Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2023, 14:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2023-08-27_0da99871763dc5bc44102caf50cbf2b7_mafia_JC.exe
Resource
win7-20230831-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2023-08-27_0da99871763dc5bc44102caf50cbf2b7_mafia_JC.exe
Resource
win10v2004-20230915-en
2 signatures
150 seconds
General
-
Target
2023-08-27_0da99871763dc5bc44102caf50cbf2b7_mafia_JC.exe
-
Size
486KB
-
MD5
0da99871763dc5bc44102caf50cbf2b7
-
SHA1
98aecf02187a6761bf342430c92ba3105c6ef3d3
-
SHA256
46e442813db22316ecd2f42b30e3258f350c632e71fdbbd1a5c132d887e93b29
-
SHA512
10ab2a8154f7e55b3e4ba937818a2b7914b16c49a76ca2033889cd943a404e53807f79684a631977dddad687d196d374bf35c4c377c5b6c30387866ce828c94a
-
SSDEEP
12288:/U5rCOTeiD0Qaec/ToLt/rZw/eIn9hZPPlpddUNZ:/UQOJDbdWTmtT6eInDZP3YN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4720 809A.tmp 4864 8165.tmp 2748 8201.tmp 4112 827E.tmp 2040 830B.tmp 4360 83C6.tmp 676 8472.tmp 1980 84EF.tmp 3024 859B.tmp 4996 8647.tmp 5100 86B4.tmp 928 8750.tmp 4820 880C.tmp 4980 8889.tmp 4420 8916.tmp 2824 89B2.tmp 1548 8A4E.tmp 2992 8ACB.tmp 1832 8B58.tmp 1556 8BE4.tmp 1264 8D3C.tmp 3644 8DF8.tmp 1072 8E75.tmp 4488 8F20.tmp 2248 8FDC.tmp 1300 9069.tmp 3984 9114.tmp 4864 928B.tmp 2072 9357.tmp 1684 9402.tmp 2956 9683.tmp 1980 975E.tmp 3024 9839.tmp 4768 98C5.tmp 4536 9961.tmp 2436 99FE.tmp 316 9A8A.tmp 928 9B07.tmp 4880 9BA4.tmp 2516 9C4F.tmp 2256 9CEC.tmp 4968 9D88.tmp 4724 9E34.tmp 3496 9ED0.tmp 2300 9F7C.tmp 1048 A018.tmp 1312 A0C4.tmp 1548 A151.tmp 4624 A1FD.tmp 3800 A299.tmp 2312 A354.tmp 1392 A3D1.tmp 2712 A43F.tmp 2180 A4CB.tmp 216 A568.tmp 4620 A5F4.tmp 4780 A690.tmp 4316 A6EE.tmp 3896 A77B.tmp 4832 A7D9.tmp 1276 A846.tmp 4500 A8B3.tmp 2748 A950.tmp 2040 A9EC.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5080 wrote to memory of 4720 5080 2023-08-27_0da99871763dc5bc44102caf50cbf2b7_mafia_JC.exe 85 PID 5080 wrote to memory of 4720 5080 2023-08-27_0da99871763dc5bc44102caf50cbf2b7_mafia_JC.exe 85 PID 5080 wrote to memory of 4720 5080 2023-08-27_0da99871763dc5bc44102caf50cbf2b7_mafia_JC.exe 85 PID 4720 wrote to memory of 4864 4720 809A.tmp 86 PID 4720 wrote to memory of 4864 4720 809A.tmp 86 PID 4720 wrote to memory of 4864 4720 809A.tmp 86 PID 4864 wrote to memory of 2748 4864 8165.tmp 87 PID 4864 wrote to memory of 2748 4864 8165.tmp 87 PID 4864 wrote to memory of 2748 4864 8165.tmp 87 PID 2748 wrote to memory of 4112 2748 8201.tmp 88 PID 2748 wrote to memory of 4112 2748 8201.tmp 88 PID 2748 wrote to memory of 4112 2748 8201.tmp 88 PID 4112 wrote to memory of 2040 4112 827E.tmp 89 PID 4112 wrote to memory of 2040 4112 827E.tmp 89 PID 4112 wrote to memory of 2040 4112 827E.tmp 89 PID 2040 wrote to memory of 4360 2040 830B.tmp 91 PID 2040 wrote to memory of 4360 2040 830B.tmp 91 PID 2040 wrote to memory of 4360 2040 830B.tmp 91 PID 4360 wrote to memory of 676 4360 83C6.tmp 92 PID 4360 wrote to memory of 676 4360 83C6.tmp 92 PID 4360 wrote to memory of 676 4360 83C6.tmp 92 PID 676 wrote to memory of 1980 676 8472.tmp 93 PID 676 wrote to memory of 1980 676 8472.tmp 93 PID 676 wrote to memory of 1980 676 8472.tmp 93 PID 1980 wrote to memory of 3024 1980 84EF.tmp 94 PID 1980 wrote to memory of 3024 1980 84EF.tmp 94 PID 1980 wrote to memory of 3024 1980 84EF.tmp 94 PID 3024 wrote to memory of 4996 3024 859B.tmp 95 PID 3024 wrote to memory of 4996 3024 859B.tmp 95 PID 3024 wrote to memory of 4996 3024 859B.tmp 95 PID 4996 wrote to memory of 5100 4996 8647.tmp 96 PID 4996 wrote to memory of 5100 4996 8647.tmp 96 PID 4996 wrote to memory of 5100 4996 8647.tmp 96 PID 5100 wrote to memory of 928 5100 86B4.tmp 97 PID 5100 wrote to memory of 928 5100 86B4.tmp 97 PID 5100 wrote to memory of 928 5100 86B4.tmp 97 PID 928 wrote to memory of 4820 928 8750.tmp 98 PID 928 wrote to memory of 4820 928 8750.tmp 98 PID 928 wrote to memory of 4820 928 8750.tmp 98 PID 4820 wrote to memory of 4980 4820 880C.tmp 99 PID 4820 wrote to memory of 4980 4820 880C.tmp 99 PID 4820 wrote to memory of 4980 4820 880C.tmp 99 PID 4980 wrote to memory of 4420 4980 8889.tmp 100 PID 4980 wrote to memory of 4420 4980 8889.tmp 100 PID 4980 wrote to memory of 4420 4980 8889.tmp 100 PID 4420 wrote to memory of 2824 4420 8916.tmp 101 PID 4420 wrote to memory of 2824 4420 8916.tmp 101 PID 4420 wrote to memory of 2824 4420 8916.tmp 101 PID 2824 wrote to memory of 1548 2824 89B2.tmp 103 PID 2824 wrote to memory of 1548 2824 89B2.tmp 103 PID 2824 wrote to memory of 1548 2824 89B2.tmp 103 PID 1548 wrote to memory of 2992 1548 8A4E.tmp 106 PID 1548 wrote to memory of 2992 1548 8A4E.tmp 106 PID 1548 wrote to memory of 2992 1548 8A4E.tmp 106 PID 2992 wrote to memory of 1832 2992 8ACB.tmp 107 PID 2992 wrote to memory of 1832 2992 8ACB.tmp 107 PID 2992 wrote to memory of 1832 2992 8ACB.tmp 107 PID 1832 wrote to memory of 1556 1832 8B58.tmp 108 PID 1832 wrote to memory of 1556 1832 8B58.tmp 108 PID 1832 wrote to memory of 1556 1832 8B58.tmp 108 PID 1556 wrote to memory of 1264 1556 8BE4.tmp 110 PID 1556 wrote to memory of 1264 1556 8BE4.tmp 110 PID 1556 wrote to memory of 1264 1556 8BE4.tmp 110 PID 1264 wrote to memory of 3644 1264 8D3C.