Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2023, 16:02
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-27_1f2fcc19828fe01e6784dbf3d276220f_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-27_1f2fcc19828fe01e6784dbf3d276220f_mafia_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2023-08-27_1f2fcc19828fe01e6784dbf3d276220f_mafia_JC.exe
-
Size
487KB
-
MD5
1f2fcc19828fe01e6784dbf3d276220f
-
SHA1
05dd2fa136c90e45850f215f789254751e6a7938
-
SHA256
fb93973a14c99f386fa4dded953df74754cf6634949c3c8a3795c056cf7c29b7
-
SHA512
d94f13e6008b639d9826856feba6bba18a97c8094e4f4fe3ffe1689d55b447656016d2533b0c8aaf6d28f420f60bd4638fe9f79f26170c8d018e933eb8eaa526
-
SSDEEP
6144:zorf3lPvovsgZnqG2C7mOTeiLxDxiJfqCWFema1/7cGnzyJqK0bTQYwakqphOO+:yU5rCOTeiNufBmwjcGzaoTvkIhvbZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2196 609E.tmp 3528 6169.tmp 3632 61F6.tmp 4476 62B1.tmp 4968 635D.tmp 2412 63FA.tmp 4988 6477.tmp 1716 6542.tmp 4268 65DE.tmp 2176 6699.tmp 4928 6736.tmp 4204 67C2.tmp 3444 687E.tmp 2776 6939.tmp 4136 69F5.tmp 4572 6A72.tmp 760 6BBA.tmp 1504 6C75.tmp 4492 6D21.tmp 2292 6DEC.tmp 3788 6E79.tmp 3388 6F92.tmp 2780 704E.tmp 4872 70EA.tmp 1212 71B5.tmp 4772 7271.tmp 2700 735B.tmp 4324 7417.tmp 2932 74E2.tmp 3496 758E.tmp 2664 762A.tmp 4116 76D6.tmp 4768 7782.tmp 3016 781E.tmp 8 78AA.tmp 4796 7947.tmp 1000 79E3.tmp 3864 7A50.tmp 4132 7ABE.tmp 3096 7B6A.tmp 1508 7BF6.tmp 3724 7C73.tmp 4956 7D0F.tmp 1844 7D9C.tmp 1752 7E38.tmp 4620 7EC5.tmp 1360 7F42.tmp 1624 7FDE.tmp 2076 807A.tmp 1524 80E8.tmp 3224 8146.tmp 772 81F1.tmp 376 828E.tmp 2212 831A.tmp 2000 83C6.tmp 4572 8462.tmp 5080 84D0.tmp 4240 854D.tmp 2452 85BA.tmp 4688 8637.tmp 4652 86C4.tmp 1356 8731.tmp 4340 87BE.tmp 4872 883B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 212 wrote to memory of 2196 212 2023-08-27_1f2fcc19828fe01e6784dbf3d276220f_mafia_JC.exe 85 PID 212 wrote to memory of 2196 212 2023-08-27_1f2fcc19828fe01e6784dbf3d276220f_mafia_JC.exe 85 PID 212 wrote to memory of 2196 212 2023-08-27_1f2fcc19828fe01e6784dbf3d276220f_mafia_JC.exe 85 PID 2196 wrote to memory of 3528 2196 609E.tmp 87 PID 2196 wrote to memory of 3528 2196 609E.tmp 87 PID 2196 wrote to memory of 3528 2196 609E.tmp 87 PID 3528 wrote to memory of 3632 3528 6169.tmp 88 PID 3528 wrote to memory of 3632 3528 6169.tmp 88 PID 3528 wrote to memory of 3632 3528 6169.tmp 88 PID 3632 wrote to memory of 4476 3632 61F6.tmp 89 PID 3632 wrote to memory of 4476 3632 61F6.tmp 89 PID 3632 wrote to memory of 4476 3632 61F6.tmp 89 PID 4476 wrote to memory of 4968 4476 62B1.tmp 90 PID 4476 wrote to memory of 4968 4476 62B1.tmp 90 PID 4476 wrote to memory of 4968 4476 62B1.tmp 90 PID 4968 wrote to memory of 2412 4968 635D.tmp 91 PID 4968 wrote to memory of 2412 4968 635D.tmp 91 PID 4968 wrote to memory of 2412 4968 635D.tmp 91 PID 2412 wrote to memory of 4988 2412 63FA.tmp 92 PID 2412 wrote to memory of 4988 2412 63FA.tmp 92 PID 2412 wrote to memory of 4988 2412 63FA.tmp 92 PID 4988 wrote to memory of 1716 4988 6477.tmp 93 PID 4988 wrote to memory of 1716 4988 6477.tmp 93 PID 4988 wrote to memory of 1716 4988 6477.tmp 93 PID 1716 wrote to memory of 4268 1716 6542.tmp 94 PID 1716 wrote to memory of 4268 1716 6542.tmp 94 PID 1716 wrote to memory of 4268 1716 6542.tmp 94 PID 4268 wrote to memory of 2176 4268 65DE.tmp 95 PID 4268 wrote to memory of 2176 4268 65DE.tmp 95 PID 4268 wrote to memory of 2176 4268 65DE.tmp 95 PID 2176 wrote to memory of 4928 2176 6699.tmp 96 PID 2176 wrote to memory of 4928 2176 6699.tmp 96 PID 2176 wrote to memory of 4928 2176 6699.tmp 96 PID 4928 wrote to memory of 4204 4928 6736.tmp 97 PID 4928 wrote to memory of 4204 4928 6736.tmp 97 PID 4928 wrote to memory of 4204 4928 6736.tmp 97 PID 4204 wrote to memory of 3444 4204 67C2.tmp 98 PID 4204 wrote to memory of 3444 4204 67C2.tmp 98 PID 4204 wrote to memory of 3444 4204 67C2.tmp 98 PID 3444 wrote to memory of 2776 3444 687E.tmp 100 PID 3444 wrote to memory of 2776 3444 687E.tmp 100 PID 3444 wrote to memory of 2776 3444 687E.tmp 100 PID 2776 wrote to memory of 4136 2776 6939.tmp 101 PID 2776 wrote to memory of 4136 2776 6939.tmp 101 PID 2776 wrote to memory of 4136 2776 6939.tmp 101 PID 4136 wrote to memory of 4572 4136 69F5.tmp 102 PID 4136 wrote to memory of 4572 4136 69F5.tmp 102 PID 4136 wrote to memory of 4572 4136 69F5.tmp 102 PID 4572 wrote to memory of 760 4572 6A72.tmp 105 PID 4572 wrote to memory of 760 4572 6A72.tmp 105 PID 4572 wrote to memory of 760 4572 6A72.tmp 105 PID 760 wrote to memory of 1504 760 6BBA.tmp 106 PID 760 wrote to memory of 1504 760 6BBA.tmp 106 PID 760 wrote to memory of 1504 760 6BBA.tmp 106 PID 1504 wrote to memory of 4492 1504 6C75.tmp 108 PID 1504 wrote to memory of 4492 1504 6C75.tmp 108 PID 1504 wrote to memory of 4492 1504 6C75.tmp 108 PID 4492 wrote to memory of 2292 4492 6D21.tmp 109 PID 4492 wrote to memory of 2292 4492 6D21.tmp 109 PID 4492 wrote to memory of 2292 4492 6D21.tmp 109 PID 2292 wrote to memory of 3788 2292 6DEC.tmp 110 PID 2292 wrote to memory of 3788 2292 6DEC.tmp 110 PID 2292 wrote to memory of 3788 2292 6DEC.tmp 110 PID 3788 wrote to memory of 3388 3788 6E79.