Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
26/08/2023, 13:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a1d355e9b54a3c6bffe00b37acc47345_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
a1d355e9b54a3c6bffe00b37acc47345_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
a1d355e9b54a3c6bffe00b37acc47345_mafia_JC.exe
-
Size
486KB
-
MD5
a1d355e9b54a3c6bffe00b37acc47345
-
SHA1
8209171e76655e93b783a165eb786fbaa531c0e1
-
SHA256
ba763cdec3d38828e2897deec2abf9e55fdaf39403afef5b3b78c6fbfb4c8cd0
-
SHA512
d45ab0aad33e57fa712e466253d6f6fbff800b7620abbe07cf06bcabf778f0bf6478caf3e8b3e6f5b2623a66de0d4fa6d4bd9477852fd9cc4b96a85fc9828dda
-
SSDEEP
12288:UU5rCOTeiDcHa+HeConzLXYU79DN7+j9NZ:UUQOJDmaueCYfxZDN7CN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3852 7E09.tmp 4840 7EA6.tmp 1160 7F42.tmp 4580 801D.tmp 2308 80F7.tmp 2112 81F1.tmp 1592 827E.tmp 2268 8349.tmp 3728 83F5.tmp 3988 84B1.tmp 808 853D.tmp 460 85D9.tmp 4632 879F.tmp 4956 881C.tmp 2556 88F6.tmp 2736 89A2.tmp 4260 8A6D.tmp 2656 8B29.tmp 756 8CBF.tmp 2464 8DA9.tmp 2328 8E36.tmp 2500 8EC3.tmp 1452 8F40.tmp 1368 900B.tmp 3488 90D6.tmp 3844 91A1.tmp 2116 92DA.tmp 3420 9395.tmp 3248 947F.tmp 1260 954B.tmp 4252 9616.tmp 4864 96C2.tmp 1152 97BC.tmp 1660 9858.tmp 1060 98E4.tmp 1996 9961.tmp 1832 99DE.tmp 5008 9A5B.tmp 3268 9B07.tmp 1140 9B75.tmp 648 9C01.tmp 4316 9CFB.tmp 1820 9D98.tmp 1512 9E43.tmp 4204 9EE0.tmp 4180 9F7C.tmp 3788 A009.tmp 4184 A076.tmp 3472 A0F3.tmp 2080 A180.tmp 1708 A1ED.tmp 1264 A27A.tmp 4552 A2E7.tmp 4672 A364.tmp 1504 A3E1.tmp 2308 A48D.tmp 4388 A50A.tmp 3100 A5A6.tmp 1268 A642.tmp 3976 A6CF.tmp 3992 A79A.tmp 4880 A7F8.tmp 3556 A865.tmp 460 A8B3.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2868 wrote to memory of 3852 2868 a1d355e9b54a3c6bffe00b37acc47345_mafia_JC.exe 81 PID 2868 wrote to memory of 3852 2868 a1d355e9b54a3c6bffe00b37acc47345_mafia_JC.exe 81 PID 2868 wrote to memory of 3852 2868 a1d355e9b54a3c6bffe00b37acc47345_mafia_JC.exe 81 PID 3852 wrote to memory of 4840 3852 7E09.tmp 82 PID 3852 wrote to memory of 4840 3852 7E09.tmp 82 PID 3852 wrote to memory of 4840 3852 7E09.tmp 82 PID 4840 wrote to memory of 1160 4840 7EA6.tmp 83 PID 4840 wrote to memory of 1160 4840 7EA6.tmp 83 PID 4840 wrote to memory of 1160 4840 7EA6.tmp 83 PID 1160 wrote to memory of 4580 1160 7F42.tmp 84 PID 1160 wrote to memory of 4580 1160 7F42.tmp 84 PID 1160 wrote to memory of 4580 1160 7F42.tmp 84 PID 4580 wrote to memory of 2308 4580 801D.tmp 85 PID 4580 wrote to memory of 2308 4580 801D.tmp 85 PID 4580 wrote to memory of 2308 4580 801D.tmp 85 PID 2308 wrote to memory of 2112 2308 80F7.tmp 86 PID 2308 wrote to memory of 2112 2308 80F7.tmp 86 PID 2308 wrote to memory of 2112 2308 80F7.tmp 86 PID 2112 wrote to memory of 1592 2112 81F1.tmp 87 PID 2112 wrote to memory of 1592 2112 81F1.tmp 87 PID 2112 wrote to memory of 1592 2112 81F1.tmp 87 PID 1592 wrote to memory of 2268 1592 827E.tmp 88 PID 1592 wrote to memory of 2268 1592 827E.tmp 88 PID 1592 wrote to memory of 2268 1592 827E.tmp 88 PID 2268 wrote to memory of 3728 2268 8349.tmp 89 PID 2268 wrote to memory of 3728 2268 8349.tmp 89 PID 2268 wrote to memory of 3728 2268 8349.tmp 89 PID 3728 wrote to memory of 3988 3728 83F5.tmp 90 PID 3728 wrote to memory of 3988 3728 83F5.tmp 90 PID 3728 wrote to memory of 3988 3728 83F5.tmp 90 PID 3988 wrote to memory of 808 3988 84B1.tmp 91 PID 3988 wrote to memory of 808 3988 84B1.tmp 91 PID 3988 wrote to memory of 808 3988 84B1.tmp 91 PID 808 wrote to memory of 460 808 853D.tmp 92 PID 808 wrote to memory of 460 808 853D.tmp 92 PID 808 wrote to memory of 460 808 853D.tmp 92 PID 460 wrote to memory of 4632 460 85D9.tmp 93 PID 460 wrote to memory of 4632 460 85D9.tmp 93 PID 460 wrote to memory of 4632 460 85D9.tmp 93 PID 4632 wrote to memory of 4956 4632 879F.tmp 94 PID 4632 wrote to memory of 4956 4632 879F.tmp 94 PID 4632 wrote to memory of 4956 4632 879F.tmp 94 PID 4956 wrote to memory of 2556 4956 881C.tmp 95 PID 4956 wrote to memory of 2556 4956 881C.tmp 95 PID 4956 wrote to memory of 2556 4956 881C.tmp 95 PID 2556 wrote to memory of 2736 2556 88F6.tmp 96 PID 2556 wrote to memory of 2736 2556 88F6.tmp 96 PID 2556 wrote to memory of 2736 2556 88F6.tmp 96 PID 2736 wrote to memory of 4260 2736 89A2.tmp 99 PID 2736 wrote to memory of 4260 2736 89A2.tmp 99 PID 2736 wrote to memory of 4260 2736 89A2.tmp 99 PID 4260 wrote to memory of 2656 4260 8A6D.tmp 100 PID 4260 wrote to memory of 2656 4260 8A6D.tmp 100 PID 4260 wrote to memory of 2656 4260 8A6D.tmp 100 PID 2656 wrote to memory of 756 2656 8B29.tmp 101 PID 2656 wrote to memory of 756 2656 8B29.tmp 101 PID 2656 wrote to memory of 756 2656 8B29.tmp 101 PID 756 wrote to memory of 2464 756 8CBF.tmp 102 PID 756 wrote to memory of 2464 756 8CBF.tmp 102 PID 756 wrote to memory of 2464 756 8CBF.tmp 102 PID 2464 wrote to memory of 2328 2464 8DA9.tmp 103 PID 2464 wrote to memory of 2328 2464 8DA9.tmp 103 PID 2464 wrote to memory of 2328 2464 8DA9.tmp 103 PID 2328 wrote to memory of 2500 2328 8E36.