Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
26-08-2023 20:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a78a78bfbc65178ca9a44a4d43145232_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
a78a78bfbc65178ca9a44a4d43145232_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
a78a78bfbc65178ca9a44a4d43145232_mafia_JC.exe
-
Size
527KB
-
MD5
a78a78bfbc65178ca9a44a4d43145232
-
SHA1
d6a291b360ff0baf97972b5665489f97fbab6b35
-
SHA256
3581f51b3f3dcbc5ce20615cc3d7ee226082e0425912e882dc0030e45a2feb10
-
SHA512
a805d9f66994f1714400e14872953038966baff3b8a1b442692dbcae961813d5671ad8cd8c9b051a11ec0d3ecd34547442a89aea5e5c2f66b8d414b97dbad4ec
-
SSDEEP
12288:fU5rCOTeid+h5ctKHwKyOd3r4XPmA0ZklbDAJLdKDZu:fUQOJd+h5ctmLBrQPHbDcoDo
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4412 9A2D.tmp 3280 9AE8.tmp 2600 9B84.tmp 5072 9C4F.tmp 3180 9CEC.tmp 3440 9D88.tmp 1780 9EB1.tmp 1280 9F7C.tmp 4364 A066.tmp 3392 A141.tmp 4976 A1FD.tmp 2100 A2A8.tmp 1424 A44E.tmp 4684 A50A.tmp 576 A5E5.tmp 4832 A690.tmp 4396 A77B.tmp 3948 A901.tmp 460 A9CD.tmp 5028 AA59.tmp 1388 AB05.tmp 552 ABA1.tmp 5060 AC3E.tmp 4904 AD09.tmp 2064 AD86.tmp 4008 AE32.tmp 3764 AEFD.tmp 2052 AFE7.tmp 4712 B0B2.tmp 4732 B15E.tmp 4308 B229.tmp 1472 B323.tmp 2888 B3EE.tmp 2552 B48B.tmp 3456 B517.tmp 888 B5B3.tmp 4156 B630.tmp 1636 B6BD.tmp 1596 B74A.tmp 4196 B7C7.tmp 2296 B863.tmp 4188 B90F.tmp 2192 B99B.tmp 2120 BA28.tmp 3576 BAC4.tmp 1552 BB51.tmp 2836 BBDE.tmp 4060 BC5B.tmp 1112 BCD8.tmp 5116 BD55.tmp 3792 BDD2.tmp 1064 BE4F.tmp 2880 BEDB.tmp 1496 BF77.tmp 4304 BFE5.tmp 4288 C081.tmp 3988 C10E.tmp 4932 C18B.tmp 2372 C208.tmp 1720 C265.tmp 3180 C2C3.tmp 760 C331.tmp 4680 C3BD.tmp 2636 C44A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3132 wrote to memory of 4412 3132 a78a78bfbc65178ca9a44a4d43145232_mafia_JC.exe 83 PID 3132 wrote to memory of 4412 3132 a78a78bfbc65178ca9a44a4d43145232_mafia_JC.exe 83 PID 3132 wrote to memory of 4412 3132 a78a78bfbc65178ca9a44a4d43145232_mafia_JC.exe 83 PID 4412 wrote to memory of 3280 4412 9A2D.tmp 84 PID 4412 wrote to memory of 3280 4412 9A2D.tmp 84 PID 4412 wrote to memory of 3280 4412 9A2D.tmp 84 PID 3280 wrote to memory of 2600 3280 9AE8.tmp 85 PID 3280 wrote to memory of 2600 3280 9AE8.tmp 85 PID 3280 wrote to memory of 2600 3280 9AE8.tmp 85 PID 2600 wrote to memory of 5072 2600 9B84.tmp 86 PID 2600 wrote to memory of 5072 2600 9B84.tmp 86 PID 2600 wrote to memory of 5072 2600 9B84.tmp 86 PID 5072 wrote to memory of 3180 5072 9C4F.tmp 87 PID 5072 wrote to memory of 3180 5072 9C4F.tmp 87 PID 5072 wrote to memory of 3180 5072 9C4F.tmp 87 PID 3180 wrote to memory of 3440 3180 9CEC.tmp 88 PID 3180 wrote to memory of 3440 3180 9CEC.tmp 88 PID 3180 wrote to memory of 3440 3180 9CEC.tmp 88 PID 3440 wrote to memory of 1780 3440 9D88.tmp 89 PID 3440 wrote to memory of 1780 3440 9D88.tmp 89 PID 3440 wrote to memory of 1780 3440 9D88.tmp 89 PID 1780 wrote to memory of 1280 1780 9EB1.tmp 90 PID 1780 wrote to memory of 1280 1780 9EB1.tmp 90 PID 1780 wrote to memory of 1280 1780 9EB1.tmp 90 PID 1280 wrote to memory of 4364 1280 9F7C.tmp 91 PID 1280 wrote to memory of 4364 1280 9F7C.tmp 91 PID 1280 wrote to memory of 4364 1280 9F7C.tmp 91 PID 4364 wrote to memory of 3392 4364 A066.tmp 92 PID 4364 wrote to memory of 3392 4364 A066.tmp 92 PID 4364 wrote to memory of 3392 4364 A066.tmp 92 PID 3392 wrote to memory of 4976 3392 A141.tmp 93 PID 3392 wrote to memory of 4976 3392 A141.tmp 93 PID 3392 wrote to memory of 4976 3392 A141.tmp 93 PID 4976 wrote to memory of 2100 4976 A1FD.tmp 94 PID 4976 wrote to memory of 2100 4976 A1FD.tmp 94 PID 4976 wrote to memory of 2100 4976 A1FD.tmp 94 PID 2100 wrote to memory of 1424 2100 A2A8.tmp 95 PID 2100 wrote to memory of 1424 2100 A2A8.tmp 95 PID 2100 wrote to