Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
19-08-2023 13:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
41dc07411f0ba159293a3d30f41e5618_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
41dc07411f0ba159293a3d30f41e5618_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
41dc07411f0ba159293a3d30f41e5618_mafia_JC.exe
-
Size
486KB
-
MD5
41dc07411f0ba159293a3d30f41e5618
-
SHA1
ca87859a74959802d9ce9e60fbcaa6d2857e58df
-
SHA256
09ec95ea8b22f3ba4d697f748fe511ac5f7fd64cca32d848d40576b6abcd16ec
-
SHA512
a46b0e034cbe4dac41b091ed84558b7c368a608bc171b57ba265c6a072aa7d24adb41852692483b8c551b7159f35e8d4035829f31d4379ba6781c4595fde3fec
-
SSDEEP
6144:Borf3lPvovsgZnqG2C7mOTeiLfD7cfRdZkju4nfH9uhPo5vgLMMXTYAHsH3dZ:oU5rCOTeiDcfRPHsfduhoZgLMCTpMNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3216 614A.tmp 1088 61F6.tmp 4772 62C1.tmp 4776 635D.tmp 396 6428.tmp 4720 6522.tmp 112 65CE.tmp 2760 665B.tmp 1632 66F7.tmp 1292 67A3.tmp 876 685F.tmp 5048 68DC.tmp 3192 6997.tmp 4656 6BAA.tmp 3940 6C47.tmp 3644 6D12.tmp 3756 6DCD.tmp 1696 6EC7.tmp 392 7000.tmp 2468 70CB.tmp 1820 7167.tmp 2412 71E4.tmp 1708 72A0.tmp 1516 734B.tmp 4440 7417.tmp 4476 74C2.tmp 3064 75DC.tmp 4340 7668.tmp 3800 7724.tmp 952 780E.tmp 2824 789B.tmp 1648 7956.tmp 4968 79E3.tmp 3108 7A7F.tmp 4028 7B0C.tmp 3088 7BA8.tmp 3012 7C25.tmp 4716 7CC1.tmp 4316 7D3E.tmp 2136 7DEA.tmp 4948 7E77.tmp 3256 7F23.tmp 2512 7FAF.tmp 4880 805B.tmp 3068 80C9.tmp 1652 8155.tmp 4748 81D2.tmp 1660 826E.tmp 3640 82FB.tmp 4744 83D6.tmp 4248 8453.tmp 2192 84C0.tmp 400 854D.tmp 4800 85CA.tmp 5108 8666.tmp 4704 86D3.tmp 1088 8760.tmp 2516 87ED.tmp 4240 8879.tmp 4760 8906.tmp 2188 8983.tmp 4596 89F0.tmp 3696 8AAC.tmp 3976 8B38.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 484 wrote to memory of 3216 484 41dc07411f0ba159293a3d30f41e5618_mafia_JC.exe 81 PID 484 wrote to memory of 3216 484 41dc07411f0ba159293a3d30f41e5618_mafia_JC.exe 81 PID 484 wrote to memory of 3216 484 41dc07411f0ba159293a3d30f41e5618_mafia_JC.exe 81 PID 3216 wrote to memory of 1088 3216 614A.tmp 82 PID 3216 wrote to memory of 1088 3216 614A.tmp 82 PID 3216 wrote to memory of 1088 3216 614A.tmp 82 PID 1088 wrote to memory of 4772 1088 61F6.tmp 83 PID 1088 wrote to memory of 4772 1088 61F6.tmp 83 PID 1088 wrote to memory of 4772 1088 61F6.tmp 83 PID 4772 wrote to memory of 4776 4772 62C1.tmp 84 PID 4772 wrote to memory of 4776 4772 62C1.tmp 84 PID 4772 wrote to memory of 4776 4772 62C1.tmp 84 PID 4776 wrote to memory of 396 4776 635D.tmp 85 PID 4776 wrote to memory of 396 4776 635D.tmp 85 PID 4776 wrote to memory of 396 4776 635D.tmp 85 PID 396 wrote to memory of 4720 396 6428.tmp 86 PID 396 wrote to memory of 4720 396 6428.tmp 86 PID 396 wrote to memory of 4720 396 6428.tmp 86 PID 4720 wrote to memory of 112 4720 6522.tmp 87 PID 4720 wrote to memory of 112 4720 6522.tmp 87 PID 4720 wrote to memory of 112 4720 6522.tmp 87 PID 112 wrote to memory of 2760 112 65CE.tmp 88 PID 112 wrote to memory of 2760 112 65CE.tmp 88 PID 112 wrote to memory of 2760 112 65CE.tmp 88 PID 2760 wrote to memory of 1632 2760 665B.tmp 89 PID 2760 wrote to memory of 1632 2760 665B.tmp 89 PID 2760 wrote to memory of 1632 2760 665B.tmp 89 PID 1632 wrote to memory of 1292 1632 66F7.tmp 90 PID 1632 wrote to memory of 1292 1632 66F7.tmp 90 PID 1632 wrote to memory of 1292 1632 66F7.tmp 90 PID 1292 wrote to memory of 876 1292 67A3.tmp 91 PID 1292 wrote to memory of 876 1292 67A3.tmp 91 PID 1292 wrote to memory of 876 1292 67A3.tmp 91 PID 876 wrote to memory of 5048 876 685F.tmp 92 PID 876 wrote to memory of 5048 876 685F.tmp 92 PID 876 wrote to memory of 5048 876 685F.tmp 92 PID 5048 wrote to memory of 3192 5048 68DC.tmp 93 PID 5048 wrote to memory of 3192 5048 68DC.tmp 93 PID 5048 wrote to memory of 3192 5048 68DC.tmp 93 PID 3192 wrote to memory of 4656 3192 6997.tmp 94 PID 3192 wrote to memory of 4656 3192 6997.tmp 94 PID 3192 wrote to memory of 4656 3192 6997.tmp 94 PID 4656 wrote to memory of 3940 4656 6BAA.tmp 95 PID 4656 wrote to memory of 3940 4656 6BAA.tmp 95 PID 4656 wrote to memory of 3940 4656 6BAA.tmp 95 PID 3940 wrote to memory of 3644 3940 6C47.tmp 98 PID 3940 wrote to memory of 3644 3940 6C47.tmp 98 PID 3940 wrote to memory of 3644 3940 6C47.tmp 98 PID 3644 wrote to memory of 3756 3644 6D12.tmp 99 PID 3644 wrote to memory of 3756 3644 6D12.tmp 99 PID 3644 wrote to memory of 3756 3644 6D12.tmp 99 PID 3756 wrote to memory of 1696 3756 6DCD.tmp 100 PID 3756 wrote to memory of 1696 3756 6DCD.tmp 100 PID 3756 wrote to memory of 1696 3756 6DCD.tmp 100 PID 1696 wrote to memory of 392 1696 6EC7.tmp 101 PID 1696 wrote to memory of 392 1696 6EC7.tmp 101 PID 1696 wrote to memory of 392 1696 6EC7.tmp 101 PID 392 wrote to memory of 2468 392 7000.tmp 102 PID 392 wrote to memory of 2468 392 7000.tmp 102 PID 392 wrote to memory of 2468 392 7000.tmp 102 PID 2468 wrote to memory of 1820 2468 70CB.tmp 104 PID 2468 wrote to memory of 1820 2468 70CB.tmp 104 PID 2468 wrote to memory of 1820 2468 70CB.tmp 104 PID 1820 wrote to memory of 2412 1820 7167.