Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
08/08/2023, 17:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9eafaacb7ebfa5213d49433e1a116c62_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
9eafaacb7ebfa5213d49433e1a116c62_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
9eafaacb7ebfa5213d49433e1a116c62_mafia_JC.exe
-
Size
488KB
-
MD5
9eafaacb7ebfa5213d49433e1a116c62
-
SHA1
d0046136a51a0e920e2c9cfb7a8d533d0ece5169
-
SHA256
412b651110181110ae67aa74f93104792489d14ed5df53c05c5eb2e5939f8c76
-
SHA512
8eba89ae521e8106cbd091ebb88c803b2bb68f2bfeeedcdddb759dfb2b028e976eb1e3c048c51af63652e9015af899cf5ed356a551b4de308b929bded4653967
-
SSDEEP
12288:/U5rCOTeiDGfv2tSbbIdU4Zf89c+AnOAp0WNZ:/UQOJDiv2t0bIy4ZOc7OOTN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2064 7DEA.tmp 4940 7EA6.tmp 5012 7F32.tmp 4908 803C.tmp 4668 8136.tmp 3944 81D2.tmp 1052 831A.tmp 4556 8397.tmp 4092 8443.tmp 4628 84D0.tmp 1616 859B.tmp 992 8608.tmp 4332 86B4.tmp 3136 87DD.tmp 3536 88A8.tmp 640 8954.tmp 1300 89D1.tmp 212 8A7D.tmp 4664 8B19.tmp 4344 8C13.tmp 2716 8CEE.tmp 1644 8DD8.tmp 3848 8EB3.tmp 4608 8FAD.tmp 3936 9078.tmp 1912 9163.tmp 3576 921E.tmp 2952 92DA.tmp 2476 9395.tmp 2312 9441.tmp 1776 94DD.tmp 1968 9599.tmp 728 9645.tmp 2368 96C2.tmp 1904 972F.tmp 4404 97AC.tmp 2208 9829.tmp 3516 98C5.tmp 2728 9971.tmp 1120 99FE.tmp 1140 9A8A.tmp 4588 9B17.tmp 2852 9BB3.tmp 3496 9C40.tmp 2844 9CDC.tmp 4876 9D88.tmp 1092 9E05.tmp 4752 9E82.tmp 3184 9F0F.tmp 3388 9F8C.tmp 3272 A018.tmp 4924 A095.tmp 3040 A131.tmp 4104 A1CE.tmp 3404 A24B.tmp 1408 A2E7.tmp 4320 A393.tmp 4396 A42F.tmp 1836 A49C.tmp 1168 A50A.tmp 4984 A577.tmp 4504 A5F4.tmp 2432 A690.tmp 5020 A71D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3804 wrote to memory of 2064 3804 9eafaacb7ebfa5213d49433e1a116c62_mafia_JC.exe 83 PID 3804 wrote to memory of 2064 3804 9eafaacb7ebfa5213d49433e1a116c62_mafia_JC.exe 83 PID 3804 wrote to memory of 2064 3804 9eafaacb7ebfa5213d49433e1a116c62_mafia_JC.exe 83 PID 2064 wrote to memory of 4940 2064 7DEA.tmp 84 PID 2064 wrote to memory of 4940 2064 7DEA.tmp 84 PID 2064 wrote to memory of 4940 2064 7DEA.tmp 84 PID 4940 wrote to memory of 5012 4940 7EA6.tmp 85 PID 4940 wrote to memory of 5012 4940 7EA6.tmp 85 PID 4940 wrote to memory of 5012 4940 7EA6.tmp 85 PID 5012 wrote to memory of 4908 5012 7F32.tmp 86 PID 5012 wrote to memory of 4908 5012 7F32.tmp 86 PID 5012 wrote to memory of 4908 5012 7F32.tmp 86 PID 4908 wrote to memory of 4668 4908 803C.tmp 87 PID 4908 wrote to memory of 4668 4908 803C.tmp 87 PID 4908 wrote to memory of 4668 4908 803C.tmp 87 PID 4668 wrote to memory of 3944 4668 8136.tmp 88 PID 4668 wrote to memory of 3944 4668 8136.tmp 88 PID 4668 wrote to memory of 3944 4668 8136.tmp 88 PID 3944 wrote to memory of 1052 3944 81D2.tmp 89 PID 3944 wrote to memory of 1052 3944 81D2.tmp 89 PID 3944 wrote to memory of 1052 3944 81D2.tmp 89 PID 1052 wrote to memory of 4556 1052 831A.tmp 90 PID 1052 wrote to memory of 4556 1052 831A.tmp 90 PID 1052 wrote to memory of 4556 1052 831A.tmp 90 PID 4556 wrote to memory of 4092 4556 8397.tmp 91 PID 4556 wrote to memory of 4092 4556 8397.tmp 91 PID 4556 wrote to memory of 4092 4556 8397.tmp 91 PID 4092 wrote to memory of 4628 4092 8443.tmp 92 PID 4092 wrote to memory of 4628 4092 8443.tmp 92 PID 4092 wrote to memory of 4628 4092 8443.tmp 92 PID 4628 wrote to memory of 1616 4628 84D0.tmp 93 PID 4628 wrote to memory of 1616 4628 84D0.tmp 93 PID 4628 wrote to memory of 1616 4628 84D0.tmp 93 PID 1616 wrote to memory of 992 1616 859B.tmp 94 PID 1616 wrote to memory of 992 1616 859B.tmp 94 PID 1616 wrote to memory of 992 1616 859B.tmp 94 PID 992 wrote to memory of 4332 992 8608.tmp 95 PID 992 wrote to memory of 4332 992 8608.tmp 95 PID 992 wrote to memory of 4332 992 8608.tmp 95 PID 4332 wrote to memory of 3136 4332 86B4.tmp 96 PID 4332 wrote to memory of 3136 4332 86B4.tmp 96 PID 4332 wrote to memory of 3136 4332 86B4.tmp 96 PID 3136 wrote to memory of 3536 3136 87DD.tmp 97 PID 3136 wrote to memory of 3536 3136 87DD.tmp 97 PID 3136 wrote to memory of 3536 3136 87DD.tmp 97 PID 3536 wrote to memory of 640 3536 88A8.tmp 98 PID 3536 wrote to memory of 640 3536 88A8.tmp 98 PID 3536 wrote to memory of 640 3536 88A8.tmp 98 PID 640 wrote to memory of 1300 640 8954.tmp 99 PID 640 wrote to memory of 1300 640 8954.tmp 99 PID 640 wrote to memory of 1300 640 8954.tmp 99 PID 1300 wrote to memory of 212 1300 89D1.tmp 100 PID 1300 wrote to memory of 212 1300 89D1.tmp 100 PID 1300 wrote to memory of 212 1300 89D1.tmp 100 PID 212 wrote to memory of 4664 212 8A7D.tmp 101 PID 212 wrote to memory of 4664 212 8A7D.tmp 101 PID 212 wrote to memory of 4664 212 8A7D.tmp 101 PID 4664 wrote to memory of 4344 4664 8B19.tmp 104 PID 4664 wrote to memory of 4344 4664 8B19.tmp 104 PID 4664 wrote to memory of 4344 4664 8B19.tmp 104 PID 4344 wrote to memory of 2716 4344 8C13.tmp 105 PID 4344 wrote to memory of 2716 4344 8C13.tmp 105 PID 4344 wrote to memory of 2716 4344 8C13.tmp 105 PID 2716 wrote to memory of 1644 2716 8CEE.