Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18-08-2023 16:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3622bd2da1c00a8cb0d230cacf1a543f_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
3622bd2da1c00a8cb0d230cacf1a543f_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
3622bd2da1c00a8cb0d230cacf1a543f_mafia_JC.exe
-
Size
487KB
-
MD5
3622bd2da1c00a8cb0d230cacf1a543f
-
SHA1
b2aa4820c7310c2d6f6d130fa78027152e0ca191
-
SHA256
7dc91abd64834bfd5af4cafc0f184cf58ac7d24e80ce9058c010f67f1c3d2e94
-
SHA512
e6b0d9c53fcf777baa546859d475b68fc363957f9551e02160e928a950b5637df4256aea6952828a408a7704a7a890081c5f76c8189a5163d9d39cc1c816d32b
-
SSDEEP
12288:yU5rCOTeiNJH8WK9GSr5M+ZfI6pcByjbZ:yUQOJNKWvSrC+9SYb
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1044 69B6.tmp 3852 6A72.tmp 332 6B5C.tmp 4868 6C08.tmp 2360 6CE3.tmp 3348 6D9E.tmp 4136 6E4A.tmp 840 6F54.tmp 4672 6FD1.tmp 4264 705D.tmp 4552 7129.tmp 836 7213.tmp 2424 730D.tmp 1224 7407.tmp 1496 74A3.tmp 784 753F.tmp 4652 75BC.tmp 3716 7649.tmp 2400 7733.tmp 2180 77EF.tmp 3952 7937.tmp 4120 7A12.tmp 4316 7A9E.tmp 3476 7B3B.tmp 4084 7BF6.tmp 4880 7C73.tmp 2748 7D0F.tmp 4320 7DBB.tmp 4696 7E86.tmp 2012 7F32.tmp 4972 7FAF.tmp 2688 809A.tmp 1864 8174.tmp 4212 8201.tmp 3920 829D.tmp 3672 8349.tmp 4292 8472.tmp 556 851E.tmp 1048 858B.tmp 4308 8618.tmp 3328 86A5.tmp 2296 8722.tmp 3544 878F.tmp 2732 882B.tmp 4436 88D7.tmp 224 8973.tmp 1144 8A1F.tmp 2188 8AAC.tmp 4200 8B38.tmp 2252 8BF4.tmp 3624 8C81.tmp 4304 8D2C.tmp 2588 8D8A.tmp 4160 8E07.tmp 1312 8E94.tmp 1428 8F30.tmp 888 8F9D.tmp 3780 903A.tmp 1420 90C6.tmp 1448 9153.tmp 4544 91EF.tmp 4628 927C.tmp 5092 92DA.tmp 1568 9347.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 852 wrote to memory of 1044 852 3622bd2da1c00a8cb0d230cacf1a543f_mafia_JC.exe 81 PID 852 wrote to memory of 1044 852 3622bd2da1c00a8cb0d230cacf1a543f_mafia_JC.exe 81 PID 852 wrote to memory of 1044 852 3622bd2da1c00a8cb0d230cacf1a543f_mafia_JC.exe 81 PID 1044 wrote to memory of 3852 1044 69B6.tmp 82 PID 1044 wrote to memory of 3852 1044 69B6.tmp 82 PID 1044 wrote to memory of 3852 1044 69B6.tmp 82 PID 3852 wrote to memory of 332 3852 6A72.tmp 83 PID 3852 wrote to memory of 332 3852 6A72.tmp 83 PID 3852 wrote to memory of 332 3852 6A72.tmp 83 PID 332 wrote to memory of 4868 332 6B5C.tmp 84 PID 332 wrote to memory of 4868 332 6B5C.tmp 84 PID 332 wrote to memory of 4868 332 6B5C.tmp 84 PID 4868 wrote to memory of 2360 4868 6C08.tmp 85 PID 4868 wrote to memory of 2360 4868 6C08.tmp 85 PID 4868 wrote to memory of 2360 4868 6C08.tmp 85 PID 2360 wrote to memory of 3348 2360 6CE3.tmp 86 PID 2360 wrote to memory of 3348 2360 6CE3.tmp 86 PID 2360 wrote to memory of 3348 2360 6CE3.tmp 86 PID 3348 wrote to memory of 4136 3348 6D9E.tmp 87 PID 3348 wrote to memory of 4136 3348 6D9E.tmp 87 PID 3348 wrote to memory of 4136 3348 6D9E.tmp 87 PID 4136 wrote to memory of 840 4136 6E4A.tmp 89 PID 4136 wrote to memory of 840 4136 6E4A.tmp 89 PID 4136 wrote to memory of 840 4136 6E4A.tmp 89 PID 840 wrote to memory of 4672 840 6F54.tmp 90 PID 840 wrote to memory of 4672 840 6F54.tmp 90 PID 840 wrote to memory of 4672 840 6F54.tmp 90 PID 4672 wrote to memory of 4264 4672 6FD1.tmp 91 PID 4672 wrote to memory of 4264 4672 6FD1.tmp 91 PID 4672 wrote to memory of 4264 4672 6FD1.tmp 91 PID 4264 wrote to memory of 4552 4264 705D.tmp 92 PID 4264 wrote to memory of 4552 4264 705D.tmp 92 PID 4264 wrote to memory of 4552 4264 705D.tmp 92 PID 4552 wrote to memory of 836 4552 7129.tmp 93 PID 4552 wrote to memory of 836 4552 7129.tmp 93 PID 4552 wrote to memory of 836 4552 7129.tmp 93 PID 836 wrote to memory of 2424 836 7213.tmp 94 PID 836 wrote to memory of 2424 836 7213.tmp 94 PID 836 wrote to memory of 2424 836 7213.tmp 94 PID 2424 wrote to memory of 1224 2424 730D.tmp 95 PID 2424 wrote to memory of 1224 2424 730D.tmp 95 PID 2424 wrote to memory of 1224 2424 730D.tmp 95 PID 1224 wrote to memory of 1496 1224 7407.tmp 96 PID 1224 wrote to memory of 1496 1224 7407.tmp 96 PID 1224 wrote to memory of 1496 1224 7407.tmp 96 PID 1496 wrote to memory of 784 1496 74A3.tmp 97 PID 1496 wrote to memory of 784 1496 74A3.tmp 97 PID 1496 wrote to memory of 784 1496 74A3.tmp 97 PID 784 wrote to memory of 4652 784 753F.tmp 98 PID 784 wrote to memory of 4652 784 753F.tmp 98 PID 784 wrote to memory of 4652 784 753F.tmp 98 PID 4652 wrote to memory of 3716 4652 75BC.tmp 101 PID 4652 wrote to memory of 3716 4652 75BC.tmp 101 PID 4652 wrote to memory of 3716 4652 75BC.tmp 101 PID 3716 wrote to memory of 2400 3716 7649.tmp 102 PID 3716 wrote to memory of 2400 3716 7649.tmp 102 PID 3716 wrote to memory of 2400 3716 7649.tmp 102 PID 2400 wrote to memory of 2180 2400 7733.tmp 103 PID 2400 wrote to memory of 2180 2400 7733.tmp 103 PID 2400 wrote to memory of 2180 2400 7733.tmp 103 PID 2180 wrote to memory of 3952 2180 77EF.tmp 104 PID 2180 wrote to memory of 3952 2180 77EF.tmp 104 PID 2180 wrote to memory of 3952 2180 77EF.tmp 104 PID 3952 wrote to memory of 4120 3952 7937.