Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
27/08/2023, 14:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ab91d7abfb61a6dbaf03041c0c4e3c4e_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
ab91d7abfb61a6dbaf03041c0c4e3c4e_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
ab91d7abfb61a6dbaf03041c0c4e3c4e_mafia_JC.exe
-
Size
520KB
-
MD5
ab91d7abfb61a6dbaf03041c0c4e3c4e
-
SHA1
5fd139353d6c89a26797ce7951c6f406f7b3d6e3
-
SHA256
ca3a135cc3593a799a05fec406000686a0f40835175f55dc7aade29d3622b452
-
SHA512
d8daa2a691876f2d754dc3070fe46c4e7a1e1ea270dcd8ffa037fc332f9054736406e46c93909b9e2e4ba89c22c97ce68b2ebec4c3534d87b2f7c04f321c362e
-
SSDEEP
12288:roRXOQjmOyG8qIsBvAqkSy1NwNCtuux8pxUF/HNZ:rogQ9yHsSh1Nw8uux8LGvN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4792 89D1.tmp 1948 8A7D.tmp 4780 8B58.tmp 3312 8C04.tmp 4220 8CCF.tmp 4988 8D9A.tmp 3972 8E65.tmp 4984 8F7E.tmp 4608 901A.tmp 2204 90C6.tmp 2404 9163.tmp 232 922E.tmp 1812 92DA.tmp 3760 9376.tmp 380 9412.tmp 3316 94AE.tmp 5112 95D7.tmp 4208 9673.tmp 3108 976D.tmp 2756 9877.tmp 2040 9913.tmp 3004 99B0.tmp 3776 9A5B.tmp 408 9B07.tmp 1016 9BE2.tmp 4140 9CBD.tmp 2636 9E34.tmp 540 9F3D.tmp 3032 9FF9.tmp 796 A0A5.tmp 2720 A170.tmp 2576 A22B.tmp 1076 A2A8.tmp 1872 A354.tmp 1968 A3D1.tmp 856 A44E.tmp 2320 A4DB.tmp 4144 A568.tmp 5072 A5E5.tmp 4820 A6A0.tmp 4228 A70D.tmp 1184 A7B9.tmp 1168 A865.tmp 4564 A97E.tmp 4580 AA1B.tmp 4192 AAA7.tmp 4696 AB44.tmp 2852 ABD0.tmp 4128 AC3E.tmp 1824 ACE9.tmp 3708 AD66.tmp 1612 ADF3.tmp 5008 AE70.tmp 4220 AF0C.tmp 2116 AF89.tmp 1952 AFF7.tmp 4392 B083.tmp 4984 B110.tmp 4916 B18D.tmp 4852 B21A.tmp 2000 B297.tmp 4828 B304.tmp 844 B3B0.tmp 3616 B43C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3148 wrote to memory of 4792 3148 ab91d7abfb61a6dbaf03041c0c4e3c4e_mafia_JC.exe 82 PID 3148 wrote to memory of 4792 3148 ab91d7abfb61a6dbaf03041c0c4e3c4e_mafia_JC.exe 82 PID 3148 wrote to memory of 4792 3148 ab91d7abfb61a6dbaf03041c0c4e3c4e_mafia_JC.exe 82 PID 4792 wrote to memory of 1948 4792 89D1.tmp 83 PID 4792 wrote to memory of 1948 4792 89D1.tmp 83 PID 4792 wrote to memory of 1948 4792 89D1.tmp 83 PID 1948 wrote to memory of 4780 1948 8A7D.tmp 84 PID 1948 wrote to memory of 4780 1948 8A7D.tmp 84 PID 1948 wrote to memory of 4780 1948 8A7D.tmp 84 PID 4780 wrote to memory of 3312 4780 8B58.tmp 85 PID 4780 wrote to memory of 3312 4780 8B58.tmp 85 PID 4780 wrote to memory of 3312 4780 8B58.tmp 85 PID 3312 wrote to memory of 4220 3312 8C04.tmp 86 PID 3312 wrote to memory of 4220 3312 8C04.tmp 86 PID 3312 wrote to memory of 4220 3312 8C04.tmp 86 PID 4220 wrote to memory of 4988 4220 8CCF.tmp 87 PID 4220 wrote to memory of 4988 4220 8CCF.tmp 87 PID 4220 wrote to memory of 4988 4220 8CCF.tmp 87 PID 4988 wrote to memory of 3972 4988 8D9A.tmp 88 PID 4988 wrote to memory of 3972 4988 8D9A.tmp 88 PID 4988 wrote to memory of 3972 4988 8D9A.tmp 88 PID 3972 wrote to memory of 4984 3972 8E65.tmp 89 PID 3972 wrote to memory of 4984 3972 8E65.tmp 89 PID 3972 wrote to memory of 4984 3972 8E65.tmp 89 PID 4984 wrote to memory of 4608 4984 8F7E.tmp 90 PID 4984 wrote to memory of 4608 4984 8F7E.tmp 90 PID 4984 wrote to memory of 4608 4984 8F7E.tmp 90 PID 4608 wrote to memory of 2204 4608 901A.tmp 91 PID 4608 wrote to memory of 2204 4608 901A.tmp 91 PID 4608 wrote to memory of 2204 4608 901A.tmp 91 PID 2204 wrote to memory of 2404 2204 90C6.tmp 92 PID 2204 wrote to memory of 2404 2204 90C6.tmp 92 PID 2204 wrote to memory of 2404 2204 90C6.tmp 92 PID 2404 wrote to memory of 232 2404 9163.tmp 93 PID 2404 wrote to memory of 232 2404 9163.tmp 93 PID 2404 wrote to memory of 232 2404 9163.tmp 93 PID 232 wrote to memory of 1812 232 922E.tmp 94 PID 232 wrote to memory of 1812 232 922E.tmp 94 PID 232 wrote to memory of 1812 232 922E.tmp 94 PID 1812 wrote to memory of 3760 1812 92DA.tmp 96 PID 1812 wrote to memory of 3760 1812 92DA.tmp 96 PID 1812 wrote to memory of 3760 1812 92DA.tmp 96 PID 3760 wrote to memory of 380 3760 9376.tmp 97 PID 3760 wrote to memory of 380 3760 9376.tmp 97 PID 3760 wrote to memory of 380 3760 9376.tmp 97 PID 380 wrote to memory of 3316 380 9412.tmp 98 PID 380 wrote to memory of 3316 380 9412.tmp 98 PID 380 wrote to memory of 3316 380 9412.tmp 98 PID 3316 wrote to memory of 5112 3316 94AE.tmp 99 PID 3316 wrote to memory of 5112 3316 94AE.tmp 99 PID 3316 wrote to memory of 5112 3316 94AE.tmp 99 PID 5112 wrote to memory of 4208 5112 95D7.tmp 100 PID 5112 wrote to memory of 4208 5112 95D7.tmp 100 PID 5112 wrote to memory of 4208 5112 95D7.tmp 100 PID 4208 wrote to memory of 3108 4208 9673.tmp 101 PID 4208 wrote to memory of 3108 4208 9673.tmp 101 PID 4208 wrote to memory of 3108 4208 9673.tmp 101 PID 3108 wrote to memory of 2756 3108 976D.tmp 102 PID 3108 wrote to memory of 2756 3108 976D.tmp 102 PID 3108 wrote to memory of 2756 3108 976D.tmp 102 PID 2756 wrote to memory of 2040 2756 9877.tmp 103 PID 2756 wrote to memory of 2040 2756 9877.tmp 103 PID 2756 wrote to memory of 2040 2756 9877.tmp 103 PID 2040 wrote to memory of 3004 2040 9913.