Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
22/08/2023, 15:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
69a104fc50ed7eb6bdca99fd22ff2c8d_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
69a104fc50ed7eb6bdca99fd22ff2c8d_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
69a104fc50ed7eb6bdca99fd22ff2c8d_mafia_JC.exe
-
Size
488KB
-
MD5
69a104fc50ed7eb6bdca99fd22ff2c8d
-
SHA1
e5dc7e4c2a753d934d2fa8b2a6a0a8276052d798
-
SHA256
828b78c1702680b2b437801d28f1ba1ae2842550c7c3dd2154bdeb8efb76c2bb
-
SHA512
fd93ede052d9d8423d4e88e350cfddbcdc569ca7821629bfca20cd30661e597556d6b7fa606917fdc034b6f8739128d9544daf728197ebe88d47329bf120056c
-
SSDEEP
12288:/U5rCOTeiDEkDcbXazs5SoOVhOGRhuEgEaQ5NZ:/UQOJDEK45VYp2Egc5N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2344 783D.tmp 4180 7927.tmp 3484 7A02.tmp 3408 7ACD.tmp 1352 7BA8.tmp 3124 7C44.tmp 2844 7D0F.tmp 3856 7DBB.tmp 416 7E96.tmp 368 7F80.tmp 1384 803C.tmp 1660 80F7.tmp 4572 81B3.tmp 3732 82BD.tmp 4748 8349.tmp 2644 8434.tmp 4248 84FF.tmp 1036 85BA.tmp 4648 8676.tmp 3588 8750.tmp 4752 881C.tmp 2172 8925.tmp 4892 89B2.tmp 3948 8A3E.tmp 4724 8ACB.tmp 2468 8B67.tmp 5112 8BF4.tmp 2340 8C90.tmp 3076 8D1D.tmp 3848 8DB9.tmp 4372 8EA3.tmp 4280 8F4F.tmp 2256 900B.tmp 2496 9078.tmp 2972 9105.tmp 2940 9191.tmp 2840 921E.tmp 4204 92BA.tmp 2632 9347.tmp 1544 93E3.tmp 1868 947F.tmp 2080 950C.tmp 3476 9579.tmp 1696 9616.tmp 4676 9673.tmp 4804 972F.tmp 1580 97EA.tmp 488 9858.tmp 4616 98E4.tmp 844 9990.tmp 1932 9A1D.tmp 4268 9AAA.tmp 4176 9B46.tmp 2772 9BC3.tmp 4504 9C4F.tmp 1244 9CBD.tmp 4528 9D2A.tmp 4976 9DB7.tmp 1596 9E53.tmp 4596 9EE0.tmp 4324 9F6C.tmp 3936 9FF9.tmp 2236 A086.tmp 5088 A112.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2288 wrote to memory of 2344 2288 69a104fc50ed7eb6bdca99fd22ff2c8d_mafia_JC.exe 81 PID 2288 wrote to memory of 2344 2288 69a104fc50ed7eb6bdca99fd22ff2c8d_mafia_JC.exe 81 PID 2288 wrote to memory of 2344 2288 69a104fc50ed7eb6bdca99fd22ff2c8d_mafia_JC.exe 81 PID 2344 wrote to memory of 4180 2344 783D.tmp 82 PID 2344 wrote to memory of 4180 2344 783D.tmp 82 PID 2344 wrote to memory of 4180 2344 783D.tmp 82 PID 4180 wrote to memory of 3484 4180 7927.tmp 83 PID 4180 wrote to memory of 3484 4180 7927.tmp 83 PID 4180 wrote to memory of 3484 4180 7927.tmp 83 PID 3484 wrote to memory of 3408 3484 7A02.tmp 84 PID 3484 wrote to memory of 3408 3484 7A02.tmp 84 PID 3484 wrote to memory of 3408 3484 7A02.tmp 84 PID 3408 wrote to memory of 1352 3408 7ACD.tmp 85 PID 3408 wrote to memory of 1352 3408 7ACD.tmp 85 PID 3408 wrote to memory of 1352 3408 7ACD.tmp 85 PID 1352 wrote to memory of 3124 1352 7BA8.tmp 86 PID 1352 wrote to memory of 3124 1352 7BA8.tmp 86 PID 1352 wrote to memory of 3124 1352 7BA8.tmp 86 PID 3124 wrote to memory of 2844 3124 7C44.tmp 87 PID 3124 wrote to memory of 2844 3124 7C44.tmp 87 PID 3124 wrote to memory of 2844 3124 7C44.tmp 87 PID 2844 wrote to memory of 3856 2844 7D0F.tmp 88 PID 2844 wrote to memory of 3856 2844 7D0F.tmp 88 PID 2844 wrote to memory of 3856 2844 7D0F.tmp 88 PID 3856 wrote to memory of 416 3856 7DBB.tmp 89 PID 3856 wrote to memory of 416 3856 7DBB.tmp 89 PID 3856 wrote to memory of 416 3856 7DBB.tmp 89 PID 416 wrote to memory of 368 416 7E96.tmp 90 PID 416 wrote to memory of 368 416 7E96.tmp 90 PID 416 wrote to memory of 368 416 7E96.tmp 90 PID 368 wrote to memory of 1384 368 7F80.tmp 91 PID 368 wrote to memory of 1384 368 7F80.tmp 91 PID 368 wrote to memory of 1384 368 7F80.tmp 91 PID 1384 wrote to memory of 1660 1384 803C.tmp 92 PID 1384 wrote to memory of 1660 1384 803C.tmp 92 PID 1384 wrote to memory of 1660 1384 803C.tmp 92 PID 1660 wrote to memory of 4572 1660 80F7.tmp 93 PID 1660 wrote to memory of 4572 1660 80F7.tmp 93 PID 1660 wrote to memory of 4572 1660 80F7.tmp 93 PID 4572 wrote to memory of 3732 4572 81B3.tmp 94 PID 4572 wrote to memory of 3732 4572 81B3.tmp 94 PID 4572 wrote to memory of 3732 4572 81B3.tmp 94 PID 3732 wrote to memory of 4748 3732 82BD.tmp 95 PID 3732 wrote to memory of 4748 3732 82BD.tmp 95 PID 3732 wrote to memory of 4748 3732 82BD.tmp 95 PID 4748 wrote to memory of 2644 4748 8349.tmp 98 PID 4748 wrote to memory of 2644 4748 8349.tmp 98 PID 4748 wrote to memory of 2644 4748 8349.tmp 98 PID 2644 wrote to memory of 4248 2644 8434.tmp 99 PID 2644 wrote to memory of 4248 2644 8434.tmp 99 PID 2644 wrote to memory of 4248 2644 8434.tmp 99 PID 4248 wrote to memory of 1036 4248 84FF.tmp 100 PID 4248 wrote to memory of 1036 4248 84FF.tmp 100 PID 4248 wrote to memory of 1036 4248 84FF.tmp 100 PID 1036 wrote to memory of 4648 1036 85BA.tmp 101 PID 1036 wrote to memory of 4648 1036 85BA.tmp 101 PID 1036 wrote to memory of 4648 1036 85BA.tmp 101 PID 4648 wrote to memory of 3588 4648 8676.tmp 102 PID 4648 wrote to memory of 3588 4648 8676.tmp 102 PID 4648 wrote to memory of 3588 4648 8676.tmp 102 PID 3588 wrote to memory of 4752 3588 8750.tmp 103 PID 3588 wrote to memory of 4752 3588 8750.tmp 103 PID 3588 wrote to memory of 4752 3588 8750.tmp 103 PID 4752 wrote to memory of 2172 4752 881C.