Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
28-08-2023 19:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cb8ee32ebec9a652556476c82e500e27_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
cb8ee32ebec9a652556476c82e500e27_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
cb8ee32ebec9a652556476c82e500e27_mafia_JC.exe
-
Size
527KB
-
MD5
cb8ee32ebec9a652556476c82e500e27
-
SHA1
c3eb365d6111a43443cfede88577df4230a19c47
-
SHA256
9c86226b628a87b4a21e0b09fc4b73487ff10fd585631be100b7a3c2a748c30f
-
SHA512
aa292ed77900bda9ef356643af27dd247adcf4242946a331966c6b59b16608100f6c6d3e9269fa7cd49c1359eeee207057b0defdf59517100738caefaab11f96
-
SSDEEP
12288:fU5rCOTeidmZLLpWzMwAg3juL2O6KDZu:fUQOJdOvpBw3DKDo
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4312 6F73.tmp 1512 704E.tmp 1236 7129.tmp 2844 7223.tmp 4996 72EE.tmp 908 73D8.tmp 1880 7465.tmp 2216 754F.tmp 832 762A.tmp 3640 76F5.tmp 3740 7791.tmp 4792 78AA.tmp 4644 7995.tmp 3948 7A50.tmp 3096 7AFC.tmp 4712 7BB8.tmp 2824 7C54.tmp 4968 7D4E.tmp 4788 7E09.tmp 4288 7E86.tmp 3560 7F52.tmp 4736 7FFD.tmp 2612 809A.tmp 3664 8174.tmp 764 8211.tmp 1432 82AD.tmp 1164 8359.tmp 4800 8424.tmp 2172 84EF.tmp 2200 85D9.tmp 2528 8666.tmp 4272 8741.tmp 2996 881C.tmp 3804 88C7.tmp 3888 8935.tmp 4480 89C1.tmp 4564 8A4E.tmp 4820 8ACB.tmp 564 8B48.tmp 4332 8BB5.tmp 3988 8C52.tmp 2732 8CDE.tmp 4916 8D6B.tmp 1580 8E26.tmp 2244 8EC3.tmp 2052 8F5F.tmp 3160 8FEC.tmp 4284 90A7.tmp 1068 9143.tmp 4508 91D0.tmp 2144 926C.tmp 2884 92E9.tmp 4312 9395.tmp 3040 9431.tmp 3052 94BE.tmp 2084 956A.tmp 2072 9625.tmp 2680 96D1.tmp 2060 976D.tmp 3772 97FA.tmp 2316 98C5.tmp 4592 9933.tmp 4468 99B0.tmp 2036 9A4C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 724 wrote to memory of 4312 724 cb8ee32ebec9a652556476c82e500e27_mafia_JC.exe 83 PID 724 wrote to memory of 4312 724 cb8ee32ebec9a652556476c82e500e27_mafia_JC.exe 83 PID 724 wrote to memory of 4312 724 cb8ee32ebec9a652556476c82e500e27_mafia_JC.exe 83 PID 4312 wrote to memory of 1512 4312 6F73.tmp 84 PID 4312 wrote to memory of 1512 4312 6F73.tmp 84 PID 4312 wrote to memory of 1512 4312 6F73.tmp 84 PID 1512 wrote to memory of 1236 1512 704E.tmp 85 PID 1512 wrote to memory of 1236 1512 704E.tmp 85 PID 1512 wrote to memory of 1236 1512 704E.tmp 85 PID 1236 wrote to memory of 2844 1236 7129.tmp 86 PID 1236 wrote to memory of 2844 1236 7129.tmp 86 PID 1236 wrote to memory of 2844 1236 7129.tmp 86 PID 2844 wrote to memory of 4996 2844 7223.tmp 87 PID 2844 wrote to memory of 4996 2844 7223.tmp 87 PID 2844 wrote to memory of 4996 2844 7223.tmp 87 PID 4996 wrote to memory of 908 4996 72EE.tmp 88 PID 4996 wrote to memory of 908 4996 72EE.tmp 88 PID 4996 wrote to memory of 908 4996 72EE.tmp 88 PID 908 wrote to memory of 1880 908 73D8.tmp 89 PID 908 wrote to memory of 1880 908 73D8.tmp 89 PID 908 wrote to memory of 1880 908 73D8.tmp 89 PID 1880 wrote to memory of 2216 1880 7465.tmp 90 PID 1880 wrote to memory of 2216 1880 7465.tmp 90 PID 1880 wrote to memory of 2216 1880 7465.tmp 90 PID 2216 wrote to memory of 832 2216 754F.tmp 91 PID 2216 wrote to memory of 832 2216 754F.tmp 91 PID 2216 wrote to memory of 832 2216 754F.tmp 91 PID 832 wrote to memory of 3640 832 762A.tmp 92 PID 832 wrote to memory of 3640 832 762A.tmp 92 PID 832 wrote to memory of 3640 832 762A.tmp 92 PID 3640 wrote to memory of 3740 3640 76F5.tmp 93 PID 3640 wrote to memory of 3740 3640 76F5.tmp 93 PID 3640 wrote to memory of 3740 3640 76F5.tmp 93 PID 3740 wrote to memory of 4792 3740 7791.tmp 94 PID 3740 wrote to memory of 4792 3740 7791.tmp 94 PID 3740 wrote to memory of 4792 3740 7791.tmp 94 PID 4792 wrote to memory of 4644 4792 78AA.tmp 95 PID 4792 wrote to memory of 4644 4792 78AA.tmp 95 PID 4792 wrote to memory of 4644 4792 78AA.tmp 95 PID 4644 wrote to memory of 3948 4644 7995.tmp 96 PID 4644 wrote to memory of 3948 4644 7995.tmp 96 PID 4644 wrote to memory of 3948 4644 7995.tmp 96 PID 3948 wrote to memory of 3096 3948 7A50.tmp 97 PID 3948 wrote to memory of 3096 3948 7A50.tmp 97 PID 3948 wrote to memory of 3096 3948 7A50.tmp 97 PID 3096 wrote to memory of 4712 3096 7AFC.tmp 98 PID 3096 wrote to memory of 4712 3096 7AFC.tmp 98 PID 3096 wrote to memory of 4712 3096 7AFC.tmp 98 PID 4712 wrote to memory of 2824 4712 7BB8.tmp 101 PID 4712 wrote to memory of 2824 4712 7BB8.tmp 101 PID 4712 wrote to memory of 2824 4712 7BB8.tmp 101 PID 2824 wrote to memory of 4968 2824 7C54.tmp 102 PID 2824 wrote to memory of 4968 2824 7C54.tmp 102 PID 2824 wrote to memory of 4968 2824 7C54.tmp 102 PID 4968 wrote to memory of 4788 4968 7D4E.tmp 103 PID 4968 wrote to memory of 4788 4968 7D4E.tmp 103 PID 4968 wrote to memory of 4788 4968 7D4E.tmp 103 PID 4788 wrote to memory of 4288 4788 7E09.tmp 104 PID 4788 wrote to memory of 4288 4788 7E09.tmp 104 PID 4788 wrote to memory of 4288 4788 7E09.tmp 104 PID 4288 wrote to memory of 3560 4288 7E86.tmp 105 PID 4288 wrote to memory of 3560 4288 7E86.tmp 105 PID 4288 wrote to memory of 3560 4288 7E86.tmp 105 PID 3560 wrote to memory of 4736 3560 7F52.