Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2023, 13:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
41084aa5723ccd8a51b47598ce904989_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
41084aa5723ccd8a51b47598ce904989_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
41084aa5723ccd8a51b47598ce904989_mafia_JC.exe
-
Size
527KB
-
MD5
41084aa5723ccd8a51b47598ce904989
-
SHA1
81485e260c86af70a378d5d6e0d4bf1618c6fdec
-
SHA256
84aff556f9a24fa685749fec3b29219257508a056dff570cad88fccd86b097c7
-
SHA512
4b9f37a62870c6892a23898bacbbac3c7ede9d329595ef508708faaf75c17ca3e037c82df0cc5a1f3e9cd53104dfe42cddf3e975ce827c9280b673d325070b6e
-
SSDEEP
6144:yorf3lPvovsgZnqG2C7mOTeiLRDYdQNjDI4qyU8iSgK+RyNwRXCRcbVDS4HtsH3E:fU5rCOTeidoQ9DIByZiSgKEDS6baDZu
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4700 6978.tmp 3160 6A43.tmp 4352 6B3D.tmp 864 6C37.tmp 3680 6CF2.tmp 2988 6DBE.tmp 4204 6E69.tmp 2276 6F25.tmp 3052 6FD1.tmp 5096 70DA.tmp 2192 7196.tmp 4804 72DE.tmp 400 739A.tmp 4840 7445.tmp 1928 7511.tmp 4380 7639.tmp 2384 76E5.tmp 4568 77D0.tmp 2316 78E9.tmp 2412 79B4.tmp 3004 7A7F.tmp 3792 7B1B.tmp 3540 7BB8.tmp 1272 7C73.tmp 2536 7D0F.tmp 2740 7DAC.tmp 4588 7E96.tmp 4616 7F23.tmp 724 7FDE.tmp 752 80D8.tmp 3448 8155.tmp 548 8220.tmp 1684 82CC.tmp 2224 8378.tmp 3888 8405.tmp 3220 8491.tmp 2748 850E.tmp 3596 858B.tmp 4388 8628.tmp 1096 86A5.tmp 2116 8750.tmp 4936 880C.tmp 4900 8879.tmp 1480 8906.tmp 4832 8983.tmp 2268 8A00.tmp 4376 8AAC.tmp 3048 8B29.tmp 4688 8BB5.tmp 4780 8C32.tmp 696 8CDE.tmp 3648 8D9A.tmp 3500 8E07.tmp 1340 8EB3.tmp 4876 8F5F.tmp 4360 8FCC.tmp 4548 9069.tmp 1616 90D6.tmp 2744 9172.tmp 3080 91FF.tmp 224 927C.tmp 2276 92F9.tmp 4632 9395.tmp 4464 9412.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1340 wrote to memory of 4700 1340 41084aa5723ccd8a51b47598ce904989_mafia_JC.exe 81 PID 1340 wrote to memory of 4700 1340 41084aa5723ccd8a51b47598ce904989_mafia_JC.exe 81 PID 1340 wrote to memory of 4700 1340 41084aa5723ccd8a51b47598ce904989_mafia_JC.exe 81 PID 4700 wrote to memory of 3160 4700 6978.tmp 82 PID 4700 wrote to memory of 3160 4700 6978.tmp 82 PID 4700 wrote to memory of 3160 4700 6978.tmp 82 PID 3160 wrote to memory of 4352 3160 6A43.tmp 83 PID 3160 wrote to memory of 4352 3160 6A43.tmp 83 PID 3160 wrote to memory of 4352 3160 6A43.tmp 83 PID 4352 wrote to memory of 864 4352 6B3D.tmp 84 PID 4352 wrote to memory of 864 4352 6B3D.tmp 84 PID 4352 wrote to memory of 864 4352 6B3D.tmp 84 PID 864 wrote to memory of 3680 864 6C37.tmp 85 PID 864 wrote to memory of 3680 864 6C37.tmp 85 PID 864 wrote to memory of 3680 864 6C37.tmp 85 PID 3680 wrote to memory of 2988 3680 6CF2.tmp 86 PID 3680 wrote to memory of 2988 3680 6CF2.tmp 86 PID 3680 wrote to memory of 2988 3680 6CF2.tmp 86 PID 2988 wrote to memory of 4204 2988 6DBE.tmp 87 PID 2988 wrote to memory of 4204 2988 6DBE.tmp 87 PID 2988 wrote to memory of 4204 2988 6DBE.tmp 87 PID 4204 wrote to memory of 2276 4204 6E69.tmp 88 PID 4204 wrote to memory of 2276 4204 6E69.tmp 88 PID 4204 wrote to memory of 2276 4204 6E69.tmp 88 PID 2276 wrote to memory of 3052 2276 6F25.tmp 89 PID 2276 wrote to memory of 3052 2276 6F25.tmp 89 PID 2276 wrote to memory of 3052 2276 6F25.tmp 89 PID 3052 wrote to memory of 5096 3052 6FD1.tmp 90 PID 3052 wrote to memory of 5096 3052 6FD1.tmp 90 PID 3052 wrote to memory of 5096 3052 6FD1.tmp 90 PID 5096 wrote to memory of 2192 5096 70DA.tmp 91 PID 5096 wrote to memory of 2192 5096 70DA.tmp 91 PID 5096 wrote to memory of 2192 5096 70DA.tmp 91 PID 2192 wrote to memory of 4804 2192 7196.tmp 92 PID 2192 wrote to memory of 4804 2192 7196.tmp 92 PID 2192 wrote to memory of 4804 2192 7196.tmp 92 PID 4804 wrote to memory of 400 4804 72DE.tmp 93 PID 4804 wrote to memory of 400 4804 72DE.tmp 93 PID 4804 wrote to memory of 400 4804 72DE.tmp 93 PID 400 wrote to memory of 4840 400 739A.tmp 94 PID 400 wrote to memory of 4840 400 739A.tmp 94 PID 400 wrote to memory of 4840 400 739A.tmp 94 PID 4840 wrote to memory of 1928 4840 7445.tmp 97 PID 4840 wrote to memory of 1928 4840 7445.tmp 97 PID 4840 wrote to memory of 1928 4840 7445.tmp 97 PID 1928 wrote to memory of 4380 1928 7511.tmp 98 PID 1928 wrote to memory of 4380 1928 7511.tmp 98 PID 1928 wrote to memory of 4380 1928 7511.tmp 98 PID 4380 wrote to memory of 2384 4380 7639.tmp 99 PID 4380 wrote to memory of 2384 4380 7639.tmp 99 PID 4380 wrote to memory of 2384 4380 7639.tmp 99 PID 2384 wrote to memory of 4568 2384 76E5.tmp 100 PID 2384 wrote to memory of 4568 2384 76E5.tmp 100 PID 2384 wrote to memory of 4568 2384 76E5.tmp 100 PID 4568 wrote to memory of 2316 4568 77D0.tmp 101 PID 4568 wrote to memory of 2316 4568 77D0.tmp 101 PID 4568 wrote to memory of 2316 4568 77D0.tmp 101 PID 2316 wrote to memory of 2412 2316 78E9.tmp 103 PID 2316 wrote to memory of 2412 2316 78E9.tmp 103 PID 2316 wrote to memory of 2412 2316 78E9.tmp 103 PID 2412 wrote to memory of 3004 2412 79B4.tmp 104 PID 2412 wrote to memory of 3004 2412 79B4.tmp 104 PID 2412 wrote to memory of 3004 2412 79B4.tmp 104 PID 3004 wrote to memory of 3792 3004 7A7F.