Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
31/08/2023, 17:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f7b72969bd08f44ea0cac9cf7a048027_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
f7b72969bd08f44ea0cac9cf7a048027_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
f7b72969bd08f44ea0cac9cf7a048027_mafia_JC.exe
-
Size
488KB
-
MD5
f7b72969bd08f44ea0cac9cf7a048027
-
SHA1
1230415e8d2f1477b5df2510cff084de78303c88
-
SHA256
9700764f958c8fff2b663b2e7fbde9817870bfa64e85e8527e6f50656182a6e1
-
SHA512
36b941edd1fca189aca1227fe6e4e6741fac03f4d05e7924c24691e01521139bc682632075524d03c3f9ec7eb1e848fc96c0940f3456b962aa5128a796b79a7c
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7xuvRmKIYZvXUmlDWWKrmbB728RgAsH3dZ:/U5rCOTeiDxsDKIDWW4mNfgJNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4924 D225.tmp 1508 D2F0.tmp 3852 D39C.tmp 1072 D476.tmp 3108 D522.tmp 2892 D5DE.tmp 2312 D699.tmp 4072 D726.tmp 2328 D7F1.tmp 832 D8EB.tmp 4508 D9D5.tmp 4588 DA62.tmp 1892 DB2D.tmp 1552 DC08.tmp 3092 DC95.tmp 4192 DD40.tmp 784 DF44.tmp 2032 DFD1.tmp 4224 E06D.tmp 1100 E465.tmp 4428 E501.tmp 5012 E57E.tmp 2432 E62A.tmp 3652 E6B6.tmp 3724 E7C0.tmp 2960 E8BA.tmp 2280 E947.tmp 4016 E9D3.tmp 3904 EA7F.tmp 3344 EB1B.tmp 3648 EBD7.tmp 4536 ECA2.tmp 2140 ED8C.tmp 4364 EE09.tmp 3700 EEB5.tmp 4796 EF51.tmp 4908 EFDE.tmp 5068 F05B.tmp 3948 F0C8.tmp 3196 F155.tmp 440 F201.tmp 4232 F27E.tmp 1228 F32A.tmp 780 F3D6.tmp 3924 F482.tmp 2388 F52D.tmp 3104 F5D9.tmp 1604 F666.tmp 2932 F712.tmp 3736 F77F.tmp 3200 F7FC.tmp 4328 F898.tmp 4856 F935.tmp 2232 F9B2.tmp 1536 FA2F.tmp 4924 FACB.tmp 4640 FB58.tmp 1292 FBC5.tmp 4724 FC42.tmp 2440 FCAF.tmp 3512 FD3C.tmp 2760 FDA9.tmp 224 FE26.tmp 3964 FEA3.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2176 wrote to memory of 4924 2176 f7b72969bd08f44ea0cac9cf7a048027_mafia_JC.exe 81 PID 2176 wrote to memory of 4924 2176 f7b72969bd08f44ea0cac9cf7a048027_mafia_JC.exe 81 PID 2176 wrote to memory of 4924 2176 f7b72969bd08f44ea0cac9cf7a048027_mafia_JC.exe 81 PID 4924 wrote to memory of 1508 4924 D225.tmp 82 PID 4924 wrote to memory of 1508 4924 D225.tmp 82 PID 4924 wrote to memory of 1508 4924 D225.tmp 82 PID 1508 wrote to memory of 3852 1508 D2F0.tmp 83 PID 1508 wrote to memory of 3852 1508 D2F0.tmp 83 PID 1508 wrote to memory of 3852 1508 D2F0.tmp 83 PID 3852 wrote to memory of 1072 3852 D39C.tmp 84 PID 3852 wrote to memory of 1072 3852 D39C.tmp 84 PID 3852 wrote to memory of 1072 3852 D39C.tmp 84 PID 1072 wrote to memory of 3108 1072 D476.tmp 85 PID 1072 wrote to memory of 3108 1072 D476.tmp 85 PID 1072 wrote to memory of 3108 1072 D476.tmp 85 PID 3108 wrote to memory of 2892 3108 D522.tmp 86 PID 3108 wrote to memory of 2892 3108 D522.tmp 86 PID 3108 wrote to memory of 2892 3108 D522.tmp 86 PID 2892 wrote to memory of 2312 2892 D5DE.tmp 87 PID 2892 wrote to memory of 2312 2892 D5DE.tmp 87 PID 2892 wrote to memory of 2312 2892 D5DE.tmp 87 PID 2312 wrote to memory of 4072 2312 D699.tmp 88 PID 2312 wrote to memory of 4072 2312 D699.tmp 88 PID 2312 wrote to memory of 4072 2312 D699.tmp 88 PID 4072 wrote to memory of 2328 4072 D726.tmp 89 PID 4072 wrote to memory of 2328 4072 D726.tmp 89 PID 4072 wrote to memory of 2328 4072 D726.tmp 89 PID 2328 wrote to memory of 832 2328 D7F1.tmp 90 PID 2328 wrote to memory of 832 2328 D7F1.tmp 90 PID 2328 wrote to memory of 832 2328 D7F1.tmp 90 PID 832 wrote to memory of 4508 832 D8EB.tmp 91 PID 832 wrote to memory of 4508 832 D8EB.tmp 91 PID 832 wrote to memory of 4508 832 D8EB.tmp 91 PID 4508 wrote to memory of 4588 4508 D9D5.tmp 92 PID 4508 wrote to memory of 4588 4508 D9D5.tmp 92 PID 4508 wrote to memory of 4588 4508 D9D5.tmp 92 PID 4588 wrote to memory of 1892 4588 DA62.tmp 93 PID 4588 wrote to memory of 1892 4588 DA62.tmp 93 PID 4588 wrote to memory of 1892 4588 DA62.tmp 93 PID 1892 wrote to memory of 1552 1892 DB2D.tmp 94 PID 1892 wrote to memory of 1552 1892 DB2D.tmp 94 PID 1892 wrote to memory of 1552 1892 DB2D.tmp 94 PID 1552 wrote to memory of 3092 1552 DC08.tmp 95 PID 1552 wrote to memory of 3092 1552 DC08.tmp 95 PID 1552 wrote to memory of 3092 1552 DC08.tmp 95 PID 3092 wrote to memory of 4192 3092 DC95.tmp 96 PID 3092 wrote to memory of 4192 3092 DC95.tmp 96 PID 3092 wrote to memory of 4192 3092 DC95.tmp 96 PID 4192 wrote to memory of 784 4192 