Analysis
-
max time kernel
151s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230824-en -
resource tags
arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system -
submitted
27/08/2023, 15:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ad1338caa5aedd1c3de3ff25345a9c0b_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
ad1338caa5aedd1c3de3ff25345a9c0b_mafia_JC.exe
Resource
win10v2004-20230824-en
2 signatures
150 seconds
General
-
Target
ad1338caa5aedd1c3de3ff25345a9c0b_mafia_JC.exe
-
Size
488KB
-
MD5
ad1338caa5aedd1c3de3ff25345a9c0b
-
SHA1
b296cf9dee5a65f3f288d0bfba3d5af99f204155
-
SHA256
d0b915faa83f3a8fcd1d5d55395cc87d1dc77adbc077bde7cd2eef5361aa44ff
-
SHA512
461876b2d01f58b85a9cb1b41fd39e9c2e5e442aba618e8a38130d9dd9a0cbc364beb86baec78bd33a9d21659e718c75979b634d5b3046df9360740fbf4116a7
-
SSDEEP
12288:/U5rCOTeiDa4XzEo9A4Mb4tGrasJ8uW6/JNZ:/UQOJDxzEo9YEoaHyN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4596 3563.tmp 4244 368C.tmp 2092 3728.tmp 340 3812.tmp 3408 38CE.tmp 568 39A9.tmp 3960 3A64.tmp 1652 3B3F.tmp 2204 3C1A.tmp 3332 3CF4.tmp 1096 3D91.tmp 376 3EAA.tmp 2816 3F65.tmp 4800 4040.tmp 3412 414A.tmp 4612 4244.tmp 3424 431F.tmp 5004 43EA.tmp 3172 4590.tmp 5020 46B8.tmp 4972 4764.tmp 2848 483F.tmp 3920 48FB.tmp 5036 49E5.tmp 1800 4A62.tmp 4860 4B4C.tmp 704 4C27.tmp 4752 4D02.tmp 1344 4DBD.tmp 4672 4EB7.tmp 3788 4F44.tmp 5096 501F.tmp 1760 5119.tmp 3932 5222.tmp 2384 52DE.tmp 4708 5445.tmp 3312 5501.tmp 4396 55BC.tmp 324 5697.tmp 3244 5714.tmp 1988 582D.tmp 3628 58F8.tmp 4960 59C3.tmp 2980 5B3A.tmp 4852 5BE6.tmp 2796 5C73.tmp 4252 5D6D.tmp 2300 5DFA.tmp 4692 5F80.tmp 1976 603C.tmp 4988 6116.tmp 1892 61C2.tmp 972 62CC.tmp 3512 6349.tmp 1300 64DF.tmp 788 65AA.tmp 3440 6647.tmp 216 679E.tmp 2328 6869.tmp 4636 68E6.tmp 1368 6AFA.tmp 4276 6B67.tmp 1400 6BE4.tmp 3960 6C61.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3512 wrote to memory of 4596 3512 ad1338caa5aedd1c3de3ff25345a9c0b_mafia_JC.exe 85 PID 3512 wrote to memory of 4596 3512 ad1338caa5aedd1c3de3ff25345a9c0b_mafia_JC.exe 85 PID 3512 wrote to memory of 4596 3512 ad1338caa5aedd1c3de3ff25345a9c0b_mafia_JC.exe 85 PID 4596 wrote to memory of 4244 4596 3563.tmp 86 PID 4596 wrote to memory of 4244 4596 3563.tmp 86 PID 4596 wrote to memory of 4244 4596 3563.tmp 86 PID 4244 wrote to memory of 2092 4244 368C.tmp 88 PID 4244 wrote to memory of 2092 4244 368C.tmp 88 PID 4244 wrote to memory of 2092 4244 368C.tmp 88 PID 2092 wrote to memory of 340 2092 3728.tmp 89 PID 2092 wrote to memory of 340 2092 3728.tmp 89 PID 2092 wrote to memory of 340 2092 3728.tmp 89 PID 340 wrote to memory of 3408 340 3812.tmp 90 PID 340 wrote to memory of 3408 340 3812.tmp 90 PID 340 wrote to memory of 3408 340 3812.tmp 90 PID 3408 wrote to memory of 568 3408 38CE.tmp 91 PID 3408 wrote to memory of 568 3408 38CE.tmp 91 PID 3408 wrote to memory of 568 3408 38CE.tmp 91 PID 568 wrote to memory of 3960 568 39A9.tmp 92 PID 568 wrote to memory of 3960 568 39A9.tmp 92 PID 568 wrote to memory of 3960 568 39A9.tmp 92 PID 3960 wrote to memory of 1652 3960 3A64.tmp 94 PID 3960 wrote to memory of 1652 3960 3A64.tmp 94 PID 3960 wrote to memory of 1652 3960 3A64.tmp 94 PID 1652 wrote to memory of 2204 1652 3B3F.tmp 95 PID 1652 wrote to memory of 2204 1652 3B3F.tmp 95 PID 1652 wrote to memory of 2204 1652 3B3F.tmp 95 PID 2204 wrote to memory of 3332 2204 3C1A.tmp 96 PID 2204 wrote to memory of 3332 2204 3C1A.tmp 96 PID 2204 wrote to memory of 3332 2204 3C1A.tmp 96 PID 3332 wrote to memory of 1096 3332 3CF4.tmp 97 PID 3332 wrote to memory of 1096 3332 3CF4.tmp 97 PID 3332 wrote to memory of 1096 3332 3CF4.tmp 97 PID 1096 wrote to memory of 376 1096 3D91.tmp 98 PID 1096 wrote to memory of 376 1096 