Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
27-08-2023 15:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ad7f665e070cb6b6fbb4d138b18bf218_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
ad7f665e070cb6b6fbb4d138b18bf218_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
ad7f665e070cb6b6fbb4d138b18bf218_mafia_JC.exe
-
Size
487KB
-
MD5
ad7f665e070cb6b6fbb4d138b18bf218
-
SHA1
5b92ef2c1b34beffb03fcdf939c871a0bb35ea41
-
SHA256
ffaa2f4e066b7f67a70691626c327af4946550c62fa52358bda0dab88b5e5d62
-
SHA512
0289cce09d887624e71428962ab01bb9cb420626d9c275951fb46f4e80ef51fa67fb78b37f847e00ab7882be9afcd131c30a0a851fc5d3b41f72c2603d0de5c1
-
SSDEEP
12288:HU5rCOTeiJ8p224rCFzUMsY4tw8Gvjf5sjNZ:HUQOJJARlp4twHKjN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 456 69D6.tmp 3868 6A91.tmp 1928 6B5C.tmp 1292 6C56.tmp 644 6D21.tmp 2132 6DFC.tmp 1016 6EA8.tmp 4912 6FB2.tmp 3556 707D.tmp 4920 7129.tmp 2640 7223.tmp 4872 72EE.tmp 2420 74E2.tmp 4116 758E.tmp 5036 7649.tmp 3752 76D6.tmp 3696 77D0.tmp 4556 78CA.tmp 1852 79C4.tmp 2768 7A9E.tmp 2036 7B89.tmp 4208 7C44.tmp 3584 7D00.tmp 860 7DAC.tmp 1032 7E48.tmp 656 7F03.tmp 5012 7FA0.tmp 1600 803C.tmp 1148 8146.tmp 1972 826E.tmp 1808 8359.tmp 1316 8405.tmp 1744 84FF.tmp 4756 857C.tmp 3092 8618.tmp 4836 86A5.tmp 3164 8750.tmp 1728 87DD.tmp 4456 886A.tmp 1584 88F6.tmp 4228 8964.tmp 2856 8A00.tmp 4592 8A7D.tmp 3960 8B19.tmp 3884 8BB5.tmp 4248 8C42.tmp 4656 8CDE.tmp 3656 8D7B.tmp 4404 8E07.tmp 2208 8EA3.tmp 4692 8F40.tmp 3680 8FCC.tmp 4060 9059.tmp 3708 90F5.tmp 4104 9182.tmp 3284 921E.tmp 3040 929B.tmp 3184 9318.tmp 3692 93B4.tmp 2936 9431.tmp 4912 949F.tmp 792 951C.tmp 4796 9599.tmp 1888 95F6.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4276 wrote to memory of 456 4276 ad7f665e070cb6b6fbb4d138b18bf218_mafia_JC.exe 81 PID 4276 wrote to memory of 456 4276 ad7f665e070cb6b6fbb4d138b18bf218_mafia_JC.exe 81 PID 4276 wrote to memory of 456 4276 ad7f665e070cb6b6fbb4d138b18bf218_mafia_JC.exe 81 PID 456 wrote to memory of 3868 456 69D6.tmp 82 PID 456 wrote to memory of 3868 456 69D6.tmp 82 PID 456 wrote to memory of 3868 456 69D6.tmp 82 PID 3868 wrote to memory of 1928 3868 6A91.tmp 83 PID 3868 wrote to memory of 1928 3868 6A91.tmp 83 PID 3868 wrote to memory of 1928 3868 6A91.tmp 83 PID 1928 wrote to memory of 1292 1928 6B5C.tmp 84 PID 1928 wrote to memory of 1292 1928 6B5C.tmp 84 PID 1928 wrote to memory of 1292 1928 6B5C.tmp 84 PID 1292 wrote to memory of 644 1292 6C56.tmp 85 PID 1292 wrote to memory of 644 1292 6C56.tmp 85 PID 1292 wrote to memory of 644 1292 6C56.tmp 85 PID 644 wrote to memory of 2132 644 6D21.tmp 86 PID 644 wrote to memory of 2132 644 6D21.tmp 86 PID 644 wrote to memory of 2132 644 6D21.tmp 86 PID 2132 wrote to memory of 1016 2132 6DFC.tmp 87 PID 2132 wrote to memory of 1016 2132 6DFC.tmp 87 PID 2132 wrote to memory of 1016 2132 6DFC.tmp 87 PID 1016 wrote to memory of 4912 1016 6EA8.tmp 88 PID 1016 wrote to memory of 4912 1016 6EA8.tmp 88 PID 1016 wrote to memory of 4912 1016 6EA8.tmp 88 PID 4912 wrote to memory of 3556 4912 6FB2.tmp 89 PID 4912 wrote to memory of 3556 4912 6FB2.tmp 89 PID 4912 wrote to memory of 3556 4912 6FB2.tmp 89 PID 3556 wrote to memory of 4920 3556 707D.tmp 90 PID 3556 wrote to memory of 4920 3556 707D.tmp 90 PID 3556 wrote to memory of 4920 3556 707D.tmp 90 PID 4920 wrote to memory of 2640 4920 7129.tmp 91 PID 4920 wrote to memory of 2640 4920 7129.tmp 91 PID 4920 wrote to memory of 2640 4920 7129.tmp 91 PID 2640 wrote to memory of 4872 2640 7223.tmp 92 PID 2640 wrote to memory of 4872 2640 7223.tmp 92 PID 2640 wrote to memory of 4872 2640 7223.tmp 92 PID 4872 wrote to memory of 2420 4872 72EE.tmp 93 PID 4872 wrote to memory of 2420 4872 72EE.tmp 93 PID 4872 wrote to memory of 2420 4872 72EE.tmp 93 PID 2420 wrote to memory of 4116 2420 74E2.tmp 94 PID 2420 wrote to memory of 4116 2420 74E2.tmp 94 PID 2420 wrote to memory of 4116 2420 74E2.tmp 94 PID 4116 wrote to memory of 5036 4116 758E.tmp 95 PID 4116 wrote to memory of 5036 4116 758E.tmp 95 PID 4116 wrote to memory of 5036 4116 758E.tmp 95 PID 5036 wrote to memory of 3752 5036 7649.tmp 98 PID 5036 wrote to memory of 3752 5036 7649.tmp 98 PID 5036 wrote to memory of 3752 5036 7649.tmp 98 PID 3752 wrote to memory of 3696 3752 76D6.tmp 99 PID 3752 wrote to memory of 3696 3752 76D6.tmp 99 PID 3752 wrote to memory of 3696 3752 76D6.tmp 99 PID 3696 wrote to memory of 4556 3696 77D0.tmp 100 PID 3696 wrote to memory of 4556 3696 77D0.tmp 100 PID 3696 wrote to memory of 4556 3696 77D0.tmp 100 PID 4556 wrote to memory of 1852 4556 78CA.tmp 101 PID 4556 wrote to memory of 1852 4556 78CA.tmp 101 PID 4556 wrote to memory of 1852 4556 78CA.tmp 101 PID 1852 wrote to memory of 2768 1852 79C4.tmp 102 PID 1852 wrote to memory of 2768 1852 79C4.tmp 102 PID 1852 wrote to memory of 2768 1852 79C4.tmp 102 PID 2768 wrote to memory of 2036 2768 7A9E.tmp 103 PID 2768 wrote to memory of 2036 2768 7A9E.tmp 103 PID 2768 wrote to memory of 2036 2768 7A9E.tmp 103 PID 2036 wrote to memory of 4208 2036 7B89.