Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2023, 16:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9d8bb22ca401d46dbf733472c4e325e2_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
9d8bb22ca401d46dbf733472c4e325e2_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
9d8bb22ca401d46dbf733472c4e325e2_mafia_JC.exe
-
Size
488KB
-
MD5
9d8bb22ca401d46dbf733472c4e325e2
-
SHA1
40def0bb4e19041c67f074c6aa8a0bbcbdedd6b0
-
SHA256
e1fd0f4ee92db198ef221c7352a240bb9c0149286b83f3b621916f60af6b044f
-
SHA512
60fa1ef3abdde9a555a9de7329f6c4f2051934b9809373ab21b668f4f791fa3a7ae23f90542861965370289accf25cd3188408d7d6b9497195eadd86f39c1ffc
-
SSDEEP
12288:/U5rCOTeiDWrhT9swcoDbKr0hQbdnxwNZ:/UQOJDWs2urZbdnmN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4716 805B.tmp 5056 8146.tmp 1672 8220.tmp 2300 82CC.tmp 1940 8368.tmp 3796 8434.tmp 3288 84DF.tmp 2868 857C.tmp 3172 8685.tmp 2680 877F.tmp 1476 884A.tmp 2420 8925.tmp 2652 89D1.tmp 556 8AEA.tmp 3332 8BA6.tmp 4464 8C71.tmp 3712 8CEE.tmp 5008 8DB9.tmp 3380 8E55.tmp 4136 8F11.tmp 2736 902A.tmp 1724 90D6.tmp 912 9163.tmp 744 91EF.tmp 640 92BA.tmp 1804 9357.tmp 1772 93D4.tmp 3388 9470.tmp 1592 952B.tmp 388 95E7.tmp 4324 96B2.tmp 4188 975E.tmp 4768 9829.tmp 4932 98D5.tmp 4668 9961.tmp 3092 99DE.tmp 4872 9A6B.tmp 2804 9B17.tmp 1032 9BA4.tmp 4332 9C4F.tmp 3784 9CEC.tmp 2356 9D69.tmp 400 9DF5.tmp 5016 9EA1.tmp 2096 9F3D.tmp 3840 9FF9.tmp 1704 A086.tmp 1996 A103.tmp 4600 A19F.tmp 3932 A24B.tmp 2648 A2D7.tmp 4380 A374.tmp 3940 A410.tmp 1452 A4AC.tmp 1908 A529.tmp 2992 A5F4.tmp 3624 A690.tmp 4148 A72D.tmp 4596 A7C9.tmp 3172 A875.tmp 3220 A911.tmp 4432 A99E.tmp 3904 AA2A.tmp 2848 AAB7.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 960 wrote to memory of 4716 960 9d8bb22ca401d46dbf733472c4e325e2_mafia_JC.exe 82 PID 960 wrote to memory of 4716 960 9d8bb22ca401d46dbf733472c4e325e2_mafia_JC.exe 82 PID 960 wrote to memory of 4716 960 9d8bb22ca401d46dbf733472c4e325e2_mafia_JC.exe 82 PID 4716 wrote to memory of 5056 4716 805B.tmp 83 PID 4716 wrote to memory of 5056 4716 805B.tmp 83 PID 4716 wrote to memory of 5056 4716 805B.tmp 83 PID 5056 wrote to memory of 1672 5056 8146.tmp 84 PID 5056 wrote to memory of 1672 5056 8146.tmp 84 PID 5056 wrote to memory of 1672 5056 8146.tmp 84 PID 1672 wrote to memory of 2300 1672 8220.tmp 85 PID 1672 wrote to memory of 2300 1672 8220.tmp 85 PID 1672 wrote to memory of 2300 1672 8220.tmp 85 PID 2300 wrote to memory of 1940 2300 82CC.tmp 86 PID 2300 wrote to memory of 1940 2300 82CC.tmp 86 PID 2300 wrote to memory of 1940 2300 82CC.tmp 86 PID 1940 wrote to memory of 3796 1940 8368.tmp 87 PID 1940 wrote to memory of 3796 1940 8368.tmp 87 PID 1940 wrote to memory of 3796 1940 8368.tmp 87 PID 3796 wrote to memory of 3288 3796 8434.tmp 88 PID 3796 wrote to memory of 3288 3796 8434.tmp 88 PID 3796 wrote to memory of 3288 3796 8434.tmp 88 PID 3288 wrote to memory of 2868 3288 84DF.tmp 89 PID 3288 wrote to memory of 2868 3288 84DF.tmp 89 PID 3288 wrote to memory of 2868 3288 84DF.tmp 89 PID 2868 wrote to memory of 3172 2868 857C.tmp 90 PID 2868 wrote to memory of 3172 2868 857C.tmp 90 PID 2868 wrote to memory of 3172 2868 857C.tmp 90 PID 3172 wrote to memory of 2680 3172 8685.tmp 91 PID 3172 wrote to memory of 2680 3172 8685.tmp 91 PID 3172 wrote to memory of 2680 3172 8685.tmp 91 PID 2680 wrote to memory of 1476 2680 877F.tmp 92 PID 2680 wrote to memory of 1476 2680 877F.tmp 92 PID 2680 wrote to memory of 1476 2680 877F.tmp 92 PID 1476 wrote to memory of 2420 1476 884A.tmp 93 PID 1476 wrote to memory of 2420 1476 884A.tmp 93 PID 1476 wrote to memory of 2420 1476 884A.tmp 93 PID 2420 wrote to memory of 2652 2420 8925.tmp 94 PID 2420 wrote to memory of 2652 2420 8925.tmp 94 PID 2420 wrote to memory of 2652 2420 8925.tmp 94 PID 2652 wrote to memory of 556 2652 89D1.tmp 95 PID 2652 wrote to memory of 556 2652 89D1.tmp 95 PID 2652 wrote to memory of 556 2652 89D1.tmp 95 PID 556 wrote to memory of 3332 556 8AEA.tmp 96 PID 556 wrote to memory of 3332 556 8AEA.tmp 96 PID 556 wrote to memory of 3332 556 8AEA.tmp 96 PID 3332 wrote to memory of 4464 3332 8BA6.tmp 97 PID 3332 wrote to memory of 4464 3332 8BA6.tmp 97 PID 3332 wrote to memory of 4464 3332 8BA6.tmp 97 PID 4464 wrote to memory of 3712 4464 8C71.tmp 100 PID 4464 wrote to memory of 3712 4464 8C71.tmp 100 PID 4464 wrote to memory of 3712 4464 8C71.tmp 100 PID 3712 wrote to memory of 5008 3712 8CEE.tmp 101 PID 3712 wrote to memory of 5008 3712 8CEE.tmp 101 PID 3712 wrote to memory of 5008 3712 8CEE.tmp 101 PID 5008 wrote to memory of 3380 5008 8DB9.tmp 102 PID 5008 wrote to memory of 3380 5008 8DB9.tmp 102 PID 5008 wrote to memory of 3380 5008 8DB9.tmp 102 PID 3380 wrote to memory of 4136 3380 8E55.tmp 103 PID 3380 wrote to memory of 4136 3380 8E55.tmp 103 PID 3380 wrote to memory of 4136 3380 8E55.tmp 103 PID 4136 wrote to memory of 2736 4136 8F11.tmp 104 PID 4136 wrote to memory of 2736 4136 8F11.tmp 104 PID 4136 wrote to memory of 2736 4136 8F11.tmp 104 PID 2736 wrote to memory of 1724 2736 902A.