Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
27/08/2023, 15:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ae923afc9cac42e345b79c32578b9064_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
ae923afc9cac42e345b79c32578b9064_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
ae923afc9cac42e345b79c32578b9064_mafia_JC.exe
-
Size
486KB
-
MD5
ae923afc9cac42e345b79c32578b9064
-
SHA1
b310dfc39d6519eab20e71b49df108daa5b4b200
-
SHA256
be0dd7ccf4afd01a983c03badb2521aadf5a165d24f76355313e0bc419e166a2
-
SHA512
6b431c21d354054c1492743fef7f6b11a4af3deed71fa55430f9297142cef701584cea29d9c2315b206548d482bf453d99584e5caba9c6a2e5e689f66aaa7eed
-
SSDEEP
12288:/U5rCOTeiDLXgY9HK5SeDlgXMH3o6UQNZ:/UQOJDLXbijDlVH3nrN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1464 6E98.tmp 4108 6F63.tmp 3488 703E.tmp 4868 7119.tmp 2332 71E4.tmp 2040 7261.tmp 3872 731D.tmp 3192 7426.tmp 4040 74E2.tmp 4984 75DC.tmp 4676 7668.tmp 640 7714.tmp 3060 77D0.tmp 4720 78F9.tmp 4872 79E3.tmp 888 7ABE.tmp 1140 7BB8.tmp 2624 7CA2.tmp 4468 7DBB.tmp 2416 7E77.tmp 4500 7F03.tmp 1804 7FBF.tmp 2080 806B.tmp 4260 80E8.tmp 3892 81A3.tmp 4704 825F.tmp 2204 832A.tmp 2888 8462.tmp 4304 84DF.tmp 3152 857C.tmp 4836 8608.tmp 2956 86C4.tmp 4120 8770.tmp 3912 87FC.tmp 1772 8879.tmp 2640 88F6.tmp 5104 8973.tmp 4692 8A10.tmp 4616 8A9C.tmp 2020 8B19.tmp 4208 8BB5.tmp 3564 8C52.tmp 2756 8CEE.tmp 2200 8D9A.tmp 952 8E84.tmp 5084 8F11.tmp 2116 8FBD.tmp 1500 9049.tmp 3000 90C6.tmp 1368 9182.tmp 2584 920E.tmp 4628 927C.tmp 544 9308.tmp 1672 9366.tmp 4064 93D4.tmp 3684 9460.tmp 4688 94ED.tmp 3532 955A.tmp 2960 95F6.tmp 3872 9664.tmp 1480 96C2.tmp 3236 973F.tmp 4676 97AC.tmp 3736 9858.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4920 wrote to memory of 1464 4920 ae923afc9cac42e345b79c32578b9064_mafia_JC.exe 83 PID 4920 wrote to memory of 1464 4920 ae923afc9cac42e345b79c32578b9064_mafia_JC.exe 83 PID 4920 wrote to memory of 1464 4920 ae923afc9cac42e345b79c32578b9064_mafia_JC.exe 83 PID 1464 wrote to memory of 4108 1464 6E98.tmp 84 PID 1464 wrote to memory of 4108 1464 6E98.tmp 84 PID 1464 wrote to memory of 4108 1464 6E98.tmp 84 PID 4108 wrote to memory of 3488 4108 6F63.tmp 85 PID 4108 wrote to memory of 3488 4108 6F63.tmp 85 PID 4108 wrote to memory of 3488 4108 6F63.tmp 85 PID 3488 wrote to memory of 4868 3488 703E.tmp 86 PID 3488 wrote to memory of 4868 3488 703E.tmp 86 PID 3488 wrote to memory of 4868 3488 703E.tmp 86 PID 4868 wrote to memory of 2332 4868 7119.tmp 87 PID 4868 wrote to memory of 2332 4868 7119.tmp 87 PID 4868 wrote to memory of 2332 4868 7119.tmp 87 PID 2332 wrote to memory of 2040 2332 71E4.tmp 88 PID 2332 wrote to memory of 2040 2332 71E4.tmp 88 PID 2332 wrote to memory of 2040 2332 71E4.tmp 88 PID 2040 wrote to memory of 3872 2040 7261.tmp 89 PID 2040 wrote to memory of 3872 2040 7261.tmp 89 PID 2040 wrote to memory of 3872 2040 7261.tmp 89 PID 3872 wrote to memory of 3192 3872 731D.tmp 90 PID 3872 wrote to memory of 3192 3872 731D.tmp 90 PID 3872 wrote to memory of 3192 3872 731D.tmp 90 PID 3192 wrote to memory of 4040 3192 7426.tmp 91 PID 3192 wrote to memory of 4040 3192 7426.tmp 91 PID 3192 wrote to memory of 4040 3192 7426.tmp 91 PID 4040 wrote to memory of 4984 4040 74E2.tmp 92 PID 4040 wrote to memory of 4984 4040 74E2.tmp 92 PID 4040 wrote to memory of 4984 4040 74E2.tmp 92 PID 4984 wrote to memory of 4676 4984 75DC.tmp 93 PID 4984 wrote to memory of 4676 4984 75DC.tmp 93 PID 4984 wrote to memory of 4676 4984 75DC.tmp 93 PID 4676 wrote to memory of 640 4676 7668.tmp 94 PID 4676 wrote to memory of 640 4676 7668.tmp 94 PID 4676 wrote to memory of 640 4676 7668.tmp 94 PID 640 wrote to memory of 3060 640 7714.tmp 95 PID 640 wrote to memory of 3060 640 7714.tmp 95 PID 640 wrote to memory of 3060 640 7714.tmp 95 PID 3060 wrote to memory of 4720 3060 77D0.tmp 96 PID 3060 wrote to memory of 4720 3060 77D0.tmp 96 PID 3060 wrote to memory of 4720 3060 77D0.tmp 96 PID 4720 wrote to memory of 4872 4720 78F9.tmp 99 PID 4720 wrote to memory of 4872 4720 78F9.tmp 99 PID 4720 wrote to memory of 4872 4720 78F9.tmp 99 PID 4872 wrote to memory of 888 4872 79E3.tmp 100 PID 4872 wrote to memory of 888 4872 79E3.tmp 100 PID 4872 wrote to memory of 888 4872 79E3.tmp 100 PID 888 wrote to memory of 1140 888 7ABE.tmp 101 PID 888 wrote to memory of 1140 888 7ABE.tmp 101 PID 888 wrote to memory of 1140 888 7ABE.tmp 101 PID 1140 wrote to memory of 2624 1140 7BB8.tmp 102 PID 1140 wrote to memory of 2624 1140 7BB8.tmp 102 PID 1140 wrote to memory of 2624 1140 7BB8.tmp 102 PID 2624 wrote to memory of 4468 2624 7CA2.tmp 103 PID 2624 wrote to memory of 4468 2624 7CA2.tmp 103 PID 2624 wrote to memory of 4468 2624 7CA2.tmp 103 PID 4468 wrote to memory of 2416 4468 7DBB.tmp 105 PID 4468 wrote to memory of 2416 4468 7DBB.tmp 105 PID 4468 wrote to memory of 2416 4468 7DBB.tmp 105 PID 2416 wrote to memory of 4500 2416 7E77.tmp 106 PID 2416 wrote to memory of 4500 2416 7E77.tmp 106 PID 2416 wrote to memory of 4500 2416 7E77.tmp 106 PID 4500 wrote to memory of 1804 4500 7F03.