Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
24-08-2023 19:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8b5e5f088dc4a50a4bd708ed933afac9_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
8b5e5f088dc4a50a4bd708ed933afac9_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
8b5e5f088dc4a50a4bd708ed933afac9_mafia_JC.exe
-
Size
486KB
-
MD5
8b5e5f088dc4a50a4bd708ed933afac9
-
SHA1
3ffa87ffcdb213de88e88a78553172af85d54fe6
-
SHA256
8f8e2a4a8d1088970081793525c498e1eb2ff36679444fe3adc88e3ad9a3205a
-
SHA512
0456322779566be35adef3cb1d09b4feceb141c8da6a94e2c223c0e27a32f31934f837bfa4a537519cc242064fa5739162930effebcb31d0097e093c14e00d21
-
SSDEEP
12288:/U5rCOTeiDF/rDc2dQzJuug5laUYlKNZ:/UQOJDB/dOJLg/N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4812 8656.tmp 2980 8722.tmp 3408 880C.tmp 1248 8906.tmp 4520 89C1.tmp 4260 8A9C.tmp 3992 8B58.tmp 1812 8D1D.tmp 2316 8DC9.tmp 4996 8EC3.tmp 4204 8F4F.tmp 4892 9088.tmp 2456 9143.tmp 3228 923D.tmp 4484 92DA.tmp 2636 93B4.tmp 1536 9460.tmp 1304 953B.tmp 1060 95E7.tmp 1860 9683.tmp 4860 975E.tmp 1308 97DB.tmp 3392 9867.tmp 4604 98F4.tmp 2852 99A0.tmp 2208 9A2D.tmp 3812 9AD8.tmp 4584 9BD2.tmp 1124 9C5F.tmp 3376 9D1B.tmp 4336 9DA7.tmp 4516 9E34.tmp 4496 9EEF.tmp 4032 9F6C.tmp 2436 9FF9.tmp 4820 A095.tmp 4568 A112.tmp 3068 A1AE.tmp 3524 A22B.tmp 836 A2C8.tmp 3896 A335.tmp 3892 A393.tmp 3544 A400.tmp 556 A47D.tmp 4796 A4DB.tmp 4720 A548.tmp 4716 A5D5.tmp 3920 A671.tmp 3968 A6DF.tmp 4104 A75C.tmp 4348 A7D9.tmp 2236 A875.tmp 3176 A901.tmp 3904 A97E.tmp 4136 A9FB.tmp 1404 AA69.tmp 3124 AAE6.tmp 4692 AB63.tmp 2112 ABEF.tmp 3868 AC7C.tmp 1708 AD09.tmp 1668 AD86.tmp 3940 AE12.tmp 1888 AEAF.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3288 wrote to memory of 4812 3288 8b5e5f088dc4a50a4bd708ed933afac9_mafia_JC.exe 81 PID 3288 wrote to memory of 4812 3288 8b5e5f088dc4a50a4bd708ed933afac9_mafia_JC.exe 81 PID 3288 wrote to memory of 4812 3288 8b5e5f088dc4a50a4bd708ed933afac9_mafia_JC.exe 81 PID 4812 wrote to memory of 2980 4812 8656.tmp 82 PID 4812 wrote to memory of 2980 4812 8656.tmp 82 PID 4812 wrote to memory of 2980 4812 8656.tmp 82 PID 2980 wrote to memory of 3408 2980 8722.tmp 83 PID 2980 wrote to memory of 3408 2980 8722.tmp 83 PID 2980 wrote to memory of 3408 2980 8722.tmp 83 PID 3408 wrote to memory of 1248 3408 880C.tmp 84 PID 3408 wrote to memory of 1248 3408 880C.tmp 84 PID 3408 wrote to memory of 1248 3408 880C.tmp 84 PID 1248 wrote to memory of 4520 1248 8906.tmp 85 PID 1248 wrote to memory of 4520 1248 8906.tmp 85 PID 1248 wrote to memory of 4520 1248 8906.tmp 85 PID 4520 wrote to memory of 4260 4520 89C1.tmp 86 PID 4520 wrote to memory of 4260 4520 89C1.tmp 86 PID 4520 wrote to memory of 4260 4520 89C1.tmp 86 PID 4260 wrote to memory of 3992 4260 8A9C.tmp 87 PID 4260 wrote to memory of 3992 4260 8A9C.tmp 87 PID 4260 wrote to memory of 3992 4260 8A9C.tmp 87 PID 3992 wrote to memory of 1812 3992 8B58.tmp 88 PID 3992 wrote to memory of 1812 3992 8B58.tmp 88 PID 3992 wrote to memory of 1812 3992 8B58.tmp 88 PID 1812 wrote to memory of 2316 1812 8D1D.tmp 89 PID 1812 wrote to memory of 2316 1812 8D1D.tmp 89 PID 1812 wrote to memory of 2316 1812 8D1D.tmp 89 PID 2316 wrote to memory of 4996 2316 8DC9.tmp 90 PID 2316 wrote to memory of 4996 2316 8DC9.tmp 90 PID 2316 wrote to memory of 4996 2316 8DC9.tmp 90 PID 4996 wrote to memory of 4204 4996 8EC3.tmp 91 PID 4996 wrote to memory of 4204 4996 8EC3.tmp 91 PID 4996 wrote to memory of 4204 4996 8EC3.tmp 91 PID 4204 wrote to memory of 4892 4204 8F4F.tmp 92 PID 4204 wrote to memory of 4892 4204 8F4F.tmp 92 PID 4204 wrote to memory of 4892 4204 8F4F.tmp 92 PID 4892 wrote to memory of 2456 4892 9088.tmp 93 PID 4892 wrote to memory of 2456 4892 9088.tmp 93 PID 4892 wrote to memory of 2456 4892 9088.tmp 93 PID 2456 wrote to memory of 3228 2456 9143.tmp 94 PID 2456 wrote to memory of 3228 2456 9143.tmp 94 PID 2456 wrote to memory of 3228 2456 9143.tmp 94 PID 3228 wrote to memory of 4484 3228 923D.tmp 95 PID 3228 wrote to memory of 4484 3228 923D.tmp 95 PID 3228 wrote to memory of 4484 3228 923D.tmp 95 PID 4484 wrote to memory of 2636 4484 92DA.tmp 96 PID 4484 wrote to memory of 2636 4484 92DA.tmp 96 PID 4484 wrote to memory of 2636 4484 92DA.tmp 96 PID 2636 wrote to memory of 1536 2636 93B4.tmp 97 PID 2636 wrote to memory of 1536 2636 93B4.tmp 97 PID 2636 wrote to memory of 1536 2636 93B4.tmp 97 PID 1536 wrote to memory of 1304 1536 9460.tmp 98 PID 1536 wrote to memory of 1304 1536 9460.tmp 98 PID 1536 wrote to memory of 1304 1536 9460.tmp 98 PID 1304 wrote to memory of 1060 1304 953B.tmp 99 PID 1304 wrote to memory of 1060 1304 953B.tmp 99 PID 1304 wrote to memory of 1060 1304 953B.tmp 99 PID 1060 wrote to memory of 1860 1060 95E7.tmp 100 PID 1060 wrote to memory of 1860 1060 95E7.tmp 100 PID 1060 wrote to memory of 1860 1060 95E7.tmp 100 PID 1860 wrote to memory of 4860 1860 9683.tmp 101 PID 1860 wrote to memory of 4860 1860 9683.tmp 101 PID 1860 wrote to memory of 4860 1860 9683.tmp 101 PID 4860 wrote to memory of 1308 4860 975E.