Analysis
-
max time kernel
151s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20230824-en -
resource tags
arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system -
submitted
24/08/2023, 17:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
854e50b91bbeeccc20fa83c22c97428e_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
854e50b91bbeeccc20fa83c22c97428e_mafia_JC.exe
Resource
win10v2004-20230824-en
2 signatures
150 seconds
General
-
Target
854e50b91bbeeccc20fa83c22c97428e_mafia_JC.exe
-
Size
488KB
-
MD5
854e50b91bbeeccc20fa83c22c97428e
-
SHA1
7866ca008c1fd1ebd2783f9800000f6df27002ce
-
SHA256
9cce991757db99bc4463737ac75f418b33223359a66222b5d1c782449e3d2334
-
SHA512
a093e2753eb810b58d6ee7afe750308a3981f34b456a1e1ce194db68652c6ac44d687b254bf7d31ed2d8439082766995820c7e33216e12d2fd3580351338d3ac
-
SSDEEP
12288:/U5rCOTeiDr48TPNhOwO4lshJgJIvhNZ:/UQOJD8aPFqJgJIvhN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4804 867.tmp 4412 942.tmp 2692 9EE.tmp 2264 A7B.tmp 60 B55.tmp 3828 BE2.tmp 1408 C5F.tmp 4976 CDC.tmp 2860 D69.tmp 1836 DE6.tmp 3780 E53.tmp 368 EE0.tmp 2500 F5D.tmp 264 FDA.tmp 1660 1057.tmp 5116 1102.tmp 1976 1623.tmp 1204 16DE.tmp 2968 17AA.tmp 4524 1865.tmp 3564 195F.tmp 4504 1A59.tmp 1916 1B24.tmp 2996 1C1E.tmp 2944 1D09.tmp 2780 1DA5.tmp 2020 1E60.tmp 3308 1FA8.tmp 5016 2083.tmp 4436 215E.tmp 4036 2239.tmp 4788 22D5.tmp 3148 23BF.tmp 5056 246B.tmp 2396 2536.tmp 4348 25D3.tmp 3356 268E.tmp 876 274A.tmp 3420 27F5.tmp 2212 2892.tmp 4004 298C.tmp 4444 2A38.tmp 4256 2AD4.tmp 2776 2BAF.tmp 2028 2C5A.tmp 3248 2D45.tmp 3320 2DE1.tmp 4364 2EBC.tmp 440 2F58.tmp 4648 3023.tmp 2120 30EE.tmp 2584 31AA.tmp 3752 3275.tmp 4000 337F.tmp 1508 343A.tmp 488 34F6.tmp 548 3582.tmp 3840 362E.tmp 2328 36CA.tmp 1912 3767.tmp 4940 37E4.tmp 4860 3880.tmp 644 38FD.tmp 1544 39A9.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5104 wrote to memory of 4804 5104 854e50b91bbeeccc20fa83c22c97428e_mafia_JC.exe 98 PID 5104 wrote to memory of 4804 5104 854e50b91bbeeccc20fa83c22c97428e_mafia_JC.exe 98 PID 5104 wrote to memory of 4804 5104 854e50b91bbeeccc20fa83c22c97428e_mafia_JC.exe 98 PID 4804 wrote to memory of 4412 4804 867.tmp 83 PID 4804 wrote to memory of 4412 4804 867.tmp 83 PID 4804 wrote to memory of 4412 4804 867.tmp 83 PID 4412 wrote to memory of 2692 4412 942.tmp 84 PID 4412 wrote to memory of 2692 4412 942.tmp 84 PID 4412 wrote to memory of 2692 4412 942.tmp 84 PID 2692 wrote to memory of 2264 2692 9EE.tmp 97 PID 2692 wrote to memory of 2264 2692 9EE.tmp 97 PID 2692 wrote to memory of 2264 2692 9EE.tmp 97 PID 2264 wrote to memory of 60 2264 A7B.tmp 85 PID 2264 wrote to memory of 60 2264 A7B.tmp 85 PID 2264 wrote to memory of 60 2264 A7B.tmp 85 PID 60 wrote to memory of 3828 60 B55.tmp 86 PID 60 wrote to memory of 3828 60 B55.tmp 86 PID 60 wrote to memory of 3828 60 B55.tmp 86 PID 3828 wrote to memory of 1408 3828 BE2.tmp 96 PID 3828 wrote to memory of 1408 3828 BE2.tmp 96 PID 3828 wrote to memory of 1408 3828 BE2.tmp 96 PID 1408 wrote to memory of 4976 1408 C5F.tmp 95 PID 1408 wrote to memory of 4976 1408 C5F.tmp 95 PID 1408 wrote to memory of 4976 1408 C5F.tmp 95 PID 4976 wrote to memory of 2860 4976 CDC.tmp 94 PID 4976 wrote to memory of 2860 4976 CDC.tmp 94 PID 4976 wrote to memory of 2860 4976 CDC.tmp 94 PID 2860 wrote to memory of 1836 2860 D69.tmp 87 PID 2860 wrote to memory of 1836 2860 D69.tmp 87 PID 2860 wrote to memory of 1836 2860 D69.tmp 87 PID 1836 wrote to memory of 3780 1836 DE6.tmp 88 PID 1836 wrote to memory of 3780 1836 DE6.tmp 88 PID 1836 wrote to memory of 3780 1836 DE6.tmp 88 PID 3780 wrote to memory of 368 3780 E53.tmp 93 PID 3780 wrote to memory of 368 3780 E53.tmp 93 PID 3780 wrote to memory of 368 3780 E53.tmp 93 PID 368 wrote to memory of 2500 368 EE0.tmp 92 PID 368 wrote to memory of 2500 368 EE0.tmp 92 PID 368 wrote to memory of 2500 368 EE0.tmp 92 PID 2500 wrote to memory of 264 2500 F5D.tmp 91 PID 