Analysis
-
max time kernel
159s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2023, 03:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2023-08-25_4b31d6adad6404f9829c59a5a6a8d05e_mafia_JC.exe
Resource
win7-20230831-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2023-08-25_4b31d6adad6404f9829c59a5a6a8d05e_mafia_JC.exe
Resource
win10v2004-20230915-en
2 signatures
150 seconds
General
-
Target
2023-08-25_4b31d6adad6404f9829c59a5a6a8d05e_mafia_JC.exe
-
Size
486KB
-
MD5
4b31d6adad6404f9829c59a5a6a8d05e
-
SHA1
0a6d512f3c58365090a10e25ae042fd4d265346c
-
SHA256
a83e131cf1acaa99fdba139656698c51ba77df31aef7567b782c3b069922e3a7
-
SHA512
dca51fa3d089fcde0dde60dcb09a5f626f256901c9d9e16ab73bb9bafe5e7ed85c61f62fb33eb37b49c5bc40995e7a6bfc76a7e4f460a335c82a607e09b1192c
-
SSDEEP
12288:/U5rCOTeiDnHPiJzCq8MOjjRFwbR3fBhPf7GNZ:/UQOJDnHPyzC2u1FwrVjGN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2112 D830.tmp 4872 D958.tmp 3124 DA14.tmp 4552 DAC0.tmp 3524 DB3D.tmp 5004 DC08.tmp 4512 DCA4.tmp 1196 DD50.tmp 1516 DE0C.tmp 4716 DEE6.tmp 3764 DFA2.tmp 2424 E08C.tmp 548 E1B5.tmp 2108 E251.tmp 4420 E32C.tmp 2480 E3F7.tmp 1672 E4A3.tmp 2824 E57E.tmp 4180 E659.tmp 1100 E733.tmp 3040 E7C0.tmp 3936 E947.tmp 4264 E9F2.tmp 1168 EB3B.tmp 4148 EC15.tmp 1288 ED1F.tmp 4252 EE29.tmp 4412 EF13.tmp 3788 EFBF.tmp 3556 F09A.tmp 1208 F155.tmp 2680 F211.tmp 3492 F2DC.tmp 4916 F378.tmp 4172 F405.tmp 2032 F472.tmp 1780 F50E.tmp 992 F59B.tmp 4256 F618.tmp 3688 F6A4.tmp 3684 F7DD.tmp 680 F8B8.tmp 4584 F944.tmp 2676 F9D1.tmp 4128 FA6D.tmp 4552 FAFA.tmp 3524 FB96.tmp 4224 FCA0.tmp 1524 FD0D.tmp 5064 FD7A.tmp 3160 FDE8.tmp 2424 FE55.tmp 4648 FEC3.tmp 4660 FF30.tmp 4948 FFBD.tmp 1932 162.tmp 3792 21E.tmp 1076 337.tmp 1404 441.tmp 3944 50C.tmp 1764 599.tmp 2008 654.tmp 220 6E1.tmp 2568 79C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3244 wrote to memory of 2112 3244 2023-08-25_4b31d6adad6404f9829c59a5a6a8d05e_mafia_JC.exe 88 PID 3244 wrote to memory of 2112 3244 2023-08-25_4b31d6adad6404f9829c59a5a6a8d05e_mafia_JC.exe 88 PID 3244 wrote to memory of 2112 3244 2023-08-25_4b31d6adad6404f9829c59a5a6a8d05e_mafia_JC.exe 88 PID 2112 wrote to memory of 4872 2112 D830.tmp 89 PID 2112 wrote to memory of 4872 2112 D830.tmp 89 PID 2112 wrote to memory of 4872 2112 D830.tmp 89 PID 4872 wrote to memory of 3124 4872 D958.tmp 90 PID 4872 wrote to memory of 3124 4872 D958.tmp 90 PID 4872 wrote to memory of 3124 4872 D958.tmp 90 PID 3124 wrote to memory of 4552 3124 DA14.tmp 91 PID 3124 wrote to memory of 4552 3124 DA14.tmp 91 PID 3124 wrote to memory of 4552 3124 DA14.tmp 91 PID 4552 wrote to memory of 3524 4552 DAC0.tmp 92 PID 4552 wrote to memory of 3524 4552 DAC0.tmp 92 PID 4552 wrote to memory of 3524 4552 DAC0.tmp 92 PID 3524 wrote to memory of 5004 3524 DB3D.tmp 93 PID 3524 wrote to memory of 5004 3524 DB3D.tmp 93 PID 3524 wrote to memory of 5004 3524 DB3D.tmp 93 PID 5004 wrote to memory of 4512 5004 DC08.tmp 94 PID 5004 wrote to memory of 4512 5004 DC08.tmp 94 PID 5004 wrote to memory of 4512 5004 DC08.tmp 94 PID 4512 wrote to memory of 1196 4512 DCA4.tmp 95 PID 4512 wrote to memory of 1196 4512 DCA4.tmp 95 PID 4512 wrote to memory of 1196 4512 DCA4.tmp 95 PID 1196 wrote to memory of 1516 1196 DD50.tmp 96 PID 1196 wrote to memory of 1516 1196 DD50.tmp 96 PID 1196 wrote to memory of 1516 1196 DD50.tmp 96 PID 1516 wrote to memory of 4716 1516 DE0C.tmp 97 PID 1516 wrote to memory of 4716 1516 DE0C.tmp 97 PID 1516 wrote to memory of 4716 1516 DE0C.tmp 97 PID 4716 wrote to memory of 3764 4716 DEE6.tmp 98 PID 4716 wrote to memory of 3764 4716 DEE6.tmp 98 PID 4716 wrote to memory of 3764 4716 DEE6.tmp 98 PID 3764 wrote to memory of 2424 3764 DFA2.tmp 99 PID 3764 wrote to memory of 2424 3764 DFA2.tmp 99 PID 3764 wrote to memory of 2424 3764 DFA2.tmp 99 PID 2424 wrote to memory of 548 2424 E08C.tmp 100 PID 2424 wrote to memory of 548 2424 E08C.tmp 100 PID 2424 wrote to memory of 548 2424 E08C.tmp 100 PID 548 wrote to memory of 2108 548 E1B5.tmp 101 PID 548 wrote to memory of 2108 548 E1B5.tmp 101 PID 548 wrote to memory of 2108 548 E1B5.tmp 101 PID 2108 wrote to memory of 4420 2108 E251.tmp 102 PID 2108 wrote to memory of 4420 2108 E251.tmp 102 PID 2108 wrote to memory of 4420 2108 E251.tmp 102 PID 4420 wrote to memory of 2480 4420 E32C.tmp 103 PID 4420 wrote to memory of 2480 4420 E32C.tmp 