Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2023, 18:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7ec8ae11ec4511ce526024d4af2e8e11_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
7ec8ae11ec4511ce526024d4af2e8e11_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
7ec8ae11ec4511ce526024d4af2e8e11_mafia_JC.exe
-
Size
520KB
-
MD5
7ec8ae11ec4511ce526024d4af2e8e11
-
SHA1
1cd1531949c1e742ba1dacbc12af552d0a5591b2
-
SHA256
5273dff596eface789eb307df10a7d9d5b88daddd42e7157b99c843cc156ac30
-
SHA512
cefab372cd55fa547a5b22dab0a22e74aec70eb0b0f7f6c06566582ef128f8c80c947b9d048a6c1f674468c2945255421ea50c85486c2f9854490d6e9912f9c9
-
SSDEEP
6144:ufj/rtv3Yp26PvSQXJsi3U+pvVr/nUEgxxRIjbRlo78znED21QSEJSh2nCI2sH3j:0q5XOi3U+BBUzbRIBOYE4QSEJShg7NZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2988 7B1B.tmp 1432 7BC7.tmp 1376 7CC1.tmp 4156 7DEA.tmp 3332 7EB5.tmp 5092 7F71.tmp 4988 804C.tmp 1740 80E8.tmp 5000 81A3.tmp 924 824F.tmp 2172 831A.tmp 2644 8397.tmp 3384 8453.tmp 4504 859B.tmp 4496 8637.tmp 4060 8702.tmp 2628 878F.tmp 4644 883B.tmp 4976 88F6.tmp 1264 89E1.tmp 3508 8A6D.tmp 3492 8B0A.tmp 4764 8BA6.tmp 4508 8C23.tmp 2688 8CA0.tmp 4320 8D2C.tmp 2148 8DC9.tmp 2248 8E75.tmp 1236 8F11.tmp 2460 8F9D.tmp 2112 9078.tmp 4872 9153.tmp 3120 91EF.tmp 4424 926C.tmp 4964 92DA.tmp 2136 9357.tmp 3756 93E3.tmp 2796 948F.tmp 1456 952B.tmp 4244 95C8.tmp 2360 9664.tmp 4388 96F0.tmp 4416 977D.tmp 992 980A.tmp 1352 98A6.tmp 4112 9913.tmp 5044 99A0.tmp 3328 9A1D.tmp 2140 9AAA.tmp 1444 9B17.tmp 4636 9BC3.tmp 4348 9C4F.tmp 2208 9CDC.tmp 2384 9D78.tmp 2480 9E05.tmp 1376 9E72.tmp 1512 9EEF.tmp 1564 9F6C.tmp 968 9FE9.tmp 5092 A076.tmp 432 A0E3.tmp 624 A151.tmp 4736 A1ED.tmp 1008 A25A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4880 wrote to memory of 2988 4880 7ec8ae11ec4511ce526024d4af2e8e11_mafia_JC.exe 81 PID 4880 wrote to memory of 2988 4880 7ec8ae11ec4511ce526024d4af2e8e11_mafia_JC.exe 81 PID 4880 wrote to memory of 2988 4880 7ec8ae11ec4511ce526024d4af2e8e11_mafia_JC.exe 81 PID 2988 wrote to memory of 1432 2988 7B1B.tmp 82 PID 2988 wrote to memory of 1432 2988 7B1B.tmp 82 PID 2988 wrote to memory of 1432 2988 7B1B.tmp 82 PID 1432 wrote to memory of 1376 1432 7BC7.tmp 83 PID 1432 wrote to memory of 1376 1432 7BC7.tmp 83 PID 1432 wrote to memory of 1376 1432 7BC7.tmp 83 PID 1376 wrote to memory of 4156 1376 7CC1.tmp 84 PID 1376 wrote to memory of 4156 1376 7CC1.tmp 84 PID 1376 wrote to memory of 4156 1376 7CC1.tmp 84 PID 4156 wrote to memory of 3332 4156 7DEA.tmp 85 PID 4156 wrote to memory of 3332 4156 7DEA.tmp 85 PID 4156 wrote to memory of 3332 4156 7DEA.tmp 85 PID 3332 wrote to memory of 5092 3332 7EB5.tmp 86 PID 3332 wrote to memory of 5092 3332 7EB5.tmp 86 PID 3332 wrote to memory of 5092 3332 7EB5.tmp 86 PID 5092 wrote to memory of 4988 5092 7F71.tmp 87 PID 5092 wrote to memory of 4988 5092 7F71.tmp 87 PID 5092 wrote to memory of 4988 5092 7F71.tmp 87 PID 4988 wrote to memory of 1740 4988 804C.tmp 88 PID 4988 wrote to memory of 1740 4988 804C.tmp 88 PID 4988 wrote to memory of 1740 4988 804C.tmp 88 PID 1740 wrote to memory of 5000 1740 80E8.tmp 89 PID 1740 wrote to memory of 5000 1740 80E8.tmp 89 PID 1740 wrote to memory of 5000 1740 80E8.tmp 89 PID 5000 wrote to memory of 924 5000 81A3.tmp 90 PID 5000 wrote to memory of 924 5000 81A3.tmp 90 PID 5000 wrote to memory of 924 5000 81A3.tmp 90 PID 924 wrote to memory of 2172 924 824F.tmp 91 PID 924 wrote to memory of 2172 924 824F.tmp 91 PID 924 wrote to memory of 2172 924 824F.tmp 91 PID 2172 wrote to memory of 2644 2172 831A.tmp 92 PID 2172 wrote to memory of 2644 2172 831A.tmp 92 PID 2172 wrote to memory of 2644 2172 831A.tmp 92 PID 2644 wrote to memory of 3384 2644 8397.tmp 93 PID 2644 wrote to memory of 3384 2644 8397.tmp 93 PID 2644 wrote to memory of 3384 2644 8397.tmp 93 PID 3384 wrote to memory of 4504 3384 8453.tmp 94 PID 3384 wrote to memory of 4504 3384 8453.tmp 94 PID 3384 wrote to memory of 4504 3384 8453.tmp 94 PID 4504 wrote to memory of 4496 4504 859B.tmp 97 PID 4504 wrote to memory of 4496 4504 859B.tmp 97 PID 4504 wrote to memory of 4496 4504 859B.tmp 97 PID 4496 wrote to memory of 4060 4496 8637.tmp 98 PID 4496 wrote to memory of 4060 4496 8637.tmp 98 PID 4496 wrote to memory of 4060 4496 8637.tmp 98 PID 4060 wrote to memory of 2628 4060 8702.tmp 99 PID 4060 wrote to memory of 2628 4060 8702.tmp 99 PID 4060 wrote to memory of 2628 4060 8702.tmp 99 PID 2628 wrote to memory of 4644 2628 878F.tmp 100 PID 2628 wrote to memory of 4644 2628 878F.tmp 100 PID 2628 wrote to memory of 4644 2628 878F.tmp 100 PID 4644 wrote to memory of 4976 4644 883B.tmp 101 PID 4644 wrote to memory of 4976 4644 883B.tmp 101 PID 4644 wrote to memory of 4976 4644 883B.tmp 101 PID 4976 wrote to memory of 1264 4976 88F6.tmp 102 PID 4976 wrote to memory of 1264 4976 88F6.tmp 102 PID 4976 wrote to memory of 1264 4976 88F6.tmp 102 PID 1264 wrote to memory of 3508 1264 89E1.tmp 103 PID 1264 wrote to memory of 3508 1264 89E1.tmp 103 PID 1264 wrote to memory of 3508 1264 89E1.tmp 103 PID 3508 wrote to memory of 3492 3508 8A6D.