2500 wrote to memory of 264 2500 F5D.tmp 91 PID 2500 wrote to memory of 264 2500 F5D.tmp 91 PID 264 wrote to memory of 1660 264 FDA.tmp 89 PID 264 wrote to memory of 1660 264 FDA.tmp 89 PID 264 wrote to memory of 1660 264 FDA.tmp 89 PID 1660 wrote to memory of 5116 1660 1057.tmp 90 PID 1660 wrote to memory of 5116 1660 1057.tmp 90 PID 1660 wrote to memory of 5116 1660 1057.tmp 90 PID 5116 wrote to memory of 1976 5116 1102.tmp 99 PID 5116 wrote to memory of 1976 5116 1102.tmp 99 PID 5116 wrote to memory of 1976 5116 1102.tmp 99 PID 1976 wrote to memory of 1204 1976 1623.tmp 100 PID 1976 wrote to memory of 1204 1976 1623.tmp 100 PID 1976 wrote to memory of 1204 1976 1623.tmp 100 PID 1204 wrote to memory of 2968 1204 16DE.tmp 101 PID 1204 wrote to memory of 2968 1204 16DE.tmp 101 PID 1204 wrote to memory of 2968 1204 16DE.tmp 101 PID 2968 wrote to memory of 4524 2968 17AA.tmp 102 PID 2968 wrote to memory of 4524 2968 17AA.tmp 102 PID 2968 wrote to memory of 4524 2968 17AA.tmp 102 PID 4524 wrote to memory of 3564 4524 1865.tmp 103 PID 4524 wrote to memory of 3564 4524 1865.tmp 103 PID 4524 wrote to memory of 3564 4524 1865.tmp 103 PID 3564 wrote to memory of 4504 3564 195F.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\854e50b91bbeeccc20fa83c22c97428e_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\854e50b91bbeeccc20fa83c22c97428e_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\867.tmp"C:\Users\Admin\AppData\Local\Temp\867.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\942.tmp"C:\Users\Admin\AppData\Local\Temp\942.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\9EE.tmp"C:\Users\Admin\AppData\Local\Temp\9EE.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\A7B.tmp"C:\Users\Admin\AppData\Local\Temp\A7B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264
-
-
-
C:\Users\Admin\AppData\Local\Temp\B55.tmp"C:\Users\Admin\AppData\Local\Temp\B55.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\BE2.tmp"C:\Users\Admin\AppData\Local\Temp\BE2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\C5F.tmp"C:\Users\Admin\AppData\Local\Temp\C5F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408
-
-
-
C:\Users\Admin\AppData\Local\Temp\DE6.tmp"C:\Users\Admin\AppData\Local\Temp\DE6.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\E53.tmp"C:\Users\Admin\AppData\Local\Temp\E53.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\EE0.tmp"C:\Users\Admin\AppData\Local\Temp\EE0.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368
-
-
-
C:\Users\Admin\AppData\Local\Temp\1057.tmp"C:\Users\Admin\AppData\Local\Temp\1057.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\1102.tmp"C:\Users\Admin\AppData\Local\Temp\1102.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\1623.tmp"C:\Users\Admin\AppData\Local\Temp\1623.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\16DE.tmp"C:\Users\Admin\AppData\Local\Temp\16DE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\17AA.tmp"C:\Users\Admin\AppData\Local\Temp\17AA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\1865.tmp"C:\Users\Admin\AppData\Local\Temp\1865.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\195F.tmp"C:\Users\Admin\AppData\Local\Temp\195F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\1A59.tmp"C:\Users\Admin\AppData\Local\Temp\1A59.tmp"8⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\1B24.tmp"C:\Users\Admin\AppData\Local\Temp\1B24.tmp"9⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"10⤵
- Executes dropped EXE
