Analysis
-
max time kernel
151s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
23-08-2023 18:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7f0110fc0d6adbb047e2a54a3e5a00ad_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
7f0110fc0d6adbb047e2a54a3e5a00ad_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
7f0110fc0d6adbb047e2a54a3e5a00ad_mafia_JC.exe
-
Size
527KB
-
MD5
7f0110fc0d6adbb047e2a54a3e5a00ad
-
SHA1
1a8603a15290b7138ac8f3af2e4b581b226ecd5c
-
SHA256
99903ee162046c555eecb2be19c0c2a8d6c9880156f6752fee9265a55017f49a
-
SHA512
40a88f1052467ac805942e93ac2beff67b5f835f9bb5a01c91412406c18b92716fe55df793c9516d3cbaa0b569ec7bee4ac3b1327ce2f97a95a9b065d8fd8dc2
-
SSDEEP
12288:fU5rCOTeidEXAncGIdT+oEzOHLQvDHRDZu:fUQOJd/CdUqrQvdDo
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4812 FC03.tmp 2224 356.tmp 2996 589.tmp 4140 654.tmp 3184 700.tmp 4304 7CB.tmp 4224 8D5.tmp 4884 9A0.tmp 4692 A6B.tmp 416 B26.tmp 1244 C01.tmp 1804 C8E.tmp 3968 D78.tmp 1112 E14.tmp 1604 EEF.tmp 1596 FAB.tmp 2192 1037.tmp 4500 10E3.tmp 2064 117F.tmp 1060 126A.tmp 3464 1325.tmp 4892 13F0.tmp 2096 14DB.tmp 3728 15A6.tmp 3996 1671.tmp 2436 171D.tmp 1608 17D8.tmp 3932 1884.tmp 1520 1930.tmp 3860 1A1B.tmp 1284 1B05.tmp 900 1BFF.tmp 1148 1C9B.tmp 1912 1D28.tmp 4148 1D95.tmp 4332 1E22.tmp 2088 1E8F.tmp 4860 1EFD.tmp 3492 1F89.tmp 4880 2006.tmp 2864 2074.tmp 924 212F.tmp 2868 21AC.tmp 4796 2258.tmp 1432 22D5.tmp 4052 2371.tmp 2400 23FE.tmp 4440 249A.tmp 3288 2546.tmp 936 25C3.tmp 2468 2640.tmp 4268 26BD.tmp 4736 274A.tmp 4312 27E6.tmp 3152 2853.tmp 1676 28E0.tmp 2996 295D.tmp 4060 29F9.tmp 1076 2A95.tmp 1508 2B12.tmp 4304 2BAF.tmp 4808 2C2C.tmp 2696 2CE7.tmp 864 2D64.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3096 wrote to memory of 4812 3096 7f0110fc0d6adbb047e2a54a3e5a00ad_mafia_JC.exe 81 PID 3096 wrote to memory of 4812 3096 7f0110fc0d6adbb047e2a54a3e5a00ad_mafia_JC.exe 81 PID 3096 wrote to memory of 4812 3096 7f0110fc0d6adbb047e2a54a3e5a00ad_mafia_JC.exe 81 PID 4812 wrote to memory of 2224 4812 FC03.tmp 82 PID 4812 wrote to memory of 2224 4812 FC03.tmp 82 PID 4812 wrote to memory of 2224 4812 FC03.tmp 82 PID 2224 wrote to memory of 2996 2224 356.tmp 83 PID 2224 wrote to memory of 2996 2224 356.tmp 83 PID 2224 wrote to memory of 2996 2224 356.tmp 83 PID 2996 wrote to memory of 4140 2996 589.tmp 84 PID 2996 wrote to memory of 4140 2996 589.tmp 84 PID 2996 wrote to memory of 4140 2996 589.tmp 84 PID 4140 wrote to memory of 3184 4140 654.tmp 85 PID 4140 wrote to memory of 3184 4140 654.tmp 85 PID 4140 wrote to memory of 3184 4140 654.tmp 85 PID 3184 wrote to memory of 4304 3184 700.tmp 86 PID 3184 wrote to memory of 4304 3184 700.tmp 86 PID 3184 wrote to memory of 4304 3184 700.tmp 86 PID 4304 wrote to memory of 4224 4304 7CB.tmp 87 PID 4304 wrote to memory of 4224 4304 7CB.tmp 87 PID 4304 wrote to memory of 4224 4304 7CB.tmp 87 PID 4224 wrote to memory of 4884 4224 8D5.tmp 88 PID 4224 wrote to memory of 4884 4224 8D5.tmp 88 PID 4224 wrote to memory of 4884 4224 8D5.tmp 88 PID 4884 wrote to memory of 4692 4884 9A0.tmp 89 PID 4884 wrote to memory of 4692 4884 9A0.tmp 89 PID 4884 wrote to memory of 4692 4884 9A0.tmp 89 PID 4692 wrote to memory of 416 4692 A6B.tmp 90 PID 4692 wrote to memory of 416 4692 A6B.tmp 90 PID 4692 wrote to memory of 416 4692 A6B.tmp 90 PID 416 wrote to memory of 1244 416 B26.tmp 91 PID 416 wrote to memory of 1244 416 B26.tmp 91 PID 416 wrote to memory of 1244 416 B26.tmp 91 PID 1244 wrote to memory of 1804 1244 C01.tmp 92 PID 1244 wrote to memory of 1804 1244 C01.tmp 92 PID 1244 wrote to memory of 1804 1244 C01.tmp 92 PID 1804 wrote to memory