Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
22/08/2023, 17:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6d97de5b70a67e42b94018d93c292b54_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
6d97de5b70a67e42b94018d93c292b54_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
6d97de5b70a67e42b94018d93c292b54_mafia_JC.exe
-
Size
527KB
-
MD5
6d97de5b70a67e42b94018d93c292b54
-
SHA1
39c1e77eda052772b7957ab3b8d27ef3263c5438
-
SHA256
511e2e1df9af6a829bf008e6cd58c1aac82d92d7367766fd2c792e0d75a37af1
-
SHA512
7e7934ab024742a02c0c2a38eb61d4bf21874a642fc35fda1c393bc8cc406c2ee838c40b8f4585004f6dde08c6257350823c3cf9fa3efaabc430427843a23b69
-
SSDEEP
12288:fU5rCOTeidnq1mwpVW2IgBIjuyiAEDZu:fUQOJdnUphBCu9Do
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4720 90E6.tmp 4024 91B1.tmp 2708 927C.tmp 4548 9366.tmp 3240 9402.tmp 3360 949F.tmp 384 9599.tmp 4616 9693.tmp 1620 975E.tmp 1060 9858.tmp 5064 9913.tmp 4220 9A1D.tmp 1380 9B17.tmp 3264 9BA4.tmp 2848 9C6F.tmp 5076 9CFB.tmp 1336 9D98.tmp 4052 9EC0.tmp 1696 9F6C.tmp 632 A057.tmp 1452 A0E3.tmp 2312 A1BE.tmp 2920 A24B.tmp 3496 A306.tmp 3768 A3C2.tmp 2392 A4CB.tmp 2816 A587.tmp 3996 A681.tmp 812 A71D.tmp 956 A817.tmp 1128 A901.tmp 4344 A9DC.tmp 3904 AAC7.tmp 3196 AB63.tmp 1704 ABEF.tmp 3860 AC7C.tmp 3436 ACE9.tmp 1532 AD57.tmp 4712 AE03.tmp 1472 AE80.tmp 3352 AF0C.tmp 3964 AFA9.tmp 2328 B035.tmp 4060 B0B2.tmp 1596 B13F.tmp 3060 B1CB.tmp 4560 B268.tmp 2092 B2E5.tmp 3296 B371.tmp 3232 B41D.tmp 3688 B48B.tmp 2520 B527.tmp 3020 B5B3.tmp 4728 B630.tmp 4776 B6CD.tmp 2220 B769.tmp 2712 B805.tmp 2864 B882.tmp 1016 B8F0.tmp 1044 B94D.tmp 3584 B9BB.tmp 3340 BA38.tmp 1540 BAA5.tmp 8 BB03.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2520 wrote to memory of 4720 2520 6d97de5b70a67e42b94018d93c292b54_mafia_JC.exe 82 PID 2520 wrote to memory of 4720 2520 6d97de5b70a67e42b94018d93c292b54_mafia_JC.exe 82 PID 2520 wrote to memory of 4720 2520 6d97de5b70a67e42b94018d93c292b54_mafia_JC.exe 82 PID 4720 wrote to memory of 4024 4720 90E6.tmp 83 PID 4720 wrote to memory of 4024 4720 90E6.tmp 83 PID 4720 wrote to memory of 4024 4720 90E6.tmp 83 PID 4024 wrote to memory of 2708 4024 91B1.tmp 84 PID 4024 wrote to memory of 2708 4024 91B1.tmp 84 PID 4024 wrote to memory of 2708 4024 91B1.tmp 84 PID 2708 wrote to memory of 4548 2708 927C.tmp 85 PID 2708 wrote to memory of 4548 2708 927C.tmp 85 PID 2708 wrote to memory of 4548 2708 927C.tmp 85 PID 4548 wrote to memory of 3240 4548 9366.tmp 86 PID 4548 wrote to memory of 3240 4548 9366.tmp 86 PID 4548 wrote to memory of 3240 4548 9366.tmp 86 PID 3240 wrote to memory of 3360 3240 9402.tmp 87 PID 3240 wrote to memory of 3360 3240 9402.tmp 87 PID 3240 wrote to memory of 3360 3240 9402.tmp 87 PID 3360 wrote to memory of 384 3360 949F.tmp 88 PID 3360 wrote to memory of 384 3360 949F.tmp 88 PID 3360 wrote to memory of 384 3360 949F.tmp 88 PID 384 wrote to memory of 4616 384 9599.tmp 90 PID 384 wrote to memory of 4616 384 9599.tmp 90 PID 384 wrote to memory of 4616 384 9599.tmp 90 PID 4616 wrote to memory of 1620 4616 9693.tmp 91 PID 4616 wrote to memory of 1620 4616 9693.tmp 91 PID 4616 wrote to memory of 1620 4616 9693.tmp 91 PID 1620 wrote to memory of 1060 1620 975E.tmp 92 PID 1620 wrote to memory of 1060 1620 975E.tmp 92 PID 1620 wrote to memory of 1060 1620 975E.tmp 92 PID 1060 wrote to memory of 5064 1060 9858.tmp 93 PID 1060 wrote to memory of 5064 1060 9858.tmp 93 PID 1060 wrote to memory of 5064 1060 9858.tmp 93 PID 5064 wrote to memory of 4220 5064 9913.tmp 94 PID 5064 wrote to memory of 4220 5064 9913.tmp 94 PID 5064 wrote to memory of 4220 5064 9913.tmp 94 PID 4220 wrote to memory of 1380 4220 9A1D.tmp 95 PID 4220 wrote to memory of 1380 4220 9A1D.tmp 95 PID 4220 wrote to memory of 1380 4220 9A1D.tmp 95 PID 1380 wrote to memory of 3264 1380 9B17.tmp 96 PID 1380 wrote to memory of 3264 1380 9B17.tmp 96 PID 1380 wrote to memory of 3264 1380 9B17.tmp 96 PID 3264 wrote to memory of 2848 3264 9BA4.tmp 99 PID 3264 wrote to memory of 2848 3264 9BA4.tmp 99 PID 3264 wrote to memory of 2848 3264 9BA4.tmp 99 PID 2848 wrote to memory of 5076 2848 9C6F.tmp 100 PID 2848 wrote to memory of 5076 2848 9C6F.tmp 100 PID 2848 wrote to memory of 5076 2848 9C6F.tmp 100 PID 5076 wrote to memory of 1336 5076 9CFB.tmp 101 PID 5076 wrote to memory of 1336 5076 9CFB.tmp 101 PID 5076 wrote to memory of 1336 5076 9CFB.tmp 101 PID 1336 wrote to memory of 4052 1336 9D98.tmp 102 PID 1336 wrote to memory of 4052 1336 9D98.tmp 102 PID 1336 wrote to memory of 4052 1336 9D98.tmp 102 PID 4052 wrote to memory of 1696 4052 9EC0.tmp 103 PID 4052 wrote to memory of 1696 4052 9EC0.tmp 103 PID 4052 wrote to memory of 1696 4052 9EC0.tmp 103 PID 1696 wrote to memory of 632 1696 9F6C.tmp 104 PID 1696 wrote to memory of 632 1696 9F6C.tmp 104 PID 1696 wrote to memory of 632 1696 9F6C.tmp 104 PID 632 wrote to memory of 1452 632 A057.tmp 106 PID 632 wrote to memory of 1452 632 A057.tmp 106 PID 632 wrote to memory of 1452 632 A057.tmp 106 PID 1452 wrote to memory of 2312 1452 A0E3.