Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
27/08/2023, 14:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aa60426e311114d1af0c16a81499e750_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
aa60426e311114d1af0c16a81499e750_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
aa60426e311114d1af0c16a81499e750_mafia_JC.exe
-
Size
520KB
-
MD5
aa60426e311114d1af0c16a81499e750
-
SHA1
ea88c7a020fd34b1ea17fe524b5de7e5ab0168d1
-
SHA256
aa7a7e79d18b7099be1f55301829c2887351371184a3f862ffaaff6dcc7cc755
-
SHA512
1571b4d1fa2006a9853a84ebb2e9ac37558f899f012a08c026911641db385f8798e4265352453c0441cc0dd3528a9b530e971c004cee9f4c10540168842cbd39
-
SSDEEP
12288:roRXOQjmOyW03dsLgtz2Iyai0YQKhgzmFCNZ:rogQ9yW0OLgNlYQKhWN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2840 82EB.tmp 4828 8397.tmp 4448 8462.tmp 1264 854D.tmp 2440 8608.tmp 456 86B4.tmp 2756 878F.tmp 4152 883B.tmp 1768 88D7.tmp 1376 8993.tmp 4136 8A1F.tmp 1112 8AFA.tmp 4964 8BF4.tmp 3416 8CAF.tmp 4344 8D3C.tmp 4160 8DC9.tmp 3068 8E65.tmp 4236 928B.tmp 2152 9328.tmp 2488 93E3.tmp 2136 949F.tmp 416 956A.tmp 4008 9606.tmp 2020 96B2.tmp 3996 972F.tmp 4780 97CB.tmp 4040 9877.tmp 2260 9933.tmp 3516 99CF.tmp 1412 9AB9.tmp 2180 9C4F.tmp 4676 9D0B.tmp 2764 9DF5.tmp 4708 9E82.tmp 400 9F1E.tmp 4772 9F9B.tmp 2788 A0A5.tmp 3392 A160.tmp 3268 A1FD.tmp 2996 A2A8.tmp 3732 A316.tmp 232 A393.tmp 3064 A410.tmp 2096 A4AC.tmp 4200 A5A6.tmp 3672 A613.tmp 4604 A6BF.tmp 3852 A74C.tmp 1764 A7E8.tmp 3132 A875.tmp 4556 A901.tmp 1116 A98E.tmp 940 AA1B.tmp 2956 AB63.tmp 3152 ABEF.tmp 4052 AC6C.tmp 2308 AD09.tmp 4328 ADA5.tmp 4584 AE32.tmp 2756 AECE.tmp 1012 AF4B.tmp 4036 AFB8.tmp 3112 B0C2.tmp 3864 B12F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4604 wrote to memory of 2840 4604 aa60426e311114d1af0c16a81499e750_mafia_JC.exe 81 PID 4604 wrote to memory of 2840 4604 aa60426e311114d1af0c16a81499e750_mafia_JC.exe 81 PID 4604 wrote to memory of 2840 4604 aa60426e311114d1af0c16a81499e750_mafia_JC.exe 81 PID 2840 wrote to memory of 4828 2840 82EB.tmp 82 PID 2840 wrote to memory of 4828 2840 82EB.tmp 82 PID 2840 wrote to memory of 4828 2840 82EB.tmp 82 PID 4828 wrote to memory of 4448 4828 8397.tmp 83 PID 4828 wrote to memory of 4448 4828 8397.tmp 83 PID 4828 wrote to memory of 4448 4828 8397.tmp 83 PID 4448 wrote to memory of 1264 4448 8462.tmp 84 PID 4448 wrote to memory of 1264 4448 8462.tmp 84 PID 4448 wrote to memory of 1264 4448 8462.tmp 84 PID 1264 wrote to memory of 2440 1264 854D.tmp 85 PID 1264 wrote to memory of 2440 1264 854D.tmp 85 PID 1264 wrote to memory of 2440 1264 854D.tmp 85 PID 2440 wrote to memory of 456 2440 8608.tmp 86 PID 2440 wrote to memory of 456 2440 8608.tmp 86 PID 2440 wrote to memory of 456 2440 8608.tmp 86 PID 456 wrote to memory of 2756 456 86B4.tmp 87 PID 456 wrote to memory of 2756 456 86B4.tmp 87 PID 456 wrote to memory of 2756 456 86B4.tmp 87 PID 2756 wrote to memory of 4152 2756 878F.tmp 88 PID 2756 wrote to memory of 4152 2756 878F.tmp 88 PID 2756 wrote to memory of 4152 2756 878F.tmp 88 PID 4152 wrote to memory of 1768 4152 883B.tmp 89 PID 4152 wrote to memory of 1768 4152 883B.tmp 89 PID 4152 wrote to memory of 1768 4152 883B.tmp 89 PID 1768 wrote to memory of 1376 1768 88D7.tmp 90 PID 1768 wrote to memory of 1376 1768 88D7.tmp 90 PID 1768 wrote to memory of 1376 1768 88D7.tmp 90 PID 1376 wrote to memory of 4136 1376 8993.tmp 91 PID 1376 wrote to memory of 4136 1376 8993.tmp 91 PID 1376 wrote to memory of 4136 1376 8993.tmp 91 PID 4136 wrote to memory of 1112 4136 8A1F.tmp 92 PID 4136 wrote to memory of 1112 4136 8A1F.tmp 92 PID 4136 wrote to memory of 1112 4136 8A1F.tmp 92 PID 1112 wrote to memory of 4964 1112 8AFA.tmp 93 PID 1112 wrote to memory of 4964 1112 8AFA.tmp 93 PID 1112 wrote to memory of 4964 1112 8AFA.tmp 93 PID 4964 wrote to memory of 3416 4964 8BF4.tmp 94 PID 4964 wrote to memory of 3416 4964 8BF4.tmp 94 PID 4964 wrote to memory of 3416 4964 8BF4.tmp 94 PID 3416 wrote to memory of 4344 3416 8CAF.tmp 95 PID 3416 wrote to memory of 4344 3416 8CAF.tmp 95 PID 3416 wrote to memory of 4344 3416 8CAF.tmp 95 PID 4344 wrote to memory of 4160 4344 8D3C.tmp 96 PID 4344 wrote to memory of 4160 4344 8D3C.tmp 96 PID 4344 wrote to memory of 4160 4344 8D3C.tmp 96 PID 4160 wrote to memory of 3068 4160 8DC9.tmp 97 PID 4160 wrote to memory of 3068 4160 8DC9.tmp 97 PID 4160 wrote to memory of 3068 4160 8DC9.tmp 97 PID 3068 wrote to memory of 4236 3068 8E65.tmp 100 PID 3068 wrote to memory of 4236 3068 8E65.tmp 100 PID 3068 wrote to memory of 4236 3068 8E65.tmp 100 PID 4236 wrote to memory of 2152 4236 928B.tmp 101 PID 4236 wrote to memory of 2152 4236 928B.tmp 101 PID 4236 wrote to memory of 2152 4236 928B.tmp 101 PID 2152 wrote to memory of 2488 2152 9328.tmp 102 PID 2152 wrote to memory of 2488 2152 9328.tmp 102 PID 2152 wrote to memory of 2488 2152 9328.tmp 102 PID 2488 wrote to memory of 2136 2488 93E3.tmp 103 PID 2488 wrote to memory of 2136 2488 93E3.tmp 103 PID 2488 wrote to memory of 2136 2488 93E3.tmp 103 PID 2136 wrote to memory of 416 2136 949F.