Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2023, 17:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c3044ec224df58ca1d63fe6b13052291_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
c3044ec224df58ca1d63fe6b13052291_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
c3044ec224df58ca1d63fe6b13052291_mafia_JC.exe
-
Size
486KB
-
MD5
c3044ec224df58ca1d63fe6b13052291
-
SHA1
ca35be68ae915195e806a6b3047569f835ac0a9d
-
SHA256
f9b724de4135f792c90134ef99307060c69a2184529e2e26d0979dea74f7965b
-
SHA512
3cfc2214adf5ef6effcd3a320c639eafa0dcede0a86b65db56a0f7dd4d8d487234742e163112e1b9947233a1489c3bedfddcc1676edeb07b588e0a983940b73f
-
SSDEEP
6144:Borf3lPvovsgZnqG2C7mOTeiLfD7HA5GZ8mvKUdCofh9RSm3qfQ+g0vzInsH3dZ:oU5rCOTeiDHLiUAo5PF3qBUsNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5116 665B.tmp 2668 6726.tmp 1080 67F1.tmp 2156 68DC.tmp 4588 6978.tmp 3220 6A43.tmp 3152 6AC0.tmp 1656 6B3D.tmp 208 6BE9.tmp 1616 6C85.tmp 448 6D31.tmp 1012 6DBE.tmp 3192 6E89.tmp 1720 6F54.tmp 4920 703E.tmp 4020 71F4.tmp 4268 7280.tmp 5024 730D.tmp 4600 73A9.tmp 4892 7436.tmp 5044 74D2.tmp 1088 75AD.tmp 4764 7659.tmp 2632 7705.tmp 3124 77A1.tmp 1252 784D.tmp 4024 78CA.tmp 5000 79A4.tmp 1856 7A12.tmp 4300 7ABE.tmp 1400 7B4A.tmp 60 7C06.tmp 2872 7CC1.tmp 3424 7D5E.tmp 5100 7DCB.tmp 3660 7E58.tmp 2828 7F13.tmp 924 7F80.tmp 1596 7FFD.tmp 1136 809A.tmp 2008 8117.tmp 5060 81A3.tmp 4120 824F.tmp 4848 82EB.tmp 3372 8368.tmp 3436 8414.tmp 1228 8491.tmp 2044 852E.tmp 1736 85BA.tmp 896 8647.tmp 8 8750.tmp 3844 87DD.tmp 3304 886A.tmp 3576 8906.tmp 3012 8983.tmp 2668 8A10.tmp 1080 8AAC.tmp 1952 8B29.tmp 1888 8BB5.tmp 2648 8C42.tmp 4588 8CDE.tmp 1636 8D8A.tmp 4512 8E26.tmp 3152 8EC3.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4608 wrote to memory of 5116 4608 c3044ec224df58ca1d63fe6b13052291_mafia_JC.exe 81 PID 4608 wrote to memory of 5116 4608 c3044ec224df58ca1d63fe6b13052291_mafia_JC.exe 81 PID 4608 wrote to memory of 5116 4608 c3044ec224df58ca1d63fe6b13052291_mafia_JC.exe 81 PID 5116 wrote to memory of 2668 5116 665B.tmp 82 PID 5116 wrote to memory of 2668 5116 665B.tmp 82 PID 5116 wrote to memory of 2668 5116 665B.tmp 82 PID 2668 wrote to memory of 1080 2668 6726.tmp 83 PID 2668 wrote to memory of 1080 2668 6726.tmp 83 PID 2668 wrote to memory of 1080 2668 6726.tmp 83 PID 1080 wrote to memory of 2156 1080 67F1.tmp 84 PID 1080 wrote to memory of 2156 1080 67F1.tmp 84 PID 1080 wrote to memory of 2156 1080 67F1.tmp 84 PID 2156 wrote to memory of 4588 2156 68DC.tmp 85 PID 2156 wrote to memory of 4588 2156 68DC.tmp 85 PID 2156 wrote to memory of 4588 2156 68DC.tmp 85 PID 4588 wrote to memory of 3220 4588 6978.tmp 86 PID 4588 wrote to memory of 3220 4588 6978.tmp 86 PID 4588 wrote to memory of 3220 4588 6978.tmp 86 PID 3220 wrote to memory of 3152 3220 6A43.tmp 87 PID 3220 wrote to memory of 3152 3220 6A43.tmp 87 PID 3220 wrote to memory of 3152 3220 6A43.tmp 87 PID 3152 wrote to memory of 1656 3152 6AC0.tmp 88 PID 3152 wrote to memory of 1656 3152 6AC0.tmp 88 PID 3152 wrote to memory of 1656 3152 6AC0.tmp 88 PID 1656 wrote to memory of 208 1656 6B3D.tmp 89 PID 1656 wrote to memory of 208 1656 6B3D.tmp 89 PID 1656 wrote to memory of 208 1656 6B3D.tmp 89 PID 208 wrote to memory of 1616 208 6BE9.tmp 90 PID 208 wrote to memory of 1616 208 6BE9.tmp 90 PID 208 wrote to memory of 1616 208 6BE9.tmp 90 PID 1616 wrote to memory of 448 1616 6C85.tmp 92 PID 1616 wrote to memory of 448 1616 6C85.tmp 92 PID 1616 wrote to memory of 448 1616 6C85.tmp 92 PID 448 wrote to memory of 1012 448 6D31.tmp 93 PID 448 wrote to memory of 1012 448 6D31.tmp 93 PID 448 wrote to memory of 1012 448 6D31.tmp 93 PID 1012 wrote to memory of 3192 1012 6DBE.tmp 94 PID 1012 wrote to memory of 3192 1012 6DBE.tmp 94 PID 1012 wrote to memory of 3192 1012 6DBE.tmp 94 PID 3192 wrote to memory of 1720 3192 6E89.tmp 95 PID 3192 wrote to memory of 1720 3192 6E89.tmp 95 PID 3192 wrote to memory of 1720 3192 6E89.tmp 95 PID 1720 wrote to memory of 4920 1720 6F54.tmp 96 PID 1720 wrote to memory of 4920 1720 6F54.tmp 96 PID 1720 wrote to memory of 4920 1720 6F54.tmp 96 PID 4920 wrote to memory of 4020 4920 703E.tmp 97 PID 4920 wrote to memory of 4020 4920 703E.tmp 97 PID 4920 wrote to memory of 4020 4920 703E.tmp 97 PID 4020 wrote to memory of 4268 4020 71F4.tmp 98 PID 4020 wrote to memory of 4268 4020 71F4.tmp 98 PID 4020 wrote to memory of 4268 4020 71F4.tmp 98 PID 4268 wrote to memory of 5024 4268 7280.tmp 99 PID 4268 wrote to memory of 5024 4268 7280.tmp 99 PID 4268 wrote to memory of 5024 4268 7280.tmp 99 PID 5024 wrote to memory of 4600 5024 730D.tmp 102 PID 5024 wrote to memory of 4600 5024 730D.tmp 102 PID 5024 wrote to memory of 4600 5024 730D.tmp 102 PID 4600 wrote to memory of 4892 4600 73A9.tmp 103 PID 4600 wrote to memory of 4892 4600 73A9.tmp 103 PID 4600 wrote to memory of 4892 4600 73A9.tmp 103 PID 4892 wrote to memory of 5044 4892 7436.tmp 104 PID 4892 wrote to memory of 5044 4892 7436.tmp 104 PID 4892 wrote to memory of 5044 4892 7436.tmp 104 PID 5044 wrote to memory of 1088 5044 74D2.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3044ec224df58ca1d63fe6b13052291_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\c3044ec224df58ca1d63fe6b13052291_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"23⤵
