Analysis
-
max time kernel
152s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
29-09-2023 18:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2023-08-26_c54c70ef53fed03cd211e83d611c7899_mafia_JC.exe
Resource
win7-20230831-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2023-08-26_c54c70ef53fed03cd211e83d611c7899_mafia_JC.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2023-08-26_c54c70ef53fed03cd211e83d611c7899_mafia_JC.exe
-
Size
520KB
-
MD5
c54c70ef53fed03cd211e83d611c7899
-
SHA1
f2c5ab3b864d2e63cb9f140de16c9788d0d00076
-
SHA256
8b9135e09775fb570c49f8e7a12386f76449955f02154b8e332e6486c27164f9
-
SHA512
62983fba764dffe0972ce162e51fa833a4780d9e9dc3f434d9dfbe0767abb9cbef68d18593267c526420702fc0cad13ac6526ceff61e35b4efd6818bb263226c
-
SSDEEP
12288:YcRnG07aWiU2U0HwbTqR5mkGMNRPmWILk2sNZ:YcI0BiUF0QbTu5EaPmCNN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 372 EE0.tmp 3164 173C.tmp 3396 18A4.tmp 2308 19FB.tmp 4000 1BE0.tmp 4864 1D28.tmp 2964 1E60.tmp 2836 1FB8.tmp 2556 20F1.tmp 3680 2219.tmp 3316 22F4.tmp 4404 241D.tmp 4944 24E8.tmp 2216 25D3.tmp 1420 271B.tmp 3924 27F5.tmp 1916 292E.tmp 4804 29DA.tmp 1268 2A76.tmp 912 2B32.tmp 2132 2C1C.tmp 2464 2CC8.tmp 4808 2DC2.tmp 1184 2E7D.tmp 4140 2F77.tmp 2108 3014.tmp 2628 30FE.tmp 2284 318B.tmp 2832 32A4.tmp 4764 338E.tmp 4272 341B.tmp 2712 34C7.tmp 4860 3582.tmp 3756 363E.tmp 3320 36DA.tmp 8 3776.tmp 1248 3812.tmp 4656 38BE.tmp 5048 396A.tmp 496 3A26.tmp 5016 3A93.tmp 2836 3B10.tmp 4676 3B8D.tmp 3816 3C0A.tmp 4520 3C87.tmp 2364 3D43.tmp 4364 3DB0.tmp 2060 3E1D.tmp 2004 3EC9.tmp 3308 3F56.tmp 2068 3FE2.tmp 3956 405F.tmp 3924 40FC.tmp 1152 4188.tmp 1660 4244.tmp 1720 42C1.tmp 2968 435D.tmp 1768 4409.tmp 388 4496.tmp 2132 4522.tmp 2464 45AF.tmp 1436 464B.tmp 4688 46C8.tmp 932 4755.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4128 wrote to memory of 372 4128 2023-08-26_c54c70ef53fed03cd211e83d611c7899_mafia_JC.exe 87 PID 4128 wrote to memory of 372 4128 2023-08-26_c54c70ef53fed03cd211e83d611c7899_mafia_JC.exe 87 PID 4128 wrote to memory of 372 4128 2023-08-26_c54c70ef53fed03cd211e83d611c7899_mafia_JC.exe 87 PID 372 wrote to memory of 3164 372 EE0.tmp 88 PID 372 wrote to memory of 3164 372 EE0.tmp 88 PID 372 wrote to memory of 3164 372 EE0.tmp 88 PID 3164 wrote to memory of 3396 3164 173C.tmp 90 PID 3164 wrote to memory of 3396 3164 173C.tmp 90 PID 3164 wrote to memory of 3396 3164 173C.tmp 90 PID 3396 wrote to memory of 2308 3396 18A4.tmp 91 PID 3396 wrote to memory of 2308 3396 18A4.tmp 91 PID 3396 wrote to memory of 2308 3396 18A4.tmp 91 PID 2308 wrote to memory of 4000 2308 19FB.tmp 92 PID 2308 wrote to memory of 4000 2308 19FB.tmp 92 PID 2308 wrote to memory of 4000 2308 19FB.tmp 92 PID 4000 wrote to memory of 4864 4000 1BE0.tmp 93 PID 4000 wrote to memory of 4864 4000 1BE0.tmp 93 PID 4000 wrote to memory of 4864 4000 1BE0.tmp 93 PID 4864 wrote to memory of 2964 4864 1D28.tmp 94 PID 4864 wrote to memory of 2964 4864 1D28.tmp 94 PID 4864 wrote to memory of 2964 4864 1D28.tmp 94 PID 2964 wrote to memory of 2836 2964 1E60.tmp 95 PID 2964 wrote to memory of 2836 2964 1E60.tmp 95 PID 2964 wrote to memory of 2836 2964 1E60.tmp 95 PID 2836 wrote to memory of 2556 2836 1FB8.tmp 96 PID 2836 wrote to memory of 2556 2836 1FB8.tmp 96 PID 2836 wrote to memory of 2556 2836 1FB8.tmp 96 PID 2556 wrote to memory of 3680 2556 20F1.tmp 97 PID 2556 wrote to memory of 3680 2556 20F1.tmp 97 PID 2556 wrote to memory of 3680 2556 20F1.tmp 97 PID 3680 wrote to memory of 3316 3680 2219.tmp 98 PID 3680 wrote to memory of 3316 3680 2219.tmp 98 PID 3680 wrote to memory of 3316 3680 2219.tmp 98 PID 3316 wrote to memory of 4404 3316 22F4.tmp 99 