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb8ee32ebec9a652556476c82e500e27_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\cb8ee32ebec9a652556476c82e500e27_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\72EE.tmp"C:\Users\Admin\AppData\Local\Temp\72EE.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\754F.tmp"C:\Users\Admin\AppData\Local\Temp\754F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\76F5.tmp"C:\Users\Admin\AppData\Local\Temp\76F5.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\7791.tmp"C:\Users\Admin\AppData\Local\Temp\7791.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\7995.tmp"C:\Users\Admin\AppData\Local\Temp\7995.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\7A50.tmp"C:\Users\Admin\AppData\Local\Temp\7A50.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\7C54.tmp"C:\Users\Admin\AppData\Local\Temp\7C54.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\7E09.tmp"C:\Users\Admin\AppData\Local\Temp\7E09.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\7F52.tmp"C:\Users\Admin\AppData\Local\Temp\7F52.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"23⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\809A.tmp"C:\Users\Admin\AppData\Local\Temp\809A.tmp"24⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\8174.tmp"C:\Users\Admin\AppData\Local\Temp\8174.tmp"25⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"26⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\82AD.tmp"C:\Users\Admin\AppData\Local\Temp\82AD.tmp"27⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\8359.tmp"C:\Users\Admin\AppData\Local\Temp\8359.tmp"28⤵
- Executes dropped EXE
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\8424.tmp"C:\Users\Admin\AppData\Local\Temp\8424.tmp"29⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\84EF.tmp"C:\Users\Admin\AppData\Local\Temp\84EF.tmp"30⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\85D9.tmp"C:\Users\Admin\AppData\Local\Temp\85D9.tmp"31⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\8666.tmp"C:\Users\Admin\AppData\Local\Temp\8666.tmp"32⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\8741.tmp"C:\Users\Admin\AppData\Local\Temp\8741.tmp"33⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\881C.tmp"C:\Users\Admin\AppData\Local\Temp\881C.tmp"34⤵
- Executes dropped EXE
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\88C7.tmp"C:\Users\Admin\AppData\Local\Temp\88C7.tmp"35⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\8935.tmp"C:\Users\Admin\AppData\Local\Temp\8935.tmp"36⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\89C1.tmp"C:\Users\Admin\AppData\Local\Temp\89C1.tmp"37⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"38⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"39⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\8B48.tmp"C:\Users\Admin\AppData\Local\Temp\8B48.tmp"40⤵
- Executes dropped EXE
PID:564 -
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"41⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"42⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"43⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"44⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\8E26.tmp"C:\Users\Admin\AppData\Local\Temp\8E26.tmp"45⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"46⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"47⤵
- Executes dropped EXE
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"48⤵
- Executes dropped EXE
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\90A7.tmp"C:\Users\Admin\AppData\Local\Temp\90A7.tmp"49⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\9143.tmp"C:\Users\Admin\AppData\Local\Temp\9143.tmp"50⤵
- Executes dropped EXE
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\91D0.tmp"C:\Users\Admin\AppData\Local\Temp\91D0.tmp"51⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\926C.tmp"C:\Users\Admin\AppData\Local\Temp\926C.tmp"52⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"53⤵
- Executes dropped EXE
