Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
31/08/2023, 16:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f42b2acda188bd1bb3603f5e98fd31da_mafia_JC.exe
Resource
win7-20230824-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
f42b2acda188bd1bb3603f5e98fd31da_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
f42b2acda188bd1bb3603f5e98fd31da_mafia_JC.exe
-
Size
486KB
-
MD5
f42b2acda188bd1bb3603f5e98fd31da
-
SHA1
e5f59e055b91692d901b0b9143fa61e6e80b132c
-
SHA256
d06b4c9c7480f647db65b8219589e6318d0a9e4f6aace8c22c4598d68d49b1bb
-
SHA512
b3693ded981aaa8824ed10a3c95c78779a9bffd5b84448c79480e0427f105e17a3cc213c04118d436684374e5e0bcc9439f444ccee7c9a65bbb383347c71c0f8
-
SSDEEP
6144:Forf3lPvovsgZnqG2C7mOTeiLfD7hC4lmd28gJrbdYsqnC5zrvj3aKwcBRvTuspj:UU5rCOTeiDQ4lmdzAdYsXrr3hwTi1NZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1320 A884.tmp 5104 A930.tmp 3464 A9DC.tmp 4024 AAD6.tmp 2396 AB72.tmp 2996 AC1E.tmp 4500 ACCA.tmp 2532 AD57.tmp 3488 AE03.tmp 1272 AEAF.tmp 4040 AF3B.tmp 1640 AFC8.tmp 4244 B093.tmp 4508 B13F.tmp 3092 B20A.tmp 380 B2E5.tmp 4532 B381.tmp 4488 B41D.tmp 4904 B49A.tmp 2932 B536.tmp 996 B6EC.tmp 3512 B7A7.tmp 1920 B834.tmp 4888 B8F0.tmp 5048 B97C.tmp 3484 BAB5.tmp 2504 BB51.tmp 2860 BBFD.tmp 5040 BC89.tmp 1404 BD35.tmp 3852 BDE1.tmp 992 BECC.tmp 4720 BF97.tmp 4596 C004.tmp 3024 C0C0.tmp 4804 C15C.tmp 684 C1E8.tmp 4768 C275.tmp 2632 C2F2.tmp 3680 C39E.tmp 4052 C41B.tmp 1072 C4C7.tmp 4336 C553.tmp 4360 C5E0.tmp 1508 C65D.tmp 3088 C6F9.tmp 3276 C786.tmp 1216 C803.tmp 1440 C8AF.tmp 224 C93B.tmp 1468 C9C8.tmp 4732 CA45.tmp 1020 CB2F.tmp 688 CBAC.tmp 4664 CC49.tmp 4176 CCC6.tmp 3208 CD43.tmp 3700 CDCF.tmp 4392 CE7B.tmp 2088 CEE9.tmp 3224 CF75.tmp 432 CFF2.tmp 2084 D06F.tmp 396 D0EC.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4692 wrote to memory of 1320 4692 f42b2acda188bd1bb3603f5e98fd31da_mafia_JC.exe 81 PID 4692 wrote to memory of 1320 4692 f42b2acda188bd1bb3603f5e98fd31da_mafia_JC.exe 81 PID 4692 wrote to memory of 1320 4692 f42b2acda188bd1bb3603f5e98fd31da_mafia_JC.exe 81 PID 1320 wrote to memory of 5104 1320 A884.tmp 82 PID 1320 wrote to memory of 5104 1320 A884.tmp 82 PID 1320 wrote to memory of 5104 1320 A884.tmp 82 PID 5104 wrote to memory of 3464 5104 A930.tmp 83 PID 5104 wrote to memory of 3464 5104 A930.tmp 83 PID 5104 wrote to memory of 3464 5104 A930.tmp 83 PID 3464 wrote to memory of 4024 3464 A9DC.tmp 84 PID 3464 wrote to memory of 4024 3464 A9DC.tmp 84 PID 3464 wrote to memory of 4024 3464 A9DC.tmp 84 PID 4024 wrote to memory of 2396 4024 AAD6.tmp 85 PID 4024 wrote to memory of 2396 4024 AAD6.tmp 85 PID 4024 wrote to memory of 2396 4024 AAD6.tmp 85 PID 2396 wrote to memory of 2996 2396 AB72.tmp 86 PID 2396 wrote to memory of 2996 2396 AB72.tmp 86 PID 2396 wrote to memory of 2996 2396 AB72.tmp 86 PID 2996 wrote to memory of 4500 2996 AC1E.tmp 87 PID 2996 wrote to memory of 4500 2996 AC1E.tmp 87 PID 2996 wrote to memory of 4500 2996 AC1E.tmp 87 PID 4500 wrote to memory of 2532 4500 ACCA.tmp 88 PID 4500 wrote to memory of 2532 4500 ACCA.tmp 88 PID 4500 wrote to memory of 2532 4500 ACCA.tmp 88 PID 2532 wrote to memory of 3488 2532 AD57.tmp 90 PID 2532 wrote to memory of 3488 2532 AD57.tmp 90 PID 2532 wrote to memory of 3488 2532 AD57.tmp 90 PID 3488 wrote to memory of 1272 3488 AE03.tmp 91 PID 3488 wrote to memory of 1272 3488 AE03.tmp 91 PID 3488 wrote to memory of 1272 3488 AE03.tmp 91 PID 1272 wrote to memory of 4040 1272 AEAF.tmp 92 PID 1272 wrote to memory of 4040 1272 AEAF.tmp 92 PID 1272 wrote to memory of 4040 1272 AEAF.tmp 92 PID 4040 wrote to memory of 1640 4040 AF3B.tmp 93 PID 4040 wrote to memory of 1640 4040 AF3B.tmp 93 PID 4040 wrote to memory of 1640 4040 AF3B.tmp 93 PID 1640 wrote to memory of 4244 1640 AFC8.tmp 94 PID 1640 wrote to memory of 4244 1640 AFC8.tmp 94 PID 1640 wrote to memory of 4244 1640 AFC8.tmp 94 PID 4244 wrote to memory of 4508 4244 B093.tmp 95 PID 4244 wrote to memory of 4508 4244 