Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2023, 19:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cafa4c8a9b259565422ff661cd0f6262_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
cafa4c8a9b259565422ff661cd0f6262_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
cafa4c8a9b259565422ff661cd0f6262_mafia_JC.exe
-
Size
486KB
-
MD5
cafa4c8a9b259565422ff661cd0f6262
-
SHA1
deae5f53c74513c321c2cafde1aa2a90dcec2ac7
-
SHA256
d0e5743033533ccc1db36273d50ab3f433941ffeec00f9189c3544dcd48cba70
-
SHA512
254ddba5ae307987895366ed3283e9f6260640ad83830608b48340a7c54be08a5f5906535678ad333644a8b074aa0c98b8bb815a2125e1931d9980f5b00c8caa
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7ym8Nmsb7YGJchtXZih/zCNGUgRCOyvYuZQ3b:/U5rCOTeiDymts4GJcPIh/+GFCORPNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3700 852E.tmp 2988 8628.tmp 1820 8712.tmp 4560 87BE.tmp 2944 8899.tmp 3836 8A10.tmp 2536 8BC5.tmp 2700 8C90.tmp 2752 8DB9.tmp 392 8F11.tmp 456 8FCC.tmp 4180 90F5.tmp 4132 91E0.tmp 380 A103.tmp 2616 A24B.tmp 5064 A354.tmp 3660 A42F.tmp 5096 A577.tmp 3904 A6DF.tmp 4408 A78A.tmp 1752 A8B3.tmp 2560 A97E.tmp 4404 AA78.tmp 3296 ABA1.tmp 4820 AC9B.tmp 2340 AD66.tmp 1428 AEBE.tmp 1340 AFD7.tmp 4788 B0A3.tmp 4172 B1AC.tmp 2528 B323.tmp 812 B48B.tmp 5092 B536.tmp 4868 B621.tmp 1312 B6FC.tmp 2240 B7F6.tmp 4796 B892.tmp 5084 B96D.tmp 1888 BA47.tmp 2448 BAD4.tmp 3656 BB61.tmp 2212 BBFD.tmp 4004 BC6A.tmp 4236 BCE7.tmp 3816 BDA3.tmp 4340 BE2F.tmp 1812 BF1A.tmp 2236 BFA6.tmp 536 C043.tmp 4736 C0CF.tmp 1496 C1F8.tmp 3328 C265.tmp 972 C2F2.tmp 2396 C38E.tmp 692 C41B.tmp 2836 C498.tmp 1780 C5A2.tmp 4480 C62E.tmp 4476 C6BB.tmp 2888 C728.tmp 1568 C7C4.tmp 3820 C841.tmp 436 C8CE.tmp 32 CA07.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3328 wrote to memory of 3700 3328 cafa4c8a9b259565422ff661cd0f6262_mafia_JC.exe 81 PID 3328 wrote to memory of 3700 3328 cafa4c8a9b259565422ff661cd0f6262_mafia_JC.exe 81 PID 3328 wrote to memory of 3700 3328 cafa4c8a9b259565422ff661cd0f6262_mafia_JC.exe 81 PID 3700 wrote to memory of 2988 3700 852E.tmp 82 PID 3700 wrote to memory of 2988 3700 852E.tmp 82 PID 3700 wrote to memory of 2988 3700 852E.tmp 82 PID 2988 wrote to memory of 1820 2988 8628.tmp 83 PID 2988 wrote to memory of 1820 2988 8628.tmp 83 PID 2988 wrote to memory of 1820 2988 8628.tmp 83 PID 1820 wrote to memory of 4560 1820 8712.tmp 84 PID 1820 wrote to memory of 4560 1820 8712.tmp 84 PID 1820 wrote to memory of 4560 1820 8712.tmp 84 PID 4560 wrote to memory of 2944 4560 87BE.tmp 85 PID 4560 wrote to memory of 2944 4560 87BE.tmp 85 PID 4560 wrote to memory of 2944 4560 87BE.tmp 85 PID 2944 wrote to memory of 3836 2944 8899.tmp 86 PID 2944 wrote to memory of 3836 2944 8899.tmp 86 PID 2944 wrote to memory of 3836 2944 8899.tmp 86 PID 3836 wrote to memory of 2536 3836 8A10.tmp 87 PID 3836 wrote to memory of 2536 3836 8A10.tmp 87 PID 3836 wrote to memory of 2536 3836 8A10.tmp 87 PID 2536 wrote to memory of 2700 2536 8BC5.tmp 88 PID 2536 wrote to memory of 2700 2536 8BC5.tmp 88 PID 2536 wrote to memory of 2700 2536 8BC5.tmp 88 PID 2700 wrote to memory of 2752 2700 8C90.tmp 89 PID 2700 wrote to memory of 2752 2700 8C90.tmp 89 PID 2700 wrote to memory of 2752 2700 8C90.tmp 89 PID 2752 wrote to memory of 392 2752 8DB9.tmp 90 PID 2752 wrote to memory of 392 2752 8DB9.tmp 90 PID 2752 wrote to memory of 392 2752 8DB9.tmp 90 PID 392 wrote to memory of 456 392 8F11.tmp 91 PID 392 wrote to memory of 456 392 8F11.tmp 91 PID 392 wrote to memory of 456 392 8F11.tmp 91 PID 456 wrote to memory of 4180 456 8FCC.tmp 92 PID 456 wrote to memory of 4180 456 8FCC.tmp 92 PID 456 wrote to memory of 4180 456 8FCC.tmp 92 PID 4180 wrote to memory of 4132 4180 90F5.tmp 93 PID 4180 wrote to memory of 4132 4180 90F5.tmp 93 PID 4180 wrote to memory of 4132 4180 90F5.tmp 93 PID 4132 wrote to memory of 380 4132 91E0.tmp 94 PID 4132 wrote to memory of 380 4132 91E0.tmp 94 PID 4132 wrote to memory of 380 4132 91E0.tmp 94 PID 380 wrote to