Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
16/08/2023, 17:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0a0af86a0f03cc8cdbcc233805112eff_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
0a0af86a0f03cc8cdbcc233805112eff_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
0a0af86a0f03cc8cdbcc233805112eff_mafia_JC.exe
-
Size
486KB
-
MD5
0a0af86a0f03cc8cdbcc233805112eff
-
SHA1
99642c305b33a1e1ae015b046d99f22084393667
-
SHA256
0753d446e76dc21361484d9d6fe4a001534c96a414dfb55b90cfa5f2a10c0096
-
SHA512
5402918e497797c7e20be8d83281f81383e2027f2e490477adff782b871a6b9c1e69addbd63f5097cdc423a7133d3260a82752225593c72bce315acffc56c6ed
-
SSDEEP
12288:UU5rCOTeiDjZ5j7hOW94uqezr++QjdNZ:UUQOJDjZlquH+N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4052 631F.tmp 1864 63FA.tmp 212 64E4.tmp 4252 65BF.tmp 1972 667A.tmp 4700 6707.tmp 3136 67C2.tmp 3980 684F.tmp 5092 6959.tmp 4208 6A33.tmp 3700 6AC0.tmp 780 6B6C.tmp 5052 6C47.tmp 1296 6D6F.tmp 3752 6E69.tmp 2392 6F06.tmp 1876 6FC1.tmp 2232 706D.tmp 3540 7109.tmp 4384 71E4.tmp 1416 72CE.tmp 2828 736B.tmp 5100 7465.tmp 4588 7511.tmp 4232 75EB.tmp 3196 76C6.tmp 4296 7782.tmp 3580 780E.tmp 4980 78BA.tmp 2420 7985.tmp 3396 7A31.tmp 2228 7ADD.tmp 1964 7C15.tmp 1764 7CC1.tmp 5088 7DCB.tmp 2212 7E58.tmp 5080 7EF4.tmp 1352 7F71.tmp 4064 7FDE.tmp 3704 807A.tmp 2548 8126.tmp 4124 81B3.tmp 3720 824F.tmp 1448 82DC.tmp 3160 8368.tmp 2316 8405.tmp 116 84A1.tmp 64 853D.tmp 3784 85D9.tmp 1120 8676.tmp 3904 8722.tmp 2184 87AE.tmp 4120 882B.tmp 4132 88C7.tmp 1408 8964.tmp 3380 89E1.tmp 3836 8A6D.tmp 212 8B0A.tmp 3284 8B96.tmp 1464 8C13.tmp 2868 8CA0.tmp 3000 8D2C.tmp 3276 8DA9.tmp 4684 8E36.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3288 wrote to memory of 4052 3288 0a0af86a0f03cc8cdbcc233805112eff_mafia_JC.exe 82 PID 3288 wrote to memory of 4052 3288 0a0af86a0f03cc8cdbcc233805112eff_mafia_JC.exe 82 PID 3288 wrote to memory of 4052 3288 0a0af86a0f03cc8cdbcc233805112eff_mafia_JC.exe 82 PID 4052 wrote to memory of 1864 4052 631F.tmp 83 PID 4052 wrote to memory of 1864 4052 631F.tmp 83 PID 4052 wrote to memory of 1864 4052 631F.tmp 83 PID 1864 wrote to memory of 212 1864 63FA.tmp 84 PID 1864 wrote to memory of 212 1864 63FA.tmp 84 PID 1864 wrote to memory of 212 1864 63FA.tmp 84 PID 212 wrote to memory of 4252 212 64E4.tmp 85 PID 212 wrote to memory of 4252 212 64E4.tmp 85 PID 212 wrote to memory of 4252 212 64E4.tmp 85 PID 4252 wrote to memory of 1972 4252 65BF.tmp 86 PID 4252 wrote to memory of 1972 4252 65BF.tmp 86 PID 4252 wrote to memory of 1972 4252 65BF.tmp 86 PID 1972 wrote to memory of 4700 1972 667A.tmp 87 PID 1972 wrote to memory of 4700 1972 667A.tmp 87 PID 1972 wrote to memory of 4700 1972 667A.tmp 87 PID 4700 wrote to memory of 3136 4700 6707.tmp 88 PID 4700 wrote to memory of 3136 4700 6707.tmp 88 PID 4700 wrote to memory of 3136 4700 6707.tmp 88 PID 3136 wrote to memory of 3980 3136 67C2.tmp 89 PID 3136 wrote to memory of 3980 3136 67C2.tmp 89 PID 3136 wrote to memory of 3980 3136 67C2.tmp 89 PID 3980 wrote to memory of 5092 3980 684F.tmp 90 PID 3980 wrote to memory of 5092 3980 684F.tmp 90 PID 3980 wrote to memory of 5092 3980 684F.tmp 90 PID 5092 wrote to memory of 4208 5092 6959.tmp 91 PID 5092 wrote to memory of 4208 5092 6959.tmp 91 PID 5092 wrote to memory of 4208 5092 6959.tmp 91 PID 4208 wrote to memory of 3700 4208 6A33.tmp 92 PID 4208 wrote to memory of 3700 4208 6A33.tmp 92 PID 4208 wrote to memory of 3700 4208 6A33.tmp 92 PID 3700 wrote to memory of 780 3700 6AC0.tmp 93 PID 3700 wrote to memory of 780 3700 6AC0.tmp 93 PID 3700 wrote to memory of 780 3700 6AC0.tmp 93 PID 780 wrote to memory of 5052 780 6B6C.tmp 94 PID 780 wrote to memory of 5052 780 6B6C.tmp 94 PID 780 wrote to memory of 5052 780 6B6C.tmp 94 PID 5052 wrote to memory of 1296 5052 6C47.tmp 95 PID 5052 wrote to memory of 1296 5052 6C47.tmp 95 PID 5052 wrote to memory of 1296 5052 6C47.tmp 95 PID 1296 wrote to memory of 3752 1296 6D6F.tmp 96 PID 1296 wrote to memory of 3752 1296 6D6F.tmp 96 PID 1296 wrote to memory of 3752 1296 6D6F.tmp 96 PID 3752 wrote to memory of 2392 3752 6E69.tmp 97 PID 3752 wrote to memory of 2392 3752 6E69.tmp 97 PID 3752 wrote to memory of 2392 3752 6E69.tmp 97 PID 2392 wrote to memory of 1876 2392 6F06.tmp 98 PID 2392 wrote to memory of 1876 2392 6F06.tmp 98 PID 2392 wrote to memory of 1876 2392 6F06.tmp 98 PID 1876 wrote to memory of 2232 1876 6FC1.tmp 99 PID 1876 wrote to memory of 2232 1876 6FC1.tmp 99 PID 1876 wrote to memory of 2232 1876 6FC1.tmp 99 PID 2232 wrote to memory of 3540 2232 706D.tmp 100 PID 2232 wrote to memory of 3540 2232 706D.tmp 100 PID 2232 wrote to memory of 3540 2232 706D.tmp 100 PID 3540 wrote to memory of 4384 3540 7109.tmp 103 PID 3540 wrote to memory of 4384 3540 7109.tmp 103 PID 3540 wrote to memory of 4384 3540 7109.tmp 103 PID 4384 wrote to memory of 1416 4384 71E4.tmp 104 PID 4384 wrote to memory of 1416 4384 71E4.tmp 104 PID 4384 wrote to memory of 1416 4384 71E4.tmp 104 PID 1416 wrote to memory of 2828 1416 72CE.