Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2023, 16:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
60f6dde8b9523dcf07825826c3b8ef6e_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
60f6dde8b9523dcf07825826c3b8ef6e_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
60f6dde8b9523dcf07825826c3b8ef6e_mafia_JC.exe
-
Size
488KB
-
MD5
60f6dde8b9523dcf07825826c3b8ef6e
-
SHA1
9d2d0604e66096d385fb302080427cc3a478ddc8
-
SHA256
4e03ba8732075d8e5e1dd1b2968975ca3f7a05ba68bc4aaf1d8ecb047b6e334e
-
SHA512
27d6d3d113634e135811cecedb1693a3256566b8470949a1846c2cb65d2a704518dd4e7d98d2b9dffbfdf31fe820802e7ce2420631a42771a66ead9cd30fd98a
-
SSDEEP
12288:/U5rCOTeiDexK9vT7BLv8DkBGQzK+ZNZ:/UQOJDBfB8UzK+ZN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1992 8E65.tmp 1628 8F40.tmp 3100 8FEC.tmp 4648 9097.tmp 2676 9172.tmp 1896 91FF.tmp 4920 92BA.tmp 4484 93C4.tmp 4168 947F.tmp 3740 953B.tmp 5116 95D7.tmp 4596 9693.tmp 4232 971F.tmp 3140 9867.tmp 4292 9913.tmp 2040 99A0.tmp 1932 9A1D.tmp 4724 9AAA.tmp 2216 9B75.tmp 2176 9C30.tmp 4688 9CFB.tmp 1280 9D88.tmp 1536 9E15.tmp 1804 9EB1.tmp 2812 9FAB.tmp 3084 A047.tmp 1996 A122.tmp 1760 A1ED.tmp 5012 A27A.tmp 764 A306.tmp 4716 A3A2.tmp 2364 A45E.tmp 5112 A50A.tmp 4964 A577.tmp 4436 A5E5.tmp 4612 A662.tmp 2816 A6DF.tmp 4204 A78A.tmp 4428 A817.tmp 2164 A8A4.tmp 1912 A901.tmp 5036 A98E.tmp 916 AA0B.tmp 4244 AA98.tmp 2924 AB24.tmp 320 ABD0.tmp 1368 AC4D.tmp 3572 ACBB.tmp 3212 AD38.tmp 1020 ADC4.tmp 440 AE32.tmp 208 AEBE.tmp 4272 AF3B.tmp 5072 AFB8.tmp 1524 B045.tmp 1628 B0C2.tmp 4532 B12F.tmp 2408 B1DB.tmp 3996 B258.tmp 3876 B2E5.tmp 4648 B371.tmp 4472 B3FE.tmp 4336 B46B.tmp 1896 B4F8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2920 wrote to memory of 1992 2920 60f6dde8b9523dcf07825826c3b8ef6e_mafia_JC.exe 81 PID 2920 wrote to memory of 1992 2920 60f6dde8b9523dcf07825826c3b8ef6e_mafia_JC.exe 81 PID 2920 wrote to memory of 1992 2920 60f6dde8b9523dcf07825826c3b8ef6e_mafia_JC.exe 81 PID 1992 wrote to memory of 1628 1992 8E65.tmp 82 PID 1992 wrote to memory of 1628 1992 8E65.tmp 82 PID 1992 wrote to memory of 1628 1992 8E65.tmp 82 PID 1628 wrote to memory of 3100 1628 8F40.tmp 83 PID 1628 wrote to memory of 3100 1628 8F40.tmp 83 PID 1628 wrote to memory of 3100 1628 8F40.tmp 83 PID 3100 wrote to memory of 4648 3100 8FEC.tmp 84 PID 3100 wrote to memory of 4648 3100 8FEC.tmp 84 PID 3100 wrote to memory of 4648 3100 8FEC.tmp 84 PID 4648 wrote to memory of 2676 4648 9097.tmp 85 PID 4648 wrote to memory of 2676 4648 9097.tmp 85 PID 4648 wrote to memory of 2676 4648 9097.tmp 85 PID 2676 wrote to memory of 1896 2676 9172.tmp 86 PID 2676 wrote to memory of 1896 2676 9172.tmp 86 PID 2676 wrote to memory of 1896 2676 9172.tmp 86 PID 1896 wrote to memory of 4920 1896 91FF.tmp 87 PID 1896 wrote to memory of 4920 1896 91FF.tmp 87 PID 1896 wrote to memory of 4920 1896 91FF.tmp 87 PID 4920 wrote to memory of 4484 4920 92BA.tmp 88 PID 4920 wrote to memory of 4484 4920 92BA.tmp 88 PID 4920 wrote to memory of 4484 4920 92BA.tmp 88 PID 4484 wrote to memory of 4168 4484 93C4.tmp 89 PID 4484 wrote to memory of 4168 4484 93C4.tmp 89 PID 4484 wrote to memory of 4168 4484 93C4.tmp 89 PID 4168 wrote to memory of 3740 4168 947F.tmp 91 PID 4168 wrote to memory of 3740 4168 947F.tmp 91 PID 4168 wrote to memory of 3740 4168 947F.tmp 91 PID 3740 wrote to memory of 5116 3740 953B.tmp 92 PID 3740 wrote to memory of 5116 3740 953B.tmp 92 PID 3740 wrote to memory of 5116 3740 953B.tmp 92 PID 5116 wrote to memory of 4596 5116 95D7.tmp 93 PID 5116 wrote to memory of 4596 5116 95D7.tmp 93 PID 5116 wrote to memory of 4596 5116 95D7.tmp 93 PID 4596 wrote to memory of 4232 4596 9693.tmp 94 PID 4596 wrote to memory of 4232 4596 9693.tmp 94 PID 4596 wrote to memory of 4232 4596 9693.tmp 94 PID 4232 wrote to memory of 3140 4232 971F.tmp 95 PID 4232 wrote to memory of 3140 4232 971F.tmp 95 PID 4232 wrote to memory of 3140 4232 971F.tmp 95 PID 3140 wrote to memory of 4292 3140 9867.tmp 96 PID 3140 wrote to memory of 4292 3140 9867.tmp 96 PID 3140 wrote to memory of 4292 3140 9867.tmp 96 PID 4292 wrote to memory of 2040 4292 9913.tmp 97 PID 4292 wrote to memory of 2040 4292 9913.tmp 97 PID 4292 wrote to memory of 2040 4292 9913.tmp 97 PID 2040 wrote to memory of 1932 2040 99A0.tmp 98 PID 2040 wrote to memory of 1932 2040 99A0.tmp 98 PID 2040 wrote to memory of 1932 2040 99A0.tmp 98 PID 1932 wrote to memory of 4724 1932 9A1D.tmp 99 PID 1932 wrote to memory of 4724 1932 9A1D.tmp 99 PID 1932 wrote to memory of 4724 1932 9A1D.tmp 99 PID 4724 wrote to memory of 2216 4724 9AAA.tmp 100 PID 4724 wrote to memory of 2216 4724 9AAA.tmp 100 PID 4724 wrote to memory of 2216 4724 9AAA.tmp 100 PID 2216 wrote to memory of 2176 2216 9B75.tmp 101 PID 2216 wrote to memory of 2176 2216 9B75.tmp 101 PID 2216 wrote to memory of 2176 2216 9B75.tmp 101 PID 2176 wrote to memory of 4688 2176 9C30.tmp 102 PID 2176 wrote to memory of 4688 2176 9C30.tmp 102 PID 2176 wrote to memory of 4688 2176 9C30.tmp 102 PID 4688 wrote to memory of 1280 4688 9CFB.