Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
22/08/2023, 16:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6a19f724f9c48826314cf6cecdeeb887_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
6a19f724f9c48826314cf6cecdeeb887_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
6a19f724f9c48826314cf6cecdeeb887_mafia_JC.exe
-
Size
520KB
-
MD5
6a19f724f9c48826314cf6cecdeeb887
-
SHA1
57e45d1a8594242ef4cd7652c35d78bab89dc1c7
-
SHA256
5a3906037104a41665df43552362a69ac4b16c4576b480b9ba6c4d9f8a21cc06
-
SHA512
8ee004c50615b9f5ea77eaf23c48e1fdbdec84b8c82a7f7ea1ddfda3ae9806cfdce59f7633673be007baf5d41a709f9a9440655b9ab3bd51cb30be32de73cd6b
-
SSDEEP
12288:gj8fuxR21t5i8fP1ZLRcAl2l9VmMWMBaeAgql9Fu7TNZ:gj8fuK1GYP1Z/2lpWMBNAFuPN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 112 8BD5.tmp 3680 8C71.tmp 5048 8D2C.tmp 3880 8DD8.tmp 1388 8E84.tmp 224 8F8E.tmp 3720 9049.tmp 4656 90E6.tmp 3064 91A1.tmp 4256 923D.tmp 1452 92E9.tmp 688 93A5.tmp 1852 952B.tmp 2704 9606.tmp 376 96B2.tmp 4700 977D.tmp 2020 9829.tmp 3824 9913.tmp 2016 99BF.tmp 3288 9A5B.tmp 3692 9AD8.tmp 872 9B84.tmp 5024 9C5F.tmp 4620 9CFB.tmp 4960 9D88.tmp 2464 9E15.tmp 3528 9EC0.tmp 3324 9F4D.tmp 2520 9FDA.tmp 1456 A095.tmp 3936 A131.tmp 3360 A1ED.tmp 3812 A2B8.tmp 628 A345.tmp 3564 A3E1.tmp 2324 A48D.tmp 1920 A519.tmp 2024 A596.tmp 452 A642.tmp 4272 A6CF.tmp 2852 A74C.tmp 4644 A7B9.tmp 4136 A856.tmp 4956 A8E2.tmp 2296 A98E.tmp 1152 AA2A.tmp 3372 AAB7.tmp 4280 ABEF.tmp 5056 AC7C.tmp 2468 AD28.tmp 3628 ADA5.tmp 1668 AE03.tmp 4132 AE9F.tmp 3684 AF1C.tmp 3640 AFA9.tmp 3088 B026.tmp 1032 B0B2.tmp 3180 B13F.tmp 4596 B1EB.tmp 1608 B277.tmp 392 B2F4.tmp 1596 B362.tmp 1716 B3BF.tmp 4840 B41D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2416 wrote to memory of 112 2416 6a19f724f9c48826314cf6cecdeeb887_mafia_JC.exe 81 PID 2416 wrote to memory of 112 2416 6a19f724f9c48826314cf6cecdeeb887_mafia_JC.exe 81 PID 2416 wrote to memory of 112 2416 6a19f724f9c48826314cf6cecdeeb887_mafia_JC.exe 81 PID 112 wrote to memory of 3680 112 8BD5.tmp 82 PID 112 wrote to memory of 3680 112 8BD5.tmp 82 PID 112 wrote to memory of 3680 112 8BD5.tmp 82 PID 3680 wrote to memory of 5048 3680 8C71.tmp 83 PID 3680 wrote to memory of 5048 3680 8C71.tmp 83 PID 3680 wrote to memory of 5048 3680 8C71.tmp 83 PID 5048 wrote to memory of 3880 5048 8D2C.tmp 84 PID 5048 wrote to memory of 3880 5048 8D2C.tmp 84 PID 5048 wrote to memory of 3880 5048 8D2C.tmp 84 PID 3880 wrote to memory of 1388 3880 8DD8.tmp 85 PID 3880 wrote to memory of 1388 3880 8DD8.tmp 85 PID 3880 wrote to memory of 1388 3880 8DD8.tmp 85 PID 1388 wrote to memory of 224 1388 8E84.tmp 86 PID 1388 wrote to memory of 224 1388 8E84.tmp 86 PID 1388 wrote to memory of 224 1388 8E84.tmp 86 PID 224 wrote to memory of 3720 224 8F8E.tmp 87 PID 224 wrote to memory of 3720 224 8F8E.tmp 87 PID 224 wrote to memory of 3720 224 8F8E.tmp 87 PID 3720 wrote to memory of 4656 3720 9049.tmp 88 PID 3720 wrote to memory of 4656 3720 9049.tmp 88 PID 3720 wrote to memory of 4656 3720 9049.tmp 88 PID 4656 wrote to memory of 3064 4656 90E6.tmp 89 PID 4656 wrote to memory of 3064 4656 90E6.tmp 89 PID 4656 wrote to memory of 3064 4656 90E6.tmp 89 PID 3064 wrote to memory of 4256 3064 91A1.tmp 90 PID 3064 wrote to memory of 4256 3064 91A1.tmp 90 PID 3064 wrote to memory of 4256 3064 91A1.tmp 90 PID 4256 wrote to memory of 1452 4256 923D.tmp 91 PID 4256 wrote to memory of 1452 4256 923D.tmp 91 PID 4256 wrote to memory of 1452 4256 923D.tmp 91 PID 1452 wrote to memory of 688 1452 92E9.tmp 92 PID 1452 wrote to memory of 688 1452 92E9.tmp 92 PID 1452 wrote to memory of 688 1452 92E9.tmp 92 PID 688 wrote to memory of 1852 688 93A5.tmp 93 PID 688 wrote to memory of 1852 688 93A5.tmp 93 PID 688 wrote to memory of 1852 688 93A5.tmp 93 PID 1852 wrote to memory of 2704 1852 952B.tmp 94 PID 1852 wrote to memory of 2704 1852 952B.tmp 94 PID 1852 wrote to memory of 2704 1852 952B.tmp 94 PID 2704 wrote to memory of 376 2704 9606.tmp 97 PID 2704 wrote to memory of 376 2704 9606.tmp 97 PID 2704 wrote to memory of 376 2704 9606.tmp 97 PID 376 wrote to memory of 4700 376 96B2.tmp 98 PID 376 wrote to memory of 4700 376 96B2.tmp 98 PID 376 wrote to memory of 4700 376 96B2.tmp 98 PID 4700 wrote to memory of 2020 4700 977D.tmp 99 PID 4700 wrote to memory of 2020 4700 977D.tmp 99 PID 4700 wrote to memory of 2020 4700 977D.tmp 99 PID 2020 wrote to memory of 3824 2020 9829.tmp 100 PID 2020 wrote to memory of 3824 2020 9829.tmp 100 PID 2020 wrote to memory of 3824 2020 9829.tmp 100 PID 3824 wrote to memory of 2016 3824 9913.tmp 101 PID 3824 wrote to memory of 2016 3824 9913.tmp 101 PID 3824 wrote to memory of 2016 3824 9913.tmp 101 PID 2016 wrote to memory of 3288 2016 99BF.tmp 102 PID 2016 wrote to memory of 3288 2016 99BF.tmp 102 PID 2016 wrote to memory of 3288 2016 99BF.tmp 102 PID 3288 wrote to memory of 3692 3288 9A5B.tmp 103 PID 3288 wrote to memory of 3692 3288 9A5B.tmp 103 PID 3288 wrote to memory of 3692 3288 9A5B.tmp 103 PID 3692 wrote to memory of 872 3692 9AD8.