Analysis
-
max time kernel
151s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2023, 15:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5d81402416e69f8d4de06988807857fe_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
5d81402416e69f8d4de06988807857fe_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
5d81402416e69f8d4de06988807857fe_mafia_JC.exe
-
Size
487KB
-
MD5
5d81402416e69f8d4de06988807857fe
-
SHA1
25bc6f3ac349daa5df317e7f6615098f9e4ddee5
-
SHA256
57500a688aacca09f9d0ac44428e1477051eb9f32f6d3df5a5b54daceee686c1
-
SHA512
65c237686c17eef373912da8caaf209bc450fe2a772dd550a31f6367359fdcc5df20fd3ee2fdb66f860fe6f58077fe8d3583ac12aefb351ebd132b86f82949f9
-
SSDEEP
12288:yU5rCOTeiNfehIT8eaVqmqwxScs+tzObZ:yUQOJNf2eaXxSz+VOb
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3004 683F.tmp 4676 690A.tmp 3920 69A7.tmp 5084 6A72.tmp 1200 6B4D.tmp 3916 6C18.tmp 824 6CE3.tmp 4092 6D60.tmp 1452 6E2B.tmp 4404 6F35.tmp 668 702F.tmp 5028 70DA.tmp 868 71B5.tmp 1372 7271.tmp 4484 730D.tmp 2040 73C8.tmp 2516 7474.tmp 1108 75DC.tmp 3644 7659.tmp 2204 76F5.tmp 1936 7782.tmp 5000 782D.tmp 4192 7908.tmp 1224 79E3.tmp 3768 7A8F.tmp 2020 7B79.tmp 2152 7C15.tmp 4308 7CA2.tmp 1780 7D5E.tmp 912 7DFA.tmp 2832 7E86.tmp 1840 7F90.tmp 964 805B.tmp 2148 80D8.tmp 3464 8165.tmp 664 81F1.tmp 1580 827E.tmp 4360 831A.tmp 4344 83B7.tmp 3236 8443.tmp 3992 84D0.tmp 1596 857C.tmp 2732 8647.tmp 4548 86E3.tmp 216 8770.tmp 2060 882B.tmp 700 88B8.tmp 4356 8944.tmp 1692 89C1.tmp 2188 8A3E.tmp 4712 8B0A.tmp 4580 8B87.tmp 3004 8BF4.tmp 456 8C90.tmp 1040 8D3C.tmp 212 8DC9.tmp 2780 8E55.tmp 4072 8ED2.tmp 1996 8F4F.tmp 4688 8FCC.tmp 832 9059.tmp 2296 90F5.tmp 4912 91A1.tmp 452 920E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4128 wrote to memory of 3004 4128 5d81402416e69f8d4de06988807857fe_mafia_JC.exe 83 PID 4128 wrote to memory of 3004 4128 5d81402416e69f8d4de06988807857fe_mafia_JC.exe 83 PID 4128 wrote to memory of 3004 4128 5d81402416e69f8d4de06988807857fe_mafia_JC.exe 83 PID 3004 wrote to memory of 4676 3004 683F.tmp 84 PID 3004 wrote to memory of 4676 3004 683F.tmp 84 PID 3004 wrote to memory of 4676 3004 683F.tmp 84 PID 4676 wrote to memory of 3920 4676 690A.tmp 85 PID 4676 wrote to memory of 3920 4676 690A.tmp 85 PID 4676 wrote to memory of 3920 4676 690A.tmp 85 PID 3920 wrote to memory of 5084 3920 69A7.tmp 86 PID 3920 wrote to memory of 5084 3920 69A7.tmp 86 PID 3920 wrote to memory of 5084 3920 69A7.tmp 86 PID 5084 wrote to memory of 1200 5084 6A72.tmp 87 PID 5084 wrote to memory of 1200 5084 6A72.tmp 87 PID 5084 wrote to memory of 1200 5084 6A72.tmp 87 PID 1200 wrote to memory of 3916 1200 6B4D.tmp 88 PID 1200 wrote to memory of 3916 1200 6B4D.tmp 88 PID 1200 wrote to memory of 3916 1200 6B4D.tmp 88 PID 3916 wrote to memory of 824 3916 6C18.tmp 89 PID 3916 wrote to memory of 824 3916 6C18.tmp 89 PID 3916 wrote to memory of 824 3916 6C18.tmp 89 PID 824 wrote to memory of 4092 824 6CE3.tmp 90 PID 824 wrote to memory of 4092 824 6CE3.tmp 90 PID 824 wrote to memory of 4092 824 6CE3.tmp 90 PID 4092 wrote to memory of 1452 4092 6D60.tmp 91 PID 4092 wrote to memory of 1452 4092 6D60.tmp 91 PID 4092 wrote to memory of 1452 4092 6D60.tmp 91 PID 1452 wrote to memory of 4404 1452 6E2B.tmp 93 PID 1452 wrote to memory of 4404 1452 6E2B.tmp 93 PID 1452 wrote to memory of 4404 1452 6E2B.tmp 93 PID 4404 wrote to memory of 668 4404 6F35.tmp 94 PID 4404 wrote to memory of 668 4404 6F35.tmp 94 PID 4404 wrote to memory of 668 4404 6F35.tmp 94 PID 668 wrote to memory of 5028 668 702F.tmp 95 PID 668 wrote to memory of 5028 668 702F.tmp 95 PID 668 wrote to memory of 5028 668 702F.tmp 95 PID 5028 wrote to memory of 868 5028 70DA.tmp 96 PID 5028 wrote to memory of 868 5028 70DA.tmp 96 PID 5028 wrote to memory of 868 5028 70DA.tmp 96 PID 868 wrote to memory of 1372 868 71B5.tmp 97 PID 868 wrote to memory of 1372 868 71B5.tmp 97 PID 868 wrote to memory of 1372 868 71B5.tmp 97 PID 1372 wrote to memory of 4484 1372 7271.tmp 98 PID 1372 wrote to memory of 4484 1372 7271.tmp 98 PID 1372 wrote to memory of 4484 1372 7271.tmp 98 PID 4484 wrote to memory of 2040 4484 730D.tmp 99 PID 4484 wrote to memory of 2040 4484 730D.tmp 99 PID 4484 wrote to memory of 2040 4484 730D.tmp 99 PID 2040 wrote to memory of 2516 2040 73C8.tmp 100 PID 2040 wrote to memory of 2516 2040 73C8.tmp 100 PID 2040 wrote to memory of 2516 2040 73C8.tmp 100 PID 2516 wrote to memory of 1108 2516 7474.tmp 101 PID 2516 wrote to memory of 1108 2516 7474.tmp 101 PID 2516 wrote to memory of 1108 2516 7474.tmp 101 PID 1108 wrote to memory of 3644 1108 75DC.tmp 102 PID 1108 wrote to memory of 3644 1108 75DC.tmp 102 PID 1108 wrote to memory of 3644 1108 75DC.tmp 102 PID 3644 wrote to memory of 2204 3644 7659.tmp 103 PID 3644 wrote to memory of 2204 3644 7659.tmp 103 PID 3644 wrote to memory of 2204 3644 7659.tmp 103 PID 2204 wrote to memory of 1936 2204 76F5.tmp 106 PID 2204 wrote to memory of 1936 2204 76F5.tmp 106 PID 2204 wrote to memory of 1936 2204 76F5.tmp 106 PID 1936 wrote to memory of 5000 1936 7782.