Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2023, 15:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5d724eea8a910c04343c2f01f6c1bdce_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
5d724eea8a910c04343c2f01f6c1bdce_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
5d724eea8a910c04343c2f01f6c1bdce_mafia_JC.exe
-
Size
527KB
-
MD5
5d724eea8a910c04343c2f01f6c1bdce
-
SHA1
9250f510b5daf729c2c21d7216055d6a67a2283c
-
SHA256
b3856614c51febdfe5f908816c44320a41aa2464aa370d2ce76f2a232417c5e9
-
SHA512
374af85ce094276af6b95612905cef0aed182f0b22121a637c2cae5fac770d1c072f408a81951160c3aa78ffeb8ec07ac55c177d9652795dca7c9a77865136f6
-
SSDEEP
12288:fU5rCOTeidSA4/Sh/n+aZeuv9EykWFv2/DZu:fUQOJdsJa11EynV2/Do
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2884 668A.tmp 3192 6745.tmp 5092 6810.tmp 216 68DC.tmp 1276 69B6.tmp 4792 6A53.tmp 1304 6AFE.tmp 2892 6BE9.tmp 4836 6CA4.tmp 3264 6D41.tmp 3004 6E1B.tmp 1176 6ED7.tmp 2104 6FA2.tmp 4676 70AC.tmp 2568 71D4.tmp 4552 7280.tmp 1832 735B.tmp 4440 73E8.tmp 1856 7474.tmp 2696 757E.tmp 3680 761A.tmp 5108 76D6.tmp 2552 77D0.tmp 212 786C.tmp 4820 7956.tmp 4936 7A31.tmp 5016 7ADD.tmp 1180 7B79.tmp 2960 7C35.tmp 4704 7CB2.tmp 1596 7DAC.tmp 4892 7E86.tmp 4044 7F61.tmp 4692 7FEE.tmp 1064 807A.tmp 3972 8107.tmp 4008 8174.tmp 1996 81F1.tmp 3688 828E.tmp 4160 832A.tmp 364 83B7.tmp 5064 8443.tmp 4904 84D0.tmp 3240 858B.tmp 1792 85F9.tmp 1680 8676.tmp 4480 86F3.tmp 4316 879F.tmp 4272 883B.tmp 3416 88D7.tmp 1244 8973.tmp 3824 8A10.tmp 4060 8A8D.tmp 3600 8B0A.tmp 1208 8B87.tmp 1548 8BF4.tmp 3192 8C71.tmp 4740 8CEE.tmp 1076 8D7B.tmp 2304 8E07.tmp 1276 8E84.tmp 2548 8F11.tmp 4396 8F6F.tmp 2016 901A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1820 wrote to memory of 2884 1820 5d724eea8a910c04343c2f01f6c1bdce_mafia_JC.exe 81 PID 1820 wrote to memory of 2884 1820 5d724eea8a910c04343c2f01f6c1bdce_mafia_JC.exe 81 PID 1820 wrote to memory of 2884 1820 5d724eea8a910c04343c2f01f6c1bdce_mafia_JC.exe 81 PID 2884 wrote to memory of 3192 2884 668A.tmp 82 PID 2884 wrote to memory of 3192 2884 668A.tmp 82 PID 2884 wrote to memory of 3192 2884 668A.tmp 82 PID 3192 wrote to memory of 5092 3192 6745.tmp 83 PID 3192 wrote to memory of 5092 3192 6745.tmp 83 PID 3192 wrote to memory of 5092 3192 6745.tmp 83 PID 5092 wrote to memory of 216 5092 6810.tmp 84 PID 5092 wrote to memory of 216 5092 6810.tmp 84 PID 5092 wrote to memory of 216 5092 6810.tmp 84 PID 216 wrote to memory of 1276 216 68DC.tmp 85 PID 216 wrote to memory of 1276 216 68DC.tmp 85 PID 216 wrote to memory of 1276 216 68DC.tmp 85 PID 1276 wrote to memory of 4792 1276 69B6.tmp 86 PID 1276 wrote to memory of 4792 1276 69B6.tmp 86 PID 1276 wrote to memory of 4792 1276 69B6.tmp 86 PID 4792 wrote to memory of 1304 4792 6A53.tmp 87 PID 4792 wrote to memory of 1304 4792 6A53.tmp 87 PID 4792 wrote to memory of 1304 4792 6A53.tmp 87 PID 1304 wrote to memory of 2892 1304 6AFE.tmp 88 PID 1304 wrote to memory of 2892 1304 6AFE.tmp 88 PID 1304 wrote to memory of 2892 1304 6AFE.tmp 88 PID 2892 wrote to memory of 4836 2892 6BE9.tmp 90 PID 2892 wrote to memory of 4836 2892 6BE9.tmp 90 PID 2892 wrote to memory of 4836 2892 6BE9.tmp 90 PID 4836 wrote to memory of 3264 4836 6CA4.tmp 91 PID 4836 wrote to memory of 3264 4836 6CA4.tmp 91 PID 4836 wrote to memory of 3264 4836 6CA4.tmp 91 PID 3264 wrote to memory of 3004 3264 6D41.tmp 92 PID 3264 wrote to memory of 3004 3264 6D41.tmp 92 PID 3264 wrote to memory of 3004 3264 6D41.tmp 92 PID 3004 wrote to memory of 1176 3004 6E1B.tmp 93 PID 3004 wrote to memory of 1176 3004 6E1B.tmp 93 PID 3004 wrote to memory of 1176 3004 6E1B.tmp 93 PID 1176 wrote to memory of 2104 1176 6ED7.tmp 94 PID 1176 wrote to memory of 2104 1176 6ED7.tmp 94 PID 1176 wrote to memory of 2104 1176 6ED7.tmp 94 PID 2104 wrote to memory of 4676 2104 6FA2.tmp 95 PID 2104 wrote to memory of 4676 2104 6FA2.tmp 95 PID 2104 wrote to memory of 4676 2104 6FA2.tmp 95 PID 4676 wrote to memory of 2568 4676 70AC.tmp 96 PID 4676 wrote to memory of 2568 4676 70AC.tmp 96 PID 4676 wrote to memory of 2568 4676 70AC.tmp 96 PID 2568 wrote to memory of 4552 2568 71D4.tmp 97 PID 2568 wrote to memory of 4552 2568 71D4.tmp 97 PID 2568 wrote to memory of 4552 2568 71D4.tmp 97 PID 4552 wrote to memory of 1832 4552 7280.tmp 98 PID 4552 wrote to memory of 1832 4552 7280.tmp 98 PID 4552 wrote to memory of 1832 4552 7280.tmp 98 PID 1832 wrote to memory of 4440 1832 735B.tmp 99 PID 1832 wrote to memory of 4440 1832 735B.tmp 99 PID 1832 wrote to memory of 4440 1832 735B.tmp 99 PID 4440 wrote to memory of 1856 4440 73E8.tmp 100 PID 4440 wrote to memory of 1856 4440 73E8.tmp 100 PID 4440 wrote to memory of 1856 4440 73E8.tmp 100 PID 1856 wrote to memory of 2696 1856 7474.tmp 103 PID 1856 wrote to memory of 2696 1856 7474.tmp 103 PID 1856 wrote to memory of 2696 1856 7474.tmp 103 PID 2696 wrote to memory of 3680 2696 757E.tmp 104 PID 2696 wrote to memory of 3680 2696 757E.tmp 104 PID 2696 wrote to memory of 3680 2696 757E.tmp 104 PID 3680 wrote to memory of 5108 3680 761A.