Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
31/08/2023, 18:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fd722c84bf5df97e55cb53d28f935068_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
fd722c84bf5df97e55cb53d28f935068_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
fd722c84bf5df97e55cb53d28f935068_mafia_JC.exe
-
Size
520KB
-
MD5
fd722c84bf5df97e55cb53d28f935068
-
SHA1
0bdf0c49f2d3c42d28238f98f2cc89d1c227fa49
-
SHA256
fea31fb821720ffd2005ab158f8d5499303423b69c90672fcf81e830e9b18902
-
SHA512
1bf34389ff9582fb57a67d4317c40d14c4a0d57708933783187fe2f60396a80ef9000e82363e12001ff166ec75194a2f78e1964252e2eb5c0120c99b2d6e058c
-
SSDEEP
12288:roRXOQjmOyHG+jvXImH/1MH3UvnwcIgimd5fFNZ:rogQ9yzv4k1kanNd5dN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3876 8194.tmp 3064 8240.tmp 4996 82EB.tmp 3052 83F5.tmp 3708 84A1.tmp 3292 855C.tmp 4508 85E9.tmp 2460 8685.tmp 1860 8712.tmp 5000 879F.tmp 5048 883B.tmp 4568 88D7.tmp 5080 8993.tmp 4056 8A5E.tmp 1380 8B29.tmp 1788 8BB5.tmp 1804 8C90.tmp 4744 8D0D.tmp 3732 8DC9.tmp 4016 8E65.tmp 1756 8F20.tmp 2176 9049.tmp 4436 9134.tmp 4280 91D0.tmp 3036 926C.tmp 1212 9337.tmp 2008 93D4.tmp 2496 9441.tmp 2608 94ED.tmp 456 95C8.tmp 3512 96A2.tmp 2924 973F.tmp 2256 980A.tmp 4172 9887.tmp 4788 9904.tmp 3156 99A0.tmp 484 9A2D.tmp 3564 9A9A.tmp 4264 9B27.tmp 2936 9BC3.tmp 3656 9C4F.tmp 5012 9CDC.tmp 5056 9D59.tmp 3852 9DE6.tmp 3612 9E72.tmp 4712 9EEF.tmp 1084 9F7C.tmp 3044 A009.tmp 492 A0A5.tmp 3272 A122.tmp 4360 A19F.tmp 2896 A22B.tmp 2164 A2A8.tmp 4012 A335.tmp 5060 A3C2.tmp 4904 A42F.tmp 960 A4AC.tmp 4252 A539.tmp 5020 A5C5.tmp 3724 A642.tmp 4964 A6BF.tmp 4128 A72D.tmp 1984 A7B9.tmp 3872 A836.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3768 wrote to memory of 3876 3768 fd722c84bf5df97e55cb53d28f935068_mafia_JC.exe 82 PID 3768 wrote to memory of 3876 3768 fd722c84bf5df97e55cb53d28f935068_mafia_JC.exe 82 PID 3768 wrote to memory of 3876 3768 fd722c84bf5df97e55cb53d28f935068_mafia_JC.exe 82 PID 3876 wrote to memory of 3064 3876 8194.tmp 83 PID 3876 wrote to memory of 3064 3876 8194.tmp 83 PID 3876 wrote to memory of 3064 3876 8194.tmp 83 PID 3064 wrote to memory of 4996 3064 8240.tmp 84 PID 3064 wrote to memory of 4996 3064 8240.tmp 84 PID 3064 wrote to memory of 4996 3064 8240.tmp 84 PID 4996 wrote to memory of 3052 4996 82EB.tmp 85 PID 4996 wrote to memory of 3052 4996 82EB.tmp 85 PID 4996 wrote to memory of 3052 4996 82EB.tmp 85 PID 3052 wrote to memory of 3708 3052 83F5.tmp 86 PID 3052 wrote to memory of 3708 3052 83F5.tmp 86 PID 3052 wrote to memory of 3708 3052 83F5.tmp 86 PID 3708 wrote to memory of 3292 3708 84A1.tmp 87 PID 3708 wrote to memory of 3292 3708 84A1.tmp 87 PID 3708 wrote to memory of 3292 3708 84A1.tmp 87 PID 3292 wrote to memory of 4508 3292 855C.tmp 88 PID 3292 wrote to memory of 4508 3292 855C.tmp 88 PID 3292 wrote to memory of 4508 3292 855C.tmp 88 PID 4508 wrote to memory of 2460 4508 85E9.tmp 89 PID 4508 wrote to memory of 2460 4508 85E9.tmp 89 PID 4508 wrote to memory of 2460 4508 85E9.tmp 89 PID 2460 wrote to memory of 1860 2460 8685.tmp 91 PID 2460 wrote to memory of 1860 2460 8685.tmp 91 PID 2460 wrote to memory of 1860 2460 8685.tmp 91 PID 1860 wrote to memory of 5000 1860 8712.tmp 92 PID 1860 wrote to memory of 5000 1860 8712.tmp 92 PID 1860 wrote to memory of 5000 1860 8712.tmp 92 PID 5000 wrote to memory of 5048 5000 879F.tmp 93 PID 5000 wrote to memory of 5048 5000 879F.tmp 93 PID 5000 wrote to memory of 5048 5000 879F.tmp 93 PID 5048 wrote to memory of 4568 5048 883B.tmp 94 PID 5048 wrote to memory of 4568 5048 883B.tmp 94 PID 5048 wrote to memory of 4568 5048 883B.tmp 94 PID 4568 wrote to memory of 5080 4568 88D7.tmp 95 PID 4568 wrote to memory of 5080 4568 88D7.tmp 95 PID 4568 wrote to memory of 5080 4568 88D7.tmp 95 PID 5080 wrote to memory of 4056 5080 8993.tmp 96 PID 5080 wrote to memory of 4056 5080 8993.tmp 96 PID 5080 wrote to memory of 4056 5080 8993.tmp 96 PID 4056 wrote to memory of 1380 4056 8A5E.tmp 97 PID 4056 wrote to memory of 1380 4056 8A5E.tmp 97 PID 4056 wrote to memory of 1380 4056 8A5E.tmp 97 PID 1380 wrote to memory of 1788 1380 8B29.tmp 98 PID 1380 wrote to memory of 1788 1380 8B29.tmp 98 PID 1380 wrote to memory of 1788 1380 8B29.tmp 98 PID 1788 wrote to memory of 1804 1788 8BB5.tmp 99 PID 1788 wrote to memory of 1804 1788 8BB5.tmp 99 PID 1788 wrote to memory of 1804 1788 8BB5.tmp 99 PID 1804 wrote to memory of 4744 1804 8C90.tmp 102 PID 1804 wrote to memory of 4744 1804 8C90.tmp 102 PID 1804 wrote to memory of 4744 1804 8C90.tmp 102 PID 4744 wrote to memory of 3732 4744 8D0D.tmp 103 PID 4744 wrote to memory of 3732 4744 8D0D.tmp 103 PID 4744 wrote to memory of 3732 4744 8D0D.tmp 103 PID 3732 wrote to memory of 4016 3732 8DC9.tmp 104 PID 3732 wrote to memory of 4016 3732 8DC9.tmp 104 PID 3732 wrote to memory of 4016 3732 8DC9.tmp 104 PID 4016 wrote to memory of 1756 4016 8E65.tmp 105 PID 4016 wrote to memory of 1756 4016 8E65.tmp 105 PID 4016 wrote to memory of 1756 4016 8E65.tmp 105 PID 1756 wrote to memory of 2176 1756 8F20.