Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
16/08/2023, 16:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
06be325f0295322f2c264b8d228f846e_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
06be325f0295322f2c264b8d228f846e_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
06be325f0295322f2c264b8d228f846e_mafia_JC.exe
-
Size
486KB
-
MD5
06be325f0295322f2c264b8d228f846e
-
SHA1
b3f79aadc8af281ffec9e6af4b72fb1a3d139851
-
SHA256
d5dce9653a1c4e902fb9f9aa852501be08ce4b7a16eaa9e8f2a061021ceb4b75
-
SHA512
2018ed3f00b460e06b912709ddab2a84e285b32fa23698bac808722b6c6ada130f343a80e21b3547ed294e5db81a5b0cd8bb6e54d3fce805432b76b59ffb4f25
-
SSDEEP
12288:/U5rCOTeiDqKqawltd/1QK3pV92V/axFHjvyV1idNZ:/UQOJDqKolvdQK3pRhN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4488 781E.tmp 4176 78F9.tmp 3244 79B4.tmp 4020 7AAE.tmp 2388 7B4A.tmp 2304 7C06.tmp 1344 7CB2.tmp 1656 7DFA.tmp 416 7EB5.tmp 2372 7F42.tmp 516 7FFD.tmp 3668 80B9.tmp 4456 8174.tmp 3732 828E.tmp 1460 8349.tmp 3176 83F5.tmp 544 84A1.tmp 2184 853D.tmp 1640 85D9.tmp 3468 8695.tmp 3744 877F.tmp 2864 88A8.tmp 1684 8925.tmp 4952 89F0.tmp 1848 8A7D.tmp 4892 8B58.tmp 2272 8C32.tmp 4144 8CDE.tmp 5032 8D9A.tmp 4620 8EA3.tmp 2404 8F5F.tmp 5068 9059.tmp 5112 9124.tmp 1812 91B1.tmp 4884 924D.tmp 3076 92CA.tmp 1644 9337.tmp 4156 93C4.tmp 4372 9451.tmp 3352 94BE.tmp 3676 953B.tmp 1744 95F6.tmp 3036 9693.tmp 2572 972F.tmp 2792 97AC.tmp 3976 9858.tmp 3060 98D5.tmp 4676 9942.tmp 4876 99CF.tmp 208 9A4C.tmp 4180 9B36.tmp 232 9BD2.tmp 2728 9C5F.tmp 4348 9D1B.tmp 3404 9DA7.tmp 4900 9E05.tmp 1352 9E63.tmp 3124 9EEF.tmp 1224 9F7C.tmp 3780 A018.tmp 2236 A086.tmp 3936 A103.tmp 3884 A180.tmp 5080 A1FD.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1380 wrote to memory of 4488 1380 06be325f0295322f2c264b8d228f846e_mafia_JC.exe 81 PID 1380 wrote to memory of 4488 1380 06be325f0295322f2c264b8d228f846e_mafia_JC.exe 81 PID 1380 wrote to memory of 4488 1380 06be325f0295322f2c264b8d228f846e_mafia_JC.exe 81 PID 4488 wrote to memory of 4176 4488 781E.tmp 82 PID 4488 wrote to memory of 4176 4488 781E.tmp 82 PID 4488 wrote to memory of 4176 4488 781E.tmp 82 PID 4176 wrote to memory of 3244 4176 78F9.tmp 83 PID 4176 wrote to memory of 3244 4176 78F9.tmp 83 PID 4176 wrote to memory of 3244 4176 78F9.tmp 83 PID 3244 wrote to memory of 4020 3244 79B4.tmp 84 PID 3244 wrote to memory of 4020 3244 79B4.tmp 84 PID 3244 wrote to memory of 4020 3244 79B4.tmp 84 PID 4020 wrote to memory of 2388 4020 7AAE.tmp 85 PID 4020 wrote to memory of 2388 4020 7AAE.tmp 85 PID 4020 wrote to memory of 2388 4020 7AAE.tmp 85 PID 2388 wrote to memory of 2304 2388 7B4A.tmp 86 PID 2388 wrote to memory of 2304 2388 7B4A.tmp 86 PID 2388 wrote to memory of 2304 2388 7B4A.tmp 86 PID 2304 wrote to memory of 1344 2304 7C06.tmp 87 PID 2304 wrote to memory of 1344 2304 7C06.tmp 87 PID 2304 wrote to memory of 1344 2304 7C06.tmp 87 PID 1344 wrote to memory of 1656 1344 7CB2.tmp 88 PID 1344 wrote to memory of 1656 1344 7CB2.tmp 88 PID 1344 wrote to memory of 1656 1344 7CB2.tmp 88 PID 1656 wrote to memory of 416 1656 7DFA.tmp 89 PID 1656 wrote to memory of 416 1656 7DFA.tmp 89 PID 1656 wrote to memory of 416 1656 7DFA.tmp 89 PID 416 wrote to memory of 2372 416 7EB5.tmp 90 PID 416 wrote to memory of 2372 416 7EB5.tmp 90 PID 416 wrote to memory of 2372 416 7EB5.tmp 90 PID 2372 wrote to memory of 516 2372 7F42.tmp 91 PID 2372 wrote to memory of 516 2372 7F42.tmp 91 PID 2372 wrote to memory of 516 2372 7F42.tmp 91 PID 516 wrote to memory of 3668 516 7FFD.tmp 92 PID 516 wrote to memory of 3668 516 7FFD.tmp 92 PID 516 wrote to memory of 3668 516 7FFD.tmp 92 PID 3668 wrote to memory of 4456 3668 80B9.tmp 93 PID 3668 wrote to memory of 4456 3668 80B9.tmp 93 PID 3668 wrote to memory of 4456 3668 80B9.tmp 93 PID 4456 wrote to memory of 3732 4456 8174.tmp 94 PID 4456 wrote to memory of 3732 4456 8174.tmp 94 PID 4456 wrote to memory of 3732 4456 8174.tmp 94 PID 3732 wrote to memory of 1460 3732 828E.tmp 95 PID 3732 wrote to memory of 1460 3732 828E.tmp 95 PID 3732 wrote to memory of 1460 3732 828E.tmp 95 PID 1460 wrote to memory of 3176 1460 8349.tmp 96 PID 1460 wrote to memory of 3176 1460 8349.tmp 96 PID 1460 wrote to memory of 3176 1460 8349.tmp 96 PID 3176 wrote to memory of 544 3176 83F5.tmp 97 PID 3176 wrote to memory of 544 3176 83F5.tmp 97 PID 3176 wrote to memory of 544 3176 83F5.tmp 97 PID 544 wrote to memory of 2184 544 84A1.tmp 98 PID 544 wrote to memory of 2184 544 84A1.tmp 98 PID 544 wrote to memory of 2184 544 84A1.tmp 98 PID 2184 wrote to memory of 1640 2184 853D.tmp 99 PID 2184 wrote to memory of 1640 2184 853D.tmp 99 PID 2184 wrote to memory of 1640 2184 853D.tmp 99 PID 1640 wrote to memory of 3468 1640 85D9.tmp 100 PID 1640 wrote to memory of 3468 1640 85D9.tmp 100 PID 1640 wrote to memory of 3468 1640 85D9.tmp 100 PID 3468 wrote to memory of 3744 3468 8695.tmp 101 PID 3468 wrote to memory of 3744 3468 8695.tmp 101 PID 3468 wrote to memory of 3744 3468 8695.tmp 101 PID 3744 wrote to memory of 2864 3744 877F.