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\41dc07411f0ba159293a3d30f41e5618_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\41dc07411f0ba159293a3d30f41e5618_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"23⤵
- Executes dropped EXE
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\72A0.tmp"C:\Users\Admin\AppData\Local\Temp\72A0.tmp"24⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"25⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"26⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\74C2.tmp"C:\Users\Admin\AppData\Local\Temp\74C2.tmp"27⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"28⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"29⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\7724.tmp"C:\Users\Admin\AppData\Local\Temp\7724.tmp"30⤵
- Executes dropped EXE
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\780E.tmp"C:\Users\Admin\AppData\Local\Temp\780E.tmp"31⤵
- Executes dropped EXE
PID:952 -
C:\Users\Admin\AppData\Local\Temp\789B.tmp"C:\Users\Admin\AppData\Local\Temp\789B.tmp"32⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\7956.tmp"C:\Users\Admin\AppData\Local\Temp\7956.tmp"33⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"34⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"35⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"36⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"37⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"38⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"39⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"40⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"41⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\7E77.tmp"C:\Users\Admin\AppData\Local\Temp\7E77.tmp"42⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\7F23.tmp"C:\Users\Admin\AppData\Local\Temp\7F23.tmp"43⤵
- Executes dropped EXE
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"44⤵
- Executes dropped EXE
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\805B.tmp"C:\Users\Admin\AppData\Local\Temp\805B.tmp"45⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\80C9.tmp"C:\Users\Admin\AppData\Local\Temp\80C9.tmp"46⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\8155.tmp"C:\Users\Admin\AppData\Local\Temp\8155.tmp"47⤵
- Executes dropped EXE
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\81D2.tmp"C:\Users\Admin\AppData\Local\Temp\81D2.tmp"48⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"49⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\82FB.tmp"C:\Users\Admin\AppData\Local\Temp\82FB.tmp"50⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\83D6.tmp"C:\Users\Admin\AppData\Local\Temp\83D6.tmp"51⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\8453.tmp"C:\Users\Admin\AppData\Local\Temp\8453.tmp"52⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\84C0.tmp"C:\Users\Admin\AppData\Local\Temp\84C0.tmp"53⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\854D.tmp"C:\Users\Admin\AppData\Local\Temp\854D.tmp"54⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\85CA.tmp"C:\Users\Admin\AppData\Local\Temp\85CA.tmp"55⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\8666.tmp"C:\Users\Admin\AppData\Local\Temp\8666.tmp"56⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\86D3.tmp"C:\Users\Admin\AppData\Local\Temp\86D3.tmp"57⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\8760.tmp"C:\Users\Admin\AppData\Local\Temp\8760.tmp"58⤵
- Executes dropped EXE
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"59⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\8879.tmp"C:\Users\Admin\AppData\Local\Temp\8879.tmp"60⤵
- Executes dropped EXE
