Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
18/08/2023, 16:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
36f707242127a8a3250e760374cb8d4e_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
36f707242127a8a3250e760374cb8d4e_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
36f707242127a8a3250e760374cb8d4e_mafia_JC.exe
-
Size
486KB
-
MD5
36f707242127a8a3250e760374cb8d4e
-
SHA1
83c1f8e7d4f6a1745d3dbc3e9932727bbb068c24
-
SHA256
c542452f2771c4282084a6f07e4708aaf6d0b4c4c3aa59ee438a93f5e0415d2e
-
SHA512
b094abaf27ca3fc93c78d398189541dbc96c8b5eade5ced247fe6faa8c896f6330c33ac6538c85b88b4fc3c44554c708efe55b4c927c498c07fcca5ddb8b4c96
-
SSDEEP
12288:UU5rCOTeiDow4SLiIoQCaqUO9noiutQE6NZ:UUQOJD/uRBUAoiSQVN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2968 84D9.tmp 2620 8594.tmp 2552 85F2.tmp 2040 864F.tmp 2508 86BD.tmp 2824 871A.tmp 2984 8797.tmp 1464 8804.tmp 2684 8871.tmp 2964 88CF.tmp 2780 892D.tmp 2792 899A.tmp 2696 89F7.tmp 2256 8A55.tmp 2652 8AD2.tmp 2028 8B3F.tmp 1808 8B9D.tmp 3060 8BFA.tmp 1012 8C67.tmp 2608 8CB5.tmp 1780 8D13.tmp 2744 8D71.tmp 2764 8DCE.tmp 2872 8E2C.tmp 1980 8E89.tmp 1784 8EC8.tmp 340 8F35.tmp 1284 8F93.tmp 2444 8FF0.tmp 2528 903E.tmp 2244 90AB.tmp 1700 9109.tmp 660 91A5.tmp 780 927F.tmp 648 931B.tmp 828 93B7.tmp 2376 9425.tmp 1076 94D0.tmp 1372 957C.tmp 664 96C3.tmp 1600 97DC.tmp 748 9878.tmp 2492 98F5.tmp 2240 9953.tmp 1988 99A1.tmp 1296 9A0E.tmp 1452 9A7B.tmp 2380 9AD9.tmp 2008 9B55.tmp 760 9BC3.tmp 1956 9C20.tmp 2200 9C7E.tmp 856 9CEB.tmp 1308 9D49.tmp 1776 9D97.tmp 1592 9E13.tmp 2208 9E90.tmp 2212 9EFD.tmp 2532 9F5B.tmp 2052 9FC8.tmp 2060 A026.tmp 2952 A093.tmp 1472 A0F1.tmp 2912 A15E.tmp -
Loads dropped DLL 64 IoCs
pid Process 816 36f707242127a8a3250e760374cb8d4e_mafia_JC.exe 2968 84D9.tmp 2620 8594.tmp 2552 85F2.tmp 2040 864F.tmp 2508 86BD.tmp 2824 871A.tmp 2984 8797.tmp 1464 8804.tmp 2684 8871.tmp 2964 88CF.tmp 2780 892D.tmp 2792 899A.tmp 2696 89F7.tmp 2256 8A55.tmp 2652 8AD2.tmp 2028 8B3F.tmp 1808 8B9D.tmp 3060 8BFA.tmp 1012 8C67.tmp 2608 8CB5.tmp 1780 8D13.tmp 2744 8D71.tmp 2764 8DCE.tmp 2872 8E2C.tmp 1980 8E89.tmp 1784 8EC8.tmp 340 8F35.tmp 1284 8F93.tmp 2444 8FF0.tmp 2528 903E.tmp 2244 90AB.tmp 1700 9109.tmp 660 91A5.tmp 780 927F.tmp 648 931B.tmp 828 93B7.tmp 2376 9425.tmp 1076 94D0.tmp 1372 957C.tmp 664 96C3.tmp 1600 97DC.tmp 748 9878.tmp 2492 98F5.tmp 2240 9953.tmp 1988 99A1.tmp 1296 9A0E.tmp 1452 9A7B.tmp 2380 9AD9.tmp 2008 9B55.tmp 760 9BC3.tmp 1956 9C20.tmp 2200 9C7E.tmp 856 9CEB.tmp 1308 9D49.tmp 1776 9D97.tmp 1592 9E13.tmp 2208 9E90.tmp 2212 9EFD.tmp 2532 9F5B.tmp 2052 9FC8.tmp 2060 A026.tmp 2952 A093.tmp 1472 A0F1.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 816 wrote to memory of 2968 816 36f707242127a8a3250e760374cb8d4e_mafia_JC.exe 28 PID 816 wrote to memory of 2968 816 36f707242127a8a3250e760374cb8d4e_mafia_JC.exe 28 PID 816 wrote to memory of 2968 816 36f707242127a8a3250e760374cb8d4e_mafia_JC.exe 28 PID 816 wrote to memory of 2968 816 36f707242127a8a3250e760374cb8d4e_mafia_JC.exe 28 PID 2968 wrote to memory of 2620 2968 84D9.tmp 29 PID 2968 wrote to memory of 2620 2968 84D9.tmp 29 PID 2968 wrote to memory of 2620 2968 84D9.tmp 29 PID 2968 wrote to memory of 2620 2968 84D9.tmp 29 PID 2620 wrote to memory of 2552 2620 8594.tmp 31 PID 2620 wrote to memory of 2552 2620 8594.tmp 31 PID 2620 wrote to memory of 2552 2620 8594.tmp 31 PID 2620 wrote to memory of 2552 2620 8594.tmp 31 PID 2552 wrote to memory of 2040 2552 85F2.tmp 30 PID 2552 wrote to memory of 2040 2552 85F2.tmp 30 PID 