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\3622bd2da1c00a8cb0d230cacf1a543f_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\3622bd2da1c00a8cb0d230cacf1a543f_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\7213.tmp"C:\Users\Admin\AppData\Local\Temp\7213.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\77EF.tmp"C:\Users\Admin\AppData\Local\Temp\77EF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\7937.tmp"C:\Users\Admin\AppData\Local\Temp\7937.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\7A12.tmp"C:\Users\Admin\AppData\Local\Temp\7A12.tmp"23⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"24⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"25⤵
- Executes dropped EXE
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"26⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\7C73.tmp"C:\Users\Admin\AppData\Local\Temp\7C73.tmp"27⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"28⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"29⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"30⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\7F32.tmp"C:\Users\Admin\AppData\Local\Temp\7F32.tmp"31⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"32⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\809A.tmp"C:\Users\Admin\AppData\Local\Temp\809A.tmp"33⤵
- Executes dropped EXE
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\8174.tmp"C:\Users\Admin\AppData\Local\Temp\8174.tmp"34⤵
- Executes dropped EXE
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\8201.tmp"C:\Users\Admin\AppData\Local\Temp\8201.tmp"35⤵
- Executes dropped EXE
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\829D.tmp"C:\Users\Admin\AppData\Local\Temp\829D.tmp"36⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\8349.tmp"C:\Users\Admin\AppData\Local\Temp\8349.tmp"37⤵
- Executes dropped EXE
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\8472.tmp"C:\Users\Admin\AppData\Local\Temp\8472.tmp"38⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\851E.tmp"C:\Users\Admin\AppData\Local\Temp\851E.tmp"39⤵
- Executes dropped EXE
PID:556 -
C:\Users\Admin\AppData\Local\Temp\858B.tmp"C:\Users\Admin\AppData\Local\Temp\858B.tmp"40⤵
- Executes dropped EXE
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\8618.tmp"C:\Users\Admin\AppData\Local\Temp\8618.tmp"41⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\86A5.tmp"C:\Users\Admin\AppData\Local\Temp\86A5.tmp"42⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\8722.tmp"C:\Users\Admin\AppData\Local\Temp\8722.tmp"43⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\878F.tmp"C:\Users\Admin\AppData\Local\Temp\878F.tmp"44⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\882B.tmp"C:\Users\Admin\AppData\Local\Temp\882B.tmp"45⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"46⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\8973.tmp"C:\Users\Admin\AppData\Local\Temp\8973.tmp"47⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"48⤵
- Executes dropped EXE
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"49⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\8B38.tmp"C:\Users\Admin\AppData\Local\Temp\8B38.tmp"50⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"51⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\8C81.tmp"C:\Users\Admin\AppData\Local\Temp\8C81.tmp"52⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"53⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"54⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\8E07.tmp"C:\Users\Admin\AppData\Local\Temp\8E07.tmp"55⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\8E94.tmp"C:\Users\Admin\AppData\Local\Temp\8E94.tmp"56⤵
- Executes dropped EXE
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\8F30.tmp"C:\Users\Admin\AppData\Local\Temp\8F30.tmp"57⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"58⤵
- Executes dropped EXE
PID:888 -
C:\Users\Admin\AppData\Local\Temp\903A.tmp"C:\Users\Admin\AppData\Local\Temp\903A.tmp"59⤵
- Executes dropped EXE
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"60⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\9153.tmp"C:\Users\Admin\AppData\Local\Temp\9153.tmp"61⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\91EF.tmp"C:\Users\Admin\AppData\Local\Temp\91EF.tmp"62⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\927C.tmp"C:\Users\Admin\AppData\Local\Temp\927C.tmp"63⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\92DA.tmp"C:\Users\Admin\AppData\Local\Temp\92DA.tmp"64⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"65⤵