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a0af86a0f03cc8cdbcc233805112eff_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\0a0af86a0f03cc8cdbcc233805112eff_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"23⤵
- Executes dropped EXE
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"24⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"25⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"26⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"27⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"28⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\780E.tmp"C:\Users\Admin\AppData\Local\Temp\780E.tmp"29⤵
- Executes dropped EXE
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\78BA.tmp"C:\Users\Admin\AppData\Local\Temp\78BA.tmp"30⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"31⤵
- Executes dropped EXE
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"32⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"33⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\7C15.tmp"C:\Users\Admin\AppData\Local\Temp\7C15.tmp"34⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"35⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"36⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"37⤵
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"38⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\7F71.tmp"C:\Users\Admin\AppData\Local\Temp\7F71.tmp"39⤵
- Executes dropped EXE
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"40⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\807A.tmp"C:\Users\Admin\AppData\Local\Temp\807A.tmp"41⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\8126.tmp"C:\Users\Admin\AppData\Local\Temp\8126.tmp"42⤵
- Executes dropped EXE
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\81B3.tmp"C:\Users\Admin\AppData\Local\Temp\81B3.tmp"43⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\824F.tmp"C:\Users\Admin\AppData\Local\Temp\824F.tmp"44⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\82DC.tmp"C:\Users\Admin\AppData\Local\Temp\82DC.tmp"45⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\8368.tmp"C:\Users\Admin\AppData\Local\Temp\8368.tmp"46⤵
- Executes dropped EXE
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\8405.tmp"C:\Users\Admin\AppData\Local\Temp\8405.tmp"47⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\84A1.tmp"C:\Users\Admin\AppData\Local\Temp\84A1.tmp"48⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\853D.tmp"C:\Users\Admin\AppData\Local\Temp\853D.tmp"49⤵
- Executes dropped EXE
PID:64 -
C:\Users\Admin\AppData\Local\Temp\85D9.tmp"C:\Users\Admin\AppData\Local\Temp\85D9.tmp"50⤵
- Executes dropped EXE
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\8676.tmp"C:\Users\Admin\AppData\Local\Temp\8676.tmp"51⤵
- Executes dropped EXE
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\8722.tmp"C:\Users\Admin\AppData\Local\Temp\8722.tmp"52⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\87AE.tmp"C:\Users\Admin\AppData\Local\Temp\87AE.tmp"53⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\882B.tmp"C:\Users\Admin\AppData\Local\Temp\882B.tmp"54⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\88C7.tmp"C:\Users\Admin\AppData\Local\Temp\88C7.tmp"55⤵
- Executes dropped EXE
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\8964.tmp"C:\Users\Admin\AppData\Local\Temp\8964.tmp"56⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\89E1.tmp"C:\Users\Admin\AppData\Local\Temp\89E1.tmp"57⤵
- Executes dropped EXE
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"58⤵
- Executes dropped EXE
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"59⤵
- Executes dropped EXE
PID:212 -
C:\Users\Admin\AppData\Local\Temp\8B96.tmp"C:\Users\Admin\AppData\Local\Temp\8B96.tmp"60⤵