B093.tmp 95 PID 4244 wrote to memory of 4508 4244 B093.tmp 95 PID 4508 wrote to memory of 3092 4508 B13F.tmp 96 PID 4508 wrote to memory of 3092 4508 B13F.tmp 96 PID 4508 wrote to memory of 3092 4508 B13F.tmp 96 PID 3092 wrote to memory of 380 3092 B20A.tmp 97 PID 3092 wrote to memory of 380 3092 B20A.tmp 97 PID 3092 wrote to memory of 380 3092 B20A.tmp 97 PID 380 wrote to memory of 4532 380 B2E5.tmp 98 PID 380 wrote to memory of 4532 380 B2E5.tmp 98 PID 380 wrote to memory of 4532 380 B2E5.tmp 98 PID 4532 wrote to memory of 4488 4532 B381.tmp 99 PID 4532 wrote to memory of 4488 4532 B381.tmp 99 PID 4532 wrote to memory of 4488 4532 B381.tmp 99 PID 4488 wrote to memory of 4904 4488 B41D.tmp 100 PID 4488 wrote to memory of 4904 4488 B41D.tmp 100 PID 4488 wrote to memory of 4904 4488 B41D.tmp 100 PID 4904 wrote to memory of 2932 4904 B49A.tmp 101 PID 4904 wrote to memory of 2932 4904 B49A.tmp 101 PID 4904 wrote to memory of 2932 4904 B49A.tmp 101 PID 2932 wrote to memory of 996 2932 B536.tmp 104 PID 2932 wrote to memory of 996 2932 B536.tmp 104 PID 2932 wrote to memory of 996 2932 B536.tmp 104 PID 996 wrote to memory of 3512 996 B6EC.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\f42b2acda188bd1bb3603f5e98fd31da_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\f42b2acda188bd1bb3603f5e98fd31da_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\A884.tmp"C:\Users\Admin\AppData\Local\Temp\A884.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\AB72.tmp"C:\Users\Admin\AppData\Local\Temp\AB72.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\AD57.tmp"C:\Users\Admin\AppData\Local\Temp\AD57.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\B093.tmp"C:\Users\Admin\AppData\Local\Temp\B093.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\B20A.tmp"C:\Users\Admin\AppData\Local\Temp\B20A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\B381.tmp"C:\Users\Admin\AppData\Local\Temp\B381.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\B41D.tmp"C:\Users\Admin\AppData\Local\Temp\B41D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\B49A.tmp"C:\Users\Admin\AppData\Local\Temp\B49A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\B536.tmp"C:\Users\Admin\AppData\Local\Temp\B536.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"23⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\B834.tmp"C:\Users\Admin\AppData\Local\Temp\B834.tmp"24⤵
- Executes dropped EXE
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"25⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\B97C.tmp"C:\Users\Admin\AppData\Local\Temp\B97C.tmp"26⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"27⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"28⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"29⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\BC89.tmp"C:\Users\Admin\AppData\Local\Temp\BC89.tmp"30⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\BD35.tmp"C:\Users\Admin\AppData\Local\Temp\BD35.tmp"31⤵
- Executes dropped EXE
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"32⤵
- Executes dropped EXE
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"33⤵
- Executes dropped EXE
PID:992 -
C:\Users\Admin\AppData\Local\Temp\BF97.tmp"C:\Users\Admin\AppData\Local\Temp\BF97.tmp"34⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\C004.tmp"C:\Users\Admin\AppData\Local\Temp\C004.tmp"35⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"36⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"37⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"38⤵
- Executes dropped EXE
PID:684 -
C:\Users\Admin\AppData\Local\Temp\C275.tmp"C:\Users\Admin\AppData\Local\Temp\C275.tmp"39⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"40⤵
- Executes dropped EXE
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\C39E.tmp"C:\Users\Admin\AppData\Local\Temp\C39E.tmp"41⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\C41B.tmp"C:\Users\Admin\AppData\Local\Temp\C41B.tmp"42⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\C4C7.tmp"C:\Users\Admin\AppData\Local\Temp\C4C7.tmp"43⤵
