Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
25-08-2023 11:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8f26ec533ec512641764a2da6dfeba35_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
8f26ec533ec512641764a2da6dfeba35_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
8f26ec533ec512641764a2da6dfeba35_mafia_JC.exe
-
Size
488KB
-
MD5
8f26ec533ec512641764a2da6dfeba35
-
SHA1
bdb9cd2c5203d9099050a3250ffcd80019d229f4
-
SHA256
8c8af396f318c76d50c10e2761abf74c9b00853a953450d5096edda79066771a
-
SHA512
6ee84ada98f937e3737d72837f62c74fb1039b36656641bd1581415eabbc3bc5321de06fb6b6fe64eb7042c659aec3300afcca71041919efdc515f1d18291c0b
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7bAnj2R/4MKN8PyExWqB9KTM9s4MSwW/m93Ru:/U5rCOTeiDka/KNW/B94SwhdRoaFINZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1124 70FA.tmp 3304 71A6.tmp 1864 7251.tmp 4784 731D.tmp 3228 73C8.tmp 628 7474.tmp 2492 7511.tmp 4684 758E.tmp 3544 760B.tmp 672 76F5.tmp 4568 7791.tmp 4480 786C.tmp 2256 7937.tmp 2864 7A02.tmp 2496 7AAE.tmp 4028 7B4A.tmp 3640 7C25.tmp 3948 7CD1.tmp 1664 7DFA.tmp 4924 7EB5.tmp 1608 7F80.tmp 4884 801D.tmp 4044 80F7.tmp 3608 8184.tmp 2520 8220.tmp 4272 830B.tmp 3932 83D6.tmp 1548 8462.tmp 1224 84EF.tmp 764 85BA.tmp 2944 8647.tmp 3844 86D3.tmp 2280 877F.tmp 5096 884A.tmp 368 88D7.tmp 2616 8944.tmp 3380 89A2.tmp 4064 8A2F.tmp 712 8ACB.tmp 224 8B38.tmp 4192 8BB5.tmp 4148 8C32.tmp 2800 8CAF.tmp 4856 8D1D.tmp 4352 8E26.tmp 2840 8EA3.tmp 228 8F01.tmp 4724 8F6F.tmp 2492 8FCC.tmp 1288 9049.tmp 672 90A7.tmp 3728 9105.tmp 3888 9163.tmp 3052 93D4.tmp 2328 94BE.tmp 3852 951C.tmp 4940 9589.tmp 4028 95F6.tmp 1784 9664.tmp 3264 973F.tmp 392 97AC.tmp 4860 9819.tmp 2208 9887.tmp 4476 98E4.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2768 wrote to memory of 1124 2768 8f26ec533ec512641764a2da6dfeba35_mafia_JC.exe 82 PID 2768 wrote to memory of 1124 2768 8f26ec533ec512641764a2da6dfeba35_mafia_JC.exe 82 PID 2768 wrote to memory of 1124 2768 8f26ec533ec512641764a2da6dfeba35_mafia_JC.exe 82 PID 1124 wrote to memory of 3304 1124 70FA.tmp 83 PID 1124 wrote to memory of 3304 1124 70FA.tmp 83 PID 1124 wrote to memory of 3304 1124 70FA.tmp 83 PID 3304 wrote to memory of 1864 3304 71A6.tmp 84 PID 3304 wrote to memory of 1864 3304 71A6.tmp 84 PID 3304 wrote to memory of 1864 3304 71A6.tmp 84 PID 1864 wrote to memory of 4784 1864 7251.tmp 85 PID 1864 wrote to memory of 4784 1864 7251.tmp 85 PID 1864 wrote to memory of 4784 1864 7251.tmp 85 PID 4784 wrote to memory of 3228 4784 731D.tmp 86 PID 4784 wrote to memory of 3228 4784 731D.tmp 86 PID 4784 wrote to memory of 3228 4784 731D.tmp 86 PID 3228 wrote to memory of 628 3228 73C8.tmp 87 PID 3228 wrote to memory of 628 3228 73C8.tmp 87 PID 3228 wrote to memory of 628 3228 73C8.tmp 87 PID 628 wrote to memory of 2492 628 7474.tmp 88 PID 628 wrote to memory of 2492 628 7474.tmp 88 PID 628 wrote to memory of 2492 628 7474.tmp 88 PID 2492 wrote to memory of 4684 2492 7511.tmp 89 PID 2492 wrote to memory of 4684 2492 7511.tmp 89 PID 2492 wrote to memory of 4684 2492 7511.tmp 89 PID 4684 wrote to memory of 3544 4684 758E.tmp 90 PID 4684 wrote to memory of 3544 4684 758E.tmp 90 PID 4684 wrote to memory of 3544 4684 758E.tmp 90 PID 3544 wrote to memory of 672 3544 760B.tmp 91 PID 3544 wrote to memory of 672 3544 760B.tmp 91 PID 3544 wrote to memory of 672 3544 760B.tmp 91 PID 672 wrote to memory of 4568 672 76F5.tmp 92 PID 672 wrote to memory of 4568 672 76F5.tmp 92 PID 672 wrote to memory of 4568 672 76F5.tmp 92 PID 4568 wrote to memory of 4480 4568 7791.tmp 93 PID 4568 wrote to memory of 4480 4568 7791.tmp 93 PID 4568 wrote to memory of 4480 4568 7791.tmp 93 PID 4480 wrote to memory of 2256 4480 786C.tmp 94 PID 4480 wrote to memory of 2256 4480 786C.tmp 94 PID 4480 wrote to memory of 2256 4480 786C.tmp 94 PID 2256 wrote to memory of 2864 2256 7937.tmp 97 PID 2256 wrote to memory of 2864 2256 7937.tmp 97 PID 2256 wrote to memory of 2864 2256 7937.tmp 97 PID 2864 wrote to memory of 2496 2864 7A02.tmp 98 PID 2864 wrote to memory of 2496 2864 7A02.tmp 98 PID 2864 wrote to memory of 2496 2864 7A02.tmp 98 PID 2496 wrote to memory of 4028 2496 7AAE.tmp 99 PID 2496 wrote to memory of 4028 2496 7AAE.tmp 99 PID 2496 wrote to memory of 4028 2496 7AAE.tmp 99 PID 4028 wrote to memory of 3640 4028 7B4A.tmp 100 PID 4028 wrote to memory of 3640 4028 7B4A.tmp 100 PID 4028 wrote to memory of 3640 4028 7B4A.tmp 100 PID 3640 wrote to memory of 3948 3640 7C25.tmp 101 PID 3640 wrote to memory of 3948 3640 7C25.tmp 101 PID 3640 wrote to memory of 3948 3640 7C25.tmp 101 PID 3948 wrote to memory of 1664 3948 7CD1.tmp 103 PID 3948 wrote to memory of 1664 3948 7CD1.tmp 103 PID 3948 wrote to memory of 1664 3948 7CD1.tmp 103 PID 1664 wrote to memory of 4924 1664 7DFA.tmp 104 PID 1664 wrote to memory of 4924 1664 7DFA.tmp 104 PID 1664 wrote to memory of 4924 1664 7DFA.tmp 104 PID 4924 wrote to memory of 1608 4924 7EB5.tmp 106 PID 4924 wrote to memory of 1608 4924 7EB5.tmp 106 PID 4924 wrote to memory of 1608 4924 7EB5.tmp 106 PID 1608 wrote to memory of 4884 1608 7F80.