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\8C13.tmp"C:\Users\Admin\AppData\Local\Temp\8C13.tmp"61⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"62⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"63⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"64⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp"65⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"66⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"67⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"68⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\901A.tmp"C:\Users\Admin\AppData\Local\Temp\901A.tmp"69⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\9097.tmp"C:\Users\Admin\AppData\Local\Temp\9097.tmp"70⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"71⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\91B1.tmp"C:\Users\Admin\AppData\Local\Temp\91B1.tmp"72⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\921E.tmp"C:\Users\Admin\AppData\Local\Temp\921E.tmp"73⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"74⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"75⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\9402.tmp"C:\Users\Admin\AppData\Local\Temp\9402.tmp"76⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"77⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"78⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"79⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"80⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"81⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\96F0.tmp"C:\Users\Admin\AppData\Local\Temp\96F0.tmp"82⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"83⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"84⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\98C5.tmp"C:\Users\Admin\AppData\Local\Temp\98C5.tmp"85⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"86⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"87⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"88⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"89⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"90⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"91⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"92⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"93⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"94⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\9E15.tmp"C:\Users\Admin\AppData\Local\Temp\9E15.tmp"95⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"96⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"97⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"98⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\A076.tmp"C:\Users\Admin\AppData\Local\Temp\A076.tmp"99⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\A103.tmp"C:\Users\Admin\AppData\Local\Temp\A103.tmp"100⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"101⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\A21C.tmp"C:\Users\Admin\AppData\Local\Temp\A21C.tmp"102⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"103⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\A364.tmp"C:\Users\Admin\AppData\Local\Temp\A364.tmp"104⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"105⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\A46E.tmp"C:\Users\Admin\AppData\Local\Temp\A46E.tmp"106⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"107⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"108⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"109⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"110⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"111⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"112⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\A827.tmp"C:\Users\Admin\AppData\Local\Temp\A827.tmp"113⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"114⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"115⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"116⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"117⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"118⤵PID:492
-
C:\Users\Admin\AppData\Local\Temp\AB53.tmp"C:\Users\Admin\AppData\Local\Temp\AB53.tmp"119⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"120⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"121⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"122⤵PID:3260
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-