Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
27-08-2023 17:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b71ed44372d898f6332c3139804526f4_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
b71ed44372d898f6332c3139804526f4_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
b71ed44372d898f6332c3139804526f4_mafia_JC.exe
-
Size
486KB
-
MD5
b71ed44372d898f6332c3139804526f4
-
SHA1
d601c448f91611d04e46cd94b98d04bc7b02667d
-
SHA256
5588a48c4c003eb8cf19d8b354f0398240c25db59bbde9cd6a8fd362ad5d1e43
-
SHA512
758a856a64020c1b4be120b4cb42ed9322c94683cfeae8e4089fcc9e3dbb6f479fc91e624d2e51a68fe88d47f0c4919c8a6d37f83d7c3cfd49a4fb823cf2c168
-
SSDEEP
12288:oU5rCOTeiDADJoFdGT6AZxxSx+6DHmQTWcH5uq/NZ:oUQOJDADKi6Im+GTZTN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2720 AFA9.tmp 5076 B0A3.tmp 3628 B19D.tmp 1760 B258.tmp 924 B333.tmp 1440 B41D.tmp 4836 B527.tmp 4340 B5E2.tmp 3844 B66F.tmp 4892 B71B.tmp 444 B7E6.tmp 5068 B892.tmp 3368 BA76.tmp 4760 BB41.tmp 2368 BBCE.tmp 1568 BC89.tmp 4540 BD83.tmp 1280 BE8D.tmp 1892 BF68.tmp 2988 BFE5.tmp 4520 C081.tmp 2148 C18B.tmp 2756 C237.tmp 3340 C2F2.tmp 4128 C3BD.tmp 2584 C469.tmp 2592 C4F6.tmp 4060 C5A2.tmp 2828 C64D.tmp 4732 C6F9.tmp 1352 C786.tmp 3980 C841.tmp 4232 C8BE.tmp 1612 C93B.tmp 3784 CA74.tmp 4120 CB10.tmp 3772 CBBC.tmp 4148 CC78.tmp 2044 CD14.tmp 2352 CD91.tmp 4304 CE3D.tmp 4140 CED9.tmp 1480 CF66.tmp 4648 D002.tmp 3144 D07F.tmp 4680 D10B.tmp 3796 D198.tmp 3936 D244.tmp 3032 D2D1.tmp 3924 D36D.tmp 4576 D3F9.tmp 2608 D486.tmp 1300 D522.tmp 3908 D5BF.tmp 1800 D66A.tmp 1072 D6F7.tmp 1820 D7A3.tmp 1372 D83F.tmp 2720 D8DB.tmp 824 D987.tmp 2868 DA24.tmp 3000 DAC0.tmp 3404 DB5C.tmp 784 DBF8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1820 wrote to memory of 2720 1820 b71ed44372d898f6332c3139804526f4_mafia_JC.exe 82 PID 1820 wrote to memory of 2720 1820 b71ed44372d898f6332c3139804526f4_mafia_JC.exe 82 PID 1820 wrote to memory of 2720 1820 b71ed44372d898f6332c3139804526f4_mafia_JC.exe 82 PID 2720 wrote to memory of 5076 2720 AFA9.tmp 83 PID 2720 wrote to memory of 5076 2720 AFA9.tmp 83 PID 2720 wrote to memory of 5076 2720 AFA9.tmp 83 PID 5076 wrote to memory of 3628 5076 B0A3.tmp 84 PID 5076 wrote to memory of 3628 5076 B0A3.tmp 84 PID 5076 wrote to memory of 3628 5076 B0A3.tmp 84 PID 3628 wrote to memory of 1760 3628 B19D.tmp 85 PID 3628 wrote to memory of 1760 3628 B19D.tmp 85 PID 3628 wrote to memory of 1760 3628 B19D.tmp 85 PID 1760 wrote to memory of 924 1760 B258.tmp 86 PID 1760 wrote to memory of 924 1760 B258.tmp 86 PID 1760 wrote to memory of 924 1760 B258.tmp 86 PID 924 wrote to memory of 1440 924 B333.tmp 87 PID 924 wrote to memory of 1440 924 B333.tmp 87 PID 924 wrote to memory of 1440 924 B333.tmp 87 PID 1440 wrote to memory of 4836 1440 B41D.tmp 88 PID 1440 wrote to memory of 4836 1440 B41D.tmp 88 PID 1440 wrote to memory of 4836 1440 B41D.tmp 88 PID 4836 wrote to memory of 4340 4836 B527.tmp 89 PID 4836 wrote to memory of 4340 4836 B527.tmp 89 PID 4836 wrote to memory of 4340 4836 B527.tmp 89 PID 4340 wrote to memory of 3844 4340 B5E2.tmp 90 PID 4340 wrote to memory of 3844 4340 B5E2.tmp 90 PID 4340 wrote to memory of 3844 4340 B5E2.tmp 90 PID 3844 wrote to memory of 4892 3844 B66F.tmp 91 PID 3844 wrote to memory of 4892 3844 B66F.tmp 91 PID 3844 wrote to memory of 4892 3844 B66F.tmp 91 PID 4892 wrote to memory of 444 4892 B71B.tmp 92 PID 4892 wrote to memory of 444 4892 B71B.tmp 92 PID 4892 wrote to memory of 444 4892 B71B.tmp 92 PID 444 wrote to memory of 5068 444 B7E6.tmp 93 PID 444 wrote to memory of 5068 444 B7E6.tmp 93 PID 444 wrote to memory of 5068 444 B7E6.tmp 93 PID 5068 wrote to memory of 3368 5068 B892.tmp 94 PID 5068 wrote to memory of 3368 5068 B892.tmp 94 PID 5068 wrote to memory of 3368 5068 B892.tmp 94 PID 3368 wrote to memory of 4760 3368 BA76.tmp 95 PID 3368 wrote to memory of 4760 3368 BA76.tmp 95 PID 3368 wrote to memory of 4760 3368 BA76.tmp 95 PID 4760 wrote to memory of 2368 4760 BB41.tmp 96 PID 4760 wrote to memory of 2368 4760 BB41.tmp 96 PID 4760 wrote to memory of 2368 4760 BB41.tmp 96 PID 2368 wrote to memory of 1568 2368 BBCE.tmp 97 PID 2368 wrote to memory of 1568 2368 BBCE.tmp 