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\8906.tmp"C:\Users\Admin\AppData\Local\Temp\8906.tmp"61⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\8983.tmp"C:\Users\Admin\AppData\Local\Temp\8983.tmp"62⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\89F0.tmp"C:\Users\Admin\AppData\Local\Temp\89F0.tmp"63⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"64⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\8B38.tmp"C:\Users\Admin\AppData\Local\Temp\8B38.tmp"65⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"66⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"67⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"68⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"69⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp"70⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"71⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"72⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\902A.tmp"C:\Users\Admin\AppData\Local\Temp\902A.tmp"73⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\90B7.tmp"C:\Users\Admin\AppData\Local\Temp\90B7.tmp"74⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"75⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\9191.tmp"C:\Users\Admin\AppData\Local\Temp\9191.tmp"76⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"77⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"78⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"79⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"80⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\9460.tmp"C:\Users\Admin\AppData\Local\Temp\9460.tmp"81⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\950C.tmp"C:\Users\Admin\AppData\Local\Temp\950C.tmp"82⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"83⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\9625.tmp"C:\Users\Admin\AppData\Local\Temp\9625.tmp"84⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\9693.tmp"C:\Users\Admin\AppData\Local\Temp\9693.tmp"85⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\9700.tmp"C:\Users\Admin\AppData\Local\Temp\9700.tmp"86⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"87⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"88⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\98C5.tmp"C:\Users\Admin\AppData\Local\Temp\98C5.tmp"89⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\9942.tmp"C:\Users\Admin\AppData\Local\Temp\9942.tmp"90⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"91⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"92⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"93⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"94⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"95⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"96⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"97⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"98⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"99⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"100⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"101⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\A047.tmp"C:\Users\Admin\AppData\Local\Temp\A047.tmp"102⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"103⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"104⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\A20C.tmp"C:\Users\Admin\AppData\Local\Temp\A20C.tmp"105⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"106⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"107⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"108⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\A410.tmp"C:\Users\Admin\AppData\Local\Temp\A410.tmp"109⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"110⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"111⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"112⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"113⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\A73C.tmp"C:\Users\Admin\AppData\Local\Temp\A73C.tmp"114⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"115⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"116⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\A911.tmp"C:\Users\Admin\AppData\Local\Temp\A911.tmp"117⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\A99E.tmp"C:\Users\Admin\AppData\Local\Temp\A99E.tmp"118⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"119⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\AA88.tmp"C:\Users\Admin\AppData\Local\Temp\AA88.tmp"120⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\AB05.tmp"C:\Users\Admin\AppData\Local\Temp\AB05.tmp"121⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\AB82.tmp"C:\Users\Admin\AppData\Local\Temp\AB82.tmp"122⤵PID:2188
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-