Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2023, 10:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8d2fd8924e0a06b7b1a6bea8a5f636dd_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
8d2fd8924e0a06b7b1a6bea8a5f636dd_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
8d2fd8924e0a06b7b1a6bea8a5f636dd_mafia_JC.exe
-
Size
486KB
-
MD5
8d2fd8924e0a06b7b1a6bea8a5f636dd
-
SHA1
22a159d8a6895e5a38bfc6e5eac54d6d9bdcc822
-
SHA256
f45c5584ef3e3f8e9a71cda615b47a03c4222216f1008696d398ca76752f28a1
-
SHA512
e9371234f58fbb407db933db700dce4ff92d8a3f3d67fc2371314d564895d58490a02c71dbdc9df6b8c2ed7e6b038d041e451a76438617299862184a5e69ff80
-
SSDEEP
12288:UU5rCOTeiDZZ2vJdBWn3NRLjKPF+DWJvdsz1NZ:UUQOJDnF3nLIsZN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4108 6FE0.tmp 3488 709C.tmp 4868 7167.tmp 2332 7261.tmp 1664 730D.tmp 2656 73A9.tmp 1724 7445.tmp 2896 74F1.tmp 2468 759D.tmp 4676 7659.tmp 968 7714.tmp 3756 77C0.tmp 4720 78CA.tmp 1412 79C4.tmp 4832 7A41.tmp 3296 7AAE.tmp 1320 7B3B.tmp 3820 7C25.tmp 2860 7CB2.tmp 3940 7E19.tmp 2252 7EC5.tmp 1252 7FA0.tmp 3732 804C.tmp 2424 8107.tmp 3588 81C3.tmp 4292 824F.tmp 3772 82EB.tmp 3156 8405.tmp 856 84A1.tmp 4840 854D.tmp 4332 8618.tmp 1248 86E3.tmp 1540 87AE.tmp 2616 882B.tmp 4440 8916.tmp 3380 89C1.tmp 3232 8A4E.tmp 2604 8AFA.tmp 4616 8B77.tmp 1892 8C04.tmp 3240 8CA0.tmp 4316 8D4C.tmp 952 8DD8.tmp 3636 8E75.tmp 3376 8F01.tmp 4504 8F7E.tmp 1616 901A.tmp 1500 90A7.tmp 3372 9124.tmp 624 91B1.tmp 4172 923D.tmp 2224 92CA.tmp 2292 9357.tmp 1628 93C4.tmp 3488 9451.tmp 4868 94CE.tmp 3796 955A.tmp 1372 95B8.tmp 4016 9635.tmp 3644 96D1.tmp 4340 973F.tmp 1692 97DB.tmp 4584 9848.tmp 1900 98B6.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1112 wrote to memory of 4108 1112 8d2fd8924e0a06b7b1a6bea8a5f636dd_mafia_JC.exe 82 PID 1112 wrote to memory of 4108 1112 8d2fd8924e0a06b7b1a6bea8a5f636dd_mafia_JC.exe 82 PID 1112 wrote to memory of 4108 1112 8d2fd8924e0a06b7b1a6bea8a5f636dd_mafia_JC.exe 82 PID 4108 wrote to memory of 3488 4108 6FE0.tmp 83 PID 4108 wrote to memory of 3488 4108 6FE0.tmp 83 PID 4108 wrote to memory of 3488 4108 6FE0.tmp 83 PID 3488 wrote to memory of 4868 3488 709C.tmp 84 PID 3488 wrote to memory of 4868 3488 709C.tmp 84 PID 3488 wrote to memory of 4868 3488 709C.tmp 84 PID 4868 wrote to memory of 2332 4868 7167.tmp 85 PID 4868 wrote to memory of 2332 4868 7167.tmp 85 PID 4868 wrote to memory of 2332 4868 7167.tmp 85 PID 2332 wrote to memory of 1664 2332 7261.tmp 86 PID 2332 wrote to memory of 1664 2332 7261.tmp 86 PID 2332 wrote to memory of 1664 2332 7261.tmp 86 PID 1664 wrote to memory of 2656 1664 730D.tmp 87 PID 1664 wrote to memory of 2656 1664 730D.tmp 87 PID 1664 wrote to memory of 2656 1664 730D.tmp 87 PID 2656 wrote to memory of 1724 2656 73A9.tmp 88 PID 2656 wrote to memory of 1724 2656 73A9.tmp 88 PID 2656 wrote to memory of 1724 2656 73A9.tmp 88 PID 1724 wrote to memory of 2896 1724 7445.tmp 89 PID 1724 wrote to memory of 2896 1724 7445.tmp 89 PID 1724 wrote to memory of 2896 1724 7445.tmp 89 PID 2896 wrote to memory of 2468 2896 74F1.tmp 90 PID 2896 wrote to memory of 2468 2896 74F1.tmp 90 PID 2896 wrote to memory of 2468 2896 74F1.tmp 90 PID 2468 wrote to memory of 4676 2468 759D.tmp 91 PID 2468 wrote to memory of 4676 2468 759D.tmp 91 PID 2468 wrote to memory of 4676 2468 759D.tmp 91 PID 4676 wrote to memory of 968 4676 7659.tmp 92 PID 4676 wrote to memory of 968 4676 7659.tmp 92 PID 4676 wrote to memory of 968 4676 7659.tmp 92 PID 968 wrote to memory of 3756 968 7714.tmp 93 PID 968 wrote to memory of 3756 968 7714.tmp 93 PID 968 wrote to memory of 3756 968 7714.tmp 93 PID 3756 wrote to memory of 4720 3756 77C0.tmp 94 PID 3756 wrote to memory of 4720 3756 77C0.tmp 94 PID 3756 wrote to memory of 4720 3756 77C0.tmp 94 PID 4720 wrote to memory of 1412 4720 78CA.tmp 95 PID 4720 wrote to memory of 1412 4720 78CA.tmp 95 PID 4720 wrote to memory of 1412 4720 78CA.tmp 95 PID 1412 wrote to memory of 4832 1412 79C4.tmp 96 PID 1412 wrote to memory of 4832 1412 79C4.tmp 96 PID 1412 wrote to memory of 4832 1412 79C4.tmp 96 PID 4832 wrote to memory of 3296 4832 7A41.tmp 97 PID 4832 wrote to memory of 3296 4832 7A41.tmp 97 PID 4832 wrote to memory of 3296 4832 7A41.tmp 97 PID 3296 wrote to memory of 1320 3296 7AAE.tmp 98 PID 3296 wrote to memory of 1320 3296 7AAE.tmp 98 PID 3296 wrote to memory of 1320 3296 7AAE.tmp 98 PID 1320 wrote to memory of 3820 1320 7B3B.tmp 101 PID 1320 wrote to memory of 3820 1320 7B3B.tmp 101 PID 1320 wrote to memory of 3820 1320 7B3B.tmp 101 PID 3820 wrote to memory of 2860 3820 7C25.tmp 102 PID 3820 wrote to memory of 2860 3820 7C25.tmp 102 PID 3820 wrote to memory of 2860 3820 7C25.tmp 102 PID 2860 wrote to memory of 3940 2860 7CB2.tmp 103 PID 2860 wrote to memory of 3940 2860 7CB2.tmp 103 PID 2860 wrote to memory of 3940 2860 7CB2.tmp 103 PID 3940 wrote to memory of 2252 3940 7E19.tmp 104 PID 3940 wrote to memory of 2252 3940 7E19.tmp 104 PID 3940 wrote to memory of 2252 3940 7E19.tmp 104 PID 2252 wrote to memory of 1252 2252 7EC5.