Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2023, 15:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9c6a84022a0eabf75bf7bba94cde3682_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
9c6a84022a0eabf75bf7bba94cde3682_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
9c6a84022a0eabf75bf7bba94cde3682_mafia_JC.exe
-
Size
488KB
-
MD5
9c6a84022a0eabf75bf7bba94cde3682
-
SHA1
af6a614aa1f6008c83d2001320267b0e8d06659f
-
SHA256
2e96d097a2dc29d165617b974fb498f59e6b4f1174eaf5d57fff1a19843c2134
-
SHA512
afebaa46170475bf254ed3f1e1f3a5ec6aea2f5980b975e96c8b37810a08af16acb895259614fe9c66f3355a9d755741d2dfd6695008fc870b6fde664e44b003
-
SSDEEP
12288:/U5rCOTeiD6wLm5UKUW8CX3bOp+nkez2wxGKNZ:/UQOJDzsyCXtnk7wPN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4872 7F42.tmp 3312 800D.tmp 812 80B9.tmp 2896 8155.tmp 1832 826E.tmp 3352 82FB.tmp 1260 8397.tmp 1308 8424.tmp 2132 84C0.tmp 1036 855C.tmp 4444 8618.tmp 4084 86B4.tmp 2176 8741.tmp 1296 87ED.tmp 3316 88A8.tmp 4220 8935.tmp 4960 89D1.tmp 2320 8A6D.tmp 2736 8B0A.tmp 3056 8BD5.tmp 4504 8D0D.tmp 3680 8DB9.tmp 3424 8EB3.tmp 3536 8F6F.tmp 4636 9049.tmp 2512 90E6.tmp 4608 91B1.tmp 3700 925D.tmp 4480 9318.tmp 5016 93D4.tmp 2652 9451.tmp 2060 954B.tmp 3692 9635.tmp 3532 96B2.tmp 3348 9710.tmp 2000 978D.tmp 468 9839.tmp 1584 98B6.tmp 4284 9933.tmp 2932 99DE.tmp 3752 9A7B.tmp 3940 9B27.tmp 324 9BC3.tmp 4188 9C4F.tmp 908 9CEC.tmp 488 9D78.tmp 2764 9DE6.tmp 4204 9E82.tmp 1128 9FAB.tmp 2388 A047.tmp 3052 A0E3.tmp 1356 A170.tmp 3956 A1FD.tmp 2896 A289.tmp 636 A2F7.tmp 5080 A354.tmp 1012 A3C2.tmp 464 A43F.tmp 2268 A4DB.tmp 884 A558.tmp 836 A5E5.tmp 220 A662.tmp 2536 A6FE.tmp 4616 A78A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5092 wrote to memory of 4872 5092 9c6a84022a0eabf75bf7bba94cde3682_mafia_JC.exe 82 PID 5092 wrote to memory of 4872 5092 9c6a84022a0eabf75bf7bba94cde3682_mafia_JC.exe 82 PID 5092 wrote to memory of 4872 5092 9c6a84022a0eabf75bf7bba94cde3682_mafia_JC.exe 82 PID 4872 wrote to memory of 3312 4872 7F42.tmp 83 PID 4872 wrote to memory of 3312 4872 7F42.tmp 83 PID 4872 wrote to memory of 3312 4872 7F42.tmp 83 PID 3312 wrote to memory of 812 3312 800D.tmp 84 PID 3312 wrote to memory of 812 3312 800D.tmp 84 PID 3312 wrote to memory of 812 3312 800D.tmp 84 PID 812 wrote to memory of 2896 812 80B9.tmp 85 PID 812 wrote to memory of 2896 812 80B9.tmp 85 PID 812 wrote to memory of 2896 812 80B9.tmp 85 PID 2896 wrote to memory of 1832 2896 8155.tmp 86 PID 2896 wrote to memory of 1832 2896 8155.tmp 86 PID 2896 wrote to memory of 1832 2896 8155.tmp 86 PID 1832 wrote to memory of 3352 1832 826E.tmp 87 PID 1832 wrote to memory of 3352 1832 826E.tmp 87 PID 1832 wrote to memory of 3352 1832 826E.tmp 87 PID 3352 wrote to memory of 1260 3352 82FB.tmp 88 PID 3352 wrote to memory of 1260 3352 82FB.tmp 88 PID 3352 wrote to memory of 1260 3352 82FB.tmp 88 PID 1260 wrote to memory of 1308 1260 8397.tmp 89 PID 1260 wrote to memory of 1308 1260 8397.tmp 89 PID 1260 wrote to memory of 1308 1260 8397.tmp 89 PID 1308 wrote to memory of 2132 1308 8424.tmp 90 PID 1308 wrote to memory of 2132 1308 8424.tmp 90 PID 1308 wrote to memory of 2132 1308 8424.tmp 90 PID 2132 wrote to memory of 1036 2132 84C0.tmp 92 PID 2132 wrote to memory of 1036 2132 84C0.tmp 92 PID 2132 wrote to memory of 1036 2132 84C0.tmp 92 PID 1036 wrote to memory of 4444 1036 855C.tmp 93 PID 1036 wrote to memory of 4444 1036 855C.tmp 93 PID 1036 wrote to memory of 4444 1036 855C.tmp 93 PID 4444 wrote to memory of 4084 4444 8618.tmp 94 PID 4444 wrote to memory of 4084 4444 8618.tmp 94 PID 4444 wrote to memory of 4084 4444 8618.tmp 94 PID 4084 wrote to memory of 2176 4084 86B4.tmp 95 PID 4084 wrote to memory of 2176 4084 86B4.tmp 95 PID 4084 wrote to memory of 2176 4084 86B4.tmp 95 PID 2176 wrote to memory of 1296 2176 8741.tmp 96 PID 2176 wrote to memory of 1296 2176 8741.tmp 96 PID 2176 wrote to memory of 1296 2176 8741.tmp 96 PID 1296 wrote to memory of 3316 1296 87ED.tmp 97 PID 1296 wrote to memory of 3316 1296 87ED.tmp 97 PID 1296 wrote to memory of 3316 1296 87ED.tmp 97 PID 3316 wrote to memory of 4220 3316 88A8.tmp 98 PID 3316 wrote to memory of 4220 3316 88A8.tmp 98 PID 3316 wrote to memory of 4220 3316 88A8.tmp 98 PID 4220 wrote to memory of 4960 4220 8935.tmp 99 PID 4220 wrote to memory of 4960 4220 8935.tmp 99 PID 4220 wrote to memory of 4960 4220 8935.tmp 99 PID 4960 wrote to memory of 2320 4960 89D1.tmp 100 PID 4960 wrote to memory of 2320 4960 89D1.tmp 100 PID 4960 wrote to memory of 2320 4960 89D1.tmp 100 PID 2320 wrote to memory of 2736 2320 8A6D.tmp 101 PID 2320 wrote to memory of 2736 2320 8A6D.tmp 101 PID 2320 wrote to memory of 2736 2320 8A6D.tmp 101 PID 2736 wrote to memory of 3056 2736 8B0A.tmp 102 PID 2736 wrote to memory of 3056 2736 8B0A.tmp 102 PID 2736 wrote to memory of 3056 2736 8B0A.tmp 102 PID 3056 wrote to memory of 4504 3056 8BD5.tmp 103 PID 3056 wrote to memory of 4504 3056 8BD5.tmp 103 PID 3056 wrote to memory of 4504 3056 8BD5.tmp 103 PID 4504 wrote to memory of 3680 4504 8D0D.