Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
25-08-2023 14:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
93749d78b8d92170f681673eb6c3fbb3_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
93749d78b8d92170f681673eb6c3fbb3_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
93749d78b8d92170f681673eb6c3fbb3_mafia_JC.exe
-
Size
487KB
-
MD5
93749d78b8d92170f681673eb6c3fbb3
-
SHA1
2831ea09a5e1ef9b31d1d089b79cd49e9e96568c
-
SHA256
c761163aae004c45c2bfcd1244edd82b08dd049889213c6984a08f58fe28126f
-
SHA512
ace2321d53ab46a065e6a073bf2b3a2ed87957d011142a139344c05ec5b065d3312dd4ed8098341140a2593d8482232e90a3fd633d57ebc865e4d9cc9536c3d2
-
SSDEEP
12288:HU5rCOTeiJuw3QbXY8SnwVprTn3lwVNZ:HUQOJJuwgbJrprTn3lEN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1376 8EF2.tmp 3952 8FBD.tmp 3356 9049.tmp 4896 9124.tmp 3120 91FF.tmp 5036 928B.tmp 4124 9376.tmp 568 9431.tmp 3520 94ED.tmp 2088 9589.tmp 384 9625.tmp 496 96B2.tmp 1016 979C.tmp 2864 9877.tmp 4444 9923.tmp 4504 99BF.tmp 3708 9A5B.tmp 2888 9B07.tmp 4480 9BD2.tmp 2936 9D49.tmp 3488 9DC6.tmp 880 9E72.tmp 3624 9F4D.tmp 4420 9FF9.tmp 4680 A0E3.tmp 4984 A18F.tmp 3912 A22B.tmp 2660 A2A8.tmp 2592 A374.tmp 2556 A400.tmp 1912 A49C.tmp 1724 A529.tmp 2692 A604.tmp 436 A6B0.tmp 1324 A71D.tmp 980 A7B9.tmp 736 A846.tmp 1388 A8C3.tmp 2872 A940.tmp 3028 A9EC.tmp 4840 AA78.tmp 944 AB24.tmp 716 ABC1.tmp 4560 AC4D.tmp 4736 ACE9.tmp 4832 AD76.tmp 1612 ADF3.tmp 2984 AE60.tmp 488 AEFD.tmp 404 AFB8.tmp 3744 B054.tmp 948 B1FA.tmp 1476 B268.tmp 2184 B2E5.tmp 1348 B352.tmp 3952 B3EE.tmp 3596 B48B.tmp 4616 B527.tmp 1140 B594.tmp 4868 B621.tmp 2104 B69E.tmp 4712 B71B.tmp 2720 B7C7.tmp 2972 B882.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5084 wrote to memory of 1376 5084 93749d78b8d92170f681673eb6c3fbb3_mafia_JC.exe 81 PID 5084 wrote to memory of 1376 5084 93749d78b8d92170f681673eb6c3fbb3_mafia_JC.exe 81 PID 5084 wrote to memory of 1376 5084 93749d78b8d92170f681673eb6c3fbb3_mafia_JC.exe 81 PID 1376 wrote to memory of 3952 1376 8EF2.tmp 82 PID 1376 wrote to memory of 3952 1376 8EF2.tmp 82 PID 1376 wrote to memory of 3952 1376 8EF2.tmp 82 PID 3952 wrote to memory of 3356 3952 8FBD.tmp 83 PID 3952 wrote to memory of 3356 3952 8FBD.tmp 83 PID 3952 wrote to memory of 3356 3952 8FBD.tmp 83 PID 3356 wrote to memory of 4896 3356 9049.tmp 84 PID 3356 wrote to memory of 4896 3356 9049.tmp 84 PID 3356 wrote to memory of 4896 3356 9049.tmp 84 PID 4896 wrote to memory of 3120 4896 9124.tmp 85 PID 4896 wrote to memory of 3120 4896 9124.tmp 85 PID 4896 wrote to memory of 3120 4896 9124.tmp 85 PID 3120 wrote to memory of 5036 3120 91FF.tmp 86 PID 3120 wrote to memory of 5036 3120 91FF.tmp 86 PID 3120 wrote to memory of 5036 3120 91FF.tmp 86 PID 5036 wrote to memory of 4124 5036 928B.tmp 87 PID 5036 wrote to memory of 4124 5036 928B.tmp 87 PID 5036 wrote to memory of 4124 5036 928B.tmp 87 PID 4124 wrote to memory of 568 4124 9376.tmp 88 PID 4124 wrote to memory of 568 4124 9376.tmp 88 PID 4124 wrote to memory of 568 4124 9376.tmp 88 PID 568 wrote to memory of 3520 568 9431.tmp 89 PID 568 wrote to memory of 3520 568 9431.tmp 89 PID 568 wrote to memory of 3520 568 9431.tmp 89 PID 3520 wrote to memory of 2088 3520 94ED.tmp 90 PID 3520 wrote to memory of 2088 3520 94ED.tmp 90 PID 3520 wrote to memory of 2088 3520 94ED.tmp 90 PID 2088 wrote to memory of 384 2088 9589.tmp 91 PID 2088 wrote to memory of 384 2088 9589.tmp 91 PID 2088 wrote to memory of 384 2088 9589.tmp 91 PID 384 wrote to memory of 496 384 9625.tmp 92 PID 384 wrote to memory of 496 384 9625.tmp 92 PID 384 wrote to memory of 496 384 9625.tmp 92 PID 496 wrote to memory of 1016 496 96B2.tmp 93 PID 496 wrote to memory of 1016 496 96B2.tmp 93 PID 496 wrote to memory of 1016 496 96B2.tmp 93 PID 1016 wrote to memory of 2864 1016 979C.tmp 94 PID 1016 wrote to memory of 2864 1016 979C.tmp 94 PID 1016 wrote to memory of 2864 1016 979C.tmp 94 PID 2864 wrote to memory of 4444 2864 9877.tmp 95 PID 2864 wrote to memory of 4444 2864 9877.tmp 95 PID 2864 wrote to memory of 4444 2864 9877.tmp 95 PID 4444 wrote to memory of 4504 4444 9923.tmp 96 PID 4444 wrote to memory of 4504 4444 9923.tmp 96 PID 4444 wrote to memory of 4504 4444 9923.tmp 96 PID 4504 wrote to memory of 3708 4504 99BF.tmp 97 PID 4504 wrote to memory of 3708 4504 99BF.tmp 97 PID 4504 wrote to memory of 3708 4504 99BF.tmp 97 PID 3708 wrote to memory of 2888 3708 9A5B.tmp 98 PID 3708 wrote to memory of 2888 3708 9A5B.tmp 98 PID 3708 wrote to memory of 2888 3708 9A5B.tmp 98 PID 2888 wrote to memory of 4480 2888 9B07.tmp 99 PID 2888 wrote to memory of 4480 2888 9B07.tmp 99 PID 2888 wrote to memory of 4480 2888 9B07.tmp 99 PID 4480 wrote to memory of 2936 4480 9BD2.tmp 102 PID 4480 wrote to memory of 2936 4480 9BD2.tmp 102 PID 4480 wrote to memory of 2936 4480 9BD2.tmp 102 PID 2936 wrote to memory of 3488 2936 9D49.tmp 103 PID 2936 wrote to memory of 3488 2936 9D49.tmp 103 PID 2936 wrote to memory of 3488 2936 9D49.tmp 103 PID 3488 wrote to memory of 880 3488 9DC6.