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\69a104fc50ed7eb6bdca99fd22ff2c8d_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\69a104fc50ed7eb6bdca99fd22ff2c8d_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\783D.tmp"C:\Users\Admin\AppData\Local\Temp\783D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\7927.tmp"C:\Users\Admin\AppData\Local\Temp\7927.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\7A02.tmp"C:\Users\Admin\AppData\Local\Temp\7A02.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\7C44.tmp"C:\Users\Admin\AppData\Local\Temp\7C44.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\7E96.tmp"C:\Users\Admin\AppData\Local\Temp\7E96.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Users\Admin\AppData\Local\Temp\7F80.tmp"C:\Users\Admin\AppData\Local\Temp\7F80.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\803C.tmp"C:\Users\Admin\AppData\Local\Temp\803C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\80F7.tmp"C:\Users\Admin\AppData\Local\Temp\80F7.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\81B3.tmp"C:\Users\Admin\AppData\Local\Temp\81B3.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\82BD.tmp"C:\Users\Admin\AppData\Local\Temp\82BD.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\8349.tmp"C:\Users\Admin\AppData\Local\Temp\8349.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\8434.tmp"C:\Users\Admin\AppData\Local\Temp\8434.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\84FF.tmp"C:\Users\Admin\AppData\Local\Temp\84FF.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\85BA.tmp"C:\Users\Admin\AppData\Local\Temp\85BA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\8676.tmp"C:\Users\Admin\AppData\Local\Temp\8676.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\8750.tmp"C:\Users\Admin\AppData\Local\Temp\8750.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\881C.tmp"C:\Users\Admin\AppData\Local\Temp\881C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\8925.tmp"C:\Users\Admin\AppData\Local\Temp\8925.tmp"23⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\89B2.tmp"C:\Users\Admin\AppData\Local\Temp\89B2.tmp"24⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"25⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"26⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\8B67.tmp"C:\Users\Admin\AppData\Local\Temp\8B67.tmp"27⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"28⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"29⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"30⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"31⤵
- Executes dropped EXE
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"32⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"33⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\900B.tmp"C:\Users\Admin\AppData\Local\Temp\900B.tmp"34⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\9078.tmp"C:\Users\Admin\AppData\Local\Temp\9078.tmp"35⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"36⤵
- Executes dropped EXE
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\9191.tmp"C:\Users\Admin\AppData\Local\Temp\9191.tmp"37⤵
- Executes dropped EXE
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\921E.tmp"C:\Users\Admin\AppData\Local\Temp\921E.tmp"38⤵
- Executes dropped EXE
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"39⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"40⤵
- Executes dropped EXE
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"41⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\947F.tmp"C:\Users\Admin\AppData\Local\Temp\947F.tmp"42⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\950C.tmp"C:\Users\Admin\AppData\Local\Temp\950C.tmp"43⤵
- Executes dropped EXE
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\9579.tmp"C:\Users\Admin\AppData\Local\Temp\9579.tmp"44⤵
- Executes dropped EXE
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"45⤵
- Executes dropped EXE
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\9673.tmp"C:\Users\Admin\AppData\Local\Temp\9673.tmp"46⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\972F.tmp"C:\Users\Admin\AppData\Local\Temp\972F.tmp"47⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\97EA.tmp"C:\Users\Admin\AppData\Local\Temp\97EA.tmp"48⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"49⤵
- Executes dropped EXE
PID:488 -
C:\Users\Admin\AppData\Local\Temp\98E4.tmp"C:\Users\Admin\AppData\Local\Temp\98E4.tmp"50⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"51⤵
- Executes dropped EXE
PID:844 -
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"52⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"53⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"54⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"55⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"56⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"57⤵
- Executes dropped EXE