3D91.tmp 98 PID 1096 wrote to memory of 376 1096 3D91.tmp 98 PID 376 wrote to memory of 2816 376 3EAA.tmp 99 PID 376 wrote to memory of 2816 376 3EAA.tmp 99 PID 376 wrote to memory of 2816 376 3EAA.tmp 99 PID 2816 wrote to memory of 4800 2816 3F65.tmp 100 PID 2816 wrote to memory of 4800 2816 3F65.tmp 100 PID 2816 wrote to memory of 4800 2816 3F65.tmp 100 PID 4800 wrote to memory of 3412 4800 4040.tmp 101 PID 4800 wrote to memory of 3412 4800 4040.tmp 101 PID 4800 wrote to memory of 3412 4800 4040.tmp 101 PID 3412 wrote to memory of 4612 3412 414A.tmp 102 PID 3412 wrote to memory of 4612 3412 414A.tmp 102 PID 3412 wrote to memory of 4612 3412 414A.tmp 102 PID 4612 wrote to memory of 3424 4612 4244.tmp 103 PID 4612 wrote to memory of 3424 4612 4244.tmp 103 PID 4612 wrote to memory of 3424 4612 4244.tmp 103 PID 3424 wrote to memory of 5004 3424 431F.tmp 104 PID 3424 wrote to memory of 5004 3424 431F.tmp 104 PID 3424 wrote to memory of 5004 3424 431F.tmp 104 PID 5004 wrote to memory of 3172 5004 43EA.tmp 105 PID 5004 wrote to memory of 3172 5004 43EA.tmp 105 PID 5004 wrote to memory of 3172 5004 43EA.tmp 105 PID 3172 wrote to memory of 5020 3172 4590.tmp 106 PID 3172 wrote to memory of 5020 3172 4590.tmp 106 PID 3172 wrote to memory of 5020 3172 4590.tmp 106 PID 5020 wrote to memory of 4972 5020 46B8.tmp 107 PID 5020 wrote to memory of 4972 5020 46B8.tmp 107 PID 5020 wrote to memory of 4972 5020 46B8.tmp 107 PID 4972 wrote to memory of 2848 4972 4764.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad1338caa5aedd1c3de3ff25345a9c0b_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\ad1338caa5aedd1c3de3ff25345a9c0b_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\3563.tmp"C:\Users\Admin\AppData\Local\Temp\3563.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\368C.tmp"C:\Users\Admin\AppData\Local\Temp\368C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\3728.tmp"C:\Users\Admin\AppData\Local\Temp\3728.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\3812.tmp"C:\Users\Admin\AppData\Local\Temp\3812.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:340 -
C:\Users\Admin\AppData\Local\Temp\38CE.tmp"C:\Users\Admin\AppData\Local\Temp\38CE.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\39A9.tmp"C:\Users\Admin\AppData\Local\Temp\39A9.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Users\Admin\AppData\Local\Temp\3A64.tmp"C:\Users\Admin\AppData\Local\Temp\3A64.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\3C1A.tmp"C:\Users\Admin\AppData\Local\Temp\3C1A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\3CF4.tmp"C:\Users\Admin\AppData\Local\Temp\3CF4.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\3D91.tmp"C:\Users\Admin\AppData\Local\Temp\3D91.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Users\Admin\AppData\Local\Temp\3F65.tmp"C:\Users\Admin\AppData\Local\Temp\3F65.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\4040.tmp"C:\Users\Admin\AppData\Local\Temp\4040.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\414A.tmp"C:\Users\Admin\AppData\Local\Temp\414A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\4244.tmp"C:\Users\Admin\AppData\Local\Temp\4244.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\431F.tmp"C:\Users\Admin\AppData\Local\Temp\431F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\43EA.tmp"C:\Users\Admin\AppData\Local\Temp\43EA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\4590.tmp"C:\Users\Admin\AppData\Local\Temp\4590.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\46B8.tmp"C:\Users\Admin\AppData\Local\Temp\46B8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\4764.tmp"C:\Users\Admin\AppData\Local\Temp\4764.