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\93749d78b8d92170f681673eb6c3fbb3_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\93749d78b8d92170f681673eb6c3fbb3_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\9049.tmp"C:\Users\Admin\AppData\Local\Temp\9049.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\9376.tmp"C:\Users\Admin\AppData\Local\Temp\9376.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Users\Admin\AppData\Local\Temp\94ED.tmp"C:\Users\Admin\AppData\Local\Temp\94ED.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\9625.tmp"C:\Users\Admin\AppData\Local\Temp\9625.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\AppData\Local\Temp\96B2.tmp"C:\Users\Admin\AppData\Local\Temp\96B2.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:496 -
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\9877.tmp"C:\Users\Admin\AppData\Local\Temp\9877.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\9923.tmp"C:\Users\Admin\AppData\Local\Temp\9923.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\99BF.tmp"C:\Users\Admin\AppData\Local\Temp\99BF.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\9E72.tmp"C:\Users\Admin\AppData\Local\Temp\9E72.tmp"23⤵
- Executes dropped EXE
PID:880 -
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"24⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"25⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"26⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\A18F.tmp"C:\Users\Admin\AppData\Local\Temp\A18F.tmp"27⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"28⤵
- Executes dropped EXE
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"29⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\A374.tmp"C:\Users\Admin\AppData\Local\Temp\A374.tmp"30⤵
- Executes dropped EXE
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"31⤵
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"32⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"33⤵
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"34⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"35⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"36⤵
- Executes dropped EXE
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"37⤵
- Executes dropped EXE
PID:980 -
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"38⤵
- Executes dropped EXE
PID:736 -
C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"39⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\A940.tmp"C:\Users\Admin\AppData\Local\Temp\A940.tmp"40⤵
- Executes dropped EXE
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"41⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"42⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"43⤵
- Executes dropped EXE
PID:944 -
C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"44⤵
- Executes dropped EXE
PID:716 -
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"45⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"46⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\AD76.tmp"C:\Users\Admin\AppData\Local\Temp\AD76.tmp"47⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"48⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\AE60.tmp"C:\Users\Admin\AppData\Local\Temp\AE60.tmp"49⤵
- Executes dropped EXE
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"50⤵
- Executes dropped EXE
PID:488 -
C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"51⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\B054.tmp"C:\Users\Admin\AppData\Local\Temp\B054.tmp"52⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"53⤵
- Executes dropped EXE
PID:948 -
C:\Users\Admin\AppData\Local\Temp\B268.tmp"C:\Users\Admin\AppData\Local\Temp\B268.tmp"54⤵
- Executes dropped EXE
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"55⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\B352.tmp"C:\Users\Admin\AppData\Local\Temp\B352.tmp"56⤵
- Executes dropped EXE
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"57⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\B48B.tmp"C:\Users\Admin\AppData\Local\Temp\B48B.tmp"58⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\B527.tmp"C:\Users\Admin\AppData\Local\Temp\B527.tmp"59⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\B594.tmp"C:\Users\Admin\AppData\Local\Temp\B594.tmp"60⤵
- Executes dropped EXE
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\B621.tmp"C:\Users\Admin\AppData\Local\Temp\B621.tmp"61⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\B69E.tmp"C:\Users\Admin\AppData\Local\Temp\B69E.tmp"62⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\B71B.tmp"C:\Users\Admin\AppData\Local\Temp\B71B.tmp"63⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"64⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\B882.tmp"C:\Users\Admin\AppData\Local\Temp\B882.tmp"65⤵
- Executes dropped EXE
