Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
27-08-2023 15:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
afb8a600e681bf2166e8b4bd65b1df78_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
afb8a600e681bf2166e8b4bd65b1df78_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
afb8a600e681bf2166e8b4bd65b1df78_mafia_JC.exe
-
Size
487KB
-
MD5
afb8a600e681bf2166e8b4bd65b1df78
-
SHA1
c44c5e070ef47e65db98928e42694305597464e9
-
SHA256
53c478cb0fd94e7dac3db6d559ff29e3c8fef06da04f98daa385819019fb4c11
-
SHA512
a2e0aab6a6f52a74d39fda56f64a5519315cb29a58ed388cee5d4c560d94db1f643a39a0ef7b0fcb489503361c82213d01a5df9252fd07980e7dd1700b13c5c7
-
SSDEEP
6144:zorf3lPvovsgZnqG2C7mOTeiLxDxL4/o2uv9gddX3i0L1rRIQsQLwUCH1CLgx959:yU5rCOTeiNB0o2uvI8IB+oLgx9+pCbZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1108 7C15.tmp 3700 7D4E.tmp 988 7E19.tmp 3848 7EF4.tmp 4172 7FBF.tmp 1496 804C.tmp 3792 80F7.tmp 2988 81F1.tmp 2376 828E.tmp 4404 832A.tmp 4456 83A7.tmp 1072 8443.tmp 2184 84D0.tmp 4452 85AB.tmp 908 86D3.tmp 1992 87BE.tmp 4580 886A.tmp 4964 88F6.tmp 4712 8983.tmp 3756 8A3E.tmp 4540 8B58.tmp 3492 8BF4.tmp 2932 8CCF.tmp 4544 8D6B.tmp 2168 8E07.tmp 3924 8EA3.tmp 3000 8F5F.tmp 2792 902A.tmp 4788 90F5.tmp 1012 9172.tmp 2332 923D.tmp 3012 92BA.tmp 4384 9395.tmp 2840 9412.tmp 4652 949F.tmp 1644 950C.tmp 3024 95A8.tmp 4348 9616.tmp 3828 96A2.tmp 4928 972F.tmp 468 97CB.tmp 416 9867.tmp 1624 9904.tmp 4768 99A0.tmp 5064 9A2D.tmp 1716 9AC9.tmp 1464 9B65.tmp 3124 9C01.tmp 4696 9C9E.tmp 940 9D49.tmp 404 9E05.tmp 4948 9E72.tmp 960 9F0F.tmp 2936 9FAB.tmp 988 A047.tmp 3952 A0E3.tmp 776 A160.tmp 2980 A1DD.tmp 4172 A299.tmp 4868 A306.tmp 5084 A393.tmp 4104 A43F.tmp 2376 A4CB.tmp 5068 A558.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3928 wrote to memory of 1108 3928 afb8a600e681bf2166e8b4bd65b1df78_mafia_JC.exe 81 PID 3928 wrote to memory of 1108 3928 afb8a600e681bf2166e8b4bd65b1df78_mafia_JC.exe 81 PID 3928 wrote to memory of 1108 3928 afb8a600e681bf2166e8b4bd65b1df78_mafia_JC.exe 81 PID 1108 wrote to memory of 3700 1108 7C15.tmp 82 PID 1108 wrote to memory of 3700 1108 7C15.tmp 82 PID 1108 wrote to memory of 3700 1108 7C15.tmp 82 PID 3700 wrote to memory of 988 3700 7D4E.tmp 83 PID 3700 wrote to memory of 988 3700 7D4E.tmp 83 PID 3700 wrote to memory of 988 3700 7D4E.tmp 83 PID 988 wrote to memory of 3848 988 7E19.tmp 84 PID 988 wrote to memory of 3848 988 7E19.tmp 84 PID 988 wrote to memory of 3848 988 7E19.tmp 84 PID 3848 wrote to memory of 4172 3848 7EF4.tmp 85 PID 3848 wrote to memory of 4172 3848 7EF4.tmp 85 PID 3848 wrote to memory of 4172 3848 7EF4.tmp 85 PID 4172 wrote to memory of 1496 4172 7FBF.tmp 86 PID 4172 wrote to memory of 1496 4172 7FBF.tmp 86 PID 4172 wrote to memory of 1496 4172 7FBF.tmp 86 PID 1496 wrote to memory of 3792 1496 804C.tmp 87 PID 1496 wrote to memory of 3792 1496 804C.tmp 87 PID 1496 wrote to memory of 3792 1496 804C.tmp 87 PID 3792 wrote to memory of 2988 3792 80F7.tmp 88 PID 3792 wrote to memory of 2988 3792 80F7.tmp 88 PID 3792 wrote to memory of 2988 3792 80F7.tmp 88 PID 2988 wrote to memory of 2376 2988 81F1.tmp 89 PID 2988 wrote to memory of 2376 2988 81F1.tmp 89 PID 2988 wrote to memory of 2376 2988 81F1.tmp 89 PID 2376 wrote to memory of 4404 2376 828E.tmp 90 PID 2376 wrote to memory of 4404 2376 828E.tmp 90 PID 2376 wrote to memory of 4404 2376 828E.tmp 90 PID 4404 wrote to memory of 4456 4404 832A.tmp 92 PID 4404 wrote to memory of 4456 4404 832A.tmp 92 PID 4404 wrote to memory of 4456 4404 832A.tmp 92 PID 4456 wrote to memory of 1072 4456 83A7.tmp 93 PID 4456 wrote to memory of 1072 4456 83A7.tmp 93 PID 4456 wrote to memory of 1072 4456 83A7.tmp 93 PID 1072 wrote to memory of 2184 1072 8443.tmp 94 PID 1072 wrote to memory of 2184 1072 8443.tmp 94 PID 1072 wrote to memory of 2184 1072 8443.tmp 94 PID 2184 wrote to memory of 4452 2184 84D0.tmp 95 PID 2184 wrote to memory of 4452 2184 84D0.tmp 95 PID 2184 wrote to memory of 4452 2184 84D0.tmp 95 PID 4452 wrote to memory of 908 4452 85AB.tmp 96 PID 4452 wrote to memory of 908 4452 85AB.tmp 96 PID 4452 wrote to memory of 908 4452 85AB.tmp 96 PID 908 wrote to memory of 1992 908 86D3.tmp 97 PID 908 wrote to memory of 1992 908 86D3.tmp 97 PID 908 wrote to memory of 1992 908 86D3.tmp 97 PID 1992 wrote to memory of 4580 1992 87BE.tmp 98 PID 1992 wrote to memory of 4580 1992 87BE.tmp 98 PID 1992 wrote to memory of 4580 1992 87BE.tmp 98 PID 4580 wrote to memory of 4964 4580 886A.tmp 99 PID 4580 wrote to memory of 4964 4580 886A.tmp 99 PID 4580 wrote to memory of 4964 4580 886A.tmp 99 PID 4964 wrote to memory of 4712 4964 88F6.tmp 102 PID 4964 wrote to memory of 4712 4964 88F6.tmp 102 PID 4964 wrote to memory of 4712 4964 88F6.tmp 102 PID 4712 wrote to memory of 3756 4712 8983.tmp 103 PID 4712 wrote to memory of 3756 4712 8983.tmp 103 PID 4712 wrote to memory of 3756 4712 8983.tmp 103 PID 3756 wrote to memory of 4540 3756 8A3E.tmp 104 PID 3756 wrote to memory of 4540 3756 8A3E.tmp 104 PID 3756 wrote to memory of 4540 3756 8A3E.tmp 104 PID 4540 wrote to memory of 3492 4540 8B58.