Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2023, 16:28
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-27_6a335beb71854a8c0e9cc933524ed525_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-27_6a335beb71854a8c0e9cc933524ed525_mafia_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2023-08-27_6a335beb71854a8c0e9cc933524ed525_mafia_JC.exe
-
Size
488KB
-
MD5
6a335beb71854a8c0e9cc933524ed525
-
SHA1
768577dce9aceb3a703a112c9097c860d54288b8
-
SHA256
7a5102a4530bfc79a8b5f3827b4ab46c70efbc9d02399ccb1e82c2378792fc8e
-
SHA512
4166edb1ba0ec52f3a5265a7c7d97e54cc86c69b6f8e4541ca3276fb8e89e1eece85779a361477f492a0907b95974a0b19ddb580011017b874bb525dd05605cd
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7AI8xz+0Le0LIxxwETeyzRURlfB8qVuzEDtBK:/U5rCOTeiDAT+3xx1VUR7VuG8cSNNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2380 7A41.tmp 956 7AED.tmp 856 7B98.tmp 2020 7C44.tmp 1092 7CE1.tmp 1768 7D9C.tmp 1504 7E09.tmp 4952 7EE4.tmp 4696 7F61.tmp 2496 7FDE.tmp 4036 809A.tmp 3932 8146.tmp 1248 81E2.tmp 4756 825F.tmp 4592 82FB.tmp 828 8388.tmp 2472 84D0.tmp 2796 857C.tmp 3460 8618.tmp 4712 86D3.tmp 4352 877F.tmp 3380 884A.tmp 3804 88D7.tmp 1988 8983.tmp 3644 8A1F.tmp 1664 8AAC.tmp 396 8B67.tmp 4620 8BF4.tmp 3728 8C81.tmp 4980 8D2C.tmp 1096 8DC9.tmp 2216 8E65.tmp 2336 8F6F.tmp 1440 8FFB.tmp 2556 9097.tmp 4136 9114.tmp 624 9172.tmp 2496 91EF.tmp 4320 927C.tmp 640 9308.tmp 4104 93A5.tmp 264 949F.tmp 5116 953B.tmp 3700 9664.tmp 3664 9700.tmp 4756 976D.tmp 4592 97FA.tmp 4688 9887.tmp 3964 9913.tmp 4216 9990.tmp 1100 9A0D.tmp 3852 9AAA.tmp 920 9B36.tmp 4296 9BA4.tmp 1788 9C40.tmp 4552 9CBD.tmp 3380 9D49.tmp 4208 9DC6.tmp 2480 9E53.tmp 2432 9ED0.tmp 2772 9F4D.tmp 4932 9FCA.tmp 2448 A057.tmp 2056 A0C4.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2932 wrote to memory of 2380 2932 2023-08-27_6a335beb71854a8c0e9cc933524ed525_mafia_JC.exe 86 PID 2932 wrote to memory of 2380 2932 2023-08-27_6a335beb71854a8c0e9cc933524ed525_mafia_JC.exe 86 PID 2932 wrote to memory of 2380 2932 2023-08-27_6a335beb71854a8c0e9cc933524ed525_mafia_JC.exe 86 PID 2380 wrote to memory of 956 2380 7A41.tmp 87 PID 2380 wrote to memory of 956 2380 7A41.tmp 87 PID 2380 wrote to memory of 956 2380 7A41.tmp 87 PID 956 wrote to memory of 856 956 7AED.tmp 88 PID 956 wrote to memory of 856 956 7AED.tmp 88 PID 956 wrote to memory of 856 956 7AED.tmp 88 PID 856 wrote to memory of 2020 856 7B98.tmp 89 PID 856 wrote to memory of 2020 856 7B98.tmp 89 PID 856 wrote to memory of 2020 856 7B98.tmp 89 PID 2020 wrote to memory of 1092 2020 7C44.tmp 90 PID 2020 wrote to memory of 1092 2020 7C44.tmp 90 PID 2020 wrote to memory of 1092 2020 7C44.tmp 90 PID 1092 wrote to memory of 1768 1092 7CE1.tmp 91 PID 1092 wrote to memory of 1768 1092 7CE1.tmp 91 PID 1092 wrote to memory of 1768 1092 7CE1.tmp 91 PID 1768 wrote to memory of 1504 1768 7D9C.tmp 92 PID 1768 wrote to memory of 1504 1768 7D9C.tmp 92 PID 1768 wrote to memory of 1504 1768 7D9C.tmp 92 PID 1504 wrote to memory of 4952 1504 7E09.tmp 94 PID 1504 wrote to memory of 4952 1504 7E09.tmp 94 PID 1504 wrote to memory of 4952 1504 7E09.tmp 94 PID 4952 wrote to memory of 4696 4952 7EE4.tmp 95 PID 4952 wrote to memory of 4696 4952 7EE4.tmp 95 PID 4952 wrote to memory of 4696 4952 7EE4.tmp 95 PID 4696 wrote to memory of 2496 4696 7F61.tmp 96 PID 4696 wrote to memory of 2496 4696 7F61.tmp 96 PID 4696 wrote to memory of 2496 4696 7F61.tmp 96 PID 2496 wrote to memory of 4036 2496 7FDE.tmp 97 PID 2496 wrote to memory of 4036 2496 7FDE.tmp 97 PID 2496 wrote to memory of 4036 2496 7FDE.tmp 97 PID 4036 wrote to memory of 3932 4036 809A.tmp 98 PID 4036 wrote to memory of 3932 4036 809A.tmp 98 PID 4036 wrote to memory of 3932 4036 809A.tmp 98 PID 3932 wrote to memory of 1248 3932 8146.tmp 99 PID 3932 wrote to memory of 1248 3932 8146.tmp 99 PID 3932 wrote to memory of 1248 3932 8146.tmp 99 PID 1248 wrote to memory of 4756 1248 81E2.tmp 100 PID 1248 wrote to memory of 4756 1248 81E2.tmp 100 PID 1248 wrote to memory of 4756 1248 81E2.tmp 100 PID 4756 wrote to memory of 4592 4756 825F.tmp 101 PID 4756 wrote to memory of 4592 4756 825F.tmp 101 PID 4756 wrote to memory of 4592 4756 825F.tmp 101 PID 4592 wrote to memory of 828 4592 82FB.tmp 102 PID 4592 wrote to memory of 828 4592 82FB.tmp 102 PID 4592 wrote to memory of 828 4592 82FB.tmp 102 PID 828 wrote to memory of 2472 828 8388.tmp 103 PID 828 wrote to memory of 2472 828 8388.tmp 103 PID 828 wrote to memory of 2472 828 8388.tmp 103 PID 2472 wrote to memory of 2796 2472 84D0.tmp 104 PID 2472 wrote to memory of 2796 2472 84D0.tmp 104 PID 2472 wrote to memory of 2796 2472 84D0.tmp 104 PID 2796 wrote to memory of 3460 2796 857C.tmp 106 PID 2796 wrote to memory of 3460 2796 857C.tmp 106 PID 2796 wrote to memory of 3460 2796 857C.tmp 106 PID 3460 wrote to memory of 4712 3460 8618.tmp 109 PID 3460 wrote to memory of 4712 3460 8618.tmp 109 PID 3460 wrote to memory of 4712 3460 8618.tmp 109 PID 4712 wrote to memory of 4352 4712 86D3.tmp 110 PID 4712 wrote to memory of 4352 4712 86D3.tmp 110 PID 4712 wrote to memory of 4352 4712 86D3.tmp 110 PID 4352 wrote to memory of 3380 4352 877F.