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d2fd8924e0a06b7b1a6bea8a5f636dd_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\8d2fd8924e0a06b7b1a6bea8a5f636dd_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\7445.tmp"C:\Users\Admin\AppData\Local\Temp\7445.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\74F1.tmp"C:\Users\Admin\AppData\Local\Temp\74F1.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\7659.tmp"C:\Users\Admin\AppData\Local\Temp\7659.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\7714.tmp"C:\Users\Admin\AppData\Local\Temp\7714.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\79C4.tmp"C:\Users\Admin\AppData\Local\Temp\79C4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"23⤵
- Executes dropped EXE
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\804C.tmp"C:\Users\Admin\AppData\Local\Temp\804C.tmp"24⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\8107.tmp"C:\Users\Admin\AppData\Local\Temp\8107.tmp"25⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\81C3.tmp"C:\Users\Admin\AppData\Local\Temp\81C3.tmp"26⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\824F.tmp"C:\Users\Admin\AppData\Local\Temp\824F.tmp"27⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\82EB.tmp"C:\Users\Admin\AppData\Local\Temp\82EB.tmp"28⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\8405.tmp"C:\Users\Admin\AppData\Local\Temp\8405.tmp"29⤵
- Executes dropped EXE
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\84A1.tmp"C:\Users\Admin\AppData\Local\Temp\84A1.tmp"30⤵
- Executes dropped EXE
PID:856 -
C:\Users\Admin\AppData\Local\Temp\854D.tmp"C:\Users\Admin\AppData\Local\Temp\854D.tmp"31⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\8618.tmp"C:\Users\Admin\AppData\Local\Temp\8618.tmp"32⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\86E3.tmp"C:\Users\Admin\AppData\Local\Temp\86E3.tmp"33⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\87AE.tmp"C:\Users\Admin\AppData\Local\Temp\87AE.tmp"34⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\882B.tmp"C:\Users\Admin\AppData\Local\Temp\882B.tmp"35⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\8916.tmp"C:\Users\Admin\AppData\Local\Temp\8916.tmp"36⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\89C1.tmp"C:\Users\Admin\AppData\Local\Temp\89C1.tmp"37⤵
- Executes dropped EXE
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"38⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"39⤵
- Executes dropped EXE
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\8B77.tmp"C:\Users\Admin\AppData\Local\Temp\8B77.tmp"40⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\8C04.tmp"C:\Users\Admin\AppData\Local\Temp\8C04.tmp"41⤵
- Executes dropped EXE
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"42⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"43⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"44⤵
- Executes dropped EXE
PID:952 -
C:\Users\Admin\AppData\Local\Temp\8E75.tmp"C:\Users\Admin\AppData\Local\Temp\8E75.tmp"45⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\8F01.tmp"C:\Users\Admin\AppData\Local\Temp\8F01.tmp"46⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"47⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\901A.tmp"C:\Users\Admin\AppData\Local\Temp\901A.tmp"48⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\90A7.tmp"C:\Users\Admin\AppData\Local\Temp\90A7.tmp"49⤵
- Executes dropped EXE
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"50⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\91B1.tmp"C:\Users\Admin\AppData\Local\Temp\91B1.tmp"51⤵
- Executes dropped EXE
PID:624 -
C:\Users\Admin\AppData\Local\Temp\923D.tmp"C:\Users\Admin\AppData\Local\Temp\923D.tmp"52⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\92CA.tmp"C:\Users\Admin\AppData\Local\Temp\92CA.tmp"53⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"54⤵
- Executes dropped EXE
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"55⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\9451.tmp"C:\Users\Admin\AppData\Local\Temp\9451.tmp"56⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\94CE.tmp"C:\Users\Admin\AppData\Local\Temp\94CE.tmp"57⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"58⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\95B8.tmp"C:\Users\Admin\AppData\Local\Temp\95B8.tmp"59⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"60⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\96D1.tmp"C:\Users\Admin\AppData\Local\Temp\96D1.tmp"61⤵
