Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
03-09-2023 15:26
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-23_1123e100b1629dd9fb74fe6d303c3c82_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-23_1123e100b1629dd9fb74fe6d303c3c82_mafia_JC.exe
Resource
win10v2004-20230831-en
General
-
Target
2023-08-23_1123e100b1629dd9fb74fe6d303c3c82_mafia_JC.exe
-
Size
486KB
-
MD5
1123e100b1629dd9fb74fe6d303c3c82
-
SHA1
a5e8c828ec54f0249ea74c3b12a5899b407a1647
-
SHA256
fe89feb96e6e621aac6974d9788fc3a2c950495feac34306df2f1efbb482e073
-
SHA512
b17b67127852ca412c1fe8a178944e50fd143c41ed9528e142e801a26d61063c7512fe8741f94c82821e20ba914eebb13f7513a84c078731f1a0567da0b3becd
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7Wp3jtX11UY31aBHohK6JX2BfZTbRKeFuXIFJ:/U5rCOTeiDs32SaBHA5GxTbR9sANZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3244 7947.tmp 4212 7A21.tmp 4052 7ABE.tmp 4432 7BA8.tmp 3992 7C54.tmp 4548 7CE1.tmp 3852 7D8C.tmp 1108 7E48.tmp 4628 7EC5.tmp 4500 7F52.tmp 3952 800D.tmp 472 808A.tmp 3184 8647.tmp 5096 86E3.tmp 2728 877F.tmp 4516 881C.tmp 3364 88C7.tmp 4716 89F0.tmp 4304 8A6D.tmp 5116 8B0A.tmp 3592 8B96.tmp 4980 8C52.tmp 4908 8D1D.tmp 1680 8DD8.tmp 4940 8EB3.tmp 1648 8F4F.tmp 1804 8FDC.tmp 1316 9097.tmp 3616 9134.tmp 4944 920E.tmp 1624 92E9.tmp 2112 93C4.tmp 4788 948F.tmp 2008 950C.tmp 3604 9599.tmp 3420 9616.tmp 4856 9683.tmp 3748 9710.tmp 4100 97AC.tmp 2216 9839.tmp 532 98C5.tmp 1768 9942.tmp 3624 99CF.tmp 4232 9A3C.tmp 4212 9A9A.tmp 4808 9B17.tmp 3844 9B84.tmp 3728 9C01.tmp 776 9C6F.tmp 3868 9CFB.tmp 4776 9D78.tmp 972 9E15.tmp 2356 9E92.tmp 3320 9F4D.tmp 1244 9FCA.tmp 3700 A057.tmp 2052 A0E3.tmp 1240 A180.tmp 3952 A20C.tmp 948 A2A8.tmp 392 A325.tmp 1860 A3A2.tmp 1852 A44E.tmp 2616 A4DB.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2328 wrote to memory of 3244 2328 2023-08-23_1123e100b1629dd9fb74fe6d303c3c82_mafia_JC.exe 85 PID 2328 wrote to memory of 3244 2328 2023-08-23_1123e100b1629dd9fb74fe6d303c3c82_mafia_JC.exe 85 PID 2328 wrote to memory of 3244 2328 2023-08-23_1123e100b1629dd9fb74fe6d303c3c82_mafia_JC.exe 85 PID 3244 wrote to memory of 4212 3244 7947.tmp 86 PID 3244 wrote to memory of 4212 3244 7947.tmp 86 PID 3244 wrote to memory of 4212 3244 7947.tmp 86 PID 4212 wrote to memory of 4052 4212 7A21.tmp 87 PID 4212 wrote to memory of 4052 4212 7A21.tmp 87 PID 4212 wrote to memory of 4052 4212 7A21.tmp 87 PID 4052 wrote to memory of 4432 4052 7ABE.tmp 88 PID 4052 wrote to memory of 4432 4052 7ABE.tmp 88 PID 4052 wrote to memory of 4432 4052 7ABE.tmp 88 PID 4432 wrote to memory of 3992 4432 7BA8.tmp 89 PID 4432 wrote to memory of 3992 4432 7BA8.tmp 89 PID 4432 wrote to memory of 3992 4432 7BA8.tmp 89 PID 3992 wrote to memory of 4548 3992 7C54.tmp 90 PID 3992 wrote to memory of 4548 3992 7C54.tmp 90 PID 3992 wrote to memory of 4548 3992 7C54.tmp 90 PID 4548 wrote to memory of 3852 4548 7CE1.tmp 91 PID 4548 wrote to memory of 3852 4548 7CE1.tmp 91 PID 4548 wrote to memory of 3852 4548 7CE1.tmp 91 PID 3852 wrote to memory of 1108 3852 7D8C.tmp 92 PID 3852 wrote to memory of 1108 3852 7D8C.tmp 92 PID 3852 wrote to memory of 1108 3852 7D8C.tmp 92 PID 1108 wrote to memory of 4628 1108 7E48.tmp 93 PID 1108 wrote to memory of 4628 1108 7E48.tmp 93 PID 1108 wrote to memory of 4628 1108 7E48.tmp 93 PID 4628 wrote to memory of 4500 4628 7EC5.tmp 94 PID 4628 wrote to memory of 4500 4628 7EC5.tmp 94 PID 4628 wrote to memory of 4500 4628 7EC5.tmp 94 PID 4500 wrote to memory of 3952 4500 7F52.tmp 96 PID 4500 wrote to memory of 3952 4500 7F52.tmp 96 PID 4500 wrote to memory of 3952 4500 7F52.tmp 96 PID 3952 wrote to memory of 472 3952 800D.tmp 97 PID 3952 wrote to memory of 472 3952 800D.tmp 97 PID 3952 wrote to memory of 472 3952 800D.tmp 97 PID 472 wrote to memory of 3184 472 808A.tmp 98 PID 472 wrote to memory of 3184 472 808A.tmp 98 PID 472 wrote to memory of 3184 472 808A.tmp 98 PID 3184 wrote to memory of 5096 3184 8647.tmp 100 PID 3184 wrote to memory of 5096 3184 8647.tmp 100 PID 3184 wrote to memory of 5096 3184 8647.tmp 100 PID 5096 wrote to memory of 2728 5096 86E3.tmp 101 PID 5096 wrote to memory of 2728 5096 86E3.tmp 101 PID 5096 wrote to memory of 2728 5096 86E3.tmp 101 PID 2728 wrote to memory of 4516 2728 877F.tmp 102 PID 2728 wrote to memory of 4516 2728 877F.tmp 102 PID 2728 wrote to memory of 4516 2728 877F.tmp 102 PID 4516 wrote to memory of 3364 4516 881C.tmp 103 PID 4516 wrote to memory of 3364 4516 881C.tmp 103 PID 4516 wrote to memory of 3364 4516 881C.tmp 103 PID 3364 wrote to memory of 4716 3364 88C7.tmp 104 PID 3364 wrote to memory of 4716 3364 88C7.tmp 104 PID 3364 wrote to memory of 4716 3364 88C7.tmp 104 PID 4716 wrote to memory of 4304 4716 89F0.tmp 105 PID 4716 wrote to memory of 4304 4716 89F0.tmp 105 PID 4716 wrote to memory of 4304 4716 89F0.tmp 105 PID 4304 wrote to memory of 5116 4304 8A6D.tmp 106 PID 4304 wrote to memory of 5116 4304 8A6D.tmp 106 PID 4304 wrote to memory of 5116 4304 8A6D.tmp 106 PID 5116 wrote to memory of 3592 5116 8B0A.tmp 107 PID 5116 wrote to memory of 3592 5116 8B0A.tmp 107 PID 5116 wrote to memory of 3592 5116 8B0A.tmp 107 PID 3592 wrote to memory of 4980 3592 8B96.