Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
29-08-2023 18:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d7869b0fe72ea2af64dd5a101f3652d9_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
d7869b0fe72ea2af64dd5a101f3652d9_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
d7869b0fe72ea2af64dd5a101f3652d9_mafia_JC.exe
-
Size
488KB
-
MD5
d7869b0fe72ea2af64dd5a101f3652d9
-
SHA1
b29ccca350e28ae0ddd1e38d5460f7f50f4a978c
-
SHA256
af6d24bca0b546a5035bbe6ad21b2d87d6d00a3d21eec017169b782c72bceb0a
-
SHA512
2eccb0f24221951c35e87add709cd19aa7667ab011f73fbe2b670da726785fed7ba2d202c2a0a1bd275c7c3a861d8b6606c33a22db6cfd5e4abc5e50ca724a5c
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD77Nz+MnIhT+fHUmM0Le49PCYtosvM+45tesHT:/U5rCOTeiD7AQcua6ptzvDuJNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4276 6A04.tmp 1288 6AC0.tmp 1268 6BAA.tmp 4256 6C66.tmp 1436 6D02.tmp 2324 6DCD.tmp 2200 6EA8.tmp 2376 6FE0.tmp 4244 709C.tmp 3624 7167.tmp 4904 71E4.tmp 5028 72CE.tmp 3524 736B.tmp 1932 7455.tmp 4144 7511.tmp 3832 75BC.tmp 4952 7678.tmp 3584 7733.tmp 2140 781E.tmp 4008 78E9.tmp 1484 79E3.tmp 4468 7A70.tmp 988 7B3B.tmp 2000 7BA8.tmp 836 7C64.tmp 3384 7D1F.tmp 1580 7DBB.tmp 2276 7E38.tmp 2612 7F42.tmp 2372 800D.tmp 1836 80E8.tmp 4656 81A3.tmp 2264 826E.tmp 3800 82FB.tmp 4980 8378.tmp 4712 8405.tmp 3876 84C0.tmp 580 855C.tmp 4460 85F9.tmp 3836 8685.tmp 4384 8712.tmp 2220 879F.tmp 1452 882B.tmp 2032 88A8.tmp 3720 8925.tmp 4892 89A2.tmp 1008 8A2F.tmp 4856 8ABB.tmp 1256 8B48.tmp 4448 8BE4.tmp 1044 8C71.tmp 1320 8D0D.tmp 2172 8D7B.tmp 3364 8E17.tmp 1328 8E94.tmp 4392 8F4F.tmp 5048 8FEC.tmp 232 9088.tmp 1704 9124.tmp 4788 91A1.tmp 2344 923D.tmp 1312 92BA.tmp 1988 9366.tmp 4308 93E3.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1216 wrote to memory of 4276 1216 d7869b0fe72ea2af64dd5a101f3652d9_mafia_JC.exe 80 PID 1216 wrote to memory of 4276 1216 d7869b0fe72ea2af64dd5a101f3652d9_mafia_JC.exe 80 PID 1216 wrote to memory of 4276 1216 d7869b0fe72ea2af64dd5a101f3652d9_mafia_JC.exe 80 PID 4276 wrote to memory of 1288 4276 6A04.tmp 81 PID 4276 wrote to memory of 1288 4276 6A04.tmp 81 PID 4276 wrote to memory of 1288 4276 6A04.tmp 81 PID 1288 wrote to memory of 1268 1288 6AC0.tmp 82 PID 1288 wrote to memory of 1268 1288 6AC0.tmp 82 PID 1288 wrote to memory of 1268 1288 6AC0.tmp 82 PID 1268 wrote to memory of 4256 1268 6BAA.tmp 83 PID 1268 wrote to memory of 4256 1268 6BAA.tmp 83 PID 1268 wrote to memory of 4256 1268 6BAA.tmp 83 PID 4256 wrote to memory of 1436 4256 6C66.tmp 84 PID 4256 wrote to memory of 1436 4256 6C66.tmp 84 PID 4256 wrote to memory of 1436 4256 6C66.tmp 84 PID 1436 wrote to memory of 2324 1436 6D02.tmp 85 PID 1436 wrote to memory of 2324 1436 6D02.tmp 85 PID 1436 wrote to memory of 2324 1436 6D02.tmp 85 PID 2324 wrote to memory of 2200 2324 6DCD.tmp 86 PID 2324 wrote to memory of 2200 2324 6DCD.tmp 86 PID 2324 wrote to memory of 2200 2324 6DCD.tmp 86 PID 2200 wrote to memory of 2376 2200 6EA8.tmp 87 PID 2200 wrote to memory of 2376 2200 6EA8.tmp 87 PID 2200 wrote to memory of 2376 2200 6EA8.tmp 87 PID 2376 wrote to memory of 4244 2376 6FE0.tmp 89 PID 2376 wrote to memory of 4244 2376 6FE0.tmp 89 PID 2376 wrote to memory of 4244 2376 6FE0.tmp 89 PID 4244 wrote to memory of 3624 4244 709C.tmp 90 PID 4244 wrote to memory of 3624 4244 709C.tmp 90 PID 4244 wrote to memory of 3624 4244 709C.tmp 90 PID 3624 wrote to memory of 4904 3624 7167.tmp 91 PID 3624 wrote to memory of 4904 3624 7167.tmp 91 PID 3624 wrote to memory of 4904 3624 7167.tmp 91 PID 4904 wrote to memory of 5028 4904 71E4.tmp 92 PID 4904 wrote to memory of 5028 4904 71E4.tmp 92 PID 4904 wrote to memory of 5028 4904 71E4.tmp 92 PID 5028 wrote to memory of 3524 5028 72CE.tmp 93 PID 5028 wrote to memory of 3524 5028 72CE.tmp 93 PID 5028 wrote to memory of 3524 5028 72CE.tmp 93 PID 3524 wrote to memory of 1932 3524 736B.tmp 94 PID 3524 wrote to memory of 1932 3524 736B.tmp 94 PID 3524 wrote to memory of 1932 3524 736B.tmp 94 PID 1932 wrote to memory of 4144 1932 7455.tmp 95 PID 1932 wrote to memory of 4144 1932 7455.tmp 95 PID 1932 wrote to memory of 4144 1932 7455.tmp 95 PID 4144 wrote to memory of 3832 4144 7511.tmp 96 PID 4144 wrote to memory of 3832 4144 7511.tmp 96 PID 4144 wrote to memory of 3832 4144 7511.tmp 96 PID 3832 wrote to memory of 4952 3832 75BC.tmp 97 PID 3832 wrote to memory of 4952 3832 75BC.tmp 97 PID 3832 wrote to memory of 4952 3832 75BC.tmp 97 PID 4952 wrote to memory of 3584 4952 7678.tmp 100 PID 4952 wrote to memory of 3584 4952 7678.tmp 100 PID 4952 wrote to memory of 3584 4952 7678.tmp 100 PID 3584 wrote to memory of 2140 3584 7733.tmp 101 PID 3584 wrote to memory of 2140 3584 7733.tmp 101 PID 3584 wrote to memory of 2140 3584 7733.tmp 101 PID 2140 wrote to memory of 4008 2140 781E.tmp 102 PID 2140 wrote to memory of 4008 2140 781E.tmp 102 PID 2140 wrote to memory of 4008 2140 781E.tmp 102 PID 4008 wrote to memory of 1484 4008 78E9.tmp 103 PID 4008 wrote to memory of 1484 4008 78E9.tmp 103 PID 4008 wrote to memory of 1484 4008 78E9.tmp 103 PID 1484 wrote to memory of 4468 1484 79E3.