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d8bb22ca401d46dbf733472c4e325e2_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\9d8bb22ca401d46dbf733472c4e325e2_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\805B.tmp"C:\Users\Admin\AppData\Local\Temp\805B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\8146.tmp"C:\Users\Admin\AppData\Local\Temp\8146.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\8220.tmp"C:\Users\Admin\AppData\Local\Temp\8220.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\8368.tmp"C:\Users\Admin\AppData\Local\Temp\8368.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\8434.tmp"C:\Users\Admin\AppData\Local\Temp\8434.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\84DF.tmp"C:\Users\Admin\AppData\Local\Temp\84DF.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\857C.tmp"C:\Users\Admin\AppData\Local\Temp\857C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\8685.tmp"C:\Users\Admin\AppData\Local\Temp\8685.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\877F.tmp"C:\Users\Admin\AppData\Local\Temp\877F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\8925.tmp"C:\Users\Admin\AppData\Local\Temp\8925.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\89D1.tmp"C:\Users\Admin\AppData\Local\Temp\89D1.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\8C71.tmp"C:\Users\Admin\AppData\Local\Temp\8C71.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\8E55.tmp"C:\Users\Admin\AppData\Local\Temp\8E55.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\902A.tmp"C:\Users\Admin\AppData\Local\Temp\902A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"23⤵
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\9163.tmp"C:\Users\Admin\AppData\Local\Temp\9163.tmp"24⤵
- Executes dropped EXE
PID:912 -
C:\Users\Admin\AppData\Local\Temp\91EF.tmp"C:\Users\Admin\AppData\Local\Temp\91EF.tmp"25⤵
- Executes dropped EXE
PID:744 -
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"26⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"27⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"28⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\9470.tmp"C:\Users\Admin\AppData\Local\Temp\9470.tmp"29⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"30⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\95E7.tmp"C:\Users\Admin\AppData\Local\Temp\95E7.tmp"31⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\96B2.tmp"C:\Users\Admin\AppData\Local\Temp\96B2.tmp"32⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"33⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"34⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\98D5.tmp"C:\Users\Admin\AppData\Local\Temp\98D5.tmp"35⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"36⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"37⤵
- Executes dropped EXE
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"38⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"39⤵
- Executes dropped EXE
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"40⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"41⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"42⤵
- Executes dropped EXE
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\9D69.tmp"C:\Users\Admin\AppData\Local\Temp\9D69.tmp"43⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"44⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"45⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"46⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"47⤵
- Executes dropped EXE
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\A086.tmp"C:\Users\Admin\AppData\Local\Temp\A086.tmp"48⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\A103.tmp"C:\Users\Admin\AppData\Local\Temp\A103.tmp"49⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\A19F.tmp"C:\Users\Admin\AppData\Local\Temp\A19F.tmp"50⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\A24B.tmp"C:\Users\Admin\AppData\Local\Temp\A24B.tmp"51⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"52⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\A374.tmp"C:\Users\Admin\AppData\Local\Temp\A374.tmp"53⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\A410.tmp"C:\Users\Admin\AppData\Local\Temp\A410.tmp"54⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"55⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"56⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"57⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"58⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"59⤵
- Executes dropped EXE
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"60⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"61⤵
