Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
31-08-2023 18:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fc56395f030c36954d12efbe1d064f9b_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
fc56395f030c36954d12efbe1d064f9b_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
fc56395f030c36954d12efbe1d064f9b_mafia_JC.exe
-
Size
486KB
-
MD5
fc56395f030c36954d12efbe1d064f9b
-
SHA1
50b7f16d1b16d1e6f852fba965beaebcc4307a21
-
SHA256
54252c32448b18d72bfa0f31a9ff29c0d9e929b21901adf701e994c38a99b8a2
-
SHA512
2f8b809e2681f97b0a78d52ab09b73baa8fe1f106d8816a062ce104dff32dfd2d9234dd0bc57ebae2adc24f755694e04143e2809f86740d061481e19fd16b52a
-
SSDEEP
12288:UU5rCOTeiDaRpjktUyLo+CqvTbluZAXDn73GRNZ:UUQOJDaRnyLKCTb0sn73GRN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1304 D09E.tmp 3316 D169.tmp 3924 D225.tmp 3388 D2E0.tmp 3608 D3AB.tmp 1312 D448.tmp 556 D4F3.tmp 1268 D5BF.tmp 1604 D65B.tmp 932 D6E7.tmp 3160 D764.tmp 3020 D88D.tmp 4468 D939.tmp 1988 D9D5.tmp 4736 DA62.tmp 3824 DAEF.tmp 2808 DBC9.tmp 2912 DC66.tmp 4928 DD02.tmp 2940 DDBD.tmp 412 DE98.tmp 928 DF25.tmp 2876 DFC1.tmp 896 E05D.tmp 4032 E148.tmp 2172 E213.tmp 1368 E2AF.tmp 2164 E36B.tmp 1684 E3E8.tmp 4696 E465.tmp 4652 E501.tmp 2112 E5BC.tmp 720 E678.tmp 3536 E6E5.tmp 2388 E781.tmp 2592 E7FE.tmp 1116 E8AA.tmp 112 E937.tmp 3140 E9B4.tmp 1536 EA31.tmp 3820 EACD.tmp 3352 EB69.tmp 852 EC06.tmp 4284 EC92.tmp 2548 ED2F.tmp 708 EDBB.tmp 3796 EE57.tmp 4376 EEE4.tmp 4976 EFBF.tmp 848 F05B.tmp 5108 F0F7.tmp 5064 F184.tmp 3176 F211.tmp 580 F28E.tmp 1544 F31A.tmp 2712 F3B6.tmp 3296 F414.tmp 2412 F491.tmp 3828 F4FF.tmp 2908 F57C.tmp 1148 F618.tmp 3608 F6B4.tmp 4952 F741.tmp 3988 F7ED.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1388 wrote to memory of 1304 1388 fc56395f030c36954d12efbe1d064f9b_mafia_JC.exe 81 PID 1388 wrote to memory of 1304 1388 fc56395f030c36954d12efbe1d064f9b_mafia_JC.exe 81 PID 1388 wrote to memory of 1304 1388 fc56395f030c36954d12efbe1d064f9b_mafia_JC.exe 81 PID 1304 wrote to memory of 3316 1304 D09E.tmp 82 PID 1304 wrote to memory of 3316 1304 D09E.tmp 82 PID 1304 wrote to memory of 3316 1304 D09E.tmp 82 PID 3316 wrote to memory of 3924 3316 D169.tmp 83 PID 3316 wrote to memory of 3924 3316 D169.tmp 83 PID 3316 wrote to memory of 3924 3316 D169.tmp 83 PID 3924 wrote to memory of 3388 3924 D225.tmp 84 PID 3924 wrote to memory of 3388 3924 D225.tmp 84 PID 3924 wrote to memory of 3388 3924 D225.tmp 84 PID 3388 wrote to memory of 3608 3388 D2E0.tmp 85 PID 3388 wrote to memory of 3608 3388 D2E0.tmp 85 PID 3388 wrote to memory of 3608 3388 D2E0.tmp 85 PID 3608 wrote to memory of 1312 3608 D3AB.tmp 86 PID 3608 wrote to memory of 1312 3608 D3AB.tmp 86 PID 3608 wrote to memory of 1312 3608 D3AB.tmp 86 PID 1312 wrote to memory of 556 1312 D448.tmp 87 PID 1312 wrote to memory of 556 1312 D448.tmp 87 PID 1312 wrote to memory of 556 1312 D448.tmp 87 PID 556 wrote to memory of 1268 556 D4F3.tmp 88 PID 556 wrote to memory of 1268 556 D4F3.tmp 88 PID 556 wrote to memory of 1268 556 D4F3.tmp 88 PID 1268 wrote to memory of 1604 1268 D5BF.tmp 90 PID 1268 wrote to memory of 1604 1268 D5BF.tmp 90 PID 1268 wrote to memory of 1604 1268 D5BF.tmp 90 PID 1604 wrote to memory of 932 1604 D65B.tmp 91 PID 1604 wrote to memory of 932 1604 D65B.tmp 91 PID 1604 wrote to memory of 932 1604 D65B.tmp 91 PID 932 wrote to memory of 3160 932 D6E7.tmp 92 PID 932 wrote to memory of 3160 932 D6E7.tmp 92 PID 932 wrote to memory of 3160 932 D6E7.tmp 92 PID 3160 wrote to memory of 3020 3160 D764.tmp 93 PID 3160 wrote to