- Executes dropped EXE
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\7659.tmp"C:\Users\Admin\AppData\Local\Temp\7659.tmp"24⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\7705.tmp"C:\Users\Admin\AppData\Local\Temp\7705.tmp"25⤵
- Executes dropped EXE
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\77A1.tmp"C:\Users\Admin\AppData\Local\Temp\77A1.tmp"26⤵
- Executes dropped EXE
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"27⤵
- Executes dropped EXE
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"28⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\79A4.tmp"C:\Users\Admin\AppData\Local\Temp\79A4.tmp"29⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\7A12.tmp"C:\Users\Admin\AppData\Local\Temp\7A12.tmp"30⤵
- Executes dropped EXE
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"31⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"32⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\7C06.tmp"C:\Users\Admin\AppData\Local\Temp\7C06.tmp"33⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"34⤵
- Executes dropped EXE
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"35⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"36⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"37⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\7F13.tmp"C:\Users\Admin\AppData\Local\Temp\7F13.tmp"38⤵
- Executes dropped EXE
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\7F80.tmp"C:\Users\Admin\AppData\Local\Temp\7F80.tmp"39⤵
- Executes dropped EXE
PID:924 -
C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"40⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\809A.tmp"C:\Users\Admin\AppData\Local\Temp\809A.tmp"41⤵
- Executes dropped EXE
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\8117.tmp"C:\Users\Admin\AppData\Local\Temp\8117.tmp"42⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\81A3.tmp"C:\Users\Admin\AppData\Local\Temp\81A3.tmp"43⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\824F.tmp"C:\Users\Admin\AppData\Local\Temp\824F.tmp"44⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\82EB.tmp"C:\Users\Admin\AppData\Local\Temp\82EB.tmp"45⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\8368.tmp"C:\Users\Admin\AppData\Local\Temp\8368.tmp"46⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\8414.tmp"C:\Users\Admin\AppData\Local\Temp\8414.tmp"47⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\8491.tmp"C:\Users\Admin\AppData\Local\Temp\8491.tmp"48⤵
- Executes dropped EXE
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\852E.tmp"C:\Users\Admin\AppData\Local\Temp\852E.tmp"49⤵
- Executes dropped EXE
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\85BA.tmp"C:\Users\Admin\AppData\Local\Temp\85BA.tmp"50⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\8647.tmp"C:\Users\Admin\AppData\Local\Temp\8647.tmp"51⤵
- Executes dropped EXE
PID:896 -
C:\Users\Admin\AppData\Local\Temp\86C4.tmp"C:\Users\Admin\AppData\Local\Temp\86C4.tmp"52⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\8750.tmp"C:\Users\Admin\AppData\Local\Temp\8750.tmp"53⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\87DD.tmp"C:\Users\Admin\AppData\Local\Temp\87DD.tmp"54⤵
- Executes dropped EXE
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\886A.tmp"C:\Users\Admin\AppData\Local\Temp\886A.tmp"55⤵
- Executes dropped EXE
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\8906.tmp"C:\Users\Admin\AppData\Local\Temp\8906.tmp"56⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\8983.tmp"C:\Users\Admin\AppData\Local\Temp\8983.tmp"57⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\8A10.tmp"C:\Users\Admin\AppData\Local\Temp\8A10.tmp"58⤵
- Executes dropped EXE
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"59⤵
- Executes dropped EXE
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\8B29.tmp"C:\Users\Admin\AppData\Local\Temp\8B29.tmp"60⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"61⤵
- Executes dropped EXE
