Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
16/08/2023, 19:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0ff0d00e3ee4256723994c2606db7976_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
0ff0d00e3ee4256723994c2606db7976_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
0ff0d00e3ee4256723994c2606db7976_mafia_JC.exe
-
Size
488KB
-
MD5
0ff0d00e3ee4256723994c2606db7976
-
SHA1
6caefceedfa1bb2b3fb0d7f203e4c38baebd09a0
-
SHA256
34b9e2de7a44845f95cd7416957d3b6ad1cc101e532bd238cebf9631d63c4478
-
SHA512
28dcc0aad5bcd9f78a79052d3d3de9be6c6e21ee248ffae2aff1c115ad32f138ba0c3ccfb2c5e75712cc5dc4e45e8712eaa1b3f997feb9ef9493ccdb8802301f
-
SSDEEP
12288:/U5rCOTeiDEgf7lHByJZSiHRbKVfN+HmEijxmYNZ:/UQOJDEwhoZSwRbKV1+GFjVN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4996 9E34.tmp 1664 9F4D.tmp 2776 A009.tmp 4860 A0F3.tmp 5060 A1DD.tmp 3880 A27A.tmp 3888 A364.tmp 2692 A400.tmp 1940 A4BC.tmp 2844 A5C5.tmp 4712 A671.tmp 4164 A72D.tmp 2824 A7AA.tmp 3684 AB05.tmp 2796 ABB1.tmp 2296 ACAB.tmp 1444 AD47.tmp 1528 AE22.tmp 4436 AECE.tmp 1976 AFC8.tmp 4500 B093.tmp 8 B1AC.tmp 2632 B248.tmp 2496 B2F4.tmp 1248 B371.tmp 3116 B40E.tmp 696 B4AA.tmp 1972 B536.tmp 3388 B621.tmp 4064 B6DC.tmp 808 B7A7.tmp 1888 B882.tmp 1452 B8FF.tmp 4460 B99B.tmp 4420 BA28.tmp 4684 BAB5.tmp 4248 BB51.tmp 2272 BBFD.tmp 1636 BC7A.tmp 4160 BD06.tmp 4008 BD93.tmp 1808 BE20.tmp 2200 BEAC.tmp 3304 BF39.tmp 4696 BFD5.tmp 4112 C071.tmp 3636 C0FE.tmp 708 C17B.tmp 3816 C217.tmp 3192 C2B4.tmp 4596 C331.tmp 2924 C3CD.tmp 4640 C44A.tmp 1044 C4D6.tmp 2176 C573.tmp 4268 C5FF.tmp 1372 C68C.tmp 3780 C709.tmp 3948 C7A5.tmp 1312 C841.tmp 2360 C8DE.tmp 4484 C97A.tmp 5020 C9E7.tmp 1940 CA55.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4264 wrote to memory of 4996 4264 0ff0d00e3ee4256723994c2606db7976_mafia_JC.exe 82 PID 4264 wrote to memory of 4996 4264 0ff0d00e3ee4256723994c2606db7976_mafia_JC.exe 82 PID 4264 wrote to memory of 4996 4264 0ff0d00e3ee4256723994c2606db7976_mafia_JC.exe 82 PID 4996 wrote to memory of 1664 4996 9E34.tmp 83 PID 4996 wrote to memory of 1664 4996 9E34.tmp 83 PID 4996 wrote to memory of 1664 4996 9E34.tmp 83 PID 1664 wrote to memory of 2776 1664 9F4D.tmp 84 PID 1664 wrote to memory of 2776 1664 9F4D.tmp 84 PID 1664 wrote to memory of 2776 1664 9F4D.tmp 84 PID 2776 wrote to memory of 4860 2776 A009.tmp 85 PID 2776 wrote to memory of 4860 2776 A009.tmp 85 PID 2776 wrote to memory of 4860 2776 A009.tmp 85 PID 4860 wrote to memory of 5060 4860 A0F3.tmp 86 PID 4860 wrote to memory of 5060 4860 A0F3.tmp 86 PID 4860 wrote to memory of 5060 4860 A0F3.tmp 86 PID 5060 wrote to memory of 3880 5060 A1DD.tmp 87 PID 5060 wrote to memory of 3880 5060 A1DD.tmp 87 PID 5060 wrote to memory of 3880 5060 A1DD.tmp 87 PID 3880 wrote to memory of 3888 3880 A27A.tmp 88 PID 3880 wrote to memory of 3888 3880 A27A.tmp 88 PID 3880 wrote to memory of 3888 3880 A27A.tmp 88 PID 3888 wrote to memory of 2692 3888 A364.tmp 89 PID 3888 wrote to memory of 2692 3888 A364.tmp 89 PID 3888 wrote to memory of 2692 3888 A364.tmp 89 PID 2692 wrote to memory of 1940 2692 A400.tmp 90 PID 2692 wrote to memory of 1940 2692 A400.tmp 90 PID 2692 wrote to memory of 1940 2692 A400.tmp 90 PID 1940 wrote to memory of 2844 1940 A4BC.tmp 91 PID 1940 wrote to memory of 2844 1940 A4BC.tmp 91 PID 1940 wrote to memory of 2844 1940 A4BC.tmp 91 PID 2844 wrote to memory of 4712 2844 A5C5.tmp 92 PID 2844 wrote to memory of 4712 2844 A5C5.tmp 92 PID 2844 wrote to memory of 4712 2844 A5C5.tmp 92 PID 4712 wrote to memory of 4164 4712 A671.tmp 93 PID 4712 wrote to memory of 4164 4712 A671.tmp 93 PID 4712 wrote to memory of 4164 4712 A671.tmp 93 PID 4164 wrote to memory of 2824 4164 A72D.tmp 94 PID 4164 wrote to memory of 2824 4164 A72D.tmp 94 PID 4164 wrote to memory of 2824 4164 A72D.tmp 94 PID 2824 wrote to memory of 3684 2824 