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1d355e9b54a3c6bffe00b37acc47345_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\a1d355e9b54a3c6bffe00b37acc47345_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\7E09.tmp"C:\Users\Admin\AppData\Local\Temp\7E09.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\7F42.tmp"C:\Users\Admin\AppData\Local\Temp\7F42.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\801D.tmp"C:\Users\Admin\AppData\Local\Temp\801D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\80F7.tmp"C:\Users\Admin\AppData\Local\Temp\80F7.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\81F1.tmp"C:\Users\Admin\AppData\Local\Temp\81F1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\827E.tmp"C:\Users\Admin\AppData\Local\Temp\827E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\8349.tmp"C:\Users\Admin\AppData\Local\Temp\8349.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\83F5.tmp"C:\Users\Admin\AppData\Local\Temp\83F5.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\84B1.tmp"C:\Users\Admin\AppData\Local\Temp\84B1.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\853D.tmp"C:\Users\Admin\AppData\Local\Temp\853D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\85D9.tmp"C:\Users\Admin\AppData\Local\Temp\85D9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Users\Admin\AppData\Local\Temp\879F.tmp"C:\Users\Admin\AppData\Local\Temp\879F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\881C.tmp"C:\Users\Admin\AppData\Local\Temp\881C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\88F6.tmp"C:\Users\Admin\AppData\Local\Temp\88F6.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\89A2.tmp"C:\Users\Admin\AppData\Local\Temp\89A2.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\8B29.tmp"C:\Users\Admin\AppData\Local\Temp\8B29.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"23⤵
- Executes dropped EXE
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\8F40.tmp"C:\Users\Admin\AppData\Local\Temp\8F40.tmp"24⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\900B.tmp"C:\Users\Admin\AppData\Local\Temp\900B.tmp"25⤵
- Executes dropped EXE
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"26⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"27⤵
- Executes dropped EXE
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\92DA.tmp"C:\Users\Admin\AppData\Local\Temp\92DA.tmp"28⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\9395.tmp"C:\Users\Admin\AppData\Local\Temp\9395.tmp"29⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\947F.tmp"C:\Users\Admin\AppData\Local\Temp\947F.tmp"30⤵
- Executes dropped EXE
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\954B.tmp"C:\Users\Admin\AppData\Local\Temp\954B.tmp"31⤵
- Executes dropped EXE
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"32⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\96C2.tmp"C:\Users\Admin\AppData\Local\Temp\96C2.tmp"33⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\97BC.tmp"C:\Users\Admin\AppData\Local\Temp\97BC.tmp"34⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"35⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\98E4.tmp"C:\Users\Admin\AppData\Local\Temp\98E4.tmp"36⤵
- Executes dropped EXE
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"37⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"38⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"39⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"40⤵
- Executes dropped EXE
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"41⤵
- Executes dropped EXE
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"42⤵
- Executes dropped EXE
PID:648 -
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"43⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"44⤵
- Executes dropped EXE
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"45⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"46⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"47⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"48⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\A076.tmp"C:\Users\Admin\AppData\Local\Temp\A076.tmp"49⤵
- Executes dropped EXE
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"50⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\A180.tmp"C:\Users\Admin\AppData\Local\Temp\A180.tmp"51⤵
- Executes dropped EXE
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"52⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"53⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"54⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\A364.tmp"C:\Users\Admin\AppData\Local\Temp\A364.tmp"55⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"56⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"57⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\A50A.tmp"C:\Users\Admin\AppData\Local\Temp\A50A.tmp"58⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"59⤵
- Executes dropped EXE
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\A642.tmp"C:\Users\Admin\AppData\Local\Temp\A642.tmp"60⤵
- Executes dropped EXE