97 PID 2368 wrote to memory of 1568 2368 BBCE.tmp 97 PID 1568 wrote to memory of 4540 1568 BC89.tmp 98 PID 1568 wrote to memory of 4540 1568 BC89.tmp 98 PID 1568 wrote to memory of 4540 1568 BC89.tmp 98 PID 4540 wrote to memory of 1280 4540 BD83.tmp 99 PID 4540 wrote to memory of 1280 4540 BD83.tmp 99 PID 4540 wrote to memory of 1280 4540 BD83.tmp 99 PID 1280 wrote to memory of 1892 1280 BE8D.tmp 100 PID 1280 wrote to memory of 1892 1280 BE8D.tmp 100 PID 1280 wrote to memory of 1892 1280 BE8D.tmp 100 PID 1892 wrote to memory of 2988 1892 BF68.tmp 101 PID 1892 wrote to memory of 2988 1892 BF68.tmp 101 PID 1892 wrote to memory of 2988 1892 BF68.tmp 101 PID 2988 wrote to memory of 4520 2988 BFE5.tmp 104 PID 2988 wrote to memory of 4520 2988 BFE5.tmp 104 PID 2988 wrote to memory of 4520 2988 BFE5.tmp 104 PID 4520 wrote to memory of 2148 4520 C081.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\b71ed44372d898f6332c3139804526f4_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\b71ed44372d898f6332c3139804526f4_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\B19D.tmp"C:\Users\Admin\AppData\Local\Temp\B19D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\B258.tmp"C:\Users\Admin\AppData\Local\Temp\B258.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\B41D.tmp"C:\Users\Admin\AppData\Local\Temp\B41D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\B527.tmp"C:\Users\Admin\AppData\Local\Temp\B527.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\B66F.tmp"C:\Users\Admin\AppData\Local\Temp\B66F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\B71B.tmp"C:\Users\Admin\AppData\Local\Temp\B71B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
C:\Users\Admin\AppData\Local\Temp\B892.tmp"C:\Users\Admin\AppData\Local\Temp\B892.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\BA76.tmp"C:\Users\Admin\AppData\Local\Temp\BA76.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\BB41.tmp"C:\Users\Admin\AppData\Local\Temp\BB41.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\BC89.tmp"C:\Users\Admin\AppData\Local\Temp\BC89.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\BD83.tmp"C:\Users\Admin\AppData\Local\Temp\BD83.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\BF68.tmp"C:\Users\Admin\AppData\Local\Temp\BF68.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\C18B.tmp"C:\Users\Admin\AppData\Local\Temp\C18B.tmp"23⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\C237.tmp"C:\Users\Admin\AppData\Local\Temp\C237.tmp"24⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"25⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\C3BD.tmp"C:\Users\Admin\AppData\Local\Temp\C3BD.tmp"26⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\C469.tmp"C:\Users\Admin\AppData\Local\Temp\C469.tmp"27⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"28⤵
- Executes dropped EXE
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"29⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\C64D.tmp"C:\Users\Admin\AppData\Local\Temp\C64D.tmp"30⤵
- Executes dropped EXE
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"31⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\C786.tmp"C:\Users\Admin\AppData\Local\Temp\C786.tmp"32⤵
- Executes dropped EXE
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\C841.tmp"C:\Users\Admin\AppData\Local\Temp\C841.tmp"33⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"34⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\C93B.tmp"C:\Users\Admin\AppData\Local\Temp\C93B.tmp"35⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\CA74.tmp"C:\Users\Admin\AppData\Local\Temp\CA74.tmp"36⤵
- Executes dropped EXE
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\CB10.tmp"C:\Users\Admin\AppData\Local\Temp\CB10.tmp"37⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\CBBC.tmp"C:\Users\Admin\AppData\Local\Temp\CBBC.tmp"38⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\CC78.tmp"C:\Users\Admin\AppData\Local\Temp\CC78.tmp"39⤵
- Executes dropped EXE
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\CD14.tmp"C:\Users\Admin\AppData\Local\Temp\CD14.tmp"40⤵
- Executes dropped EXE
