Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
31/08/2023, 17:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f7afef94e80f9aba4e40c4698d1c9fd3_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
f7afef94e80f9aba4e40c4698d1c9fd3_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
f7afef94e80f9aba4e40c4698d1c9fd3_mafia_JC.exe
-
Size
488KB
-
MD5
f7afef94e80f9aba4e40c4698d1c9fd3
-
SHA1
5eb5dbd3f08082131cde4cb95d279ad4ef4d0ea5
-
SHA256
14fae3748d03840b2e03cd324d1fa0d3fbc44fa07dc67ca76d803faa1312634b
-
SHA512
de3e237874f274348897878a60c7e2a0f9852430c7d98c9e778137c5469338e81a3d0c809839850b9ef4255522484f1b1be799c2fc19db3b884b28730592fe55
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7L6HTj8ngbI9e0qg9VLKJWAe7tnw6RMRfAA+7:/U5rCOTeiDL6HAgbiegJd7D11vNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4708 783D.tmp 3860 78E9.tmp 4572 79B4.tmp 4732 7A60.tmp 2592 7B0C.tmp 4980 7BB8.tmp 2852 7C54.tmp 2184 7D1F.tmp 3768 7E09.tmp 3732 7EA6.tmp 3116 8462.tmp 4176 84FF.tmp 4676 858B.tmp 4612 8608.tmp 4300 8695.tmp 2760 8722.tmp 3976 87AE.tmp 3000 886A.tmp 4636 8906.tmp 1924 89D1.tmp 2700 8A9C.tmp 2092 8B29.tmp 820 8BD5.tmp 4208 8C52.tmp 3160 8CEE.tmp 3108 8D7B.tmp 2020 8E07.tmp 2776 8E94.tmp 2624 8F5F.tmp 1292 8FEC.tmp 2772 9078.tmp 1724 9124.tmp 3924 91C0.tmp 3164 9347.tmp 3448 93F3.tmp 796 949F.tmp 508 952B.tmp 1476 95E7.tmp 5044 9683.tmp 3600 96F0.tmp 4952 977D.tmp 4324 980A.tmp 3936 9887.tmp 3992 98F4.tmp 4140 9961.tmp 3644 99CF.tmp 400 9A5B.tmp 3124 9AE8.tmp 3920 9B75.tmp 4572 9C01.tmp 3428 9C9E.tmp 1012 9D2A.tmp 2592 9DB7.tmp 2724 9E53.tmp 3212 9EC0.tmp 1456 9F3D.tmp 3300 9FBA.tmp 4960 A037.tmp 4496 A0C4.tmp 1072 A141.tmp 4316 A1BE.tmp 3540 A21C.tmp 3172 A289.tmp 220 A2E7.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3824 wrote to memory of 4708 3824 f7afef94e80f9aba4e40c4698d1c9fd3_mafia_JC.exe 83 PID 3824 wrote to memory of 4708 3824 f7afef94e80f9aba4e40c4698d1c9fd3_mafia_JC.exe 83 PID 3824 wrote to memory of 4708 3824 f7afef94e80f9aba4e40c4698d1c9fd3_mafia_JC.exe 83 PID 4708 wrote to memory of 3860 4708 783D.tmp 84 PID 4708 wrote to memory of 3860 4708 783D.tmp 84 PID 4708 wrote to memory of 3860 4708 783D.tmp 84 PID 3860 wrote to memory of 4572 3860 78E9.tmp 85 PID 3860 wrote to memory of 4572 3860 78E9.tmp 85 PID 3860 wrote to memory of 4572 3860 78E9.tmp 85 PID 4572 wrote to memory of 4732 4572 79B4.tmp 86 PID 4572 wrote to memory of 4732 4572 79B4.tmp 86 PID 4572 wrote to memory of 4732 4572 79B4.tmp 86 PID 4732 wrote to memory of 2592 4732 7A60.tmp 87 PID 4732 wrote to memory of 2592 4732 7A60.tmp 87 PID 4732 wrote to memory of 2592 4732 7A60.tmp 87 PID 2592 wrote to memory of 4980 2592 7B0C.tmp 88 PID 2592 wrote to memory of 4980 2592 7B0C.tmp 88 PID 2592 wrote to memory of 4980 2592 7B0C.tmp 88 PID 4980 wrote to memory of 2852 4980 7BB8.tmp 89 PID 4980 wrote to memory of 2852 4980 7BB8.tmp 89 PID 4980 wrote to memory of 2852 4980 7BB8.tmp 89 PID 2852 wrote to memory of 2184 2852 7C54.tmp 90 PID 2852 wrote to memory of 2184 2852 7C54.tmp 90 PID 2852 wrote to memory of 2184 2852 7C54.tmp 90 PID 2184 wrote to memory of 3768 2184 7D1F.tmp 91 PID 2184 wrote to memory of 3768 2184 7D1F.tmp 91 PID 2184 wrote to memory of 3768 2184 7D1F.tmp 91 PID 3768 wrote to memory of 3732 3768 7E09.tmp 92 PID 3768 wrote to memory of 3732 3768 7E09.tmp 92 PID 3768 wrote to memory of 3732 3768 7E09.tmp 92 PID 3732 wrote to memory of 3116 3732 7EA6.tmp 93 PID 3732 wrote to memory of 3116 3732 7EA6.tmp 93 PID 3732 wrote to memory of 3116 3732 7EA6.tmp 93 PID 3116 wrote to memory of 4176 3116 8462.tmp 94 PID 3116 wrote to memory of 4176 3116 8462.tmp 94 PID 3116 wrote to memory of 4176 3116 8462.tmp 94 PID 4176 wrote to memory of 4676 4176 84FF.tmp 95 PID 4176 wrote to memory of 4676 4176 84FF.tmp 95 PID 4176 wrote to memory of 4676 4176 84FF.tmp 95 PID 4676 wrote to memory of 4612 4676 858B.tmp 96 PID 4676 wrote to memory of 4612 4676 858B.tmp 96 PID 4676 wrote to memory of 4612 4676 858B.tmp 96 PID 4612 wrote to memory of 4300 4612 8608.tmp 97 PID 4612 wrote to memory of 4300 4612 8608.tmp 97 PID 4612 wrote to memory of 4300 4612 8608.tmp 97 PID 4300 wrote to memory of 2760 4300 8695.tmp 100 PID 4300 wrote to memory of 2760 4300 8695.tmp 100 PID 4300 wrote to memory of 2760 4300 8695.tmp 100 PID 2760 wrote to memory of 3976 2760 8722.tmp 101 PID 2760 wrote to memory of 3976 2760 8722.tmp 101 PID 2760 wrote to memory of 3976 2760 8722.tmp 101 PID 3976 wrote to memory of 3000 3976 87AE.tmp 102 PID 3976 wrote to memory of 3000 3976 87AE.tmp 102 PID 3976 wrote to memory of 3000 3976 87AE.tmp 102 PID 3000 wrote to memory of 4636 3000 886A.tmp 103 PID 3000 wrote to memory of 4636 3000 886A.tmp 103 PID 3000 wrote to memory of 4636 3000 886A.tmp 103 PID 4636 wrote to memory of 1924 4636 8906.tmp 104 PID 4636 wrote to memory of 1924 4636 8906.tmp 104 PID 4636 wrote to memory of 1924 4636 8906.tmp 104 PID 1924 wrote to memory of 2700 1924 89D1.tmp 105 PID 1924 wrote to memory of 2700 1924 89D1.tmp 105 PID 1924 wrote to memory of 2700 1924 89D1.tmp 105 PID 2700 wrote to memory of 2092 2700 8A9C.