103 PID 4420 wrote to memory of 2480 4420 E32C.tmp 103 PID 2480 wrote to memory of 1672 2480 E3F7.tmp 104 PID 2480 wrote to memory of 1672 2480 E3F7.tmp 104 PID 2480 wrote to memory of 1672 2480 E3F7.tmp 104 PID 1672 wrote to memory of 2824 1672 E4A3.tmp 105 PID 1672 wrote to memory of 2824 1672 E4A3.tmp 105 PID 1672 wrote to memory of 2824 1672 E4A3.tmp 105 PID 2824 wrote to memory of 4180 2824 E57E.tmp 106 PID 2824 wrote to memory of 4180 2824 E57E.tmp 106 PID 2824 wrote to memory of 4180 2824 E57E.tmp 106 PID 4180 wrote to memory of 1100 4180 E659.tmp 107 PID 4180 wrote to memory of 1100 4180 E659.tmp 107 PID 4180 wrote to memory of 1100 4180 E659.tmp 107 PID 1100 wrote to memory of 3040 1100 E733.tmp 108 PID 1100 wrote to memory of 3040 1100 E733.tmp 108 PID 1100 wrote to memory of 3040 1100 E733.tmp 108 PID 3040 wrote to memory of 3936 3040 E7C0.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-25_4b31d6adad6404f9829c59a5a6a8d05e_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-25_4b31d6adad6404f9829c59a5a6a8d05e_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\D830.tmp"C:\Users\Admin\AppData\Local\Temp\D830.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\D958.tmp"C:\Users\Admin\AppData\Local\Temp\D958.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\DA14.tmp"C:\Users\Admin\AppData\Local\Temp\DA14.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\DC08.tmp"C:\Users\Admin\AppData\Local\Temp\DC08.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\DCA4.tmp"C:\Users\Admin\AppData\Local\Temp\DCA4.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\DD50.tmp"C:\Users\Admin\AppData\Local\Temp\DD50.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\DE0C.tmp"C:\Users\Admin\AppData\Local\Temp\DE0C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\DFA2.tmp"C:\Users\Admin\AppData\Local\Temp\DFA2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\E08C.tmp"C:\Users\Admin\AppData\Local\Temp\E08C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\E1B5.tmp"C:\Users\Admin\AppData\Local\Temp\E1B5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\E251.tmp"C:\Users\Admin\AppData\Local\Temp\E251.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\E32C.tmp"C:\Users\Admin\AppData\Local\Temp\E32C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\E3F7.tmp"C:\Users\Admin\AppData\Local\Temp\E3F7.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\E57E.tmp"C:\Users\Admin\AppData\Local\Temp\E57E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\E659.tmp"C:\Users\Admin\AppData\Local\Temp\E659.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\E733.tmp"C:\Users\Admin\AppData\Local\Temp\E733.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\E947.tmp"C:\Users\Admin\AppData\Local\Temp\E947.tmp"23⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"24⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\EB3B.tmp"C:\Users\Admin\AppData\Local\Temp\EB3B.tmp"25⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\EC15.tmp"C:\Users\Admin\AppData\Local\Temp\EC15.tmp"26⤵
- Executes dropped EXE
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"27⤵
- Executes dropped EXE
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\EE29.tmp"C:\Users\Admin\AppData\Local\Temp\EE29.tmp"28⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\EF13.tmp"C:\Users\Admin\AppData\Local\Temp\EF13.tmp"29⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\EFBF.tmp"C:\Users\Admin\AppData\Local\Temp\EFBF.tmp"30⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\F09A.tmp"C:\Users\Admin\AppData\Local\Temp\F09A.tmp"31⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\F155.tmp"C:\Users\Admin\AppData\Local\Temp\F155.tmp"32⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\F211.tmp"C:\Users\Admin\AppData\Local\Temp\F211.tmp"33⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\F2DC.tmp"C:\Users\Admin\AppData\Local\Temp\F2DC.tmp"34⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\F378.tmp"C:\Users\Admin\AppData\Local\Temp\F378.tmp"35⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\F405.tmp"C:\Users\Admin\AppData\Local\Temp\F405.tmp"36⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\F472.tmp"C:\Users\Admin\AppData\Local\Temp\F472.tmp"37⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\F50E.tmp"C:\Users\Admin\AppData\Local\Temp\F50E.tmp"38⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\F59B.tmp"C:\Users\Admin\AppData\Local\Temp\F59B.tmp"39⤵