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ec8ae11ec4511ce526024d4af2e8e11_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\7ec8ae11ec4511ce526024d4af2e8e11_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\7F71.tmp"C:\Users\Admin\AppData\Local\Temp\7F71.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\804C.tmp"C:\Users\Admin\AppData\Local\Temp\804C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\80E8.tmp"C:\Users\Admin\AppData\Local\Temp\80E8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\81A3.tmp"C:\Users\Admin\AppData\Local\Temp\81A3.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\824F.tmp"C:\Users\Admin\AppData\Local\Temp\824F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\8453.tmp"C:\Users\Admin\AppData\Local\Temp\8453.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\859B.tmp"C:\Users\Admin\AppData\Local\Temp\859B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\8637.tmp"C:\Users\Admin\AppData\Local\Temp\8637.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\8702.tmp"C:\Users\Admin\AppData\Local\Temp\8702.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\878F.tmp"C:\Users\Admin\AppData\Local\Temp\878F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\883B.tmp"C:\Users\Admin\AppData\Local\Temp\883B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\88F6.tmp"C:\Users\Admin\AppData\Local\Temp\88F6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\89E1.tmp"C:\Users\Admin\AppData\Local\Temp\89E1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"23⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"24⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\8C23.tmp"C:\Users\Admin\AppData\Local\Temp\8C23.tmp"25⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"26⤵
- Executes dropped EXE
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"27⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"28⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\8E75.tmp"C:\Users\Admin\AppData\Local\Temp\8E75.tmp"29⤵
- Executes dropped EXE
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"30⤵
- Executes dropped EXE
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"31⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\9078.tmp"C:\Users\Admin\AppData\Local\Temp\9078.tmp"32⤵
- Executes dropped EXE
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\9153.tmp"C:\Users\Admin\AppData\Local\Temp\9153.tmp"33⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\91EF.tmp"C:\Users\Admin\AppData\Local\Temp\91EF.tmp"34⤵
- Executes dropped EXE
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\926C.tmp"C:\Users\Admin\AppData\Local\Temp\926C.tmp"35⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\92DA.tmp"C:\Users\Admin\AppData\Local\Temp\92DA.tmp"36⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"37⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"38⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\948F.tmp"C:\Users\Admin\AppData\Local\Temp\948F.tmp"39⤵
- Executes dropped EXE
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"40⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\95C8.tmp"C:\Users\Admin\AppData\Local\Temp\95C8.tmp"41⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\9664.tmp"C:\Users\Admin\AppData\Local\Temp\9664.tmp"42⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\96F0.tmp"C:\Users\Admin\AppData\Local\Temp\96F0.tmp"43⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\977D.tmp"C:\Users\Admin\AppData\Local\Temp\977D.tmp"44⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"45⤵
- Executes dropped EXE
PID:992 -
C:\Users\Admin\AppData\Local\Temp\98A6.tmp"C:\Users\Admin\AppData\Local\Temp\98A6.tmp"46⤵
- Executes dropped EXE
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"47⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\99A0.tmp"C:\Users\Admin\AppData\Local\Temp\99A0.tmp"48⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"49⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"50⤵
- Executes dropped EXE
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"51⤵
- Executes dropped EXE
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"52⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"53⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"54⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\9D78.tmp"C:\Users\Admin\AppData\Local\Temp\9D78.tmp"55⤵
- Executes dropped EXE
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"56⤵
- Executes dropped EXE
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\9E72.tmp"C:\Users\Admin\AppData\Local\Temp\9E72.tmp"57⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"58⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"59⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"60⤵
- Executes dropped EXE
PID:968 -
