Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
04/08/2023, 17:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
647a9717a8332c1498dff6b09e1b6fe1_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
647a9717a8332c1498dff6b09e1b6fe1_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
647a9717a8332c1498dff6b09e1b6fe1_mafia_JC.exe
-
Size
486KB
-
MD5
647a9717a8332c1498dff6b09e1b6fe1
-
SHA1
e37fa431ea8308b1f917ead93e61495dbe7ae58b
-
SHA256
216b7197bd03e8e2c0bcf0cc7bc817339f7663c0110aab59702073b9747c6577
-
SHA512
51bc46497443835f41e0197db380fa0a3aa5387d7aa102c9c165e6e7a2ac509379ab6ce54edf1b31a6aad1e28db24dceb19bb86e7a6c49015eb9b10579b8caab
-
SSDEEP
12288:/U5rCOTeiDhs2LdJHgYjcevH3nEm+SsNxrE+rMjNZ:/UQOJDvdZgYjdfQSsNxrE+8N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4992 7E48.tmp 1432 7EE4.tmp 4680 7FDE.tmp 4704 808A.tmp 2844 8136.tmp 4956 8230.tmp 3172 82DC.tmp 1364 8405.tmp 3484 84B1.tmp 1772 859B.tmp 1040 8666.tmp 324 8741.tmp 4484 87ED.tmp 2944 88D7.tmp 732 89D1.tmp 4636 8AAC.tmp 1692 8B67.tmp 1748 8C13.tmp 2404 8D0D.tmp 1964 8DB9.tmp 1572 8E84.tmp 2436 8F40.tmp 4760 8FAD.tmp 4552 9088.tmp 2832 9134.tmp 3248 91B1.tmp 3468 926C.tmp 2720 9328.tmp 4120 93F3.tmp 1408 94BE.tmp 1984 9579.tmp 4740 9664.tmp 1464 96F0.tmp 2120 976D.tmp 2648 97FA.tmp 4864 9896.tmp 3852 9971.tmp 2100 9A0D.tmp 4628 9AAA.tmp 1868 9B46.tmp 3432 9BD2.tmp 1368 9C5F.tmp 4452 9CDC.tmp 2920 9DC6.tmp 4744 9E43.tmp 940 9EE0.tmp 2844 9F8C.tmp 4608 A037.tmp 4716 A0F3.tmp 2204 A170.tmp 1448 A21C.tmp 4792 A2A8.tmp 4036 A335.tmp 1772 A3D1.tmp 1140 A46E.tmp 3520 A4FA.tmp 324 A577.tmp 4032 A613.tmp 1840 A690.tmp 1256 A71D.tmp 2272 A79A.tmp 2592 A807.tmp 2328 A865.tmp 3320 A930.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1868 wrote to memory of 4992 1868 647a9717a8332c1498dff6b09e1b6fe1_mafia_JC.exe 85 PID 1868 wrote to memory of 4992 1868 647a9717a8332c1498dff6b09e1b6fe1_mafia_JC.exe 85 PID 1868 wrote to memory of 4992 1868 647a9717a8332c1498dff6b09e1b6fe1_mafia_JC.exe 85 PID 4992 wrote to memory of 1432 4992 7E48.tmp 86 PID 4992 wrote to memory of 1432 4992 7E48.tmp 86 PID 4992 wrote to memory of 1432 4992 7E48.tmp 86 PID 1432 wrote to memory of 4680 1432 7EE4.tmp 87 PID 1432 wrote to memory of 4680 1432 7EE4.tmp 87 PID 1432 wrote to memory of 4680 1432 7EE4.tmp 87 PID 4680 wrote to memory of 4704 4680 7FDE.tmp 88 PID 4680 wrote to memory of 4704 4680 7FDE.tmp 88 PID 4680 wrote to memory of 4704 4680 7FDE.tmp 88 PID 4704 wrote to memory of 2844 4704 808A.tmp 89 PID 4704 wrote to memory of 2844 4704 808A.tmp 89 PID 4704 wrote to memory of 2844 4704 808A.tmp 89 PID 2844 wrote to memory of 4956 2844 8136.tmp 91 PID 2844 wrote to memory of 4956 2844 8136.tmp 91 PID 2844 wrote to memory of 4956 2844 8136.tmp 91 PID 4956 wrote to memory of 3172 4956 8230.tmp 92 PID 4956 wrote to memory of 3172 4956 8230.tmp 92 PID 4956 wrote to memory of 3172 4956 8230.tmp 92 PID 3172 wrote to memory of 1364 3172 82DC.tmp 93 PID 3172 wrote to memory of 1364 3172 82DC.tmp 93 PID 3172 wrote to memory of 1364 3172 82DC.tmp 93 PID 1364 wrote to memory of 3484 1364 8405.tmp 94 PID 1364 wrote to memory of 3484 1364 8405.tmp 94 PID 1364 wrote to memory of 3484 1364 8405.tmp 94 PID 3484 wrote to memory of 1772 3484 84B1.tmp 95 PID 3484 wrote to memory of 1772 3484 84B1.tmp 95 PID 3484 wrote to memory of 1772 3484 84B1.tmp 95 PID 1772 wrote to memory of 1040 1772 859B.tmp 96 PID 1772 wrote to memory of 1040 1772 859B.tmp 96 PID 1772 wrote to memory of 1040 1772 859B.tmp 96 PID 1040 wrote to memory of 324 1040 8666.tmp 97 PID 1040 wrote to memory of 324 1040 8666.tmp 97 PID 1040 wrote to memory of 324 1040 8666.tmp 97 PID 324 wrote to memory of 4484 324 8741.tmp 98 PID 324 wrote to memory of 4484 324 8741.tmp 98 PID 324 wrote to memory of 4484 324 8741.tmp 98 PID 4484 wrote to memory of 2944 4484 87ED.tmp 99 PID 4484 wrote to memory of 2944 4484 87ED.tmp 99 PID 4484 wrote to memory of 2944 4484 87ED.tmp 99 PID 2944 wrote to memory of 732 2944 88D7.tmp 102 PID 2944 wrote to memory of 732 2944 88D7.tmp 102 PID 2944 wrote to memory of 732 2944 88D7.tmp 102 PID 732 wrote to memory of 4636 732 89D1.tmp 103 PID 732 wrote to memory of 4636 732 89D1.tmp 103 PID 732 wrote to memory of 4636 732 89D1.tmp 103 PID 4636 wrote to memory of 1692 4636 8AAC.tmp 104 PID 4636 wrote to memory of 1692 4636 8AAC.tmp 104 PID 4636 wrote to memory of 1692 4636 8AAC.tmp 104 PID 1692 wrote to memory of 1748 1692 8B67.tmp 105 PID 1692 wrote to memory of 1748 1692 8B67.tmp 105 PID 1692 wrote to memory of 1748 1692 8B67.tmp 105 PID 1748 wrote to memory of 2404 1748 8C13.tmp 106 PID 1748 wrote to memory of 2404 1748 8C13.tmp 106 PID 1748 wrote to memory of 2404 1748 8C13.tmp 106 PID 2404 wrote to memory of 1964 2404 8D0D.tmp 107 PID 2404 wrote to memory of 1964 2404 8D0D.tmp 107 PID 2404 wrote to memory of 1964 2404 8D0D.tmp 107 PID 1964 wrote to memory of 1572 1964 8DB9.tmp 109 PID 1964 wrote to memory of 1572 1964 8DB9.tmp 109 PID 1964 wrote to memory of 1572 1964 8DB9.tmp 109 PID 1572 wrote to memory of 2436 1572 8E84.