- Executes dropped EXE
PID:992 -
C:\Users\Admin\AppData\Local\Temp\F618.tmp"C:\Users\Admin\AppData\Local\Temp\F618.tmp"40⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"41⤵
- Executes dropped EXE
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"42⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\F8B8.tmp"C:\Users\Admin\AppData\Local\Temp\F8B8.tmp"43⤵
- Executes dropped EXE
PID:680 -
C:\Users\Admin\AppData\Local\Temp\F944.tmp"C:\Users\Admin\AppData\Local\Temp\F944.tmp"44⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"45⤵
- Executes dropped EXE
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"46⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"47⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\FB96.tmp"C:\Users\Admin\AppData\Local\Temp\FB96.tmp"48⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"49⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"50⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\FD7A.tmp"C:\Users\Admin\AppData\Local\Temp\FD7A.tmp"51⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"52⤵
- Executes dropped EXE
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\FE55.tmp"C:\Users\Admin\AppData\Local\Temp\FE55.tmp"53⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\FEC3.tmp"C:\Users\Admin\AppData\Local\Temp\FEC3.tmp"54⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\FF30.tmp"C:\Users\Admin\AppData\Local\Temp\FF30.tmp"55⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"56⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\162.tmp"C:\Users\Admin\AppData\Local\Temp\162.tmp"57⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\21E.tmp"C:\Users\Admin\AppData\Local\Temp\21E.tmp"58⤵
- Executes dropped EXE
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\337.tmp"C:\Users\Admin\AppData\Local\Temp\337.tmp"59⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\441.tmp"C:\Users\Admin\AppData\Local\Temp\441.tmp"60⤵
- Executes dropped EXE
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\50C.tmp"C:\Users\Admin\AppData\Local\Temp\50C.tmp"61⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\599.tmp"C:\Users\Admin\AppData\Local\Temp\599.tmp"62⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\654.tmp"C:\Users\Admin\AppData\Local\Temp\654.tmp"63⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\6E1.tmp"C:\Users\Admin\AppData\Local\Temp\6E1.tmp"64⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\79C.tmp"C:\Users\Admin\AppData\Local\Temp\79C.tmp"65⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\838.tmp"C:\Users\Admin\AppData\Local\Temp\838.tmp"66⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\904.tmp"C:\Users\Admin\AppData\Local\Temp\904.tmp"67⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\9A0.tmp"C:\Users\Admin\AppData\Local\Temp\9A0.tmp"68⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\A1D.tmp"C:\Users\Admin\AppData\Local\Temp\A1D.tmp"69⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\AC9.tmp"C:\Users\Admin\AppData\Local\Temp\AC9.tmp"70⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\BB3.tmp"C:\Users\Admin\AppData\Local\Temp\BB3.tmp"71⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\C8E.tmp"C:\Users\Admin\AppData\Local\Temp\C8E.tmp"72⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\D3A.tmp"C:\Users\Admin\AppData\Local\Temp\D3A.tmp"73⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\DB7.tmp"C:\Users\Admin\AppData\Local\Temp\DB7.tmp"74⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\E91.tmp"C:\Users\Admin\AppData\Local\Temp\E91.tmp"75⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\EFF.tmp"C:\Users\Admin\AppData\Local\Temp\EFF.tmp"76⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\F7C.tmp"C:\Users\Admin\AppData\Local\Temp\F7C.tmp"77⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\1047.tmp"C:\Users\Admin\AppData\Local\Temp\1047.tmp"78⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\10E3.tmp"C:\Users\Admin\AppData\Local\Temp\10E3.tmp"79⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\1151.tmp"C:\Users\Admin\AppData\Local\Temp\1151.tmp"80⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\11ED.tmp"C:\Users\Admin