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7869b0fe72ea2af64dd5a101f3652d9_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\d7869b0fe72ea2af64dd5a101f3652d9_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\7A70.tmp"C:\Users\Admin\AppData\Local\Temp\7A70.tmp"23⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"24⤵
- Executes dropped EXE
PID:988 -
C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"25⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\7C64.tmp"C:\Users\Admin\AppData\Local\Temp\7C64.tmp"26⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"27⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"28⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\7E38.tmp"C:\Users\Admin\AppData\Local\Temp\7E38.tmp"29⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\7F42.tmp"C:\Users\Admin\AppData\Local\Temp\7F42.tmp"30⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\800D.tmp"C:\Users\Admin\AppData\Local\Temp\800D.tmp"31⤵
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\80E8.tmp"C:\Users\Admin\AppData\Local\Temp\80E8.tmp"32⤵
- Executes dropped EXE
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\81A3.tmp"C:\Users\Admin\AppData\Local\Temp\81A3.tmp"33⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"34⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\82FB.tmp"C:\Users\Admin\AppData\Local\Temp\82FB.tmp"35⤵
- Executes dropped EXE
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\8378.tmp"C:\Users\Admin\AppData\Local\Temp\8378.tmp"36⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\8405.tmp"C:\Users\Admin\AppData\Local\Temp\8405.tmp"37⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\84C0.tmp"C:\Users\Admin\AppData\Local\Temp\84C0.tmp"38⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\855C.tmp"C:\Users\Admin\AppData\Local\Temp\855C.tmp"39⤵
- Executes dropped EXE
PID:580 -
C:\Users\Admin\AppData\Local\Temp\85F9.tmp"C:\Users\Admin\AppData\Local\Temp\85F9.tmp"40⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\8685.tmp"C:\Users\Admin\AppData\Local\Temp\8685.tmp"41⤵
- Executes dropped EXE
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\8712.tmp"C:\Users\Admin\AppData\Local\Temp\8712.tmp"42⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\879F.tmp"C:\Users\Admin\AppData\Local\Temp\879F.tmp"43⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\882B.tmp"C:\Users\Admin\AppData\Local\Temp\882B.tmp"44⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\88A8.tmp"C:\Users\Admin\AppData\Local\Temp\88A8.tmp"45⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\8925.tmp"C:\Users\Admin\AppData\Local\Temp\8925.tmp"46⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\89A2.tmp"C:\Users\Admin\AppData\Local\Temp\89A2.tmp"47⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"48⤵
- Executes dropped EXE
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"49⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\8B48.tmp"C:\Users\Admin\AppData\Local\Temp\8B48.tmp"50⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"51⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\8C71.tmp"C:\Users\Admin\AppData\Local\Temp\8C71.tmp"52⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"53⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"54⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\8E17.tmp"C:\Users\Admin\AppData\Local\Temp\8E17.tmp"55⤵
- Executes dropped EXE
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\8E94.tmp"C:\Users\Admin\AppData\Local\Temp\8E94.tmp"56⤵
- Executes dropped EXE
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"57⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"58⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"59⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"60⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"61⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\923D.tmp"C:\Users\Admin\AppData\Local\Temp\923D.tmp"62⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"63⤵
