Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
29-08-2023 15:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cd2a3f01a7893972b0cefeab38e54222_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
cd2a3f01a7893972b0cefeab38e54222_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
cd2a3f01a7893972b0cefeab38e54222_mafia_JC.exe
-
Size
527KB
-
MD5
cd2a3f01a7893972b0cefeab38e54222
-
SHA1
5b2107e5aec4ee208608534ad9949c7f16e865ce
-
SHA256
faf3ba1bc10f1c6369967b4cec86bee6c438c970e9e66c803901e9e4207d7de2
-
SHA512
7b2d6fdc6942abdfded5be254b9d6c778287ad877802d1d89604b96b93ad12d4586f36732722fb6c308cd876f94ff829fbd20fe097ec278cc2db601044c1ad5e
-
SSDEEP
12288:fU5rCOTeid643hQElfE97PBqUQbIrq19Yt3m80MFQ3DZu:fUQOJdyE5E97pqUQbat3mYFQ3Do
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4632 7C83.tmp 3992 7D7D.tmp 1100 7E58.tmp 3424 7F13.tmp 2856 7FBF.tmp 948 805B.tmp 3396 8126.tmp 4460 8220.tmp 5036 82EB.tmp 1352 83F5.tmp 1804 8491.tmp 4744 854D.tmp 2068 85CA.tmp 4928 8722.tmp 1532 87AE.tmp 4792 8879.tmp 2768 8906.tmp 1980 8A1F.tmp 3776 8ADB.tmp 3880 8B77.tmp 4468 8C23.tmp 1328 8CAF.tmp 1624 8D3C.tmp 1884 8DD8.tmp 492 8E55.tmp 4816 8EE2.tmp 4620 8F9D.tmp 4612 90A7.tmp 2720 9182.tmp 3680 922E.tmp 820 9308.tmp 2680 9412.tmp 2368 94AE.tmp 464 952B.tmp 2112 95A8.tmp 5000 9625.tmp 3436 96B2.tmp 4904 972F.tmp 3856 97AC.tmp 2984 9848.tmp 2488 98E4.tmp 4960 9961.tmp 4592 99EE.tmp 392 9A9A.tmp 2116 9B46.tmp 5016 9BC3.tmp 1188 9C7E.tmp 2428 9CEC.tmp 1916 9D78.tmp 2188 9E05.tmp 3784 9E92.tmp 2980 9F3D.tmp 728 9FDA.tmp 3892 A086.tmp 4196 A112.tmp 2496 A19F.tmp 4784 A22B.tmp 3124 A2B8.tmp 4524 A335.tmp 4116 A3D1.tmp 1996 A43F.tmp 4884 A4BC.tmp 4928 A529.tmp 2028 A5C5.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5016 wrote to memory of 4632 5016 cd2a3f01a7893972b0cefeab38e54222_mafia_JC.exe 80 PID 5016 wrote to memory of 4632 5016 cd2a3f01a7893972b0cefeab38e54222_mafia_JC.exe 80 PID 5016 wrote to memory of 4632 5016 cd2a3f01a7893972b0cefeab38e54222_mafia_JC.exe 80 PID 4632 wrote to memory of 3992 4632 7C83.tmp 81 PID 4632 wrote to memory of 3992 4632 7C83.tmp 81 PID 4632 wrote to memory of 3992 4632 7C83.tmp 81 PID 3992 wrote to memory of 1100 3992 7D7D.tmp 82 PID 3992 wrote to memory of 1100 3992 7D7D.tmp 82 PID 3992 wrote to memory of 1100 3992 7D7D.tmp 82 PID 1100 wrote to memory of 3424 1100 7E58.tmp 83 PID 1100 wrote to memory of 3424 1100 7E58.tmp 83 PID 1100 wrote to memory of 3424 1100 7E58.tmp 83 PID 3424 wrote to memory of 2856 3424 7F13.tmp 84 PID 3424 wrote to memory of 2856 3424 7F13.tmp 84 PID 3424 wrote to memory of 2856 3424 7F13.tmp 84 PID 2856 wrote to memory of 948 2856 7FBF.tmp 85 PID 2856 wrote to memory of 948 2856 7FBF.tmp 85 PID 2856 wrote to memory of 948 2856 7FBF.tmp 85 PID 948 wrote to memory of 3396 948 805B.tmp 86 PID 948 wrote to memory of 3396 948 805B.tmp 86 PID 948 wrote to memory of 3396 948 805B.tmp 86 PID 3396 wrote to memory of 4460 3396 8126.tmp 88 PID 3396 wrote to memory of 4460 3396 8126.tmp 88 PID 3396 wrote to memory of 4460 3396 8126.tmp 88 PID 4460 wrote to memory of 5036 4460 8220.tmp 89 PID 4460 wrote to memory of 5036 4460 8220.tmp 89 PID 4460 wrote to memory of 5036 4460 8220.tmp 89 PID 5036 wrote to memory of 1352 5036 82EB.tmp 90 PID 5036 wrote to memory of 1352 5036 82EB.tmp 90 PID 5036 wrote to memory of 1352 5036 82EB.tmp 90 PID 1352 wrote to memory of 1804 1352 83F5.tmp 91 PID 1352 wrote to memory of 1804 1352 83F5.tmp 91 PID 1352 wrote to memory of 1804 1352 83F5.tmp 91 PID 1804 wrote to memory of 4744 1804 8491.tmp 92 PID 1804 wrote to memory of 4744 1804 8491.tmp 92 PID 1804 wrote to memory of 4744 1804 8491.tmp 92 PID 4744 wrote to memory of 2068 4744 854D.tmp 93 PID 4744 wrote to memory of 2068 4744 854D.tmp 93 PID 4744 wrote to memory of 2068 4744 854D.tmp 93 PID 2068 wrote to memory of 4928 2068 85CA.tmp 94 PID 2068 wrote to memory of 4928 2068 85CA.tmp 94 PID 2068 wrote to memory of 4928 2068 85CA.tmp 94 PID 4928 wrote to memory of 1532 4928 8722.tmp 97 PID 4928 wrote to memory of 1532 4928 8722.tmp 97 PID 4928 wrote to memory of 1532 4928 8722.tmp 97 PID 1532 wrote to memory of 4792 1532 87AE.tmp 98 PID 1532 wrote to memory of 4792 1532 87AE.tmp 98 PID 1532 wrote to memory of 4792 1532 87AE.tmp 98 PID 4792 wrote to memory of 2768 4792 8879.tmp 99 PID 4792 wrote to memory of 2768 4792 8879.tmp 99 PID 4792 wrote to memory of 2768 4792 8879.tmp 99 PID 2768 wrote to memory of 1980 2768 8906.tmp 100 PID 2768 wrote to memory of 1980 2768 8906.tmp 100 PID 2768 wrote to memory of 1980 2768 8906.tmp 100 PID 1980 wrote to memory of 3776 1980 8A1F.tmp 101 PID 1980 wrote to memory of 3776 1980 8A1F.tmp 101 PID 1980 wrote to memory of 3776 1980 8A1F.tmp 101 PID 3776 wrote to memory of 3880 3776 8ADB.tmp 102 PID 3776 wrote to memory of 3880 3776 8ADB.tmp 102 PID 3776 wrote to memory of 3880 3776 8ADB.tmp 102 PID 3880 wrote to memory of 4468 3880 8B77.tmp 103 PID 3880 wrote to memory of 4468 3880 8B77.tmp 103 PID 3880 wrote to memory of 4468 3880 8B77.tmp 103 PID 4468 wrote to memory of 1328 4468 8C23.