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c6a84022a0eabf75bf7bba94cde3682_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\9c6a84022a0eabf75bf7bba94cde3682_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\7F42.tmp"C:\Users\Admin\AppData\Local\Temp\7F42.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\800D.tmp"C:\Users\Admin\AppData\Local\Temp\800D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\80B9.tmp"C:\Users\Admin\AppData\Local\Temp\80B9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Users\Admin\AppData\Local\Temp\8155.tmp"C:\Users\Admin\AppData\Local\Temp\8155.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\82FB.tmp"C:\Users\Admin\AppData\Local\Temp\82FB.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\8424.tmp"C:\Users\Admin\AppData\Local\Temp\8424.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\84C0.tmp"C:\Users\Admin\AppData\Local\Temp\84C0.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\855C.tmp"C:\Users\Admin\AppData\Local\Temp\855C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\8618.tmp"C:\Users\Admin\AppData\Local\Temp\8618.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\8741.tmp"C:\Users\Admin\AppData\Local\Temp\8741.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\88A8.tmp"C:\Users\Admin\AppData\Local\Temp\88A8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\8935.tmp"C:\Users\Admin\AppData\Local\Temp\8935.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\89D1.tmp"C:\Users\Admin\AppData\Local\Temp\89D1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"23⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"24⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"25⤵
- Executes dropped EXE
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\9049.tmp"C:\Users\Admin\AppData\Local\Temp\9049.tmp"26⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\90E6.tmp"C:\Users\Admin\AppData\Local\Temp\90E6.tmp"27⤵
- Executes dropped EXE
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\91B1.tmp"C:\Users\Admin\AppData\Local\Temp\91B1.tmp"28⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"29⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"30⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"31⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\9451.tmp"C:\Users\Admin\AppData\Local\Temp\9451.tmp"32⤵
- Executes dropped EXE
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\954B.tmp"C:\Users\Admin\AppData\Local\Temp\954B.tmp"33⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"34⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\96B2.tmp"C:\Users\Admin\AppData\Local\Temp\96B2.tmp"35⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\9710.tmp"C:\Users\Admin\AppData\Local\Temp\9710.tmp"36⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\978D.tmp"C:\Users\Admin\AppData\Local\Temp\978D.tmp"37⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\9839.tmp"C:\Users\Admin\AppData\Local\Temp\9839.tmp"38⤵
- Executes dropped EXE
PID:468 -
C:\Users\Admin\AppData\Local\Temp\98B6.tmp"C:\Users\Admin\AppData\Local\Temp\98B6.tmp"39⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"40⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"41⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"42⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"43⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"44⤵
- Executes dropped EXE
PID:324 -
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"45⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"46⤵
- Executes dropped EXE
PID:908 -
C:\Users\Admin\AppData\Local\Temp\9D78.tmp"C:\Users\Admin\AppData\Local\Temp\9D78.tmp"47⤵
- Executes dropped EXE
PID:488 -
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"48⤵
- Executes dropped EXE
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"49⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"50⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"51⤵
- Executes dropped EXE
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\A047.tmp"C:\Users\Admin\AppData\Local\Temp\A047.tmp"52⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"53⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"54⤵
- Executes dropped EXE
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"55⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"56⤵
- Executes dropped EXE
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"57⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\A354.tmp"C:\Users\Admin\AppData\Local\Temp\A354.tmp"58⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"59⤵
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\A43F.tmp"C:\Users\Admin\AppData\Local\Temp\A43F.tmp"60⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"61⤵
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"62⤵
- Executes dropped EXE
PID:884 -
