Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18-08-2023 13:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
241f802643818a2e47e2c0f517446d5d_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
241f802643818a2e47e2c0f517446d5d_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
241f802643818a2e47e2c0f517446d5d_mafia_JC.exe
-
Size
520KB
-
MD5
241f802643818a2e47e2c0f517446d5d
-
SHA1
5b4f589d7d6498dad754a2a05ecbe687a63f751b
-
SHA256
e91a94f611269e411e8ede224cc054440ecda1efa25f1a4abc4eea58fd8bd6d9
-
SHA512
f132e9df38119a5683429dfaff1610c64ed8b9ef4b6ad81f3fe7c24e997df40b2b70e017d78c5ba4c11a3ed3d17b0119bdf75ea6ec419d287c1da57627dcee0b
-
SSDEEP
12288:XbB1mLVrSh1xiOD9Y+UK92EMC4v0AMNZ:XbGLshrnD9HjnMCU07N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4272 9961.tmp 4884 9A5B.tmp 4132 9B55.tmp 3404 9C30.tmp 2804 9CDC.tmp 1132 9D88.tmp 4932 9E72.tmp 2924 9F8C.tmp 3852 A018.tmp 4736 A112.tmp 4476 A1AE.tmp 208 A2A8.tmp 1148 A364.tmp 3872 A44E.tmp 2636 A519.tmp 4156 A5F4.tmp 4716 A6FE.tmp 4296 A807.tmp 1212 A8E2.tmp 4160 A97E.tmp 4048 AA3A.tmp 2992 AAE6.tmp 3700 AB92.tmp 2220 AC4D.tmp 2232 AD09.tmp 3564 ADB5.tmp 964 AE80.tmp 2568 AF99.tmp 4952 B054.tmp 4752 B120.tmp 3624 B20A.tmp 2844 B2F4.tmp 3484 B3FE.tmp 4964 B4F8.tmp 4392 B594.tmp 4404 B5F2.tmp 3552 B650.tmp 2172 B6EC.tmp 1988 B779.tmp 4380 B7E6.tmp 3724 B863.tmp 2544 B8FF.tmp 2928 B99B.tmp 3680 BA28.tmp 1548 BAD4.tmp 1756 BB61.tmp 5024 BBED.tmp 3696 BC6A.tmp 3924 BD06.tmp 5060 BD93.tmp 4536 BDF1.tmp 3736 BE5E.tmp 4728 BEFA.tmp 400 BFA6.tmp 2352 C033.tmp 2648 C0C0.tmp 1924 C15C.tmp 1668 C1E8.tmp 412 C246.tmp 4192 C2B4.tmp 3316 C331.tmp 2140 C38E.tmp 4280 C40B.tmp 560 C488.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4516 wrote to memory of 4272 4516 241f802643818a2e47e2c0f517446d5d_mafia_JC.exe 83 PID 4516 wrote to memory of 4272 4516 241f802643818a2e47e2c0f517446d5d_mafia_JC.exe 83 PID 4516 wrote to memory of 4272 4516 241f802643818a2e47e2c0f517446d5d_mafia_JC.exe 83 PID 4272 wrote to memory of 4884 4272 9961.tmp 84 PID 4272 wrote to memory of 4884 4272 9961.tmp 84 PID 4272 wrote to memory of 4884 4272 9961.tmp 84 PID 4884 wrote to memory of 4132 4884 9A5B.tmp 85 PID 4884 wrote to memory of 4132 4884 9A5B.tmp 85 PID 4884 wrote to memory of 4132 4884 9A5B.tmp 85 PID 4132 wrote to memory of 3404 4132 9B55.tmp 86 PID 4132 wrote to memory of 3404 4132 9B55.tmp 86 PID 4132 wrote to memory of 3404 4132 9B55.tmp 86 PID 3404 wrote to memory of 2804 3404 9C30.tmp 87 PID 3404 wrote to memory of 2804 3404 9C30.tmp 87 PID 3404 wrote to memory of 2804 3404 9C30.tmp 87 PID 2804 wrote to memory of 1132 2804 9CDC.tmp 88 PID 2804 wrote to memory of 1132 2804 9CDC.tmp 88 PID 2804 wrote to memory of 1132 2804 9CDC.tmp 88 PID 1132 wrote to memory of 4932 1132 9D88.tmp 89 PID 1132 wrote to memory of 4932 1132 9D88.tmp 89 PID 1132 wrote to memory of 4932 1132 9D88.tmp 89 PID 4932 wrote to memory of 2924 4932 9E72.tmp 90 PID 4932 wrote to memory of 2924 4932 9E72.tmp 90 PID 4932 wrote to memory of 2924 4932 9E72.tmp 90 PID 2924 wrote to memory of 3852 2924 9F8C.tmp 91 PID 2924 wrote to memory of 3852 2924 9F8C.tmp 91 PID 2924 wrote to memory of 3852 2924 9F8C.tmp 91 PID 3852 wrote to memory of 4736 3852 A018.tmp 92 PID 3852 wrote to memory of 4736 3852 A018.tmp 92 PID 3852 wrote to memory of 4736 3852 A018.tmp 92 PID 4736 wrote to memory of 4476 4736 A112.tmp 93 PID 4736 wrote to memory of 4476 4736 A112.tmp 93 PID 4736 wrote to memory of 4476 4736 A112.tmp 93 PID 4476 wrote to memory of 208 4476 A1AE.tmp 94 PID 4476 wrote to memory of 208 4476 A1AE.tmp 94 PID 4476 wrote to memory of 208 4476 A1AE.tmp 94 PID 208 wrote to memory of 1148 208 A2A8.tmp 95 PID 208 wrote to memory of 1148 208 A2A8.tmp 95 PID 208 wrote to memory of 1148 208 A2A8.tmp 95 PID 1148 wrote to memory of 3872 1148 A364.tmp 96 PID 1148 wrote to memory