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d97de5b70a67e42b94018d93c292b54_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\6d97de5b70a67e42b94018d93c292b54_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\90E6.tmp"C:\Users\Admin\AppData\Local\Temp\90E6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\91B1.tmp"C:\Users\Admin\AppData\Local\Temp\91B1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\927C.tmp"C:\Users\Admin\AppData\Local\Temp\927C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\9366.tmp"C:\Users\Admin\AppData\Local\Temp\9366.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\9402.tmp"C:\Users\Admin\AppData\Local\Temp\9402.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\9599.tmp"C:\Users\Admin\AppData\Local\Temp\9599.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\AppData\Local\Temp\9693.tmp"C:\Users\Admin\AppData\Local\Temp\9693.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"23⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\A24B.tmp"C:\Users\Admin\AppData\Local\Temp\A24B.tmp"24⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\A306.tmp"C:\Users\Admin\AppData\Local\Temp\A306.tmp"25⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"26⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"27⤵
- Executes dropped EXE
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"28⤵
- Executes dropped EXE
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"29⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"30⤵
- Executes dropped EXE
PID:812 -
C:\Users\Admin\AppData\Local\Temp\A817.tmp"C:\Users\Admin\AppData\Local\Temp\A817.tmp"31⤵
- Executes dropped EXE
PID:956 -
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"32⤵
- Executes dropped EXE
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"33⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"34⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"35⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"36⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"37⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"38⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\AD57.tmp"C:\Users\Admin\AppData\Local\Temp\AD57.tmp"39⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"40⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\AE80.tmp"C:\Users\Admin\AppData\Local\Temp\AE80.tmp"41⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"42⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"43⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\B035.tmp"C:\Users\Admin\AppData\Local\Temp\B035.tmp"44⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"45⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"46⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"47⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\B268.tmp"C:\Users\Admin\AppData\Local\Temp\B268.tmp"48⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"49⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\B371.tmp"C:\Users\Admin\AppData\Local\Temp\B371.tmp"50⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\B41D.tmp"C:\Users\Admin\AppData\Local\Temp\B41D.tmp"51⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\B48B.tmp"C:\Users\Admin\AppData\Local\Temp\B48B.tmp"52⤵
- Executes dropped EXE
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\B527.tmp"C:\Users\Admin\AppData\Local\Temp\B527.tmp"53⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"54⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"55⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"56⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\B769.tmp"C:\Users\Admin\AppData\Local\Temp\B769.tmp"57⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\B805.tmp"C:\Users\Admin\AppData\Local\Temp\B805.tmp"58⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\B882.tmp"C:\Users\Admin\AppData\Local\Temp\B882.tmp"59⤵
- Executes dropped EXE
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"60⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\B94D.tmp"C:\Users\Admin\AppData\Local\Temp\B94D.tmp"61⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"62⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\BA38.tmp"C:\Users\Admin\AppData\Local\Temp\BA38.tmp"63⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"64⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\BB03.tmp"C:\Users\Admin\AppData\Local\Temp\BB03.tmp"65⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\BB80.tmp"C:\Users\Admin\AppData\Local\Temp\BB80.tmp"66⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\BBED.tmp"C:\Users\Admin\AppData\Local\Temp\BBED.tmp"67⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"68⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"69⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