Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
08-08-2023 16:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9985efd8b4db914305251609b1fa0ff4_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
9985efd8b4db914305251609b1fa0ff4_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
9985efd8b4db914305251609b1fa0ff4_mafia_JC.exe
-
Size
486KB
-
MD5
9985efd8b4db914305251609b1fa0ff4
-
SHA1
58df3b79338504c0923b656174553167c740d095
-
SHA256
47867778eb00b8bc9091e810c1ceab53a321b2963ae845a8df41197fa71ebeab
-
SHA512
8097ad88f542484623abaa9c888b8c5bd895fd3f1830e091b5908bdc20c35cfee7027897e6afaf681a6bcd0e5e2fc8c4a9bca6b426235934b57b861d23f0748b
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD78c6T5Me+DFtItC/IhldvR9Gn0D8KOqOsH3dZ:/U5rCOTeiDnusnCIIhlRR9G0DoqfNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3944 7ABE.tmp 4772 7B79.tmp 4820 7C15.tmp 2896 7CF0.tmp 548 7D6D.tmp 3352 7E19.tmp 1260 7EC5.tmp 3012 7F90.tmp 4972 802C.tmp 648 8155.tmp 1044 8220.tmp 1008 82BD.tmp 1368 8359.tmp 1612 8405.tmp 1152 84B1.tmp 3212 853D.tmp 988 86D3.tmp 2736 877F.tmp 3056 882B.tmp 4092 8916.tmp 1760 89E1.tmp 1664 8ACB.tmp 3000 8BB5.tmp 2512 8C81.tmp 3980 8D2C.tmp 4572 8DA9.tmp 5036 8E36.tmp 3672 8EC3.tmp 3792 8F7E.tmp 4000 9069.tmp 3812 9143.tmp 2060 91EF.tmp 3692 92AB.tmp 3532 9328.tmp 4416 93A5.tmp 4412 9431.tmp 2664 94AE.tmp 436 954B.tmp 4500 95C8.tmp 2692 9635.tmp 4852 96D1.tmp 4140 975E.tmp 224 97FA.tmp 2124 9877.tmp 4204 98F4.tmp 2428 99FE.tmp 2780 9A9A.tmp 3324 9B27.tmp 3312 9BA4.tmp 3052 9C11.tmp 4820 9C9E.tmp 908 9D3A.tmp 3956 9DB7.tmp 956 9E53.tmp 548 9EC0.tmp 1544 9F2E.tmp 2792 9FBA.tmp 1480 A057.tmp 3640 A0D4.tmp 644 A160.tmp 4812 A1ED.tmp 1564 A289.tmp 4604 A306.tmp 4272 A383.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2976 wrote to memory of 3944 2976 9985efd8b4db914305251609b1fa0ff4_mafia_JC.exe 81 PID 2976 wrote to memory of 3944 2976 9985efd8b4db914305251609b1fa0ff4_mafia_JC.exe 81 PID 2976 wrote to memory of 3944 2976 9985efd8b4db914305251609b1fa0ff4_mafia_JC.exe 81 PID 3944 wrote to memory of 4772 3944 7ABE.tmp 82 PID 3944 wrote to memory of 4772 3944 7ABE.tmp 82 PID 3944 wrote to memory of 4772 3944 7ABE.tmp 82 PID 4772 wrote to memory of 4820 4772 7B79.tmp 83 PID 4772 wrote to memory of 4820 4772 7B79.tmp 83 PID 4772 wrote to memory of 4820 4772 7B79.tmp 83 PID 4820 wrote to memory of 2896 4820 7C15.tmp 84 PID 4820 wrote to memory of 2896 4820 7C15.tmp 84 PID 4820 wrote to memory of 2896 4820 7C15.tmp 84 PID 2896 wrote to memory of 548 2896 7CF0.tmp 85 PID 2896 wrote to memory of 548 2896 7CF0.tmp 85 PID 2896 wrote to memory of 548 2896 7CF0.tmp 85 PID 548 wrote to memory of 3352 548 7D6D.tmp 86 PID 548 wrote to memory of 3352 548 7D6D.tmp 86 PID 548 wrote to memory of 3352 548 7D6D.tmp 86 PID 3352 wrote to memory of 1260 3352 7E19.tmp 87 PID 3352 wrote to memory of 1260 3352 7E19.tmp 87 PID 3352 wrote to memory of 1260 3352 7E19.tmp 87 PID 1260 wrote to memory of 3012 1260 7EC5.tmp 89 PID 1260 wrote to memory of 3012 1260 7EC5.tmp 89 PID 1260 wrote to memory of 3012 1260 7EC5.tmp 89 PID 3012 wrote to memory of 4972 3012 7F90.tmp 90 PID 3012 wrote to memory of 4972 3012 7F90.tmp 90 PID 3012 wrote to memory of 4972 3012 7F90.tmp 90 PID 4972 wrote to memory of 648 4972 802C.tmp 91 PID 4972 wrote to memory of 648 4972 802C.tmp 91 PID 4972 wrote to memory of 648 4972 802C.tmp 91 PID 648 wrote to memory of 1044 648 8155.tmp 92 PID 648 wrote to memory of 1044 648 8155.tmp 92 PID 648 wrote to memory of 1044 648 8155.tmp 92 PID 1044 wrote to memory of 1008 1044 8220.tmp 93 PID 1044 wrote to memory of 1008 1044 8220.tmp 93 PID 1044 wrote to memory of 1008 1044 8220.tmp 93 PID 1008 wrote to memory of 1368 1008 82BD.tmp 94 PID 1008 wrote to memory of 1368 1008 82BD.tmp 94 PID 1008 wrote to memory of 1368 1008 82BD.tmp 94 PID 1368 wrote to memory of 1612 1368 8359.tmp 95 PID 1368 wrote to memory of 1612 1368 8359.tmp 95 PID 1368 wrote to memory of 1612 1368 8359.tmp 95 PID 1612 wrote to memory of 1152 1612 8405.tmp 96 PID 1612 wrote to memory of 1152 1612 8405.tmp 96 PID 1612 wrote to memory of 1152 1612 8405.tmp 96 PID 1152 wrote to memory of 3212 1152 84B1.tmp 97 PID 1152 wrote to memory of 3212 1152 84B1.tmp 97 PID 1152 wrote to memory of 3212 1152 84B1.tmp 97 PID 3212 wrote to memory of 988 3212 853D.tmp 98 PID 3212 wrote to memory of 988 3212 853D.tmp 98 PID 3212 wrote to memory of 988 3212 853D.tmp 98 PID 988 wrote to memory of 2736 988 86D3.tmp 101 PID 988 wrote to memory of 2736 988 86D3.tmp 101 PID 988 wrote to memory of 2736 988 86D3.tmp 101 PID 2736 wrote to memory of 3056 2736 877F.tmp 102 PID 2736 wrote to memory of 3056 2736 877F.tmp 102 PID 2736 wrote to memory of 3056 2736 877F.tmp 102 PID 3056 wrote to memory of 4092 3056 882B.tmp 103 PID 3056 wrote to memory of 4092 3056 882B.tmp 103 PID 3056 wrote to memory of 4092 3056 882B.tmp 103 PID 4092 wrote to memory of 1760 4092 8916.tmp 104 PID 4092 wrote to memory of 1760 4092 8916.tmp 104 PID 4092 wrote to memory of 1760 4092 8916.tmp 104 PID 1760 wrote to memory of 1664 1760 89E1.