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad7f665e070cb6b6fbb4d138b18bf218_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\ad7f665e070cb6b6fbb4d138b18bf218_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\6C56.tmp"C:\Users\Admin\AppData\Local\Temp\6C56.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\72EE.tmp"C:\Users\Admin\AppData\Local\Temp\72EE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\79C4.tmp"C:\Users\Admin\AppData\Local\Temp\79C4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\7B89.tmp"C:\Users\Admin\AppData\Local\Temp\7B89.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\7C44.tmp"C:\Users\Admin\AppData\Local\Temp\7C44.tmp"23⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\7D00.tmp"C:\Users\Admin\AppData\Local\Temp\7D00.tmp"24⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"25⤵
- Executes dropped EXE
PID:860 -
C:\Users\Admin\AppData\Local\Temp\7E48.tmp"C:\Users\Admin\AppData\Local\Temp\7E48.tmp"26⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\7F03.tmp"C:\Users\Admin\AppData\Local\Temp\7F03.tmp"27⤵
- Executes dropped EXE
PID:656 -
C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"28⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\803C.tmp"C:\Users\Admin\AppData\Local\Temp\803C.tmp"29⤵
- Executes dropped EXE
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\8146.tmp"C:\Users\Admin\AppData\Local\Temp\8146.tmp"30⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"31⤵
- Executes dropped EXE
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\8359.tmp"C:\Users\Admin\AppData\Local\Temp\8359.tmp"32⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\8405.tmp"C:\Users\Admin\AppData\Local\Temp\8405.tmp"33⤵
- Executes dropped EXE
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\84FF.tmp"C:\Users\Admin\AppData\Local\Temp\84FF.tmp"34⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\857C.tmp"C:\Users\Admin\AppData\Local\Temp\857C.tmp"35⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\8618.tmp"C:\Users\Admin\AppData\Local\Temp\8618.tmp"36⤵
- Executes dropped EXE
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\86A5.tmp"C:\Users\Admin\AppData\Local\Temp\86A5.tmp"37⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\8750.tmp"C:\Users\Admin\AppData\Local\Temp\8750.tmp"38⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\87DD.tmp"C:\Users\Admin\AppData\Local\Temp\87DD.tmp"39⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\886A.tmp"C:\Users\Admin\AppData\Local\Temp\886A.tmp"40⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\88F6.tmp"C:\Users\Admin\AppData\Local\Temp\88F6.tmp"41⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\8964.tmp"C:\Users\Admin\AppData\Local\Temp\8964.tmp"42⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\8A00.tmp"C:\Users\Admin\AppData\Local\Temp\8A00.tmp"43⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"44⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\8B19.tmp"C:\Users\Admin\AppData\Local\Temp\8B19.tmp"45⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"46⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\8C42.tmp"C:\Users\Admin\AppData\Local\Temp\8C42.tmp"47⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"48⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"49⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\8E07.tmp"C:\Users\Admin\AppData\Local\Temp\8E07.tmp"50⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"51⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\8F40.tmp"C:\Users\Admin\AppData\Local\Temp\8F40.tmp"52⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"53⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"54⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"55⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\9182.tmp"C:\Users\Admin\AppData\Local\Temp\9182.tmp"56⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\921E.tmp"C:\Users\Admin\AppData\Local\Temp\921E.tmp"57⤵
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\929B.tmp"C:\Users\Admin\AppData\Local\Temp\929B.tmp"58⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"59⤵
- Executes dropped EXE
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\93B4.tmp"C:\Users\Admin\AppData\Local\Temp\93B4.tmp"60⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"61⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"62⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\951C.tmp"C:\Users\Admin\AppData\Local\Temp\951C.tmp"63⤵