memory of 3020 3160 D764.tmp 93 PID 3160 wrote to memory of 3020 3160 D764.tmp 93 PID 3020 wrote to memory of 4468 3020 D88D.tmp 94 PID 3020 wrote to memory of 4468 3020 D88D.tmp 94 PID 3020 wrote to memory of 4468 3020 D88D.tmp 94 PID 4468 wrote to memory of 1988 4468 D939.tmp 95 PID 4468 wrote to memory of 1988 4468 D939.tmp 95 PID 4468 wrote to memory of 1988 4468 D939.tmp 95 PID 1988 wrote to memory of 4736 1988 D9D5.tmp 96 PID 1988 wrote to memory of 4736 1988 D9D5.tmp 96 PID 1988 wrote to memory of 4736 1988 D9D5.tmp 96 PID 4736 wrote to memory of 3824 4736 DA62.tmp 97 PID 4736 wrote to memory of 3824 4736 DA62.tmp 97 PID 4736 wrote to memory of 3824 4736 DA62.tmp 97 PID 3824 wrote to memory of 2808 3824 DAEF.tmp 98 PID 3824 wrote to memory of 2808 3824 DAEF.tmp 98 PID 3824 wrote to memory of 2808 3824 DAEF.tmp 98 PID 2808 wrote to memory of 2912 2808 DBC9.tmp 99 PID 2808 wrote to memory of 2912 2808 DBC9.tmp 99 PID 2808 wrote to memory of 2912 2808 DBC9.tmp 99 PID 2912 wrote to memory of 4928 2912 DC66.tmp 100 PID 2912 wrote to memory of 4928 2912 DC66.tmp 100 PID 2912 wrote to memory of 4928 2912 DC66.tmp 100 PID 4928 wrote to memory of 2940 4928 DD02.tmp 101 PID 4928 wrote to memory of 2940 4928 DD02.tmp 101 PID 4928 wrote to memory of 2940 4928 DD02.tmp 101 PID 2940 wrote to memory of 412 2940 DDBD.tmp 102 PID 2940 wrote to memory of 412 2940 DDBD.tmp 102 PID 2940 wrote to memory of 412 2940 DDBD.tmp 102 PID 412 wrote to memory of 928 412 DE98.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc56395f030c36954d12efbe1d064f9b_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\fc56395f030c36954d12efbe1d064f9b_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\D09E.tmp"C:\Users\Admin\AppData\Local\Temp\D09E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\D169.tmp"C:\Users\Admin\AppData\Local\Temp\D169.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\D225.tmp"C:\Users\Admin\AppData\Local\Temp\D225.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\D448.tmp"C:\Users\Admin\AppData\Local\Temp\D448.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\D4F3.tmp"C:\Users\Admin\AppData\Local\Temp\D4F3.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\D5BF.tmp"C:\Users\Admin\AppData\Local\Temp\D5BF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\D65B.tmp"C:\Users\Admin\AppData\Local\Temp\D65B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\D6E7.tmp"C:\Users\Admin\AppData\Local\Temp\D6E7.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\D764.tmp"C:\Users\Admin\AppData\Local\Temp\D764.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\D88D.tmp"C:\Users\Admin\AppData\Local\Temp\D88D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\D939.tmp"C:\Users\Admin\AppData\Local\Temp\D939.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\DA62.tmp"C:\Users\Admin\AppData\Local\Temp\DA62.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\DAEF.tmp"C:\Users\Admin\AppData\Local\Temp\DAEF.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\DC66.tmp"C:\Users\Admin\AppData\Local\Temp\DC66.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\DD02.tmp"C:\Users\Admin\AppData\Local\Temp\DD02.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\DDBD.tmp"C:\Users\Admin\AppData\Local\Temp\DDBD.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\DE98.tmp"C:\Users\Admin\AppData\Local\Temp\DE98.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Users\Admin\AppData\Local\Temp\DF25.tmp"C:\Users\Admin\AppData\Local\Temp\DF25.tmp"23⤵
