Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
27-08-2023 13:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a8c69685c2712f876dc70a31f1a3a321_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
a8c69685c2712f876dc70a31f1a3a321_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
a8c69685c2712f876dc70a31f1a3a321_mafia_JC.exe
-
Size
520KB
-
MD5
a8c69685c2712f876dc70a31f1a3a321
-
SHA1
1cf66b32127b83b548748d0a464f1566a51ee7f9
-
SHA256
09d5bf3e7d9048f95f06b00493c67040b29212a95fe5b62af13a87f0a16158c6
-
SHA512
cbcf6fa08e01fecd50e2b1556c8610f87f4ba030a57346995d7f77865e96c40f9140120453c478339d51868fa0b2da2255e471cf7f60849c6311e863f0f4be61
-
SSDEEP
12288:roRXOQjmOyU+2HGfVVcEb1zwwyiXLy3lNMi9NZ:rogQ9yjoGwQ1Ut/N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4628 7157.tmp 2868 7213.tmp 3544 72BF.tmp 4668 739A.tmp 1344 7455.tmp 1644 7511.tmp 3064 75BC.tmp 4392 7668.tmp 1000 7762.tmp 1692 77FF.tmp 2660 7918.tmp 376 79B4.tmp 684 7A50.tmp 4364 7B0C.tmp 1700 7BA8.tmp 964 7C35.tmp 888 7CE1.tmp 4856 7D9C.tmp 1820 7E58.tmp 396 7F32.tmp 2124 7FDE.tmp 680 808A.tmp 2908 8146.tmp 2104 81E2.tmp 3052 828E.tmp 5004 832A.tmp 2204 8397.tmp 3880 8424.tmp 3556 84D0.tmp 4836 855C.tmp 2956 8676.tmp 4120 8750.tmp 3208 87BE.tmp 988 882B.tmp 2240 88C7.tmp 3380 8944.tmp 3232 89C1.tmp 2604 8A2F.tmp 4616 8ABB.tmp 2020 8B38.tmp 4208 8B96.tmp 3824 8C32.tmp 1800 8CBF.tmp 4540 8D3C.tmp 1308 8DB9.tmp 4640 8E55.tmp 1032 8ED2.tmp 3368 8F4F.tmp 3376 8FCC.tmp 1452 9059.tmp 764 90F5.tmp 4108 9191.tmp 2292 921E.tmp 4064 92AB.tmp 3132 9347.tmp 2332 93C4.tmp 4668 9451.tmp 3796 94CE.tmp 4016 953B.tmp 1724 95C8.tmp 1472 9635.tmp 4192 96D1.tmp 4984 974E.tmp 2712 97DB.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4876 wrote to memory of 4628 4876 a8c69685c2712f876dc70a31f1a3a321_mafia_JC.exe 83 PID 4876 wrote to memory of 4628 4876 a8c69685c2712f876dc70a31f1a3a321_mafia_JC.exe 83 PID 4876 wrote to memory of 4628 4876 a8c69685c2712f876dc70a31f1a3a321_mafia_JC.exe 83 PID 4628 wrote to memory of 2868 4628 7157.tmp 84 PID 4628 wrote to memory of 2868 4628 7157.tmp 84 PID 4628 wrote to memory of 2868 4628 7157.tmp 84 PID 2868 wrote to memory of 3544 2868 7213.tmp 85 PID 2868 wrote to memory of 3544 2868 7213.tmp 85 PID 2868 wrote to memory of 3544 2868 7213.tmp 85 PID 3544 wrote to memory of 4668 3544 72BF.tmp 86 PID 3544 wrote to memory of 4668 3544 72BF.tmp 86 PID 3544 wrote to memory of 4668 3544 72BF.tmp 86 PID 4668 wrote to memory of 1344 4668 739A.tmp 87 PID 4668 wrote to memory of 1344 4668 739A.tmp 87 PID 4668 wrote to memory of 1344 4668 739A.tmp 87 PID 1344 wrote to memory of 1644 1344 7455.tmp 88 PID 1344 wrote to memory of 1644 1344 7455.tmp 88 PID 1344 wrote to memory of 1644 1344 7455.tmp 88 PID 1644 wrote to memory of 3064 1644 7511.tmp 89 PID 1644 wrote to memory of 3064 1644 7511.tmp 89 PID 1644 wrote to memory of 3064 1644 7511.tmp 89 PID 3064 wrote to memory of 4392 3064 75BC.tmp 90 PID 3064 wrote to memory of 4392 3064 75BC.tmp 90 PID 3064 wrote to memory of 4392 3064 75BC.tmp 90 PID 4392 wrote to memory of 1000 4392 7668.tmp 91 PID 4392 wrote to memory of 1000 4392 7668.tmp 91 PID 4392 wrote to memory of 1000 4392 7668.tmp 91 PID 1000 wrote to memory of 1692 1000 7762.tmp 92 PID 1000 wrote to memory of 1692 1000 7762.tmp 92 PID 1000 wrote to memory of 1692 1000 7762.tmp 92 PID 1692 wrote to memory of 2660 1692 77FF.tmp 93 PID 1692 wrote to memory of 2660 1692 77FF.tmp 93 PID 1692 wrote to memory of 2660 1692 77FF.tmp 93 PID 2660 wrote to memory of 376 2660 7918.tmp 94 PID 2660 wrote to memory of 376 2660 7918.tmp 94 PID 2660 wrote to memory of 376 2660 7918.tmp 94 PID 376 wrote to memory of 684 376 79B4.tmp 95 PID 376 wrote to memory of 684 376 79B4.tmp 95 PID 376 wrote to memory of 684 376 79B4.tmp 95 PID 684 wrote to memory of 4364 684 7A50.tmp 96 PID 684 wrote to memory of 4364 684 7A50.tmp 96 PID 684 wrote to memory of 4364 684 7A50.tmp 96 PID 4364 wrote to memory of 1700 4364 7B0C.tmp 97 PID 4364 wrote to memory of 1700 4364 7B0C.tmp 97 PID 4364 wrote to memory of 1700 4364 7B0C.tmp 97 PID 1700 wrote to memory of 964 1700 7BA8.tmp 98 PID 1700 wrote to memory of 964 1700 7BA8.tmp 98 PID 1700 wrote to memory of 964 1700 7BA8.tmp 98 PID 964 wrote to memory of 888 964 7C35.tmp 99 PID 964 wrote to memory of 888 964 7C35.tmp 99 PID 964 wrote to memory of 888 964 7C35.tmp 99 PID 888 wrote to memory of 4856 888 7CE1.tmp 102 PID 888 wrote to memory of 4856 888 7CE1.tmp 102 PID 888 wrote to memory of 4856 888 7CE1.tmp 102 PID 4856 wrote to memory of 1820 4856 7D9C.tmp 103 PID 4856 wrote to memory of 1820 4856 7D9C.tmp 103 PID 4856 wrote to memory of 1820 4856 7D9C.tmp 103 PID 1820 wrote to memory of 396 1820 7E58.tmp 104 PID 1820 wrote to memory of 396 1820 7E58.tmp 104 PID 1820 wrote to memory of 396 1820 7E58.tmp 104 PID 396 wrote to memory of 2124 396 7F32.tmp 105 PID 396 wrote to memory of 2124 396 7F32.tmp 105 PID 396 wrote to memory of 2124 396 7F32.tmp 105 PID 2124 wrote to memory of 680 2124 7FDE.