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa60426e311114d1af0c16a81499e750_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\aa60426e311114d1af0c16a81499e750_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\82EB.tmp"C:\Users\Admin\AppData\Local\Temp\82EB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\8462.tmp"C:\Users\Admin\AppData\Local\Temp\8462.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\854D.tmp"C:\Users\Admin\AppData\Local\Temp\854D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\8608.tmp"C:\Users\Admin\AppData\Local\Temp\8608.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\878F.tmp"C:\Users\Admin\AppData\Local\Temp\878F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\883B.tmp"C:\Users\Admin\AppData\Local\Temp\883B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\8993.tmp"C:\Users\Admin\AppData\Local\Temp\8993.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\9328.tmp"C:\Users\Admin\AppData\Local\Temp\9328.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\956A.tmp"C:\Users\Admin\AppData\Local\Temp\956A.tmp"23⤵
- Executes dropped EXE
PID:416 -
C:\Users\Admin\AppData\Local\Temp\9606.tmp"C:\Users\Admin\AppData\Local\Temp\9606.tmp"24⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\96B2.tmp"C:\Users\Admin\AppData\Local\Temp\96B2.tmp"25⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\972F.tmp"C:\Users\Admin\AppData\Local\Temp\972F.tmp"26⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\97CB.tmp"C:\Users\Admin\AppData\Local\Temp\97CB.tmp"27⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\9877.tmp"C:\Users\Admin\AppData\Local\Temp\9877.tmp"28⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"29⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"30⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"31⤵
- Executes dropped EXE
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"32⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"33⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"34⤵
- Executes dropped EXE
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"35⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"36⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"37⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"38⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\A160.tmp"C:\Users\Admin\AppData\Local\Temp\A160.tmp"39⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"40⤵
- Executes dropped EXE
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"41⤵
- Executes dropped EXE
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"42⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"43⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\A410.tmp"C:\Users\Admin\AppData\Local\Temp\A410.tmp"44⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"45⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"46⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\A613.tmp"C:\Users\Admin\AppData\Local\Temp\A613.tmp"47⤵
- Executes dropped EXE
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"48⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\A74C.tmp"C:\Users\Admin\AppData\Local\Temp\A74C.tmp"49⤵
- Executes dropped EXE
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"50⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"51⤵
- Executes dropped EXE
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"52⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"53⤵
- Executes dropped EXE
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"54⤵
- Executes dropped EXE
PID:940 -
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"55⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"56⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"57⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\AD09.tmp"C:\Users\Admin\AppData\Local\Temp\AD09.tmp"58⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"59⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"60⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\AECE.tmp"C:\Users\Admin\AppData\Local\Temp\AECE.tmp"61⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"62⤵
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"63⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"64⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\B12F.tmp"C:\Users\Admin\AppData\Local\Temp\B12F.tmp"65⤵
- Executes dropped EXE