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\9985efd8b4db914305251609b1fa0ff4_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\9985efd8b4db914305251609b1fa0ff4_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\7B79.tmp"C:\Users\Admin\AppData\Local\Temp\7B79.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\7C15.tmp"C:\Users\Admin\AppData\Local\Temp\7C15.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\7F90.tmp"C:\Users\Admin\AppData\Local\Temp\7F90.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\802C.tmp"C:\Users\Admin\AppData\Local\Temp\802C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\8155.tmp"C:\Users\Admin\AppData\Local\Temp\8155.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Users\Admin\AppData\Local\Temp\8220.tmp"C:\Users\Admin\AppData\Local\Temp\8220.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\82BD.tmp"C:\Users\Admin\AppData\Local\Temp\82BD.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\8359.tmp"C:\Users\Admin\AppData\Local\Temp\8359.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\8405.tmp"C:\Users\Admin\AppData\Local\Temp\8405.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\84B1.tmp"C:\Users\Admin\AppData\Local\Temp\84B1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\853D.tmp"C:\Users\Admin\AppData\Local\Temp\853D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\86D3.tmp"C:\Users\Admin\AppData\Local\Temp\86D3.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\877F.tmp"C:\Users\Admin\AppData\Local\Temp\877F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\882B.tmp"C:\Users\Admin\AppData\Local\Temp\882B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\8916.tmp"C:\Users\Admin\AppData\Local\Temp\8916.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\89E1.tmp"C:\Users\Admin\AppData\Local\Temp\89E1.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"23⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"24⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\8C81.tmp"C:\Users\Admin\AppData\Local\Temp\8C81.tmp"25⤵
- Executes dropped EXE
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"26⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"27⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp"28⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"29⤵
- Executes dropped EXE
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"30⤵
- Executes dropped EXE
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"31⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\9143.tmp"C:\Users\Admin\AppData\Local\Temp\9143.tmp"32⤵
- Executes dropped EXE
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\91EF.tmp"C:\Users\Admin\AppData\Local\Temp\91EF.tmp"33⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\92AB.tmp"C:\Users\Admin\AppData\Local\Temp\92AB.tmp"34⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\9328.tmp"C:\Users\Admin\AppData\Local\Temp\9328.tmp"35⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\93A5.tmp"C:\Users\Admin\AppData\Local\Temp\93A5.tmp"36⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"37⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\94AE.tmp"C:\Users\Admin\AppData\Local\Temp\94AE.tmp"38⤵
- Executes dropped EXE
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\954B.tmp"C:\Users\Admin\AppData\Local\Temp\954B.tmp"39⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\95C8.tmp"C:\Users\Admin\AppData\Local\Temp\95C8.tmp"40⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"41⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\96D1.tmp"C:\Users\Admin\AppData\Local\Temp\96D1.tmp"42⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"43⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\97FA.tmp"C:\Users\Admin\AppData\Local\Temp\97FA.tmp"44⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\9877.tmp"C:\Users\Admin\AppData\Local\Temp\9877.tmp"45⤵
- Executes dropped EXE
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\98F4.tmp"C:\Users\Admin\AppData\Local\Temp\98F4.tmp"46⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"47⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"48⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"49⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"50⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"51⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"52⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"53⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"54⤵
- Executes dropped EXE
PID:908 -
C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"55⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\9E53.tmp"C:\Users\Admin\AppData\Local\Temp\9E53.tmp"56⤵
- Executes dropped EXE
PID:956 -
C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"57⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"58⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"59⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"60⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"61⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\A160.tmp"C:\Users\Admin\AppData\Local\Temp\A160.tmp"62⤵
