Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18-08-2023 14:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2c8b9b8777ca5ac3127ad9cc9d8070da_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2c8b9b8777ca5ac3127ad9cc9d8070da_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2c8b9b8777ca5ac3127ad9cc9d8070da_mafia_JC.exe
-
Size
487KB
-
MD5
2c8b9b8777ca5ac3127ad9cc9d8070da
-
SHA1
8c61ec1b197ca0a02ec676c2a3150c89f696285e
-
SHA256
6029311fd85a1889491971f3cf7154aa616a963f3d0708ffd0ad34ad12e6634f
-
SHA512
07b0ef0361e8f842c0383a81f5351d5aa6987fe7391efecfa9549666bdc6ab64f2e57dd1a23c759f49c9c74120d65b7a28f650d3bf52f5d246994397b733113d
-
SSDEEP
12288:yU5rCOTeiNmUSNKTm2dSTz7SU8v3KuCfy7zbZ:yUQOJNcNcdS7qi+b
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3584 803C.tmp 4836 80F7.tmp 3460 81A3.tmp 4180 82BD.tmp 1304 8368.tmp 4816 8424.tmp 3056 84C0.tmp 1284 857C.tmp 4692 8628.tmp 3372 86C4.tmp 4920 87AE.tmp 3344 884A.tmp 3516 8916.tmp 2824 89C1.tmp 4520 8ADB.tmp 2448 8B87.tmp 4668 8C13.tmp 4892 8CCF.tmp 2012 8D6B.tmp 376 8E55.tmp 4324 8F6F.tmp 1968 8FFB.tmp 3980 90C6.tmp 3252 9153.tmp 4296 922E.tmp 1588 929B.tmp 1656 9337.tmp 632 93D4.tmp 1372 948F.tmp 1276 954B.tmp 1796 9606.tmp 4024 96C2.tmp 4712 974E.tmp 3748 97CB.tmp 1712 9848.tmp 1748 98D5.tmp 2576 9952.tmp 2968 99DE.tmp 4956 9A5B.tmp 2864 9AF8.tmp 560 9B84.tmp 4976 9C21.tmp 1096 9CBD.tmp 2388 9D49.tmp 3268 9DF5.tmp 3900 9F3D.tmp 4592 9FCA.tmp 4808 A066.tmp 1848 A0F3.tmp 1460 A180.tmp 3864 A22B.tmp 2688 A2B8.tmp 4952 A345.tmp 1144 A3D1.tmp 1304 A43F.tmp 5040 A4AC.tmp 412 A519.tmp 1392 A5B6.tmp 4360 A671.tmp 4924 A6EE.tmp 1124 A78A.tmp 4040 A827.tmp 3104 A8A4.tmp 1868 A901.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4184 wrote to memory of 3584 4184 2c8b9b8777ca5ac3127ad9cc9d8070da_mafia_JC.exe 81 PID 4184 wrote to memory of 3584 4184 2c8b9b8777ca5ac3127ad9cc9d8070da_mafia_JC.exe 81 PID 4184 wrote to memory of 3584 4184 2c8b9b8777ca5ac3127ad9cc9d8070da_mafia_JC.exe 81 PID 3584 wrote to memory of 4836 3584 803C.tmp 82 PID 3584 wrote to memory of 4836 3584 803C.tmp 82 PID 3584 wrote to memory of 4836 3584 803C.tmp 82 PID 4836 wrote to memory of 3460 4836 80F7.tmp 83 PID 4836 wrote to memory of 3460 4836 80F7.tmp 83 PID 4836 wrote to memory of 3460 4836 80F7.tmp 83 PID 3460 wrote to memory of 4180 3460 81A3.tmp 84 PID 3460 wrote to memory of 4180 3460 81A3.tmp 84 PID 3460 wrote to memory of 4180 3460 81A3.tmp 84 PID 4180 wrote to memory of 1304 4180 82BD.tmp 85 PID 4180 wrote to memory of 1304 4180 82BD.tmp 85 PID 4180 wrote to memory of 1304 4180 82BD.tmp 85 PID 1304 wrote to memory of 4816 1304 8368.tmp 86 PID 1304 wrote to memory of 4816 1304 8368.tmp 86 PID 1304 wrote to memory of 4816 1304 8368.tmp 86 PID 4816 wrote to memory of 3056 4816 8424.tmp 87 PID 4816 wrote to memory of 3056 4816 8424.tmp 87 PID 4816 wrote to memory of 3056 4816 8424.tmp 87 PID 3056 wrote to memory of 1284 3056 84C0.tmp 88 PID 3056 wrote to memory of 1284 3056 84C0.tmp 88 PID 3056 wrote to memory of 1284 3056 84C0.tmp 88 PID 1284 wrote to memory of 4692 1284 857C.tmp 89 PID 1284 wrote to memory of 4692 1284 857C.tmp 89 PID 1284 wrote to memory of 4692 1284 857C.tmp 89 PID 4692 wrote to memory of 3372 4692 8628.tmp 90 PID 4692 wrote to memory of 3372 4692 8628.tmp 90 PID 4692 wrote to memory of 3372 4692 8628.tmp 90 PID 3372 wrote to memory of 4920 3372 86C4.tmp 91 PID 3372 wrote to memory of 4920 3372 86C4.tmp 91 PID 3372 wrote to memory of 4920 3372 86C4.tmp 91 PID 4920 wrote to memory of 3344 4920 87AE.tmp 92 PID 4920 wrote to memory of 3344 4920 87AE.tmp 92 PID 4920 wrote to memory of 3344 4920 87AE.tmp 92 PID 3344 wrote to memory of 3516 3344 884A.tmp 93 PID 3344 wrote to memory of 3516 3344 884A.tmp 93 PID 3344 wrote to memory of 3516 3344 884A.tmp 93 PID 3516 wrote to memory of 2824 3516 8916.tmp 94 PID 3516 wrote to memory of 2824 3516 8916.tmp 94 PID 3516 wrote to memory of 2824 3516 8916.tmp 94 PID 2824 wrote to memory of 4520 2824 89C1.tmp 95 PID 2824 wrote to memory of 4520 2824 89C1.tmp 95 PID 2824 wrote to memory of 4520 2824 89C1.tmp 95 PID 4520 wrote to memory of 2448 4520 8ADB.tmp 96 PID 4520 wrote to memory of 2448 4520 8ADB.tmp 96 PID 4520 wrote to memory of 2448 4520 8ADB.tmp 96 PID 2448 wrote to memory of 4668 2448 8B87.tmp 99 PID 2448 wrote to memory of 4668 2448 8B87.tmp 99 PID 2448 wrote to memory of 4668 2448 8B87.tmp 99 PID 4668 wrote to memory of 4892 4668 8C13.tmp 100 PID 4668 wrote to memory of 4892 4668 8C13.tmp 100 PID 4668 wrote to memory of 4892 4668 8C13.tmp 100 PID 4892 wrote to memory of 2012 4892 8CCF.tmp 101 PID 4892 wrote to memory of 2012 4892 8CCF.tmp 101 PID 4892 wrote to memory of 2012 4892 8CCF.tmp 101 PID 2012 wrote to memory of 376 2012 8D6B.tmp 102 PID 2012 wrote to memory of 376 2012 8D6B.tmp 102 PID 2012 wrote to memory of 376 2012 8D6B.tmp 102 PID 376 wrote to memory of 4324 376 8E55.tmp 103 PID 376 wrote to memory of 4324 376 8E55.tmp 103 PID 376 wrote to memory of 4324 376 8E55.tmp 103 PID 4324 wrote to memory of 1968 4324 8F6F.