Analysis
-
max time kernel
150s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
23-08-2023 16:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
772e439a99879ca87d52f6a5f4e5c962_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
772e439a99879ca87d52f6a5f4e5c962_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
772e439a99879ca87d52f6a5f4e5c962_mafia_JC.exe
-
Size
486KB
-
MD5
772e439a99879ca87d52f6a5f4e5c962
-
SHA1
0491eca6f33b091843a75bd5a749a65ff6481f4a
-
SHA256
55dcb036d6d53451c0ae2918de1dee72bbefc6197e6f242873cc1880410e090e
-
SHA512
01ac4f558247d4d14b120c65cced54c7e7d8765636da2a46e415e834877485b6b634854945bc79c5332d89b4e25064db54e277e6c1da3cbc28dd3d7129a07891
-
SSDEEP
12288:oU5rCOTeiDzBaIngomX3oJhvCUGwgAa0P7V4pBNZ:oUQOJDytXYJh6FiyXN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 724 9E05.tmp 2924 9EE0.tmp 5088 9F6C.tmp 228 A086.tmp 4396 A122.tmp 756 A1CE.tmp 4108 A289.tmp 3548 A42F.tmp 3060 A529.tmp 5072 A5C5.tmp 2396 A662.tmp 5076 A70D.tmp 1544 A7D9.tmp 1876 A8C3.tmp 4548 A97E.tmp 4524 AA3A.tmp 4836 AAF5.tmp 1468 AB92.tmp 3300 AC4D.tmp 5084 AD18.tmp 1284 ADE3.tmp 4896 AECE.tmp 4160 AFD7.tmp 1432 B093.tmp 3556 B13F.tmp 3664 B20A.tmp 1100 B297.tmp 3028 B333.tmp 4572 B3B0.tmp 1388 B47B.tmp 1492 B527.tmp 4328 B621.tmp 4300 B6CD.tmp 3500 B759.tmp 3312 B7F6.tmp 3248 B8C1.tmp 2868 B93E.tmp 2168 B9CA.tmp 512 BA57.tmp 5096 BB03.tmp 1560 BB8F.tmp 4888 BC0C.tmp 4376 BCA9.tmp 3800 BD45.tmp 1400 BDE1.tmp 1444 BE7D.tmp 2428 BEFA.tmp 3948 BFA6.tmp 3708 C043.tmp 4660 C0CF.tmp 2932 C14C.tmp 4932 C1D9.tmp 4908 C265.tmp 4016 C2F2.tmp 5052 C37F.tmp 3796 C3FC.tmp 3920 C498.tmp 724 C525.tmp 1756 C5A2.tmp 1260 C61F.tmp 4764 C69C.tmp 2928 C719.tmp 3728 C7A5.tmp 968 C851.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2592 wrote to memory of 724 2592 772e439a99879ca87d52f6a5f4e5c962_mafia_JC.exe 80 PID 2592 wrote to memory of 724 2592 772e439a99879ca87d52f6a5f4e5c962_mafia_JC.exe 80 PID 2592 wrote to memory of 724 2592 772e439a99879ca87d52f6a5f4e5c962_mafia_JC.exe 80 PID 724 wrote to memory of 2924 724 9E05.tmp 81 PID 724 wrote to memory of 2924 724 9E05.tmp 81 PID 724 wrote to memory of 2924 724 9E05.tmp 81 PID 2924 wrote to memory of 5088 2924 9EE0.tmp 82 PID 2924 wrote to memory of 5088 2924 9EE0.tmp 82 PID 2924 wrote to memory of 5088 2924 9EE0.tmp 82 PID 5088 wrote to memory of 228 5088 9F6C.tmp 83 PID 5088 wrote to memory of 228 5088 9F6C.tmp 83 PID 5088 wrote to memory of 228 5088 9F6C.tmp 83 PID 228 wrote to memory of 4396 228 A086.tmp 84 PID 228 wrote to memory of 4396 228 A086.tmp 84 PID 228 wrote to memory of 4396 228 A086.tmp 84 PID 4396 wrote to memory of 756 4396 A122.tmp 85 PID 4396 wrote to memory of 756 4396 A122.tmp 85 PID 4396 wrote to memory of 756 4396 A122.tmp 85 PID 756 wrote to memory of 4108 756 A1CE.tmp 86 PID 756 wrote to memory of 4108 756 A1CE.tmp 86 PID 756 wrote to memory of 4108 756 A1CE.tmp 86 PID 4108 wrote to memory of 3548 4108 A289.tmp 87 PID 4108 wrote to memory of 3548 4108 A289.tmp 87 PID 4108 wrote to memory of 3548 4108 A289.tmp 87 PID 3548 wrote to memory of 3060 3548 A42F.tmp 88 PID 3548 wrote to memory of 3060 3548 A42F.tmp 88 PID 3548 wrote to memory of 3060 3548 A42F.tmp 88 PID 3060 wrote to memory of 5072 3060 A529.tmp 89 PID 3060 wrote to memory of 5072 3060 A529.tmp 89 PID 3060 wrote to memory of 5072 3060 A529.tmp 89 PID 5072 wrote to memory of 2396 5072 A5C5.tmp 91 PID 5072 wrote to memory of 2396 5072 A5C5.tmp 91 PID 5072 wrote to memory of 2396 5072 A5C5.tmp 91 PID 2396 wrote to memory of 5076 2396 A662.tmp 92 PID 2396 wrote to memory of 5076 2396 A662.tmp 92 PID 2396 wrote to memory of 5076 2396 A662.tmp 92 PID 5076 wrote to memory of 1544 5076 A70D.tmp 93 PID 5076 wrote to memory of 1544 5076 