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\9395.tmp"C:\Users\Admin\AppData\Local\Temp\9395.tmp"54⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"55⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\94BE.tmp"C:\Users\Admin\AppData\Local\Temp\94BE.tmp"56⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\956A.tmp"C:\Users\Admin\AppData\Local\Temp\956A.tmp"57⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\9625.tmp"C:\Users\Admin\AppData\Local\Temp\9625.tmp"58⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\96D1.tmp"C:\Users\Admin\AppData\Local\Temp\96D1.tmp"59⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\976D.tmp"C:\Users\Admin\AppData\Local\Temp\976D.tmp"60⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\97FA.tmp"C:\Users\Admin\AppData\Local\Temp\97FA.tmp"61⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\98C5.tmp"C:\Users\Admin\AppData\Local\Temp\98C5.tmp"62⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"63⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"64⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"65⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"66⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"67⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"68⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"69⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"70⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\9D59.tmp"C:\Users\Admin\AppData\Local\Temp\9D59.tmp"71⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"72⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"73⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"74⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"75⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"76⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\A086.tmp"C:\Users\Admin\AppData\Local\Temp\A086.tmp"77⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\A112.tmp"C:\Users\Admin\AppData\Local\Temp\A112.tmp"78⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\A18F.tmp"C:\Users\Admin\AppData\Local\Temp\A18F.tmp"79⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\A20C.tmp"C:\Users\Admin\AppData\Local\Temp\A20C.tmp"80⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\A299.tmp"C:\Users\Admin\AppData\Local\Temp\A299.tmp"81⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"82⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"83⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\A43F.tmp"C:\Users\Admin\AppData\Local\Temp\A43F.tmp"84⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"85⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"86⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"87⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"88⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"89⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"90⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\A836.tmp"C:\Users\Admin\AppData\Local\Temp\A836.tmp"91⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"92⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"93⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"94⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"95⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"96⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"97⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"98⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"99⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\AD57.tmp"C:\Users\Admin\AppData\Local\Temp\AD57.tmp"100⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"101⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"102⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"103⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"104⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\B016.tmp"C:\Users\Admin\AppData\Local\Temp\B016.tmp"105⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"106⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"107⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"108⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\B258.tmp"C:\Users\Admin\AppData\Local\Temp\B258.tmp"109⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"110⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\B371.tmp"C:\Users\Admin\AppData\Local\Temp\B371.tmp"111⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\B40E.tmp"C:\Users\Admin\AppData\Local\Temp\B40E.tmp"112⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\B49A.tmp"C:\Users\Admin\AppData\Local\Temp\B49A.tmp"113⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\B536.tmp"C:\Users\Admin\AppData\Local\Temp\B536.tmp"114⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"115⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"116⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\B70B.tmp"C:\Users\Admin\AppData\Local\Temp\B70B.tmp"117⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\B798.tmp"C:\Users\Admin\AppData\Local\Temp\B798.tmp"118⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\B824.tmp"C:\Users\Admin\AppData\Local\Temp\B824.tmp"119⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\B892.tmp"C:\Users\Admin\AppData\Local\Temp\B892.tmp"120⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\B93E.tmp"C:\Users\Admin\AppData\Local\Temp\B93E.tmp"121⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"122⤵PID:1160
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-