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"66⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\B268.tmp"C:\Users\Admin\AppData\Local\Temp\B268.tmp"67⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"68⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\B371.tmp"C:\Users\Admin\AppData\Local\Temp\B371.tmp"69⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"70⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"71⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\B49A.tmp"C:\Users\Admin\AppData\Local\Temp\B49A.tmp"72⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"73⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\B650.tmp"C:\Users\Admin\AppData\Local\Temp\B650.tmp"74⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"75⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\B779.tmp"C:\Users\Admin\AppData\Local\Temp\B779.tmp"76⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\B815.tmp"C:\Users\Admin\AppData\Local\Temp\B815.tmp"77⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"78⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\B97C.tmp"C:\Users\Admin\AppData\Local\Temp\B97C.tmp"79⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\BA38.tmp"C:\Users\Admin\AppData\Local\Temp\BA38.tmp"80⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"81⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\BB41.tmp"C:\Users\Admin\AppData\Local\Temp\BB41.tmp"82⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"83⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"84⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"85⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\BD64.tmp"C:\Users\Admin\AppData\Local\Temp\BD64.tmp"86⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"87⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"88⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"89⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\BF68.tmp"C:\Users\Admin\AppData\Local\Temp\BF68.tmp"90⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\C014.tmp"C:\Users\Admin\AppData\Local\Temp\C014.tmp"91⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"92⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"93⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"94⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\C256.tmp"C:\Users\Admin\AppData\Local\Temp\C256.tmp"95⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"96⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\C36F.tmp"C:\Users\Admin\AppData\Local\Temp\C36F.tmp"97⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"98⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\C469.tmp"C:\Users\Admin\AppData\Local\Temp\C469.tmp"99⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"100⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\C582.tmp"C:\Users\Admin\AppData\Local\Temp\C582.tmp"101⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\C62E.tmp"C:\Users\Admin\AppData\Local\Temp\C62E.tmp"102⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"103⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\C738.tmp"C:\Users\Admin\AppData\Local\Temp\C738.tmp"104⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"105⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\C832.tmp"C:\Users\Admin\AppData\Local\Temp\C832.tmp"106⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"107⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\C93B.tmp"C:\Users\Admin\AppData\Local\Temp\C93B.tmp"108⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\C9C8.tmp"C:\Users\Admin\AppData\Local\Temp\C9C8.tmp"109⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\CA74.tmp"C:\Users\Admin\AppData\Local\Temp\CA74.tmp"110⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"111⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"112⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\CC68.tmp"C:\Users\Admin\AppData\Local\Temp\CC68.tmp"113⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\CCD5.tmp"C:\Users\Admin\AppData\Local\Temp\CCD5.tmp"114⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\CD43.tmp"C:\Users\Admin\AppData\Local\Temp\CD43.tmp"115⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"116⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\CE5C.tmp"C:\Users\Admin\AppData\Local\Temp\CE5C.tmp"117⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\CEE9.tmp"C:\Users\Admin\AppData\Local\Temp\CEE9.tmp"118⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\CF75.tmp"C:\Users\Admin\AppData\Local\Temp\CF75.tmp"119⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\D040.tmp"C:\Users\Admin\AppData\Local\Temp\D040.tmp"120⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"121⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\D179.tmp"C:\Users\Admin\AppData\Local\Temp\D179.tmp"122⤵PID:4072
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-