- Executes dropped EXE
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\9366.tmp"C:\Users\Admin\AppData\Local\Temp\9366.tmp"64⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"65⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\9441.tmp"C:\Users\Admin\AppData\Local\Temp\9441.tmp"66⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"67⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\951C.tmp"C:\Users\Admin\AppData\Local\Temp\951C.tmp"68⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\9579.tmp"C:\Users\Admin\AppData\Local\Temp\9579.tmp"69⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\95E7.tmp"C:\Users\Admin\AppData\Local\Temp\95E7.tmp"70⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"71⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\9710.tmp"C:\Users\Admin\AppData\Local\Temp\9710.tmp"72⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\978D.tmp"C:\Users\Admin\AppData\Local\Temp\978D.tmp"73⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\9819.tmp"C:\Users\Admin\AppData\Local\Temp\9819.tmp"74⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\9896.tmp"C:\Users\Admin\AppData\Local\Temp\9896.tmp"75⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\9904.tmp"C:\Users\Admin\AppData\Local\Temp\9904.tmp"76⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"77⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"78⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"79⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"80⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"81⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"82⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"83⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"84⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"85⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"86⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"87⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"88⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"89⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"90⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\A095.tmp"C:\Users\Admin\AppData\Local\Temp\A095.tmp"91⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"92⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"93⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"94⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"95⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"96⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\A383.tmp"C:\Users\Admin\AppData\Local\Temp\A383.tmp"97⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"98⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"99⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"100⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"101⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"102⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\A73C.tmp"C:\Users\Admin\AppData\Local\Temp\A73C.tmp"103⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"104⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"105⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"106⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"107⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"108⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"109⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"110⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"111⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"112⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"113⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\AD66.tmp"C:\Users\Admin\AppData\Local\Temp\AD66.tmp"114⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\AE12.tmp"C:\Users\Admin\AppData\Local\Temp\AE12.tmp"115⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"116⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"117⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"118⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\B054.tmp"C:\Users\Admin\AppData\Local\Temp\B054.tmp"119⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"120⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\B17D.tmp"C:\Users\Admin\AppData\Local\Temp\B17D.tmp"121⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\B229.tmp"C:\Users\Admin\AppData\Local\Temp\B229.tmp"122⤵PID:4800
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-