memory of 1424 2100 A2A8.tmp 95 PID 1424 wrote to memory of 4684 1424 A44E.tmp 96 PID 1424 wrote to memory of 4684 1424 A44E.tmp 96 PID 1424 wrote to memory of 4684 1424 A44E.tmp 96 PID 4684 wrote to memory of 576 4684 A50A.tmp 99 PID 4684 wrote to memory of 576 4684 A50A.tmp 99 PID 4684 wrote to memory of 576 4684 A50A.tmp 99 PID 576 wrote to memory of 4832 576 A5E5.tmp 100 PID 576 wrote to memory of 4832 576 A5E5.tmp 100 PID 576 wrote to memory of 4832 576 A5E5.tmp 100 PID 4832 wrote to memory of 4396 4832 A690.tmp 101 PID 4832 wrote to memory of 4396 4832 A690.tmp 101 PID 4832 wrote to memory of 4396 4832 A690.tmp 101 PID 4396 wrote to memory of 3948 4396 A77B.tmp 102 PID 4396 wrote to memory of 3948 4396 A77B.tmp 102 PID 4396 wrote to memory of 3948 4396 A77B.tmp 102 PID 3948 wrote to memory of 460 3948 A901.tmp 104 PID 3948 wrote to memory of 460 3948 A901.tmp 104 PID 3948 wrote to memory of 460 3948 A901.tmp 104 PID 460 wrote to memory of 5028 460 A9CD.tmp 105 PID 460 wrote to memory of 5028 460 A9CD.tmp 105 PID 460 wrote to memory of 5028 460 A9CD.tmp 105 PID 5028 wrote to memory of 1388 5028 AA59.tmp 107 PID 5028 wrote to memory of 1388 5028 AA59.tmp 107 PID 5028 wrote to memory of 1388 5028 AA59.tmp 107 PID 1388 wrote to memory of 552 1388 AB05.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\a78a78bfbc65178ca9a44a4d43145232_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\a78a78bfbc65178ca9a44a4d43145232_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\A066.tmp"C:\Users\Admin\AppData\Local\Temp\A066.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\A141.tmp"C:\Users\Admin\AppData\Local\Temp\A141.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\A50A.tmp"C:\Users\Admin\AppData\Local\Temp\A50A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Users\Admin\AppData\Local\Temp\AA59.tmp"C:\Users\Admin\AppData\Local\Temp\AA59.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\AB05.tmp"C:\Users\Admin\AppData\Local\Temp\AB05.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"23⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"24⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\AD09.tmp"C:\Users\Admin\AppData\Local\Temp\AD09.tmp"25⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"26⤵
- Executes dropped EXE
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"27⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"28⤵
- Executes dropped EXE
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"29⤵
- Executes dropped EXE
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"30⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\B15E.tmp"C:\Users\Admin\AppData\Local\Temp\B15E.tmp"31⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\B229.tmp"C:\Users\Admin\AppData\Local\Temp\B229.tmp"32⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\B323.tmp"C:\Users\Admin\AppData\Local\Temp\B323.tmp"33⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"34⤵
- Executes dropped EXE
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\B48B.tmp"C:\Users\Admin\AppData\Local\Temp\B48B.tmp"35⤵
- Executes dropped EXE
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\B517.tmp"C:\Users\Admin\AppData\Local\Temp\B517.tmp"36⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"37⤵
- Executes dropped EXE
PID:888 -
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"38⤵
- Executes dropped EXE
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"39⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\B74A.tmp"C:\Users\Admin\AppData\Local\Temp\B74A.tmp"40⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"41⤵
- Executes dropped EXE