C:\Users\Admin\AppData\Local\Temp\A076.tmp"C:\Users\Admin\AppData\Local\Temp\A076.tmp"61⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"62⤵
- Executes dropped EXE
PID:432 -
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"63⤵
- Executes dropped EXE
PID:624 -
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"64⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"65⤵
- Executes dropped EXE
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\A306.tmp"C:\Users\Admin\AppData\Local\Temp\A306.tmp"66⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\A374.tmp"C:\Users\Admin\AppData\Local\Temp\A374.tmp"67⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"68⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"69⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"70⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"71⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"72⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"73⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"74⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\A76B.tmp"C:\Users\Admin\AppData\Local\Temp\A76B.tmp"75⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"76⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"77⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"78⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"79⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"80⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\AA69.tmp"C:\Users\Admin\AppData\Local\Temp\AA69.tmp"81⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\AB05.tmp"C:\Users\Admin\AppData\Local\Temp\AB05.tmp"82⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\AB82.tmp"C:\Users\Admin\AppData\Local\Temp\AB82.tmp"83⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"84⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"85⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\AD18.tmp"C:\Users\Admin\AppData\Local\Temp\AD18.tmp"86⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"87⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"88⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"89⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"90⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\AF99.tmp"C:\Users\Admin\AppData\Local\Temp\AF99.tmp"91⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\B035.tmp"C:\Users\Admin\AppData\Local\Temp\B035.tmp"92⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"93⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\B15E.tmp"C:\Users\Admin\AppData\Local\Temp\B15E.tmp"94⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"95⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\B268.tmp"C:\Users\Admin\AppData\Local\Temp\B268.tmp"96⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"97⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\B381.tmp"C:\Users\Admin\AppData\Local\Temp\B381.tmp"98⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\B40E.tmp"C:\Users\Admin\AppData\Local\Temp\B40E.tmp"99⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\B48B.tmp"C:\Users\Admin\AppData\Local\Temp\B48B.tmp"100⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\B508.tmp"C:\Users\Admin\AppData\Local\Temp\B508.tmp"101⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\B594.tmp"C:\Users\Admin\AppData\Local\Temp\B594.tmp"102⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"103⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"104⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\B73A.tmp"C:\Users\Admin\AppData\Local\Temp\B73A.tmp"105⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"106⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\B873.tmp"C:\Users\Admin\AppData\Local\Temp\B873.tmp"107⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"108⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\B95D.tmp"C:\Users\Admin\AppData\Local\Temp\B95D.tmp"109⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"110⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"111⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\BB22.tmp"C:\Users\Admin\AppData\Local\Temp\BB22.tmp"112⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"113⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"114⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"115⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\BD45.tmp"C:\Users\Admin\AppData\Local\Temp\BD45.tmp"116⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"117⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"118⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"119⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\BF58.tmp"C:\Users\Admin\AppData\Local\Temp\BF58.tmp"120⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"121⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\C062.tmp"C:\Users\Admin\AppData\Local\Temp\C062.tmp"122⤵PID:5108
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-