\AppData\Local\Temp\11ED.tmp"81⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\1373.tmp"C:\Users\Admin\AppData\Local\Temp\1373.tmp"82⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\143F.tmp"C:\Users\Admin\AppData\Local\Temp\143F.tmp"83⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\14DB.tmp"C:\Users\Admin\AppData\Local\Temp\14DB.tmp"84⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\1567.tmp"C:\Users\Admin\AppData\Local\Temp\1567.tmp"85⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\1681.tmp"C:\Users\Admin\AppData\Local\Temp\1681.tmp"86⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\175B.tmp"C:\Users\Admin\AppData\Local\Temp\175B.tmp"87⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\17D8.tmp"C:\Users\Admin\AppData\Local\Temp\17D8.tmp"88⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\1855.tmp"C:\Users\Admin\AppData\Local\Temp\1855.tmp"89⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\18D2.tmp"C:\Users\Admin\AppData\Local\Temp\18D2.tmp"90⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\197E.tmp"C:\Users\Admin\AppData\Local\Temp\197E.tmp"91⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"92⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"93⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\1B34.tmp"C:\Users\Admin\AppData\Local\Temp\1B34.tmp"94⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"95⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\1C0F.tmp"C:\Users\Admin\AppData\Local\Temp\1C0F.tmp"96⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\1C8C.tmp"C:\Users\Admin\AppData\Local\Temp\1C8C.tmp"97⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"98⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\1D95.tmp"C:\Users\Admin\AppData\Local\Temp\1D95.tmp"99⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\1E12.tmp"C:\Users\Admin\AppData\Local\Temp\1E12.tmp"100⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\1F1C.tmp"C:\Users\Admin\AppData\Local\Temp\1F1C.tmp"101⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"102⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\2025.tmp"C:\Users\Admin\AppData\Local\Temp\2025.tmp"103⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\20D1.tmp"C:\Users\Admin\AppData\Local\Temp\20D1.tmp"104⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\218D.tmp"C:\Users\Admin\AppData\Local\Temp\218D.tmp"105⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\2229.tmp"C:\Users\Admin\AppData\Local\Temp\2229.tmp"106⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\22E5.tmp"C:\Users\Admin\AppData\Local\Temp\22E5.tmp"107⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\23FE.tmp"C:\Users\Admin\AppData\Local\Temp\23FE.tmp"108⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\246B.tmp"C:\Users\Admin\AppData\Local\Temp\246B.tmp"109⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\24D9.tmp"C:\Users\Admin\AppData\Local\Temp\24D9.tmp"110⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\2575.tmp"C:\Users\Admin\AppData\Local\Temp\2575.tmp"111⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\25E2.tmp"C:\Users\Admin\AppData\Local\Temp\25E2.tmp"112⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\265F.tmp"C:\Users\Admin\AppData\Local\Temp\265F.tmp"113⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\26CD.tmp"C:\Users\Admin\AppData\Local\Temp\26CD.tmp"114⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\272A.tmp"C:\Users\Admin\AppData\Local\Temp\272A.tmp"115⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\27B7.tmp"C:\Users\Admin\AppData\Local\Temp\27B7.tmp"116⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\28EF.tmp"C:\Users\Admin\AppData\Local\Temp\28EF.tmp"117⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\295D.tmp"C:\Users\Admin\AppData\Local\Temp\295D.tmp"118⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\29DA.tmp"C:\Users\Admin\AppData\Local\Temp\29DA.tmp"119⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\2A57.tmp"C:\Users\Admin\AppData\Local\Temp\2A57.tmp"120⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\2AD4.tmp"C:\Users\Admin\AppData\Local\Temp\2AD4.tmp"121⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\2B41.tmp"C:\Users\Admin\AppData\Local\Temp\2B41.tmp"122⤵PID:3788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-