2552 wrote to memory of 2040 2552 85F2.tmp 30 PID 2552 wrote to memory of 2040 2552 85F2.tmp 30 PID 2040 wrote to memory of 2508 2040 864F.tmp 32 PID 2040 wrote to memory of 2508 2040 864F.tmp 32 PID 2040 wrote to memory of 2508 2040 864F.tmp 32 PID 2040 wrote to memory of 2508 2040 864F.tmp 32 PID 2508 wrote to memory of 2824 2508 86BD.tmp 59 PID 2508 wrote to memory of 2824 2508 86BD.tmp 59 PID 2508 wrote to memory of 2824 2508 86BD.tmp 59 PID 2508 wrote to memory of 2824 2508 86BD.tmp 59 PID 2824 wrote to memory of 2984 2824 871A.tmp 33 PID 2824 wrote to memory of 2984 2824 871A.tmp 33 PID 2824 wrote to memory of 2984 2824 871A.tmp 33 PID 2824 wrote to memory of 2984 2824 871A.tmp 33 PID 2984 wrote to memory of 1464 2984 8797.tmp 34 PID 2984 wrote to memory of 1464 2984 8797.tmp 34 PID 2984 wrote to memory of 1464 2984 8797.tmp 34 PID 2984 wrote to memory of 1464 2984 8797.tmp 34 PID 1464 wrote to memory of 2684 1464 8804.tmp 35 PID 1464 wrote to memory of 2684 1464 8804.tmp 35 PID 1464 wrote to memory of 2684 1464 8804.tmp 35 PID 1464 wrote to memory of 2684 1464 8804.tmp 35 PID 2684 wrote to memory of 2964 2684 8871.tmp 58 PID 2684 wrote to memory of 2964 2684 8871.tmp 58 PID 2684 wrote to memory of 2964 2684 8871.tmp 58 PID 2684 wrote to memory of 2964 2684 8871.tmp 58 PID 2964 wrote to memory of 2780 2964 88CF.tmp 57 PID 2964 wrote to memory of 2780 2964 88CF.tmp 57 PID 2964 wrote to memory of 2780 2964 88CF.tmp 57 PID 2964 wrote to memory of 2780 2964 88CF.tmp 57 PID 2780 wrote to memory of 2792 2780 892D.tmp 56 PID 2780 wrote to memory of 2792 2780 892D.tmp 56 PID 2780 wrote to memory of 2792 2780 892D.tmp 56 PID 2780 wrote to memory of 2792 2780 892D.tmp 56 PID 2792 wrote to memory of 2696 2792 899A.tmp 36 PID 2792 wrote to memory of 2696 2792 899A.tmp 36 PID 2792 wrote to memory of 2696 2792 899A.tmp 36 PID 2792 wrote to memory of 2696 2792 899A.tmp 36 PID 2696 wrote to memory of 2256 2696 89F7.tmp 55 PID 2696 wrote to memory of 2256 2696 89F7.tmp 55 PID 2696 wrote to memory of 2256 2696 89F7.tmp 55 PID 2696 wrote to memory of 2256 2696 89F7.tmp 55 PID 2256 wrote to memory of 2652 2256 8A55.tmp 54 PID 2256 wrote to memory of 2652 2256 8A55.tmp 54 PID 2256 wrote to memory of 2652 2256 8A55.tmp 54 PID 2256 wrote to memory of 2652 2256 8A55.tmp 54 PID 2652 wrote to memory of 2028 2652 8AD2.tmp 53 PID 2652 wrote to memory of 2028 2652 8AD2.tmp 53 PID 2652 wrote to memory of 2028 2652 8AD2.tmp 53 PID 2652 wrote to memory of 2028 2652 8AD2.tmp 53
Processes
-
C:\Users\Admin\AppData\Local\Temp\36f707242127a8a3250e760374cb8d4e_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\36f707242127a8a3250e760374cb8d4e_mafia_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\84D9.tmp"C:\Users\Admin\AppData\Local\Temp\84D9.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\8594.tmp"C:\Users\Admin\AppData\Local\Temp\8594.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\85F2.tmp"C:\Users\Admin\AppData\Local\Temp\85F2.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\864F.tmp"C:\Users\Admin\AppData\Local\Temp\864F.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\86BD.tmp"C:\Users\Admin\AppData\Local\Temp\86BD.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\871A.tmp"C:\Users\Admin\AppData\Local\Temp\871A.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824
-
-
-