- Executes dropped EXE
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\C553.tmp"C:\Users\Admin\AppData\Local\Temp\C553.tmp"44⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"45⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\C65D.tmp"C:\Users\Admin\AppData\Local\Temp\C65D.tmp"46⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"47⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\C786.tmp"C:\Users\Admin\AppData\Local\Temp\C786.tmp"48⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\C803.tmp"C:\Users\Admin\AppData\Local\Temp\C803.tmp"49⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"50⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\C93B.tmp"C:\Users\Admin\AppData\Local\Temp\C93B.tmp"51⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\C9C8.tmp"C:\Users\Admin\AppData\Local\Temp\C9C8.tmp"52⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\CA45.tmp"C:\Users\Admin\AppData\Local\Temp\CA45.tmp"53⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"54⤵
- Executes dropped EXE
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\CBAC.tmp"C:\Users\Admin\AppData\Local\Temp\CBAC.tmp"55⤵
- Executes dropped EXE
PID:688 -
C:\Users\Admin\AppData\Local\Temp\CC49.tmp"C:\Users\Admin\AppData\Local\Temp\CC49.tmp"56⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\CCC6.tmp"C:\Users\Admin\AppData\Local\Temp\CCC6.tmp"57⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\CD43.tmp"C:\Users\Admin\AppData\Local\Temp\CD43.tmp"58⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"59⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"60⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\CEE9.tmp"C:\Users\Admin\AppData\Local\Temp\CEE9.tmp"61⤵
- Executes dropped EXE
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\CF75.tmp"C:\Users\Admin\AppData\Local\Temp\CF75.tmp"62⤵
- Executes dropped EXE
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\CFF2.tmp"C:\Users\Admin\AppData\Local\Temp\CFF2.tmp"63⤵
- Executes dropped EXE
PID:432 -
C:\Users\Admin\AppData\Local\Temp\D06F.tmp"C:\Users\Admin\AppData\Local\Temp\D06F.tmp"64⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"65⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\D169.tmp"C:\Users\Admin\AppData\Local\Temp\D169.tmp"66⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"67⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\D263.tmp"C:\Users\Admin\AppData\Local\Temp\D263.tmp"68⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"69⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\D34E.tmp"C:\Users\Admin\AppData\Local\Temp\D34E.tmp"70⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\D3CB.tmp"C:\Users\Admin\AppData\Local\Temp\D3CB.tmp"71⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\D428.tmp"C:\Users\Admin\AppData\Local\Temp\D428.tmp"72⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\D476.tmp"C:\Users\Admin\AppData\Local\Temp\D476.tmp"73⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"74⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\D590.tmp"C:\Users\Admin\AppData\Local\Temp\D590.tmp"75⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\D5FD.tmp"C:\Users\Admin\AppData\Local\Temp\D5FD.tmp"76⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\D68A.tmp"C:\Users\Admin\AppData\Local\Temp\D68A.tmp"77⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\D707.tmp"C:\Users\Admin\AppData\Local\Temp\D707.tmp"78⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\D784.tmp"C:\Users\Admin\AppData\Local\Temp\D784.tmp"79⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\D810.tmp"C:\Users\Admin\AppData\Local\Temp\D810.tmp"80⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\D87E.tmp"C:\Users\Admin\AppData\Local\Temp\D87E.tmp"81⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