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7afef94e80f9aba4e40c4698d1c9fd3_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\f7afef94e80f9aba4e40c4698d1c9fd3_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\783D.tmp"C:\Users\Admin\AppData\Local\Temp\783D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\79B4.tmp"C:\Users\Admin\AppData\Local\Temp\79B4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\7A60.tmp"C:\Users\Admin\AppData\Local\Temp\7A60.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\7C54.tmp"C:\Users\Admin\AppData\Local\Temp\7C54.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\7E09.tmp"C:\Users\Admin\AppData\Local\Temp\7E09.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\8462.tmp"C:\Users\Admin\AppData\Local\Temp\8462.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\84FF.tmp"C:\Users\Admin\AppData\Local\Temp\84FF.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\858B.tmp"C:\Users\Admin\AppData\Local\Temp\858B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\8608.tmp"C:\Users\Admin\AppData\Local\Temp\8608.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\8695.tmp"C:\Users\Admin\AppData\Local\Temp\8695.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\8722.tmp"C:\Users\Admin\AppData\Local\Temp\8722.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\87AE.tmp"C:\Users\Admin\AppData\Local\Temp\87AE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\886A.tmp"C:\Users\Admin\AppData\Local\Temp\886A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\8906.tmp"C:\Users\Admin\AppData\Local\Temp\8906.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\89D1.tmp"C:\Users\Admin\AppData\Local\Temp\89D1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\8B29.tmp"C:\Users\Admin\AppData\Local\Temp\8B29.tmp"23⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"24⤵
- Executes dropped EXE
PID:820 -
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"25⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"26⤵
- Executes dropped EXE
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"27⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\8E07.tmp"C:\Users\Admin\AppData\Local\Temp\8E07.tmp"28⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\8E94.tmp"C:\Users\Admin\AppData\Local\Temp\8E94.tmp"29⤵
- Executes dropped EXE
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"30⤵
- Executes dropped EXE
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"31⤵
- Executes dropped EXE
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\9078.tmp"C:\Users\Admin\AppData\Local\Temp\9078.tmp"32⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"33⤵
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\91C0.tmp"C:\Users\Admin\AppData\Local\Temp\91C0.tmp"34⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"35⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\93F3.tmp"C:\Users\Admin\AppData\Local\Temp\93F3.tmp"36⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"37⤵
- Executes dropped EXE
PID:796 -
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"38⤵
- Executes dropped EXE
PID:508 -
C:\Users\Admin\AppData\Local\Temp\95E7.tmp"C:\Users\Admin\AppData\Local\Temp\95E7.tmp"39⤵
- Executes dropped EXE
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"40⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\96F0.tmp"C:\Users\Admin\AppData\Local\Temp\96F0.tmp"41⤵
- Executes dropped EXE
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\977D.tmp"C:\Users\Admin\AppData\Local\Temp\977D.tmp"42⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"43⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"44⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\98F4.tmp"C:\Users\Admin\AppData\Local\Temp\98F4.tmp"45⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"46⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"47⤵
- Executes dropped EXE
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"48⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"49⤵
- Executes dropped EXE
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"50⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"51⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"52⤵
- Executes dropped EXE
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"53⤵
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"54⤵
- Executes dropped EXE
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\9E53.tmp"C:\Users\Admin\AppData\Local\Temp\9E53.tmp"55⤵
- Executes dropped EXE