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d81402416e69f8d4de06988807857fe_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\5d81402416e69f8d4de06988807857fe_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Users\Admin\AppData\Local\Temp\70DA.tmp"C:\Users\Admin\AppData\Local\Temp\70DA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\71B5.tmp"C:\Users\Admin\AppData\Local\Temp\71B5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\7659.tmp"C:\Users\Admin\AppData\Local\Temp\7659.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\76F5.tmp"C:\Users\Admin\AppData\Local\Temp\76F5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\782D.tmp"C:\Users\Admin\AppData\Local\Temp\782D.tmp"23⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\7908.tmp"C:\Users\Admin\AppData\Local\Temp\7908.tmp"24⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"25⤵
- Executes dropped EXE
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"26⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\7B79.tmp"C:\Users\Admin\AppData\Local\Temp\7B79.tmp"27⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\7C15.tmp"C:\Users\Admin\AppData\Local\Temp\7C15.tmp"28⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"29⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"30⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"31⤵
- Executes dropped EXE
PID:912 -
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"32⤵
- Executes dropped EXE
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\7F90.tmp"C:\Users\Admin\AppData\Local\Temp\7F90.tmp"33⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\805B.tmp"C:\Users\Admin\AppData\Local\Temp\805B.tmp"34⤵
- Executes dropped EXE
PID:964 -
C:\Users\Admin\AppData\Local\Temp\80D8.tmp"C:\Users\Admin\AppData\Local\Temp\80D8.tmp"35⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\8165.tmp"C:\Users\Admin\AppData\Local\Temp\8165.tmp"36⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\81F1.tmp"C:\Users\Admin\AppData\Local\Temp\81F1.tmp"37⤵
- Executes dropped EXE
PID:664 -
C:\Users\Admin\AppData\Local\Temp\827E.tmp"C:\Users\Admin\AppData\Local\Temp\827E.tmp"38⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"39⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\83B7.tmp"C:\Users\Admin\AppData\Local\Temp\83B7.tmp"40⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"41⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\84D0.tmp"C:\Users\Admin\AppData\Local\Temp\84D0.tmp"42⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\857C.tmp"C:\Users\Admin\AppData\Local\Temp\857C.tmp"43⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\8647.tmp"C:\Users\Admin\AppData\Local\Temp\8647.tmp"44⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\86E3.tmp"C:\Users\Admin\AppData\Local\Temp\86E3.tmp"45⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\8770.tmp"C:\Users\Admin\AppData\Local\Temp\8770.tmp"46⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\882B.tmp"C:\Users\Admin\AppData\Local\Temp\882B.tmp"47⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\88B8.tmp"C:\Users\Admin\AppData\Local\Temp\88B8.tmp"48⤵
- Executes dropped EXE
PID:700 -
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"49⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\89C1.tmp"C:\Users\Admin\AppData\Local\Temp\89C1.tmp"50⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"51⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"52⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\8B87.tmp"C:\Users\Admin\AppData\Local\Temp\8B87.tmp"53⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"54⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"55⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"56⤵
- Executes dropped EXE
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"57⤵
- Executes dropped EXE
PID:212 -
C:\Users\Admin\AppData\Local\Temp\8E55.tmp"C:\Users\Admin\AppData\Local\Temp\8E55.tmp"58⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"59⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"60⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"61⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"62⤵
- Executes dropped EXE
PID:832 -