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\06be325f0295322f2c264b8d228f846e_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\06be325f0295322f2c264b8d228f846e_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\78F9.tmp"C:\Users\Admin\AppData\Local\Temp\78F9.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\79B4.tmp"C:\Users\Admin\AppData\Local\Temp\79B4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\7C06.tmp"C:\Users\Admin\AppData\Local\Temp\7C06.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Users\Admin\AppData\Local\Temp\7F42.tmp"C:\Users\Admin\AppData\Local\Temp\7F42.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Users\Admin\AppData\Local\Temp\80B9.tmp"C:\Users\Admin\AppData\Local\Temp\80B9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\8174.tmp"C:\Users\Admin\AppData\Local\Temp\8174.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\828E.tmp"C:\Users\Admin\AppData\Local\Temp\828E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\8349.tmp"C:\Users\Admin\AppData\Local\Temp\8349.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\83F5.tmp"C:\Users\Admin\AppData\Local\Temp\83F5.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\84A1.tmp"C:\Users\Admin\AppData\Local\Temp\84A1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Users\Admin\AppData\Local\Temp\853D.tmp"C:\Users\Admin\AppData\Local\Temp\853D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\85D9.tmp"C:\Users\Admin\AppData\Local\Temp\85D9.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\8695.tmp"C:\Users\Admin\AppData\Local\Temp\8695.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\877F.tmp"C:\Users\Admin\AppData\Local\Temp\877F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\88A8.tmp"C:\Users\Admin\AppData\Local\Temp\88A8.tmp"23⤵
- Executes dropped EXE
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\8925.tmp"C:\Users\Admin\AppData\Local\Temp\8925.tmp"24⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\89F0.tmp"C:\Users\Admin\AppData\Local\Temp\89F0.tmp"25⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"26⤵
- Executes dropped EXE
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\8B58.tmp"C:\Users\Admin\AppData\Local\Temp\8B58.tmp"27⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\8C32.tmp"C:\Users\Admin\AppData\Local\Temp\8C32.tmp"28⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"29⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"30⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"31⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"32⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"33⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"34⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\91B1.tmp"C:\Users\Admin\AppData\Local\Temp\91B1.tmp"35⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\924D.tmp"C:\Users\Admin\AppData\Local\Temp\924D.tmp"36⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\92CA.tmp"C:\Users\Admin\AppData\Local\Temp\92CA.tmp"37⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\9337.tmp"C:\Users\Admin\AppData\Local\Temp\9337.tmp"38⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"39⤵
- Executes dropped EXE
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\9451.tmp"C:\Users\Admin\AppData\Local\Temp\9451.tmp"40⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\94BE.tmp"C:\Users\Admin\AppData\Local\Temp\94BE.tmp"41⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"42⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\95F6.tmp"C:\Users\Admin\AppData\Local\Temp\95F6.tmp"43⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\9693.tmp"C:\Users\Admin\AppData\Local\Temp\9693.tmp"44⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\972F.tmp"C:\Users\Admin\AppData\Local\Temp\972F.tmp"45⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"46⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"47⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\98D5.tmp"C:\Users\Admin\AppData\Local\Temp\98D5.tmp"48⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\9942.tmp"C:\Users\Admin\AppData\Local\Temp\9942.tmp"49⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"50⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"51⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"52⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"53⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"54⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"55⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"56⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"57⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"58⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\9E63.tmp"C:\Users\Admin\AppData\Local\Temp\9E63.tmp"59⤵
- Executes dropped EXE
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"60⤵
- Executes dropped EXE