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a19f724f9c48826314cf6cecdeeb887_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\6a19f724f9c48826314cf6cecdeeb887_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Users\Admin\AppData\Local\Temp\8C71.tmp"C:\Users\Admin\AppData\Local\Temp\8C71.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\8E84.tmp"C:\Users\Admin\AppData\Local\Temp\8E84.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\9049.tmp"C:\Users\Admin\AppData\Local\Temp\9049.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\90E6.tmp"C:\Users\Admin\AppData\Local\Temp\90E6.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\923D.tmp"C:\Users\Admin\AppData\Local\Temp\923D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\93A5.tmp"C:\Users\Admin\AppData\Local\Temp\93A5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\9606.tmp"C:\Users\Admin\AppData\Local\Temp\9606.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\96B2.tmp"C:\Users\Admin\AppData\Local\Temp\96B2.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Users\Admin\AppData\Local\Temp\977D.tmp"C:\Users\Admin\AppData\Local\Temp\977D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\99BF.tmp"C:\Users\Admin\AppData\Local\Temp\99BF.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"23⤵
- Executes dropped EXE
PID:872 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"24⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"25⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"26⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\9E15.tmp"C:\Users\Admin\AppData\Local\Temp\9E15.tmp"27⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"28⤵
- Executes dropped EXE
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"29⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"30⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\A095.tmp"C:\Users\Admin\AppData\Local\Temp\A095.tmp"31⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"32⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"33⤵
- Executes dropped EXE
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"34⤵
- Executes dropped EXE
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"35⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"36⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"37⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\A519.tmp"C:\Users\Admin\AppData\Local\Temp\A519.tmp"38⤵
- Executes dropped EXE
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"39⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\A642.tmp"C:\Users\Admin\AppData\Local\Temp\A642.tmp"40⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"41⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\A74C.tmp"C:\Users\Admin\AppData\Local\Temp\A74C.tmp"42⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"43⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\A856.tmp"C:\Users\Admin\AppData\Local\Temp\A856.tmp"44⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"45⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"46⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"47⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"48⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"49⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"50⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"51⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"52⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"53⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"54⤵
- Executes dropped EXE
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"55⤵
- Executes dropped EXE
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"56⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"57⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"58⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"59⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"60⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"61⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\B277.tmp"C:\Users\Admin\AppData\Local\Temp\B277.tmp"62⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"63⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\B362.tmp"C:\Users\Admin\AppData\Local\Temp\B362.tmp"64⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"65⤵
- Executes dropped EXE