PID 3316 wrote to memory of 4404 3316 22F4.tmp 99 PID 3316 wrote to memory of 4404 3316 22F4.tmp 99 PID 4404 wrote to memory of 4944 4404 241D.tmp 100 PID 4404 wrote to memory of 4944 4404 241D.tmp 100 PID 4404 wrote to memory of 4944 4404 241D.tmp 100 PID 4944 wrote to memory of 2216 4944 24E8.tmp 101 PID 4944 wrote to memory of 2216 4944 24E8.tmp 101 PID 4944 wrote to memory of 2216 4944 24E8.tmp 101 PID 2216 wrote to memory of 1420 2216 25D3.tmp 102 PID 2216 wrote to memory of 1420 2216 25D3.tmp 102 PID 2216 wrote to memory of 1420 2216 25D3.tmp 102 PID 1420 wrote to memory of 3924 1420 271B.tmp 103 PID 1420 wrote to memory of 3924 1420 271B.tmp 103 PID 1420 wrote to memory of 3924 1420 271B.tmp 103 PID 3924 wrote to memory of 1916 3924 27F5.tmp 104 PID 3924 wrote to memory of 1916 3924 27F5.tmp 104 PID 3924 wrote to memory of 1916 3924 27F5.tmp 104 PID 1916 wrote to memory of 4804 1916 292E.tmp 107 PID 1916 wrote to memory of 4804 1916 292E.tmp 107 PID 1916 wrote to memory of 4804 1916 292E.tmp 107 PID 4804 wrote to memory of 1268 4804 29DA.tmp 108 PID 4804 wrote to memory of 1268 4804 29DA.tmp 108 PID 4804 wrote to memory of 1268 4804 29DA.tmp 108 PID 1268 wrote to memory of 912 1268 2A76.tmp 109 PID 1268 wrote to memory of 912 1268 2A76.tmp 109 PID 1268 wrote to memory of 912 1268 2A76.tmp 109 PID 912 wrote to memory of 2132 912 2B32.tmp 110 PID 912 wrote to memory of 2132 912 2B32.tmp 110 PID 912 wrote to memory of 2132 912 2B32.tmp 110 PID 2132 wrote to memory of 2464 2132 2C1C.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-26_c54c70ef53fed03cd211e83d611c7899_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-26_c54c70ef53fed03cd211e83d611c7899_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\EE0.tmp"C:\Users\Admin\AppData\Local\Temp\EE0.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Users\Admin\AppData\Local\Temp\173C.tmp"C:\Users\Admin\AppData\Local\Temp\173C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\18A4.tmp"C:\Users\Admin\AppData\Local\Temp\18A4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\19FB.tmp"C:\Users\Admin\AppData\Local\Temp\19FB.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\1D28.tmp"C:\Users\Admin\AppData\Local\Temp\1D28.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\1E60.tmp"C:\Users\Admin\AppData\Local\Temp\1E60.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\1FB8.tmp"C:\Users\Admin\AppData\Local\Temp\1FB8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\20F1.tmp"C:\Users\Admin\AppData\Local\Temp\20F1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\2219.tmp"C:\Users\Admin\AppData\Local\Temp\2219.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\22F4.tmp"C:\Users\Admin\AppData\Local\Temp\22F4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\241D.tmp"C:\Users\Admin\AppData\Local\Temp\241D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\24E8.tmp"C:\Users\Admin\AppData\Local\Temp\24E8.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\25D3.tmp"C:\Users\Admin\AppData\Local\Temp\25D3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\271B.tmp"C:\Users\Admin\AppData\Local\Temp\271B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\27F5.tmp"C:\Users\Admin\AppData\Local\Temp\27F5.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\292E.tmp"C:\Users\Admin\AppData\Local\Temp\292E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\29DA.tmp"C:\Users\Admin\AppData\Local\Temp\29DA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\2A76.tmp"C:\Users\Admin\AppData\Local\Temp\2A76.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\2B32.tmp"C:\Users\Admin\AppData\Local\Temp\2B32.