Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
27/08/2023, 15:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
af8f0e09299c610bddabae9487cc23c9_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
af8f0e09299c610bddabae9487cc23c9_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
af8f0e09299c610bddabae9487cc23c9_mafia_JC.exe
-
Size
486KB
-
MD5
af8f0e09299c610bddabae9487cc23c9
-
SHA1
3e28ed57a384eeb3fcb3f0729d16e041f1fb29d5
-
SHA256
5e93db141743a5ed9ce5429fad038553510164e54966c68b74c2118fafbe8925
-
SHA512
15257075c9431416904a11796fe32b35d02697372a4cf774c7d908235256ef3c6fbc67ea807b129a28e86d591b67deae9666be2c06d133be9bb949fc789be357
-
SSDEEP
12288:UU5rCOTeiD/gwZl9XV1Sexq+96KFOic1eRHNZ:UUQOJD/rL31JQ+oK8/WHN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4192 784D.tmp 2772 7937.tmp 4536 7A12.tmp 4020 7ACD.tmp 4976 7B6A.tmp 2548 7C15.tmp 4304 7D00.tmp 212 7E38.tmp 4720 7F13.tmp 4768 7FFD.tmp 2736 809A.tmp 3908 8146.tmp 3096 82DC.tmp 3496 8397.tmp 3320 8462.tmp 5092 851E.tmp 3420 85CA.tmp 4184 86A5.tmp 4668 878F.tmp 1684 8889.tmp 4916 8935.tmp 5060 8A00.tmp 1288 8A7D.tmp 4408 8B0A.tmp 2468 8BC5.tmp 3080 8C81.tmp 3068 8D5B.tmp 2352 8E75.tmp 1644 8F4F.tmp 4376 900B.tmp 3792 90C6.tmp 1468 9153.tmp 3924 91D0.tmp 3676 925D.tmp 1744 92DA.tmp 3052 9357.tmp 4576 93E3.tmp 2612 949F.tmp 4104 952B.tmp 1816 95B8.tmp 1820 9654.tmp 1752 971F.tmp 2836 97BC.tmp 3480 98D5.tmp 628 9952.tmp 4388 99FE.tmp 1580 9A7B.tmp 3208 9B27.tmp 400 9BB3.tmp 1380 9C40.tmp 4348 9CEC.tmp 1932 9D88.tmp 808 9E05.tmp 540 9E92.tmp 4212 9F3D.tmp 3408 9FDA.tmp 3112 A066.tmp 3856 A0E3.tmp 4940 A170.tmp 3340 A1FD.tmp 1428 A2B8.tmp 1660 A335.tmp 3632 A3A2.tmp 3176 A42F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2168 wrote to memory of 4192 2168 af8f0e09299c610bddabae9487cc23c9_mafia_JC.exe 81 PID 2168 wrote to memory of 4192 2168 af8f0e09299c610bddabae9487cc23c9_mafia_JC.exe 81 PID 2168 wrote to memory of 4192 2168 af8f0e09299c610bddabae9487cc23c9_mafia_JC.exe 81 PID 4192 wrote to memory of 2772 4192 784D.tmp 82 PID 4192 wrote to memory of 2772 4192 784D.tmp 82 PID 4192 wrote to memory of 2772 4192 784D.tmp 82 PID 2772 wrote to memory of 4536 2772 7937.tmp 83 PID 2772 wrote to memory of 4536 2772 7937.tmp 83 PID 2772 wrote to memory of 4536 2772 7937.tmp 83 PID 4536 wrote to memory of 4020 4536 7A12.tmp 84 PID 4536 wrote to memory of 4020 4536 7A12.tmp 84 PID 4536 wrote to memory of 4020 4536 7A12.tmp 84 PID 4020 wrote to memory of 4976 4020 7ACD.tmp 85 PID 4020 wrote to memory of 4976 4020 7ACD.tmp 85 PID 4020 wrote to memory of 4976 4020 7ACD.tmp 85 PID 4976 wrote to memory of 2548 4976 7B6A.tmp 86 PID 4976 wrote to memory of 2548 4976 7B6A.tmp 86 PID 4976 wrote to memory of 2548 4976 7B6A.tmp 86 PID 2548 wrote to memory of 4304 2548 7C15.tmp 87 PID 2548 wrote to memory of 4304 2548 7C15.tmp 87 PID 2548 wrote to memory of 4304 2548 7C15.tmp 87 PID 4304 wrote to memory of 212 4304 7D00.tmp 88 PID 4304 wrote to memory of 212 4304 7D00.tmp 88 PID 4304 wrote to memory of 212 4304 7D00.tmp 88 PID 212 wrote to memory of 4720 212 7E38.tmp 89 PID 212 wrote to memory of 4720 212 7E38.tmp 89 PID 212 wrote to memory of 4720 212 7E38.tmp 89 PID 4720 wrote to memory of 4768 4720 7F13.tmp 90 PID 4720 wrote to memory of 4768 4720 7F13.tmp 90 PID 4720 wrote to memory of 4768 4720 7F13.tmp 90 PID 4768 wrote to memory of 2736 4768 7FFD.tmp 91 PID 4768 wrote to memory of 2736 4768 7FFD.tmp 91 PID 4768 wrote to memory of 2736 4768 7FFD.tmp 91 PID 2736 wrote to memory of 3908 2736 809A.tmp 92 PID 2736 wrote to memory of 3908 2736 809A.tmp 92 PID 2736 wrote to memory of 3908 2736 809A.tmp 92 PID 3908 wrote to memory of 3096 3908 8146.tmp 93 PID 3908 wrote to memory of 3096 3908 8146.tmp 93 PID 3908 wrote to memory of 3096 3908 8146.tmp 93 PID 3096 wrote to memory of 3496 3096 82DC.tmp 96 PID 3096 wrote to memory of 3496 3096 82DC.tmp 96 PID 3096 wrote to memory of 3496 3096 82DC.tmp 96 PID 3496 wrote to memory of 3320 3496 8397.tmp 97 PID 3496 wrote to memory of 3320 3496 8397.tmp 97 PID 3496 wrote to memory of 3320 3496 8397.tmp 97 PID 3320 wrote to memory of 5092 3320 8462.tmp 98 PID 3320 wrote to memory of 5092 3320 8462.tmp 98 PID 3320 wrote to memory of 5092 3320 8462.tmp 98 PID 5092 wrote to memory of 3420 5092 851E.tmp 99 PID 5092 wrote to memory of 3420 5092 851E.tmp 99 PID 5092 wrote to memory of 3420 5092 851E.tmp 99 PID 3420 wrote to memory of 4184 3420 85CA.tmp 100 PID 3420 wrote to memory of 4184 3420 85CA.tmp 100 PID 3420 wrote to memory of 4184 3420 85CA.tmp 100 PID 4184 wrote to memory of 4668 4184 86A5.tmp 101 PID 4184 wrote to memory of 4668 4184 86A5.tmp 101 PID 4184 wrote to memory of 4668 4184 86A5.tmp 101 PID 4668 wrote to memory of 1684 4668 878F.tmp 103 PID 4668 wrote to memory of 1684 4668 878F.tmp 103 PID 4668 wrote to memory of 1684 4668 878F.tmp 103 PID 1684 wrote to memory of 4916 1684 8889.tmp 104 PID 1684 wrote to memory of 4916 1684 8889.tmp 104 PID 1684 wrote to memory of 4916 1684 8889.tmp 104 PID 4916 wrote to memory of 5060 4916 8935.