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\afb8a600e681bf2166e8b4bd65b1df78_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\afb8a600e681bf2166e8b4bd65b1df78_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\7C15.tmp"C:\Users\Admin\AppData\Local\Temp\7C15.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\804C.tmp"C:\Users\Admin\AppData\Local\Temp\804C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\80F7.tmp"C:\Users\Admin\AppData\Local\Temp\80F7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\81F1.tmp"C:\Users\Admin\AppData\Local\Temp\81F1.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\828E.tmp"C:\Users\Admin\AppData\Local\Temp\828E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\83A7.tmp"C:\Users\Admin\AppData\Local\Temp\83A7.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\84D0.tmp"C:\Users\Admin\AppData\Local\Temp\84D0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\85AB.tmp"C:\Users\Admin\AppData\Local\Temp\85AB.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\86D3.tmp"C:\Users\Admin\AppData\Local\Temp\86D3.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\87BE.tmp"C:\Users\Admin\AppData\Local\Temp\87BE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\886A.tmp"C:\Users\Admin\AppData\Local\Temp\886A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\88F6.tmp"C:\Users\Admin\AppData\Local\Temp\88F6.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\8983.tmp"C:\Users\Admin\AppData\Local\Temp\8983.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\8B58.tmp"C:\Users\Admin\AppData\Local\Temp\8B58.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"23⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"24⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"25⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\8E07.tmp"C:\Users\Admin\AppData\Local\Temp\8E07.tmp"26⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"27⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"28⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\902A.tmp"C:\Users\Admin\AppData\Local\Temp\902A.tmp"29⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"30⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp"31⤵
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\923D.tmp"C:\Users\Admin\AppData\Local\Temp\923D.tmp"32⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"33⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\9395.tmp"C:\Users\Admin\AppData\Local\Temp\9395.tmp"34⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\9412.tmp"C:\Users\Admin\AppData\Local\Temp\9412.tmp"35⤵
- Executes dropped EXE
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"36⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\950C.tmp"C:\Users\Admin\AppData\Local\Temp\950C.tmp"37⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"38⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"39⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"40⤵
- Executes dropped EXE
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\972F.tmp"C:\Users\Admin\AppData\Local\Temp\972F.tmp"41⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\97CB.tmp"C:\Users\Admin\AppData\Local\Temp\97CB.tmp"42⤵
- Executes dropped EXE
PID:468 -
C:\Users\Admin\AppData\Local\Temp\9867.tmp"C:\Users\Admin\AppData\Local\Temp\9867.tmp"43⤵
- Executes dropped EXE
PID:416 -
C:\Users\Admin\AppData\Local\Temp\9904.tmp"C:\Users\Admin\AppData\Local\Temp\9904.tmp"44⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\99A0.tmp"C:\Users\Admin\AppData\Local\Temp\99A0.tmp"45⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"46⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"47⤵
- Executes dropped EXE
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"48⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"49⤵
- Executes dropped EXE
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"50⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"51⤵
- Executes dropped EXE
PID:940 -
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"52⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\9E72.tmp"C:\Users\Admin\AppData\Local\Temp\9E72.tmp"53⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"54⤵
- Executes dropped EXE
PID:960 -
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"55⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\A047.tmp"C:\Users\Admin\AppData\Local\Temp\A047.tmp"56⤵
- Executes dropped EXE
PID:988 -
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"57⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\A160.tmp"C:\Users\Admin\AppData\Local\Temp\A160.tmp"58⤵
- Executes dropped EXE
PID:776 -