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\2C1C.tmp"C:\Users\Admin\AppData\Local\Temp\2C1C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"23⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"24⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\2E7D.tmp"C:\Users\Admin\AppData\Local\Temp\2E7D.tmp"25⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\2F77.tmp"C:\Users\Admin\AppData\Local\Temp\2F77.tmp"26⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\3014.tmp"C:\Users\Admin\AppData\Local\Temp\3014.tmp"27⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\30FE.tmp"C:\Users\Admin\AppData\Local\Temp\30FE.tmp"28⤵
- Executes dropped EXE
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\318B.tmp"C:\Users\Admin\AppData\Local\Temp\318B.tmp"29⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\3227.tmp"C:\Users\Admin\AppData\Local\Temp\3227.tmp"30⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\32A4.tmp"C:\Users\Admin\AppData\Local\Temp\32A4.tmp"31⤵
- Executes dropped EXE
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"32⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"33⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\34C7.tmp"C:\Users\Admin\AppData\Local\Temp\34C7.tmp"34⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"35⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\363E.tmp"C:\Users\Admin\AppData\Local\Temp\363E.tmp"36⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\36DA.tmp"C:\Users\Admin\AppData\Local\Temp\36DA.tmp"37⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\3776.tmp"C:\Users\Admin\AppData\Local\Temp\3776.tmp"38⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\3812.tmp"C:\Users\Admin\AppData\Local\Temp\3812.tmp"39⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\38BE.tmp"C:\Users\Admin\AppData\Local\Temp\38BE.tmp"40⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\396A.tmp"C:\Users\Admin\AppData\Local\Temp\396A.tmp"41⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\3A26.tmp"C:\Users\Admin\AppData\Local\Temp\3A26.tmp"42⤵
- Executes dropped EXE
PID:496 -
C:\Users\Admin\AppData\Local\Temp\3A93.tmp"C:\Users\Admin\AppData\Local\Temp\3A93.tmp"43⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\3B10.tmp"C:\Users\Admin\AppData\Local\Temp\3B10.tmp"44⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\3B8D.tmp"C:\Users\Admin\AppData\Local\Temp\3B8D.tmp"45⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\3C0A.tmp"C:\Users\Admin\AppData\Local\Temp\3C0A.tmp"46⤵
- Executes dropped EXE
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\3C87.tmp"C:\Users\Admin\AppData\Local\Temp\3C87.tmp"47⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\3D43.tmp"C:\Users\Admin\AppData\Local\Temp\3D43.tmp"48⤵
- Executes dropped EXE
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\3DB0.tmp"C:\Users\Admin\AppData\Local\Temp\3DB0.tmp"49⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\3E1D.tmp"C:\Users\Admin\AppData\Local\Temp\3E1D.tmp"50⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\3EC9.tmp"C:\Users\Admin\AppData\Local\Temp\3EC9.tmp"51⤵
- Executes dropped EXE