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\9eafaacb7ebfa5213d49433e1a116c62_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\9eafaacb7ebfa5213d49433e1a116c62_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\7F32.tmp"C:\Users\Admin\AppData\Local\Temp\7F32.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\803C.tmp"C:\Users\Admin\AppData\Local\Temp\803C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\8136.tmp"C:\Users\Admin\AppData\Local\Temp\8136.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\81D2.tmp"C:\Users\Admin\AppData\Local\Temp\81D2.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\84D0.tmp"C:\Users\Admin\AppData\Local\Temp\84D0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\859B.tmp"C:\Users\Admin\AppData\Local\Temp\859B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\8608.tmp"C:\Users\Admin\AppData\Local\Temp\8608.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\87DD.tmp"C:\Users\Admin\AppData\Local\Temp\87DD.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\88A8.tmp"C:\Users\Admin\AppData\Local\Temp\88A8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\8954.tmp"C:\Users\Admin\AppData\Local\Temp\8954.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\89D1.tmp"C:\Users\Admin\AppData\Local\Temp\89D1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\8B19.tmp"C:\Users\Admin\AppData\Local\Temp\8B19.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\8C13.tmp"C:\Users\Admin\AppData\Local\Temp\8C13.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"23⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"24⤵
- Executes dropped EXE
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"25⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\9078.tmp"C:\Users\Admin\AppData\Local\Temp\9078.tmp"26⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\9163.tmp"C:\Users\Admin\AppData\Local\Temp\9163.tmp"27⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\921E.tmp"C:\Users\Admin\AppData\Local\Temp\921E.tmp"28⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\92DA.tmp"C:\Users\Admin\AppData\Local\Temp\92DA.tmp"29⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\9395.tmp"C:\Users\Admin\AppData\Local\Temp\9395.tmp"30⤵
- Executes dropped EXE
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\9441.tmp"C:\Users\Admin\AppData\Local\Temp\9441.tmp"31⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\94DD.tmp"C:\Users\Admin\AppData\Local\Temp\94DD.tmp"32⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\9599.tmp"C:\Users\Admin\AppData\Local\Temp\9599.tmp"33⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"34⤵
- Executes dropped EXE
PID:728 -
C:\Users\Admin\AppData\Local\Temp\96C2.tmp"C:\Users\Admin\AppData\Local\Temp\96C2.tmp"35⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\972F.tmp"C:\Users\Admin\AppData\Local\Temp\972F.tmp"36⤵
- Executes dropped EXE
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"37⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"38⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\98C5.tmp"C:\Users\Admin\AppData\Local\Temp\98C5.tmp"39⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"40⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"41⤵
- Executes dropped EXE
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"42⤵
- Executes dropped EXE
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"43⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"44⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"45⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"46⤵
- Executes dropped EXE
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"47⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"48⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"49⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"50⤵
- Executes dropped EXE
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"51⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"52⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\A095.tmp"C:\Users\Admin\AppData\Local\Temp\A095.tmp"53⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"54⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"55⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\A24B.tmp"C:\Users\Admin\AppData\Local\Temp\A24B.tmp"56⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"57⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"58⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"59⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"60⤵
- Executes dropped EXE