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f26ec533ec512641764a2da6dfeba35_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\8f26ec533ec512641764a2da6dfeba35_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\760B.tmp"C:\Users\Admin\AppData\Local\Temp\760B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\76F5.tmp"C:\Users\Admin\AppData\Local\Temp\76F5.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Users\Admin\AppData\Local\Temp\7791.tmp"C:\Users\Admin\AppData\Local\Temp\7791.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\786C.tmp"C:\Users\Admin\AppData\Local\Temp\786C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\7937.tmp"C:\Users\Admin\AppData\Local\Temp\7937.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\7A02.tmp"C:\Users\Admin\AppData\Local\Temp\7A02.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\7F80.tmp"C:\Users\Admin\AppData\Local\Temp\7F80.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\801D.tmp"C:\Users\Admin\AppData\Local\Temp\801D.tmp"23⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\80F7.tmp"C:\Users\Admin\AppData\Local\Temp\80F7.tmp"24⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\8184.tmp"C:\Users\Admin\AppData\Local\Temp\8184.tmp"25⤵
- Executes dropped EXE
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\8220.tmp"C:\Users\Admin\AppData\Local\Temp\8220.tmp"26⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\830B.tmp"C:\Users\Admin\AppData\Local\Temp\830B.tmp"27⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\83D6.tmp"C:\Users\Admin\AppData\Local\Temp\83D6.tmp"28⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\8462.tmp"C:\Users\Admin\AppData\Local\Temp\8462.tmp"29⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\84EF.tmp"C:\Users\Admin\AppData\Local\Temp\84EF.tmp"30⤵
- Executes dropped EXE
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\85BA.tmp"C:\Users\Admin\AppData\Local\Temp\85BA.tmp"31⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\8647.tmp"C:\Users\Admin\AppData\Local\Temp\8647.tmp"32⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\86D3.tmp"C:\Users\Admin\AppData\Local\Temp\86D3.tmp"33⤵
- Executes dropped EXE
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\877F.tmp"C:\Users\Admin\AppData\Local\Temp\877F.tmp"34⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"35⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"36⤵
- Executes dropped EXE
PID:368 -
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"37⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\89A2.tmp"C:\Users\Admin\AppData\Local\Temp\89A2.tmp"38⤵
- Executes dropped EXE
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"39⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"40⤵
- Executes dropped EXE
PID:712 -
C:\Users\Admin\AppData\Local\Temp\8B38.tmp"C:\Users\Admin\AppData\Local\Temp\8B38.tmp"41⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"42⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\8C32.tmp"C:\Users\Admin\AppData\Local\Temp\8C32.tmp"43⤵
- Executes dropped EXE
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"44⤵
- Executes dropped EXE
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"45⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\8E26.tmp"C:\Users\Admin\AppData\Local\Temp\8E26.tmp"46⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"47⤵
- Executes dropped EXE
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\8F01.tmp"C:\Users\Admin\AppData\Local\Temp\8F01.tmp"48⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"49⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"50⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\9049.tmp"C:\Users\Admin\AppData\Local\Temp\9049.tmp"51⤵
- Executes dropped EXE
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\90A7.tmp"C:\Users\Admin\AppData\Local\Temp\90A7.tmp"52⤵
- Executes dropped EXE
PID:672 -
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"53⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\9163.tmp"C:\Users\Admin\AppData\Local\Temp\9163.tmp"54⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"55⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\94BE.tmp"C:\Users\Admin\AppData\Local\Temp\94BE.tmp"56⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\951C.tmp"C:\Users\Admin\AppData\Local\Temp\951C.tmp"57⤵
- Executes dropped EXE