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-27_6a335beb71854a8c0e9cc933524ed525_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-27_6a335beb71854a8c0e9cc933524ed525_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\7AED.tmp"C:\Users\Admin\AppData\Local\Temp\7AED.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\7B98.tmp"C:\Users\Admin\AppData\Local\Temp\7B98.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\7C44.tmp"C:\Users\Admin\AppData\Local\Temp\7C44.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\7E09.tmp"C:\Users\Admin\AppData\Local\Temp\7E09.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\7F61.tmp"C:\Users\Admin\AppData\Local\Temp\7F61.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\809A.tmp"C:\Users\Admin\AppData\Local\Temp\809A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\8146.tmp"C:\Users\Admin\AppData\Local\Temp\8146.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\81E2.tmp"C:\Users\Admin\AppData\Local\Temp\81E2.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\825F.tmp"C:\Users\Admin\AppData\Local\Temp\825F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\82FB.tmp"C:\Users\Admin\AppData\Local\Temp\82FB.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\8388.tmp"C:\Users\Admin\AppData\Local\Temp\8388.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\84D0.tmp"C:\Users\Admin\AppData\Local\Temp\84D0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\857C.tmp"C:\Users\Admin\AppData\Local\Temp\857C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\8618.tmp"C:\Users\Admin\AppData\Local\Temp\8618.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\86D3.tmp"C:\Users\Admin\AppData\Local\Temp\86D3.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\877F.tmp"C:\Users\Admin\AppData\Local\Temp\877F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"23⤵
- Executes dropped EXE
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"24⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\8983.tmp"C:\Users\Admin\AppData\Local\Temp\8983.tmp"25⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"26⤵
- Executes dropped EXE
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"27⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\8B67.tmp"C:\Users\Admin\AppData\Local\Temp\8B67.tmp"28⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"29⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\8C81.tmp"C:\Users\Admin\AppData\Local\Temp\8C81.tmp"30⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"31⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"32⤵
- Executes dropped EXE
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"33⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"34⤵
- Executes dropped EXE
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"35⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\9097.tmp"C:\Users\Admin\AppData\Local\Temp\9097.tmp"36⤵
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\9114.tmp"C:\Users\Admin\AppData\Local\Temp\9114.tmp"37⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp"38⤵
- Executes dropped EXE
PID:624 -
C:\Users\Admin\AppData\Local\Temp\91EF.tmp"C:\Users\Admin\AppData\Local\Temp\91EF.tmp"39⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\927C.tmp"C:\Users\Admin\AppData\Local\Temp\927C.tmp"40⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\9308.tmp"C:\Users\Admin\AppData\Local\Temp\9308.tmp"41⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\93A5.tmp"C:\Users\Admin\AppData\Local\Temp\93A5.tmp"42⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"43⤵
- Executes dropped EXE
PID:264 -
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"44⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\9664.tmp"C:\Users\Admin\AppData\Local\Temp\9664.tmp"45⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\9700.tmp"C:\Users\Admin\AppData\Local\Temp\9700.tmp"46⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\976D.tmp"C:\Users\Admin\AppData\Local\Temp\976D.tmp"47⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\97FA.tmp"C:\Users\Admin\AppData\Local\Temp\97FA.tmp"48⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"49⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"50⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"51⤵
- Executes dropped EXE
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"52⤵
- Executes dropped EXE
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"53⤵
- Executes dropped EXE
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"54⤵
- Executes dropped EXE
PID:920 -
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"55⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"56⤵
- Executes dropped EXE
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"57⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"58⤵