C:\Users\Admin\AppData\Local\Temp\8797.tmp"C:\Users\Admin\AppData\Local\Temp\8797.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\8804.tmp"C:\Users\Admin\AppData\Local\Temp\8804.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\8871.tmp"C:\Users\Admin\AppData\Local\Temp\8871.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\88CF.tmp"C:\Users\Admin\AppData\Local\Temp\88CF.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2964
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\89F7.tmp"C:\Users\Admin\AppData\Local\Temp\89F7.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\8A55.tmp"C:\Users\Admin\AppData\Local\Temp\8A55.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2256
-
-
C:\Users\Admin\AppData\Local\Temp\8B9D.tmp"C:\Users\Admin\AppData\Local\Temp\8B9D.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060
-
-
C:\Users\Admin\AppData\Local\Temp\8DCE.tmp"C:\Users\Admin\AppData\Local\Temp\8DCE.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\8E2C.tmp"C:\Users\Admin\AppData\Local\Temp\8E2C.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872
-
-
C:\Users\Admin\AppData\Local\Temp\8EC8.tmp"C:\Users\Admin\AppData\Local\Temp\8EC8.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\8F35.tmp"C:\Users\Admin\AppData\Local\Temp\8F35.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:340
-
-
C:\Users\Admin\AppData\Local\Temp\8F93.tmp"C:\Users\Admin\AppData\Local\Temp\8F93.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\8FF0.tmp"C:\Users\Admin\AppData\Local\Temp\8FF0.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444
-
-
C:\Users\Admin\AppData\Local\Temp\903E.tmp"C:\Users\Admin\AppData\Local\Temp\903E.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\90AB.tmp"C:\Users\Admin\AppData\Local\Temp\90AB.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\9109.tmp"C:\Users\Admin\AppData\Local\Temp\9109.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\91A5.tmp"C:\Users\Admin\AppData\Local\Temp\91A5.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:660 -
C:\Users\Admin\AppData\Local\Temp\927F.tmp"C:\Users\Admin\AppData\Local\Temp\927F.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:780 -
C:\Users\Admin\AppData\Local\Temp\931B.tmp"C:\Users\Admin\AppData\Local\Temp\931B.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:648 -
C:\Users\Admin\AppData\Local\Temp\93B7.tmp"C:\Users\Admin\AppData\Local\Temp\93B7.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:828 -
C:\Users\Admin\AppData\Local\Temp\9425.tmp"C:\Users\Admin\AppData\Local\Temp\9425.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\94D0.tmp"C:\Users\Admin\AppData\Local\Temp\94D0.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\957C.tmp"C:\Users\Admin\AppData\Local\Temp\957C.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\96C3.tmp"C:\Users\Admin\AppData\Local\Temp\96C3.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
PID:664 -
C:\Users\Admin\AppData\Local\Temp\97DC.tmp"C:\Users\Admin\AppData\Local\Temp\97DC.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\9878.tmp"C:\Users\Admin\AppData\Local\Temp\9878.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:748 -
C:\Users\Admin\AppData\Local\Temp\98F5.tmp"C:\Users\Admin\AppData\Local\Temp\98F5.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\9953.tmp"C:\Users\Admin\AppData\Local\Temp\9953.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\99A1.tmp"C:\Users\Admin\AppData\Local\Temp\99A1.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\9A0E.tmp"C:\Users\Admin\AppData\Local\Temp\9A0E.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\9AD9.tmp"C:\Users\Admin\AppData\Local\Temp\9AD9.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:760 -