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\B863.tmp"C:\Users\Admin\AppData\Local\Temp\B863.tmp"42⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\B90F.tmp"C:\Users\Admin\AppData\Local\Temp\B90F.tmp"43⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\B99B.tmp"C:\Users\Admin\AppData\Local\Temp\B99B.tmp"44⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\BA28.tmp"C:\Users\Admin\AppData\Local\Temp\BA28.tmp"45⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"46⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"47⤵
- Executes dropped EXE
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"48⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"49⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"50⤵
- Executes dropped EXE
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\BD55.tmp"C:\Users\Admin\AppData\Local\Temp\BD55.tmp"51⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"52⤵
- Executes dropped EXE
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"53⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"54⤵
- Executes dropped EXE
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\BF77.tmp"C:\Users\Admin\AppData\Local\Temp\BF77.tmp"55⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"56⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"57⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\C10E.tmp"C:\Users\Admin\AppData\Local\Temp\C10E.tmp"58⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\C18B.tmp"C:\Users\Admin\AppData\Local\Temp\C18B.tmp"59⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\C208.tmp"C:\Users\Admin\AppData\Local\Temp\C208.tmp"60⤵
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"61⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"62⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\C331.tmp"C:\Users\Admin\AppData\Local\Temp\C331.tmp"63⤵
- Executes dropped EXE
PID:760 -
C:\Users\Admin\AppData\Local\Temp\C3BD.tmp"C:\Users\Admin\AppData\Local\Temp\C3BD.tmp"64⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\C44A.tmp"C:\Users\Admin\AppData\Local\Temp\C44A.tmp"65⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"66⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\C544.tmp"C:\Users\Admin\AppData\Local\Temp\C544.tmp"67⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"68⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\C63E.tmp"C:\Users\Admin\AppData\Local\Temp\C63E.tmp"69⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"70⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\C757.tmp"C:\Users\Admin\AppData\Local\Temp\C757.tmp"71⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"72⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\C822.tmp"C:\Users\Admin\AppData\Local\Temp\C822.tmp"73⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"74⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\C96A.tmp"C:\Users\Admin\AppData\Local\Temp\C96A.tmp"75⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"76⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\CA84.tmp"C:\Users\Admin\AppData\Local\Temp\CA84.tmp"77⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\CB3F.tmp"C:\Users\Admin\AppData\Local\Temp\CB3F.tmp"78⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"79⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\CC49.tmp"C:\Users\Admin\AppData\Local\Temp\CC49.tmp"80⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"81⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\CD72.tmp"C:\Users\Admin\AppData\Local\Temp\CD72.tmp"82⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\CDDF.tmp"C:\Users\Admin\AppData\Local\Temp\CDDF.tmp"83⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\CE5C.tmp"C:\Users\Admin\AppData\Local\Temp\CE5C.tmp"84⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\CEC9.tmp"C:\Users\Admin\AppData\Local\Temp\CEC9.tmp"85⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