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae923afc9cac42e345b79c32578b9064_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\ae923afc9cac42e345b79c32578b9064_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\6F63.tmp"C:\Users\Admin\AppData\Local\Temp\6F63.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\7714.tmp"C:\Users\Admin\AppData\Local\Temp\7714.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\78F9.tmp"C:\Users\Admin\AppData\Local\Temp\78F9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\7E77.tmp"C:\Users\Admin\AppData\Local\Temp\7E77.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\7F03.tmp"C:\Users\Admin\AppData\Local\Temp\7F03.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"23⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"24⤵
- Executes dropped EXE
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\80E8.tmp"C:\Users\Admin\AppData\Local\Temp\80E8.tmp"25⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\81A3.tmp"C:\Users\Admin\AppData\Local\Temp\81A3.tmp"26⤵
- Executes dropped EXE
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\825F.tmp"C:\Users\Admin\AppData\Local\Temp\825F.tmp"27⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"28⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\8462.tmp"C:\Users\Admin\AppData\Local\Temp\8462.tmp"29⤵
- Executes dropped EXE
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\84DF.tmp"C:\Users\Admin\AppData\Local\Temp\84DF.tmp"30⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\857C.tmp"C:\Users\Admin\AppData\Local\Temp\857C.tmp"31⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\8608.tmp"C:\Users\Admin\AppData\Local\Temp\8608.tmp"32⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\86C4.tmp"C:\Users\Admin\AppData\Local\Temp\86C4.tmp"33⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\8770.tmp"C:\Users\Admin\AppData\Local\Temp\8770.tmp"34⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\87FC.tmp"C:\Users\Admin\AppData\Local\Temp\87FC.tmp"35⤵
- Executes dropped EXE
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\8879.tmp"C:\Users\Admin\AppData\Local\Temp\8879.tmp"36⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\88F6.tmp"C:\Users\Admin\AppData\Local\Temp\88F6.tmp"37⤵
- Executes dropped EXE
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\8973.tmp"C:\Users\Admin\AppData\Local\Temp\8973.tmp"38⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\8A10.tmp"C:\Users\Admin\AppData\Local\Temp\8A10.tmp"39⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"40⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\8B19.tmp"C:\Users\Admin\AppData\Local\Temp\8B19.tmp"41⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"42⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"43⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"44⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"45⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\8E84.tmp"C:\Users\Admin\AppData\Local\Temp\8E84.tmp"46⤵
- Executes dropped EXE
PID:952 -
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"47⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"48⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\9049.tmp"C:\Users\Admin\AppData\Local\Temp\9049.tmp"49⤵
- Executes dropped EXE
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"50⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\9182.tmp"C:\Users\Admin\AppData\Local\Temp\9182.tmp"51⤵
- Executes dropped EXE
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"52⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\927C.tmp"C:\Users\Admin\AppData\Local\Temp\927C.tmp"53⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\9308.tmp"C:\Users\Admin\AppData\Local\Temp\9308.tmp"54⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\9366.tmp"C:\Users\Admin\AppData\Local\Temp\9366.tmp"55⤵
- Executes dropped EXE
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"56⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\9460.tmp"C:\Users\Admin\AppData\Local\Temp\9460.tmp"57⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\94ED.tmp"C:\Users\Admin\AppData\Local\Temp\94ED.tmp"58⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"59⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\95F6.tmp"C:\Users\Admin\AppData\Local\Temp\95F6.tmp"60⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\9664.tmp"C:\Users\Admin\AppData\Local\Temp\9664.tmp"61⤵
