Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2023, 17:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6347a8861bb49cb076b6e5cbda169f42_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
6347a8861bb49cb076b6e5cbda169f42_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
6347a8861bb49cb076b6e5cbda169f42_mafia_JC.exe
-
Size
520KB
-
MD5
6347a8861bb49cb076b6e5cbda169f42
-
SHA1
89bdba0c4be277db2ad8175d4a15e11d6ba7b7af
-
SHA256
bfa0dfaab789e0333bb520b9e356c3e290157472e298f384475b6c11fee5435e
-
SHA512
3337ca2f0a103790eda3bdf1be83118ed01c03a1c4c8e846b79e367a5b97966dd707f996048757c90bc02bec413d520bd762171205d75becca71b7d961cd04de
-
SSDEEP
12288:roRXOQjmOyjfJKPjeblznbI40iAYO3SUKMrNZ:rogQ9yjRKL+lQN6UKMrN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1940 6F35.tmp 2796 703E.tmp 4772 7109.tmp 2840 71C5.tmp 1352 7261.tmp 464 72EE.tmp 4824 739A.tmp 4440 7426.tmp 3704 74D2.tmp 3132 75AD.tmp 4080 76E5.tmp 3496 7791.tmp 388 786C.tmp 4100 7908.tmp 3564 7A41.tmp 3748 7AED.tmp 4780 7BF6.tmp 1212 7CC1.tmp 828 7DCB.tmp 4452 7EA6.tmp 2404 7F52.tmp 4636 801D.tmp 1560 80A9.tmp 892 8155.tmp 4524 8211.tmp 4740 82BD.tmp 2980 8397.tmp 4308 8462.tmp 3208 852E.tmp 4844 85D9.tmp 4352 86B4.tmp 3420 8750.tmp 4380 881C.tmp 4560 88A8.tmp 4572 8925.tmp 4776 89A2.tmp 4200 8A2F.tmp 2144 8AAC.tmp 3452 8B48.tmp 2600 8BE4.tmp 1908 8C61.tmp 3516 8CDE.tmp 2856 8D6B.tmp 556 8DE8.tmp 548 8E75.tmp 1708 8F20.tmp 2184 8FAD.tmp 3400 902A.tmp 1836 90C6.tmp 1164 9163.tmp 3540 91EF.tmp 3076 928B.tmp 4328 9308.tmp 2796 9395.tmp 3316 9422.tmp 5012 949F.tmp 2832 950C.tmp 628 956A.tmp 4932 9616.tmp 4536 96A2.tmp 1300 972F.tmp 4044 97BC.tmp 1812 9848.tmp 1084 98C5.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3084 wrote to memory of 1940 3084 6347a8861bb49cb076b6e5cbda169f42_mafia_JC.exe 83 PID 3084 wrote to memory of 1940 3084 6347a8861bb49cb076b6e5cbda169f42_mafia_JC.exe 83 PID 3084 wrote to memory of 1940 3084 6347a8861bb49cb076b6e5cbda169f42_mafia_JC.exe 83 PID 1940 wrote to memory of 2796 1940 6F35.tmp 84 PID 1940 wrote to memory of 2796 1940 6F35.tmp 84 PID 1940 wrote to memory of 2796 1940 6F35.tmp 84 PID 2796 wrote to memory of 4772 2796 703E.tmp 85 PID 2796 wrote to memory of 4772 2796 703E.tmp 85 PID 2796 wrote to memory of 4772 2796 703E.tmp 85 PID 4772 wrote to memory of 2840 4772 7109.tmp 86 PID 4772 wrote to memory of 2840 4772 7109.tmp 86 PID 4772 wrote to memory of 2840 4772 7109.tmp 86 PID 2840 wrote to memory of 1352 2840 71C5.tmp 87 PID 2840 wrote to memory of 1352 2840 71C5.tmp 87 PID 2840 wrote to memory of 1352 2840 71C5.tmp 87 PID 1352 wrote to memory of 464 1352 7261.tmp 88 PID 1352 wrote to memory of 464 1352 7261.tmp 88 PID 1352 wrote to memory of 464 1352 7261.tmp 88 PID 464 wrote to memory of 4824 464 72EE.tmp 89 PID 464 wrote to memory of 4824 464 72EE.tmp 89 PID 464 wrote to memory of 4824 464 72EE.tmp 89 PID 4824 wrote to memory of 4440 4824 739A.tmp 91 PID 4824 wrote to memory of 4440 4824 739A.tmp 91 PID 4824 wrote to memory of 4440 4824 739A.tmp 91 PID 4440 wrote to memory of 3704 4440 7426.tmp 92 PID 4440 wrote to memory of 3704 4440 7426.tmp 92 PID 4440 wrote to memory of 3704 4440 7426.tmp 92 PID 3704 wrote to memory of 3132 3704 74D2.tmp 93 PID 3704 wrote to memory of 3132 3704 74D2.tmp 93 PID 3704 wrote to memory of 3132 3704 74D2.tmp 93 PID 3132 wrote to memory of 4080 3132 75AD.tmp 94 PID 3132 wrote to memory of 4080 3132 75AD.tmp 94 PID 3132 wrote to memory of 4080 3132 75AD.tmp 94 PID 4080 wrote to memory of 3496 4080 76E5.tmp 95 PID 4080 wrote to memory of 3496 4080 76E5.tmp 95 PID 4080 wrote to memory of 3496 4080 76E5.tmp 95 PID 3496 wrote to memory of 388 3496 7791.tmp 96 PID 3496 wrote to memory of 388 3496 7791.tmp 96 PID 3496 wrote to memory of 388 3496 7791.tmp 96 PID 388 wrote to memory of 4100 388 786C.tmp 97 PID 388 wrote to memory of 4100 388 786C.tmp 97 PID 388 wrote to memory of 4100 388 786C.tmp 97 PID 4100 wrote to memory of 3564 4100 7908.tmp 98 PID 4100 wrote to memory of 3564 4100 7908.tmp 98 PID 4100 wrote to memory of 3564 4100 7908.tmp 98 PID 3564 wrote to memory of 3748 3564 7A41.tmp 99 PID 3564 wrote to memory of 3748 3564 7A41.tmp 99 PID 3564 wrote to memory of 3748 3564 7A41.tmp 99 PID 3748 wrote to memory of 4780 3748 7AED.tmp 102 PID 3748 wrote to memory of 4780 3748 7AED.tmp 102 PID 3748 wrote to memory of 4780 3748 7AED.tmp 102 PID 4780 wrote to memory of 1212 4780 7BF6.tmp 103 PID 4780 wrote to memory of 1212 4780 7BF6.tmp 103 PID 4780 wrote to memory of 1212 4780 7BF6.tmp 103 PID 1212 wrote to memory of 828 1212 7CC1.tmp 104 PID 1212 wrote to memory of 828 1212 7CC1.tmp 104 PID 1212 wrote to memory of 828 1212 7CC1.tmp 104 PID 828 wrote to memory of 4452 828 7DCB.tmp 105 PID 828 wrote to memory of 4452 828 7DCB.tmp 105 PID 828 wrote to memory of 4452 828 7DCB.tmp 105 PID 4452 wrote to memory of 2404 4452 7EA6.tmp 106 PID 4452 wrote to memory of 2404 4452 7EA6.tmp 106 PID 4452 wrote to memory of 2404 4452 7EA6.tmp 106 PID 2404 wrote to memory of 4636 2404 7F52.