\CF46.tmp"C:\Users\Admin\AppData\Local\Temp\CF46.tmp"86⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"87⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\D040.tmp"C:\Users\Admin\AppData\Local\Temp\D040.tmp"88⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"89⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\D169.tmp"C:\Users\Admin\AppData\Local\Temp\D169.tmp"90⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\D1F6.tmp"C:\Users\Admin\AppData\Local\Temp\D1F6.tmp"91⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\D292.tmp"C:\Users\Admin\AppData\Local\Temp\D292.tmp"92⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\D33E.tmp"C:\Users\Admin\AppData\Local\Temp\D33E.tmp"93⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"94⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\D448.tmp"C:\Users\Admin\AppData\Local\Temp\D448.tmp"95⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"96⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\D561.tmp"C:\Users\Admin\AppData\Local\Temp\D561.tmp"97⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\D5FD.tmp"C:\Users\Admin\AppData\Local\Temp\D5FD.tmp"98⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\D68A.tmp"C:\Users\Admin\AppData\Local\Temp\D68A.tmp"99⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\D716.tmp"C:\Users\Admin\AppData\Local\Temp\D716.tmp"100⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\D784.tmp"C:\Users\Admin\AppData\Local\Temp\D784.tmp"101⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\D810.tmp"C:\Users\Admin\AppData\Local\Temp\D810.tmp"102⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\D89D.tmp"C:\Users\Admin\AppData\Local\Temp\D89D.tmp"103⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\D92A.tmp"C:\Users\Admin\AppData\Local\Temp\D92A.tmp"104⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"105⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\DA43.tmp"C:\Users\Admin\AppData\Local\Temp\DA43.tmp"106⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\DACF.tmp"C:\Users\Admin\AppData\Local\Temp\DACF.tmp"107⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\DB6C.tmp"C:\Users\Admin\AppData\Local\Temp\DB6C.tmp"108⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\DBE9.tmp"C:\Users\Admin\AppData\Local\Temp\DBE9.tmp"109⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\DC66.tmp"C:\Users\Admin\AppData\Local\Temp\DC66.tmp"110⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\DD02.tmp"C:\Users\Admin\AppData\Local\Temp\DD02.tmp"111⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\DD7F.tmp"C:\Users\Admin\AppData\Local\Temp\DD7F.tmp"112⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\DE0C.tmp"C:\Users\Admin\AppData\Local\Temp\DE0C.tmp"113⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\DE98.tmp"C:\Users\Admin\AppData\Local\Temp\DE98.tmp"114⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\DF34.tmp"C:\Users\Admin\AppData\Local\Temp\DF34.tmp"115⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"116⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\E03E.tmp"C:\Users\Admin\AppData\Local\Temp\E03E.tmp"117⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"118⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\E157.tmp"C:\Users\Admin\AppData\Local\Temp\E157.tmp"119⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\E203.tmp"C:\Users\Admin\AppData\Local\Temp\E203.tmp"120⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\E280.tmp"C:\Users\Admin\AppData\Local\Temp\E280.tmp"121⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\E30D.tmp"C:\Users\Admin\AppData\Local\Temp\E30D.tmp"122⤵PID:4932
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-