DD40.tmp 97 PID 4192 wrote to memory of 784 4192 DD40.tmp 97 PID 4192 wrote to memory of 784 4192 DD40.tmp 97 PID 784 wrote to memory of 2032 784 DF44.tmp 100 PID 784 wrote to memory of 2032 784 DF44.tmp 100 PID 784 wrote to memory of 2032 784 DF44.tmp 100 PID 2032 wrote to memory of 4224 2032 DFD1.tmp 101 PID 2032 wrote to memory of 4224 2032 DFD1.tmp 101 PID 2032 wrote to memory of 4224 2032 DFD1.tmp 101 PID 4224 wrote to memory of 1100 4224 E06D.tmp 103 PID 4224 wrote to memory of 1100 4224 E06D.tmp 103 PID 4224 wrote to memory of 1100 4224 E06D.tmp 103 PID 1100 wrote to memory of 4428 1100 E465.tmp 104 PID 1100 wrote to memory of 4428 1100 E465.tmp 104 PID 1100 wrote to memory of 4428 1100 E465.tmp 104 PID 4428 wrote to memory of 5012 4428 E501.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7b72969bd08f44ea0cac9cf7a048027_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\f7b72969bd08f44ea0cac9cf7a048027_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\D225.tmp"C:\Users\Admin\AppData\Local\Temp\D225.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\D39C.tmp"C:\Users\Admin\AppData\Local\Temp\D39C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\D476.tmp"C:\Users\Admin\AppData\Local\Temp\D476.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\D522.tmp"C:\Users\Admin\AppData\Local\Temp\D522.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\D699.tmp"C:\Users\Admin\AppData\Local\Temp\D699.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\D726.tmp"C:\Users\Admin\AppData\Local\Temp\D726.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\D7F1.tmp"C:\Users\Admin\AppData\Local\Temp\D7F1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\DA62.tmp"C:\Users\Admin\AppData\Local\Temp\DA62.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\DB2D.tmp"C:\Users\Admin\AppData\Local\Temp\DB2D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\DC08.tmp"C:\Users\Admin\AppData\Local\Temp\DC08.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\DC95.tmp"C:\Users\Admin\AppData\Local\Temp\DC95.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\DD40.tmp"C:\Users\Admin\AppData\Local\Temp\DD40.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\DF44.tmp"C:\Users\Admin\AppData\Local\Temp\DF44.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\E06D.tmp"C:\Users\Admin\AppData\Local\Temp\E06D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\E465.tmp"C:\Users\Admin\AppData\Local\Temp\E465.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\E501.tmp"C:\Users\Admin\AppData\Local\Temp\E501.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\E57E.tmp"C:\Users\Admin\AppData\Local\Temp\E57E.tmp"23⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\E62A.tmp"C:\Users\Admin\AppData\Local\Temp\E62A.tmp"24⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"25⤵
- Executes dropped EXE
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"26⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"27⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\E947.tmp"C:\Users\Admin\AppData\Local\Temp\E947.tmp"28⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"29⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"30⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\EB1B.tmp"C:\Users\Admin\AppData\Local\Temp\EB1B.tmp"31⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"32⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\ECA2.tmp"C:\Users\Admin\AppData\Local\Temp\ECA2.tmp"33⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"34⤵
- Executes dropped EXE
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\EE09.tmp"C:\Users\Admin\AppData\Local\Temp\EE09.tmp"35⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"36⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\EF51.tmp"C:\Users\Admin\AppData\Local\Temp\EF51.tmp"37⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\EFDE.tmp"C:\Users\Admin\AppData\Local\Temp\EFDE.tmp"38⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\F05B.tmp"C:\Users\Admin\AppData\Local\Temp\F05B.tmp"39⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"40⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\F155.tmp"C:\Users\Admin\AppData\Local\Temp\F155.tmp"41⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\F201.tmp"C:\Users\Admin\AppData\Local\Temp\F201.tmp"42⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\F27E.tmp"C:\Users\Admin\AppData\Local\Temp\F27E.tmp"43⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\F32A.tmp"C:\Users\Admin\AppData\Local\Temp\F32A.tmp"44⤵
