Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2023, 16:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
79a9e5a48e2c72f380a06d121c9ce41c_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
79a9e5a48e2c72f380a06d121c9ce41c_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
79a9e5a48e2c72f380a06d121c9ce41c_mafia_JC.exe
-
Size
527KB
-
MD5
79a9e5a48e2c72f380a06d121c9ce41c
-
SHA1
1be26c4f78cae6f91562a38122452540e0a04a2f
-
SHA256
0ba3c0e1cfc2d5706929372a0dbf1aa6393d27c1c20daee3a84a2de1d05dca22
-
SHA512
77eb913139c9ccf9f974c046823334119277424a64eea4f194c5bfa1113d688a452d9f3c5abc4ed0f01fd6a7741bdb0d34009bda607c1dfa033ac266864fdde2
-
SSDEEP
12288:fU5rCOTeidPxpWaAcK/2AuhQdiX1pqDZu:fUQOJdKaAn/BuWdiX6Do
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1200 46C8.tmp 4984 47E1.tmp 5064 48CC.tmp 2436 49C6.tmp 4036 4AB0.tmp 3876 4B6C.tmp 5048 4C56.tmp 4436 4D31.tmp 3704 4DEC.tmp 3244 4EB7.tmp 1448 4FA2.tmp 2496 505D.tmp 3336 50CB.tmp 3420 51F3.tmp 2080 52BF.tmp 1696 5399.tmp 4004 5455.tmp 5012 5510.tmp 1916 55DB.tmp 992 5678.tmp 4452 5724.tmp 208 57EF.tmp 4752 58D9.tmp 5072 59A4.tmp 436 5A8F.tmp 4056 5B3A.tmp 348 5C44.tmp 1644 5D2E.tmp 4052 5E38.tmp 1588 5EE4.tmp 904 5FEE.tmp 1244 608A.tmp 4380 6155.tmp 4604 6201.tmp 4824 629D.tmp 4816 6349.tmp 3276 63B6.tmp 3076 6433.tmp 1536 64D0.tmp 3428 655C.tmp 2360 6618.tmp 3744 66A4.tmp 4692 6741.tmp 5036 67DD.tmp 1188 684A.tmp 2220 68E6.tmp 4668 6983.tmp 4412 6A00.tmp 3856 6A7D.tmp 4684 6B09.tmp 2868 6B86.tmp 2020 6C03.tmp 4660 6CAF.tmp 3212 6D3C.tmp 4368 6DA9.tmp 1164 6E36.tmp 3032 6EC2.tmp 224 6F3F.tmp 3372 6FAD.tmp 4288 7049.tmp 1952 70C6.tmp 1428 7153.tmp 2024 71EF.tmp 3196 726C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2916 wrote to memory of 1200 2916 79a9e5a48e2c72f380a06d121c9ce41c_mafia_JC.exe 81 PID 2916 wrote to memory of 1200 2916 79a9e5a48e2c72f380a06d121c9ce41c_mafia_JC.exe 81 PID 2916 wrote to memory of 1200 2916 79a9e5a48e2c72f380a06d121c9ce41c_mafia_JC.exe 81 PID 1200 wrote to memory of 4984 1200 46C8.tmp 82 PID 1200 wrote to memory of 4984 1200 46C8.tmp 82 PID 1200 wrote to memory of 4984 1200 46C8.tmp 82 PID 4984 wrote to memory of 5064 4984 47E1.tmp 83 PID 4984 wrote to memory of 5064 4984 47E1.tmp 83 PID 4984 wrote to memory of 5064 4984 47E1.tmp 83 PID 5064 wrote to memory of 2436 5064 48CC.tmp 84 PID 5064 wrote to memory of 2436 5064 48CC.tmp 84 PID 5064 wrote to memory of 2436 5064 48CC.tmp 84 PID 2436 wrote to memory of 4036 2436 49C6.tmp 85 PID 2436 wrote to memory of 4036 2436 49C6.tmp 85 PID 2436 wrote to memory of 4036 2436 49C6.tmp 85 PID 4036 wrote to memory of 3876 4036 4AB0.tmp 86 PID 4036 wrote to memory of 3876 4036 4AB0.tmp 86 PID 4036 wrote to memory of 3876 4036 4AB0.tmp 86 PID 3876 wrote to memory of 5048 3876 4B6C.tmp 87 PID 3876 wrote to memory of 5048 3876 4B6C.tmp 87 PID 3876 wrote to memory of 5048 3876 4B6C.tmp 87 PID 5048 wrote to memory of 4436 5048 4C56.tmp 88 PID 5048 wrote to memory of 4436 5048 4C56.tmp 88 PID 5048 wrote to memory of 4436 5048 4C56.tmp 88 PID 4436 wrote to memory of 3704 4436 4D31.tmp 89 PID 4436 wrote to memory of 3704 4436 4D31.tmp 89 PID 4436 wrote to memory of 3704 4436 4D31.tmp 89 PID 3704 wrote to memory of 3244 3704 4DEC.tmp 90 PID 3704 wrote to memory of 3244 3704 4DEC.tmp 90 PID 3704 wrote to memory of 3244 3704 4DEC.tmp 90 PID 3244 wrote to memory of 1448 3244 4EB7.tmp 91 PID 3244 wrote to memory of 1448 3244 4EB7.tmp 91 PID 3244 wrote to memory of 1448 3244 4EB7.tmp 91 PID 1448 wrote to memory of 2496 1448 4FA2.tmp 92 PID 1448 wrote to memory of 2496 1448 4FA2.tmp 92 PID 1448 wrote to memory of 2496 1448 4FA2.tmp 92 PID 2496 wrote to memory of 3336 2496 505D.tmp 