512
91460872188f1952df33397d5f86f48b74dd1b7f95103b5eb208909f2a27f5c4402a48b3d61529301877e19c10e6941f4a21c96a88d8619eea5e87a253b55df5
-
SSDEEP
12288:gj8fuxR21t5i8fPCQSLYedo+l4bGjYGUAVcHkSxNZ:gj8fuK1GYaQSYwk0fuZN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3904 8A4E.tmp 2860 8AFA.tmp 3044 8BE4.tmp 1360 8CEE.tmp 2600 8DC9.tmp 3296 8EB3.tmp 680 8F8E.tmp 5096 9078.tmp 3284 9143.tmp 1356 91EF.tmp 2684 929B.tmp 4864 9347.tmp 5028 9422.tmp 320 94DD.tmp 4576 9589.tmp 4240 9625.tmp 2424 96B2.tmp 2740 972F.tmp 4332 980A.tmp 4560 99CF.tmp 1984 9A7B.tmp 1620 9B46.tmp 5024 9BE2.tmp 4976 9C5F.tmp 3940 9D2A.tmp 1308 9E34.tmp 4604 9F4D.tmp 4472 A047.tmp 5048 A131.tmp 1632 A21C.tmp 4608 A299.tmp 4592 A364.tmp 2436 A42F.tmp 4220 A4DB.tmp 1868 A558.tmp 4632 A5C5.tmp 4440 A652.tmp 796 A6FE.tmp 2360 A79A.tmp 4780 A807.tmp 4336 A884.tmp 508 A921.tmp 4144 A9CD.tmp 2512 AA59.tmp 5032 AAF5.tmp 1848 AB92.tmp 2732 AC1E.tmp 3312 ACBB.tmp 732 AD38.tmp 4884 ADC4.tmp 5044 AE60.tmp 3840 AEED.tmp 1760 AF6A.tmp 3700 B045.tmp 544 B0A3.tmp 2092 B120.tmp 1572 B19D.tmp 2140 B20A.tmp 408 B277.tmp 3204 B314.tmp 3764 B391.tmp 4452 B40E.tmp 3168 B4AA.tmp 60 B546.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1176 wrote to memory of 3904 1176 55d2773ae6fca4573ac79e1571d3692e_mafia_JC.exe 82 PID 1176 wrote to memory of 3904 1176 55d2773ae6fca4573ac79e1571d3692e_mafia_JC.exe 82 PID 1176 wrote to memory of 3904 1176 55d2773ae6fca4573ac79e1571d3692e_mafia_JC.exe 82 PID 3904 wrote to memory of 2860 3904 8A4E.tmp 83 PID 3904 wrote to memory of 2860 3904 8A4E.tmp 83 PID 3904 wrote to memory of 2860 3904 8A4E.tmp 83 PID 2860 wrote to memory of 3044 2860 8AFA.tmp 84 PID 2860 wrote to memory of 3044 2860 8AFA.tmp 84 PID 2860 wrote to memory of 3044 2860 8AFA.tmp 84 PID 3044 wrote to memory of 1360 3044 8BE4.tmp 85 PID 3044 wrote to memory of 1360 3044 8BE4.tmp 85 PID 3044 wrote to memory of 1360 3044 8BE4.tmp 85 PID 1360 wrote to memory of 2600 1360 8CEE.tmp 86 PID 1360 wrote to memory of 2600 1360 8CEE.tmp 86 PID 1360 wrote to memory of 2600 1360 8CEE.tmp 86 PID 2600 wrote to memory of 3296 2600 8DC9.tmp 87 PID 2600 wrote to memory of 3296 2600 8DC9.tmp 87 PID 2600 wrote to memory of 3296 2600 8DC9.tmp 87 PID 3296 wrote to memory of 680 3296 8EB3.tmp 88 PID 3296 wrote to memory of 680 3296 8EB3.tmp 88 PID 3296 wrote to memory of 680 3296 8EB3.tmp 88 PID 680 wrote to memory of 5096 680 8F8E.tmp 89 PID 680 wrote to memory of 5096 680 8F8E.tmp 89 PID 680 wrote to memory of 5096 680 8F8E.tmp 89 PID 5096 wrote to memory of 3284 5096 9078.tmp 90 PID 5096 wrote to memory of 3284 5096 9078.tmp 90 PID 5096 wrote to memory of 3284 5096 9078.tmp 90 PID 3284 wrote to memory of 1356 3284 9143.tmp 91 PID 3284 wrote to memory of 1356 3284 9143.tmp 91 PID 3284 wrote to memory of 1356 3284 9143.tmp 91 PID 1356 wrote to memory of 2684 1356 91EF.tmp 92 PID 1356 wrote to memory of 2684 1356 91EF.tmp 92 PID 1356 wrote to memory of 2684 1356 91EF.tmp 92 PID 2684 wrote to memory of 4864 2684 929B.tmp 93 PID 2684 wrote to memory of 4864 2684 929B.tmp 93 PID 2684 wrote to memory of 4864 2684 929B.tmp 93 PID 4864 wrote to memory of 5028 4864 9347.tmp 94 PID 4864 wrote to memory of 5028 4864 9347.tmp 94 PID 4864 wrote to memory of 5028 4864 9347.tmp 94 PID 5028 wrote to memory of 320 5028 9422.tmp 95 PID 5028 wrote to memory of 320 5028 9422.tmp 95 PID 5028 wrote to memory of 320 5028 9422.tmp 95 PID 320 wrote to memory of 4576 320 94DD.tmp 96 PID 320 wrote to memory of 4576 320 94DD.tmp 96 PID 320 wrote to memory of 4576 320 94DD.tmp 96 PID 4576 wrote to memory of 4240 4576 9589.tmp 97 PID 4576 wrote to memory of 4240 4576 9589.tmp 97 PID 4576 wrote to memory of 4240 4576 9589.tmp 97 PID 4240 wrote to memory of 2424 4240 9625.tmp 98 PID 4240 wrote to memory of 2424 4240 9625.tmp 98 PID 4240 wrote to memory of 2424 4240 9625.tmp 98 PID 2424 wrote to memory of 2740 2424 96B2.tmp 99 PID 2424 wrote to memory of 2740 2424 96B2.tmp 99 PID 2424 wrote to memory of 2740 2424 96B2.tmp 99 PID 2740 wrote to memory of 4332 2740 972F.tmp 100 PID 2740 wrote to memory of 4332 2740 972F.tmp 100 PID 2740 wrote to memory of 4332 2740 972F.tmp 100 PID 4332 wrote to memory of 4560 4332 980A.tmp 101 PID 4332 wrote to memory of 4560 4332 980A.tmp 101 PID 4332 wrote to memory of 4560 4332 980A.tmp 101 PID 4560 wrote to memory of 1984 4560 99CF.tmp 102 PID 4560 wrote to memory of 1984 4560 99CF.tmp 102 PID 4560 wrote to memory of 1984 4560 99CF.tmp 102 PID 1984 wrote to memory of 1620 1984 9A7B.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\55d2773ae6fca4573ac79e1571d3692e_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\55d2773ae6fca4573ac79e1571d3692e_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\9078.tmp"C:\Users\Admin\AppData\Local\Temp\9078.