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\3F56.tmp"C:\Users\Admin\AppData\Local\Temp\3F56.tmp"52⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\3FE2.tmp"C:\Users\Admin\AppData\Local\Temp\3FE2.tmp"53⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\405F.tmp"C:\Users\Admin\AppData\Local\Temp\405F.tmp"54⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\40FC.tmp"C:\Users\Admin\AppData\Local\Temp\40FC.tmp"55⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\4188.tmp"C:\Users\Admin\AppData\Local\Temp\4188.tmp"56⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\4244.tmp"C:\Users\Admin\AppData\Local\Temp\4244.tmp"57⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\42C1.tmp"C:\Users\Admin\AppData\Local\Temp\42C1.tmp"58⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\435D.tmp"C:\Users\Admin\AppData\Local\Temp\435D.tmp"59⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\4409.tmp"C:\Users\Admin\AppData\Local\Temp\4409.tmp"60⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\4496.tmp"C:\Users\Admin\AppData\Local\Temp\4496.tmp"61⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\4522.tmp"C:\Users\Admin\AppData\Local\Temp\4522.tmp"62⤵
- Executes dropped EXE
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\45AF.tmp"C:\Users\Admin\AppData\Local\Temp\45AF.tmp"63⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\464B.tmp"C:\Users\Admin\AppData\Local\Temp\464B.tmp"64⤵
- Executes dropped EXE
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\46C8.tmp"C:\Users\Admin\AppData\Local\Temp\46C8.tmp"65⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\4755.tmp"C:\Users\Admin\AppData\Local\Temp\4755.tmp"66⤵
- Executes dropped EXE
PID:932 -
C:\Users\Admin\AppData\Local\Temp\47C2.tmp"C:\Users\Admin\AppData\Local\Temp\47C2.tmp"67⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\483F.tmp"C:\Users\Admin\AppData\Local\Temp\483F.tmp"68⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\48EB.tmp"C:\Users\Admin\AppData\Local\Temp\48EB.tmp"69⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\4968.tmp"C:\Users\Admin\AppData\Local\Temp\4968.tmp"70⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\49E5.tmp"C:\Users\Admin\AppData\Local\Temp\49E5.tmp"71⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\4A91.tmp"C:\Users\Admin\AppData\Local\Temp\4A91.tmp"72⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\4B1D.tmp"C:\Users\Admin\AppData\Local\Temp\4B1D.tmp"73⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\4B8B.tmp"C:\Users\Admin\AppData\Local\Temp\4B8B.tmp"74⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\4BF8.tmp"C:\Users\Admin\AppData\Local\Temp\4BF8.tmp"75⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\4C85.tmp"C:\Users\Admin\AppData\Local\Temp\4C85.tmp"76⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\4D02.tmp"C:\Users\Admin\AppData\Local\Temp\4D02.tmp"77⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\4D9E.tmp"C:\Users\Admin\AppData\Local\Temp\4D9E.tmp"78⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\4E3A.tmp"C:\Users\Admin\AppData\Local\Temp\4E3A.tmp"79⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\4EB7.tmp"C:\Users\Admin\AppData\Local\Temp\4EB7.tmp"80⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\4F54.tmp"C:\Users\Admin\AppData\Local\Temp\4F54.tmp"81⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\4FE0.tmp"C:\Users\Admin\AppData\Local\Temp\4FE0.tmp"82⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\507C.tmp"C:\Users\Admin\AppData\Local\Temp\507C.tmp"83⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\50F9.tmp"C:\Users\Admin\AppData\Local\Temp\50F9.tmp"84⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\5157.tmp"C:\Users\Admin\AppData\Local\Temp\5157.tmp"85⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\51C5.tmp"C:\Users\Admin\AppData\Local\Temp\51C5.tmp"86⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\5270.tmp"C:\Users\Admin\AppData\Local\Temp\5270.tmp"87⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\52FD.tmp"C:\Users\Admin\AppData\Local\Temp\52FD.tmp"88⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\5399.tmp"C:\Users\Admin\AppData\