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d724eea8a910c04343c2f01f6c1bdce_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\5d724eea8a910c04343c2f01f6c1bdce_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\6745.tmp"C:\Users\Admin\AppData\Local\Temp\6745.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\73E8.tmp"C:\Users\Admin\AppData\Local\Temp\73E8.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"23⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"24⤵
- Executes dropped EXE
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\786C.tmp"C:\Users\Admin\AppData\Local\Temp\786C.tmp"25⤵
- Executes dropped EXE
PID:212 -
C:\Users\Admin\AppData\Local\Temp\7956.tmp"C:\Users\Admin\AppData\Local\Temp\7956.tmp"26⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"27⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"28⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\7B79.tmp"C:\Users\Admin\AppData\Local\Temp\7B79.tmp"29⤵
- Executes dropped EXE
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\7C35.tmp"C:\Users\Admin\AppData\Local\Temp\7C35.tmp"30⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"31⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"32⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"33⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\7F61.tmp"C:\Users\Admin\AppData\Local\Temp\7F61.tmp"34⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"35⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\807A.tmp"C:\Users\Admin\AppData\Local\Temp\807A.tmp"36⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\8107.tmp"C:\Users\Admin\AppData\Local\Temp\8107.tmp"37⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\8174.tmp"C:\Users\Admin\AppData\Local\Temp\8174.tmp"38⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\81F1.tmp"C:\Users\Admin\AppData\Local\Temp\81F1.tmp"39⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\828E.tmp"C:\Users\Admin\AppData\Local\Temp\828E.tmp"40⤵
- Executes dropped EXE
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"41⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\83B7.tmp"C:\Users\Admin\AppData\Local\Temp\83B7.tmp"42⤵
- Executes dropped EXE
PID:364 -
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"43⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\84D0.tmp"C:\Users\Admin\AppData\Local\Temp\84D0.tmp"44⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\858B.tmp"C:\Users\Admin\AppData\Local\Temp\858B.tmp"45⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\85F9.tmp"C:\Users\Admin\AppData\Local\Temp\85F9.tmp"46⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\8676.tmp"C:\Users\Admin\AppData\Local\Temp\8676.tmp"47⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\86F3.tmp"C:\Users\Admin\AppData\Local\Temp\86F3.tmp"48⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\879F.tmp"C:\Users\Admin\AppData\Local\Temp\879F.tmp"49⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\883B.tmp"C:\Users\Admin\AppData\Local\Temp\883B.tmp"50⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"51⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\8973.tmp"C:\Users\Admin\AppData\Local\Temp\8973.tmp"52⤵
- Executes dropped EXE
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\8A10.tmp"C:\Users\Admin\AppData\Local\Temp\8A10.tmp"53⤵
- Executes dropped EXE
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"54⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"55⤵
- Executes dropped EXE
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\8B87.tmp"C:\Users\Admin\AppData\Local\Temp\8B87.tmp"56⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"57⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\8C71.tmp"C:\Users\Admin\AppData\Local\Temp\8C71.tmp"58⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"59⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"60⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\8E07.tmp"C:\Users\Admin\AppData\Local\Temp\8E07.tmp"61⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\8E84.tmp"C:\Users\Admin\AppData\Local\Temp\8E84.tmp"62⤵
- Executes dropped EXE
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"63⤵
- Executes dropped EXE
