Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2023, 16:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6149da7379ebaa828eef846c82e64af8_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
6149da7379ebaa828eef846c82e64af8_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
6149da7379ebaa828eef846c82e64af8_mafia_JC.exe
-
Size
486KB
-
MD5
6149da7379ebaa828eef846c82e64af8
-
SHA1
b069c4d2c02d334e52c27d026c0a7d141b103744
-
SHA256
d38f92211a6c41975d5a7a655650b5f692ccad559df51dd1b19273f516142abc
-
SHA512
f89ef4508b141e54b2a7521851f2c6fd78a10afc8288297a3f8de4322ca8385f83f87157d22258becf40f4fc5fcb4783babae356692fc39d31aec0a97a15b779
-
SSDEEP
12288:/U5rCOTeiDKkQQGkeLk4ezMg6fGT+P9WruFNZ:/UQOJDKIGkMk4eD6W+P9BN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2252 82BD.tmp 3968 83A7.tmp 2040 8462.tmp 2492 851E.tmp 3516 85E9.tmp 5048 86B4.tmp 1660 877F.tmp 4932 8879.tmp 3340 8973.tmp 3716 8A4E.tmp 3352 8B29.tmp 1940 8BE4.tmp 3612 8C81.tmp 4736 8D1D.tmp 2000 8DC9.tmp 4264 8EA3.tmp 1208 8F5F.tmp 2668 9049.tmp 724 9114.tmp 4332 91D0.tmp 992 92AB.tmp 1980 97AC.tmp 4976 9858.tmp 2272 9913.tmp 4828 9990.tmp 1520 9A3C.tmp 4660 9B17.tmp 2244 9BA4.tmp 852 9C5F.tmp 1776 9D1B.tmp 1060 9DD6.tmp 3272 9E53.tmp 3812 9F1E.tmp 4448 9F8C.tmp 1540 9FF9.tmp 2836 A086.tmp 3800 A122.tmp 3988 A1CE.tmp 3244 A25A.tmp 4844 A2F7.tmp 4112 A3A2.tmp 3644 A43F.tmp 4656 A4CB.tmp 4368 A568.tmp 3440 A613.tmp 4692 A6A0.tmp 4432 A72D.tmp 1640 A78A.tmp 4476 A807.tmp 3872 A894.tmp 2492 A911.tmp 4152 A98E.tmp 3752 AA0B.tmp 1668 AA88.tmp 5004 AB24.tmp 4428 ABB1.tmp 4268 AC1E.tmp 3332 ACBB.tmp 4184 AD38.tmp 2088 ADA5.tmp 4540 AE22.tmp 2472 AEAF.tmp 1388 AF3B.tmp 2128 AFA9.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4424 wrote to memory of 2252 4424 6149da7379ebaa828eef846c82e64af8_mafia_JC.exe 82 PID 4424 wrote to memory of 2252 4424 6149da7379ebaa828eef846c82e64af8_mafia_JC.exe 82 PID 4424 wrote to memory of 2252 4424 6149da7379ebaa828eef846c82e64af8_mafia_JC.exe 82 PID 2252 wrote to memory of 3968 2252 82BD.tmp 83 PID 2252 wrote to memory of 3968 2252 82BD.tmp 83 PID 2252 wrote to memory of 3968 2252 82BD.tmp 83 PID 3968 wrote to memory of 2040 3968 83A7.tmp 84 PID 3968 wrote to memory of 2040 3968 83A7.tmp 84 PID 3968 wrote to memory of 2040 3968 83A7.tmp 84 PID 2040 wrote to memory of 2492 2040 8462.tmp 85 PID 2040 wrote to memory of 2492 2040 8462.tmp 85 PID 2040 wrote to memory of 2492 2040 8462.tmp 85 PID 2492 wrote to memory of 3516 2492 851E.tmp 86 PID 2492 wrote to memory of 3516 2492 851E.tmp 86 PID 2492 wrote to memory of 3516 2492 851E.tmp 86 PID 3516 wrote to memory of 5048 3516 85E9.tmp 87 PID 3516 wrote to memory of 5048 3516 85E9.tmp 87 PID 3516 wrote to memory of 5048 3516 85E9.tmp 87 PID 5048 wrote to memory of 1660 5048 86B4.tmp 88 PID 5048 wrote to memory of 1660 5048 86B4.tmp 88 PID 5048 wrote to memory of 1660 5048 86B4.tmp 88 PID 1660 wrote to memory of 4932 1660 877F.tmp 89 PID 1660 wrote to memory of 4932 1660 877F.tmp 89 PID 1660 wrote to memory of 4932 1660 877F.tmp 89 PID 4932 wrote to memory of 3340 4932 8879.tmp 90 PID 4932 wrote to memory of 3340 4932 8879.tmp 90 PID 4932 wrote to memory of 3340 4932 8879.tmp 90 PID 3340 wrote to memory of 3716 3340 8973.tmp 91 PID 3340 wrote to memory of 3716 3340 8973.tmp 91 PID 3340 wrote to memory of 3716 3340 8973.tmp 91 PID 3716 wrote to memory of 3352 3716 8A4E.tmp 92 PID 3716 wrote to memory of 3352 3716 8A4E.tmp 92 PID 3716 wrote to memory of 3352 3716 8A4E.tmp 92 PID 3352 wrote to memory of 1940 3352 8B29.tmp 93 PID 3352 wrote to memory of 1940 3352 8B29.tmp 93 PID 3352 wrote to memory of 1940 3352 8B29.tmp 93 PID 1940 wrote to memory of 3612 1940 8BE4.tmp 94 PID 1940 wrote to memory of 3612 1940 8BE4.tmp 94 PID 1940 wrote to memory of 3612 1940 8BE4.tmp 94 PID 3612 wrote to memory of 4736 3612 8C81.tmp 95 PID 3612 wrote to memory of 4736 3612 8C81.tmp 95 PID 3612 wrote to memory of 4736 3612 8C81.tmp 95 PID 4736 wrote to memory of 2000 4736 8D1D.tmp 96 PID 4736 wrote to memory of 2000 4736 8D1D.tmp 96 PID 4736 wrote to memory of 2000 4736 8D1D.tmp 96 PID 2000 wrote to memory of 4264 2000 8DC9.tmp 97 PID 2000 wrote to memory of 4264 2000 8DC9.tmp 97 PID 2000 wrote to memory of 4264 2000 8DC9.tmp 97 PID 4264 wrote to memory of 1208 4264 8EA3.tmp 100 PID 4264 wrote to memory of 1208 4264 8EA3.tmp 100 PID 4264 wrote to memory of 1208 4264 8EA3.tmp 100 PID 1208 wrote to memory of 2668 1208 8F5F.tmp 101 PID 1208 wrote to memory of 2668 1208 8F5F.tmp 101 PID 1208 wrote to memory of 2668 1208 8F5F.tmp 101 PID 2668 wrote to memory of 724 2668 9049.tmp 102 PID 2668 wrote to memory of 724 2668 9049.tmp 102 PID 2668 wrote to memory of 724 2668 9049.tmp 102 PID 724 wrote to memory of 4332 724 9114.tmp 103 PID 724 wrote to memory of 4332 724 9114.tmp 103 PID 724 wrote to memory of 4332 724 9114.tmp 103 PID 4332 wrote to memory of 992 4332 91D0.tmp 104 PID 4332 wrote to memory of 992 4332 91D0.tmp 104 PID 4332 wrote to memory of 992 4332 91D0.tmp 104 PID 992 wrote to memory of 1980 992 92AB.