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-23_1123e100b1629dd9fb74fe6d303c3c82_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-23_1123e100b1629dd9fb74fe6d303c3c82_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\7A21.tmp"C:\Users\Admin\AppData\Local\Temp\7A21.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\7C54.tmp"C:\Users\Admin\AppData\Local\Temp\7C54.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\7E48.tmp"C:\Users\Admin\AppData\Local\Temp\7E48.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\7F52.tmp"C:\Users\Admin\AppData\Local\Temp\7F52.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\800D.tmp"C:\Users\Admin\AppData\Local\Temp\800D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\808A.tmp"C:\Users\Admin\AppData\Local\Temp\808A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Users\Admin\AppData\Local\Temp\8647.tmp"C:\Users\Admin\AppData\Local\Temp\8647.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\86E3.tmp"C:\Users\Admin\AppData\Local\Temp\86E3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\877F.tmp"C:\Users\Admin\AppData\Local\Temp\877F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\881C.tmp"C:\Users\Admin\AppData\Local\Temp\881C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\88C7.tmp"C:\Users\Admin\AppData\Local\Temp\88C7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\89F0.tmp"C:\Users\Admin\AppData\Local\Temp\89F0.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\8B96.tmp"C:\Users\Admin\AppData\Local\Temp\8B96.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"23⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"24⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"25⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"26⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"27⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"28⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\9097.tmp"C:\Users\Admin\AppData\Local\Temp\9097.tmp"29⤵
- Executes dropped EXE
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\9134.tmp"C:\Users\Admin\AppData\Local\Temp\9134.tmp"30⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"31⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"32⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"33⤵
- Executes dropped EXE
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\948F.tmp"C:\Users\Admin\AppData\Local\Temp\948F.tmp"34⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\950C.tmp"C:\Users\Admin\AppData\Local\Temp\950C.tmp"35⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\9599.tmp"C:\Users\Admin\AppData\Local\Temp\9599.tmp"36⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"37⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"38⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\9710.tmp"C:\Users\Admin\AppData\Local\Temp\9710.tmp"39⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"40⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\9839.tmp"C:\Users\Admin\AppData\Local\Temp\9839.tmp"41⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\98C5.tmp"C:\Users\Admin\AppData\Local\Temp\98C5.tmp"42⤵
- Executes dropped EXE
PID:532 -
C:\Users\Admin\AppData\Local\Temp\9942.tmp"C:\Users\Admin\AppData\Local\Temp\9942.tmp"43⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"44⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"45⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"46⤵
- Executes dropped EXE
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"47⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"48⤵
- Executes dropped EXE
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"49⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"50⤵
- Executes dropped EXE
PID:776 -
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"51⤵
- Executes dropped EXE
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\9D78.tmp"C:\Users\Admin\AppData\Local\Temp\9D78.tmp"52⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\9E15.tmp"C:\Users\Admin\AppData\Local\Temp\9E15.tmp"53⤵
- Executes dropped EXE
PID:972 -
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"54⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"55⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"56⤵
- Executes dropped EXE
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"57⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"58⤵
- Executes dropped EXE
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\A180.tmp"C:\Users\Admin\AppData\Local\Temp\A180.tmp"59⤵
- Executes dropped EXE
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\A20C.tmp"C:\Users\Admin\AppData\Local\Temp\A20C.tmp"60⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"61⤵
- Executes dropped EXE
PID:948 -