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\483F.tmp"C:\Users\Admin\AppData\Local\Temp\483F.tmp"23⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\48FB.tmp"C:\Users\Admin\AppData\Local\Temp\48FB.tmp"24⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\49E5.tmp"C:\Users\Admin\AppData\Local\Temp\49E5.tmp"25⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\4A62.tmp"C:\Users\Admin\AppData\Local\Temp\4A62.tmp"26⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\4B4C.tmp"C:\Users\Admin\AppData\Local\Temp\4B4C.tmp"27⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\4C27.tmp"C:\Users\Admin\AppData\Local\Temp\4C27.tmp"28⤵
- Executes dropped EXE
PID:704 -
C:\Users\Admin\AppData\Local\Temp\4D02.tmp"C:\Users\Admin\AppData\Local\Temp\4D02.tmp"29⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\4DBD.tmp"C:\Users\Admin\AppData\Local\Temp\4DBD.tmp"30⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\4EB7.tmp"C:\Users\Admin\AppData\Local\Temp\4EB7.tmp"31⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\4F44.tmp"C:\Users\Admin\AppData\Local\Temp\4F44.tmp"32⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\501F.tmp"C:\Users\Admin\AppData\Local\Temp\501F.tmp"33⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\5119.tmp"C:\Users\Admin\AppData\Local\Temp\5119.tmp"34⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\5222.tmp"C:\Users\Admin\AppData\Local\Temp\5222.tmp"35⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\52DE.tmp"C:\Users\Admin\AppData\Local\Temp\52DE.tmp"36⤵
- Executes dropped EXE
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\5445.tmp"C:\Users\Admin\AppData\Local\Temp\5445.tmp"37⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\5501.tmp"C:\Users\Admin\AppData\Local\Temp\5501.tmp"38⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\55BC.tmp"C:\Users\Admin\AppData\Local\Temp\55BC.tmp"39⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\5697.tmp"C:\Users\Admin\AppData\Local\Temp\5697.tmp"40⤵
- Executes dropped EXE
PID:324 -
C:\Users\Admin\AppData\Local\Temp\5714.tmp"C:\Users\Admin\AppData\Local\Temp\5714.tmp"41⤵
- Executes dropped EXE
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\582D.tmp"C:\Users\Admin\AppData\Local\Temp\582D.tmp"42⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\58F8.tmp"C:\Users\Admin\AppData\Local\Temp\58F8.tmp"43⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\59C3.tmp"C:\Users\Admin\AppData\Local\Temp\59C3.tmp"44⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\5B3A.tmp"C:\Users\Admin\AppData\Local\Temp\5B3A.tmp"45⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\5BE6.tmp"C:\Users\Admin\AppData\Local\Temp\5BE6.tmp"46⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\5C73.tmp"C:\Users\Admin\AppData\Local\Temp\5C73.tmp"47⤵
- Executes dropped EXE
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\5D6D.tmp"C:\Users\Admin\AppData\Local\Temp\5D6D.tmp"48⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\5DFA.tmp"C:\Users\Admin\AppData\Local\Temp\5DFA.tmp"49⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\5F80.tmp"C:\Users\Admin\AppData\Local\Temp\5F80.tmp"50⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\603C.tmp"C:\Users\Admin\AppData\Local\Temp\603C.tmp"51⤵
- Executes dropped EXE
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\6116.tmp"C:\Users\Admin\AppData\Local\Temp\6116.tmp"52⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\61C2.tmp"C:\Users\Admin\AppData\Local\Temp\61C2.tmp"53⤵
- Executes dropped EXE
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\62CC.tmp"C:\Users\Admin\AppData\Local\Temp\62CC.tmp"54⤵
- Executes dropped EXE
PID:972 -