- Executes dropped EXE
PID:928 -
C:\Users\Admin\AppData\Local\Temp\DFC1.tmp"C:\Users\Admin\AppData\Local\Temp\DFC1.tmp"24⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\E05D.tmp"C:\Users\Admin\AppData\Local\Temp\E05D.tmp"25⤵
- Executes dropped EXE
PID:896 -
C:\Users\Admin\AppData\Local\Temp\E148.tmp"C:\Users\Admin\AppData\Local\Temp\E148.tmp"26⤵
- Executes dropped EXE
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\E213.tmp"C:\Users\Admin\AppData\Local\Temp\E213.tmp"27⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\E2AF.tmp"C:\Users\Admin\AppData\Local\Temp\E2AF.tmp"28⤵
- Executes dropped EXE
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\E36B.tmp"C:\Users\Admin\AppData\Local\Temp\E36B.tmp"29⤵
- Executes dropped EXE
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\E3E8.tmp"C:\Users\Admin\AppData\Local\Temp\E3E8.tmp"30⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\E465.tmp"C:\Users\Admin\AppData\Local\Temp\E465.tmp"31⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\E501.tmp"C:\Users\Admin\AppData\Local\Temp\E501.tmp"32⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\E5BC.tmp"C:\Users\Admin\AppData\Local\Temp\E5BC.tmp"33⤵
- Executes dropped EXE
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\E678.tmp"C:\Users\Admin\AppData\Local\Temp\E678.tmp"34⤵
- Executes dropped EXE
PID:720 -
C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"35⤵
- Executes dropped EXE
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\E781.tmp"C:\Users\Admin\AppData\Local\Temp\E781.tmp"36⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"37⤵
- Executes dropped EXE
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\E8AA.tmp"C:\Users\Admin\AppData\Local\Temp\E8AA.tmp"38⤵
- Executes dropped EXE
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\E937.tmp"C:\Users\Admin\AppData\Local\Temp\E937.tmp"39⤵
- Executes dropped EXE
PID:112 -
C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"40⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\EA31.tmp"C:\Users\Admin\AppData\Local\Temp\EA31.tmp"41⤵
- Executes dropped EXE
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\EACD.tmp"C:\Users\Admin\AppData\Local\Temp\EACD.tmp"42⤵
- Executes dropped EXE
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\EB69.tmp"C:\Users\Admin\AppData\Local\Temp\EB69.tmp"43⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\EC06.tmp"C:\Users\Admin\AppData\Local\Temp\EC06.tmp"44⤵
- Executes dropped EXE
PID:852 -
C:\Users\Admin\AppData\Local\Temp\EC92.tmp"C:\Users\Admin\AppData\Local\Temp\EC92.tmp"45⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"46⤵
- Executes dropped EXE
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"47⤵
- Executes dropped EXE
PID:708 -
C:\Users\Admin\AppData\Local\Temp\EE57.tmp"C:\Users\Admin\AppData\Local\Temp\EE57.tmp"48⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"49⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\EFBF.tmp"C:\Users\Admin\AppData\Local\Temp\EFBF.tmp"50⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\F05B.tmp"C:\Users\Admin\AppData\Local\Temp\F05B.tmp"51⤵
- Executes dropped EXE
PID:848 -
C:\Users\Admin\AppData\Local\Temp\F0F7.tmp"C:\Users\Admin\AppData\Local\Temp\F0F7.tmp"52⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\F184.tmp"C:\Users\Admin\AppData\Local\Temp\F184.tmp"53⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\F211.tmp"C:\Users\Admin\AppData\Local\Temp\F211.tmp"54⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\F28E.tmp"C:\Users\Admin\AppData\Local\Temp\F28E.tmp"55⤵