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\6149da7379ebaa828eef846c82e64af8_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\6149da7379ebaa828eef846c82e64af8_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\82BD.tmp"C:\Users\Admin\AppData\Local\Temp\82BD.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\83A7.tmp"C:\Users\Admin\AppData\Local\Temp\83A7.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\8462.tmp"C:\Users\Admin\AppData\Local\Temp\8462.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\851E.tmp"C:\Users\Admin\AppData\Local\Temp\851E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\877F.tmp"C:\Users\Admin\AppData\Local\Temp\877F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\8879.tmp"C:\Users\Admin\AppData\Local\Temp\8879.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\8973.tmp"C:\Users\Admin\AppData\Local\Temp\8973.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\8B29.tmp"C:\Users\Admin\AppData\Local\Temp\8B29.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\8C81.tmp"C:\Users\Admin\AppData\Local\Temp\8C81.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\9049.tmp"C:\Users\Admin\AppData\Local\Temp\9049.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\9114.tmp"C:\Users\Admin\AppData\Local\Temp\9114.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Users\Admin\AppData\Local\Temp\91D0.tmp"C:\Users\Admin\AppData\Local\Temp\91D0.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\92AB.tmp"C:\Users\Admin\AppData\Local\Temp\92AB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"23⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"24⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"25⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"26⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"27⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"28⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"29⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"30⤵
- Executes dropped EXE
PID:852 -
C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"31⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"32⤵
- Executes dropped EXE
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\9E53.tmp"C:\Users\Admin\AppData\Local\Temp\9E53.tmp"33⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"34⤵
- Executes dropped EXE
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"35⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"36⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\A086.tmp"C:\Users\Admin\AppData\Local\Temp\A086.tmp"37⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"38⤵
- Executes dropped EXE
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"39⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"40⤵
- Executes dropped EXE
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"41⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"42⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\A43F.tmp"C:\Users\Admin\AppData\Local\Temp\A43F.tmp"43⤵
- Executes dropped EXE
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"44⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"45⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\A613.tmp"C:\Users\Admin\AppData\Local\Temp\A613.tmp"46⤵
- Executes dropped EXE
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"47⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"48⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\A78A.tmp"C:\Users\Admin\AppData\Local\Temp\A78A.tmp"49⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"50⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\A894.tmp"C:\Users\Admin\AppData\Local\Temp\A894.tmp"51⤵
- Executes dropped EXE
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\A911.tmp"C:\Users\Admin\AppData\Local\Temp\A911.tmp"52⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"53⤵
- Executes dropped EXE
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"54⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\AA88.tmp"C:\Users\Admin\AppData\Local\Temp\AA88.tmp"55⤵
- Executes dropped EXE
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"56⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"57⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"58⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"59⤵
- Executes dropped EXE
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\AD38.tmp"C:\Users\Admin\AppData\Local\Temp\AD38.tmp"60⤵
- Executes dropped EXE
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"61⤵
- Executes dropped EXE
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"62⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"63⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"64⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"65⤵