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-27_0da99871763dc5bc44102caf50cbf2b7_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-27_0da99871763dc5bc44102caf50cbf2b7_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\809A.tmp"C:\Users\Admin\AppData\Local\Temp\809A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\8165.tmp"C:\Users\Admin\AppData\Local\Temp\8165.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\8201.tmp"C:\Users\Admin\AppData\Local\Temp\8201.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\827E.tmp"C:\Users\Admin\AppData\Local\Temp\827E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\830B.tmp"C:\Users\Admin\AppData\Local\Temp\830B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\83C6.tmp"C:\Users\Admin\AppData\Local\Temp\83C6.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\8472.tmp"C:\Users\Admin\AppData\Local\Temp\8472.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Users\Admin\AppData\Local\Temp\84EF.tmp"C:\Users\Admin\AppData\Local\Temp\84EF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\859B.tmp"C:\Users\Admin\AppData\Local\Temp\859B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\8647.tmp"C:\Users\Admin\AppData\Local\Temp\8647.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\8750.tmp"C:\Users\Admin\AppData\Local\Temp\8750.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Users\Admin\AppData\Local\Temp\880C.tmp"C:\Users\Admin\AppData\Local\Temp\880C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\8889.tmp"C:\Users\Admin\AppData\Local\Temp\8889.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\8916.tmp"C:\Users\Admin\AppData\Local\Temp\8916.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\89B2.tmp"C:\Users\Admin\AppData\Local\Temp\89B2.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\8B58.tmp"C:\Users\Admin\AppData\Local\Temp\8B58.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"23⤵
- Executes dropped EXE
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\8E75.tmp"C:\Users\Admin\AppData\Local\Temp\8E75.tmp"24⤵
- Executes dropped EXE
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\8F20.tmp"C:\Users\Admin\AppData\Local\Temp\8F20.tmp"25⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"26⤵
- Executes dropped EXE
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"27⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\9114.tmp"C:\Users\Admin\AppData\Local\Temp\9114.tmp"28⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"29⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"30⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\9402.tmp"C:\Users\Admin\AppData\Local\Temp\9402.tmp"31⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"32⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"33⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\9839.tmp"C:\Users\Admin\AppData\Local\Temp\9839.tmp"34⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\98C5.tmp"C:\Users\Admin\AppData\Local\Temp\98C5.tmp"35⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"36⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"37⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"38⤵
- Executes dropped EXE
PID:316 -
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"39⤵
- Executes dropped EXE
PID:928 -
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"40⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"41⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"42⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"43⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"44⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"45⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"46⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"47⤵
- Executes dropped EXE
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"48⤵
- Executes dropped EXE
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"49⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"50⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\A299.tmp"C:\Users\Admin\AppData\Local\Temp\A299.tmp"51⤵
- Executes dropped EXE
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\A354.tmp"C:\Users\Admin\AppData\Local\Temp\A354.tmp"52⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"53⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\A43F.tmp"C:\Users\Admin\AppData\Local\Temp\A43F.tmp"54⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"55⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"56⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"57⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"58⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"59⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"60⤵
- Executes dropped EXE
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"61⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"62⤵
- Executes dropped EXE