A7AA.tmp 95 PID 2824 wrote to memory of 3684 2824 A7AA.tmp 95 PID 2824 wrote to memory of 3684 2824 A7AA.tmp 95 PID 3684 wrote to memory of 2796 3684 AB05.tmp 96 PID 3684 wrote to memory of 2796 3684 AB05.tmp 96 PID 3684 wrote to memory of 2796 3684 AB05.tmp 96 PID 2796 wrote to memory of 2296 2796 ABB1.tmp 99 PID 2796 wrote to memory of 2296 2796 ABB1.tmp 99 PID 2796 wrote to memory of 2296 2796 ABB1.tmp 99 PID 2296 wrote to memory of 1444 2296 ACAB.tmp 100 PID 2296 wrote to memory of 1444 2296 ACAB.tmp 100 PID 2296 wrote to memory of 1444 2296 ACAB.tmp 100 PID 1444 wrote to memory of 1528 1444 AD47.tmp 101 PID 1444 wrote to memory of 1528 1444 AD47.tmp 101 PID 1444 wrote to memory of 1528 1444 AD47.tmp 101 PID 1528 wrote to memory of 4436 1528 AE22.tmp 102 PID 1528 wrote to memory of 4436 1528 AE22.tmp 102 PID 1528 wrote to memory of 4436 1528 AE22.tmp 102 PID 4436 wrote to memory of 1976 4436 AECE.tmp 103 PID 4436 wrote to memory of 1976 4436 AECE.tmp 103 PID 4436 wrote to memory of 1976 4436 AECE.tmp 103 PID 1976 wrote to memory of 4500 1976 AFC8.tmp 104 PID 1976 wrote to memory of 4500 1976 AFC8.tmp 104 PID 1976 wrote to memory of 4500 1976 AFC8.tmp 104 PID 4500 wrote to memory of 8 4500 B093.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ff0d00e3ee4256723994c2606db7976_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\0ff0d00e3ee4256723994c2606db7976_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\A364.tmp"C:\Users\Admin\AppData\Local\Temp\A364.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\A671.tmp"C:\Users\Admin\AppData\Local\Temp\A671.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\AB05.tmp"C:\Users\Admin\AppData\Local\Temp\AB05.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\AECE.tmp"C:\Users\Admin\AppData\Local\Temp\AECE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\B093.tmp"C:\Users\Admin\AppData\Local\Temp\B093.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"23⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"24⤵
- Executes dropped EXE
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"25⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\B371.tmp"C:\Users\Admin\AppData\Local\Temp\B371.tmp"26⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\B40E.tmp"C:\Users\Admin\AppData\Local\Temp\B40E.tmp"27⤵
- Executes dropped EXE
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"28⤵
- Executes dropped EXE
PID:696 -
C:\Users\Admin\AppData\Local\Temp\B536.tmp"C:\Users\Admin\AppData\Local\Temp\B536.tmp"29⤵
- Executes dropped EXE
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\B621.tmp"C:\Users\Admin\AppData\Local\Temp\B621.tmp"30⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"31⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"32⤵
- Executes dropped EXE
PID:808 -
C:\Users\Admin\AppData\Local\Temp\B882.tmp"C:\Users\Admin\AppData\Local\Temp\B882.tmp"33⤵
- Executes dropped EXE
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"34⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\B99B.tmp"C:\Users\Admin\AppData\Local\Temp\B99B.tmp"35⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\BA28.tmp"C:\Users\Admin\AppData\Local\Temp\BA28.tmp"36⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"37⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"38⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"39⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"40⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\BD06.tmp"C:\Users\Admin\AppData\Local\Temp\BD06.tmp"41⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\BD93.tmp"C:\Users\Admin\AppData\Local\Temp\BD93.tmp"42⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\BE20.tmp"C:\Users\Admin\AppData\Local\Temp\BE20.tmp"43⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"44⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\BF39.tmp"C:\Users\Admin\AppData\Local\Temp\BF39.tmp"45⤵