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8c69685c2712f876dc70a31f1a3a321_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\a8c69685c2712f876dc70a31f1a3a321_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\7157.tmp"C:\Users\Admin\AppData\Local\Temp\7157.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\7213.tmp"C:\Users\Admin\AppData\Local\Temp\7213.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\72BF.tmp"C:\Users\Admin\AppData\Local\Temp\72BF.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\7762.tmp"C:\Users\Admin\AppData\Local\Temp\7762.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\77FF.tmp"C:\Users\Admin\AppData\Local\Temp\77FF.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\7918.tmp"C:\Users\Admin\AppData\Local\Temp\7918.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\79B4.tmp"C:\Users\Admin\AppData\Local\Temp\79B4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Users\Admin\AppData\Local\Temp\7A50.tmp"C:\Users\Admin\AppData\Local\Temp\7A50.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\7C35.tmp"C:\Users\Admin\AppData\Local\Temp\7C35.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\7F32.tmp"C:\Users\Admin\AppData\Local\Temp\7F32.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\808A.tmp"C:\Users\Admin\AppData\Local\Temp\808A.tmp"23⤵
- Executes dropped EXE
PID:680 -
C:\Users\Admin\AppData\Local\Temp\8146.tmp"C:\Users\Admin\AppData\Local\Temp\8146.tmp"24⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\81E2.tmp"C:\Users\Admin\AppData\Local\Temp\81E2.tmp"25⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\828E.tmp"C:\Users\Admin\AppData\Local\Temp\828E.tmp"26⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"27⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"28⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\8424.tmp"C:\Users\Admin\AppData\Local\Temp\8424.tmp"29⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\84D0.tmp"C:\Users\Admin\AppData\Local\Temp\84D0.tmp"30⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\855C.tmp"C:\Users\Admin\AppData\Local\Temp\855C.tmp"31⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\8676.tmp"C:\Users\Admin\AppData\Local\Temp\8676.tmp"32⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\8750.tmp"C:\Users\Admin\AppData\Local\Temp\8750.tmp"33⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\87BE.tmp"C:\Users\Admin\AppData\Local\Temp\87BE.tmp"34⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\882B.tmp"C:\Users\Admin\AppData\Local\Temp\882B.tmp"35⤵
- Executes dropped EXE
PID:988 -
C:\Users\Admin\AppData\Local\Temp\88C7.tmp"C:\Users\Admin\AppData\Local\Temp\88C7.tmp"36⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"37⤵
- Executes dropped EXE
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\89C1.tmp"C:\Users\Admin\AppData\Local\Temp\89C1.tmp"38⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"39⤵
- Executes dropped EXE
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"40⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\8B38.tmp"C:\Users\Admin\AppData\Local\Temp\8B38.tmp"41⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\8B96.tmp"C:\Users\Admin\AppData\Local\Temp\8B96.tmp"42⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\8C32.tmp"C:\Users\Admin\AppData\Local\Temp\8C32.tmp"43⤵
- Executes dropped EXE
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"44⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"45⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"46⤵
- Executes dropped EXE
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\8E55.tmp"C:\Users\Admin\AppData\Local\Temp\8E55.tmp"47⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"48⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"49⤵
- Executes dropped EXE
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"50⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"51⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"52⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\9191.tmp"C:\Users\Admin\AppData\Local\Temp\9191.tmp"53⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\921E.tmp"C:\Users\Admin\AppData\Local\Temp\921E.tmp"54⤵
- Executes dropped EXE
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\92AB.tmp"C:\Users\Admin\AppData\Local\Temp\92AB.tmp"55⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"56⤵
- Executes dropped EXE
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"57⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\9451.tmp"C:\Users\Admin\AppData\Local\Temp\9451.tmp"58⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\94CE.tmp"C:\Users\Admin\AppData\Local\Temp\94CE.tmp"59⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"60⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\95C8.tmp"C:\Users\Admin\AppData\Local\Temp\95C8.tmp"61⤵