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"63⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\A950.tmp"C:\Users\Admin\AppData\Local\Temp\A950.tmp"64⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"65⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\AA88.tmp"C:\Users\Admin\AppData\Local\Temp\AA88.tmp"66⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\AB15.tmp"C:\Users\Admin\AppData\Local\Temp\AB15.tmp"67⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"68⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"69⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"70⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"71⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"72⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\AE70.tmp"C:\Users\Admin\AppData\Local\Temp\AE70.tmp"73⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"74⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"75⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\B035.tmp"C:\Users\Admin\AppData\Local\Temp\B035.tmp"76⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"77⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"78⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"79⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\B287.tmp"C:\Users\Admin\AppData\Local\Temp\B287.tmp"80⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"81⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\B342.tmp"C:\Users\Admin\AppData\Local\Temp\B342.tmp"82⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\B391.tmp"C:\Users\Admin\AppData\Local\Temp\B391.tmp"83⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\B47B.tmp"C:\Users\Admin\AppData\Local\Temp\B47B.tmp"84⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"85⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\B565.tmp"C:\Users\Admin\AppData\Local\Temp\B565.tmp"86⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"87⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\B66F.tmp"C:\Users\Admin\AppData\Local\Temp\B66F.tmp"88⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"89⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\B74A.tmp"C:\Users\Admin\AppData\Local\Temp\B74A.tmp"90⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"91⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\B853.tmp"C:\Users\Admin\AppData\Local\Temp\B853.tmp"92⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"93⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\B96D.tmp"C:\Users\Admin\AppData\Local\Temp\B96D.tmp"94⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\BA09.tmp"C:\Users\Admin\AppData\Local\Temp\BA09.tmp"95⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\BA86.tmp"C:\Users\Admin\AppData\Local\Temp\BA86.tmp"96⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\BAF3.tmp"C:\Users\Admin\AppData\Local\Temp\BAF3.tmp"97⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\BB70.tmp"C:\Users\Admin\AppData\Local\Temp\BB70.tmp"98⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"99⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"100⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\BD06.tmp"C:\Users\Admin\AppData\Local\Temp\BD06.tmp"101⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"102⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"103⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"104⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\BF58.tmp"C:\Users\Admin\AppData\Local\Temp\BF58.tmp"105⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"106⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\C091.tmp"C:\Users\Admin\AppData\Local\Temp\C091.tmp"107⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"108⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"109⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\C246.tmp"C:\Users\Admin\AppData\Local\Temp\C246.tmp"110⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"111⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\C350.tmp"C:\Users\Admin\AppData\Local\Temp\C350.tmp"112⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\C3BD.tmp"C:\Users\Admin\AppData\Local\Temp\C3BD.tmp"113⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\C43A.tmp"C:\Users\Admin\AppData\Local\Temp\C43A.tmp"114⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"115⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\C544.tmp"C:\Users\Admin\AppData\Local\Temp\C544.tmp"116⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"117⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\C64D.tmp"C:\Users\Admin\AppData\Local\Temp\C64D.tmp"118⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\C6DA.tmp"C:\Users\Admin\AppData\Local\Temp\C6DA.tmp"119⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\C767.tmp"C:\Users\Admin\AppData\Local\Temp\C767.tmp"120⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"121⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\C870.tmp"C:\Users\Admin\AppData\Local\Temp\C870.tmp"122⤵PID:316
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-