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab91d7abfb61a6dbaf03041c0c4e3c4e_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\ab91d7abfb61a6dbaf03041c0c4e3c4e_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\89D1.tmp"C:\Users\Admin\AppData\Local\Temp\89D1.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\8B58.tmp"C:\Users\Admin\AppData\Local\Temp\8B58.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\8C04.tmp"C:\Users\Admin\AppData\Local\Temp\8C04.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\901A.tmp"C:\Users\Admin\AppData\Local\Temp\901A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\9163.tmp"C:\Users\Admin\AppData\Local\Temp\9163.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\922E.tmp"C:\Users\Admin\AppData\Local\Temp\922E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Users\Admin\AppData\Local\Temp\92DA.tmp"C:\Users\Admin\AppData\Local\Temp\92DA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\9376.tmp"C:\Users\Admin\AppData\Local\Temp\9376.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\9412.tmp"C:\Users\Admin\AppData\Local\Temp\9412.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\94AE.tmp"C:\Users\Admin\AppData\Local\Temp\94AE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\95D7.tmp"C:\Users\Admin\AppData\Local\Temp\95D7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\9673.tmp"C:\Users\Admin\AppData\Local\Temp\9673.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\976D.tmp"C:\Users\Admin\AppData\Local\Temp\976D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\9877.tmp"C:\Users\Admin\AppData\Local\Temp\9877.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"23⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"24⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"25⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"26⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"27⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"28⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"29⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"30⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"31⤵
- Executes dropped EXE
PID:796 -
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"32⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"33⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"34⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\A354.tmp"C:\Users\Admin\AppData\Local\Temp\A354.tmp"35⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"36⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"37⤵
- Executes dropped EXE
PID:856 -
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"38⤵
- Executes dropped EXE
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"39⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"40⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"41⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"42⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"43⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"44⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"45⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"46⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"47⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"48⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\AB44.tmp"C:\Users\Admin\AppData\Local\Temp\AB44.tmp"49⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"50⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"51⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"52⤵
- Executes dropped EXE
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\AD66.tmp"C:\Users\Admin\AppData\Local\Temp\AD66.tmp"53⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"54⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\AE70.tmp"C:\Users\Admin\AppData\Local\Temp\AE70.tmp"55⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"56⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"57⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"58⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\B083.tmp"C:\Users\Admin\AppData\Local\Temp\B083.tmp"59⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\B110.tmp"C:\Users\Admin\AppData\Local\Temp\B110.tmp"60⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\B18D.tmp"C:\Users\Admin\AppData\Local\Temp\B18D.tmp"61⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\B21A.tmp"C:\Users\Admin\AppData\Local\Temp\B21A.tmp"62⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"63⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\B304.tmp"C:\Users\Admin\AppData\Local\Temp\B304.tmp"64⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"65⤵
- Executes dropped EXE
PID:844 -