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\60f6dde8b9523dcf07825826c3b8ef6e_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\60f6dde8b9523dcf07825826c3b8ef6e_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\8F40.tmp"C:\Users\Admin\AppData\Local\Temp\8F40.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\9097.tmp"C:\Users\Admin\AppData\Local\Temp\9097.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\947F.tmp"C:\Users\Admin\AppData\Local\Temp\947F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\95D7.tmp"C:\Users\Admin\AppData\Local\Temp\95D7.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\9693.tmp"C:\Users\Admin\AppData\Local\Temp\9693.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\9867.tmp"C:\Users\Admin\AppData\Local\Temp\9867.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\99A0.tmp"C:\Users\Admin\AppData\Local\Temp\99A0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"23⤵
- Executes dropped EXE
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\9E15.tmp"C:\Users\Admin\AppData\Local\Temp\9E15.tmp"24⤵
- Executes dropped EXE
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"25⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"26⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\A047.tmp"C:\Users\Admin\AppData\Local\Temp\A047.tmp"27⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"28⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"29⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"30⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\A306.tmp"C:\Users\Admin\AppData\Local\Temp\A306.tmp"31⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"32⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"33⤵
- Executes dropped EXE
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\A50A.tmp"C:\Users\Admin\AppData\Local\Temp\A50A.tmp"34⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\A577.tmp"C:\Users\Admin\AppData\Local\Temp\A577.tmp"35⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"36⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\A662.tmp"C:\Users\Admin\AppData\Local\Temp\A662.tmp"37⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"38⤵
- Executes dropped EXE
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\A78A.tmp"C:\Users\Admin\AppData\Local\Temp\A78A.tmp"39⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\A817.tmp"C:\Users\Admin\AppData\Local\Temp\A817.tmp"40⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"41⤵
- Executes dropped EXE
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"42⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"43⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"44⤵
- Executes dropped EXE
PID:916 -
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"45⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"46⤵
- Executes dropped EXE
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"47⤵
- Executes dropped EXE
PID:320 -
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"48⤵
- Executes dropped EXE
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"49⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\AD38.tmp"C:\Users\Admin\AppData\Local\Temp\AD38.tmp"50⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"51⤵
- Executes dropped EXE
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"52⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"53⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"54⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"55⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\B045.tmp"C:\Users\Admin\AppData\Local\Temp\B045.tmp"56⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"57⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\B12F.tmp"C:\Users\Admin\AppData\Local\Temp\B12F.tmp"58⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"59⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\B258.tmp"C:\Users\Admin\AppData\Local\Temp\B258.tmp"60⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"61⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\B371.tmp"C:\Users\Admin\AppData\Local\Temp\B371.tmp"62⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"63⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\B46B.tmp"C:\Users\Admin\AppData\Local\Temp\B46B.tmp"64⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"65⤵
- Executes dropped EXE