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\6347a8861bb49cb076b6e5cbda169f42_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\6347a8861bb49cb076b6e5cbda169f42_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\72EE.tmp"C:\Users\Admin\AppData\Local\Temp\72EE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\7791.tmp"C:\Users\Admin\AppData\Local\Temp\7791.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\786C.tmp"C:\Users\Admin\AppData\Local\Temp\786C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Users\Admin\AppData\Local\Temp\7908.tmp"C:\Users\Admin\AppData\Local\Temp\7908.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\7AED.tmp"C:\Users\Admin\AppData\Local\Temp\7AED.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\7F52.tmp"C:\Users\Admin\AppData\Local\Temp\7F52.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\801D.tmp"C:\Users\Admin\AppData\Local\Temp\801D.tmp"23⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\80A9.tmp"C:\Users\Admin\AppData\Local\Temp\80A9.tmp"24⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\8155.tmp"C:\Users\Admin\AppData\Local\Temp\8155.tmp"25⤵
- Executes dropped EXE
PID:892 -
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"26⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\82BD.tmp"C:\Users\Admin\AppData\Local\Temp\82BD.tmp"27⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"28⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\8462.tmp"C:\Users\Admin\AppData\Local\Temp\8462.tmp"29⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\852E.tmp"C:\Users\Admin\AppData\Local\Temp\852E.tmp"30⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\85D9.tmp"C:\Users\Admin\AppData\Local\Temp\85D9.tmp"31⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"32⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\8750.tmp"C:\Users\Admin\AppData\Local\Temp\8750.tmp"33⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\881C.tmp"C:\Users\Admin\AppData\Local\Temp\881C.tmp"34⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\88A8.tmp"C:\Users\Admin\AppData\Local\Temp\88A8.tmp"35⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\8925.tmp"C:\Users\Admin\AppData\Local\Temp\8925.tmp"36⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\89A2.tmp"C:\Users\Admin\AppData\Local\Temp\89A2.tmp"37⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"38⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"39⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\8B48.tmp"C:\Users\Admin\AppData\Local\Temp\8B48.tmp"40⤵
- Executes dropped EXE
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"41⤵
- Executes dropped EXE
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\8C61.tmp"C:\Users\Admin\AppData\Local\Temp\8C61.tmp"42⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"43⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"44⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"45⤵
- Executes dropped EXE
PID:556 -
C:\Users\Admin\AppData\Local\Temp\8E75.tmp"C:\Users\Admin\AppData\Local\Temp\8E75.tmp"46⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\8F20.tmp"C:\Users\Admin\AppData\Local\Temp\8F20.tmp"47⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"48⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\902A.tmp"C:\Users\Admin\AppData\Local\Temp\902A.tmp"49⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"50⤵
- Executes dropped EXE
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\9163.tmp"C:\Users\Admin\AppData\Local\Temp\9163.tmp"51⤵
- Executes dropped EXE
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\91EF.tmp"C:\Users\Admin\AppData\Local\Temp\91EF.tmp"52⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"53⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\9308.tmp"C:\Users\Admin\AppData\Local\Temp\9308.tmp"54⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\9395.tmp"C:\Users\Admin\AppData\Local\Temp\9395.tmp"55⤵
- Executes dropped EXE
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\9422.tmp"C:\Users\Admin\AppData\Local\Temp\9422.tmp"56⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"57⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\950C.tmp"C:\Users\Admin\AppData\Local\Temp\950C.tmp"58⤵
- Executes dropped EXE