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"58⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"59⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\9E53.tmp"C:\Users\Admin\AppData\Local\Temp\9E53.tmp"60⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"61⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"62⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"63⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\A086.tmp"C:\Users\Admin\AppData\Local\Temp\A086.tmp"64⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\A112.tmp"C:\Users\Admin\AppData\Local\Temp\A112.tmp"65⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\A180.tmp"C:\Users\Admin\AppData\Local\Temp\A180.tmp"66⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"67⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\A26A.tmp"C:\Users\Admin\AppData\Local\Temp\A26A.tmp"68⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"69⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\A364.tmp"C:\Users\Admin\AppData\Local\Temp\A364.tmp"70⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\A410.tmp"C:\Users\Admin\AppData\Local\Temp\A410.tmp"71⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"72⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\A539.tmp"C:\Users\Admin\AppData\Local\Temp\A539.tmp"73⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"74⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\A662.tmp"C:\Users\Admin\AppData\Local\Temp\A662.tmp"75⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"76⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"77⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"78⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"79⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"80⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"81⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"82⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"83⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\AB05.tmp"C:\Users\Admin\AppData\Local\Temp\AB05.tmp"84⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\AB72.tmp"C:\Users\Admin\AppData\Local\Temp\AB72.tmp"85⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"86⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"87⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"88⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"89⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"90⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\AE70.tmp"C:\Users\Admin\AppData\Local\Temp\AE70.tmp"91⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"92⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\AF99.tmp"C:\Users\Admin\AppData\Local\Temp\AF99.tmp"93⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\B016.tmp"C:\Users\Admin\AppData\Local\Temp\B016.tmp"94⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\B093.tmp"C:\Users\Admin\AppData\Local\Temp\B093.tmp"95⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\B110.tmp"C:\Users\Admin\AppData\Local\Temp\B110.tmp"96⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"97⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\B21A.tmp"C:\Users\Admin\AppData\Local\Temp\B21A.tmp"98⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"99⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\B342.tmp"C:\Users\Admin\AppData\Local\Temp\B342.tmp"100⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"101⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"102⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"103⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\B565.tmp"C:\Users\Admin\AppData\Local\Temp\B565.tmp"104⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"105⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\B66F.tmp"C:\Users\Admin\AppData\Local\Temp\B66F.tmp"106⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"107⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\B779.tmp"C:\Users\Admin\AppData\Local\Temp\B779.tmp"108⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"109⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\B863.tmp"C:\Users\Admin\AppData\Local\Temp\B863.tmp"110⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\B90F.tmp"C:\Users\Admin\AppData\Local\Temp\B90F.tmp"111⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\B98C.tmp"C:\Users\Admin\AppData\Local\Temp\B98C.tmp"112⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\BA09.tmp"C:\Users\Admin\AppData\Local\Temp\BA09.tmp"113⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"114⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"115⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"116⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"117⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\BD06.tmp"C:\Users\Admin\AppData\Local\Temp\BD06.tmp"118⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\BD83.tmp"C:\Users\Admin\AppData\Local\Temp\BD83.tmp"119⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\BE10.tmp"C:\Users\Admin\AppData\Local\Temp\BE10.tmp"120⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"121⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\BF29.tmp"C:\Users\Admin\AppData\Local\Temp\BF29.tmp"122⤵PID:1472
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-