Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
27/08/2023, 18:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ba0561cf6aba1400f64f6530d24ea154_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
ba0561cf6aba1400f64f6530d24ea154_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
ba0561cf6aba1400f64f6530d24ea154_mafia_JC.exe
-
Size
486KB
-
MD5
ba0561cf6aba1400f64f6530d24ea154
-
SHA1
951efb225093a9b122370d64f529d224bf2b35fe
-
SHA256
52cdca4f08ebd8a416e40022a09af7098ce26063961bbb3b4f4e7d1fe62c002f
-
SHA512
52cea299d3ffb87ca4368fb7bc8f69051e05c1b49860bfe34f7c711132b63422e4fbd412518aba3e3abbdae4e803a21e5370d151bdf67e1f1ab095ef60a767a2
-
SSDEEP
12288:oU5rCOTeiDhdyH0ZHfltqChCnMCvaAqMONZ:oUQOJDhdzHfqCARON
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 752 6774.tmp 4336 685F.tmp 756 6959.tmp 2968 6A14.tmp 2196 6ADF.tmp 4844 6BBA.tmp 3976 6C95.tmp 3572 6D41.tmp 2824 6E3B.tmp 5012 6EE6.tmp 3460 6F83.tmp 4176 702F.tmp 400 70DA.tmp 1580 71E4.tmp 4708 7251.tmp 2284 72AF.tmp 1304 735B.tmp 3232 73F7.tmp 4188 753F.tmp 3264 75CC.tmp 4796 7659.tmp 1772 7753.tmp 2664 787C.tmp 3424 7918.tmp 1476 79F3.tmp 4784 7A8F.tmp 2848 7B5A.tmp 3504 7C64.tmp 2220 7D2F.tmp 4388 7DFA.tmp 5036 7EE4.tmp 2452 7FA0.tmp 3784 801D.tmp 4276 807A.tmp 2688 80E8.tmp 2060 8165.tmp 3104 8201.tmp 1516 829D.tmp 4428 833A.tmp 2376 83C6.tmp 3092 8491.tmp 4940 852E.tmp 1868 85BA.tmp 4040 8656.tmp 3748 86D3.tmp 4916 8770.tmp 1380 87FC.tmp 1148 886A.tmp 4280 8916.tmp 896 8993.tmp 228 8A2F.tmp 3732 8A9C.tmp 4592 8B19.tmp 4336 8BA6.tmp 3384 8C23.tmp 1680 8CBF.tmp 4472 8D4C.tmp 2196 8DC9.tmp 1552 8E36.tmp 4520 8F01.tmp 2756 8F9D.tmp 2984 901A.tmp 1248 90B7.tmp 3188 9143.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1372 wrote to memory of 752 1372 ba0561cf6aba1400f64f6530d24ea154_mafia_JC.exe 82 PID 1372 wrote to memory of 752 1372 ba0561cf6aba1400f64f6530d24ea154_mafia_JC.exe 82 PID 1372 wrote to memory of 752 1372 ba0561cf6aba1400f64f6530d24ea154_mafia_JC.exe 82 PID 752 wrote to memory of 4336 752 6774.tmp 83 PID 752 wrote to memory of 4336 752 6774.tmp 83 PID 752 wrote to memory of 4336 752 6774.tmp 83 PID 4336 wrote to memory of 756 4336 685F.tmp 84 PID 4336 wrote to memory of 756 4336 685F.tmp 84 PID 4336 wrote to memory of 756 4336 685F.tmp 84 PID 756 wrote to memory of 2968 756 6959.tmp 85 PID 756 wrote to memory of 2968 756 6959.tmp 85 PID 756 wrote to memory of 2968 756 6959.tmp 85 PID 2968 wrote to memory of 2196 2968 6A14.tmp 86 PID 2968 wrote to memory of 2196 2968 6A14.tmp 86 PID 2968 wrote to memory of 2196 2968 6A14.tmp 86 PID 2196 wrote to memory of 4844 2196 6ADF.tmp 87 PID 2196 wrote to memory of 4844 2196 6ADF.tmp 87 PID 2196 wrote to memory of 4844 2196 6ADF.tmp 87 PID 4844 wrote to memory of 3976 4844 6BBA.tmp 88 PID 4844 wrote to memory of 3976 4844 6BBA.tmp 88 PID 4844 wrote to memory of 3976 4844 6BBA.tmp 88 PID 3976 wrote to memory of 3572 3976 6C95.tmp 89 PID 3976 wrote to memory of 3572 3976 6C95.tmp 89 PID 3976 wrote to memory of 3572 3976 6C95.tmp 89 PID 3572 wrote to memory of 2824 3572 6D41.tmp 90 PID 3572 wrote to memory of 2824 3572 6D41.tmp 90 PID 3572 wrote to memory of 2824 3572 6D41.tmp 90 PID 2824 wrote to memory of 5012 2824 6E3B.tmp 91 PID 2824 wrote to memory of 5012 2824 6E3B.tmp 91 PID 2824 wrote to memory of 5012 2824 6E3B.tmp 91 PID 5012 wrote to memory of 3460 5012 6EE6.tmp 92 PID 5012 wrote to memory of 3460 5012 6EE6.tmp 92 PID 5012 wrote to memory of 3460 5012 6EE6.tmp 92 PID 3460 wrote to memory of 4176 3460 6F83.tmp 93 PID 3460 wrote to memory of 4176 3460 6F83.tmp 93 PID 3460 wrote to memory of 4176 3460 6F83.tmp 93 PID 4176 wrote to memory of 400 4176 702F.tmp 94 PID 4176 wrote to memory of 400 4176 702F.tmp 94 PID 4176 wrote to memory of 400 4176 702F.tmp 94 PID 400 wrote to memory of 1580 400 70DA.tmp 95 PID 400 wrote to memory of 1580 400 70DA.tmp 95 PID 400 wrote to memory of 1580 400 70DA.tmp 95 PID 1580 wrote to memory of 4708 1580 71E4.tmp 97 PID 1580 wrote to memory of 4708 1580 71E4.tmp 97 PID 1580 wrote to memory of 4708 1580 71E4.tmp 97 PID 4708 wrote to memory of 2284 4708 7251.tmp 98 PID 4708 wrote to memory of 2284 4708 7251.tmp 98 PID 4708 wrote to memory of 2284 4708 7251.tmp 98 PID 2284 wrote to memory of 1304 2284 72AF.tmp 99 PID 2284 wrote to memory of 1304 2284 72AF.tmp 99 PID 2284 wrote to memory of 1304 2284 72AF.tmp 99 PID 1304 wrote to memory of 3232 1304 735B.tmp 100 PID 1304 wrote to memory of 3232 1304 735B.tmp 100 PID 1304 wrote to memory of 3232 1304 735B.tmp 100 PID 3232 wrote to memory of 4188 3232 73F7.tmp 101 PID 3232 wrote to memory of 4188 3232 73F7.tmp 101 PID 3232 wrote to memory of 4188 3232 73F7.tmp 101 PID 4188 wrote to memory of 3264 4188 753F.tmp 102 PID 4188 wrote to memory of 3264 4188 753F.tmp 102 PID 4188 wrote to memory of 3264 4188 753F.tmp 102 PID 3264 wrote to memory of 4796 3264 75CC.tmp 103 PID 3264 wrote to memory of 4796 3264 75CC.tmp 103 PID 3264 wrote to memory of 4796 3264 75CC.tmp 103 PID 4796 wrote to memory of 1772 4796 7659.