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\CD91.tmp"C:\Users\Admin\AppData\Local\Temp\CD91.tmp"41⤵
- Executes dropped EXE
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\CE3D.tmp"C:\Users\Admin\AppData\Local\Temp\CE3D.tmp"42⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\CED9.tmp"C:\Users\Admin\AppData\Local\Temp\CED9.tmp"43⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\CF66.tmp"C:\Users\Admin\AppData\Local\Temp\CF66.tmp"44⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\D002.tmp"C:\Users\Admin\AppData\Local\Temp\D002.tmp"45⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\D07F.tmp"C:\Users\Admin\AppData\Local\Temp\D07F.tmp"46⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\D10B.tmp"C:\Users\Admin\AppData\Local\Temp\D10B.tmp"47⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\D198.tmp"C:\Users\Admin\AppData\Local\Temp\D198.tmp"48⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\D244.tmp"C:\Users\Admin\AppData\Local\Temp\D244.tmp"49⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"50⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\D36D.tmp"C:\Users\Admin\AppData\Local\Temp\D36D.tmp"51⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\D3F9.tmp"C:\Users\Admin\AppData\Local\Temp\D3F9.tmp"52⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\D486.tmp"C:\Users\Admin\AppData\Local\Temp\D486.tmp"53⤵
- Executes dropped EXE
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\D522.tmp"C:\Users\Admin\AppData\Local\Temp\D522.tmp"54⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\D5BF.tmp"C:\Users\Admin\AppData\Local\Temp\D5BF.tmp"55⤵
- Executes dropped EXE
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\D66A.tmp"C:\Users\Admin\AppData\Local\Temp\D66A.tmp"56⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"57⤵
- Executes dropped EXE
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\D7A3.tmp"C:\Users\Admin\AppData\Local\Temp\D7A3.tmp"58⤵
- Executes dropped EXE
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\D83F.tmp"C:\Users\Admin\AppData\Local\Temp\D83F.tmp"59⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"60⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\D987.tmp"C:\Users\Admin\AppData\Local\Temp\D987.tmp"61⤵
- Executes dropped EXE
PID:824 -
C:\Users\Admin\AppData\Local\Temp\DA24.tmp"C:\Users\Admin\AppData\Local\Temp\DA24.tmp"62⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"63⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"64⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\DBF8.tmp"C:\Users\Admin\AppData\Local\Temp\DBF8.tmp"65⤵
- Executes dropped EXE
PID:784 -
C:\Users\Admin\AppData\Local\Temp\DCA4.tmp"C:\Users\Admin\AppData\Local\Temp\DCA4.tmp"66⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\DD21.tmp"C:\Users\Admin\AppData\Local\Temp\DD21.tmp"67⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\DD8F.tmp"C:\Users\Admin\AppData\Local\Temp\DD8F.tmp"68⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"69⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\DE98.tmp"C:\Users\Admin\AppData\Local\Temp\DE98.tmp"70⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\DF15.tmp"C:\Users\Admin\AppData\Local\Temp\DF15.tmp"71⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\DF73.tmp"C:\Users\Admin\AppData\Local\Temp\DF73.tmp"72⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"73⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\E06D.tmp"C:\Users\Admin\AppData\Local\Temp\E06D.tmp"74⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"75⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\E196.tmp"C:\Users\Admin\AppData\Local\Temp\E196.tmp"76⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\E203.tmp"C:\Users\Admin\AppData\Local\Temp\E203.tmp"77⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\E271.tmp"C:\Users\Admin\AppData\Local\Temp\E271.tmp"78⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\E2EE.tmp"C:\Users\Admin\AppData\Local\Temp\E2EE.tmp"79⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\E36B.tmp"C:\Users\Admin\AppData\Local\Temp\E36B.tmp"80⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"81⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