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\A50A.tmp"C:\Users\Admin\AppData\Local\Temp\A50A.tmp"61⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\A577.tmp"C:\Users\Admin\AppData\Local\Temp\A577.tmp"62⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"63⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"64⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"65⤵
- Executes dropped EXE
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"66⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\A856.tmp"C:\Users\Admin\AppData\Local\Temp\A856.tmp"67⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"68⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"69⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"70⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"71⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"72⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\AB05.tmp"C:\Users\Admin\AppData\Local\Temp\AB05.tmp"73⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\AB82.tmp"C:\Users\Admin\AppData\Local\Temp\AB82.tmp"74⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"75⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"76⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"77⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"78⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\AE41.tmp"C:\Users\Admin\AppData\Local\Temp\AE41.tmp"79⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"80⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"81⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"82⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\B054.tmp"C:\Users\Admin\AppData\Local\Temp\B054.tmp"83⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"84⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"85⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"86⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\B287.tmp"C:\Users\Admin\AppData\Local\Temp\B287.tmp"87⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\B323.tmp"C:\Users\Admin\AppData\Local\Temp\B323.tmp"88⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"89⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\B42D.tmp"C:\Users\Admin\AppData\Local\Temp\B42D.tmp"90⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"91⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\B546.tmp"C:\Users\Admin\AppData\Local\Temp\B546.tmp"92⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"93⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"94⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"95⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\B73A.tmp"C:\Users\Admin\AppData\Local\Temp\B73A.tmp"96⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"97⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\B892.tmp"C:\Users\Admin\AppData\Local\Temp\B892.tmp"98⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"99⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\B99B.tmp"C:\Users\Admin\AppData\Local\Temp\B99B.tmp"100⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\BA18.tmp"C:\Users\Admin\AppData\Local\Temp\BA18.tmp"101⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"102⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\BB12.tmp"C:\Users\Admin\AppData\Local\Temp\BB12.tmp"103⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"104⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"105⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\BC99.tmp"C:\Users\Admin\AppData\Local\Temp\BC99.tmp"106⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\BD26.tmp"C:\Users\Admin\AppData\Local\Temp\BD26.tmp"107⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\BD93.tmp"C:\Users\Admin\AppData\Local\Temp\BD93.tmp"108⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\BE00.tmp"C:\Users\Admin\AppData\Local\Temp\BE00.tmp"109⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"110⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\BF29.tmp"C:\Users\Admin\AppData\Local\Temp\BF29.tmp"111⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"112⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\C014.tmp"C:\Users\Admin\AppData\Local\Temp\C014.tmp"113⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"114⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"115⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"116⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"117⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"118⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\C331.tmp"C:\Users\Admin\AppData\Local\Temp\C331.tmp"119⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\C39E.tmp"C:\Users\Admin\AppData\Local\Temp\C39E.tmp"120⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\C40B.tmp"C:\Users\Admin\AppData\Local\Temp\C40B.tmp"121⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\C469.tmp"C:\Users\Admin\AppData\Local\Temp\C469.tmp"122⤵PID:4556
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-