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"59⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\A299.tmp"C:\Users\Admin\AppData\Local\Temp\A299.tmp"60⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\A306.tmp"C:\Users\Admin\AppData\Local\Temp\A306.tmp"61⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"62⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\A43F.tmp"C:\Users\Admin\AppData\Local\Temp\A43F.tmp"63⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"64⤵
- Executes dropped EXE
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"65⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"66⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\A662.tmp"C:\Users\Admin\AppData\Local\Temp\A662.tmp"67⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"68⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\A74C.tmp"C:\Users\Admin\AppData\Local\Temp\A74C.tmp"69⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"70⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"71⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"72⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\A940.tmp"C:\Users\Admin\AppData\Local\Temp\A940.tmp"73⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"74⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\AA59.tmp"C:\Users\Admin\AppData\Local\Temp\AA59.tmp"75⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"76⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\AB72.tmp"C:\Users\Admin\AppData\Local\Temp\AB72.tmp"77⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"78⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"79⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"80⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"81⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"82⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\AE60.tmp"C:\Users\Admin\AppData\Local\Temp\AE60.tmp"83⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"84⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"85⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"86⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\B093.tmp"C:\Users\Admin\AppData\Local\Temp\B093.tmp"87⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"88⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"89⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"90⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"91⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\B342.tmp"C:\Users\Admin\AppData\Local\Temp\B342.tmp"92⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"93⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"94⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"95⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\B546.tmp"C:\Users\Admin\AppData\Local\Temp\B546.tmp"96⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"97⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\B640.tmp"C:\Users\Admin\AppData\Local\Temp\B640.tmp"98⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"99⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\B769.tmp"C:\Users\Admin\AppData\Local\Temp\B769.tmp"100⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"101⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\B882.tmp"C:\Users\Admin\AppData\Local\Temp\B882.tmp"102⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\B91E.tmp"C:\Users\Admin\AppData\Local\Temp\B91E.tmp"103⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\B99B.tmp"C:\Users\Admin\AppData\Local\Temp\B99B.tmp"104⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\BA38.tmp"C:\Users\Admin\AppData\Local\Temp\BA38.tmp"105⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"106⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"107⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\BBED.tmp"C:\Users\Admin\AppData\Local\Temp\BBED.tmp"108⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\BC89.tmp"C:\Users\Admin\AppData\Local\Temp\BC89.tmp"109⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\BD06.tmp"C:\Users\Admin\AppData\Local\Temp\BD06.tmp"110⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\BD83.tmp"C:\Users\Admin\AppData\Local\Temp\BD83.tmp"111⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\BE20.tmp"C:\Users\Admin\AppData\Local\Temp\BE20.tmp"112⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"113⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\BF49.tmp"C:\Users\Admin\AppData\Local\Temp\BF49.tmp"114⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"115⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\C071.tmp"C:\Users\Admin\AppData\Local\Temp\C071.tmp"116⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"117⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"118⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\C256.tmp"C:\Users\Admin\AppData\Local\Temp\C256.tmp"119⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"120⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\C35F.tmp"C:\Users\Admin\AppData\Local\Temp\C35F.tmp"121⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"122⤵PID:2072
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-