A70D.tmp 93 PID 5076 wrote to memory of 1544 5076 A70D.tmp 93 PID 1544 wrote to memory of 1876 1544 A7D9.tmp 94 PID 1544 wrote to memory of 1876 1544 A7D9.tmp 94 PID 1544 wrote to memory of 1876 1544 A7D9.tmp 94 PID 1876 wrote to memory of 4548 1876 A8C3.tmp 95 PID 1876 wrote to memory of 4548 1876 A8C3.tmp 95 PID 1876 wrote to memory of 4548 1876 A8C3.tmp 95 PID 4548 wrote to memory of 4524 4548 A97E.tmp 96 PID 4548 wrote to memory of 4524 4548 A97E.tmp 96 PID 4548 wrote to memory of 4524 4548 A97E.tmp 96 PID 4524 wrote to memory of 4836 4524 AA3A.tmp 97 PID 4524 wrote to memory of 4836 4524 AA3A.tmp 97 PID 4524 wrote to memory of 4836 4524 AA3A.tmp 97 PID 4836 wrote to memory of 1468 4836 AAF5.tmp 98 PID 4836 wrote to memory of 1468 4836 AAF5.tmp 98 PID 4836 wrote to memory of 1468 4836 AAF5.tmp 98 PID 1468 wrote to memory of 3300 1468 AB92.tmp 101 PID 1468 wrote to memory of 3300 1468 AB92.tmp 101 PID 1468 wrote to memory of 3300 1468 AB92.tmp 101 PID 3300 wrote to memory of 5084 3300 AC4D.tmp 102 PID 3300 wrote to memory of 5084 3300 AC4D.tmp 102 PID 3300 wrote to memory of 5084 3300 AC4D.tmp 102 PID 5084 wrote to memory of 1284 5084 AD18.tmp 103 PID 5084 wrote to memory of 1284 5084 AD18.tmp 103 PID 5084 wrote to memory of 1284 5084 AD18.tmp 103 PID 1284 wrote to memory of 4896 1284 ADE3.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\772e439a99879ca87d52f6a5f4e5c962_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\772e439a99879ca87d52f6a5f4e5c962_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\A086.tmp"C:\Users\Admin\AppData\Local\Temp\A086.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\A662.tmp"C:\Users\Admin\AppData\Local\Temp\A662.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\AB92.tmp"C:\Users\Admin\AppData\Local\Temp\AB92.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\AD18.tmp"C:\Users\Admin\AppData\Local\Temp\AD18.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\AECE.tmp"C:\Users\Admin\AppData\Local\Temp\AECE.tmp"23⤵
- Executes dropped EXE
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"24⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\B093.tmp"C:\Users\Admin\AppData\Local\Temp\B093.tmp"25⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"26⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\B20A.tmp"C:\Users\Admin\AppData\Local\Temp\B20A.tmp"27⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"28⤵
- Executes dropped EXE
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"29⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"30⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\B47B.tmp"C:\Users\Admin\AppData\Local\Temp\B47B.tmp"31⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\B527.tmp"C:\Users\Admin\AppData\Local\Temp\B527.tmp"32⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\B621.tmp"C:\Users\Admin\AppData\Local\Temp\B621.tmp"33⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"34⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\B759.tmp"C:\Users\Admin\AppData\Local\Temp\B759.tmp"35⤵
- Executes dropped EXE
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"36⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"37⤵
- Executes dropped EXE
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\B93E.tmp"C:\Users\Admin\AppData\Local\Temp\B93E.tmp"38⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"39⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\BA57.tmp"C:\Users\Admin\AppData\Local\Temp\BA57.tmp"40⤵
- Executes dropped EXE
PID:512 -
C:\Users\Admin\AppData\Local\Temp\BB03.tmp"C:\Users\Admin\AppData\Local\Temp\BB03.tmp"41⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"42⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"43⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"44⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\BD45.tmp"C:\Users\Admin\AppData\Local\Temp\BD45.tmp"45⤵
