Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
22-08-2023 18:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
707461f243a67a99189f8c0552318f93_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
707461f243a67a99189f8c0552318f93_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
707461f243a67a99189f8c0552318f93_mafia_JC.exe
-
Size
488KB
-
MD5
707461f243a67a99189f8c0552318f93
-
SHA1
81d939322dd28474f69fc07b22c5aafb2986940f
-
SHA256
4ecaff6d679e5b326b7730a21b502db485d558f032f6cc9f98f872d1f0d27eec
-
SHA512
0fc1740e07896b058d1924e9c1c12114dc769daa424df4c557a61425ea742f38a86aa43300039ad292c0c5994420d5276daf0959bec6ecec04a14398619b1b06
-
SSDEEP
12288:/U5rCOTeiDkqbENZPn1dJuEvFt0jh4RpENZ:/UQOJDRbMZ1/FSYEN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4120 65FD.tmp 1880 66B9.tmp 3380 6793.tmp 4736 683F.tmp 3252 692A.tmp 1464 69E5.tmp 3276 6AC0.tmp 2356 6B4D.tmp 1304 6BE9.tmp 1004 6C85.tmp 4156 6D31.tmp 1668 6DFC.tmp 4544 6F15.tmp 1020 7000.tmp 1816 70AC.tmp 3948 7129.tmp 4012 7203.tmp 3184 72AF.tmp 5040 735B.tmp 3352 7445.tmp 4384 74E2.tmp 3808 758E.tmp 2344 760B.tmp 3356 7697.tmp 4616 7753.tmp 2500 785C.tmp 1100 7927.tmp 2740 79C4.tmp 3580 7A7F.tmp 2704 7B4A.tmp 4788 7BD7.tmp 1928 7C73.tmp 2304 7CF0.tmp 3860 7D6D.tmp 5088 7DFA.tmp 3476 7E86.tmp 1732 800D.tmp 896 80A9.tmp 2952 8136.tmp 2224 81B3.tmp 1384 8240.tmp 3552 82AD.tmp 1028 8359.tmp 820 83D6.tmp 1840 84A1.tmp 3148 852E.tmp 4476 85F9.tmp 3740 8666.tmp 1976 8712.tmp 2192 87AE.tmp 4728 884A.tmp 4052 8973.tmp 4724 8A00.tmp 5072 8A7D.tmp 1864 8AFA.tmp 4656 8B77.tmp 3380 8C04.tmp 4600 8C81.tmp 4712 8CEE.tmp 3272 8D6B.tmp 1936 8E07.tmp 2348 8E94.tmp 3596 8F20.tmp 1268 8FBD.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2136 wrote to memory of 4120 2136 707461f243a67a99189f8c0552318f93_mafia_JC.exe 82 PID 2136 wrote to memory of 4120 2136 707461f243a67a99189f8c0552318f93_mafia_JC.exe 82 PID 2136 wrote to memory of 4120 2136 707461f243a67a99189f8c0552318f93_mafia_JC.exe 82 PID 4120 wrote to memory of 1880 4120 65FD.tmp 83 PID 4120 wrote to memory of 1880 4120 65FD.tmp 83 PID 4120 wrote to memory of 1880 4120 65FD.tmp 83 PID 1880 wrote to memory of 3380 1880 66B9.tmp 84 PID 1880 wrote to memory of 3380 1880 66B9.tmp 84 PID 1880 wrote to memory of 3380 1880 66B9.tmp 84 PID 3380 wrote to memory of 4736 3380 6793.tmp 85 PID 3380 wrote to memory of 4736 3380 6793.tmp 85 PID 3380 wrote to memory of 4736 3380 6793.tmp 85 PID 4736 wrote to memory of 3252 4736 683F.tmp 86 PID 4736 wrote to memory of 3252 4736 683F.tmp 86 PID 4736 wrote to memory of 3252 4736 683F.tmp 86 PID 3252 wrote to memory of 1464 3252 692A.tmp 87 PID 3252 wrote to memory of 1464 3252 692A.tmp 87 PID 3252 wrote to memory of 1464 3252 692A.tmp 87 PID 1464 wrote to memory of 3276 1464 69E5.tmp 88 PID 1464 wrote to memory of 3276 1464 69E5.tmp 88 PID 1464 wrote to memory of 3276 1464 69E5.tmp 88 PID 3276 wrote to memory of 2356 3276 6AC0.tmp 89 PID 3276 wrote to memory of 2356 3276 6AC0.tmp 89 PID 3276 wrote to memory of 2356 3276 6AC0.tmp 89 PID 2356 wrote to memory of 1304 2356 6B4D.tmp 90 PID 2356 wrote to memory of 1304 2356 6B4D.tmp 90 PID 2356 wrote to memory of 1304 2356 6B4D.tmp 90 PID 1304 wrote to memory of 1004 1304 6BE9.tmp 91 PID 1304 wrote to memory of 1004 1304 6BE9.tmp 91 PID 1304 wrote to memory of 1004 1304 6BE9.tmp 91 PID 1004 wrote to memory of 4156 1004 6C85.tmp 92 PID 1004 wrote to memory of 4156 1004 6C85.tmp 92 PID 1004 wrote to memory of 4156 1004 6C85.tmp 92 PID 4156 wrote to memory of 1668 4156 6D31.tmp 93 PID 4156 wrote to memory of 1668 4156 6D31.tmp 93 PID 4156 wrote to memory of 1668 4156 6D31.tmp 93 PID 1668 wrote to memory of 4544 1668 6DFC.tmp 94 PID 1668 wrote to memory of 4544 1668 6DFC.tmp 94 PID 1668 wrote to memory of 4544 1668 6DFC.tmp 94 PID 4544 wrote to memory of 1020 4544 6F15.tmp 95 PID 4544 wrote to memory of 1020 4544 6F15.tmp 95 PID 4544 wrote to memory of 1020 4544 6F15.tmp 95 PID 1020 wrote to memory of 1816 1020 7000.tmp 96 PID 1020 wrote to memory of 1816 1020 7000.tmp 96 PID 1020 wrote to memory of 1816 1020 7000.tmp 96 PID 1816 wrote to memory of 3948 1816 70AC.tmp 97 PID 1816 wrote to memory of 3948 1816 70AC.tmp 97 PID 1816 wrote to memory of 3948 1816 70AC.tmp 97 PID 3948 wrote to memory of 4012 3948 7129.tmp 98 PID 3948 wrote to memory of 4012 3948 7129.tmp 98 PID 3948 wrote to memory of 4012 3948 7129.tmp 98 PID 4012 wrote to memory of 3184 4012 7203.tmp 99 PID 4012 wrote to memory of 3184 4012 7203.tmp 99 PID 4012 wrote to memory of 3184 4012 7203.tmp 99 PID 3184 wrote to memory of 5040 3184 72AF.tmp 100 PID 3184 wrote to memory of 5040 3184 72AF.tmp 100 PID 3184 wrote to memory of 5040 3184 72AF.tmp 100 PID 5040 wrote to memory of 3352 5040 735B.tmp 101 PID 5040 wrote to memory of 3352 5040 735B.tmp 101 PID 5040 wrote to memory of 3352 5040 735B.tmp 101 PID 3352 wrote to memory of 4384 3352 7445.tmp 102 PID 3352 wrote to memory of 4384 3352 7445.tmp 102 PID 3352 wrote to memory of 4384 3352 7445.tmp 102 PID 4384 wrote to memory of 3808 4384 74E2.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\707461f243a67a99189f8c0552318f93_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\707461f243a67a99189f8c0552318f93_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\7445.tmp"C:\Users\Admin\AppData\Local\Temp\7445.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"23⤵