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\A911.tmp"C:\Users\Admin\AppData\Local\Temp\A911.tmp"62⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\A99E.tmp"C:\Users\Admin\AppData\Local\Temp\A99E.tmp"63⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"64⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"65⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\AB53.tmp"C:\Users\Admin\AppData\Local\Temp\AB53.tmp"66⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"67⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"68⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"69⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\AD57.tmp"C:\Users\Admin\AppData\Local\Temp\AD57.tmp"70⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"71⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"72⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"73⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"74⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\B083.tmp"C:\Users\Admin\AppData\Local\Temp\B083.tmp"75⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"76⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"77⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"78⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\B391.tmp"C:\Users\Admin\AppData\Local\Temp\B391.tmp"79⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\B41D.tmp"C:\Users\Admin\AppData\Local\Temp\B41D.tmp"80⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"81⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\B546.tmp"C:\Users\Admin\AppData\Local\Temp\B546.tmp"82⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"83⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"84⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\B69E.tmp"C:\Users\Admin\AppData\Local\Temp\B69E.tmp"85⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\B70B.tmp"C:\Users\Admin\AppData\Local\Temp\B70B.tmp"86⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\B779.tmp"C:\Users\Admin\AppData\Local\Temp\B779.tmp"87⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\B824.tmp"C:\Users\Admin\AppData\Local\Temp\B824.tmp"88⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"89⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"90⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"91⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\BA57.tmp"C:\Users\Admin\AppData\Local\Temp\BA57.tmp"92⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"93⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\BB41.tmp"C:\Users\Admin\AppData\Local\Temp\BB41.tmp"94⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\BBED.tmp"C:\Users\Admin\AppData\Local\Temp\BBED.tmp"95⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\BC99.tmp"C:\Users\Admin\AppData\Local\Temp\BC99.tmp"96⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\BD64.tmp"C:\Users\Admin\AppData\Local\Temp\BD64.tmp"97⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"98⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"99⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"100⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\BF39.tmp"C:\Users\Admin\AppData\Local\Temp\BF39.tmp"101⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"102⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\C014.tmp"C:\Users\Admin\AppData\Local\Temp\C014.tmp"103⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"104⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"105⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"106⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\C256.tmp"C:\Users\Admin\AppData\Local\Temp\C256.tmp"107⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"108⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\C350.tmp"C:\Users\Admin\AppData\Local\Temp\C350.tmp"109⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"110⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\C469.tmp"C:\Users\Admin\AppData\Local\Temp\C469.tmp"111⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"112⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\C592.tmp"C:\Users\Admin\AppData\Local\Temp\C592.tmp"113⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\C61F.tmp"C:\Users\Admin\AppData\Local\Temp\C61F.tmp"114⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"115⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\C747.tmp"C:\Users\Admin\AppData\Local\Temp\C747.tmp"116⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"117⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\C841.tmp"C:\Users\Admin\AppData\Local\Temp\C841.tmp"118⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"119⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\C96A.tmp"C:\Users\Admin\AppData\Local\Temp\C96A.tmp"120⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"121⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\CA84.tmp"C:\Users\Admin\AppData\Local\Temp\CA84.tmp"122⤵PID:3172
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-