memory of 2616 380 A103.tmp 95 PID 380 wrote to memory of 2616 380 A103.tmp 95 PID 380 wrote to memory of 2616 380 A103.tmp 95 PID 2616 wrote to memory of 5064 2616 A24B.tmp 96 PID 2616 wrote to memory of 5064 2616 A24B.tmp 96 PID 2616 wrote to memory of 5064 2616 A24B.tmp 96 PID 5064 wrote to memory of 3660 5064 A354.tmp 97 PID 5064 wrote to memory of 3660 5064 A354.tmp 97 PID 5064 wrote to memory of 3660 5064 A354.tmp 97 PID 3660 wrote to memory of 5096 3660 A42F.tmp 98 PID 3660 wrote to memory of 5096 3660 A42F.tmp 98 PID 3660 wrote to memory of 5096 3660 A42F.tmp 98 PID 5096 wrote to memory of 3904 5096 A577.tmp 99 PID 5096 wrote to memory of 3904 5096 A577.tmp 99 PID 5096 wrote to memory of 3904 5096 A577.tmp 99 PID 3904 wrote to memory of 4408 3904 A6DF.tmp 100 PID 3904 wrote to memory of 4408 3904 A6DF.tmp 100 PID 3904 wrote to memory of 4408 3904 A6DF.tmp 100 PID 4408 wrote to memory of 1752 4408 A78A.tmp 101 PID 4408 wrote to memory of 1752 4408 A78A.tmp 101 PID 4408 wrote to memory of 1752 4408 A78A.tmp 101 PID 1752 wrote to memory of 2560 1752 A8B3.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\cafa4c8a9b259565422ff661cd0f6262_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\cafa4c8a9b259565422ff661cd0f6262_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\852E.tmp"C:\Users\Admin\AppData\Local\Temp\852E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\8628.tmp"C:\Users\Admin\AppData\Local\Temp\8628.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\8712.tmp"C:\Users\Admin\AppData\Local\Temp\8712.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\87BE.tmp"C:\Users\Admin\AppData\Local\Temp\87BE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\8899.tmp"C:\Users\Admin\AppData\Local\Temp\8899.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\8A10.tmp"C:\Users\Admin\AppData\Local\Temp\8A10.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\91E0.tmp"C:\Users\Admin\AppData\Local\Temp\91E0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\A103.tmp"C:\Users\Admin\AppData\Local\Temp\A103.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\A24B.tmp"C:\Users\Admin\AppData\Local\Temp\A24B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\A354.tmp"C:\Users\Admin\AppData\Local\Temp\A354.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\A577.tmp"C:\Users\Admin\AppData\Local\Temp\A577.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\A78A.tmp"C:\Users\Admin\AppData\Local\Temp\A78A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"23⤵
- Executes dropped EXE
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"24⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"25⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"26⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\AD66.tmp"C:\Users\Admin\AppData\Local\Temp\AD66.tmp"27⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"28⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"29⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"30⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"31⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\B323.tmp"C:\Users\Admin\AppData\Local\Temp\B323.tmp"32⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\B48B.tmp"C:\Users\Admin\AppData\Local\Temp\B48B.tmp"33⤵
- Executes dropped EXE
PID:812 -
C:\Users\Admin\AppData\Local\Temp\B536.tmp"C:\Users\Admin\AppData\Local\Temp\B536.tmp"34⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\B621.tmp"C:\Users\Admin\AppData\Local\Temp\B621.tmp"35⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"36⤵
- Executes dropped EXE
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"37⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\B892.tmp"C:\Users\Admin\AppData\Local\Temp\B892.tmp"38⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\B96D.tmp"C:\Users\Admin\AppData\Local\Temp\B96D.tmp"39⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\BA47.tmp"C:\Users\Admin\AppData\Local\Temp\BA47.tmp"40⤵