93 PID 2496 wrote to memory of 3336 2496 505D.tmp 93 PID 2496 wrote to memory of 3336 2496 505D.tmp 93 PID 3336 wrote to memory of 3420 3336 50CB.tmp 94 PID 3336 wrote to memory of 3420 3336 50CB.tmp 94 PID 3336 wrote to memory of 3420 3336 50CB.tmp 94 PID 3420 wrote to memory of 2080 3420 51F3.tmp 95 PID 3420 wrote to memory of 2080 3420 51F3.tmp 95 PID 3420 wrote to memory of 2080 3420 51F3.tmp 95 PID 2080 wrote to memory of 1696 2080 52BF.tmp 97 PID 2080 wrote to memory of 1696 2080 52BF.tmp 97 PID 2080 wrote to memory of 1696 2080 52BF.tmp 97 PID 1696 wrote to memory of 4004 1696 5399.tmp 98 PID 1696 wrote to memory of 4004 1696 5399.tmp 98 PID 1696 wrote to memory of 4004 1696 5399.tmp 98 PID 4004 wrote to memory of 5012 4004 5455.tmp 99 PID 4004 wrote to memory of 5012 4004 5455.tmp 99 PID 4004 wrote to memory of 5012 4004 5455.tmp 99 PID 5012 wrote to memory of 1916 5012 5510.tmp 100 PID 5012 wrote to memory of 1916 5012 5510.tmp 100 PID 5012 wrote to memory of 1916 5012 5510.tmp 100 PID 1916 wrote to memory of 992 1916 55DB.tmp 101 PID 1916 wrote to memory of 992 1916 55DB.tmp 101 PID 1916 wrote to memory of 992 1916 55DB.tmp 101 PID 992 wrote to memory of 4452 992 5678.tmp 102 PID 992 wrote to memory of 4452 992 5678.tmp 102 PID 992 wrote to memory of 4452 992 5678.tmp 102 PID 4452 wrote to memory of 208 4452 5724.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\79a9e5a48e2c72f380a06d121c9ce41c_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\79a9e5a48e2c72f380a06d121c9ce41c_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\46C8.tmp"C:\Users\Admin\AppData\Local\Temp\46C8.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\47E1.tmp"C:\Users\Admin\AppData\Local\Temp\47E1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\48CC.tmp"C:\Users\Admin\AppData\Local\Temp\48CC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\49C6.tmp"C:\Users\Admin\AppData\Local\Temp\49C6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\4B6C.tmp"C:\Users\Admin\AppData\Local\Temp\4B6C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\4C56.tmp"C:\Users\Admin\AppData\Local\Temp\4C56.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\4D31.tmp"C:\Users\Admin\AppData\Local\Temp\4D31.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\4DEC.tmp"C:\Users\Admin\AppData\Local\Temp\4DEC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\4EB7.tmp"C:\Users\Admin\AppData\Local\Temp\4EB7.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\4FA2.tmp"C:\Users\Admin\AppData\Local\Temp\4FA2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\505D.tmp"C:\Users\Admin\AppData\Local\Temp\505D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\50CB.tmp"C:\Users\Admin\AppData\Local\Temp\50CB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\51F3.tmp"C:\Users\Admin\AppData\Local\Temp\51F3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\52BF.tmp"C:\Users\Admin\AppData\Local\Temp\52BF.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\5399.tmp"C:\Users\Admin\AppData\Local\Temp\5399.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\5455.tmp"C:\Users\Admin\AppData\Local\Temp\5455.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\5510.tmp"C:\Users\Admin\AppData\Local\Temp\5510.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\55DB.tmp"C:\Users\Admin\AppData\Local\Temp\55DB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\5678.tmp"C:\Users\Admin\AppData\Local\Temp\5678.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\5724.tmp"C:\Users\Admin\AppData\Local\Temp\5724.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\57EF.tmp"C:\Users\Admin\AppData\Local\Temp\57EF.tmp"23⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\58D9.tmp"C:\Users\Admin\AppData\Local\Temp\58D9.tmp"24⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\59A4.tmp"C:\Users\Admin\AppData\Local\Temp\59A4.tmp"25⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\5A8F.tmp"C:\Users\Admin\AppData\Local\Temp\5A8F.tmp"26⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\5B3A.tmp"C:\Users\Admin\AppData\Local\Temp\5B3A.tmp"27⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\5C44.tmp"C:\Users\Admin\AppData\Local\Temp\5C44.tmp"28⤵