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\B91E.tmp"C:\Users\Admin\AppData\Local\Temp\B91E.tmp"66⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"67⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\BA57.tmp"C:\Users\Admin\AppData\Local\Temp\BA57.tmp"68⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"69⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\BB32.tmp"C:\Users\Admin\AppData\Local\Temp\BB32.tmp"70⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"71⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"72⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\BC99.tmp"C:\Users\Admin\AppData\Local\Temp\BC99.tmp"73⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\BD16.tmp"C:\Users\Admin\AppData\Local\Temp\BD16.tmp"74⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"75⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"76⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"77⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\BF58.tmp"C:\Users\Admin\AppData\Local\Temp\BF58.tmp"78⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"79⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\C023.tmp"C:\Users\Admin\AppData\Local\Temp\C023.tmp"80⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"81⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\C10E.tmp"C:\Users\Admin\AppData\Local\Temp\C10E.tmp"82⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\C18B.tmp"C:\Users\Admin\AppData\Local\Temp\C18B.tmp"83⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"84⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\C294.tmp"C:\Users\Admin\AppData\Local\Temp\C294.tmp"85⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\C331.tmp"C:\Users\Admin\AppData\Local\Temp\C331.tmp"86⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\C3DC.tmp"C:\Users\Admin\AppData\Local\Temp\C3DC.tmp"87⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\C459.tmp"C:\Users\Admin\AppData\Local\Temp\C459.tmp"88⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"89⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\C525.tmp"C:\Users\Admin\AppData\Local\Temp\C525.tmp"90⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"91⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\C64D.tmp"C:\Users\Admin\AppData\Local\Temp\C64D.tmp"92⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"93⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\C738.tmp"C:\Users\Admin\AppData\Local\Temp\C738.tmp"94⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"95⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\C832.tmp"C:\Users\Admin\AppData\Local\Temp\C832.tmp"96⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"97⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\C90D.tmp"C:\Users\Admin\AppData\Local\Temp\C90D.tmp"98⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\C98A.tmp"C:\Users\Admin\AppData\Local\Temp\C98A.tmp"99⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\CA16.tmp"C:\Users\Admin\AppData\Local\Temp\CA16.tmp"100⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"101⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"102⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\CBAC.tmp"C:\Users\Admin\AppData\Local\Temp\CBAC.tmp"103⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\CC39.tmp"C:\Users\Admin\AppData\Local\Temp\CC39.tmp"104⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"105⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\CD43.tmp"C:\Users\Admin\AppData\Local\Temp\CD43.tmp"106⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\CDC0.tmp"C:\Users\Admin\AppData\Local\Temp\CDC0.tmp"107⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"108⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\CEC9.tmp"C:\Users\Admin\AppData\Local\Temp\CEC9.tmp"109⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\CF46.tmp"C:\Users\Admin\AppData\Local\Temp\CF46.tmp"110⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"111⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\D050.tmp"C:\Users\Admin\AppData\Local\Temp\D050.tmp"112⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"113⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\D15A.tmp"C:\Users\Admin\AppData\Local\Temp\D15A.tmp"114⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"115⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\D2A2.tmp"C:\Users\Admin\AppData\Local\Temp\D2A2.tmp"116⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\D33E.tmp"C:\Users\Admin\AppData\Local\Temp\D33E.tmp"117⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\D3CB.tmp"C:\Users\Admin\AppData\Local\Temp\D3CB.tmp"118⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\D457.tmp"C:\Users\Admin\AppData\Local\Temp\D457.tmp"119⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\D4C5.tmp"C:\Users\Admin\AppData\Local\Temp\D4C5.tmp"120⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\D532.tmp"C:\Users\Admin\AppData\Local\Temp\D532.tmp"121⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"122⤵PID:1140
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-