of 3968 1804 C8E.tmp 93 PID 1804 wrote to memory of 3968 1804 C8E.tmp 93 PID 1804 wrote to memory of 3968 1804 C8E.tmp 93 PID 3968 wrote to memory of 1112 3968 D78.tmp 94 PID 3968 wrote to memory of 1112 3968 D78.tmp 94 PID 3968 wrote to memory of 1112 3968 D78.tmp 94 PID 1112 wrote to memory of 1604 1112 E14.tmp 95 PID 1112 wrote to memory of 1604 1112 E14.tmp 95 PID 1112 wrote to memory of 1604 1112 E14.tmp 95 PID 1604 wrote to memory of 1596 1604 EEF.tmp 96 PID 1604 wrote to memory of 1596 1604 EEF.tmp 96 PID 1604 wrote to memory of 1596 1604 EEF.tmp 96 PID 1596 wrote to memory of 2192 1596 FAB.tmp 97 PID 1596 wrote to memory of 2192 1596 FAB.tmp 97 PID 1596 wrote to memory of 2192 1596 FAB.tmp 97 PID 2192 wrote to memory of 4500 2192 1037.tmp 99 PID 2192 wrote to memory of 4500 2192 1037.tmp 99 PID 2192 wrote to memory of 4500 2192 1037.tmp 99 PID 4500 wrote to memory of 2064 4500 10E3.tmp 100 PID 4500 wrote to memory of 2064 4500 10E3.tmp 100 PID 4500 wrote to memory of 2064 4500 10E3.tmp 100 PID 2064 wrote to memory of 1060 2064 117F.tmp 101 PID 2064 wrote to memory of 1060 2064 117F.tmp 101 PID 2064 wrote to memory of 1060 2064 117F.tmp 101 PID 1060 wrote to memory of 3464 1060 126A.tmp 102 PID 1060 wrote to memory of 3464 1060 126A.tmp 102 PID 1060 wrote to memory of 3464 1060 126A.tmp 102 PID 3464 wrote to memory of 4892 3464 1325.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f0110fc0d6adbb047e2a54a3e5a00ad_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\7f0110fc0d6adbb047e2a54a3e5a00ad_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\FC03.tmp"C:\Users\Admin\AppData\Local\Temp\FC03.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\356.tmp"C:\Users\Admin\AppData\Local\Temp\356.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\589.tmp"C:\Users\Admin\AppData\Local\Temp\589.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\654.tmp"C:\Users\Admin\AppData\Local\Temp\654.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\700.tmp"C:\Users\Admin\AppData\Local\Temp\700.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\7CB.tmp"C:\Users\Admin\AppData\Local\Temp\7CB.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\8D5.tmp"C:\Users\Admin\AppData\Local\Temp\8D5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\9A0.tmp"C:\Users\Admin\AppData\Local\Temp\9A0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\A6B.tmp"C:\Users\Admin\AppData\Local\Temp\A6B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\B26.tmp"C:\Users\Admin\AppData\Local\Temp\B26.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Users\Admin\AppData\Local\Temp\C01.tmp"C:\Users\Admin\AppData\Local\Temp\C01.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\C8E.tmp"C:\Users\Admin\AppData\Local\Temp\C8E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\D78.tmp"C:\Users\Admin\AppData\Local\Temp\D78.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\E14.tmp"C:\Users\Admin\AppData\Local\Temp\E14.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\EEF.tmp"C:\Users\Admin\AppData\Local\Temp\EEF.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\FAB.tmp"C:\Users\Admin\AppData\Local\Temp\FAB.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\1037.tmp"C:\Users\Admin\AppData\Local\Temp\1037.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\10E3.tmp"C:\Users\Admin\AppData\Local\Temp\10E3.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\117F.tmp"C:\Users\Admin\AppData\Local\Temp\117F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\126A.tmp"C:\Users\Admin\AppData\Local\Temp\126A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\1325.tmp"C:\Users\Admin\AppData\Local\Temp\1325.