- Executes dropped EXE
PID:644 -
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"63⤵
- Executes dropped EXE
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"64⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\A306.tmp"C:\Users\Admin\AppData\Local\Temp\A306.tmp"65⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\A383.tmp"C:\Users\Admin\AppData\Local\Temp\A383.tmp"66⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\A410.tmp"C:\Users\Admin\AppData\Local\Temp\A410.tmp"67⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\A47D.tmp"C:\Users\Admin\AppData\Local\Temp\A47D.tmp"68⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"69⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"70⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"71⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\A642.tmp"C:\Users\Admin\AppData\Local\Temp\A642.tmp"72⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"73⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\A73C.tmp"C:\Users\Admin\AppData\Local\Temp\A73C.tmp"74⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"75⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\A836.tmp"C:\Users\Admin\AppData\Local\Temp\A836.tmp"76⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"77⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\A921.tmp"C:\Users\Admin\AppData\Local\Temp\A921.tmp"78⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"79⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"80⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"81⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"82⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"83⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"84⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"85⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"86⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"87⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"88⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"89⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"90⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"91⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"92⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"93⤵PID:492
-
C:\Users\Admin\AppData\Local\Temp\B093.tmp"C:\Users\Admin\AppData\Local\Temp\B093.tmp"94⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\B100.tmp"C:\Users\Admin\AppData\Local\Temp\B100.tmp"95⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\B15E.tmp"C:\Users\Admin\AppData\Local\Temp\B15E.tmp"96⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"97⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\B239.tmp"C:\Users\Admin\AppData\Local\Temp\B239.tmp"98⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\B304.tmp"C:\Users\Admin\AppData\Local\Temp\B304.tmp"99⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\B371.tmp"C:\Users\Admin\AppData\Local\Temp\B371.tmp"100⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"101⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\B49A.tmp"C:\Users\Admin\AppData\Local\Temp\B49A.tmp"102⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\B527.tmp"C:\Users\Admin\AppData\Local\Temp\B527.tmp"103⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"104⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\B650.tmp"C:\Users\Admin\AppData\Local\Temp\B650.tmp"105⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"106⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\B759.tmp"C:\Users\Admin\AppData\Local\Temp\B759.tmp"107⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\B805.tmp"C:\Users\Admin\AppData\Local\Temp\B805.tmp"108⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\B892.tmp"C:\Users\Admin\AppData\Local\Temp\B892.tmp"109⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"110⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\B97C.tmp"C:\Users\Admin\AppData\Local\Temp\B97C.tmp"111⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\BA09.tmp"C:\Users\Admin\AppData\Local\Temp\BA09.tmp"112⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\BA86.tmp"C:\Users\Admin\AppData\Local\Temp\BA86.tmp"113⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\BB03.tmp"C:\Users\Admin\AppData\Local\Temp\BB03.tmp"114⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\BB70.tmp"C:\Users\Admin\AppData\Local\Temp\BB70.tmp"115⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"116⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"117⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"118⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\BD74.tmp"C:\Users\Admin\AppData\Local\Temp\BD74.tmp"119⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"120⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"121⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"122⤵PID:3948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-