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\B594.tmp"C:\Users\Admin\AppData\Local\Temp\B594.tmp"66⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\B611.tmp"C:\Users\Admin\AppData\Local\Temp\B611.tmp"67⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"68⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\B73A.tmp"C:\Users\Admin\AppData\Local\Temp\B73A.tmp"69⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"70⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\B844.tmp"C:\Users\Admin\AppData\Local\Temp\B844.tmp"71⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"72⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\B93E.tmp"C:\Users\Admin\AppData\Local\Temp\B93E.tmp"73⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"74⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\BA47.tmp"C:\Users\Admin\AppData\Local\Temp\BA47.tmp"75⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"76⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\BB32.tmp"C:\Users\Admin\AppData\Local\Temp\BB32.tmp"77⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"78⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"79⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"80⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"81⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\BD35.tmp"C:\Users\Admin\AppData\Local\Temp\BD35.tmp"82⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"83⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"84⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"85⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\BF68.tmp"C:\Users\Admin\AppData\Local\Temp\BF68.tmp"86⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"87⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\C091.tmp"C:\Users\Admin\AppData\Local\Temp\C091.tmp"88⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"89⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\C18B.tmp"C:\Users\Admin\AppData\Local\Temp\C18B.tmp"90⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\C208.tmp"C:\Users\Admin\AppData\Local\Temp\C208.tmp"91⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\C275.tmp"C:\Users\Admin\AppData\Local\Temp\C275.tmp"92⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"93⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\C35F.tmp"C:\Users\Admin\AppData\Local\Temp\C35F.tmp"94⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\C42B.tmp"C:\Users\Admin\AppData\Local\Temp\C42B.tmp"95⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"96⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\C525.tmp"C:\Users\Admin\AppData\Local\Temp\C525.tmp"97⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"98⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\C60F.tmp"C:\Users\Admin\AppData\Local\Temp\C60F.tmp"99⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\C68C.tmp"C:\Users\Admin\AppData\Local\Temp\C68C.tmp"100⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\C719.tmp"C:\Users\Admin\AppData\Local\Temp\C719.tmp"101⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\C786.tmp"C:\Users\Admin\AppData\Local\Temp\C786.tmp"102⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\C813.tmp"C:\Users\Admin\AppData\Local\Temp\C813.tmp"103⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\C890.tmp"C:\Users\Admin\AppData\Local\Temp\C890.tmp"104⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\C91C.tmp"C:\Users\Admin\AppData\Local\Temp\C91C.tmp"105⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\C999.tmp"C:\Users\Admin\AppData\Local\Temp\C999.tmp"106⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\CA26.tmp"C:\Users\Admin\AppData\Local\Temp\CA26.tmp"107⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"108⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\CB20.tmp"C:\Users\Admin\AppData\Local\Temp\CB20.tmp"109⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"110⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"111⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\CC78.tmp"C:\Users\Admin\AppData\Local\Temp\CC78.tmp"112⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\CCE5.tmp"C:\Users\Admin\AppData\Local\Temp\CCE5.tmp"113⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\CD72.tmp"C:\Users\Admin\AppData\Local\Temp\CD72.tmp"114⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\CDEF.tmp"C:\Users\Admin\AppData\Local\Temp\CDEF.tmp"115⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"116⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\CF17.tmp"C:\Users\Admin\AppData\Local\Temp\CF17.tmp"117⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"118⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\D040.tmp"C:\Users\Admin\AppData\Local\Temp\D040.tmp"119⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\D0DD.tmp"C:\Users\Admin\AppData\Local\Temp\D0DD.tmp"120⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\D179.tmp"C:\Users\Admin\AppData\Local\Temp\D179.tmp"121⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\D1F6.tmp"C:\Users\Admin\AppData\Local\Temp\D1F6.tmp"122⤵PID:3004
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-