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd722c84bf5df97e55cb53d28f935068_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\fd722c84bf5df97e55cb53d28f935068_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\8194.tmp"C:\Users\Admin\AppData\Local\Temp\8194.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\8240.tmp"C:\Users\Admin\AppData\Local\Temp\8240.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\82EB.tmp"C:\Users\Admin\AppData\Local\Temp\82EB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\83F5.tmp"C:\Users\Admin\AppData\Local\Temp\83F5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\84A1.tmp"C:\Users\Admin\AppData\Local\Temp\84A1.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\855C.tmp"C:\Users\Admin\AppData\Local\Temp\855C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\8685.tmp"C:\Users\Admin\AppData\Local\Temp\8685.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\8712.tmp"C:\Users\Admin\AppData\Local\Temp\8712.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\879F.tmp"C:\Users\Admin\AppData\Local\Temp\879F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\883B.tmp"C:\Users\Admin\AppData\Local\Temp\883B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\8993.tmp"C:\Users\Admin\AppData\Local\Temp\8993.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\8B29.tmp"C:\Users\Admin\AppData\Local\Temp\8B29.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\8F20.tmp"C:\Users\Admin\AppData\Local\Temp\8F20.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\9049.tmp"C:\Users\Admin\AppData\Local\Temp\9049.tmp"23⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\9134.tmp"C:\Users\Admin\AppData\Local\Temp\9134.tmp"24⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\91D0.tmp"C:\Users\Admin\AppData\Local\Temp\91D0.tmp"25⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\926C.tmp"C:\Users\Admin\AppData\Local\Temp\926C.tmp"26⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\9337.tmp"C:\Users\Admin\AppData\Local\Temp\9337.tmp"27⤵
- Executes dropped EXE
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"28⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\9441.tmp"C:\Users\Admin\AppData\Local\Temp\9441.tmp"29⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\94ED.tmp"C:\Users\Admin\AppData\Local\Temp\94ED.tmp"30⤵
- Executes dropped EXE
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\95C8.tmp"C:\Users\Admin\AppData\Local\Temp\95C8.tmp"31⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"32⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"33⤵
- Executes dropped EXE
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"34⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"35⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\9904.tmp"C:\Users\Admin\AppData\Local\Temp\9904.tmp"36⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\99A0.tmp"C:\Users\Admin\AppData\Local\Temp\99A0.tmp"37⤵
- Executes dropped EXE
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"38⤵
- Executes dropped EXE
PID:484 -
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"39⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"40⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"41⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"42⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"43⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\9D59.tmp"C:\Users\Admin\AppData\Local\Temp\9D59.tmp"44⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"45⤵
- Executes dropped EXE
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\9E72.tmp"C:\Users\Admin\AppData\Local\Temp\9E72.tmp"46⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"47⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"48⤵
- Executes dropped EXE
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"49⤵
- Executes dropped EXE
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"50⤵
- Executes dropped EXE
PID:492 -
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"51⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\A19F.tmp"C:\Users\Admin\AppData\Local\Temp\A19F.tmp"52⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"53⤵
- Executes dropped EXE
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"54⤵
- Executes dropped EXE
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"55⤵
- Executes dropped EXE
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"56⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"57⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"58⤵
- Executes dropped EXE
PID:960 -
C:\Users\Admin\AppData\Local\Temp\A539.tmp"C:\Users\Admin\AppData\Local\Temp\A539.tmp"59⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"60⤵
- Executes dropped EXE