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\41084aa5723ccd8a51b47598ce904989_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\41084aa5723ccd8a51b47598ce904989_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\70DA.tmp"C:\Users\Admin\AppData\Local\Temp\70DA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\7445.tmp"C:\Users\Admin\AppData\Local\Temp\7445.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\79B4.tmp"C:\Users\Admin\AppData\Local\Temp\79B4.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"23⤵
- Executes dropped EXE
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"24⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\7C73.tmp"C:\Users\Admin\AppData\Local\Temp\7C73.tmp"25⤵
- Executes dropped EXE
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"26⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"27⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\7E96.tmp"C:\Users\Admin\AppData\Local\Temp\7E96.tmp"28⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\7F23.tmp"C:\Users\Admin\AppData\Local\Temp\7F23.tmp"29⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"30⤵
- Executes dropped EXE
PID:724 -
C:\Users\Admin\AppData\Local\Temp\80D8.tmp"C:\Users\Admin\AppData\Local\Temp\80D8.tmp"31⤵
- Executes dropped EXE
PID:752 -
C:\Users\Admin\AppData\Local\Temp\8155.tmp"C:\Users\Admin\AppData\Local\Temp\8155.tmp"32⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\8220.tmp"C:\Users\Admin\AppData\Local\Temp\8220.tmp"33⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"34⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\8378.tmp"C:\Users\Admin\AppData\Local\Temp\8378.tmp"35⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\8405.tmp"C:\Users\Admin\AppData\Local\Temp\8405.tmp"36⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\8491.tmp"C:\Users\Admin\AppData\Local\Temp\8491.tmp"37⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\850E.tmp"C:\Users\Admin\AppData\Local\Temp\850E.tmp"38⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\858B.tmp"C:\Users\Admin\AppData\Local\Temp\858B.tmp"39⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\8628.tmp"C:\Users\Admin\AppData\Local\Temp\8628.tmp"40⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\86A5.tmp"C:\Users\Admin\AppData\Local\Temp\86A5.tmp"41⤵
- Executes dropped EXE
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\8750.tmp"C:\Users\Admin\AppData\Local\Temp\8750.tmp"42⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\880C.tmp"C:\Users\Admin\AppData\Local\Temp\880C.tmp"43⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\8879.tmp"C:\Users\Admin\AppData\Local\Temp\8879.tmp"44⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\8906.tmp"C:\Users\Admin\AppData\Local\Temp\8906.tmp"45⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\8983.tmp"C:\Users\Admin\AppData\Local\Temp\8983.tmp"46⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\8A00.tmp"C:\Users\Admin\AppData\Local\Temp\8A00.tmp"47⤵
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"48⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\8B29.tmp"C:\Users\Admin\AppData\Local\Temp\8B29.tmp"49⤵
- Executes dropped EXE
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"50⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\8C32.tmp"C:\Users\Admin\AppData\Local\Temp\8C32.tmp"51⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"52⤵
- Executes dropped EXE
PID:696 -
C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"53⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\8E07.tmp"C:\Users\Admin\AppData\Local\Temp\8E07.tmp"54⤵
- Executes dropped EXE
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"55⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"56⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"57⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"58⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"59⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp"60⤵
- Executes dropped EXE