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"63⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"64⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"65⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\929B.tmp"C:\Users\Admin\AppData\Local\Temp\929B.tmp"66⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\9328.tmp"C:\Users\Admin\AppData\Local\Temp\9328.tmp"67⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\93B4.tmp"C:\Users\Admin\AppData\Local\Temp\93B4.tmp"68⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\9451.tmp"C:\Users\Admin\AppData\Local\Temp\9451.tmp"69⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\94CE.tmp"C:\Users\Admin\AppData\Local\Temp\94CE.tmp"70⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"71⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"72⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\9606.tmp"C:\Users\Admin\AppData\Local\Temp\9606.tmp"73⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"74⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"75⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\978D.tmp"C:\Users\Admin\AppData\Local\Temp\978D.tmp"76⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"77⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\9896.tmp"C:\Users\Admin\AppData\Local\Temp\9896.tmp"78⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"79⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"80⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"81⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"82⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"83⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"84⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\9C21.tmp"C:\Users\Admin\AppData\Local\Temp\9C21.tmp"85⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"86⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"87⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"88⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"89⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"90⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"91⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\A028.tmp"C:\Users\Admin\AppData\Local\Temp\A028.tmp"92⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\A095.tmp"C:\Users\Admin\AppData\Local\Temp\A095.tmp"93⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\A103.tmp"C:\Users\Admin\AppData\Local\Temp\A103.tmp"94⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\A180.tmp"C:\Users\Admin\AppData\Local\Temp\A180.tmp"95⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"96⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\A26A.tmp"C:\Users\Admin\AppData\Local\Temp\A26A.tmp"97⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\A306.tmp"C:\Users\Admin\AppData\Local\Temp\A306.tmp"98⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"99⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\A410.tmp"C:\Users\Admin\AppData\Local\Temp\A410.tmp"100⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"101⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\A539.tmp"C:\Users\Admin\AppData\Local\Temp\A539.tmp"102⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"103⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\A642.tmp"C:\Users\Admin\AppData\Local\Temp\A642.tmp"104⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"105⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"106⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"107⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\A884.tmp"C:\Users\Admin\AppData\Local\Temp\A884.tmp"108⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\A911.tmp"C:\Users\Admin\AppData\Local\Temp\A911.tmp"109⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"110⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"111⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"112⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"113⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"114⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"115⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"116⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"117⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"118⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\AE51.tmp"C:\Users\Admin\AppData\Local\Temp\AE51.tmp"119⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"120⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"121⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\B035.tmp"C:\Users\Admin\AppData\Local\Temp\B035.tmp"122⤵PID:1944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-