- Executes dropped EXE
PID:348 -
C:\Users\Admin\AppData\Local\Temp\5D2E.tmp"C:\Users\Admin\AppData\Local\Temp\5D2E.tmp"29⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\5E38.tmp"C:\Users\Admin\AppData\Local\Temp\5E38.tmp"30⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"31⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\5FEE.tmp"C:\Users\Admin\AppData\Local\Temp\5FEE.tmp"32⤵
- Executes dropped EXE
PID:904 -
C:\Users\Admin\AppData\Local\Temp\608A.tmp"C:\Users\Admin\AppData\Local\Temp\608A.tmp"33⤵
- Executes dropped EXE
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\6155.tmp"C:\Users\Admin\AppData\Local\Temp\6155.tmp"34⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\6201.tmp"C:\Users\Admin\AppData\Local\Temp\6201.tmp"35⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\629D.tmp"C:\Users\Admin\AppData\Local\Temp\629D.tmp"36⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\6349.tmp"C:\Users\Admin\AppData\Local\Temp\6349.tmp"37⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\63B6.tmp"C:\Users\Admin\AppData\Local\Temp\63B6.tmp"38⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\6433.tmp"C:\Users\Admin\AppData\Local\Temp\6433.tmp"39⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\64D0.tmp"C:\Users\Admin\AppData\Local\Temp\64D0.tmp"40⤵
- Executes dropped EXE
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\655C.tmp"C:\Users\Admin\AppData\Local\Temp\655C.tmp"41⤵
- Executes dropped EXE
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\6618.tmp"C:\Users\Admin\AppData\Local\Temp\6618.tmp"42⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\66A4.tmp"C:\Users\Admin\AppData\Local\Temp\66A4.tmp"43⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\6741.tmp"C:\Users\Admin\AppData\Local\Temp\6741.tmp"44⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\67DD.tmp"C:\Users\Admin\AppData\Local\Temp\67DD.tmp"45⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\684A.tmp"C:\Users\Admin\AppData\Local\Temp\684A.tmp"46⤵
- Executes dropped EXE
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\68E6.tmp"C:\Users\Admin\AppData\Local\Temp\68E6.tmp"47⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\6983.tmp"C:\Users\Admin\AppData\Local\Temp\6983.tmp"48⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\6A00.tmp"C:\Users\Admin\AppData\Local\Temp\6A00.tmp"49⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\6A7D.tmp"C:\Users\Admin\AppData\Local\Temp\6A7D.tmp"50⤵
- Executes dropped EXE
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\6B09.tmp"C:\Users\Admin\AppData\Local\Temp\6B09.tmp"51⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\6B86.tmp"C:\Users\Admin\AppData\Local\Temp\6B86.tmp"52⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\6C03.tmp"C:\Users\Admin\AppData\Local\Temp\6C03.tmp"53⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\6CAF.tmp"C:\Users\Admin\AppData\Local\Temp\6CAF.tmp"54⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\6D3C.tmp"C:\Users\Admin\AppData\Local\Temp\6D3C.tmp"55⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\6DA9.tmp"C:\Users\Admin\AppData\Local\Temp\6DA9.tmp"56⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\6E36.tmp"C:\Users\Admin\AppData\Local\Temp\6E36.tmp"57⤵