of 3872 1148 A364.tmp 96 PID 1148 wrote to memory of 3872 1148 A364.tmp 96 PID 3872 wrote to memory of 2636 3872 A44E.tmp 97 PID 3872 wrote to memory of 2636 3872 A44E.tmp 97 PID 3872 wrote to memory of 2636 3872 A44E.tmp 97 PID 2636 wrote to memory of 4156 2636 A519.tmp 100 PID 2636 wrote to memory of 4156 2636 A519.tmp 100 PID 2636 wrote to memory of 4156 2636 A519.tmp 100 PID 4156 wrote to memory of 4716 4156 A5F4.tmp 101 PID 4156 wrote to memory of 4716 4156 A5F4.tmp 101 PID 4156 wrote to memory of 4716 4156 A5F4.tmp 101 PID 4716 wrote to memory of 4296 4716 A6FE.tmp 102 PID 4716 wrote to memory of 4296 4716 A6FE.tmp 102 PID 4716 wrote to memory of 4296 4716 A6FE.tmp 102 PID 4296 wrote to memory of 1212 4296 A807.tmp 103 PID 4296 wrote to memory of 1212 4296 A807.tmp 103 PID 4296 wrote to memory of 1212 4296 A807.tmp 103 PID 1212 wrote to memory of 4160 1212 A8E2.tmp 104 PID 1212 wrote to memory of 4160 1212 A8E2.tmp 104 PID 1212 wrote to memory of 4160 1212 A8E2.tmp 104 PID 4160 wrote to memory of 4048 4160 A97E.tmp 106 PID 4160 wrote to memory of 4048 4160 A97E.tmp 106 PID 4160 wrote to memory of 4048 4160 A97E.tmp 106 PID 4048 wrote to memory of 2992 4048 AA3A.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\241f802643818a2e47e2c0f517446d5d_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\241f802643818a2e47e2c0f517446d5d_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\9E72.tmp"C:\Users\Admin\AppData\Local\Temp\9E72.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\A112.tmp"C:\Users\Admin\AppData\Local\Temp\A112.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\A364.tmp"C:\Users\Admin\AppData\Local\Temp\A364.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\A519.tmp"C:\Users\Admin\AppData\Local\Temp\A519.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"23⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\AB92.tmp"C:\Users\Admin\AppData\Local\Temp\AB92.tmp"24⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"25⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\AD09.tmp"C:\Users\Admin\AppData\Local\Temp\AD09.tmp"26⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"27⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\AE80.tmp"C:\Users\Admin\AppData\Local\Temp\AE80.tmp"28⤵
- Executes dropped EXE
PID:964 -
C:\Users\Admin\AppData\Local\Temp\AF99.tmp"C:\Users\Admin\AppData\Local\Temp\AF99.tmp"29⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\B054.tmp"C:\Users\Admin\AppData\Local\Temp\B054.tmp"30⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\B120.tmp"C:\Users\Admin\AppData\Local\Temp\B120.tmp"31⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\B20A.tmp"C:\Users\Admin\AppData\Local\Temp\B20A.tmp"32⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"33⤵
- Executes dropped EXE
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"34⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"35⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\B594.tmp"C:\Users\Admin\AppData\Local\Temp\B594.tmp"36⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"37⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\B650.tmp"C:\Users\Admin\AppData\Local\Temp\B650.tmp"38⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"39⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\B779.tmp"C:\Users\Admin\AppData\Local\Temp\B779.tmp"40⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"41⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\B863.tmp"C:\Users\Admin\AppData\Local\Temp\B863.tmp"42⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"43⤵
- Executes dropped EXE
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\B99B.tmp"C:\Users\Admin\AppData\Local\Temp\B99B.tmp"44⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\BA28.tmp"C:\Users\Admin\AppData\Local\Temp\BA28.tmp"45⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"46⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\BB61.tmp"C:\Users\Admin\AppData\Local\Temp\BB61.tmp"47⤵