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"63⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\A662.tmp"C:\Users\Admin\AppData\Local\Temp\A662.tmp"64⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"65⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\A78A.tmp"C:\Users\Admin\AppData\Local\Temp\A78A.tmp"66⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"67⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\A894.tmp"C:\Users\Admin\AppData\Local\Temp\A894.tmp"68⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\A921.tmp"C:\Users\Admin\AppData\Local\Temp\A921.tmp"69⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\A99E.tmp"C:\Users\Admin\AppData\Local\Temp\A99E.tmp"70⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"71⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\AA88.tmp"C:\Users\Admin\AppData\Local\Temp\AA88.tmp"72⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"73⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"74⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"75⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"76⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"77⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"78⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"79⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\AE80.tmp"C:\Users\Admin\AppData\Local\Temp\AE80.tmp"80⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"81⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\AF99.tmp"C:\Users\Admin\AppData\Local\Temp\AF99.tmp"82⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"83⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"84⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\B120.tmp"C:\Users\Admin\AppData\Local\Temp\B120.tmp"85⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"86⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\B239.tmp"C:\Users\Admin\AppData\Local\Temp\B239.tmp"87⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"88⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\B323.tmp"C:\Users\Admin\AppData\Local\Temp\B323.tmp"89⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\B391.tmp"C:\Users\Admin\AppData\Local\Temp\B391.tmp"90⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"91⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\B48B.tmp"C:\Users\Admin\AppData\Local\Temp\B48B.tmp"92⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\B517.tmp"C:\Users\Admin\AppData\Local\Temp\B517.tmp"93⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\B575.tmp"C:\Users\Admin\AppData\Local\Temp\B575.tmp"94⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\B611.tmp"C:\Users\Admin\AppData\Local\Temp\B611.tmp"95⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"96⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\B72A.tmp"C:\Users\Admin\AppData\Local\Temp\B72A.tmp"97⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"98⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\B863.tmp"C:\Users\Admin\AppData\Local\Temp\B863.tmp"99⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"100⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\B96D.tmp"C:\Users\Admin\AppData\Local\Temp\B96D.tmp"101⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\BA18.tmp"C:\Users\Admin\AppData\Local\Temp\BA18.tmp"102⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"103⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\BB80.tmp"C:\Users\Admin\AppData\Local\Temp\BB80.tmp"104⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"105⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\BC99.tmp"C:\Users\Admin\AppData\Local\Temp\BC99.tmp"106⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\BD35.tmp"C:\Users\Admin\AppData\Local\Temp\BD35.tmp"107⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"108⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"109⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"110⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\BF77.tmp"C:\Users\Admin\AppData\Local\Temp\BF77.tmp"111⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"112⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\C071.tmp"C:\Users\Admin\AppData\Local\Temp\C071.tmp"113⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"114⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"115⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"116⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"117⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\C350.tmp"C:\Users\Admin\AppData\Local\Temp\C350.tmp"118⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"119⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\C488.tmp"C:\Users\Admin\AppData\Local\Temp\C488.tmp"120⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\C505.tmp"C:\Users\Admin\AppData\Local\Temp\C505.tmp"121⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\C592.tmp"C:\Users\Admin\AppData\Local\Temp\C592.tmp"122⤵PID:2792
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-