- Executes dropped EXE
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\6EC2.tmp"C:\Users\Admin\AppData\Local\Temp\6EC2.tmp"58⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\6F3F.tmp"C:\Users\Admin\AppData\Local\Temp\6F3F.tmp"59⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\6FAD.tmp"C:\Users\Admin\AppData\Local\Temp\6FAD.tmp"60⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\7049.tmp"C:\Users\Admin\AppData\Local\Temp\7049.tmp"61⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\70C6.tmp"C:\Users\Admin\AppData\Local\Temp\70C6.tmp"62⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\7153.tmp"C:\Users\Admin\AppData\Local\Temp\7153.tmp"63⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\71EF.tmp"C:\Users\Admin\AppData\Local\Temp\71EF.tmp"64⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\726C.tmp"C:\Users\Admin\AppData\Local\Temp\726C.tmp"65⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\7327.tmp"C:\Users\Admin\AppData\Local\Temp\7327.tmp"66⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\73D3.tmp"C:\Users\Admin\AppData\Local\Temp\73D3.tmp"67⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\7470.tmp"C:\Users\Admin\AppData\Local\Temp\7470.tmp"68⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\74FC.tmp"C:\Users\Admin\AppData\Local\Temp\74FC.tmp"69⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\7589.tmp"C:\Users\Admin\AppData\Local\Temp\7589.tmp"70⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\7625.tmp"C:\Users\Admin\AppData\Local\Temp\7625.tmp"71⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\76C1.tmp"C:\Users\Admin\AppData\Local\Temp\76C1.tmp"72⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\778C.tmp"C:\Users\Admin\AppData\Local\Temp\778C.tmp"73⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\7809.tmp"C:\Users\Admin\AppData\Local\Temp\7809.tmp"74⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\78C5.tmp"C:\Users\Admin\AppData\Local\Temp\78C5.tmp"75⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\7961.tmp"C:\Users\Admin\AppData\Local\Temp\7961.tmp"76⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\79DE.tmp"C:\Users\Admin\AppData\Local\Temp\79DE.tmp"77⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\7A7A.tmp"C:\Users\Admin\AppData\Local\Temp\7A7A.tmp"78⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\7AF7.tmp"C:\Users\Admin\AppData\Local\Temp\7AF7.tmp"79⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\7B65.tmp"C:\Users\Admin\AppData\Local\Temp\7B65.tmp"80⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\7C11.tmp"C:\Users\Admin\AppData\Local\Temp\7C11.tmp"81⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\7C8E.tmp"C:\Users\Admin\AppData\Local\Temp\7C8E.tmp"82⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\7D0B.tmp"C:\Users\Admin\AppData\Local\Temp\7D0B.tmp"83⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\7D78.tmp"C:\Users\Admin\AppData\Local\Temp\7D78.tmp"84⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\7E24.tmp"C:\Users\Admin\AppData\Local\Temp\7E24.tmp"85⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\7EB1.tmp"C:\Users\Admin\AppData\Local\Temp\7EB1.tmp"86⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\7F3D.tmp"C:\Users\Admin\AppData\Local\Temp\7F3D.tmp"87⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\7FCA.tmp"C:\Users\Admin\AppData\Local\Temp\7FCA.tmp"88⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\8056.tmp"C:\Users\Admin\AppData\Local\Temp\8056.tmp"89⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