C:\Users\Admin\AppData\Local\Temp\6349.tmp"C:\Users\Admin\AppData\Local\Temp\6349.tmp"55⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\64DF.tmp"C:\Users\Admin\AppData\Local\Temp\64DF.tmp"56⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\65AA.tmp"C:\Users\Admin\AppData\Local\Temp\65AA.tmp"57⤵
- Executes dropped EXE
PID:788 -
C:\Users\Admin\AppData\Local\Temp\6647.tmp"C:\Users\Admin\AppData\Local\Temp\6647.tmp"58⤵
- Executes dropped EXE
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\679E.tmp"C:\Users\Admin\AppData\Local\Temp\679E.tmp"59⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\6869.tmp"C:\Users\Admin\AppData\Local\Temp\6869.tmp"60⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\68E6.tmp"C:\Users\Admin\AppData\Local\Temp\68E6.tmp"61⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\6AFA.tmp"C:\Users\Admin\AppData\Local\Temp\6AFA.tmp"62⤵
- Executes dropped EXE
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\6B67.tmp"C:\Users\Admin\AppData\Local\Temp\6B67.tmp"63⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\6BE4.tmp"C:\Users\Admin\AppData\Local\Temp\6BE4.tmp"64⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\6C61.tmp"C:\Users\Admin\AppData\Local\Temp\6C61.tmp"65⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\6FFB.tmp"C:\Users\Admin\AppData\Local\Temp\6FFB.tmp"66⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\7097.tmp"C:\Users\Admin\AppData\Local\Temp\7097.tmp"67⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\7133.tmp"C:\Users\Admin\AppData\Local\Temp\7133.tmp"68⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\71B0.tmp"C:\Users\Admin\AppData\Local\Temp\71B0.tmp"69⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\724D.tmp"C:\Users\Admin\AppData\Local\Temp\724D.tmp"70⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\72CA.tmp"C:\Users\Admin\AppData\Local\Temp\72CA.tmp"71⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\7385.tmp"C:\Users\Admin\AppData\Local\Temp\7385.tmp"72⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\75A8.tmp"C:\Users\Admin\AppData\Local\Temp\75A8.tmp"73⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\7635.tmp"C:\Users\Admin\AppData\Local\Temp\7635.tmp"74⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\76C1.tmp"C:\Users\Admin\AppData\Local\Temp\76C1.tmp"75⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\775E.tmp"C:\Users\Admin\AppData\Local\Temp\775E.tmp"76⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\7819.tmp"C:\Users\Admin\AppData\Local\Temp\7819.tmp"77⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\78B5.tmp"C:\Users\Admin\AppData\Local\Temp\78B5.tmp"78⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\7971.tmp"C:\Users\Admin\AppData\Local\Temp\7971.tmp"79⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\79EE.tmp"C:\Users\Admin\AppData\Local\Temp\79EE.tmp"80⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\7A8A.tmp"C:\Users\Admin\AppData\Local\Temp\7A8A.tmp"81⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\7B36.tmp"C:\Users\Admin\AppData\Local\Temp\7B36.tmp"82⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\7BC3.tmp"C:\Users\Admin\AppData\Local\Temp\7BC3.tmp"83⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\7C30.tmp"C:\Users\Admin\AppData\Local\Temp\7C30.tmp"84⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\7CDC.tmp"C:\Users\Admin\AppData\Local\Temp\7CDC.tmp"85⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\7DB7.tmp"C:\Users\Admin\AppData\Local\Temp\7DB7.tmp"86⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\7E43.tmp"C:\Users\Admin\AppData\Local\Temp\7E43.tmp"87⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"88⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\7F7C.tmp"C:\Users\Admin