- Executes dropped EXE
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\BBED.tmp"C:\Users\Admin\AppData\Local\Temp\BBED.tmp"48⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"49⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\BD06.tmp"C:\Users\Admin\AppData\Local\Temp\BD06.tmp"50⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\BD93.tmp"C:\Users\Admin\AppData\Local\Temp\BD93.tmp"51⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"52⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"53⤵
- Executes dropped EXE
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"54⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"55⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"56⤵
- Executes dropped EXE
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"57⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"58⤵
- Executes dropped EXE
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"59⤵
- Executes dropped EXE
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\C246.tmp"C:\Users\Admin\AppData\Local\Temp\C246.tmp"60⤵
- Executes dropped EXE
PID:412 -
C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"61⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\C331.tmp"C:\Users\Admin\AppData\Local\Temp\C331.tmp"62⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\C38E.tmp"C:\Users\Admin\AppData\Local\Temp\C38E.tmp"63⤵
- Executes dropped EXE
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\C40B.tmp"C:\Users\Admin\AppData\Local\Temp\C40B.tmp"64⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\C488.tmp"C:\Users\Admin\AppData\Local\Temp\C488.tmp"65⤵
- Executes dropped EXE
PID:560 -
C:\Users\Admin\AppData\Local\Temp\C505.tmp"C:\Users\Admin\AppData\Local\Temp\C505.tmp"66⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\C582.tmp"C:\Users\Admin\AppData\Local\Temp\C582.tmp"67⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\C60F.tmp"C:\Users\Admin\AppData\Local\Temp\C60F.tmp"68⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\C69C.tmp"C:\Users\Admin\AppData\Local\Temp\C69C.tmp"69⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\C738.tmp"C:\Users\Admin\AppData\Local\Temp\C738.tmp"70⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\C796.tmp"C:\Users\Admin\AppData\Local\Temp\C796.tmp"71⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\C832.tmp"C:\Users\Admin\AppData\Local\Temp\C832.tmp"72⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\C89F.tmp"C:\Users\Admin\AppData\Local\Temp\C89F.tmp"73⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\C90D.tmp"C:\Users\Admin\AppData\Local\Temp\C90D.tmp"74⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\C96A.tmp"C:\Users\Admin\AppData\Local\Temp\C96A.tmp"75⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"76⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\CA55.tmp"C:\Users\Admin\AppData\Local\Temp\CA55.tmp"77⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\CB20.tmp"C:\Users\Admin\AppData\Local\Temp\CB20.tmp"78⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\CBBC.tmp"C:\Users\Admin\AppData\Local\Temp\CBBC.tmp"79⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"80⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\CC97.tmp"C:\Users\Admin\AppData\Local\Temp\CC97.tmp"81⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\CD33.tmp"C:\Users\Admin\AppData\Local\Temp\CD33.tmp"82⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"83⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\CE5C.tmp"C:\Users\Admin\AppData\Local\Temp\CE5C.tmp"84⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"85⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\CF37.tmp"C:\Users\Admin