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"64⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\901A.tmp"C:\Users\Admin\AppData\Local\Temp\901A.tmp"65⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"66⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\9153.tmp"C:\Users\Admin\AppData\Local\Temp\9153.tmp"67⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\91C0.tmp"C:\Users\Admin\AppData\Local\Temp\91C0.tmp"68⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\924D.tmp"C:\Users\Admin\AppData\Local\Temp\924D.tmp"69⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"70⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\9328.tmp"C:\Users\Admin\AppData\Local\Temp\9328.tmp"71⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\9395.tmp"C:\Users\Admin\AppData\Local\Temp\9395.tmp"72⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"73⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\94BE.tmp"C:\Users\Admin\AppData\Local\Temp\94BE.tmp"74⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"75⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\95F6.tmp"C:\Users\Admin\AppData\Local\Temp\95F6.tmp"76⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\9654.tmp"C:\Users\Admin\AppData\Local\Temp\9654.tmp"77⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\96D1.tmp"C:\Users\Admin\AppData\Local\Temp\96D1.tmp"78⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"79⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\97CB.tmp"C:\Users\Admin\AppData\Local\Temp\97CB.tmp"80⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\9867.tmp"C:\Users\Admin\AppData\Local\Temp\9867.tmp"81⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\98D5.tmp"C:\Users\Admin\AppData\Local\Temp\98D5.tmp"82⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\9942.tmp"C:\Users\Admin\AppData\Local\Temp\9942.tmp"83⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\99BF.tmp"C:\Users\Admin\AppData\Local\Temp\99BF.tmp"84⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"85⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"86⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"87⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"88⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"89⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"90⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\9D78.tmp"C:\Users\Admin\AppData\Local\Temp\9D78.tmp"91⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"92⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"93⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"94⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"95⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"96⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\A066.tmp"C:\Users\Admin\AppData\Local\Temp\A066.tmp"97⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"98⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"99⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"100⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\A26A.tmp"C:\Users\Admin\AppData\Local\Temp\A26A.tmp"101⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"102⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"103⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"104⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"105⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"106⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"107⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\A613.tmp"C:\Users\Admin\AppData\Local\Temp\A613.tmp"108⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"109⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\A74C.tmp"C:\Users\Admin\AppData\Local\Temp\A74C.tmp"110⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"111⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"112⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\A911.tmp"C:\Users\Admin\AppData\Local\Temp\A911.tmp"113⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"114⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"115⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"116⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\AB44.tmp"C:\Users\Admin\AppData\Local\Temp\AB44.tmp"117⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"118⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"119⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"120⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"121⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"122⤵PID:2940
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-