Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
24-08-2023 19:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8ca116da3219e00d775e063a4f697385_mafia_JC.exe
Resource
win7-20230824-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
8ca116da3219e00d775e063a4f697385_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
8ca116da3219e00d775e063a4f697385_mafia_JC.exe
-
Size
486KB
-
MD5
8ca116da3219e00d775e063a4f697385
-
SHA1
0718c673905006b9a4235b6f255454b4ef7413f8
-
SHA256
1936bc012571538c51f4ae416dedcf7517376fc963d9f15f476219f438e7e68f
-
SHA512
67d7a1041984b06b6be4eb2c186b9ddbd33f3d2561230045ac3a0790ff883656f22047d18e17c47a75fc11b3f5ddd85f418e1d33f4e1b79e0b1e21bb086cf0ec
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7C1rKFlFeZxldZ/5syIyiJ+oA6gjovsH3dZ:/U5rCOTeiDC1rKFLSx/Z/OJ+rjnNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2236 6CE3.tmp 2340 6D6F.tmp 2712 6E3B.tmp 3004 6F06.tmp 5044 6FC1.tmp 1580 706D.tmp 2388 7109.tmp 2160 71A6.tmp 4496 7290.tmp 4244 731D.tmp 5080 73B9.tmp 2240 7474.tmp 1576 753F.tmp 4948 762A.tmp 3900 7791.tmp 3908 782D.tmp 3320 78E9.tmp 4068 7976.tmp 3724 7A60.tmp 4484 7B2B.tmp 1920 7C73.tmp 4464 7D00.tmp 3820 7D6D.tmp 3792 7DEA.tmp 4180 7E77.tmp 4552 7F13.tmp 1972 7F90.tmp 1340 804C.tmp 3616 80D8.tmp 2076 8184.tmp 3644 824F.tmp 1968 82DC.tmp 1296 8397.tmp 4984 8405.tmp 3460 8482.tmp 3024 84EF.tmp 4884 855C.tmp 2936 85F9.tmp 1160 8666.tmp 4632 86F3.tmp 1288 8760.tmp 4776 87DD.tmp 4468 886A.tmp 3632 8916.tmp 4320 8993.tmp 1640 8A10.tmp 3272 8ABB.tmp 2288 8B38.tmp 564 8BB5.tmp 4616 8C52.tmp 3932 8DE8.tmp 2860 8E65.tmp 1856 8F01.tmp 3916 8F8E.tmp 2924 9049.tmp 4532 90C6.tmp 4592 9153.tmp 4816 91EF.tmp 5044 928B.tmp 3848 9308.tmp 3372 93A5.tmp 2316 9422.tmp 364 94AE.tmp 2120 953B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4460 wrote to memory of 2236 4460 8ca116da3219e00d775e063a4f697385_mafia_JC.exe 81 PID 4460 wrote to memory of 2236 4460 8ca116da3219e00d775e063a4f697385_mafia_JC.exe 81 PID 4460 wrote to memory of 2236 4460 8ca116da3219e00d775e063a4f697385_mafia_JC.exe 81 PID 2236 wrote to memory of 2340 2236 6CE3.tmp 82 PID 2236 wrote to memory of 2340 2236 6CE3.tmp 82 PID 2236 wrote to memory of 2340 2236 6CE3.tmp 82 PID 2340 wrote to memory of 2712 2340 6D6F.tmp 83 PID 2340 wrote to memory of 2712 2340 6D6F.tmp 83 PID 2340 wrote to memory of 2712 2340 6D6F.tmp 83 PID 2712 wrote to memory of 3004 2712 6E3B.tmp 84 PID 2712 wrote to memory of 3004 2712 6E3B.tmp 84 PID 2712 wrote to memory of 3004 2712 6E3B.tmp 84 PID 3004 wrote to memory of 5044 3004 6F06.tmp 85 PID 3004 wrote to memory of 5044 3004 6F06.tmp 85 PID 3004 wrote to memory of 5044 3004 6F06.tmp 85 PID 5044 wrote to memory of 1580 5044 6FC1.tmp 86 PID 5044 wrote to memory of 1580 5044 6FC1.tmp 86 PID 5044 wrote to memory of 1580 5044 6FC1.tmp 86 PID 1580 wrote to memory of 2388 1580 706D.tmp 87 PID 1580 wrote to memory of 2388 1580 706D.tmp 87 PID 1580 wrote to memory of 2388 1580 706D.tmp 87 PID 2388 wrote to memory of 2160 2388 7109.tmp 88 PID 2388 wrote to memory of 2160 2388 7109.tmp 88 PID 2388 wrote to memory of 2160 2388 7109.tmp 88 PID 2160 wrote to memory of 4496 2160 71A6.tmp 89 PID 2160 wrote to memory of 4496 2160 71A6.tmp 89 PID 2160 wrote to memory of 4496 2160 71A6.tmp 89 PID 4496 wrote to memory of 4244 4496 7290.tmp 90 PID 4496 wrote to memory of 4244 4496 7290.tmp 90 PID 4496 wrote to memory of 4244 4496 7290.tmp 90 PID 4244 wrote to memory of 5080 4244 731D.tmp 91 PID 4244 wrote to memory of 5080 4244 731D.tmp 91 PID 4244 wrote to memory of 5080 4244 731D.tmp 91 PID 5080 wrote to memory of 2240 5080 73B9.tmp 92 PID 5080 wrote to memory of 2240 5080 73B9.tmp 92 PID 5080 wrote to memory of 2240 5080 73B9.tmp 92 PID 2240 wrote to memory of 1576 2240 7474.tmp 93 PID 2240 wrote to memory of 1576 2240 7474.tmp 93 PID 2240 wrote to memory of 1576 2240 7474.tmp 93 PID 1576 wrote to memory of 4948 1576 753F.tmp 94 PID 1576 wrote to memory of 4948 1576 753F.tmp 94 PID 1576 wrote to memory of 4948 1576 753F.tmp 94 PID 4948 wrote to memory of 3900 4948 762A.tmp 95 PID 4948 wrote to memory of 3900 4948 762A.tmp 95 PID 4948 wrote to memory of 3900 4948 762A.tmp 95 PID 3900 wrote to memory of 3908 3900 7791.tmp 96 PID 3900 wrote to memory of 3908 3900 7791.tmp 96 PID 3900 wrote to memory of 3908 3900 7791.tmp 96 PID 3908 wrote to memory of 3320 3908 782D.tmp 99 PID 3908 wrote to memory of 3320 3908 782D.tmp 99 PID 3908 wrote to memory of 3320 3908 782D.tmp 99 PID 3320 wrote to memory of 4068 3320 78E9.tmp 100 PID 3320 wrote to memory of 4068 3320 78E9.tmp 100 PID 3320 wrote to memory of 4068 3320 78E9.tmp 100 PID 4068 wrote to memory of 3724 4068 7976.tmp 101 PID 4068 wrote to memory of 3724 4068 7976.tmp 101 PID 4068 wrote to memory of 3724 4068 7976.tmp 101 PID 3724 wrote to memory of 4484 3724 7A60.tmp 102 PID 3724 wrote to memory of 4484 3724 7A60.tmp 102 PID 3724 wrote to memory of 4484 3724 7A60.tmp 102 PID 4484 wrote to memory of 1920 4484 7B2B.tmp 103 PID 4484 wrote to memory of 1920 4484 7B2B.tmp 103 PID 4484 wrote to memory of 1920 4484 7B2B.tmp 103 PID 1920 wrote to memory of 4464 1920 7C73.