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\647a9717a8332c1498dff6b09e1b6fe1_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\647a9717a8332c1498dff6b09e1b6fe1_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\7E48.tmp"C:\Users\Admin\AppData\Local\Temp\7E48.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\808A.tmp"C:\Users\Admin\AppData\Local\Temp\808A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\8136.tmp"C:\Users\Admin\AppData\Local\Temp\8136.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\8230.tmp"C:\Users\Admin\AppData\Local\Temp\8230.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\82DC.tmp"C:\Users\Admin\AppData\Local\Temp\82DC.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\8405.tmp"C:\Users\Admin\AppData\Local\Temp\8405.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\84B1.tmp"C:\Users\Admin\AppData\Local\Temp\84B1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\859B.tmp"C:\Users\Admin\AppData\Local\Temp\859B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\8666.tmp"C:\Users\Admin\AppData\Local\Temp\8666.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\8741.tmp"C:\Users\Admin\AppData\Local\Temp\8741.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\89D1.tmp"C:\Users\Admin\AppData\Local\Temp\89D1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\8B67.tmp"C:\Users\Admin\AppData\Local\Temp\8B67.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\8C13.tmp"C:\Users\Admin\AppData\Local\Temp\8C13.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\8E84.tmp"C:\Users\Admin\AppData\Local\Temp\8E84.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\8F40.tmp"C:\Users\Admin\AppData\Local\Temp\8F40.tmp"23⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"24⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"25⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\9134.tmp"C:\Users\Admin\AppData\Local\Temp\9134.tmp"26⤵
- Executes dropped EXE
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\91B1.tmp"C:\Users\Admin\AppData\Local\Temp\91B1.tmp"27⤵
- Executes dropped EXE
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\926C.tmp"C:\Users\Admin\AppData\Local\Temp\926C.tmp"28⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\9328.tmp"C:\Users\Admin\AppData\Local\Temp\9328.tmp"29⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\93F3.tmp"C:\Users\Admin\AppData\Local\Temp\93F3.tmp"30⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\94BE.tmp"C:\Users\Admin\AppData\Local\Temp\94BE.tmp"31⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\9579.tmp"C:\Users\Admin\AppData\Local\Temp\9579.tmp"32⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\9664.tmp"C:\Users\Admin\AppData\Local\Temp\9664.tmp"33⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\96F0.tmp"C:\Users\Admin\AppData\Local\Temp\96F0.tmp"34⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\976D.tmp"C:\Users\Admin\AppData\Local\Temp\976D.tmp"35⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\97FA.tmp"C:\Users\Admin\AppData\Local\Temp\97FA.tmp"36⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\9896.tmp"C:\Users\Admin\AppData\Local\Temp\9896.tmp"37⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"38⤵
- Executes dropped EXE
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"39⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"40⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"41⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"42⤵
- Executes dropped EXE
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"43⤵
- Executes dropped EXE
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"44⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"45⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"46⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"47⤵
- Executes dropped EXE
PID:940 -
C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"48⤵
- Executes dropped EXE
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"49⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"50⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"51⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\A21C.tmp"C:\Users\Admin\AppData\Local\Temp\A21C.tmp"52⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"53⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"54⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"55⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\A46E.tmp"C:\Users\Admin\AppData\Local\Temp\A46E.tmp"56⤵
- Executes dropped EXE
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"57⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\A577.tmp"C:\Users\Admin\AppData\Local\Temp\A577.tmp"58⤵
- Executes dropped EXE
PID:324 -
C:\Users\Admin\AppData\Local\Temp\A613.tmp"C:\Users\Admin\AppData\Local\Temp\A613.tmp"59⤵
- Executes dropped EXE