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-27_1f2fcc19828fe01e6784dbf3d276220f_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-27_1f2fcc19828fe01e6784dbf3d276220f_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"23⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"24⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"25⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\71B5.tmp"C:\Users\Admin\AppData\Local\Temp\71B5.tmp"26⤵
- Executes dropped EXE
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"27⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"28⤵
- Executes dropped EXE
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"29⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"30⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"31⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"32⤵
- Executes dropped EXE
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"33⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"34⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"35⤵
- Executes dropped EXE
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"36⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"37⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"38⤵
- Executes dropped EXE
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\7A50.tmp"C:\Users\Admin\AppData\Local\Temp\7A50.tmp"39⤵
- Executes dropped EXE
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"40⤵
- Executes dropped EXE
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"41⤵
- Executes dropped EXE
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"42⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\7C73.tmp"C:\Users\Admin\AppData\Local\Temp\7C73.tmp"43⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"44⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"45⤵
- Executes dropped EXE
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\7E38.tmp"C:\Users\Admin\AppData\Local\Temp\7E38.tmp"46⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"47⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\7F42.tmp"C:\Users\Admin\AppData\Local\Temp\7F42.tmp"48⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"49⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\807A.tmp"C:\Users\Admin\AppData\Local\Temp\807A.tmp"50⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\80E8.tmp"C:\Users\Admin\AppData\Local\Temp\80E8.tmp"51⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\8146.tmp"C:\Users\Admin\AppData\Local\Temp\8146.tmp"52⤵
- Executes dropped EXE
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\81F1.tmp"C:\Users\Admin\AppData\Local\Temp\81F1.tmp"53⤵
- Executes dropped EXE
PID:772 -
C:\Users\Admin\AppData\Local\Temp\828E.tmp"C:\Users\Admin\AppData\Local\Temp\828E.tmp"54⤵
- Executes dropped EXE
PID:376 -
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"55⤵
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\83C6.tmp"C:\Users\Admin\AppData\Local\Temp\83C6.tmp"56⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\8462.tmp"C:\Users\Admin\AppData\Local\Temp\8462.tmp"57⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\84D0.tmp"C:\Users\Admin\AppData\Local\Temp\84D0.tmp"58⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\854D.tmp"C:\Users\Admin\AppData\Local\Temp\854D.tmp"59⤵
- Executes dropped EXE
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\85BA.tmp"C:\Users\Admin\AppData\Local\Temp\85BA.tmp"60⤵
- Executes dropped EXE
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\8637.tmp"C:\Users\Admin\AppData\Local\Temp\8637.tmp"61⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\86C4.tmp"C:\Users\Admin\AppData\Local\Temp\86C4.tmp"62⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\8731.tmp"C:\Users\Admin\AppData\Local\Temp\8731.tmp"63⤵
- Executes dropped EXE