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b5e5f088dc4a50a4bd708ed933afac9_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\8b5e5f088dc4a50a4bd708ed933afac9_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\8722.tmp"C:\Users\Admin\AppData\Local\Temp\8722.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\880C.tmp"C:\Users\Admin\AppData\Local\Temp\880C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\8906.tmp"C:\Users\Admin\AppData\Local\Temp\8906.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\89C1.tmp"C:\Users\Admin\AppData\Local\Temp\89C1.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\8B58.tmp"C:\Users\Admin\AppData\Local\Temp\8B58.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\9143.tmp"C:\Users\Admin\AppData\Local\Temp\9143.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\923D.tmp"C:\Users\Admin\AppData\Local\Temp\923D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\92DA.tmp"C:\Users\Admin\AppData\Local\Temp\92DA.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\93B4.tmp"C:\Users\Admin\AppData\Local\Temp\93B4.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\9460.tmp"C:\Users\Admin\AppData\Local\Temp\9460.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\95E7.tmp"C:\Users\Admin\AppData\Local\Temp\95E7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\97DB.tmp"C:\Users\Admin\AppData\Local\Temp\97DB.tmp"23⤵
- Executes dropped EXE
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\9867.tmp"C:\Users\Admin\AppData\Local\Temp\9867.tmp"24⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\98F4.tmp"C:\Users\Admin\AppData\Local\Temp\98F4.tmp"25⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\99A0.tmp"C:\Users\Admin\AppData\Local\Temp\99A0.tmp"26⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"27⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"28⤵
- Executes dropped EXE
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"29⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"30⤵
- Executes dropped EXE
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"31⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"32⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"33⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"34⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"35⤵
- Executes dropped EXE
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"36⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\A095.tmp"C:\Users\Admin\AppData\Local\Temp\A095.tmp"37⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\A112.tmp"C:\Users\Admin\AppData\Local\Temp\A112.tmp"38⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"39⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"40⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"41⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"42⤵
- Executes dropped EXE
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"43⤵
- Executes dropped EXE
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"44⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\A47D.tmp"C:\Users\Admin\AppData\Local\Temp\A47D.tmp"45⤵
- Executes dropped EXE
PID:556 -
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"46⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"47⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"48⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\A671.tmp"C:\Users\Admin\AppData\Local\Temp\A671.tmp"49⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"50⤵
- Executes dropped EXE
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"51⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"52⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"53⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"54⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"55⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"56⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\AA69.tmp"C:\Users\Admin\AppData\Local\Temp\AA69.tmp"57⤵
- Executes dropped EXE
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"58⤵
- Executes dropped EXE
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"59⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"60⤵
- Executes dropped EXE
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"61⤵
- Executes dropped EXE
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\AD09.tmp"C:\Users\Admin\AppData\Local\Temp\AD09.tmp"62⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"63⤵
- Executes dropped EXE
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\AE12.tmp"C:\Users\Admin\AppData\Local\Temp\AE12.tmp"64⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"65⤵
- Executes dropped EXE