- Executes dropped EXE
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"46⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\C071.tmp"C:\Users\Admin\AppData\Local\Temp\C071.tmp"47⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"48⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\C17B.tmp"C:\Users\Admin\AppData\Local\Temp\C17B.tmp"49⤵
- Executes dropped EXE
PID:708 -
C:\Users\Admin\AppData\Local\Temp\C217.tmp"C:\Users\Admin\AppData\Local\Temp\C217.tmp"50⤵
- Executes dropped EXE
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"51⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\C331.tmp"C:\Users\Admin\AppData\Local\Temp\C331.tmp"52⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"53⤵
- Executes dropped EXE
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\C44A.tmp"C:\Users\Admin\AppData\Local\Temp\C44A.tmp"54⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"55⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\C573.tmp"C:\Users\Admin\AppData\Local\Temp\C573.tmp"56⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"57⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\C68C.tmp"C:\Users\Admin\AppData\Local\Temp\C68C.tmp"58⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\C709.tmp"C:\Users\Admin\AppData\Local\Temp\C709.tmp"59⤵
- Executes dropped EXE
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"60⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\C841.tmp"C:\Users\Admin\AppData\Local\Temp\C841.tmp"61⤵
- Executes dropped EXE
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"62⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\C97A.tmp"C:\Users\Admin\AppData\Local\Temp\C97A.tmp"63⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"64⤵
- Executes dropped EXE
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\CA55.tmp"C:\Users\Admin\AppData\Local\Temp\CA55.tmp"65⤵
- Executes dropped EXE
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\CAD2.tmp"C:\Users\Admin\AppData\Local\Temp\CAD2.tmp"66⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\CB3F.tmp"C:\Users\Admin\AppData\Local\Temp\CB3F.tmp"67⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\CBAC.tmp"C:\Users\Admin\AppData\Local\Temp\CBAC.tmp"68⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\CC39.tmp"C:\Users\Admin\AppData\Local\Temp\CC39.tmp"69⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"70⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\CD23.tmp"C:\Users\Admin\AppData\Local\Temp\CD23.tmp"71⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"72⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\CE3D.tmp"C:\Users\Admin\AppData\Local\Temp\CE3D.tmp"73⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"74⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\CF37.tmp"C:\Users\Admin\AppData\Local\Temp\CF37.tmp"75⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"76⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\D011.tmp"C:\Users\Admin\AppData\Local\Temp\D011.tmp"77⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\D07F.tmp"C:\Users\Admin\AppData\Local\Temp\D07F.tmp"78⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\D10B.tmp"C:\Users\Admin\AppData\Local\Temp\D10B.tmp"79⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\D1A8.tmp"C:\Users\Admin\AppData\Local\Temp\D1A8.tmp"80⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\D234.tmp"C:\Users\Admin\AppData\Local\Temp\D234.tmp"81⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\D2B1.tmp"C:\Users\Admin\AppData\Local\Temp\D2B1.tmp"82⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\D34E.tmp"C:\Users\Admin\AppData\Local\Temp\D34E.tmp"83⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"84⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