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\af8f0e09299c610bddabae9487cc23c9_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\af8f0e09299c610bddabae9487cc23c9_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\7937.tmp"C:\Users\Admin\AppData\Local\Temp\7937.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\7A12.tmp"C:\Users\Admin\AppData\Local\Temp\7A12.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\7C15.tmp"C:\Users\Admin\AppData\Local\Temp\7C15.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\7D00.tmp"C:\Users\Admin\AppData\Local\Temp\7D00.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\7E38.tmp"C:\Users\Admin\AppData\Local\Temp\7E38.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\7F13.tmp"C:\Users\Admin\AppData\Local\Temp\7F13.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\809A.tmp"C:\Users\Admin\AppData\Local\Temp\809A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\8146.tmp"C:\Users\Admin\AppData\Local\Temp\8146.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\82DC.tmp"C:\Users\Admin\AppData\Local\Temp\82DC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\8462.tmp"C:\Users\Admin\AppData\Local\Temp\8462.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\851E.tmp"C:\Users\Admin\AppData\Local\Temp\851E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\85CA.tmp"C:\Users\Admin\AppData\Local\Temp\85CA.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\86A5.tmp"C:\Users\Admin\AppData\Local\Temp\86A5.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\878F.tmp"C:\Users\Admin\AppData\Local\Temp\878F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\8889.tmp"C:\Users\Admin\AppData\Local\Temp\8889.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\8935.tmp"C:\Users\Admin\AppData\Local\Temp\8935.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\8A00.tmp"C:\Users\Admin\AppData\Local\Temp\8A00.tmp"23⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"24⤵
- Executes dropped EXE
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"25⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"26⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\8C81.tmp"C:\Users\Admin\AppData\Local\Temp\8C81.tmp"27⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"28⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\8E75.tmp"C:\Users\Admin\AppData\Local\Temp\8E75.tmp"29⤵
- Executes dropped EXE
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"30⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\900B.tmp"C:\Users\Admin\AppData\Local\Temp\900B.tmp"31⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"32⤵
- Executes dropped EXE
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\9153.tmp"C:\Users\Admin\AppData\Local\Temp\9153.tmp"33⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\91D0.tmp"C:\Users\Admin\AppData\Local\Temp\91D0.tmp"34⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"35⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\92DA.tmp"C:\Users\Admin\AppData\Local\Temp\92DA.tmp"36⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"37⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"38⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"39⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"40⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\95B8.tmp"C:\Users\Admin\AppData\Local\Temp\95B8.tmp"41⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\9654.tmp"C:\Users\Admin\AppData\Local\Temp\9654.tmp"42⤵
- Executes dropped EXE
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"43⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\97BC.tmp"C:\Users\Admin\AppData\Local\Temp\97BC.tmp"44⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\98D5.tmp"C:\Users\Admin\AppData\Local\Temp\98D5.tmp"45⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\9952.tmp"C:\Users\Admin\AppData\Local\Temp\9952.tmp"46⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"47⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"48⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"49⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"50⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"51⤵
- Executes dropped EXE
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"52⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"53⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"54⤵
- Executes dropped EXE
PID:808 -
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"55⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"56⤵
- Executes dropped EXE
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"57⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\A066.tmp"C:\Users\Admin\AppData\Local\Temp\A066.tmp"58⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"59⤵