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba0561cf6aba1400f64f6530d24ea154_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\ba0561cf6aba1400f64f6530d24ea154_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\70DA.tmp"C:\Users\Admin\AppData\Local\Temp\70DA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\73F7.tmp"C:\Users\Admin\AppData\Local\Temp\73F7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\7659.tmp"C:\Users\Admin\AppData\Local\Temp\7659.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\7753.tmp"C:\Users\Admin\AppData\Local\Temp\7753.tmp"23⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"24⤵
- Executes dropped EXE
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\7918.tmp"C:\Users\Admin\AppData\Local\Temp\7918.tmp"25⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"26⤵
- Executes dropped EXE
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"27⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"28⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\7C64.tmp"C:\Users\Admin\AppData\Local\Temp\7C64.tmp"29⤵
- Executes dropped EXE
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"30⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"31⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"32⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"33⤵
- Executes dropped EXE
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\801D.tmp"C:\Users\Admin\AppData\Local\Temp\801D.tmp"34⤵
- Executes dropped EXE
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\807A.tmp"C:\Users\Admin\AppData\Local\Temp\807A.tmp"35⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\80E8.tmp"C:\Users\Admin\AppData\Local\Temp\80E8.tmp"36⤵
- Executes dropped EXE
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\8165.tmp"C:\Users\Admin\AppData\Local\Temp\8165.tmp"37⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\8201.tmp"C:\Users\Admin\AppData\Local\Temp\8201.tmp"38⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\829D.tmp"C:\Users\Admin\AppData\Local\Temp\829D.tmp"39⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\833A.tmp"C:\Users\Admin\AppData\Local\Temp\833A.tmp"40⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\83C6.tmp"C:\Users\Admin\AppData\Local\Temp\83C6.tmp"41⤵
- Executes dropped EXE
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\8491.tmp"C:\Users\Admin\AppData\Local\Temp\8491.tmp"42⤵
- Executes dropped EXE
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\852E.tmp"C:\Users\Admin\AppData\Local\Temp\852E.tmp"43⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\85BA.tmp"C:\Users\Admin\AppData\Local\Temp\85BA.tmp"44⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"45⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\86D3.tmp"C:\Users\Admin\AppData\Local\Temp\86D3.tmp"46⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\8770.tmp"C:\Users\Admin\AppData\Local\Temp\8770.tmp"47⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\87FC.tmp"C:\Users\Admin\AppData\Local\Temp\87FC.tmp"48⤵
- Executes dropped EXE
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\886A.tmp"C:\Users\Admin\AppData\Local\Temp\886A.tmp"49⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\8916.tmp"C:\Users\Admin\AppData\Local\Temp\8916.tmp"50⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\8993.tmp"C:\Users\Admin\AppData\Local\Temp\8993.tmp"51⤵
- Executes dropped EXE
PID:896 -
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"52⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"53⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\8B19.tmp"C:\Users\Admin\AppData\Local\Temp\8B19.tmp"54⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"55⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\8C23.tmp"C:\Users\Admin\AppData\Local\Temp\8C23.tmp"56⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"57⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"58⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"59⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp"60⤵
- Executes dropped EXE
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\8F01.tmp"C:\Users\Admin\AppData\Local\Temp\8F01.tmp"61⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"62⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\901A.tmp"C:\Users\Admin\AppData\Local\Temp\901A.tmp"63⤵