\D409.tmp"C:\Users\Admin\AppData\Local\Temp\D409.tmp"85⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\D4C5.tmp"C:\Users\Admin\AppData\Local\Temp\D4C5.tmp"86⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\D532.tmp"C:\Users\Admin\AppData\Local\Temp\D532.tmp"87⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\D5BF.tmp"C:\Users\Admin\AppData\Local\Temp\D5BF.tmp"88⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\D62C.tmp"C:\Users\Admin\AppData\Local\Temp\D62C.tmp"89⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\D68A.tmp"C:\Users\Admin\AppData\Local\Temp\D68A.tmp"90⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\D707.tmp"C:\Users\Admin\AppData\Local\Temp\D707.tmp"91⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\D764.tmp"C:\Users\Admin\AppData\Local\Temp\D764.tmp"92⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\D7F1.tmp"C:\Users\Admin\AppData\Local\Temp\D7F1.tmp"93⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\D85E.tmp"C:\Users\Admin\AppData\Local\Temp\D85E.tmp"94⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"95⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\D968.tmp"C:\Users\Admin\AppData\Local\Temp\D968.tmp"96⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\DA04.tmp"C:\Users\Admin\AppData\Local\Temp\DA04.tmp"97⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\DA72.tmp"C:\Users\Admin\AppData\Local\Temp\DA72.tmp"98⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\DB0E.tmp"C:\Users\Admin\AppData\Local\Temp\DB0E.tmp"99⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"100⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\DC37.tmp"C:\Users\Admin\AppData\Local\Temp\DC37.tmp"101⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"102⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\DD40.tmp"C:\Users\Admin\AppData\Local\Temp\DD40.tmp"103⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\DDDD.tmp"C:\Users\Admin\AppData\Local\Temp\DDDD.tmp"104⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\DE79.tmp"C:\Users\Admin\AppData\Local\Temp\DE79.tmp"105⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\DF06.tmp"C:\Users\Admin\AppData\Local\Temp\DF06.tmp"106⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\DF83.tmp"C:\Users\Admin\AppData\Local\Temp\DF83.tmp"107⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\E000.tmp"C:\Users\Admin\AppData\Local\Temp\E000.tmp"108⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\E08C.tmp"C:\Users\Admin\AppData\Local\Temp\E08C.tmp"109⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\E119.tmp"C:\Users\Admin\AppData\Local\Temp\E119.tmp"110⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\E1B5.tmp"C:\Users\Admin\AppData\Local\Temp\E1B5.tmp"111⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\E242.tmp"C:\Users\Admin\AppData\Local\Temp\E242.tmp"112⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"113⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\E33C.tmp"C:\Users\Admin\AppData\Local\Temp\E33C.tmp"114⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"115⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\E465.tmp"C:\Users\Admin\AppData\Local\Temp\E465.tmp"116⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\E4F1.tmp"C:\Users\Admin\AppData\Local\Temp\E4F1.tmp"117⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\E58D.tmp"C:\Users\Admin\AppData\Local\Temp\E58D.tmp"118⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\E639.tmp"C:\Users\Admin\AppData\Local\Temp\E639.tmp"119⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"120⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\E724.tmp"C:\Users\Admin\AppData\Local\Temp\E724.tmp"121⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"122⤵PID:3292
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-