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ca116da3219e00d775e063a4f697385_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\8ca116da3219e00d775e063a4f697385_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\7290.tmp"C:\Users\Admin\AppData\Local\Temp\7290.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\7791.tmp"C:\Users\Admin\AppData\Local\Temp\7791.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\782D.tmp"C:\Users\Admin\AppData\Local\Temp\782D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\7976.tmp"C:\Users\Admin\AppData\Local\Temp\7976.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\7A60.tmp"C:\Users\Admin\AppData\Local\Temp\7A60.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\7C73.tmp"C:\Users\Admin\AppData\Local\Temp\7C73.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\7D00.tmp"C:\Users\Admin\AppData\Local\Temp\7D00.tmp"23⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"24⤵
- Executes dropped EXE
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"25⤵
- Executes dropped EXE
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\7E77.tmp"C:\Users\Admin\AppData\Local\Temp\7E77.tmp"26⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\7F13.tmp"C:\Users\Admin\AppData\Local\Temp\7F13.tmp"27⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\7F90.tmp"C:\Users\Admin\AppData\Local\Temp\7F90.tmp"28⤵
- Executes dropped EXE
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\804C.tmp"C:\Users\Admin\AppData\Local\Temp\804C.tmp"29⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\80D8.tmp"C:\Users\Admin\AppData\Local\Temp\80D8.tmp"30⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\8184.tmp"C:\Users\Admin\AppData\Local\Temp\8184.tmp"31⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\824F.tmp"C:\Users\Admin\AppData\Local\Temp\824F.tmp"32⤵
- Executes dropped EXE
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\82DC.tmp"C:\Users\Admin\AppData\Local\Temp\82DC.tmp"33⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"34⤵
- Executes dropped EXE
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\8405.tmp"C:\Users\Admin\AppData\Local\Temp\8405.tmp"35⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\8482.tmp"C:\Users\Admin\AppData\Local\Temp\8482.tmp"36⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\84EF.tmp"C:\Users\Admin\AppData\Local\Temp\84EF.tmp"37⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\855C.tmp"C:\Users\Admin\AppData\Local\Temp\855C.tmp"38⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\85F9.tmp"C:\Users\Admin\AppData\Local\Temp\85F9.tmp"39⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\8666.tmp"C:\Users\Admin\AppData\Local\Temp\8666.tmp"40⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\86F3.tmp"C:\Users\Admin\AppData\Local\Temp\86F3.tmp"41⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\8760.tmp"C:\Users\Admin\AppData\Local\Temp\8760.tmp"42⤵
- Executes dropped EXE
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\87DD.tmp"C:\Users\Admin\AppData\Local\Temp\87DD.tmp"43⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\886A.tmp"C:\Users\Admin\AppData\Local\Temp\886A.tmp"44⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\8916.tmp"C:\Users\Admin\AppData\Local\Temp\8916.tmp"45⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\8993.tmp"C:\Users\Admin\AppData\Local\Temp\8993.tmp"46⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\8A10.tmp"C:\Users\Admin\AppData\Local\Temp\8A10.tmp"47⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"48⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\8B38.tmp"C:\Users\Admin\AppData\Local\Temp\8B38.tmp"49⤵
- Executes dropped EXE
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"50⤵
- Executes dropped EXE
PID:564 -
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"51⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"52⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"53⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"54⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\8F01.tmp"C:\Users\Admin\AppData\Local\Temp\8F01.tmp"55⤵
- Executes dropped EXE
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"56⤵
- Executes dropped EXE
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\9049.tmp"C:\Users\Admin\AppData\Local\Temp\9049.tmp"57⤵
- Executes dropped EXE