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"60⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"61⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"62⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"63⤵
- Executes dropped EXE
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"64⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"65⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"66⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"67⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"68⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\AB53.tmp"C:\Users\Admin\AppData\Local\Temp\AB53.tmp"69⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"70⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"71⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\AD09.tmp"C:\Users\Admin\AppData\Local\Temp\AD09.tmp"72⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"73⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"74⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"75⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"76⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"77⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"78⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"79⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\B14E.tmp"C:\Users\Admin\AppData\Local\Temp\B14E.tmp"80⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"81⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"82⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\B304.tmp"C:\Users\Admin\AppData\Local\Temp\B304.tmp"83⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\B371.tmp"C:\Users\Admin\AppData\Local\Temp\B371.tmp"84⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"85⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\B47B.tmp"C:\Users\Admin\AppData\Local\Temp\B47B.tmp"86⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\B527.tmp"C:\Users\Admin\AppData\Local\Temp\B527.tmp"87⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"88⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\B650.tmp"C:\Users\Admin\AppData\Local\Temp\B650.tmp"89⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"90⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\B769.tmp"C:\Users\Admin\AppData\Local\Temp\B769.tmp"91⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"92⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\B892.tmp"C:\Users\Admin\AppData\Local\Temp\B892.tmp"93⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\B91E.tmp"C:\Users\Admin\AppData\Local\Temp\B91E.tmp"94⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"95⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\BA38.tmp"C:\Users\Admin\AppData\Local\Temp\BA38.tmp"96⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"97⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\BB41.tmp"C:\Users\Admin\AppData\Local\Temp\BB41.tmp"98⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"99⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"100⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"101⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\BD83.tmp"C:\Users\Admin\AppData\Local\Temp\BD83.tmp"102⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\BE20.tmp"C:\Users\Admin\AppData\Local\Temp\BE20.tmp"103⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"104⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\BF58.tmp"C:\Users\Admin\AppData\Local\Temp\BF58.tmp"105⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\C004.tmp"C:\Users\Admin\AppData\Local\Temp\C004.tmp"106⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"107⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"108⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"109⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\C275.tmp"C:\Users\Admin\AppData\Local\Temp\C275.tmp"110⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\C321.tmp"C:\Users\Admin\AppData\Local\Temp\C321.tmp"111⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"112⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\C44A.tmp"C:\Users\Admin\AppData\Local\Temp\C44A.tmp"113⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"114⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\C563.tmp"C:\Users\Admin\AppData\Local\Temp\C563.tmp"115⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"116⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"117⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\C757.tmp"C:\Users\Admin\AppData\Local\Temp\C757.tmp"118⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\C7E4.tmp"C:\Users\Admin\AppData\Local\Temp\C7E4.tmp"119⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\C861.tmp"C:\Users\Admin\AppData\Local\Temp\C861.tmp"120⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\C90D.tmp"C:\Users\Admin\AppData\Local\Temp\C90D.tmp"121⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"122⤵PID:1108
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-