- Executes dropped EXE
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"62⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\97DB.tmp"C:\Users\Admin\AppData\Local\Temp\97DB.tmp"63⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\9848.tmp"C:\Users\Admin\AppData\Local\Temp\9848.tmp"64⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\98B6.tmp"C:\Users\Admin\AppData\Local\Temp\98B6.tmp"65⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"66⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"67⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"68⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"69⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"70⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"71⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"72⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"73⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"74⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"75⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\9E53.tmp"C:\Users\Admin\AppData\Local\Temp\9E53.tmp"76⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"77⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"78⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"79⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\A095.tmp"C:\Users\Admin\AppData\Local\Temp\A095.tmp"80⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\A112.tmp"C:\Users\Admin\AppData\Local\Temp\A112.tmp"81⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\A180.tmp"C:\Users\Admin\AppData\Local\Temp\A180.tmp"82⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"83⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\A299.tmp"C:\Users\Admin\AppData\Local\Temp\A299.tmp"84⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\A325.tmp"C:\Users\Admin\AppData\Local\Temp\A325.tmp"85⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"86⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\A43F.tmp"C:\Users\Admin\AppData\Local\Temp\A43F.tmp"87⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"88⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"89⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"90⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"91⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\A671.tmp"C:\Users\Admin\AppData\Local\Temp\A671.tmp"92⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"93⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\A76B.tmp"C:\Users\Admin\AppData\Local\Temp\A76B.tmp"94⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"95⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"96⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"97⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"98⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"99⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"100⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"101⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"102⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"103⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"104⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"105⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\AD76.tmp"C:\Users\Admin\AppData\Local\Temp\AD76.tmp"106⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"107⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\AE80.tmp"C:\Users\Admin\AppData\Local\Temp\AE80.tmp"108⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"109⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"110⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\B035.tmp"C:\Users\Admin\AppData\Local\Temp\B035.tmp"111⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"112⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\B14E.tmp"C:\Users\Admin\AppData\Local\Temp\B14E.tmp"113⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"114⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\B258.tmp"C:\Users\Admin\AppData\Local\Temp\B258.tmp"115⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"116⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\B391.tmp"C:\Users\Admin\AppData\Local\Temp\B391.tmp"117⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\B41D.tmp"C:\Users\Admin\AppData\Local\Temp\B41D.tmp"118⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"119⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"120⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"121⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\B66F.tmp"C:\Users\Admin\AppData\Local\Temp\B66F.tmp"122⤵PID:4016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-