- Executes dropped EXE
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"46⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"47⤵
- Executes dropped EXE
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"48⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"49⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\C043.tmp"C:\Users\Admin\AppData\Local\Temp\C043.tmp"50⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"51⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"52⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"53⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"54⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"55⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\C37F.tmp"C:\Users\Admin\AppData\Local\Temp\C37F.tmp"56⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"57⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\C498.tmp"C:\Users\Admin\AppData\Local\Temp\C498.tmp"58⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\C525.tmp"C:\Users\Admin\AppData\Local\Temp\C525.tmp"59⤵
- Executes dropped EXE
PID:724 -
C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"60⤵
- Executes dropped EXE
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\C61F.tmp"C:\Users\Admin\AppData\Local\Temp\C61F.tmp"61⤵
- Executes dropped EXE
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\C69C.tmp"C:\Users\Admin\AppData\Local\Temp\C69C.tmp"62⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\C719.tmp"C:\Users\Admin\AppData\Local\Temp\C719.tmp"63⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"64⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\C851.tmp"C:\Users\Admin\AppData\Local\Temp\C851.tmp"65⤵
- Executes dropped EXE
PID:968 -
C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"66⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\C92C.tmp"C:\Users\Admin\AppData\Local\Temp\C92C.tmp"67⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"68⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\CA35.tmp"C:\Users\Admin\AppData\Local\Temp\CA35.tmp"69⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\CA84.tmp"C:\Users\Admin\AppData\Local\Temp\CA84.tmp"70⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\CB10.tmp"C:\Users\Admin\AppData\Local\Temp\CB10.tmp"71⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"72⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"73⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\CC97.tmp"C:\Users\Admin\AppData\Local\Temp\CC97.tmp"74⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\CD33.tmp"C:\Users\Admin\AppData\Local\Temp\CD33.tmp"75⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\CD91.tmp"C:\Users\Admin\AppData\Local\Temp\CD91.tmp"76⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"77⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\CF08.tmp"C:\Users\Admin\AppData\Local\Temp\CF08.tmp"78⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\CF85.tmp"C:\Users\Admin\AppData\Local\Temp\CF85.tmp"79⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\D011.tmp"C:\Users\Admin\AppData\Local\Temp\D011.tmp"80⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\D09E.tmp"C:\Users\Admin\AppData\Local\Temp\D09E.tmp"81⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\D14A.tmp"C:\Users\Admin\AppData\Local\Temp\D14A.tmp"82⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"83⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\D292.tmp"C:\Users\Admin\AppData\Local\Temp\D292.tmp"84⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"85⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\D34E.tmp"C:\Users\Admin\AppData\Local\Temp\D34E.tmp"86⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\D3CB.tmp"C:\Users\Admin\AppData\Local\Temp\D3CB.tmp"87⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\D438.tmp"C:\Users\Admin\AppData\Local\Temp\D438.tmp"88⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"89⤵PID:424