C:\Users\Admin\AppData\Local\Temp\9C20.tmp"C:\Users\Admin\AppData\Local\Temp\9C20.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\9CEB.tmp"C:\Users\Admin\AppData\Local\Temp\9CEB.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\9D97.tmp"C:\Users\Admin\AppData\Local\Temp\9D97.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\9E13.tmp"C:\Users\Admin\AppData\Local\Temp\9E13.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\9E90.tmp"C:\Users\Admin\AppData\Local\Temp\9E90.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\9EFD.tmp"C:\Users\Admin\AppData\Local\Temp\9EFD.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\9F5B.tmp"C:\Users\Admin\AppData\Local\Temp\9F5B.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\9FC8.tmp"C:\Users\Admin\AppData\Local\Temp\9FC8.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\A026.tmp"C:\Users\Admin\AppData\Local\Temp\A026.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\A093.tmp"C:\Users\Admin\AppData\Local\Temp\A093.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\A0F1.tmp"C:\Users\Admin\AppData\Local\Temp\A0F1.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\A15E.tmp"C:\Users\Admin\AppData\Local\Temp\A15E.tmp"35⤵
- Executes dropped EXE
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\A1BB.tmp"C:\Users\Admin\AppData\Local\Temp\A1BB.tmp"36⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\A238.tmp"C:\Users\Admin\AppData\Local\Temp\A238.tmp"37⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\A296.tmp"C:\Users\Admin\AppData\Local\Temp\A296.tmp"38⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\A303.tmp"C:\Users\Admin\AppData\Local\Temp\A303.tmp"39⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\A361.tmp"C:\Users\Admin\AppData\Local\Temp\A361.tmp"40⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\A3CE.tmp"C:\Users\Admin\AppData\Local\Temp\A3CE.tmp"41⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\A44B.tmp"C:\Users\Admin\AppData\Local\Temp\A44B.tmp"42⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\A4B8.tmp"C:\Users\Admin\AppData\Local\Temp\A4B8.tmp"43⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\A525.tmp"C:\Users\Admin\AppData\Local\Temp\A525.tmp"44⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\A592.tmp"C:\Users\Admin\AppData\Local\Temp\A592.tmp"45⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\A5FF.tmp"C:\Users\Admin\AppData\Local\Temp\A5FF.tmp"46⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\A66D.tmp"C:\Users\Admin\AppData\Local\Temp\A66D.tmp"47⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\A6DA.tmp"C:\Users\Admin\AppData\Local\Temp\A6DA.tmp"48⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\A737.tmp"C:\Users\Admin\AppData\Local\Temp\A737.tmp"49⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\A7C4.tmp"C:\Users\Admin\AppData\Local\Temp\A7C4.tmp"50⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\A831.tmp"C:\Users\Admin\AppData\Local\Temp\A831.tmp"51⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\A89E.tmp"C:\Users\Admin\AppData\Local\Temp\A89E.tmp"52⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\A90B.tmp"C:\Users\Admin\AppData\Local\Temp\A90B.tmp"53⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\A979.tmp"C:\Users\Admin\AppData\Local\Temp\A979.tmp"54⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\A9D6.tmp"C:\Users\Admin\AppData\Local\Temp\A9D6.tmp"55⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\AA53.tmp"C:\Users\Admin