- Executes dropped EXE
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\B016.tmp"C:\Users\Admin\AppData\Local\Temp\B016.tmp"66⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\B093.tmp"C:\Users\Admin\AppData\Local\Temp\B093.tmp"67⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\B100.tmp"C:\Users\Admin\AppData\Local\Temp\B100.tmp"68⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"69⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\B20A.tmp"C:\Users\Admin\AppData\Local\Temp\B20A.tmp"70⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"71⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"72⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"73⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\B43C.tmp"C:\Users\Admin\AppData\Local\Temp\B43C.tmp"74⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"75⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"76⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"77⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"78⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"79⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\B74A.tmp"C:\Users\Admin\AppData\Local\Temp\B74A.tmp"80⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"81⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\B853.tmp"C:\Users\Admin\AppData\Local\Temp\B853.tmp"82⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"83⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\B96D.tmp"C:\Users\Admin\AppData\Local\Temp\B96D.tmp"84⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"85⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\BA47.tmp"C:\Users\Admin\AppData\Local\Temp\BA47.tmp"86⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"87⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\BB61.tmp"C:\Users\Admin\AppData\Local\Temp\BB61.tmp"88⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"89⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"90⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"91⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\BD16.tmp"C:\Users\Admin\AppData\Local\Temp\BD16.tmp"92⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"93⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\BE10.tmp"C:\Users\Admin\AppData\Local\Temp\BE10.tmp"94⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"95⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"96⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\BF87.tmp"C:\Users\Admin\AppData\Local\Temp\BF87.tmp"97⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"98⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"99⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"100⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\C17B.tmp"C:\Users\Admin\AppData\Local\Temp\C17B.tmp"101⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"102⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\C285.tmp"C:\Users\Admin\AppData\Local\Temp\C285.tmp"103⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\C311.tmp"C:\Users\Admin\AppData\Local\Temp\C311.tmp"104⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\C39E.tmp"C:\Users\Admin\AppData\Local\Temp\C39E.tmp"105⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\C40B.tmp"C:\Users\Admin\AppData\Local\Temp\C40B.tmp"106⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\C498.tmp"C:\Users\Admin\AppData\Local\Temp\C498.tmp"107⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\C525.tmp"C:\Users\Admin\AppData\Local\Temp\C525.tmp"108⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"109⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\C65D.tmp"C:\Users\Admin\AppData\Local\Temp\C65D.tmp"110⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"111⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\C786.tmp"C:\Users\Admin\AppData\Local\Temp\C786.tmp"112⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\C803.tmp"C:\Users\Admin\AppData\Local\Temp\C803.tmp"113⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\C890.tmp"C:\Users\Admin\AppData\Local\Temp\C890.tmp"114⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\C91C.tmp"C:\Users\Admin\AppData\Local\Temp\C91C.tmp"115⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\C999.tmp"C:\Users\Admin\AppData\Local\Temp\C999.tmp"116⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\CA26.tmp"C:\Users\Admin\AppData\Local\Temp\CA26.tmp"117⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"118⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"119⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"120⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\CC68.tmp"C:\Users\Admin\AppData\Local\Temp\CC68.tmp"121⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\CCE5.tmp"C:\Users\Admin\AppData\Local\Temp\CCE5.tmp"122⤵PID:4836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-