\BD64.tmp"C:\Users\Admin\AppData\Local\Temp\BD64.tmp"70⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"71⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"72⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"73⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\BF68.tmp"C:\Users\Admin\AppData\Local\Temp\BF68.tmp"74⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"75⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\C071.tmp"C:\Users\Admin\AppData\Local\Temp\C071.tmp"76⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\C11D.tmp"C:\Users\Admin\AppData\Local\Temp\C11D.tmp"77⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"78⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"79⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\C294.tmp"C:\Users\Admin\AppData\Local\Temp\C294.tmp"80⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\C321.tmp"C:\Users\Admin\AppData\Local\Temp\C321.tmp"81⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"82⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\C44A.tmp"C:\Users\Admin\AppData\Local\Temp\C44A.tmp"83⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\C4C7.tmp"C:\Users\Admin\AppData\Local\Temp\C4C7.tmp"84⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\C525.tmp"C:\Users\Admin\AppData\Local\Temp\C525.tmp"85⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\C592.tmp"C:\Users\Admin\AppData\Local\Temp\C592.tmp"86⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\C5F0.tmp"C:\Users\Admin\AppData\Local\Temp\C5F0.tmp"87⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\C65D.tmp"C:\Users\Admin\AppData\Local\Temp\C65D.tmp"88⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\C6EA.tmp"C:\Users\Admin\AppData\Local\Temp\C6EA.tmp"89⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\C767.tmp"C:\Users\Admin\AppData\Local\Temp\C767.tmp"90⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"91⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\C880.tmp"C:\Users\Admin\AppData\Local\Temp\C880.tmp"92⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"93⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\C97A.tmp"C:\Users\Admin\AppData\Local\Temp\C97A.tmp"94⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"95⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\CA84.tmp"C:\Users\Admin\AppData\Local\Temp\CA84.tmp"96⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\CB20.tmp"C:\Users\Admin\AppData\Local\Temp\CB20.tmp"97⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\CBBC.tmp"C:\Users\Admin\AppData\Local\Temp\CBBC.tmp"98⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\CC29.tmp"C:\Users\Admin\AppData\Local\Temp\CC29.tmp"99⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"100⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\CD33.tmp"C:\Users\Admin\AppData\Local\Temp\CD33.tmp"101⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"102⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"103⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\CEE9.tmp"C:\Users\Admin\AppData\Local\Temp\CEE9.tmp"104⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\CF85.tmp"C:\Users\Admin\AppData\Local\Temp\CF85.tmp"105⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\D011.tmp"C:\Users\Admin\AppData\Local\Temp\D011.tmp"106⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"107⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\D14A.tmp"C:\Users\Admin\AppData\Local\Temp\D14A.tmp"108⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"109⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\D273.tmp"C:\Users\Admin\AppData\Local\Temp\D273.tmp"110⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"111⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\D37C.tmp"C:\Users\Admin\AppData\Local\Temp\D37C.tmp"112⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\D419.tmp"C:\Users\Admin\AppData\Local\Temp\D419.tmp"113⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\D4B5.tmp"C:\Users\Admin\AppData\Local\Temp\D4B5.tmp"114⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\D551.tmp"C:\Users\Admin\AppData\Local\Temp\D551.tmp"115⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"116⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\D68A.tmp"C:\Users\Admin\AppData\Local\Temp\D68A.tmp"117⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"118⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\D7A3.tmp"C:\Users\Admin\AppData\Local\Temp\D7A3.tmp"119⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\D810.tmp"C:\Users\Admin\AppData\Local\Temp\D810.tmp"120⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\D88D.tmp"C:\Users\Admin\AppData\Local\Temp\D88D.tmp"121⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\D90A.tmp"C:\Users\Admin\AppData\Local\Temp\D90A.tmp"122⤵PID:2120
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-