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\B41D.tmp"C:\Users\Admin\AppData\Local\Temp\B41D.tmp"66⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\B48B.tmp"C:\Users\Admin\AppData\Local\Temp\B48B.tmp"67⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"68⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\B585.tmp"C:\Users\Admin\AppData\Local\Temp\B585.tmp"69⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\B602.tmp"C:\Users\Admin\AppData\Local\Temp\B602.tmp"70⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\B68E.tmp"C:\Users\Admin\AppData\Local\Temp\B68E.tmp"71⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\B70B.tmp"C:\Users\Admin\AppData\Local\Temp\B70B.tmp"72⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"73⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\B844.tmp"C:\Users\Admin\AppData\Local\Temp\B844.tmp"74⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"75⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\B91E.tmp"C:\Users\Admin\AppData\Local\Temp\B91E.tmp"76⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\B97C.tmp"C:\Users\Admin\AppData\Local\Temp\B97C.tmp"77⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"78⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\BA86.tmp"C:\Users\Admin\AppData\Local\Temp\BA86.tmp"79⤵PID:100
-
C:\Users\Admin\AppData\Local\Temp\BB03.tmp"C:\Users\Admin\AppData\Local\Temp\BB03.tmp"80⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"81⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"82⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"83⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\BD06.tmp"C:\Users\Admin\AppData\Local\Temp\BD06.tmp"84⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\BD93.tmp"C:\Users\Admin\AppData\Local\Temp\BD93.tmp"85⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\BE10.tmp"C:\Users\Admin\AppData\Local\Temp\BE10.tmp"86⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"87⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\BF39.tmp"C:\Users\Admin\AppData\Local\Temp\BF39.tmp"88⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"89⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\C014.tmp"C:\Users\Admin\AppData\Local\Temp\C014.tmp"90⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\C071.tmp"C:\Users\Admin\AppData\Local\Temp\C071.tmp"91⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"92⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"93⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"94⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"95⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\C302.tmp"C:\Users\Admin\AppData\Local\Temp\C302.tmp"96⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\C39E.tmp"C:\Users\Admin\AppData\Local\Temp\C39E.tmp"97⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\C41B.tmp"C:\Users\Admin\AppData\Local\Temp\C41B.tmp"98⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"99⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\C534.tmp"C:\Users\Admin\AppData\Local\Temp\C534.tmp"100⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"101⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\C62E.tmp"C:\Users\Admin\AppData\Local\Temp\C62E.tmp"102⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"103⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\C747.tmp"C:\Users\Admin\AppData\Local\Temp\C747.tmp"104⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"105⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\C861.tmp"C:\Users\Admin\AppData\Local\Temp\C861.tmp"106⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"107⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\C97A.tmp"C:\Users\Admin\AppData\Local\Temp\C97A.tmp"108⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"109⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\CA93.tmp"C:\Users\Admin\AppData\Local\Temp\CA93.tmp"110⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\CB10.tmp"C:\Users\Admin\AppData\Local\Temp\CB10.tmp"111⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"112⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\CC0A.tmp"C:\Users\Admin\AppData\Local\Temp\CC0A.tmp"113⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\CC97.tmp"C:\Users\Admin\AppData\Local\Temp\CC97.tmp"114⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\CD33.tmp"C:\Users\Admin\AppData\Local\Temp\CD33.tmp"115⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"116⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"117⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"118⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\CF46.tmp"C:\Users\Admin\AppData\Local\Temp\CF46.tmp"119⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"120⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\D060.tmp"C:\Users\Admin\AppData\Local\Temp\D060.tmp"121⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"122⤵PID:4384
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-