- Executes dropped EXE
PID:580 -
C:\Users\Admin\AppData\Local\Temp\F31A.tmp"C:\Users\Admin\AppData\Local\Temp\F31A.tmp"56⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"57⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\F414.tmp"C:\Users\Admin\AppData\Local\Temp\F414.tmp"58⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\F491.tmp"C:\Users\Admin\AppData\Local\Temp\F491.tmp"59⤵
- Executes dropped EXE
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"60⤵
- Executes dropped EXE
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\F57C.tmp"C:\Users\Admin\AppData\Local\Temp\F57C.tmp"61⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\F618.tmp"C:\Users\Admin\AppData\Local\Temp\F618.tmp"62⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\F6B4.tmp"C:\Users\Admin\AppData\Local\Temp\F6B4.tmp"63⤵
- Executes dropped EXE
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\F741.tmp"C:\Users\Admin\AppData\Local\Temp\F741.tmp"64⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\F7ED.tmp"C:\Users\Admin\AppData\Local\Temp\F7ED.tmp"65⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\F85A.tmp"C:\Users\Admin\AppData\Local\Temp\F85A.tmp"66⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"67⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\F983.tmp"C:\Users\Admin\AppData\Local\Temp\F983.tmp"68⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\FA1F.tmp"C:\Users\Admin\AppData\Local\Temp\FA1F.tmp"69⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\FAAC.tmp"C:\Users\Admin\AppData\Local\Temp\FAAC.tmp"70⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\FB58.tmp"C:\Users\Admin\AppData\Local\Temp\FB58.tmp"71⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"72⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\FC52.tmp"C:\Users\Admin\AppData\Local\Temp\FC52.tmp"73⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"74⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"75⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"76⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\FE17.tmp"C:\Users\Admin\AppData\Local\Temp\FE17.tmp"77⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\FE74.tmp"C:\Users\Admin\AppData\Local\Temp\FE74.tmp"78⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\FF20.tmp"C:\Users\Admin\AppData\Local\Temp\FF20.tmp"79⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\FF9D.tmp"C:\Users\Admin\AppData\Local\Temp\FF9D.tmp"80⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\1A.tmp"C:\Users\Admin\AppData\Local\Temp\1A.tmp"81⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\88.tmp"C:\Users\Admin\AppData\Local\Temp\88.tmp"82⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\124.tmp"C:\Users\Admin\AppData\Local\Temp\124.tmp"83⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\1D0.tmp"C:\Users\Admin\AppData\Local\Temp\1D0.tmp"84⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\26C.tmp"C:\Users\Admin\AppData\Local\Temp\26C.tmp"85⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\2E9.tmp"C:\Users\Admin\AppData\Local\Temp\2E9.tmp"86⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\366.tmp"C:\Users\Admin\AppData\Local\Temp\366.tmp"87⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\3E3.tmp"C:\Users\Admin\AppData\Local\Temp\3E3.tmp"88⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\460.tmp"C:\Users\Admin\AppData\Local\Temp\460.tmp"89⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\4DD.tmp"C:\Users\Admin\AppData\Local\