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"66⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"67⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"68⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"69⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\B12F.tmp"C:\Users\Admin\AppData\Local\Temp\B12F.tmp"70⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"71⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\B21A.tmp"C:\Users\Admin\AppData\Local\Temp\B21A.tmp"72⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"73⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"74⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"75⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\B45C.tmp"C:\Users\Admin\AppData\Local\Temp\B45C.tmp"76⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"77⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\B575.tmp"C:\Users\Admin\AppData\Local\Temp\B575.tmp"78⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\B602.tmp"C:\Users\Admin\AppData\Local\Temp\B602.tmp"79⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\B67F.tmp"C:\Users\Admin\AppData\Local\Temp\B67F.tmp"80⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"81⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\B779.tmp"C:\Users\Admin\AppData\Local\Temp\B779.tmp"82⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\B815.tmp"C:\Users\Admin\AppData\Local\Temp\B815.tmp"83⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\B892.tmp"C:\Users\Admin\AppData\Local\Temp\B892.tmp"84⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\B90F.tmp"C:\Users\Admin\AppData\Local\Temp\B90F.tmp"85⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\B98C.tmp"C:\Users\Admin\AppData\Local\Temp\B98C.tmp"86⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\BA09.tmp"C:\Users\Admin\AppData\Local\Temp\BA09.tmp"87⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"88⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\BB22.tmp"C:\Users\Admin\AppData\Local\Temp\BB22.tmp"89⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\BB80.tmp"C:\Users\Admin\AppData\Local\Temp\BB80.tmp"90⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\BBED.tmp"C:\Users\Admin\AppData\Local\Temp\BBED.tmp"91⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"92⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"93⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\BD35.tmp"C:\Users\Admin\AppData\Local\Temp\BD35.tmp"94⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"95⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"96⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"97⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\BF68.tmp"C:\Users\Admin\AppData\Local\Temp\BF68.tmp"98⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"99⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\C052.tmp"C:\Users\Admin\AppData\Local\Temp\C052.tmp"100⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"101⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"102⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"103⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"104⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"105⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\C35F.tmp"C:\Users\Admin\AppData\Local\Temp\C35F.tmp"106⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\C41B.tmp"C:\Users\Admin\AppData\Local\Temp\C41B.tmp"107⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\C498.tmp"C:\Users\Admin\AppData\Local\Temp\C498.tmp"108⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"109⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\C553.tmp"C:\Users\Admin\AppData\Local\Temp\C553.tmp"110⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"111⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\C63E.tmp"C:\Users\Admin\AppData\Local\Temp\C63E.tmp"112⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"113⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\C728.tmp"C:\Users\Admin\AppData\Local\Temp\C728.tmp"114⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\C796.tmp"C:\Users\Admin\AppData\Local\Temp\C796.tmp"115⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\C803.tmp"C:\Users\Admin\AppData\Local\Temp\C803.tmp"116⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\C870.tmp"C:\Users\Admin\AppData\Local\Temp\C870.tmp"117⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"118⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\C97A.tmp"C:\Users\Admin\AppData\Local\Temp\C97A.tmp"119⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\CA07.tmp"C:\Users\Admin\AppData\Local\Temp\CA07.tmp"120⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\CA84.tmp"C:\Users\Admin\AppData\Local\Temp\CA84.tmp"121⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\CB20.tmp"C:\Users\Admin\AppData\Local\Temp\CB20.tmp"122⤵PID:3916
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-