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\13F0.tmp"C:\Users\Admin\AppData\Local\Temp\13F0.tmp"23⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\14DB.tmp"C:\Users\Admin\AppData\Local\Temp\14DB.tmp"24⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\15A6.tmp"C:\Users\Admin\AppData\Local\Temp\15A6.tmp"25⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\1671.tmp"C:\Users\Admin\AppData\Local\Temp\1671.tmp"26⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\171D.tmp"C:\Users\Admin\AppData\Local\Temp\171D.tmp"27⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\17D8.tmp"C:\Users\Admin\AppData\Local\Temp\17D8.tmp"28⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\1884.tmp"C:\Users\Admin\AppData\Local\Temp\1884.tmp"29⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\1930.tmp"C:\Users\Admin\AppData\Local\Temp\1930.tmp"30⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"31⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\1B05.tmp"C:\Users\Admin\AppData\Local\Temp\1B05.tmp"32⤵
- Executes dropped EXE
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\1BFF.tmp"C:\Users\Admin\AppData\Local\Temp\1BFF.tmp"33⤵
- Executes dropped EXE
PID:900 -
C:\Users\Admin\AppData\Local\Temp\1C9B.tmp"C:\Users\Admin\AppData\Local\Temp\1C9B.tmp"34⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\1D28.tmp"C:\Users\Admin\AppData\Local\Temp\1D28.tmp"35⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\1D95.tmp"C:\Users\Admin\AppData\Local\Temp\1D95.tmp"36⤵
- Executes dropped EXE
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\1E22.tmp"C:\Users\Admin\AppData\Local\Temp\1E22.tmp"37⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\1E8F.tmp"C:\Users\Admin\AppData\Local\Temp\1E8F.tmp"38⤵
- Executes dropped EXE
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"39⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\1F89.tmp"C:\Users\Admin\AppData\Local\Temp\1F89.tmp"40⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\2006.tmp"C:\Users\Admin\AppData\Local\Temp\2006.tmp"41⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\2074.tmp"C:\Users\Admin\AppData\Local\Temp\2074.tmp"42⤵
- Executes dropped EXE
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\212F.tmp"C:\Users\Admin\AppData\Local\Temp\212F.tmp"43⤵
- Executes dropped EXE
PID:924 -
C:\Users\Admin\AppData\Local\Temp\21AC.tmp"C:\Users\Admin\AppData\Local\Temp\21AC.tmp"44⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\2258.tmp"C:\Users\Admin\AppData\Local\Temp\2258.tmp"45⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\22D5.tmp"C:\Users\Admin\AppData\Local\Temp\22D5.tmp"46⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\2371.tmp"C:\Users\Admin\AppData\Local\Temp\2371.tmp"47⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\23FE.tmp"C:\Users\Admin\AppData\Local\Temp\23FE.tmp"48⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\249A.tmp"C:\Users\Admin\AppData\Local\Temp\249A.tmp"49⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\2546.tmp"C:\Users\Admin\AppData\Local\Temp\2546.tmp"50⤵
- Executes dropped EXE
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\25C3.tmp"C:\Users\Admin\AppData\Local\Temp\25C3.tmp"51⤵
- Executes dropped EXE
PID:936 -