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd2a3f01a7893972b0cefeab38e54222_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\cd2a3f01a7893972b0cefeab38e54222_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\7C83.tmp"C:\Users\Admin\AppData\Local\Temp\7C83.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\7F13.tmp"C:\Users\Admin\AppData\Local\Temp\7F13.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\805B.tmp"C:\Users\Admin\AppData\Local\Temp\805B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\8126.tmp"C:\Users\Admin\AppData\Local\Temp\8126.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\8220.tmp"C:\Users\Admin\AppData\Local\Temp\8220.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\82EB.tmp"C:\Users\Admin\AppData\Local\Temp\82EB.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\83F5.tmp"C:\Users\Admin\AppData\Local\Temp\83F5.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\8491.tmp"C:\Users\Admin\AppData\Local\Temp\8491.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\854D.tmp"C:\Users\Admin\AppData\Local\Temp\854D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\85CA.tmp"C:\Users\Admin\AppData\Local\Temp\85CA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\8722.tmp"C:\Users\Admin\AppData\Local\Temp\8722.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\87AE.tmp"C:\Users\Admin\AppData\Local\Temp\87AE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\8879.tmp"C:\Users\Admin\AppData\Local\Temp\8879.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\8906.tmp"C:\Users\Admin\AppData\Local\Temp\8906.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\8B77.tmp"C:\Users\Admin\AppData\Local\Temp\8B77.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\8C23.tmp"C:\Users\Admin\AppData\Local\Temp\8C23.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"23⤵
- Executes dropped EXE
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"24⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"25⤵
- Executes dropped EXE
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\8E55.tmp"C:\Users\Admin\AppData\Local\Temp\8E55.tmp"26⤵
- Executes dropped EXE
PID:492 -
C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"27⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"28⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\90A7.tmp"C:\Users\Admin\AppData\Local\Temp\90A7.tmp"29⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\9182.tmp"C:\Users\Admin\AppData\Local\Temp\9182.tmp"30⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\922E.tmp"C:\Users\Admin\AppData\Local\Temp\922E.tmp"31⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\9308.tmp"C:\Users\Admin\AppData\Local\Temp\9308.tmp"32⤵
- Executes dropped EXE
PID:820 -
C:\Users\Admin\AppData\Local\Temp\9412.tmp"C:\Users\Admin\AppData\Local\Temp\9412.tmp"33⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\94AE.tmp"C:\Users\Admin\AppData\Local\Temp\94AE.tmp"34⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"35⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"36⤵
- Executes dropped EXE
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\9625.tmp"C:\Users\Admin\AppData\Local\Temp\9625.tmp"37⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\96B2.tmp"C:\Users\Admin\AppData\Local\Temp\96B2.tmp"38⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\972F.tmp"C:\Users\Admin\AppData\Local\Temp\972F.tmp"39⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"40⤵
- Executes dropped EXE
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\9848.tmp"C:\Users\Admin\AppData\Local\Temp\9848.tmp"41⤵
- Executes dropped EXE
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\98E4.tmp"C:\Users\Admin\AppData\Local\Temp\98E4.tmp"42⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"43⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\99EE.tmp"C:\Users\Admin\AppData\Local\Temp\99EE.tmp"44⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"45⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"46⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"47⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"48⤵
- Executes dropped EXE
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"49⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\9D78.tmp"C:\Users\Admin\AppData\Local\Temp\9D78.tmp"50⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"51⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"52⤵
- Executes dropped EXE
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"53⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"54⤵
- Executes dropped EXE
PID:728 -
C:\Users\Admin\AppData\Local\Temp\A086.tmp"C:\Users\Admin\AppData\Local\Temp\A086.tmp"55⤵
- Executes dropped EXE
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\A112.tmp"C:\Users\Admin\AppData\Local\Temp\A112.tmp"56⤵
- Executes dropped EXE
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\A19F.tmp"C:\Users\Admin\AppData\Local\Temp\A19F.tmp"57⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"58⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"59⤵