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"58⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\9153.tmp"C:\Users\Admin\AppData\Local\Temp\9153.tmp"59⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\91EF.tmp"C:\Users\Admin\AppData\Local\Temp\91EF.tmp"60⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"61⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\9308.tmp"C:\Users\Admin\AppData\Local\Temp\9308.tmp"62⤵
- Executes dropped EXE
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\93A5.tmp"C:\Users\Admin\AppData\Local\Temp\93A5.tmp"63⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\9422.tmp"C:\Users\Admin\AppData\Local\Temp\9422.tmp"64⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\94AE.tmp"C:\Users\Admin\AppData\Local\Temp\94AE.tmp"65⤵
- Executes dropped EXE
PID:364 -
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"66⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"67⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"68⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\9693.tmp"C:\Users\Admin\AppData\Local\Temp\9693.tmp"69⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\9700.tmp"C:\Users\Admin\AppData\Local\Temp\9700.tmp"70⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\977D.tmp"C:\Users\Admin\AppData\Local\Temp\977D.tmp"71⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\9819.tmp"C:\Users\Admin\AppData\Local\Temp\9819.tmp"72⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\98A6.tmp"C:\Users\Admin\AppData\Local\Temp\98A6.tmp"73⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"74⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"75⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"76⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"77⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"78⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"79⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"80⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"81⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"82⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"83⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"84⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"85⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"86⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"87⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\A028.tmp"C:\Users\Admin\AppData\Local\Temp\A028.tmp"88⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"89⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"90⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"91⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\A23B.tmp"C:\Users\Admin\AppData\Local\Temp\A23B.tmp"92⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"93⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\A325.tmp"C:\Users\Admin\AppData\Local\Temp\A325.tmp"94⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"95⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"96⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"97⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"98⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"99⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\A642.tmp"C:\Users\Admin\AppData\Local\Temp\A642.tmp"100⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"101⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\A73C.tmp"C:\Users\Admin\AppData\Local\Temp\A73C.tmp"102⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"103⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"104⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"105⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"106⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"107⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"108⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\AB44.tmp"C:\Users\Admin\AppData\Local\Temp\AB44.tmp"109⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"110⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"111⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"112⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\AD66.tmp"C:\Users\Admin\AppData\Local\Temp\AD66.tmp"113⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"114⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\AE80.tmp"C:\Users\Admin\AppData\Local\Temp\AE80.tmp"115⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"116⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"117⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"118⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\B074.tmp"C:\Users\Admin\AppData\Local\Temp\B074.tmp"119⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"120⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\B15E.tmp"C:\Users\Admin\AppData\Local\Temp\B15E.tmp"121⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"122⤵PID:4352
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-