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\9143.tmp"C:\Users\Admin\AppData\Local\Temp\9143.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\91EF.tmp"C:\Users\Admin\AppData\Local\Temp\91EF.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\929B.tmp"C:\Users\Admin\AppData\Local\Temp\929B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\9422.tmp"C:\Users\Admin\AppData\Local\Temp\9422.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\94DD.tmp"C:\Users\Admin\AppData\Local\Temp\94DD.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\9625.tmp"C:\Users\Admin\AppData\Local\Temp\9625.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\96B2.tmp"C:\Users\Admin\AppData\Local\Temp\96B2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\972F.tmp"C:\Users\Admin\AppData\Local\Temp\972F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"23⤵
- Executes dropped EXE
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"24⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"25⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"26⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"27⤵
- Executes dropped EXE
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"28⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\A047.tmp"C:\Users\Admin\AppData\Local\Temp\A047.tmp"29⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"30⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\A21C.tmp"C:\Users\Admin\AppData\Local\Temp\A21C.tmp"31⤵
- Executes dropped EXE
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\A299.tmp"C:\Users\Admin\AppData\Local\Temp\A299.tmp"32⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\A364.tmp"C:\Users\Admin\AppData\Local\Temp\A364.tmp"33⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"34⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"35⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"36⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"37⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"38⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"39⤵
- Executes dropped EXE
PID:796 -
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"40⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"41⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\A884.tmp"C:\Users\Admin\AppData\Local\Temp\A884.tmp"42⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\A921.tmp"C:\Users\Admin\AppData\Local\Temp\A921.tmp"43⤵
- Executes dropped EXE
PID:508 -
C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"44⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\AA59.tmp"C:\Users\Admin\AppData\Local\Temp\AA59.tmp"45⤵
- Executes dropped EXE
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"46⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\AB92.tmp"C:\Users\Admin\AppData\Local\Temp\AB92.tmp"47⤵
- Executes dropped EXE
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"48⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"49⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\AD38.tmp"C:\Users\Admin\AppData\Local\Temp\AD38.tmp"50⤵
- Executes dropped EXE
PID:732 -
C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"51⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\AE60.tmp"C:\Users\Admin\AppData\Local\Temp\AE60.tmp"52⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"53⤵
- Executes dropped EXE
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"54⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\B045.tmp"C:\Users\Admin\AppData\Local\Temp\B045.tmp"55⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"56⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\B120.tmp"C:\Users\Admin\AppData\Local\Temp\B120.tmp"57⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\B19D.tmp"C:\Users\Admin\AppData\Local\Temp\B19D.tmp"58⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\B20A.tmp"C:\Users\Admin\AppData\Local\Temp\B20A.tmp"59⤵
- Executes dropped EXE
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\B277.tmp"C:\Users\Admin\AppData\Local\Temp\B277.tmp"60⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\B314.tmp"C:\Users\Admin\AppData\Local\Temp\B314.tmp"61⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\B391.tmp"C:\Users\Admin\AppData\Local\Temp\B391.tmp"62⤵
- Executes dropped EXE