- Executes dropped EXE
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"41⤵
- Executes dropped EXE
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\BB61.tmp"C:\Users\Admin\AppData\Local\Temp\BB61.tmp"42⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"43⤵
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"44⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"45⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"46⤵
- Executes dropped EXE
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"47⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"48⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"49⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\C043.tmp"C:\Users\Admin\AppData\Local\Temp\C043.tmp"50⤵
- Executes dropped EXE
PID:536 -
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"51⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"52⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"53⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"54⤵
- Executes dropped EXE
PID:972 -
C:\Users\Admin\AppData\Local\Temp\C38E.tmp"C:\Users\Admin\AppData\Local\Temp\C38E.tmp"55⤵
- Executes dropped EXE
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\C41B.tmp"C:\Users\Admin\AppData\Local\Temp\C41B.tmp"56⤵
- Executes dropped EXE
PID:692 -
C:\Users\Admin\AppData\Local\Temp\C498.tmp"C:\Users\Admin\AppData\Local\Temp\C498.tmp"57⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"58⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\C62E.tmp"C:\Users\Admin\AppData\Local\Temp\C62E.tmp"59⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"60⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\C728.tmp"C:\Users\Admin\AppData\Local\Temp\C728.tmp"61⤵
- Executes dropped EXE
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"62⤵
- Executes dropped EXE
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\C841.tmp"C:\Users\Admin\AppData\Local\Temp\C841.tmp"63⤵
- Executes dropped EXE
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"64⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\CA07.tmp"C:\Users\Admin\AppData\Local\Temp\CA07.tmp"65⤵
- Executes dropped EXE
PID:32 -
C:\Users\Admin\AppData\Local\Temp\CA74.tmp"C:\Users\Admin\AppData\Local\Temp\CA74.tmp"66⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"67⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"68⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\CBBC.tmp"C:\Users\Admin\AppData\Local\Temp\CBBC.tmp"69⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\CC49.tmp"C:\Users\Admin\AppData\Local\Temp\CC49.tmp"70⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\CCD5.tmp"C:\Users\Admin\AppData\Local\Temp\CCD5.tmp"71⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\CD62.tmp"C:\Users\Admin\AppData\Local\Temp\CD62.tmp"72⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\CE0E.tmp"C:\Users\Admin\AppData\Local\Temp\CE0E.tmp"73⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"74⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\CEF8.tmp"C:\Users\Admin\AppData\Local\Temp\CEF8.tmp"75⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\CF85.tmp"C:\Users\Admin\AppData\Local\Temp\CF85.tmp"76⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\D021.tmp"C:\Users\Admin\AppData\Local\Temp\D021.tmp"77⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\D09E.tmp"C:\Users\Admin\AppData\Local\Temp\D09E.tmp"78⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\D10B.tmp"C:\Users\Admin\AppData\Local\Temp\D10B.tmp"79⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\D198.tmp"C:\Users\Admin\AppData\Local\Temp\D198.tmp"80⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\D254.tmp"C:\Users\Admin\AppData\Local\Temp\D254.tmp"81⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"82⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\D35D.tmp"C:\Users\Admin\AppData\Local\Temp\D35D.tmp"83⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\D3EA.tmp"