\E465.tmp"C:\Users\Admin\AppData\Local\Temp\E465.tmp"82⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\E4F1.tmp"C:\Users\Admin\AppData\Local\Temp\E4F1.tmp"83⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\E56E.tmp"C:\Users\Admin\AppData\Local\Temp\E56E.tmp"84⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\E60A.tmp"C:\Users\Admin\AppData\Local\Temp\E60A.tmp"85⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\E697.tmp"C:\Users\Admin\AppData\Local\Temp\E697.tmp"86⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\E704.tmp"C:\Users\Admin\AppData\Local\Temp\E704.tmp"87⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\E772.tmp"C:\Users\Admin\AppData\Local\Temp\E772.tmp"88⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"89⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\E87B.tmp"C:\Users\Admin\AppData\Local\Temp\E87B.tmp"90⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\E908.tmp"C:\Users\Admin\AppData\Local\Temp\E908.tmp"91⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\E975.tmp"C:\Users\Admin\AppData\Local\Temp\E975.tmp"92⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"93⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\EA50.tmp"C:\Users\Admin\AppData\Local\Temp\EA50.tmp"94⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\EABE.tmp"C:\Users\Admin\AppData\Local\Temp\EABE.tmp"95⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"96⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"97⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\EC44.tmp"C:\Users\Admin\AppData\Local\Temp\EC44.tmp"98⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"99⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\ED4E.tmp"C:\Users\Admin\AppData\Local\Temp\ED4E.tmp"100⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\EDEA.tmp"C:\Users\Admin\AppData\Local\Temp\EDEA.tmp"101⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\EE86.tmp"C:\Users\Admin\AppData\Local\Temp\EE86.tmp"102⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\EF13.tmp"C:\Users\Admin\AppData\Local\Temp\EF13.tmp"103⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\EF90.tmp"C:\Users\Admin\AppData\Local\Temp\EF90.tmp"104⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\F01D.tmp"C:\Users\Admin\AppData\Local\Temp\F01D.tmp"105⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\F08A.tmp"C:\Users\Admin\AppData\Local\Temp\F08A.tmp"106⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\F126.tmp"C:\Users\Admin\AppData\Local\Temp\F126.tmp"107⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\F1B3.tmp"C:\Users\Admin\AppData\Local\Temp\F1B3.tmp"108⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\F230.tmp"C:\Users\Admin\AppData\Local\Temp\F230.tmp"109⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"110⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\F359.tmp"C:\Users\Admin\AppData\Local\Temp\F359.tmp"111⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\F3D6.tmp"C:\Users\Admin\AppData\Local\Temp\F3D6.tmp"112⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"113⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\F56C.tmp"C:\Users\Admin\AppData\Local\Temp\F56C.tmp"114⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\F618.tmp"C:\Users\Admin\AppData\Local\Temp\F618.tmp"115⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\F695.tmp"C:\Users\Admin\AppData\Local\Temp\F695.tmp"116⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\F741.tmp"C:\Users\Admin\AppData\Local\Temp\F741.tmp"117⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\F7CD.tmp"C:\Users\Admin\AppData\Local\Temp\F7CD.tmp"118⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\F85A.tmp"C:\Users\Admin\AppData\Local\Temp\F85A.tmp"119⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\F8F6.tmp"C:\Users\Admin\AppData\Local\Temp\F8F6.tmp"120⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\F983.tmp"C:\Users\Admin\AppData\Local\Temp\F983.tmp"121⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\FA2F.tmp"C:\Users\Admin\AppData\Local\Temp\FA2F.tmp"122⤵PID:3680
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-