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\1D09.tmp"C:\Users\Admin\AppData\Local\Temp\1D09.tmp"11⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\1DA5.tmp"C:\Users\Admin\AppData\Local\Temp\1DA5.tmp"12⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\1E60.tmp"C:\Users\Admin\AppData\Local\Temp\1E60.tmp"13⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"14⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\2083.tmp"C:\Users\Admin\AppData\Local\Temp\2083.tmp"15⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\215E.tmp"C:\Users\Admin\AppData\Local\Temp\215E.tmp"16⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\2239.tmp"C:\Users\Admin\AppData\Local\Temp\2239.tmp"17⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\22D5.tmp"C:\Users\Admin\AppData\Local\Temp\22D5.tmp"18⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\23BF.tmp"C:\Users\Admin\AppData\Local\Temp\23BF.tmp"19⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\246B.tmp"C:\Users\Admin\AppData\Local\Temp\246B.tmp"20⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\2536.tmp"C:\Users\Admin\AppData\Local\Temp\2536.tmp"21⤵
- Executes dropped EXE
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\25D3.tmp"C:\Users\Admin\AppData\Local\Temp\25D3.tmp"22⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\268E.tmp"C:\Users\Admin\AppData\Local\Temp\268E.tmp"23⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\274A.tmp"C:\Users\Admin\AppData\Local\Temp\274A.tmp"24⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\27F5.tmp"C:\Users\Admin\AppData\Local\Temp\27F5.tmp"25⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\2892.tmp"C:\Users\Admin\AppData\Local\Temp\2892.tmp"26⤵
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\298C.tmp"C:\Users\Admin\AppData\Local\Temp\298C.tmp"27⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\2A38.tmp"C:\Users\Admin\AppData\Local\Temp\2A38.tmp"28⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\2AD4.tmp"C:\Users\Admin\AppData\Local\Temp\2AD4.tmp"29⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\2BAF.tmp"C:\Users\Admin\AppData\Local\Temp\2BAF.tmp"30⤵
- Executes dropped EXE
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\2C5A.tmp"C:\Users\Admin\AppData\Local\Temp\2C5A.tmp"31⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\2D45.tmp"C:\Users\Admin\AppData\Local\Temp\2D45.tmp"32⤵
- Executes dropped EXE
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\2DE1.tmp"C:\Users\Admin\AppData\Local\Temp\2DE1.tmp"33⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"34⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\2F58.tmp"C:\Users\Admin\AppData\Local\Temp\2F58.tmp"35⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\3023.tmp"C:\Users\Admin\AppData\Local\Temp\3023.tmp"36⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\30EE.tmp"C:\Users\Admin\AppData\Local\Temp\30EE.tmp"37⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\31AA.tmp"C:\Users\Admin\AppData\Local\Temp\31AA.tmp"38⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\3275.tmp"C:\Users\Admin\AppData\Local\Temp\3275.tmp"39⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"40⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"41⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\34F6.tmp"C:\Users\Admin\AppData\Local\Temp\34F6.tmp"42⤵
- Executes dropped EXE
PID:488 -
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"43⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\362E.tmp"C:\Users\Admin\AppData\Local\Temp\362E.tmp"44⤵
- Executes dropped EXE
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\36CA.tmp"C:\Users\Admin\AppData\Local\Temp\36CA.tmp"45⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\3767.tmp"C:\Users\Admin\AppData\Local\Temp\3767.tmp"46⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\37E4.tmp"C:\Users\Admin\AppData\Local\Temp\37E4.tmp"47⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\3880.tmp"C:\Users\Admin\AppData\Local\Temp\3880.tmp"48⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\38FD.tmp"C:\Users\Admin\AppData\Local\Temp\38FD.tmp"49⤵
- Executes dropped EXE
PID:644 -