\AppData\Local\Temp\CF37.tmp"86⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\CF85.tmp"C:\Users\Admin\AppData\Local\Temp\CF85.tmp"87⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\CFF2.tmp"C:\Users\Admin\AppData\Local\Temp\CFF2.tmp"88⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\D07F.tmp"C:\Users\Admin\AppData\Local\Temp\D07F.tmp"89⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\D0FC.tmp"C:\Users\Admin\AppData\Local\Temp\D0FC.tmp"90⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\D179.tmp"C:\Users\Admin\AppData\Local\Temp\D179.tmp"91⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\D215.tmp"C:\Users\Admin\AppData\Local\Temp\D215.tmp"92⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\D2B1.tmp"C:\Users\Admin\AppData\Local\Temp\D2B1.tmp"93⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\D34E.tmp"C:\Users\Admin\AppData\Local\Temp\D34E.tmp"94⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\D3DA.tmp"C:\Users\Admin\AppData\Local\Temp\D3DA.tmp"95⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\D467.tmp"C:\Users\Admin\AppData\Local\Temp\D467.tmp"96⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\D4D4.tmp"C:\Users\Admin\AppData\Local\Temp\D4D4.tmp"97⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\D551.tmp"C:\Users\Admin\AppData\Local\Temp\D551.tmp"98⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\D5CE.tmp"C:\Users\Admin\AppData\Local\Temp\D5CE.tmp"99⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\D64B.tmp"C:\Users\Admin\AppData\Local\Temp\D64B.tmp"100⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\D6D8.tmp"C:\Users\Admin\AppData\Local\Temp\D6D8.tmp"101⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\D784.tmp"C:\Users\Admin\AppData\Local\Temp\D784.tmp"102⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\D801.tmp"C:\Users\Admin\AppData\Local\Temp\D801.tmp"103⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\D8AD.tmp"C:\Users\Admin\AppData\Local\Temp\D8AD.tmp"104⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\D949.tmp"C:\Users\Admin\AppData\Local\Temp\D949.tmp"105⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"106⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\DA52.tmp"C:\Users\Admin\AppData\Local\Temp\DA52.tmp"107⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\DADF.tmp"C:\Users\Admin\AppData\Local\Temp\DADF.tmp"108⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"109⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\DC08.tmp"C:\Users\Admin\AppData\Local\Temp\DC08.tmp"110⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\DCA4.tmp"C:\Users\Admin\AppData\Local\Temp\DCA4.tmp"111⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\DD21.tmp"C:\Users\Admin\AppData\Local\Temp\DD21.tmp"112⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"113⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\DE4A.tmp"C:\Users\Admin\AppData\Local\Temp\DE4A.tmp"114⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\DEB7.tmp"C:\Users\Admin\AppData\Local\Temp\DEB7.tmp"115⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\DF34.tmp"C:\Users\Admin\AppData\Local\Temp\DF34.tmp"116⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\DFC1.tmp"C:\Users\Admin\AppData\Local\Temp\DFC1.tmp"117⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\E05D.tmp"C:\Users\Admin\AppData\Local\Temp\E05D.tmp"118⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"119⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\E167.tmp"C:\Users\Admin\AppData\Local\Temp\E167.tmp"120⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\E203.tmp"C:\Users\Admin\AppData\Local\Temp\E203.tmp"121⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\E290.tmp"C:\Users\Admin\AppData\Local\Temp\E290.tmp"122⤵PID:4884
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-