Local\Temp\5399.tmp"89⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\5407.tmp"C:\Users\Admin\AppData\Local\Temp\5407.tmp"90⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\5474.tmp"C:\Users\Admin\AppData\Local\Temp\5474.tmp"91⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\5501.tmp"C:\Users\Admin\AppData\Local\Temp\5501.tmp"92⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\559D.tmp"C:\Users\Admin\AppData\Local\Temp\559D.tmp"93⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\5678.tmp"C:\Users\Admin\AppData\Local\Temp\5678.tmp"94⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\56E5.tmp"C:\Users\Admin\AppData\Local\Temp\56E5.tmp"95⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\5781.tmp"C:\Users\Admin\AppData\Local\Temp\5781.tmp"96⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\57FE.tmp"C:\Users\Admin\AppData\Local\Temp\57FE.tmp"97⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\589B.tmp"C:\Users\Admin\AppData\Local\Temp\589B.tmp"98⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\5927.tmp"C:\Users\Admin\AppData\Local\Temp\5927.tmp"99⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\59D3.tmp"C:\Users\Admin\AppData\Local\Temp\59D3.tmp"100⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\5A60.tmp"C:\Users\Admin\AppData\Local\Temp\5A60.tmp"101⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"102⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\5B5A.tmp"C:\Users\Admin\AppData\Local\Temp\5B5A.tmp"103⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\5C06.tmp"C:\Users\Admin\AppData\Local\Temp\5C06.tmp"104⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\5C92.tmp"C:\Users\Admin\AppData\Local\Temp\5C92.tmp"105⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\5D00.tmp"C:\Users\Admin\AppData\Local\Temp\5D00.tmp"106⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\5D6D.tmp"C:\Users\Admin\AppData\Local\Temp\5D6D.tmp"107⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\5E19.tmp"C:\Users\Admin\AppData\Local\Temp\5E19.tmp"108⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\5E96.tmp"C:\Users\Admin\AppData\Local\Temp\5E96.tmp"109⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\5F22.tmp"C:\Users\Admin\AppData\Local\Temp\5F22.tmp"110⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\5F9F.tmp"C:\Users\Admin\AppData\Local\Temp\5F9F.tmp"111⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\600D.tmp"C:\Users\Admin\AppData\Local\Temp\600D.tmp"112⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\608A.tmp"C:\Users\Admin\AppData\Local\Temp\608A.tmp"113⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\60F7.tmp"C:\Users\Admin\AppData\Local\Temp\60F7.tmp"114⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\6184.tmp"C:\Users\Admin\AppData\Local\Temp\6184.tmp"115⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\6220.tmp"C:\Users\Admin\AppData\Local\Temp\6220.tmp"116⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\62AD.tmp"C:\Users\Admin\AppData\Local\Temp\62AD.tmp"117⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\6349.tmp"C:\Users\Admin\AppData\Local\Temp\6349.tmp"118⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\63B6.tmp"C:\Users\Admin\AppData\Local\Temp\63B6.tmp"119⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\6433.tmp"C:\Users\Admin\AppData\Local\Temp\6433.tmp"120⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\64A1.tmp"C:\Users\Admin\AppData\Local\Temp\64A1.tmp"121⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\654D.tmp"C:\Users\Admin\AppData\Local\Temp\654D.tmp"122⤵PID:3616
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-