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\A642.tmp"C:\Users\Admin\AppData\Local\Temp\A642.tmp"61⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"62⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"63⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"64⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\A836.tmp"C:\Users\Admin\AppData\Local\Temp\A836.tmp"65⤵
- Executes dropped EXE
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"66⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\A950.tmp"C:\Users\Admin\AppData\Local\Temp\A950.tmp"67⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"68⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"69⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"70⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\AB05.tmp"C:\Users\Admin\AppData\Local\Temp\AB05.tmp"71⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\AB72.tmp"C:\Users\Admin\AppData\Local\Temp\AB72.tmp"72⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"73⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"74⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"75⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\AD66.tmp"C:\Users\Admin\AppData\Local\Temp\AD66.tmp"76⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"77⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\AE80.tmp"C:\Users\Admin\AppData\Local\Temp\AE80.tmp"78⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"79⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"80⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"81⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\B064.tmp"C:\Users\Admin\AppData\Local\Temp\B064.tmp"82⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"83⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"84⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"85⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\B258.tmp"C:\Users\Admin\AppData\Local\Temp\B258.tmp"86⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"87⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\B352.tmp"C:\Users\Admin\AppData\Local\Temp\B352.tmp"88⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"89⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"90⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"91⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"92⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\B602.tmp"C:\Users\Admin\AppData\Local\Temp\B602.tmp"93⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\B66F.tmp"C:\Users\Admin\AppData\Local\Temp\B66F.tmp"94⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"95⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\B74A.tmp"C:\Users\Admin\AppData\Local\Temp\B74A.tmp"96⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"97⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\B824.tmp"C:\Users\Admin\AppData\Local\Temp\B824.tmp"98⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\B892.tmp"C:\Users\Admin\AppData\Local\Temp\B892.tmp"99⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\B94D.tmp"C:\Users\Admin\AppData\Local\Temp\B94D.tmp"100⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"101⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\BA76.tmp"C:\Users\Admin\AppData\Local\Temp\BA76.tmp"102⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\BAF3.tmp"C:\Users\Admin\AppData\Local\Temp\BAF3.tmp"103⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"104⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"105⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\BC99.tmp"C:\Users\Admin\AppData\Local\Temp\BC99.tmp"106⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\BD06.tmp"C:\Users\Admin\AppData\Local\Temp\BD06.tmp"107⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"108⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"109⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"110⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"111⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\BF77.tmp"C:\Users\Admin\AppData\Local\Temp\BF77.tmp"112⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\C004.tmp"C:\Users\Admin\AppData\Local\Temp\C004.tmp"113⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"114⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\C10E.tmp"C:\Users\Admin\AppData\Local\Temp\C10E.tmp"115⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\C18B.tmp"C:\Users\Admin\AppData\Local\Temp\C18B.tmp"116⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\C208.tmp"C:\Users\Admin\AppData\Local\Temp\C208.tmp"117⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\C294.tmp"C:\Users\Admin\AppData\Local\Temp\C294.tmp"118⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\C302.tmp"C:\Users\Admin\AppData\Local\Temp\C302.tmp"119⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\C37F.tmp"C:\Users\Admin\AppData\Local\Temp\C37F.tmp"120⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\C41B.tmp"C:\Users\Admin\AppData\Local\Temp\C41B.tmp"121⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"122⤵PID:4124
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-