- Executes dropped EXE
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\90B7.tmp"C:\Users\Admin\AppData\Local\Temp\90B7.tmp"64⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\9143.tmp"C:\Users\Admin\AppData\Local\Temp\9143.tmp"65⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\91EF.tmp"C:\Users\Admin\AppData\Local\Temp\91EF.tmp"66⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\926C.tmp"C:\Users\Admin\AppData\Local\Temp\926C.tmp"67⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"68⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\9395.tmp"C:\Users\Admin\AppData\Local\Temp\9395.tmp"69⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"70⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\94CE.tmp"C:\Users\Admin\AppData\Local\Temp\94CE.tmp"71⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"72⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\95E7.tmp"C:\Users\Admin\AppData\Local\Temp\95E7.tmp"73⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\9664.tmp"C:\Users\Admin\AppData\Local\Temp\9664.tmp"74⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\9710.tmp"C:\Users\Admin\AppData\Local\Temp\9710.tmp"75⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"76⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"77⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\9896.tmp"C:\Users\Admin\AppData\Local\Temp\9896.tmp"78⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\9904.tmp"C:\Users\Admin\AppData\Local\Temp\9904.tmp"79⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"80⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"81⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"82⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"83⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"84⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"85⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"86⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"87⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"88⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"89⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"90⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"91⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"92⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"93⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"94⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"95⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\A24B.tmp"C:\Users\Admin\AppData\Local\Temp\A24B.tmp"96⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"97⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\A325.tmp"C:\Users\Admin\AppData\Local\Temp\A325.tmp"98⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"99⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"100⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"101⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"102⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"103⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"104⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"105⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"106⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\A817.tmp"C:\Users\Admin\AppData\Local\Temp\A817.tmp"107⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\A884.tmp"C:\Users\Admin\AppData\Local\Temp\A884.tmp"108⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\A921.tmp"C:\Users\Admin\AppData\Local\Temp\A921.tmp"109⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\A99E.tmp"C:\Users\Admin\AppData\Local\Temp\A99E.tmp"110⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"111⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"112⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\AB44.tmp"C:\Users\Admin\AppData\Local\Temp\AB44.tmp"113⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"114⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"115⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"116⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"117⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"118⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\AECE.tmp"C:\Users\Admin\AppData\Local\Temp\AECE.tmp"119⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"120⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\B045.tmp"C:\Users\Admin\AppData\Local\Temp\B045.tmp"121⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"122⤵PID:1688
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-