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c8b9b8777ca5ac3127ad9cc9d8070da_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2c8b9b8777ca5ac3127ad9cc9d8070da_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\803C.tmp"C:\Users\Admin\AppData\Local\Temp\803C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\80F7.tmp"C:\Users\Admin\AppData\Local\Temp\80F7.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\81A3.tmp"C:\Users\Admin\AppData\Local\Temp\81A3.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\82BD.tmp"C:\Users\Admin\AppData\Local\Temp\82BD.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\8368.tmp"C:\Users\Admin\AppData\Local\Temp\8368.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\8424.tmp"C:\Users\Admin\AppData\Local\Temp\8424.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\84C0.tmp"C:\Users\Admin\AppData\Local\Temp\84C0.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\857C.tmp"C:\Users\Admin\AppData\Local\Temp\857C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\8628.tmp"C:\Users\Admin\AppData\Local\Temp\8628.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\86C4.tmp"C:\Users\Admin\AppData\Local\Temp\86C4.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\87AE.tmp"C:\Users\Admin\AppData\Local\Temp\87AE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\8916.tmp"C:\Users\Admin\AppData\Local\Temp\8916.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\89C1.tmp"C:\Users\Admin\AppData\Local\Temp\89C1.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\8B87.tmp"C:\Users\Admin\AppData\Local\Temp\8B87.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\8C13.tmp"C:\Users\Admin\AppData\Local\Temp\8C13.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\8E55.tmp"C:\Users\Admin\AppData\Local\Temp\8E55.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"23⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"24⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\9153.tmp"C:\Users\Admin\AppData\Local\Temp\9153.tmp"25⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\922E.tmp"C:\Users\Admin\AppData\Local\Temp\922E.tmp"26⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\929B.tmp"C:\Users\Admin\AppData\Local\Temp\929B.tmp"27⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\9337.tmp"C:\Users\Admin\AppData\Local\Temp\9337.tmp"28⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"29⤵
- Executes dropped EXE
PID:632 -
C:\Users\Admin\AppData\Local\Temp\948F.tmp"C:\Users\Admin\AppData\Local\Temp\948F.tmp"30⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\954B.tmp"C:\Users\Admin\AppData\Local\Temp\954B.tmp"31⤵
- Executes dropped EXE
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\9606.tmp"C:\Users\Admin\AppData\Local\Temp\9606.tmp"32⤵
- Executes dropped EXE
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\96C2.tmp"C:\Users\Admin\AppData\Local\Temp\96C2.tmp"33⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"34⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\97CB.tmp"C:\Users\Admin\AppData\Local\Temp\97CB.tmp"35⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\9848.tmp"C:\Users\Admin\AppData\Local\Temp\9848.tmp"36⤵
- Executes dropped EXE
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\98D5.tmp"C:\Users\Admin\AppData\Local\Temp\98D5.tmp"37⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\9952.tmp"C:\Users\Admin\AppData\Local\Temp\9952.tmp"38⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"39⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"40⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"41⤵
- Executes dropped EXE
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"42⤵
- Executes dropped EXE
PID:560 -
C:\Users\Admin\AppData\Local\Temp\9C21.tmp"C:\Users\Admin\AppData\Local\Temp\9C21.tmp"43⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"44⤵
- Executes dropped EXE
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"45⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"46⤵
- Executes dropped EXE
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"47⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"48⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"49⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\A066.tmp"C:\Users\Admin\AppData\Local\Temp\A066.tmp"50⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"51⤵
- Executes dropped EXE
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\A180.tmp"C:\Users\Admin\AppData\Local\Temp\A180.tmp"52⤵
- Executes dropped EXE
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"53⤵
- Executes dropped EXE
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"54⤵
- Executes dropped EXE
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"55⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"56⤵
- Executes dropped EXE
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\A43F.tmp"C:\Users\Admin\AppData\Local\Temp\A43F.tmp"57⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"58⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\A519.tmp"C:\Users\Admin\AppData\Local\Temp\A519.tmp"59⤵