C:\Users\Admin\AppData\Local\Temp\A325.tmp"C:\Users\Admin\AppData\Local\Temp\A325.tmp"62⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"63⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"64⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"65⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"66⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"67⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"68⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"69⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"70⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\A836.tmp"C:\Users\Admin\AppData\Local\Temp\A836.tmp"71⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"72⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\A940.tmp"C:\Users\Admin\AppData\Local\Temp\A940.tmp"73⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"74⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\AA59.tmp"C:\Users\Admin\AppData\Local\Temp\AA59.tmp"75⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"76⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"77⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"78⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"79⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"80⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"81⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"82⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\AF99.tmp"C:\Users\Admin\AppData\Local\Temp\AF99.tmp"83⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\B006.tmp"C:\Users\Admin\AppData\Local\Temp\B006.tmp"84⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"85⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\B110.tmp"C:\Users\Admin\AppData\Local\Temp\B110.tmp"86⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\B17D.tmp"C:\Users\Admin\AppData\Local\Temp\B17D.tmp"87⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\B21A.tmp"C:\Users\Admin\AppData\Local\Temp\B21A.tmp"88⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"89⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\B314.tmp"C:\Users\Admin\AppData\Local\Temp\B314.tmp"90⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\B391.tmp"C:\Users\Admin\AppData\Local\Temp\B391.tmp"91⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\B40E.tmp"C:\Users\Admin\AppData\Local\Temp\B40E.tmp"92⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\B48B.tmp"C:\Users\Admin\AppData\Local\Temp\B48B.tmp"93⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\B517.tmp"C:\Users\Admin\AppData\Local\Temp\B517.tmp"94⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\B594.tmp"C:\Users\Admin\AppData\Local\Temp\B594.tmp"95⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\B611.tmp"C:\Users\Admin\AppData\Local\Temp\B611.tmp"96⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\B67F.tmp"C:\Users\Admin\AppData\Local\Temp\B67F.tmp"97⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\B71B.tmp"C:\Users\Admin\AppData\Local\Temp\B71B.tmp"98⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\B788.tmp"C:\Users\Admin\AppData\Local\Temp\B788.tmp"99⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"100⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\B882.tmp"C:\Users\Admin\AppData\Local\Temp\B882.tmp"101⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\B90F.tmp"C:\Users\Admin\AppData\Local\Temp\B90F.tmp"102⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\B99B.tmp"C:\Users\Admin\AppData\Local\Temp\B99B.tmp"103⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\BA18.tmp"C:\Users\Admin\AppData\Local\Temp\BA18.tmp"104⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"105⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\BB22.tmp"C:\Users\Admin\AppData\Local\Temp\BB22.tmp"106⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"107⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"108⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\BC99.tmp"C:\Users\Admin\AppData\Local\Temp\BC99.tmp"109⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\BD26.tmp"C:\Users\Admin\AppData\Local\Temp\BD26.tmp"110⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\BD93.tmp"C:\Users\Admin\AppData\Local\Temp\BD93.tmp"111⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\BE10.tmp"C:\Users\Admin\AppData\Local\Temp\BE10.tmp"112⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"113⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\BF29.tmp"C:\Users\Admin\AppData\Local\Temp\BF29.tmp"114⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\BF97.tmp"C:\Users\Admin\AppData\Local\Temp\BF97.tmp"115⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"116⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"117⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"118⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"119⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\C237.tmp"C:\Users\Admin\AppData\Local\Temp\C237.tmp"120⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"121⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\C35F.tmp"C:\Users\Admin\AppData\Local\Temp\C35F.tmp"122⤵PID:984
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-