C:\Users\Admin\AppData\Local\Temp\D3EA.tmp"84⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\D486.tmp"C:\Users\Admin\AppData\Local\Temp\D486.tmp"85⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\D513.tmp"C:\Users\Admin\AppData\Local\Temp\D513.tmp"86⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"87⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\D63C.tmp"C:\Users\Admin\AppData\Local\Temp\D63C.tmp"88⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\D6A9.tmp"C:\Users\Admin\AppData\Local\Temp\D6A9.tmp"89⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\D707.tmp"C:\Users\Admin\AppData\Local\Temp\D707.tmp"90⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"91⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\D830.tmp"C:\Users\Admin\AppData\Local\Temp\D830.tmp"92⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\D8AD.tmp"C:\Users\Admin\AppData\Local\Temp\D8AD.tmp"93⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\D939.tmp"C:\Users\Admin\AppData\Local\Temp\D939.tmp"94⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"95⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\DA62.tmp"C:\Users\Admin\AppData\Local\Temp\DA62.tmp"96⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\DB0E.tmp"C:\Users\Admin\AppData\Local\Temp\DB0E.tmp"97⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\DB7B.tmp"C:\Users\Admin\AppData\Local\Temp\DB7B.tmp"98⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\DC08.tmp"C:\Users\Admin\AppData\Local\Temp\DC08.tmp"99⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\DCA4.tmp"C:\Users\Admin\AppData\Local\Temp\DCA4.tmp"100⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\DD21.tmp"C:\Users\Admin\AppData\Local\Temp\DD21.tmp"101⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\DD9E.tmp"C:\Users\Admin\AppData\Local\Temp\DD9E.tmp"102⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\DE2B.tmp"C:\Users\Admin\AppData\Local\Temp\DE2B.tmp"103⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\DEB7.tmp"C:\Users\Admin\AppData\Local\Temp\DEB7.tmp"104⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\DF44.tmp"C:\Users\Admin\AppData\Local\Temp\DF44.tmp"105⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"106⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\E00F.tmp"C:\Users\Admin\AppData\Local\Temp\E00F.tmp"107⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\E07D.tmp"C:\Users\Admin\AppData\Local\Temp\E07D.tmp"108⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"109⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\E177.tmp"C:\Users\Admin\AppData\Local\Temp\E177.tmp"110⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\E1F4.tmp"C:\Users\Admin\AppData\Local\Temp\E1F4.tmp"111⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\E280.tmp"C:\Users\Admin\AppData\Local\Temp\E280.tmp"112⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\E2DE.tmp"C:\Users\Admin\AppData\Local\Temp\E2DE.tmp"113⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\E38A.tmp"C:\Users\Admin\AppData\Local\Temp\E38A.tmp"114⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\E416.tmp"C:\Users\Admin\AppData\Local\Temp\E416.tmp"115⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\E493.tmp"C:\Users\Admin\AppData\Local\Temp\E493.tmp"116⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\E510.tmp"C:\Users\Admin\AppData\Local\Temp\E510.tmp"117⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\E56E.tmp"C:\Users\Admin\AppData\Local\Temp\E56E.tmp"118⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\E5CC.tmp"C:\Users\Admin\AppData\Local\Temp\E5CC.tmp"119⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\E649.tmp"C:\Users\Admin\AppData\Local\Temp\E649.tmp"120⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"121⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\E762.tmp"C:\Users\Admin\AppData\Local\Temp\E762.tmp"122⤵PID:1140
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-