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"61⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"62⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"63⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"64⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"65⤵
- Executes dropped EXE
PID:460 -
C:\Users\Admin\AppData\Local\Temp\A921.tmp"C:\Users\Admin\AppData\Local\Temp\A921.tmp"66⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"67⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"68⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\AA88.tmp"C:\Users\Admin\AppData\Local\Temp\AA88.tmp"69⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\AB15.tmp"C:\Users\Admin\AppData\Local\Temp\AB15.tmp"70⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"71⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"72⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"73⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"74⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"75⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\AE80.tmp"C:\Users\Admin\AppData\Local\Temp\AE80.tmp"76⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"77⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"78⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\B045.tmp"C:\Users\Admin\AppData\Local\Temp\B045.tmp"79⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"80⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"81⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"82⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\B258.tmp"C:\Users\Admin\AppData\Local\Temp\B258.tmp"83⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"84⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"85⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"86⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\B40E.tmp"C:\Users\Admin\AppData\Local\Temp\B40E.tmp"87⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\B46B.tmp"C:\Users\Admin\AppData\Local\Temp\B46B.tmp"88⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"89⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\B575.tmp"C:\Users\Admin\AppData\Local\Temp\B575.tmp"90⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\B602.tmp"C:\Users\Admin\AppData\Local\Temp\B602.tmp"91⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\B67F.tmp"C:\Users\Admin\AppData\Local\Temp\B67F.tmp"92⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\B70B.tmp"C:\Users\Admin\AppData\Local\Temp\B70B.tmp"93⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\B788.tmp"C:\Users\Admin\AppData\Local\Temp\B788.tmp"94⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\B824.tmp"C:\Users\Admin\AppData\Local\Temp\B824.tmp"95⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"96⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\B93E.tmp"C:\Users\Admin\AppData\Local\Temp\B93E.tmp"97⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"98⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\BA57.tmp"C:\Users\Admin\AppData\Local\Temp\BA57.tmp"99⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"100⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\BB70.tmp"C:\Users\Admin\AppData\Local\Temp\BB70.tmp"101⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"102⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"103⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\BD06.tmp"C:\Users\Admin\AppData\Local\Temp\BD06.tmp"104⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\BD93.tmp"C:\Users\Admin\AppData\Local\Temp\BD93.tmp"105⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\BE20.tmp"C:\Users\Admin\AppData\Local\Temp\BE20.tmp"106⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"107⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\BF39.tmp"C:\Users\Admin\AppData\Local\Temp\BF39.tmp"108⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"109⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\C052.tmp"C:\Users\Admin\AppData\Local\Temp\C052.tmp"110⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"111⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"112⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\C36F.tmp"C:\Users\Admin\AppData\Local\Temp\C36F.tmp"113⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"114⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\C488.tmp"C:\Users\Admin\AppData\Local\Temp\C488.tmp"115⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\C525.tmp"C:\Users\Admin\AppData\Local\Temp\C525.tmp"116⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"117⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\C61F.tmp"C:\Users\Admin\AppData\Local\Temp\C61F.tmp"118⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"119⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"120⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\C813.tmp"C:\Users\Admin\AppData\Local\Temp\C813.tmp"121⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\C890.tmp"C:\Users\Admin\AppData\Local\Temp\C890.tmp"122⤵PID:3372
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-