\80D3.tmp"C:\Users\Admin\AppData\Local\Temp\80D3.tmp"90⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\8170.tmp"C:\Users\Admin\AppData\Local\Temp\8170.tmp"91⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\81ED.tmp"C:\Users\Admin\AppData\Local\Temp\81ED.tmp"92⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\8279.tmp"C:\Users\Admin\AppData\Local\Temp\8279.tmp"93⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\8538.tmp"C:\Users\Admin\AppData\Local\Temp\8538.tmp"94⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\85E4.tmp"C:\Users\Admin\AppData\Local\Temp\85E4.tmp"95⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\8671.tmp"C:\Users\Admin\AppData\Local\Temp\8671.tmp"96⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\871D.tmp"C:\Users\Admin\AppData\Local\Temp\871D.tmp"97⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\87C9.tmp"C:\Users\Admin\AppData\Local\Temp\87C9.tmp"98⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\8855.tmp"C:\Users\Admin\AppData\Local\Temp\8855.tmp"99⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\88E2.tmp"C:\Users\Admin\AppData\Local\Temp\88E2.tmp"100⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\894F.tmp"C:\Users\Admin\AppData\Local\Temp\894F.tmp"101⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\89BD.tmp"C:\Users\Admin\AppData\Local\Temp\89BD.tmp"102⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\8A2A.tmp"C:\Users\Admin\AppData\Local\Temp\8A2A.tmp"103⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\8AA7.tmp"C:\Users\Admin\AppData\Local\Temp\8AA7.tmp"104⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\8B14.tmp"C:\Users\Admin\AppData\Local\Temp\8B14.tmp"105⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\8BC0.tmp"C:\Users\Admin\AppData\Local\Temp\8BC0.tmp"106⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\8C7C.tmp"C:\Users\Admin\AppData\Local\Temp\8C7C.tmp"107⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\8D18.tmp"C:\Users\Admin\AppData\Local\Temp\8D18.tmp"108⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\8D95.tmp"C:\Users\Admin\AppData\Local\Temp\8D95.tmp"109⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\8EED.tmp"C:\Users\Admin\AppData\Local\Temp\8EED.tmp"110⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\8F79.tmp"C:\Users\Admin\AppData\Local\Temp\8F79.tmp"111⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\9006.tmp"C:\Users\Admin\AppData\Local\Temp\9006.tmp"112⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\9073.tmp"C:\Users\Admin\AppData\Local\Temp\9073.tmp"113⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\90F0.tmp"C:\Users\Admin\AppData\Local\Temp\90F0.tmp"114⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\917D.tmp"C:\Users\Admin\AppData\Local\Temp\917D.tmp"115⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\9248.tmp"C:\Users\Admin\AppData\Local\Temp\9248.tmp"116⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\92E4.tmp"C:\Users\Admin\AppData\Local\Temp\92E4.tmp"117⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\9361.tmp"C:\Users\Admin\AppData\Local\Temp\9361.tmp"118⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\940D.tmp"C:\Users\Admin\AppData\Local\Temp\940D.tmp"119⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\94B9.tmp"C:\Users\Admin\AppData\Local\Temp\94B9.tmp"120⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\9527.tmp"C:\Users\Admin\AppData\Local\Temp\9527.tmp"121⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\95B3.tmp"C:\Users\Admin\AppData\Local\Temp\95B3.tmp"122⤵PID:4292
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-