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"62⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\96D1.tmp"C:\Users\Admin\AppData\Local\Temp\96D1.tmp"63⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"64⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\97DB.tmp"C:\Users\Admin\AppData\Local\Temp\97DB.tmp"65⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\9848.tmp"C:\Users\Admin\AppData\Local\Temp\9848.tmp"66⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\98B6.tmp"C:\Users\Admin\AppData\Local\Temp\98B6.tmp"67⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\9942.tmp"C:\Users\Admin\AppData\Local\Temp\9942.tmp"68⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\99EE.tmp"C:\Users\Admin\AppData\Local\Temp\99EE.tmp"69⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"70⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"71⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"72⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"73⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"74⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"75⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"76⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\9D69.tmp"C:\Users\Admin\AppData\Local\Temp\9D69.tmp"77⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"78⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\9E72.tmp"C:\Users\Admin\AppData\Local\Temp\9E72.tmp"79⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"80⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"81⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"82⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"83⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\A095.tmp"C:\Users\Admin\AppData\Local\Temp\A095.tmp"84⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"85⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"86⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\A26A.tmp"C:\Users\Admin\AppData\Local\Temp\A26A.tmp"87⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\A306.tmp"C:\Users\Admin\AppData\Local\Temp\A306.tmp"88⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\A364.tmp"C:\Users\Admin\AppData\Local\Temp\A364.tmp"89⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"90⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"91⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"92⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\A577.tmp"C:\Users\Admin\AppData\Local\Temp\A577.tmp"93⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\A642.tmp"C:\Users\Admin\AppData\Local\Temp\A642.tmp"94⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"95⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"96⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"97⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\A827.tmp"C:\Users\Admin\AppData\Local\Temp\A827.tmp"98⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"99⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\A950.tmp"C:\Users\Admin\AppData\Local\Temp\A950.tmp"100⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"101⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"102⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"103⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\AB82.tmp"C:\Users\Admin\AppData\Local\Temp\AB82.tmp"104⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"105⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"106⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\AD18.tmp"C:\Users\Admin\AppData\Local\Temp\AD18.tmp"107⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"108⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"109⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"110⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"111⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"112⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\B045.tmp"C:\Users\Admin\AppData\Local\Temp\B045.tmp"113⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"114⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"115⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"116⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\B287.tmp"C:\Users\Admin\AppData\Local\Temp\B287.tmp"117⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\B314.tmp"C:\Users\Admin\AppData\Local\Temp\B314.tmp"118⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"119⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"120⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\B585.tmp"C:\Users\Admin\AppData\Local\Temp\B585.tmp"121⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\B611.tmp"C:\Users\Admin\AppData\Local\Temp\B611.tmp"122⤵PID:4168
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-