- Executes dropped EXE
PID:792 -
C:\Users\Admin\AppData\Local\Temp\9599.tmp"C:\Users\Admin\AppData\Local\Temp\9599.tmp"64⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\95F6.tmp"C:\Users\Admin\AppData\Local\Temp\95F6.tmp"65⤵
- Executes dropped EXE
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"66⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"67⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\97CB.tmp"C:\Users\Admin\AppData\Local\Temp\97CB.tmp"68⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\9867.tmp"C:\Users\Admin\AppData\Local\Temp\9867.tmp"69⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\9904.tmp"C:\Users\Admin\AppData\Local\Temp\9904.tmp"70⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"71⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"72⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"73⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"74⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"75⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"76⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"77⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"78⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"79⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\9E63.tmp"C:\Users\Admin\AppData\Local\Temp\9E63.tmp"80⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"81⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"82⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"83⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\A066.tmp"C:\Users\Admin\AppData\Local\Temp\A066.tmp"84⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"85⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"86⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\A19F.tmp"C:\Users\Admin\AppData\Local\Temp\A19F.tmp"87⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\A20C.tmp"C:\Users\Admin\AppData\Local\Temp\A20C.tmp"88⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"89⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"90⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"91⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"92⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"93⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"94⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"95⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"96⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"97⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"98⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\A827.tmp"C:\Users\Admin\AppData\Local\Temp\A827.tmp"99⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"100⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"101⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"102⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\AA69.tmp"C:\Users\Admin\AppData\Local\Temp\AA69.tmp"103⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"104⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"105⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"106⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"107⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"108⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\AD76.tmp"C:\Users\Admin\AppData\Local\Temp\AD76.tmp"109⤵PID:492
-
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"110⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\AE80.tmp"C:\Users\Admin\AppData\Local\Temp\AE80.tmp"111⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"112⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"113⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\B074.tmp"C:\Users\Admin\AppData\Local\Temp\B074.tmp"114⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\B110.tmp"C:\Users\Admin\AppData\Local\Temp\B110.tmp"115⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\B19D.tmp"C:\Users\Admin\AppData\Local\Temp\B19D.tmp"116⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\B20A.tmp"C:\Users\Admin\AppData\Local\Temp\B20A.tmp"117⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\B287.tmp"C:\Users\Admin\AppData\Local\Temp\B287.tmp"118⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"119⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\B362.tmp"C:\Users\Admin\AppData\Local\Temp\B362.tmp"120⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"121⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\B49A.tmp"C:\Users\Admin\AppData\Local\Temp\B49A.tmp"122⤵PID:3664
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-