- Executes dropped EXE
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\760B.tmp"C:\Users\Admin\AppData\Local\Temp\760B.tmp"24⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"25⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\7753.tmp"C:\Users\Admin\AppData\Local\Temp\7753.tmp"26⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\785C.tmp"C:\Users\Admin\AppData\Local\Temp\785C.tmp"27⤵
- Executes dropped EXE
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\7927.tmp"C:\Users\Admin\AppData\Local\Temp\7927.tmp"28⤵
- Executes dropped EXE
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\79C4.tmp"C:\Users\Admin\AppData\Local\Temp\79C4.tmp"29⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"30⤵
- Executes dropped EXE
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"31⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"32⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\7C73.tmp"C:\Users\Admin\AppData\Local\Temp\7C73.tmp"33⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"34⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"35⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"36⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"37⤵
- Executes dropped EXE
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\800D.tmp"C:\Users\Admin\AppData\Local\Temp\800D.tmp"38⤵
- Executes dropped EXE
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\80A9.tmp"C:\Users\Admin\AppData\Local\Temp\80A9.tmp"39⤵
- Executes dropped EXE
PID:896 -
C:\Users\Admin\AppData\Local\Temp\8136.tmp"C:\Users\Admin\AppData\Local\Temp\8136.tmp"40⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\81B3.tmp"C:\Users\Admin\AppData\Local\Temp\81B3.tmp"41⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\8240.tmp"C:\Users\Admin\AppData\Local\Temp\8240.tmp"42⤵
- Executes dropped EXE
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\82AD.tmp"C:\Users\Admin\AppData\Local\Temp\82AD.tmp"43⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\8359.tmp"C:\Users\Admin\AppData\Local\Temp\8359.tmp"44⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\83D6.tmp"C:\Users\Admin\AppData\Local\Temp\83D6.tmp"45⤵
- Executes dropped EXE
PID:820 -
C:\Users\Admin\AppData\Local\Temp\84A1.tmp"C:\Users\Admin\AppData\Local\Temp\84A1.tmp"46⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\852E.tmp"C:\Users\Admin\AppData\Local\Temp\852E.tmp"47⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\85F9.tmp"C:\Users\Admin\AppData\Local\Temp\85F9.tmp"48⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\8666.tmp"C:\Users\Admin\AppData\Local\Temp\8666.tmp"49⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\8712.tmp"C:\Users\Admin\AppData\Local\Temp\8712.tmp"50⤵
- Executes dropped EXE
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\87AE.tmp"C:\Users\Admin\AppData\Local\Temp\87AE.tmp"51⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"52⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"53⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\8973.tmp"C:\Users\Admin\AppData\Local\Temp\8973.tmp"54⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\8A00.tmp"C:\Users\Admin\AppData\Local\Temp\8A00.tmp"55⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"56⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"57⤵
- Executes dropped EXE
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\8B77.tmp"C:\Users\Admin\AppData\Local\Temp\8B77.tmp"58⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\8C04.tmp"C:\Users\Admin\AppData\Local\Temp\8C04.tmp"59⤵
- Executes dropped EXE
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\8C81.tmp"C:\Users\Admin\AppData\Local\Temp\8C81.tmp"60⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"61⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"62⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\8E07.tmp"C:\Users\Admin\AppData\Local\Temp\8E07.tmp"63⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\8E94.tmp"C:\Users\Admin\AppData\Local\Temp\8E94.tmp"64⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\8F20.tmp"C:\Users\Admin\AppData\Local\Temp\8F20.tmp"65⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"66⤵