\AppData\Local\Temp\AA53.tmp"56⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"57⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\AB1E.tmp"C:\Users\Admin\AppData\Local\Temp\AB1E.tmp"58⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\AC85.tmp"C:\Users\Admin\AppData\Local\Temp\AC85.tmp"59⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\AD11.tmp"C:\Users\Admin\AppData\Local\Temp\AD11.tmp"60⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\ADDC.tmp"C:\Users\Admin\AppData\Local\Temp\ADDC.tmp"61⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\AE39.tmp"C:\Users\Admin\AppData\Local\Temp\AE39.tmp"62⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\AE97.tmp"C:\Users\Admin\AppData\Local\Temp\AE97.tmp"63⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\AF04.tmp"C:\Users\Admin\AppData\Local\Temp\AF04.tmp"64⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\AF71.tmp"C:\Users\Admin\AppData\Local\Temp\AF71.tmp"65⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\AFDF.tmp"C:\Users\Admin\AppData\Local\Temp\AFDF.tmp"66⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\B04C.tmp"C:\Users\Admin\AppData\Local\Temp\B04C.tmp"67⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\B0C9.tmp"C:\Users\Admin\AppData\Local\Temp\B0C9.tmp"68⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\B145.tmp"C:\Users\Admin\AppData\Local\Temp\B145.tmp"69⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\B1B3.tmp"C:\Users\Admin\AppData\Local\Temp\B1B3.tmp"70⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\B22F.tmp"C:\Users\Admin\AppData\Local\Temp\B22F.tmp"71⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\B29D.tmp"C:\Users\Admin\AppData\Local\Temp\B29D.tmp"72⤵PID:660
-
C:\Users\Admin\AppData\Local\Temp\B30A.tmp"C:\Users\Admin\AppData\Local\Temp\B30A.tmp"73⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\B377.tmp"C:\Users\Admin\AppData\Local\Temp\B377.tmp"74⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"75⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\B461.tmp"C:\Users\Admin\AppData\Local\Temp\B461.tmp"76⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\B4AF.tmp"C:\Users\Admin\AppData\Local\Temp\B4AF.tmp"77⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\B52C.tmp"C:\Users\Admin\AppData\Local\Temp\B52C.tmp"78⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\B589.tmp"C:\Users\Admin\AppData\Local\Temp\B589.tmp"79⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\B5E7.tmp"C:\Users\Admin\AppData\Local\Temp\B5E7.tmp"80⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\B645.tmp"C:\Users\Admin\AppData\Local\Temp\B645.tmp"81⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\B6A2.tmp"C:\Users\Admin\AppData\Local\Temp\B6A2.tmp"82⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\B70F.tmp"C:\Users\Admin\AppData\Local\Temp\B70F.tmp"83⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\B76D.tmp"C:\Users\Admin\AppData\Local\Temp\B76D.tmp"84⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\B7EA.tmp"C:\Users\Admin\AppData\Local\Temp\B7EA.tmp"85⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\B857.tmp"C:\Users\Admin\AppData\Local\Temp\B857.tmp"86⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\B8B5.tmp"C:\Users\Admin\AppData\Local\Temp\B8B5.tmp"87⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\B903.tmp"C:\Users\Admin\AppData\Local\Temp\B903.tmp"88⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\B960.tmp"C:\Users\Admin\AppData\Local\Temp\B960.tmp"89⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