Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
16/08/2023, 16:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
06bce250c3cff0d95f2ca4164a0ff967_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
06bce250c3cff0d95f2ca4164a0ff967_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
06bce250c3cff0d95f2ca4164a0ff967_mafia_JC.exe
-
Size
520KB
-
MD5
06bce250c3cff0d95f2ca4164a0ff967
-
SHA1
5e9fb98d62fac0ea71b5b25fd3f1cad2a323e831
-
SHA256
0df81fe56354061efbb9ffd53989f29ceb1468d904456e6d60d54806f65a5050
-
SHA512
915a415c7a9ef7ae376284262ace8e2106327727c21ce20f73863321f00bd322b4e5f05cd5c425947eb4a94b0fa31b1a8167df972f00573dc8d12abce7d6e03a
-
SSDEEP
12288:gj8fuxR21t5i8fab5pW/kyo+cVuYAxx54h2ukOd4w1WpMCBjkNZ:gj8fuK1GYab7WM7XVuYA6k61W1BIN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2820 6D60.tmp 2888 6E0C.tmp 376 6ED7.tmp 412 7000.tmp 4536 70BB.tmp 4120 7232.tmp 1772 72DE.tmp 2316 736B.tmp 3012 7426.tmp 4688 74C2.tmp 2928 758E.tmp 2828 76B6.tmp 2180 7791.tmp 1912 788B.tmp 3496 7937.tmp 4368 79E3.tmp 2520 7A7F.tmp 2324 7B5A.tmp 2372 7BE7.tmp 1440 7CD1.tmp 4220 7D8C.tmp 4636 7E77.tmp 4136 7F32.tmp 4472 800D.tmp 5088 80B9.tmp 3376 8174.tmp 3892 8220.tmp 1724 82CC.tmp 4524 8368.tmp 5048 8414.tmp 4968 84D0.tmp 824 856C.tmp 4860 8656.tmp 3460 86E3.tmp 3024 8750.tmp 4884 87ED.tmp 2936 886A.tmp 1160 88F6.tmp 4920 8964.tmp 2244 8A00.tmp 4668 8A7D.tmp 4072 8B19.tmp 2164 8B96.tmp 3632 8C32.tmp 4320 8CBF.tmp 1808 8D3C.tmp 4960 8DC9.tmp 4628 8E65.tmp 1812 8EF2.tmp 2988 8F6F.tmp 2528 8FDC.tmp 2176 9078.tmp 2276 9105.tmp 2252 9182.tmp 1144 921E.tmp 3004 92BA.tmp 4676 9347.tmp 984 93D4.tmp 3132 9460.tmp 4376 94ED.tmp 3404 9589.tmp 884 9606.tmp 4496 96A2.tmp 2316 971F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 788 wrote to memory of 2820 788 06bce250c3cff0d95f2ca4164a0ff967_mafia_JC.exe 82 PID 788 wrote to memory of 2820 788 06bce250c3cff0d95f2ca4164a0ff967_mafia_JC.exe 82 PID 788 wrote to memory of 2820 788 06bce250c3cff0d95f2ca4164a0ff967_mafia_JC.exe 82 PID 2820 wrote to memory of 2888 2820 6D60.tmp 83 PID 2820 wrote to memory of 2888 2820 6D60.tmp 83 PID 2820 wrote to memory of 2888 2820 6D60.tmp 83 PID 2888 wrote to memory of 376 2888 6E0C.tmp 84 PID 2888 wrote to memory of 376 2888 6E0C.tmp 84 PID 2888 wrote to memory of 376 2888 6E0C.tmp 84 PID 376 wrote to memory of 412 376 6ED7.tmp 85 PID 376 wrote to memory of 412 376 6ED7.tmp 85 PID 376 wrote to memory of 412 376 6ED7.tmp 85 PID 412 wrote to memory of 4536 412 7000.tmp 86 PID 412 wrote to memory of 4536 412 7000.tmp 86 PID 412 wrote to memory of 4536 412 7000.tmp 86 PID 4536 wrote to memory of 4120 4536 70BB.tmp 87 PID 4536 wrote to memory of 4120 4536 70BB.tmp 87 PID 4536 wrote to memory of 4120 4536 70BB.tmp 87 PID 4120 wrote to memory of 1772 4120 7232.tmp 88 PID 4120 wrote to memory of 1772 4120 7232.tmp 88 PID 4120 wrote to memory of 1772 4120 7232.tmp 88 PID 1772 wrote to memory of 2316 1772 72DE.tmp 89 PID 1772 wrote to memory of 2316 1772 72DE.tmp 89 PID 1772 wrote to memory of 2316 1772 72DE.tmp 89 PID 2316 wrote to memory of 3012 2316 736B.tmp 90 PID 2316 wrote to memory of 3012 2316 736B.tmp 90 PID 2316 wrote to memory of 3012 2316 736B.tmp 90 PID 3012 wrote to memory of 4688 3012 7426.tmp 91 PID 3012 wrote to memory of 4688 3012 7426.tmp 91 PID 3012 wrote to memory of 4688 3012 7426.tmp 91 PID 4688 wrote to memory of 2928 4688 74C2.tmp 92 PID 4688 wrote to memory of 2928 4688 74C2.tmp 92 PID 4688 wrote to memory of 2928 4688 74C2.tmp 92 PID 2928 wrote to memory of 2828 2928 758E.tmp 93 PID 2928 wrote to memory of 2828 2928 758E.tmp 93 PID 2928 wrote to memory of 2828 2928 758E.tmp 93 PID 2828 wrote to memory of 2180 2828 76B6.tmp 94 PID 2828 wrote to memory of 2180 2828 76B6.tmp 94 PID 2828 wrote to memory of 2180 2828 76B6.tmp 94 PID 2180 wrote to memory of 1912 2180 7791.tmp 95 PID 2180 wrote to memory of 1912 2180 7791.tmp 95 PID 2180 wrote to memory of 1912 2180 7791.tmp 95 PID 1912 wrote to memory of 3496 1912 788B.tmp 96 PID 1912 wrote to memory of 3496 1912 788B.tmp 96 PID 1912 wrote to memory of 3496 1912 788B.tmp 96 PID 3496 wrote to memory of 4368 3496 7937.tmp 97 PID 3496 wrote to memory of 4368 3496 7937.tmp 97 PID 3496 wrote to memory of 4368 3496 7937.tmp 97 PID 4368 wrote to memory of 2520 4368 79E3.tmp 98 PID 4368 wrote to memory of 2520 4368 79E3.tmp 98 PID 4368 wrote to memory of 2520 4368 79E3.tmp 98 PID 2520 wrote to memory of 2324 2520 7A7F.tmp 99 PID 2520 wrote to memory of 2324 2520 7A7F.tmp 99 PID 2520 wrote to memory of 2324 2520 7A7F.tmp 99 PID 2324 wrote to memory of 2372 2324 7B5A.tmp 102 PID 2324 wrote to memory of 2372 2324 7B5A.tmp 102 PID 2324 wrote to memory of 2372 2324 7B5A.tmp 102 PID 2372 wrote to memory of 1440 2372 7BE7.tmp 103 PID 2372 wrote to memory of 1440 2372 7BE7.tmp 103 PID 2372 wrote to memory of 1440 2372 7BE7.tmp 103 PID 1440 wrote to memory of 4220 1440 7CD1.tmp 104 PID 1440 wrote to memory of 4220 1440 7CD1.tmp 104 PID 1440 wrote to memory of 4220 1440 7CD1.tmp 104 PID 4220 wrote to memory of 4636 4220 7D8C.