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"61⤵
- Executes dropped EXE
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"62⤵
- Executes dropped EXE
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\A086.tmp"C:\Users\Admin\AppData\Local\Temp\A086.tmp"63⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\A103.tmp"C:\Users\Admin\AppData\Local\Temp\A103.tmp"64⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\A180.tmp"C:\Users\Admin\AppData\Local\Temp\A180.tmp"65⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"66⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"67⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"68⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"69⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"70⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"71⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"72⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"73⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"74⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"75⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"76⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\A817.tmp"C:\Users\Admin\AppData\Local\Temp\A817.tmp"77⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\A894.tmp"C:\Users\Admin\AppData\Local\Temp\A894.tmp"78⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"79⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"80⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"81⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"82⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"83⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\AB92.tmp"C:\Users\Admin\AppData\Local\Temp\AB92.tmp"84⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"85⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"86⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"87⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"88⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"89⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"90⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"91⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\B035.tmp"C:\Users\Admin\AppData\Local\Temp\B035.tmp"92⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"93⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\B12F.tmp"C:\Users\Admin\AppData\Local\Temp\B12F.tmp"94⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"95⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"96⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"97⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"98⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"99⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\B47B.tmp"C:\Users\Admin\AppData\Local\Temp\B47B.tmp"100⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\B517.tmp"C:\Users\Admin\AppData\Local\Temp\B517.tmp"101⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\B594.tmp"C:\Users\Admin\AppData\Local\Temp\B594.tmp"102⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\B621.tmp"C:\Users\Admin\AppData\Local\Temp\B621.tmp"103⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\B68E.tmp"C:\Users\Admin\AppData\Local\Temp\B68E.tmp"104⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\B71B.tmp"C:\Users\Admin\AppData\Local\Temp\B71B.tmp"105⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\B788.tmp"C:\Users\Admin\AppData\Local\Temp\B788.tmp"106⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\B805.tmp"C:\Users\Admin\AppData\Local\Temp\B805.tmp"107⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\B873.tmp"C:\Users\Admin\AppData\Local\Temp\B873.tmp"108⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"109⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\B97C.tmp"C:\Users\Admin\AppData\Local\Temp\B97C.tmp"110⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\BA47.tmp"C:\Users\Admin\AppData\Local\Temp\BA47.tmp"111⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"112⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\BB70.tmp"C:\Users\Admin\AppData\Local\Temp\BB70.tmp"113⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"114⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"115⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\BD26.tmp"C:\Users\Admin\AppData\Local\Temp\BD26.tmp"116⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"117⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\BE10.tmp"C:\Users\Admin\AppData\Local\Temp\BE10.tmp"118⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"119⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\BEEB.tmp"C:\Users\Admin\AppData\Local\Temp\BEEB.tmp"120⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\BF68.tmp"C:\Users\Admin\AppData\Local\Temp\BF68.tmp"121⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"122⤵PID:2252
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-