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"58⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\95F6.tmp"C:\Users\Admin\AppData\Local\Temp\95F6.tmp"59⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\9664.tmp"C:\Users\Admin\AppData\Local\Temp\9664.tmp"60⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"61⤵
- Executes dropped EXE
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"62⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\9819.tmp"C:\Users\Admin\AppData\Local\Temp\9819.tmp"63⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"64⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\98E4.tmp"C:\Users\Admin\AppData\Local\Temp\98E4.tmp"65⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\9942.tmp"C:\Users\Admin\AppData\Local\Temp\9942.tmp"66⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"67⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"68⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"69⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"70⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"71⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"72⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"73⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"74⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"75⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\9D78.tmp"C:\Users\Admin\AppData\Local\Temp\9D78.tmp"76⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"77⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"78⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"79⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"80⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"81⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"82⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\A141.tmp"C:\Users\Admin\AppData\Local\Temp\A141.tmp"83⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"84⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"85⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"86⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\A364.tmp"C:\Users\Admin\AppData\Local\Temp\A364.tmp"87⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"88⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\A46E.tmp"C:\Users\Admin\AppData\Local\Temp\A46E.tmp"89⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"90⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"91⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"92⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\A671.tmp"C:\Users\Admin\AppData\Local\Temp\A671.tmp"93⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"94⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"95⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"96⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"97⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"98⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"99⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"100⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\AA88.tmp"C:\Users\Admin\AppData\Local\Temp\AA88.tmp"101⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"102⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"103⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"104⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"105⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"106⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"107⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"108⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\AE80.tmp"C:\Users\Admin\AppData\Local\Temp\AE80.tmp"109⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"110⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"111⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"112⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"113⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\B18D.tmp"C:\Users\Admin\AppData\Local\Temp\B18D.tmp"114⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\B21A.tmp"C:\Users\Admin\AppData\Local\Temp\B21A.tmp"115⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\B287.tmp"C:\Users\Admin\AppData\Local\Temp\B287.tmp"116⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\B314.tmp"C:\Users\Admin\AppData\Local\Temp\B314.tmp"117⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"118⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\B48B.tmp"C:\Users\Admin\AppData\Local\Temp\B48B.tmp"119⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\B527.tmp"C:\Users\Admin\AppData\Local\Temp\B527.tmp"120⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"121⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\B66F.tmp"C:\Users\Admin\AppData\Local\Temp\B66F.tmp"122⤵PID:2280
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-