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"61⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\927C.tmp"C:\Users\Admin\AppData\Local\Temp\927C.tmp"62⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\92F9.tmp"C:\Users\Admin\AppData\Local\Temp\92F9.tmp"63⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\9395.tmp"C:\Users\Admin\AppData\Local\Temp\9395.tmp"64⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\9412.tmp"C:\Users\Admin\AppData\Local\Temp\9412.tmp"65⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\94AE.tmp"C:\Users\Admin\AppData\Local\Temp\94AE.tmp"66⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"67⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\95D7.tmp"C:\Users\Admin\AppData\Local\Temp\95D7.tmp"68⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\9664.tmp"C:\Users\Admin\AppData\Local\Temp\9664.tmp"69⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\96E1.tmp"C:\Users\Admin\AppData\Local\Temp\96E1.tmp"70⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"71⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\97EA.tmp"C:\Users\Admin\AppData\Local\Temp\97EA.tmp"72⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"73⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"74⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"75⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"76⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"77⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"78⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"79⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"80⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"81⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"82⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"83⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"84⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"85⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"86⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"87⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\A086.tmp"C:\Users\Admin\AppData\Local\Temp\A086.tmp"88⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"89⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"90⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"91⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"92⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"93⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"94⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"95⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"96⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"97⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"98⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"99⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"100⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\A827.tmp"C:\Users\Admin\AppData\Local\Temp\A827.tmp"101⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"102⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"103⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"104⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"105⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"106⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"107⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"108⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"109⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"110⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\AD57.tmp"C:\Users\Admin\AppData\Local\Temp\AD57.tmp"111⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"112⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\AE60.tmp"C:\Users\Admin\AppData\Local\Temp\AE60.tmp"113⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"114⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"115⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"116⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\B074.tmp"C:\Users\Admin\AppData\Local\Temp\B074.tmp"117⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\B110.tmp"C:\Users\Admin\AppData\Local\Temp\B110.tmp"118⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\B19D.tmp"C:\Users\Admin\AppData\Local\Temp\B19D.tmp"119⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\B229.tmp"C:\Users\Admin\AppData\Local\Temp\B229.tmp"120⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"121⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\B371.tmp"C:\Users\Admin\AppData\Local\Temp\B371.tmp"122⤵PID:4860
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-