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\87BE.tmp"C:\Users\Admin\AppData\Local\Temp\87BE.tmp"64⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\883B.tmp"C:\Users\Admin\AppData\Local\Temp\883B.tmp"65⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\8899.tmp"C:\Users\Admin\AppData\Local\Temp\8899.tmp"66⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\8906.tmp"C:\Users\Admin\AppData\Local\Temp\8906.tmp"67⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\8964.tmp"C:\Users\Admin\AppData\Local\Temp\8964.tmp"68⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\89D1.tmp"C:\Users\Admin\AppData\Local\Temp\89D1.tmp"69⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"70⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"71⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\8B19.tmp"C:\Users\Admin\AppData\Local\Temp\8B19.tmp"72⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"73⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\8C13.tmp"C:\Users\Admin\AppData\Local\Temp\8C13.tmp"74⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"75⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"76⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"77⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp"78⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"79⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\8F20.tmp"C:\Users\Admin\AppData\Local\Temp\8F20.tmp"80⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"81⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\902A.tmp"C:\Users\Admin\AppData\Local\Temp\902A.tmp"82⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\90A7.tmp"C:\Users\Admin\AppData\Local\Temp\90A7.tmp"83⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\9134.tmp"C:\Users\Admin\AppData\Local\Temp\9134.tmp"84⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"85⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\922E.tmp"C:\Users\Admin\AppData\Local\Temp\922E.tmp"86⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"87⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"88⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"89⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"90⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\94BE.tmp"C:\Users\Admin\AppData\Local\Temp\94BE.tmp"91⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\954B.tmp"C:\Users\Admin\AppData\Local\Temp\954B.tmp"92⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\95F6.tmp"C:\Users\Admin\AppData\Local\Temp\95F6.tmp"93⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\9673.tmp"C:\Users\Admin\AppData\Local\Temp\9673.tmp"94⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\9710.tmp"C:\Users\Admin\AppData\Local\Temp\9710.tmp"95⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\978D.tmp"C:\Users\Admin\AppData\Local\Temp\978D.tmp"96⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\9819.tmp"C:\Users\Admin\AppData\Local\Temp\9819.tmp"97⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\98A6.tmp"C:\Users\Admin\AppData\Local\Temp\98A6.tmp"98⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\9923.tmp"C:\Users\Admin\AppData\Local\Temp\9923.tmp"99⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"100⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"101⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"102⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"103⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"104⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"105⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"106⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"107⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\9D59.tmp"C:\Users\Admin\AppData\Local\Temp\9D59.tmp"108⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"109⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\9E53.tmp"C:\Users\Admin\AppData\Local\Temp\9E53.tmp"110⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"111⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"112⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"113⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"114⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"115⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"116⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\A160.tmp"C:\Users\Admin\AppData\Local\Temp\A160.tmp"117⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"118⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"119⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"120⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\A383.tmp"C:\Users\Admin\AppData\Local\Temp\A383.tmp"121⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\A410.tmp"C:\Users\Admin\AppData\Local\Temp\A410.tmp"122⤵PID:3376
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-