\B9BE.tmp"C:\Users\Admin\AppData\Local\Temp\B9BE.tmp"90⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\BA2B.tmp"C:\Users\Admin\AppData\Local\Temp\BA2B.tmp"91⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\BA98.tmp"C:\Users\Admin\AppData\Local\Temp\BA98.tmp"92⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\BB15.tmp"C:\Users\Admin\AppData\Local\Temp\BB15.tmp"93⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\BB82.tmp"C:\Users\Admin\AppData\Local\Temp\BB82.tmp"94⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\BBEF.tmp"C:\Users\Admin\AppData\Local\Temp\BBEF.tmp"95⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\BC3D.tmp"C:\Users\Admin\AppData\Local\Temp\BC3D.tmp"96⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\BC9B.tmp"C:\Users\Admin\AppData\Local\Temp\BC9B.tmp"97⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\BD08.tmp"C:\Users\Admin\AppData\Local\Temp\BD08.tmp"98⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\BD95.tmp"C:\Users\Admin\AppData\Local\Temp\BD95.tmp"99⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\BE21.tmp"C:\Users\Admin\AppData\Local\Temp\BE21.tmp"100⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\BE8E.tmp"C:\Users\Admin\AppData\Local\Temp\BE8E.tmp"101⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\BEFB.tmp"C:\Users\Admin\AppData\Local\Temp\BEFB.tmp"102⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\BF69.tmp"C:\Users\Admin\AppData\Local\Temp\BF69.tmp"103⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\BFD6.tmp"C:\Users\Admin\AppData\Local\Temp\BFD6.tmp"104⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"105⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\C0A1.tmp"C:\Users\Admin\AppData\Local\Temp\C0A1.tmp"106⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"107⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"108⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\C255.tmp"C:\Users\Admin\AppData\Local\Temp\C255.tmp"109⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\C2B3.tmp"C:\Users\Admin\AppData\Local\Temp\C2B3.tmp"110⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\C320.tmp"C:\Users\Admin\AppData\Local\Temp\C320.tmp"111⤵PID:272
-
C:\Users\Admin\AppData\Local\Temp\C39D.tmp"C:\Users\Admin\AppData\Local\Temp\C39D.tmp"112⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\C41A.tmp"C:\Users\Admin\AppData\Local\Temp\C41A.tmp"113⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\C497.tmp"C:\Users\Admin\AppData\Local\Temp\C497.tmp"114⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\C504.tmp"C:\Users\Admin\AppData\Local\Temp\C504.tmp"115⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\C590.tmp"C:\Users\Admin\AppData\Local\Temp\C590.tmp"116⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\C5EE.tmp"C:\Users\Admin\AppData\Local\Temp\C5EE.tmp"117⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\C66B.tmp"C:\Users\Admin\AppData\Local\Temp\C66B.tmp"118⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\C6D8.tmp"C:\Users\Admin\AppData\Local\Temp\C6D8.tmp"119⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\C735.tmp"C:\Users\Admin\AppData\Local\Temp\C735.tmp"120⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\C793.tmp"C:\Users\Admin\AppData\Local\Temp\C793.tmp"121⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\C800.tmp"C:\Users\Admin\AppData\Local\Temp\C800.tmp"122⤵PID:2272
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-