"82⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\D939.tmp"C:\Users\Admin\AppData\Local\Temp\D939.tmp"83⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"84⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\DA52.tmp"C:\Users\Admin\AppData\Local\Temp\DA52.tmp"85⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"86⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"87⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\DBD9.tmp"C:\Users\Admin\AppData\Local\Temp\DBD9.tmp"88⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\DC75.tmp"C:\Users\Admin\AppData\Local\Temp\DC75.tmp"89⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\DD12.tmp"C:\Users\Admin\AppData\Local\Temp\DD12.tmp"90⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\DD6F.tmp"C:\Users\Admin\AppData\Local\Temp\DD6F.tmp"91⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"92⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\DE5A.tmp"C:\Users\Admin\AppData\Local\Temp\DE5A.tmp"93⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\DEC7.tmp"C:\Users\Admin\AppData\Local\Temp\DEC7.tmp"94⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\DF34.tmp"C:\Users\Admin\AppData\Local\Temp\DF34.tmp"95⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\DFA2.tmp"C:\Users\Admin\AppData\Local\Temp\DFA2.tmp"96⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\E00F.tmp"C:\Users\Admin\AppData\Local\Temp\E00F.tmp"97⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\E08C.tmp"C:\Users\Admin\AppData\Local\Temp\E08C.tmp"98⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"99⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\E177.tmp"C:\Users\Admin\AppData\Local\Temp\E177.tmp"100⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\E1F4.tmp"C:\Users\Admin\AppData\Local\Temp\E1F4.tmp"101⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\E280.tmp"C:\Users\Admin\AppData\Local\Temp\E280.tmp"102⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\E2EE.tmp"C:\Users\Admin\AppData\Local\Temp\E2EE.tmp"103⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\E38A.tmp"C:\Users\Admin\AppData\Local\Temp\E38A.tmp"104⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\E416.tmp"C:\Users\Admin\AppData\Local\Temp\E416.tmp"105⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"106⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\E53F.tmp"C:\Users\Admin\AppData\Local\Temp\E53F.tmp"107⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\E5CC.tmp"C:\Users\Admin\AppData\Local\Temp\E5CC.tmp"108⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\E659.tmp"C:\Users\Admin\AppData\Local\Temp\E659.tmp"109⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"110⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\E762.tmp"C:\Users\Admin\AppData\Local\Temp\E762.tmp"111⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"112⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\E86C.tmp"C:\Users\Admin\AppData\Local\Temp\E86C.tmp"113⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"114⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\E966.tmp"C:\Users\Admin\AppData\Local\Temp\E966.tmp"115⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\EA12.tmp"C:\Users\Admin\AppData\Local\Temp\EA12.tmp"116⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\EA8F.tmp"C:\Users\Admin\AppData\Local\Temp\EA8F.tmp"117⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\EB1B.tmp"C:\Users\Admin\AppData\Local\Temp\EB1B.tmp"118⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\EB98.tmp"C:\Users\Admin\AppData\Local\Temp\EB98.tmp"119⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\EC25.tmp"C:\Users\Admin\AppData\Local\Temp\EC25.tmp"120⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\ECA2.tmp"C:\Users\Admin\AppData\Local\Temp\ECA2.tmp"121⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"122⤵PID:4836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-