Temp\4DD.tmp"90⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\54A.tmp"C:\Users\Admin\AppData\Local\Temp\54A.tmp"91⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\5C7.tmp"C:\Users\Admin\AppData\Local\Temp\5C7.tmp"92⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\625.tmp"C:\Users\Admin\AppData\Local\Temp\625.tmp"93⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\6B2.tmp"C:\Users\Admin\AppData\Local\Temp\6B2.tmp"94⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\73E.tmp"C:\Users\Admin\AppData\Local\Temp\73E.tmp"95⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\79C.tmp"C:\Users\Admin\AppData\Local\Temp\79C.tmp"96⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\80A.tmp"C:\Users\Admin\AppData\Local\Temp\80A.tmp"97⤵PID:420
-
C:\Users\Admin\AppData\Local\Temp\8A6.tmp"C:\Users\Admin\AppData\Local\Temp\8A6.tmp"98⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\923.tmp"C:\Users\Admin\AppData\Local\Temp\923.tmp"99⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\990.tmp"C:\Users\Admin\AppData\Local\Temp\990.tmp"100⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\A2C.tmp"C:\Users\Admin\AppData\Local\Temp\A2C.tmp"101⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\A9A.tmp"C:\Users\Admin\AppData\Local\Temp\A9A.tmp"102⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\AF8.tmp"C:\Users\Admin\AppData\Local\Temp\AF8.tmp"103⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\B75.tmp"C:\Users\Admin\AppData\Local\Temp\B75.tmp"104⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\BE2.tmp"C:\Users\Admin\AppData\Local\Temp\BE2.tmp"105⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\C5F.tmp"C:\Users\Admin\AppData\Local\Temp\C5F.tmp"106⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\CDC.tmp"C:\Users\Admin\AppData\Local\Temp\CDC.tmp"107⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\D59.tmp"C:\Users\Admin\AppData\Local\Temp\D59.tmp"108⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\DD6.tmp"C:\Users\Admin\AppData\Local\Temp\DD6.tmp"109⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\E43.tmp"C:\Users\Admin\AppData\Local\Temp\E43.tmp"110⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\EB1.tmp"C:\Users\Admin\AppData\Local\Temp\EB1.tmp"111⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\F3D.tmp"C:\Users\Admin\AppData\Local\Temp\F3D.tmp"112⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\FCA.tmp"C:\Users\Admin\AppData\Local\Temp\FCA.tmp"113⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\1057.tmp"C:\Users\Admin\AppData\Local\Temp\1057.tmp"114⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\10C4.tmp"C:\Users\Admin\AppData\Local\Temp\10C4.tmp"115⤵PID:100
-
C:\Users\Admin\AppData\Local\Temp\1160.tmp"C:\Users\Admin\AppData\Local\Temp\1160.tmp"116⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\11DD.tmp"C:\Users\Admin\AppData\Local\Temp\11DD.tmp"117⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\125A.tmp"C:\Users\Admin\AppData\Local\Temp\125A.tmp"118⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\12E7.tmp"C:\Users\Admin\AppData\Local\Temp\12E7.tmp"119⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\1373.tmp"C:\Users\Admin\AppData\Local\Temp\1373.tmp"120⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\1400.tmp"C:\Users\Admin\AppData\Local\Temp\1400.tmp"121⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\147D.tmp"C:\Users\Admin\AppData\Local\Temp\147D.tmp"122⤵PID:4212
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-