C:\Users\Admin\AppData\Local\Temp\2640.tmp"C:\Users\Admin\AppData\Local\Temp\2640.tmp"52⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\26BD.tmp"C:\Users\Admin\AppData\Local\Temp\26BD.tmp"53⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\274A.tmp"C:\Users\Admin\AppData\Local\Temp\274A.tmp"54⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\27E6.tmp"C:\Users\Admin\AppData\Local\Temp\27E6.tmp"55⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\2853.tmp"C:\Users\Admin\AppData\Local\Temp\2853.tmp"56⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\28E0.tmp"C:\Users\Admin\AppData\Local\Temp\28E0.tmp"57⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\295D.tmp"C:\Users\Admin\AppData\Local\Temp\295D.tmp"58⤵
- Executes dropped EXE
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\29F9.tmp"C:\Users\Admin\AppData\Local\Temp\29F9.tmp"59⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\2A95.tmp"C:\Users\Admin\AppData\Local\Temp\2A95.tmp"60⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\2B12.tmp"C:\Users\Admin\AppData\Local\Temp\2B12.tmp"61⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\2BAF.tmp"C:\Users\Admin\AppData\Local\Temp\2BAF.tmp"62⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\2C2C.tmp"C:\Users\Admin\AppData\Local\Temp\2C2C.tmp"63⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"64⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\2D64.tmp"C:\Users\Admin\AppData\Local\Temp\2D64.tmp"65⤵
- Executes dropped EXE
PID:864 -
C:\Users\Admin\AppData\Local\Temp\2E10.tmp"C:\Users\Admin\AppData\Local\Temp\2E10.tmp"66⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\2E9D.tmp"C:\Users\Admin\AppData\Local\Temp\2E9D.tmp"67⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\2F1A.tmp"C:\Users\Admin\AppData\Local\Temp\2F1A.tmp"68⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\2FB6.tmp"C:\Users\Admin\AppData\Local\Temp\2FB6.tmp"69⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\3062.tmp"C:\Users\Admin\AppData\Local\Temp\3062.tmp"70⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\30BF.tmp"C:\Users\Admin\AppData\Local\Temp\30BF.tmp"71⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\313C.tmp"C:\Users\Admin\AppData\Local\Temp\313C.tmp"72⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\31C9.tmp"C:\Users\Admin\AppData\Local\Temp\31C9.tmp"73⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\3236.tmp"C:\Users\Admin\AppData\Local\Temp\3236.tmp"74⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\32C3.tmp"C:\Users\Admin\AppData\Local\Temp\32C3.tmp"75⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\335F.tmp"C:\Users\Admin\AppData\Local\Temp\335F.tmp"76⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"77⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"78⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"79⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\3592.tmp"C:\Users\Admin\AppData\Local\Temp\3592.tmp"80⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\362E.tmp"C:\Users\Admin\AppData\Local\Temp\362E.tmp"81⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\36CA.tmp"C:\Users\Admin\AppData\Local\Temp\36CA.tmp"82⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\3738.tmp"C:\Users\Admin\AppData\Local\Temp\3738.tmp"83⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\37B5.tmp"C:\Users\Admin\AppData\Local\Temp\37B5.tmp"84⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\3851.tmp"C:\Users\Admin\AppData\Local\Temp\3851.tmp"85⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\38CE.tmp"C:\Users\Admin\AppData\Local\Temp\38CE.tmp"86⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\394B.tmp"C:\Users\Admin\AppData\Local\Temp\394B.tmp"87⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\39D8.tmp"C:\Users\Admin\AppData\Local\Temp\39D8.tmp"88⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\3A55.tmp"C:\Users\Admin\AppData\Local\Temp\3A55.tmp"89⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