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\956A.tmp"C:\Users\Admin\AppData\Local\Temp\956A.tmp"59⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"60⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"61⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\972F.tmp"C:\Users\Admin\AppData\Local\Temp\972F.tmp"62⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\97BC.tmp"C:\Users\Admin\AppData\Local\Temp\97BC.tmp"63⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\9848.tmp"C:\Users\Admin\AppData\Local\Temp\9848.tmp"64⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\98C5.tmp"C:\Users\Admin\AppData\Local\Temp\98C5.tmp"65⤵
- Executes dropped EXE
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"66⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"67⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"68⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"69⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"70⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"71⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\9C21.tmp"C:\Users\Admin\AppData\Local\Temp\9C21.tmp"72⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"73⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"74⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"75⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\9E63.tmp"C:\Users\Admin\AppData\Local\Temp\9E63.tmp"76⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"77⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"78⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"79⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\A066.tmp"C:\Users\Admin\AppData\Local\Temp\A066.tmp"80⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"81⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\A18F.tmp"C:\Users\Admin\AppData\Local\Temp\A18F.tmp"82⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"83⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"84⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"85⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\A374.tmp"C:\Users\Admin\AppData\Local\Temp\A374.tmp"86⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"87⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"88⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"89⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"90⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"91⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"92⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"93⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"94⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"95⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"96⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"97⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"98⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"99⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"100⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"101⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"102⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"103⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"104⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\AD66.tmp"C:\Users\Admin\AppData\Local\Temp\AD66.tmp"105⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"106⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\AE60.tmp"C:\Users\Admin\AppData\Local\Temp\AE60.tmp"107⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"108⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"109⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\B016.tmp"C:\Users\Admin\AppData\Local\Temp\B016.tmp"110⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"111⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\B14E.tmp"C:\Users\Admin\AppData\Local\Temp\B14E.tmp"112⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"113⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\B277.tmp"C:\Users\Admin\AppData\Local\Temp\B277.tmp"114⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"115⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\B381.tmp"C:\Users\Admin\AppData\Local\Temp\B381.tmp"116⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\B42D.tmp"C:\Users\Admin\AppData\Local\Temp\B42D.tmp"117⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\B49A.tmp"C:\Users\Admin\AppData\Local\Temp\B49A.tmp"118⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\B517.tmp"C:\Users\Admin\AppData\Local\Temp\B517.tmp"119⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"120⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\B640.tmp"C:\Users\Admin\AppData\Local\Temp\B640.tmp"121⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"122⤵PID:3132
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-