- Executes dropped EXE
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\903A.tmp"C:\Users\Admin\AppData\Local\Temp\903A.tmp"67⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"68⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\9134.tmp"C:\Users\Admin\AppData\Local\Temp\9134.tmp"69⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\91E0.tmp"C:\Users\Admin\AppData\Local\Temp\91E0.tmp"70⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\924D.tmp"C:\Users\Admin\AppData\Local\Temp\924D.tmp"71⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\92AB.tmp"C:\Users\Admin\AppData\Local\Temp\92AB.tmp"72⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\9328.tmp"C:\Users\Admin\AppData\Local\Temp\9328.tmp"73⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\9395.tmp"C:\Users\Admin\AppData\Local\Temp\9395.tmp"74⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\9402.tmp"C:\Users\Admin\AppData\Local\Temp\9402.tmp"75⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\947F.tmp"C:\Users\Admin\AppData\Local\Temp\947F.tmp"76⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\950C.tmp"C:\Users\Admin\AppData\Local\Temp\950C.tmp"77⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\9599.tmp"C:\Users\Admin\AppData\Local\Temp\9599.tmp"78⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"79⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\96C2.tmp"C:\Users\Admin\AppData\Local\Temp\96C2.tmp"80⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\972F.tmp"C:\Users\Admin\AppData\Local\Temp\972F.tmp"81⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\97BC.tmp"C:\Users\Admin\AppData\Local\Temp\97BC.tmp"82⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"83⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\9896.tmp"C:\Users\Admin\AppData\Local\Temp\9896.tmp"84⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\9904.tmp"C:\Users\Admin\AppData\Local\Temp\9904.tmp"85⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"86⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\99BF.tmp"C:\Users\Admin\AppData\Local\Temp\99BF.tmp"87⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"88⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"89⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"90⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"91⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"92⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"93⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\9D69.tmp"C:\Users\Admin\AppData\Local\Temp\9D69.tmp"94⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"95⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\9E63.tmp"C:\Users\Admin\AppData\Local\Temp\9E63.tmp"96⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"97⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"98⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"99⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"100⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\A095.tmp"C:\Users\Admin\AppData\Local\Temp\A095.tmp"101⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"102⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"103⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\A24B.tmp"C:\Users\Admin\AppData\Local\Temp\A24B.tmp"104⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"105⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\A374.tmp"C:\Users\Admin\AppData\Local\Temp\A374.tmp"106⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"107⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"108⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\A519.tmp"C:\Users\Admin\AppData\Local\Temp\A519.tmp"109⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"110⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\A642.tmp"C:\Users\Admin\AppData\Local\Temp\A642.tmp"111⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"112⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"113⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"114⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\A894.tmp"C:\Users\Admin\AppData\Local\Temp\A894.tmp"115⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\A921.tmp"C:\Users\Admin\AppData\Local\Temp\A921.tmp"116⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"117⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\AA59.tmp"C:\Users\Admin\AppData\Local\Temp\AA59.tmp"118⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"119⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\AB53.tmp"C:\Users\Admin\AppData\Local\Temp\AB53.tmp"120⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"121⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"122⤵PID:2088
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-