- Executes dropped EXE
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\96C2.tmp"C:\Users\Admin\AppData\Local\Temp\96C2.tmp"62⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"63⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"64⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"65⤵
- Executes dropped EXE
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\98D5.tmp"C:\Users\Admin\AppData\Local\Temp\98D5.tmp"66⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"67⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"68⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"69⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"70⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"71⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"72⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"73⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"74⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"75⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\9E15.tmp"C:\Users\Admin\AppData\Local\Temp\9E15.tmp"76⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"77⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"78⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"79⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"80⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\A095.tmp"C:\Users\Admin\AppData\Local\Temp\A095.tmp"81⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\A103.tmp"C:\Users\Admin\AppData\Local\Temp\A103.tmp"82⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\A19F.tmp"C:\Users\Admin\AppData\Local\Temp\A19F.tmp"83⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"84⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"85⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"86⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\A383.tmp"C:\Users\Admin\AppData\Local\Temp\A383.tmp"87⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\A41F.tmp"C:\Users\Admin\AppData\Local\Temp\A41F.tmp"88⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"89⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"90⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"91⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"92⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"93⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"94⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"95⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"96⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"97⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"98⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"99⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"100⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"101⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"102⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"103⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"104⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"105⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\AD95.tmp"C:\Users\Admin\AppData\Local\Temp\AD95.tmp"106⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"107⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\AECE.tmp"C:\Users\Admin\AppData\Local\Temp\AECE.tmp"108⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"109⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"110⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\B093.tmp"C:\Users\Admin\AppData\Local\Temp\B093.tmp"111⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\B12F.tmp"C:\Users\Admin\AppData\Local\Temp\B12F.tmp"112⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"113⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\B258.tmp"C:\Users\Admin\AppData\Local\Temp\B258.tmp"114⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"115⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\B391.tmp"C:\Users\Admin\AppData\Local\Temp\B391.tmp"116⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\B41D.tmp"C:\Users\Admin\AppData\Local\Temp\B41D.tmp"117⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"118⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\B536.tmp"C:\Users\Admin\AppData\Local\Temp\B536.tmp"119⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\B594.tmp"C:\Users\Admin\AppData\Local\Temp\B594.tmp"120⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"121⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"122⤵PID:3532
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-