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\B40E.tmp"C:\Users\Admin\AppData\Local\Temp\B40E.tmp"63⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"64⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\B546.tmp"C:\Users\Admin\AppData\Local\Temp\B546.tmp"65⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"66⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\B66F.tmp"C:\Users\Admin\AppData\Local\Temp\B66F.tmp"67⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"68⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"69⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\B844.tmp"C:\Users\Admin\AppData\Local\Temp\B844.tmp"70⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"71⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\B96D.tmp"C:\Users\Admin\AppData\Local\Temp\B96D.tmp"72⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"73⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\BA86.tmp"C:\Users\Admin\AppData\Local\Temp\BA86.tmp"74⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\BB32.tmp"C:\Users\Admin\AppData\Local\Temp\BB32.tmp"75⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"76⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"77⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"78⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\BD45.tmp"C:\Users\Admin\AppData\Local\Temp\BD45.tmp"79⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"80⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"81⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"82⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\BF29.tmp"C:\Users\Admin\AppData\Local\Temp\BF29.tmp"83⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"84⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\C043.tmp"C:\Users\Admin\AppData\Local\Temp\C043.tmp"85⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"86⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"87⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"88⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\C285.tmp"C:\Users\Admin\AppData\Local\Temp\C285.tmp"89⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\C302.tmp"C:\Users\Admin\AppData\Local\Temp\C302.tmp"90⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\C36F.tmp"C:\Users\Admin\AppData\Local\Temp\C36F.tmp"91⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"92⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\C498.tmp"C:\Users\Admin\AppData\Local\Temp\C498.tmp"93⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\C505.tmp"C:\Users\Admin\AppData\Local\Temp\C505.tmp"94⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\C592.tmp"C:\Users\Admin\AppData\Local\Temp\C592.tmp"95⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"96⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\C68C.tmp"C:\Users\Admin\AppData\Local\Temp\C68C.tmp"97⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\C728.tmp"C:\Users\Admin\AppData\Local\Temp\C728.tmp"98⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"99⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\C861.tmp"C:\Users\Admin\AppData\Local\Temp\C861.tmp"100⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"101⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\C95B.tmp"C:\Users\Admin\AppData\Local\Temp\C95B.tmp"102⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\CA55.tmp"C:\Users\Admin\AppData\Local\Temp\CA55.tmp"103⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\CAC2.tmp"C:\Users\Admin\AppData\Local\Temp\CAC2.tmp"104⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\CB3F.tmp"C:\Users\Admin\AppData\Local\Temp\CB3F.tmp"105⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"106⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\CC78.tmp"C:\Users\Admin\AppData\Local\Temp\CC78.tmp"107⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\CD14.tmp"C:\Users\Admin\AppData\Local\Temp\CD14.tmp"108⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"109⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\CE3D.tmp"C:\Users\Admin\AppData\Local\Temp\CE3D.tmp"110⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\CEC9.tmp"C:\Users\Admin\AppData\Local\Temp\CEC9.tmp"111⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\CF75.tmp"C:\Users\Admin\AppData\Local\Temp\CF75.tmp"112⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\D011.tmp"C:\Users\Admin\AppData\Local\Temp\D011.tmp"113⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\D07F.tmp"C:\Users\Admin\AppData\Local\Temp\D07F.tmp"114⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\D11B.tmp"C:\Users\Admin\AppData\Local\Temp\D11B.tmp"115⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\D1A8.tmp"C:\Users\Admin\AppData\Local\Temp\D1A8.tmp"116⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\D215.tmp"C:\Users\Admin\AppData\Local\Temp\D215.tmp"117⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\D2A2.tmp"C:\Users\Admin\AppData\Local\Temp\D2A2.tmp"118⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\D32E.tmp"C:\Users\Admin\AppData\Local\Temp\D32E.tmp"119⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"120⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\D448.tmp"C:\Users\Admin\AppData\Local\Temp\D448.tmp"121⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"122⤵PID:4436
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-