- Executes dropped EXE
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"60⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"61⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"62⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"63⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"64⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"65⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"66⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\A539.tmp"C:\Users\Admin\AppData\Local\Temp\A539.tmp"67⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"68⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\A662.tmp"C:\Users\Admin\AppData\Local\Temp\A662.tmp"69⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"70⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\A78A.tmp"C:\Users\Admin\AppData\Local\Temp\A78A.tmp"71⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"72⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\A884.tmp"C:\Users\Admin\AppData\Local\Temp\A884.tmp"73⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"74⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"75⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"76⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"77⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"78⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"79⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"80⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"81⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"82⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"83⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"84⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"85⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"86⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"87⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\B342.tmp"C:\Users\Admin\AppData\Local\Temp\B342.tmp"88⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"89⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"90⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"91⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"92⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"93⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\B73A.tmp"C:\Users\Admin\AppData\Local\Temp\B73A.tmp"94⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"95⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\B863.tmp"C:\Users\Admin\AppData\Local\Temp\B863.tmp"96⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"97⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\B98C.tmp"C:\Users\Admin\AppData\Local\Temp\B98C.tmp"98⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\BA09.tmp"C:\Users\Admin\AppData\Local\Temp\BA09.tmp"99⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"100⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"101⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"102⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\BC89.tmp"C:\Users\Admin\AppData\Local\Temp\BC89.tmp"103⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\BD26.tmp"C:\Users\Admin\AppData\Local\Temp\BD26.tmp"104⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"105⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"106⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\BEEB.tmp"C:\Users\Admin\AppData\Local\Temp\BEEB.tmp"107⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\BF77.tmp"C:\Users\Admin\AppData\Local\Temp\BF77.tmp"108⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"109⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\C071.tmp"C:\Users\Admin\AppData\Local\Temp\C071.tmp"110⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\C10E.tmp"C:\Users\Admin\AppData\Local\Temp\C10E.tmp"111⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\C18B.tmp"C:\Users\Admin\AppData\Local\Temp\C18B.tmp"112⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"113⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"114⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\C36F.tmp"C:\Users\Admin\AppData\Local\Temp\C36F.tmp"115⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\C42B.tmp"C:\Users\Admin\AppData\Local\Temp\C42B.tmp"116⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"117⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\C525.tmp"C:\Users\Admin\AppData\Local\Temp\C525.tmp"118⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"119⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\C64D.tmp"C:\Users\Admin\AppData\Local\Temp\C64D.tmp"120⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\C6EA.tmp"C:\Users\Admin\AppData\Local\Temp\C6EA.tmp"121⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\C796.tmp"C:\Users\Admin\AppData\Local\Temp\C796.tmp"122⤵PID:3856
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-