- Executes dropped EXE
PID:412 -
C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"60⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\A671.tmp"C:\Users\Admin\AppData\Local\Temp\A671.tmp"61⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"62⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\A78A.tmp"C:\Users\Admin\AppData\Local\Temp\A78A.tmp"63⤵
- Executes dropped EXE
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\A827.tmp"C:\Users\Admin\AppData\Local\Temp\A827.tmp"64⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"65⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"66⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\A96F.tmp"C:\Users\Admin\AppData\Local\Temp\A96F.tmp"67⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"68⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"69⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"70⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"71⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"72⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"73⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\AD18.tmp"C:\Users\Admin\AppData\Local\Temp\AD18.tmp"74⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\AD76.tmp"C:\Users\Admin\AppData\Local\Temp\AD76.tmp"75⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"76⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\AE41.tmp"C:\Users\Admin\AppData\Local\Temp\AE41.tmp"77⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"78⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"79⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"80⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\B074.tmp"C:\Users\Admin\AppData\Local\Temp\B074.tmp"81⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"82⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\B14E.tmp"C:\Users\Admin\AppData\Local\Temp\B14E.tmp"83⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"84⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\B239.tmp"C:\Users\Admin\AppData\Local\Temp\B239.tmp"85⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"86⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\B362.tmp"C:\Users\Admin\AppData\Local\Temp\B362.tmp"87⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"88⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\B47B.tmp"C:\Users\Admin\AppData\Local\Temp\B47B.tmp"89⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"90⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\B575.tmp"C:\Users\Admin\AppData\Local\Temp\B575.tmp"91⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"92⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"93⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"94⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\B759.tmp"C:\Users\Admin\AppData\Local\Temp\B759.tmp"95⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"96⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\B863.tmp"C:\Users\Admin\AppData\Local\Temp\B863.tmp"97⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"98⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\B96D.tmp"C:\Users\Admin\AppData\Local\Temp\B96D.tmp"99⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"100⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\BA95.tmp"C:\Users\Admin\AppData\Local\Temp\BA95.tmp"101⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\BB22.tmp"C:\Users\Admin\AppData\Local\Temp\BB22.tmp"102⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"103⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"104⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"105⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\BD55.tmp"C:\Users\Admin\AppData\Local\Temp\BD55.tmp"106⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"107⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"108⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\BEEB.tmp"C:\Users\Admin\AppData\Local\Temp\BEEB.tmp"109⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\BF87.tmp"C:\Users\Admin\AppData\Local\Temp\BF87.tmp"110⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\C023.tmp"C:\Users\Admin\AppData\Local\Temp\C023.tmp"111⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"112⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"113⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"114⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"115⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"116⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\C37F.tmp"C:\Users\Admin\AppData\Local\Temp\C37F.tmp"117⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"118⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\C479.tmp"C:\Users\Admin\AppData\Local\Temp\C479.tmp"119⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"120⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\C563.tmp"C:\Users\Admin\AppData\Local\Temp\C563.tmp"121⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"122⤵PID:4700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-