\3AD2.tmp"C:\Users\Admin\AppData\Local\Temp\3AD2.tmp"90⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"91⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\3BBC.tmp"C:\Users\Admin\AppData\Local\Temp\3BBC.tmp"92⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\3C58.tmp"C:\Users\Admin\AppData\Local\Temp\3C58.tmp"93⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\3CC6.tmp"C:\Users\Admin\AppData\Local\Temp\3CC6.tmp"94⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\3D43.tmp"C:\Users\Admin\AppData\Local\Temp\3D43.tmp"95⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\3DC0.tmp"C:\Users\Admin\AppData\Local\Temp\3DC0.tmp"96⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\3E5C.tmp"C:\Users\Admin\AppData\Local\Temp\3E5C.tmp"97⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\3F37.tmp"C:\Users\Admin\AppData\Local\Temp\3F37.tmp"98⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\4002.tmp"C:\Users\Admin\AppData\Local\Temp\4002.tmp"99⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\408E.tmp"C:\Users\Admin\AppData\Local\Temp\408E.tmp"100⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\412B.tmp"C:\Users\Admin\AppData\Local\Temp\412B.tmp"101⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\41C7.tmp"C:\Users\Admin\AppData\Local\Temp\41C7.tmp"102⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\4263.tmp"C:\Users\Admin\AppData\Local\Temp\4263.tmp"103⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\42F0.tmp"C:\Users\Admin\AppData\Local\Temp\42F0.tmp"104⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\436D.tmp"C:\Users\Admin\AppData\Local\Temp\436D.tmp"105⤵PID:492
-
C:\Users\Admin\AppData\Local\Temp\43F9.tmp"C:\Users\Admin\AppData\Local\Temp\43F9.tmp"106⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\4467.tmp"C:\Users\Admin\AppData\Local\Temp\4467.tmp"107⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\44E4.tmp"C:\Users\Admin\AppData\Local\Temp\44E4.tmp"108⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\4580.tmp"C:\Users\Admin\AppData\Local\Temp\4580.tmp"109⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\45FD.tmp"C:\Users\Admin\AppData\Local\Temp\45FD.tmp"110⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\466A.tmp"C:\Users\Admin\AppData\Local\Temp\466A.tmp"111⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\46D8.tmp"C:\Users\Admin\AppData\Local\Temp\46D8.tmp"112⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\4745.tmp"C:\Users\Admin\AppData\Local\Temp\4745.tmp"113⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\47E1.tmp"C:\Users\Admin\AppData\Local\Temp\47E1.tmp"114⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\487E.tmp"C:\Users\Admin\AppData\Local\Temp\487E.tmp"115⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\48FB.tmp"C:\Users\Admin\AppData\Local\Temp\48FB.tmp"116⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\4997.tmp"C:\Users\Admin\AppData\Local\Temp\4997.tmp"117⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\4A23.tmp"C:\Users\Admin\AppData\Local\Temp\4A23.tmp"118⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\4AA0.tmp"C:\Users\Admin\AppData\Local\Temp\4AA0.tmp"119⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\4B2D.tmp"C:\Users\Admin\AppData\Local\Temp\4B2D.tmp"120⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\4BBA.tmp"C:\Users\Admin\AppData\Local\Temp\4BBA.tmp"121⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\4C56.tmp"C:\Users\Admin\AppData\Local\Temp\4C56.tmp"122⤵PID:2376
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-