- Executes dropped EXE
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"60⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"61⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\A43F.tmp"C:\Users\Admin\AppData\Local\Temp\A43F.tmp"62⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"63⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"64⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"65⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\A633.tmp"C:\Users\Admin\AppData\Local\Temp\A633.tmp"66⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"67⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"68⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"69⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"70⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"71⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\A940.tmp"C:\Users\Admin\AppData\Local\Temp\A940.tmp"72⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"73⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\AA59.tmp"C:\Users\Admin\AppData\Local\Temp\AA59.tmp"74⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"75⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"76⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"77⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"78⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"79⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"80⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"81⤵PID:492
-
C:\Users\Admin\AppData\Local\Temp\AE60.tmp"C:\Users\Admin\AppData\Local\Temp\AE60.tmp"82⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"83⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"84⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"85⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"86⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\B12F.tmp"C:\Users\Admin\AppData\Local\Temp\B12F.tmp"87⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\B19D.tmp"C:\Users\Admin\AppData\Local\Temp\B19D.tmp"88⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\B258.tmp"C:\Users\Admin\AppData\Local\Temp\B258.tmp"89⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"90⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\B362.tmp"C:\Users\Admin\AppData\Local\Temp\B362.tmp"91⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"92⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\B48B.tmp"C:\Users\Admin\AppData\Local\Temp\B48B.tmp"93⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\B508.tmp"C:\Users\Admin\AppData\Local\Temp\B508.tmp"94⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\B594.tmp"C:\Users\Admin\AppData\Local\Temp\B594.tmp"95⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"96⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"97⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\B74A.tmp"C:\Users\Admin\AppData\Local\Temp\B74A.tmp"98⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"99⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\B844.tmp"C:\Users\Admin\AppData\Local\Temp\B844.tmp"100⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"101⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"102⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\B97C.tmp"C:\Users\Admin\AppData\Local\Temp\B97C.tmp"103⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\BA09.tmp"C:\Users\Admin\AppData\Local\Temp\BA09.tmp"104⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\BA95.tmp"C:\Users\Admin\AppData\Local\Temp\BA95.tmp"105⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\BB22.tmp"C:\Users\Admin\AppData\Local\Temp\BB22.tmp"106⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"107⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"108⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"109⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\BD83.tmp"C:\Users\Admin\AppData\Local\Temp\BD83.tmp"110⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\BE20.tmp"C:\Users\Admin\AppData\Local\Temp\BE20.tmp"111⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"112⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\BF29.tmp"C:\Users\Admin\AppData\Local\Temp\BF29.tmp"113⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"114⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"115⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"116⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"117⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"118⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\C285.tmp"C:\Users\Admin\AppData\Local\Temp\C285.tmp"119⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\C311.tmp"C:\Users\Admin\AppData\Local\Temp\C311.tmp"120⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"121⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\C43A.tmp"C:\Users\Admin\AppData\Local\Temp\C43A.tmp"122⤵PID:3460
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-