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\8C42.tmp"C:\Users\Admin\AppData\Local\Temp\8C42.tmp"62⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"63⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"64⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\8E26.tmp"C:\Users\Admin\AppData\Local\Temp\8E26.tmp"65⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"66⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"67⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"68⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\903A.tmp"C:\Users\Admin\AppData\Local\Temp\903A.tmp"69⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\90B7.tmp"C:\Users\Admin\AppData\Local\Temp\90B7.tmp"70⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"71⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\9182.tmp"C:\Users\Admin\AppData\Local\Temp\9182.tmp"72⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"73⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\927C.tmp"C:\Users\Admin\AppData\Local\Temp\927C.tmp"74⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"75⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\9376.tmp"C:\Users\Admin\AppData\Local\Temp\9376.tmp"76⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\93F3.tmp"C:\Users\Admin\AppData\Local\Temp\93F3.tmp"77⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\9470.tmp"C:\Users\Admin\AppData\Local\Temp\9470.tmp"78⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\951C.tmp"C:\Users\Admin\AppData\Local\Temp\951C.tmp"79⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"80⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\95F6.tmp"C:\Users\Admin\AppData\Local\Temp\95F6.tmp"81⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\9654.tmp"C:\Users\Admin\AppData\Local\Temp\9654.tmp"82⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\96F0.tmp"C:\Users\Admin\AppData\Local\Temp\96F0.tmp"83⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"84⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\97DB.tmp"C:\Users\Admin\AppData\Local\Temp\97DB.tmp"85⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"86⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\98E4.tmp"C:\Users\Admin\AppData\Local\Temp\98E4.tmp"87⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\9942.tmp"C:\Users\Admin\AppData\Local\Temp\9942.tmp"88⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"89⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"90⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"91⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"92⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"93⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"94⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"95⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"96⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"97⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\9E15.tmp"C:\Users\Admin\AppData\Local\Temp\9E15.tmp"98⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"99⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"100⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"101⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"102⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\A086.tmp"C:\Users\Admin\AppData\Local\Temp\A086.tmp"103⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"104⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\A18F.tmp"C:\Users\Admin\AppData\Local\Temp\A18F.tmp"105⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"106⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\A299.tmp"C:\Users\Admin\AppData\Local\Temp\A299.tmp"107⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\A325.tmp"C:\Users\Admin\AppData\Local\Temp\A325.tmp"108⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"109⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\A410.tmp"C:\Users\Admin\AppData\Local\Temp\A410.tmp"110⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"111⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\A519.tmp"C:\Users\Admin\AppData\Local\Temp\A519.tmp"112⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"113⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"114⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"115⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"116⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"117⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"118⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"119⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"120⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"121⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"122⤵PID:4504
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-