C:\Users\Admin\AppData\Local\Temp\39A9.tmp"C:\Users\Admin\AppData\Local\Temp\39A9.tmp"50⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\3A16.tmp"C:\Users\Admin\AppData\Local\Temp\3A16.tmp"51⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\3AA3.tmp"C:\Users\Admin\AppData\Local\Temp\3AA3.tmp"52⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"53⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\3C1A.tmp"C:\Users\Admin\AppData\Local\Temp\3C1A.tmp"54⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\3CB6.tmp"C:\Users\Admin\AppData\Local\Temp\3CB6.tmp"55⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\3D52.tmp"C:\Users\Admin\AppData\Local\Temp\3D52.tmp"56⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\3DDF.tmp"C:\Users\Admin\AppData\Local\Temp\3DDF.tmp"57⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\3E6B.tmp"C:\Users\Admin\AppData\Local\Temp\3E6B.tmp"58⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\3F08.tmp"C:\Users\Admin\AppData\Local\Temp\3F08.tmp"59⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\3F85.tmp"C:\Users\Admin\AppData\Local\Temp\3F85.tmp"60⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\4031.tmp"C:\Users\Admin\AppData\Local\Temp\4031.tmp"61⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\40CD.tmp"C:\Users\Admin\AppData\Local\Temp\40CD.tmp"62⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\4169.tmp"C:\Users\Admin\AppData\Local\Temp\4169.tmp"63⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\41F6.tmp"C:\Users\Admin\AppData\Local\Temp\41F6.tmp"64⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\4273.tmp"C:\Users\Admin\AppData\Local\Temp\4273.tmp"65⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\433E.tmp"C:\Users\Admin\AppData\Local\Temp\433E.tmp"66⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\43DA.tmp"C:\Users\Admin\AppData\Local\Temp\43DA.tmp"67⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\4476.tmp"C:\Users\Admin\AppData\Local\Temp\4476.tmp"68⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\4503.tmp"C:\Users\Admin\AppData\Local\Temp\4503.tmp"69⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\459F.tmp"C:\Users\Admin\AppData\Local\Temp\459F.tmp"70⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\461C.tmp"C:\Users\Admin\AppData\Local\Temp\461C.tmp"71⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\46C8.tmp"C:\Users\Admin\AppData\Local\Temp\46C8.tmp"72⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\4745.tmp"C:\Users\Admin\AppData\Local\Temp\4745.tmp"73⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\47D2.tmp"C:\Users\Admin\AppData\Local\Temp\47D2.tmp"74⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\484F.tmp"C:\Users\Admin\AppData\Local\Temp\484F.tmp"75⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\48EB.tmp"C:\Users\Admin\AppData\Local\Temp\48EB.tmp"76⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\49A6.tmp"C:\Users\Admin\AppData\Local\Temp\49A6.tmp"77⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\4A23.tmp"C:\Users\Admin\AppData\Local\Temp\4A23.tmp"78⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\4AA0.tmp"C:\Users\Admin\AppData\Local\Temp\4AA0.tmp"79⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\4B2D.tmp"C:\Users\Admin\AppData\Local\Temp\4B2D.tmp"80⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\4BD9.tmp"C:\Users\Admin\AppData\Local\Temp\4BD9.tmp"81⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\4C94.tmp"C:\Users\Admin\AppData\Local\Temp\4C94.tmp"82⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\4D21.tmp"C:\Users\Admin\AppData\Local\Temp\4D21.tmp"83⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\4DAE.tmp"C:\Users\Admin\AppData\Local\Temp\4DAE.tmp"84⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\4E3A.tmp"C:\Users\Admin\AppData\Local\Temp\4E3A.tmp"85⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\4EC7.tmp"C:\Users\Admin\AppData\Local\Temp\4EC7.tmp"86⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\4F44.tmp"C:\Users\Admin\AppData\Local\Temp\4F44.tmp"87⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\4FE0.tmp"C:\Users\Admin\AppData\Local\Temp\4FE0.tmp"88⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\505D.tmp"C:\Users\Admin\AppData\Local\Temp\505D.tmp"89⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\50EA.tmp"C:\Users\Admin\AppData\Local\Temp\50EA.tmp"90⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\5157.tmp"C:\Users\Admin\AppData\Local\Temp\5157.tmp"91⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\51D4.tmp"C:\Users\Admin\AppData\Local\Temp\51D4.tmp"92⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\5290.tmp"C:\Users\Admin\AppData\Local\Temp\5290.tmp"93⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\531C.tmp"C:\Users\Admin\AppData\Local\Temp\531C.tmp"94⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\53A9.tmp"C:\Users\Admin\AppData\Local\Temp\53A9.tmp"95⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\5436.tmp"C:\Users\Admin\AppData\Local\Temp\5436.tmp"96⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\54B3.tmp"C:\Users\Admin\AppData\Local\Temp\54B3.tmp"97⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\553F.tmp"C:\Users\Admin\AppData\Local\Temp\553F.tmp"98⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\55BC.tmp"C:\Users\Admin\AppData\Local\Temp\55BC.tmp"99⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\5639.tmp"C:\Users\Admin\AppData\Local\Temp\5639.tmp"100⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\56A7.tmp"C:\Users\Admin\AppData\Local\Temp\56A7.tmp"101⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\5724.tmp"C:\Users\Admin\AppData\Local\Temp\5724.tmp"102⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\5791.tmp"C:\Users\Admin\AppData\Local\Temp\5791.tmp"103⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\582D.tmp"C:\Users\Admin\AppData\Local\Temp\582D.tmp"104⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\589B.tmp"C:\Users\Admin\AppData\Local\Temp\589B.tmp"105⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\5927.tmp"C:\Users\Admin\AppData\Local\Temp\5927.tmp"106⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\59A4.tmp"C:\Users\Admin\AppData\Local\Temp\59A4.tmp"107⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\5A21.tmp"C:\Users\Admin\AppData\Local\Temp\5A21.tmp"108⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\5A8F.tmp"C:\Users\Admin\AppData\Local\Temp\5A8F.tmp"109⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\5B3A.tmp"C:\Users\Admin\AppData\Local\Temp\5B3A.tmp"110⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\5C06.tmp"C:\Users\Admin\AppData\Local\Temp\5C06.tmp"111⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\5CA2.tmp"C:\Users\Admin\AppData\Local\Temp\5CA2.tmp"112⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\5D3E.tmp"C:\Users\Admin\AppData\Local\Temp\5D3E.tmp"113⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\5DEA.tmp"C:\Users\Admin\AppData\Local\Temp\5DEA.tmp"114⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\5E77.tmp"C:\Users\Admin\AppData\Local\Temp\5E77.tmp"115⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\5F03.tmp"C:\Users\Admin\AppData\Local\Temp\5F03.tmp"116⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\5FAF.tmp"C:\Users\Admin\AppData\Local\Temp\5FAF.tmp"117⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\602C.tmp"C:\Users\Admin\AppData\Local\Temp\602C.tmp"118⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\60A9.tmp"C:\Users\Admin\AppData\Local\Temp\60A9.tmp"119⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\6136.tmp"C:\Users\Admin\AppData\Local\Temp\6136.tmp"120⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\61E2.tmp"C:\Users\Admin\AppData\Local\Temp\61E2.tmp"121⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\624F.tmp"C:\Users\Admin\AppData\Local\Temp\624F.tmp"122⤵PID:4136
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-