-
C:\Users\Admin\AppData\Local\Temp\D522.tmp"C:\Users\Admin\AppData\Local\Temp\D522.tmp"90⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\D580.tmp"C:\Users\Admin\AppData\Local\Temp\D580.tmp"91⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"92⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\D64B.tmp"C:\Users\Admin\AppData\Local\Temp\D64B.tmp"93⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\D6B9.tmp"C:\Users\Admin\AppData\Local\Temp\D6B9.tmp"94⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\D745.tmp"C:\Users\Admin\AppData\Local\Temp\D745.tmp"95⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\D7E1.tmp"C:\Users\Admin\AppData\Local\Temp\D7E1.tmp"96⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\D85E.tmp"C:\Users\Admin\AppData\Local\Temp\D85E.tmp"97⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\D90A.tmp"C:\Users\Admin\AppData\Local\Temp\D90A.tmp"98⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\D987.tmp"C:\Users\Admin\AppData\Local\Temp\D987.tmp"99⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\DA04.tmp"C:\Users\Admin\AppData\Local\Temp\DA04.tmp"100⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\DA81.tmp"C:\Users\Admin\AppData\Local\Temp\DA81.tmp"101⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\DB0E.tmp"C:\Users\Admin\AppData\Local\Temp\DB0E.tmp"102⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"103⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\DC27.tmp"C:\Users\Admin\AppData\Local\Temp\DC27.tmp"104⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\DCC3.tmp"C:\Users\Admin\AppData\Local\Temp\DCC3.tmp"105⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\DD60.tmp"C:\Users\Admin\AppData\Local\Temp\DD60.tmp"106⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"107⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\DE98.tmp"C:\Users\Admin\AppData\Local\Temp\DE98.tmp"108⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\DF44.tmp"C:\Users\Admin\AppData\Local\Temp\DF44.tmp"109⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"110⤵PID:480
-
C:\Users\Admin\AppData\Local\Temp\E04E.tmp"C:\Users\Admin\AppData\Local\Temp\E04E.tmp"111⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"112⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\E167.tmp"C:\Users\Admin\AppData\Local\Temp\E167.tmp"113⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"114⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\E261.tmp"C:\Users\Admin\AppData\Local\Temp\E261.tmp"115⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\E30D.tmp"C:\Users\Admin\AppData\Local\Temp\E30D.tmp"116⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\E38A.tmp"C:\Users\Admin\AppData\Local\Temp\E38A.tmp"117⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\E416.tmp"C:\Users\Admin\AppData\Local\Temp\E416.tmp"118⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\E484.tmp"C:\Users\Admin\AppData\Local\Temp\E484.tmp"119⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\E520.tmp"C:\Users\Admin\AppData\Local\Temp\E520.tmp"120⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\E5BC.tmp"C:\Users\Admin\AppData\Local\Temp\E5BC.tmp"121⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\E639.tmp"C:\Users\Admin\AppData\Local\Temp\E639.tmp"122⤵PID:5088
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-