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\06bce250c3cff0d95f2ca4164a0ff967_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\06bce250c3cff0d95f2ca4164a0ff967_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\7232.tmp"C:\Users\Admin\AppData\Local\Temp\7232.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\74C2.tmp"C:\Users\Admin\AppData\Local\Temp\74C2.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\7791.tmp"C:\Users\Admin\AppData\Local\Temp\7791.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\788B.tmp"C:\Users\Admin\AppData\Local\Temp\788B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\7937.tmp"C:\Users\Admin\AppData\Local\Temp\7937.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\7E77.tmp"C:\Users\Admin\AppData\Local\Temp\7E77.tmp"23⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\7F32.tmp"C:\Users\Admin\AppData\Local\Temp\7F32.tmp"24⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\800D.tmp"C:\Users\Admin\AppData\Local\Temp\800D.tmp"25⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\80B9.tmp"C:\Users\Admin\AppData\Local\Temp\80B9.tmp"26⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\8174.tmp"C:\Users\Admin\AppData\Local\Temp\8174.tmp"27⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\8220.tmp"C:\Users\Admin\AppData\Local\Temp\8220.tmp"28⤵
- Executes dropped EXE
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"29⤵
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\8368.tmp"C:\Users\Admin\AppData\Local\Temp\8368.tmp"30⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\8414.tmp"C:\Users\Admin\AppData\Local\Temp\8414.tmp"31⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\84D0.tmp"C:\Users\Admin\AppData\Local\Temp\84D0.tmp"32⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\856C.tmp"C:\Users\Admin\AppData\Local\Temp\856C.tmp"33⤵
- Executes dropped EXE
PID:824 -
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"34⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\86E3.tmp"C:\Users\Admin\AppData\Local\Temp\86E3.tmp"35⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\8750.tmp"C:\Users\Admin\AppData\Local\Temp\8750.tmp"36⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"37⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\886A.tmp"C:\Users\Admin\AppData\Local\Temp\886A.tmp"38⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\88F6.tmp"C:\Users\Admin\AppData\Local\Temp\88F6.tmp"39⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\8964.tmp"C:\Users\Admin\AppData\Local\Temp\8964.tmp"40⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\8A00.tmp"C:\Users\Admin\AppData\Local\Temp\8A00.tmp"41⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"42⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\8B19.tmp"C:\Users\Admin\AppData\Local\Temp\8B19.tmp"43⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\8B96.tmp"C:\Users\Admin\AppData\Local\Temp\8B96.tmp"44⤵
- Executes dropped EXE
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\8C32.tmp"C:\Users\Admin\AppData\Local\Temp\8C32.tmp"45⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"46⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"47⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"48⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"49⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"50⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"51⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"52⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\9078.tmp"C:\Users\Admin\AppData\Local\Temp\9078.tmp"53⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"54⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\9182.tmp"C:\Users\Admin\AppData\Local\Temp\9182.tmp"55⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\921E.tmp"C:\Users\Admin\AppData\Local\Temp\921E.tmp"56⤵
- Executes dropped EXE
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"57⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"58⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"59⤵