- Executes dropped EXE
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\93A5.tmp"C:\Users\Admin\AppData\Local\Temp\93A5.tmp"66⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\9412.tmp"C:\Users\Admin\AppData\Local\Temp\9412.tmp"67⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\948F.tmp"C:\Users\Admin\AppData\Local\Temp\948F.tmp"68⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\951C.tmp"C:\Users\Admin\AppData\Local\Temp\951C.tmp"69⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\95C8.tmp"C:\Users\Admin\AppData\Local\Temp\95C8.tmp"70⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\9654.tmp"C:\Users\Admin\AppData\Local\Temp\9654.tmp"71⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\96E1.tmp"C:\Users\Admin\AppData\Local\Temp\96E1.tmp"72⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"73⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\97EA.tmp"C:\Users\Admin\AppData\Local\Temp\97EA.tmp"74⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"75⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\98C5.tmp"C:\Users\Admin\AppData\Local\Temp\98C5.tmp"76⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"77⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"78⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"79⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"80⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"81⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"82⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"83⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"84⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"85⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"86⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\A086.tmp"C:\Users\Admin\AppData\Local\Temp\A086.tmp"87⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"88⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"89⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\A26A.tmp"C:\Users\Admin\AppData\Local\Temp\A26A.tmp"90⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"91⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"92⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"93⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"94⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"95⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"96⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"97⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"98⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"99⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\A836.tmp"C:\Users\Admin\AppData\Local\Temp\A836.tmp"100⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"101⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\A950.tmp"C:\Users\Admin\AppData\Local\Temp\A950.tmp"102⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"103⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\AA59.tmp"C:\Users\Admin\AppData\Local\Temp\AA59.tmp"104⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"105⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\AB72.tmp"C:\Users\Admin\AppData\Local\Temp\AB72.tmp"106⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"107⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"108⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\AD18.tmp"C:\Users\Admin\AppData\Local\Temp\AD18.tmp"109⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"110⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"111⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"112⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"113⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"114⤵PID:660
-
C:\Users\Admin\AppData\Local\Temp\B054.tmp"C:\Users\Admin\AppData\Local\Temp\B054.tmp"115⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"116⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"117⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"118⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\B268.tmp"C:\Users\Admin\AppData\Local\Temp\B268.tmp"119⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\B304.tmp"C:\Users\Admin\AppData\Local\Temp\B304.tmp"120⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\B371.tmp"C:\Users\Admin\AppData\Local\Temp\B371.tmp"121⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"122⤵PID:4504
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-