\AppData\Local\Temp\7F7C.tmp"89⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\8037.tmp"C:\Users\Admin\AppData\Local\Temp\8037.tmp"90⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\80A5.tmp"C:\Users\Admin\AppData\Local\Temp\80A5.tmp"91⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\8112.tmp"C:\Users\Admin\AppData\Local\Temp\8112.tmp"92⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\817F.tmp"C:\Users\Admin\AppData\Local\Temp\817F.tmp"93⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\820C.tmp"C:\Users\Admin\AppData\Local\Temp\820C.tmp"94⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\8289.tmp"C:\Users\Admin\AppData\Local\Temp\8289.tmp"95⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\8316.tmp"C:\Users\Admin\AppData\Local\Temp\8316.tmp"96⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\8393.tmp"C:\Users\Admin\AppData\Local\Temp\8393.tmp"97⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\8410.tmp"C:\Users\Admin\AppData\Local\Temp\8410.tmp"98⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\84BB.tmp"C:\Users\Admin\AppData\Local\Temp\84BB.tmp"99⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\8538.tmp"C:\Users\Admin\AppData\Local\Temp\8538.tmp"100⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\85D5.tmp"C:\Users\Admin\AppData\Local\Temp\85D5.tmp"101⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\86BF.tmp"C:\Users\Admin\AppData\Local\Temp\86BF.tmp"102⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\873C.tmp"C:\Users\Admin\AppData\Local\Temp\873C.tmp"103⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\87D8.tmp"C:\Users\Admin\AppData\Local\Temp\87D8.tmp"104⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\8855.tmp"C:\Users\Admin\AppData\Local\Temp\8855.tmp"105⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\88F2.tmp"C:\Users\Admin\AppData\Local\Temp\88F2.tmp"106⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\895F.tmp"C:\Users\Admin\AppData\Local\Temp\895F.tmp"107⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\89EC.tmp"C:\Users\Admin\AppData\Local\Temp\89EC.tmp"108⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\8A78.tmp"C:\Users\Admin\AppData\Local\Temp\8A78.tmp"109⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\8AE6.tmp"C:\Users\Admin\AppData\Local\Temp\8AE6.tmp"110⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\8B53.tmp"C:\Users\Admin\AppData\Local\Temp\8B53.tmp"111⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\8BC0.tmp"C:\Users\Admin\AppData\Local\Temp\8BC0.tmp"112⤵PID:496
-
C:\Users\Admin\AppData\Local\Temp\8C2E.tmp"C:\Users\Admin\AppData\Local\Temp\8C2E.tmp"113⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\8CCA.tmp"C:\Users\Admin\AppData\Local\Temp\8CCA.tmp"114⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\8D37.tmp"C:\Users\Admin\AppData\Local\Temp\8D37.tmp"115⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\8DC4.tmp"C:\Users\Admin\AppData\Local\Temp\8DC4.tmp"116⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\8E41.tmp"C:\Users\Admin\AppData\Local\Temp\8E41.tmp"117⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\8EAE.tmp"C:\Users\Admin\AppData\Local\Temp\8EAE.tmp"118⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\8F3B.tmp"C:\Users\Admin\AppData\Local\Temp\8F3B.tmp"119⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\8FD7.tmp"C:\Users\Admin\AppData\Local\Temp\8FD7.tmp"120⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\9064.tmp"C:\Users\Admin\AppData\Local\Temp\9064.tmp"121⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\9110.tmp"C:\Users\Admin\AppData\Local\Temp\9110.tmp"122⤵PID:2096
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-