- Executes dropped EXE
PID:984 -
C:\Users\Admin\AppData\Local\Temp\9460.tmp"C:\Users\Admin\AppData\Local\Temp\9460.tmp"60⤵
- Executes dropped EXE
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\94ED.tmp"C:\Users\Admin\AppData\Local\Temp\94ED.tmp"61⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"62⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\9606.tmp"C:\Users\Admin\AppData\Local\Temp\9606.tmp"63⤵
- Executes dropped EXE
PID:884 -
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"64⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"65⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\977D.tmp"C:\Users\Admin\AppData\Local\Temp\977D.tmp"66⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\9819.tmp"C:\Users\Admin\AppData\Local\Temp\9819.tmp"67⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"68⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\9904.tmp"C:\Users\Admin\AppData\Local\Temp\9904.tmp"69⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"70⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"71⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"72⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"73⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"74⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"75⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"76⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"77⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"78⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"79⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"80⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"81⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"82⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"83⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"84⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\A160.tmp"C:\Users\Admin\AppData\Local\Temp\A160.tmp"85⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"86⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"87⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"88⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\A364.tmp"C:\Users\Admin\AppData\Local\Temp\A364.tmp"89⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"90⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"91⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"92⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\A539.tmp"C:\Users\Admin\AppData\Local\Temp\A539.tmp"93⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"94⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"95⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"96⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"97⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"98⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"99⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"100⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"101⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"102⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"103⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"104⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"105⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"106⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"107⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\AD66.tmp"C:\Users\Admin\AppData\Local\Temp\AD66.tmp"108⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"109⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"110⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"111⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\AF99.tmp"C:\Users\Admin\AppData\Local\Temp\AF99.tmp"112⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"113⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"114⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\B14E.tmp"C:\Users\Admin\AppData\Local\Temp\B14E.tmp"115⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"116⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\B258.tmp"C:\Users\Admin\AppData\Local\Temp\B258.tmp"117⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"118⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\B352.tmp"C:\Users\Admin\AppData\Local\Temp\B352.tmp"119⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"120⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"121⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"122⤵PID:2160
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-