C:\Users\Admin\AppData\Local\Temp\B43C.tmp"C:\Users\Admin\AppData\Local\Temp\B43C.tmp"66⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"67⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\B565.tmp"C:\Users\Admin\AppData\Local\Temp\B565.tmp"68⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\B611.tmp"C:\Users\Admin\AppData\Local\Temp\B611.tmp"69⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\B69E.tmp"C:\Users\Admin\AppData\Local\Temp\B69E.tmp"70⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\B72A.tmp"C:\Users\Admin\AppData\Local\Temp\B72A.tmp"71⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"72⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\B834.tmp"C:\Users\Admin\AppData\Local\Temp\B834.tmp"73⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"74⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\B91E.tmp"C:\Users\Admin\AppData\Local\Temp\B91E.tmp"75⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\B97C.tmp"C:\Users\Admin\AppData\Local\Temp\B97C.tmp"76⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\BA18.tmp"C:\Users\Admin\AppData\Local\Temp\BA18.tmp"77⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"78⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\BB32.tmp"C:\Users\Admin\AppData\Local\Temp\BB32.tmp"79⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"80⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"81⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"82⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\BD55.tmp"C:\Users\Admin\AppData\Local\Temp\BD55.tmp"83⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\BE00.tmp"C:\Users\Admin\AppData\Local\Temp\BE00.tmp"84⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"85⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"86⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"87⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"88⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"89⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"90⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"91⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\C256.tmp"C:\Users\Admin\AppData\Local\Temp\C256.tmp"92⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"93⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\C36F.tmp"C:\Users\Admin\AppData\Local\Temp\C36F.tmp"94⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"95⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\C43A.tmp"C:\Users\Admin\AppData\Local\Temp\C43A.tmp"96⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\C4C7.tmp"C:\Users\Admin\AppData\Local\Temp\C4C7.tmp"97⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\C534.tmp"C:\Users\Admin\AppData\Local\Temp\C534.tmp"98⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"99⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\C61F.tmp"C:\Users\Admin\AppData\Local\Temp\C61F.tmp"100⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"101⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\C728.tmp"C:\Users\Admin\AppData\Local\Temp\C728.tmp"102⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\C786.tmp"C:\Users\Admin\AppData\Local\Temp\C786.tmp"103⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\C813.tmp"C:\Users\Admin\AppData\Local\Temp\C813.tmp"104⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\C890.tmp"C:\Users\Admin\AppData\Local\Temp\C890.tmp"105⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\C91C.tmp"C:\Users\Admin\AppData\Local\Temp\C91C.tmp"106⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\C9C8.tmp"C:\Users\Admin\AppData\Local\Temp\C9C8.tmp"107⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\CA55.tmp"C:\Users\Admin\AppData\Local\Temp\CA55.tmp"108⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\CAD2.tmp"C:\Users\Admin\AppData\Local\Temp\CAD2.tmp"109⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"110⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"111⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\CC78.tmp"C:\Users\Admin\AppData\Local\Temp\CC78.tmp"112⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"113⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\CD62.tmp"C:\Users\Admin\AppData\Local\Temp\CD62.tmp"114⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"115⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"116⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\CF08.tmp"C:\Users\Admin\AppData\Local\Temp\CF08.tmp"117⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\CF94.tmp"C:\Users\Admin\AppData\Local\Temp\CF94.tmp"118⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\D021.tmp"C:\Users\Admin\AppData\Local\Temp\D021.tmp"119⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"120⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\D12B.tmp"C:\Users\Admin\AppData\Local\Temp\D12B.tmp"121⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\D1B7.tmp"C:\Users\Admin\AppData\Local\Temp\D1B7.tmp"122⤵PID:864
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-