- Executes dropped EXE
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"59⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\9E53.tmp"C:\Users\Admin\AppData\Local\Temp\9E53.tmp"60⤵
- Executes dropped EXE
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"61⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"62⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"63⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"64⤵
- Executes dropped EXE
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"65⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"66⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"67⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\A23B.tmp"C:\Users\Admin\AppData\Local\Temp\A23B.tmp"68⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"69⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\A354.tmp"C:\Users\Admin\AppData\Local\Temp\A354.tmp"70⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"71⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"72⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"73⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\A519.tmp"C:\Users\Admin\AppData\Local\Temp\A519.tmp"74⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"75⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"76⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"77⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"78⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\A76B.tmp"C:\Users\Admin\AppData\Local\Temp\A76B.tmp"79⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"80⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"81⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"82⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\A99E.tmp"C:\Users\Admin\AppData\Local\Temp\A99E.tmp"83⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"84⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"85⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"86⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"87⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"88⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"89⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"90⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"91⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\AE41.tmp"C:\Users\Admin\AppData\Local\Temp\AE41.tmp"92⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\AECE.tmp"C:\Users\Admin\AppData\Local\Temp\AECE.tmp"93⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"94⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"95⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\B074.tmp"C:\Users\Admin\AppData\Local\Temp\B074.tmp"96⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\B100.tmp"C:\Users\Admin\AppData\Local\Temp\B100.tmp"97⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\B18D.tmp"C:\Users\Admin\AppData\Local\Temp\B18D.tmp"98⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\B20A.tmp"C:\Users\Admin\AppData\Local\Temp\B20A.tmp"99⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"100⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"101⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"102⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\B43C.tmp"C:\Users\Admin\AppData\Local\Temp\B43C.tmp"103⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"104⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"105⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\B602.tmp"C:\Users\Admin\AppData\Local\Temp\B602.tmp"106⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\B68E.tmp"C:\Users\Admin\AppData\Local\Temp\B68E.tmp"107⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\B72A.tmp"C:\Users\Admin\AppData\Local\Temp\B72A.tmp"108⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"109⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\B863.tmp"C:\Users\Admin\AppData\Local\Temp\B863.tmp"110⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"111⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\B95D.tmp"C:\Users\Admin\AppData\Local\Temp\B95D.tmp"112⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"113⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\BA47.tmp"C:\Users\Admin\AppData\Local\Temp\BA47.tmp"114⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"115⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"116⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"117⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"118⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"119⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\BD45.tmp"C:\Users\Admin\AppData\Local\Temp\BD45.tmp"120⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"121⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\BE20.tmp"C:\Users\Admin\AppData\Local\Temp\BE20.tmp"122⤵PID:4356
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-