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"56⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"57⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"58⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"59⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"60⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\A141.tmp"C:\Users\Admin\AppData\Local\Temp\A141.tmp"61⤵
- Executes dropped EXE
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"62⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\A21C.tmp"C:\Users\Admin\AppData\Local\Temp\A21C.tmp"63⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"64⤵
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"65⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\A354.tmp"C:\Users\Admin\AppData\Local\Temp\A354.tmp"66⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"67⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\A41F.tmp"C:\Users\Admin\AppData\Local\Temp\A41F.tmp"68⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"69⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"70⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"71⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"72⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"73⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"74⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\A73C.tmp"C:\Users\Admin\AppData\Local\Temp\A73C.tmp"75⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"76⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\A836.tmp"C:\Users\Admin\AppData\Local\Temp\A836.tmp"77⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\A894.tmp"C:\Users\Admin\AppData\Local\Temp\A894.tmp"78⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"79⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"80⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"81⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"82⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"83⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"84⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"85⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"86⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"87⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\AD18.tmp"C:\Users\Admin\AppData\Local\Temp\AD18.tmp"88⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\AD95.tmp"C:\Users\Admin\AppData\Local\Temp\AD95.tmp"89⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"90⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"91⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"92⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"93⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"94⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"95⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"96⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\B120.tmp"C:\Users\Admin\AppData\Local\Temp\B120.tmp"97⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"98⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\B229.tmp"C:\Users\Admin\AppData\Local\Temp\B229.tmp"99⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"100⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"101⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"102⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"103⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"104⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\B546.tmp"C:\Users\Admin\AppData\Local\Temp\B546.tmp"105⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"106⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"107⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"108⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\B759.tmp"C:\Users\Admin\AppData\Local\Temp\B759.tmp"109⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"110⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\B863.tmp"C:\Users\Admin\AppData\Local\Temp\B863.tmp"111⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"112⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\B95D.tmp"C:\Users\Admin\AppData\Local\Temp\B95D.tmp"113⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"114⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\BA57.tmp"C:\Users\Admin\AppData\Local\Temp\BA57.tmp"115⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"116⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\BB61.tmp"C:\Users\Admin\AppData\Local\Temp\BB61.tmp"117⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"118⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"119⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\BD06.tmp"C:\Users\Admin\AppData\Local\Temp\BD06.tmp"120⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\BD83.tmp"C:\Users\Admin\AppData\Local\Temp\BD83.tmp"121⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\BE10.tmp"C:\Users\Admin\AppData\Local\Temp\BE10.tmp"122⤵PID:4132
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-