- Executes dropped EXE
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\F3D6.tmp"C:\Users\Admin\AppData\Local\Temp\F3D6.tmp"45⤵
- Executes dropped EXE
PID:780 -
C:\Users\Admin\AppData\Local\Temp\F482.tmp"C:\Users\Admin\AppData\Local\Temp\F482.tmp"46⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\F52D.tmp"C:\Users\Admin\AppData\Local\Temp\F52D.tmp"47⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"48⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\F666.tmp"C:\Users\Admin\AppData\Local\Temp\F666.tmp"49⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\F712.tmp"C:\Users\Admin\AppData\Local\Temp\F712.tmp"50⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\F77F.tmp"C:\Users\Admin\AppData\Local\Temp\F77F.tmp"51⤵
- Executes dropped EXE
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\F7FC.tmp"C:\Users\Admin\AppData\Local\Temp\F7FC.tmp"52⤵
- Executes dropped EXE
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\F898.tmp"C:\Users\Admin\AppData\Local\Temp\F898.tmp"53⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\F935.tmp"C:\Users\Admin\AppData\Local\Temp\F935.tmp"54⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"55⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\FA2F.tmp"C:\Users\Admin\AppData\Local\Temp\FA2F.tmp"56⤵
- Executes dropped EXE
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\FACB.tmp"C:\Users\Admin\AppData\Local\Temp\FACB.tmp"57⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\FB58.tmp"C:\Users\Admin\AppData\Local\Temp\FB58.tmp"58⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"59⤵
- Executes dropped EXE
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\FC42.tmp"C:\Users\Admin\AppData\Local\Temp\FC42.tmp"60⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"61⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\FD3C.tmp"C:\Users\Admin\AppData\Local\Temp\FD3C.tmp"62⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"63⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\FE26.tmp"C:\Users\Admin\AppData\Local\Temp\FE26.tmp"64⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"65⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\FF40.tmp"C:\Users\Admin\AppData\Local\Temp\FF40.tmp"66⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"67⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\78.tmp"C:\Users\Admin\AppData\Local\Temp\78.tmp"68⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\114.tmp"C:\Users\Admin\AppData\Local\Temp\114.tmp"69⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\1B1.tmp"C:\Users\Admin\AppData\Local\Temp\1B1.tmp"70⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\21E.tmp"C:\Users\Admin\AppData\Local\Temp\21E.tmp"71⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\2CA.tmp"C:\Users\Admin\AppData\Local\Temp\2CA.tmp"72⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\356.tmp"C:\Users\Admin\AppData\Local\Temp\356.tmp"73⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\3F3.tmp"C:\Users\Admin\AppData\Local\Temp\3F3.tmp"74⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\48F.tmp"C:\Users\Admin\AppData\Local\Temp\48F.tmp"75⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\52B.tmp"C:\Users\Admin\AppData\Local\Temp\52B.tmp"76⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\5D7.tmp"C:\Users\Admin\AppData\Local\Temp\5D7.tmp"77⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\664.tmp"C:\Users\Admin\AppData\Local\Temp\664.tmp"78⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\6E1.tmp"C:\Users\Admin\AppData\Local\Temp\6E1.tmp"79⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\75E.tmp"C:\Users\Admin\AppData\Local\Temp\75E.tmp"80⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\7DB.tmp"C:\Users\Admin\AppData\Local\Temp\7DB.tmp"81⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\877.tmp"C:\Users\Admin\AppData\Local\Temp\877.tmp"82⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\904.tmp"C:\Users\Admin\AppData\Local\Temp\904.tmp"83⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\981.tmp"C:\Users\Admin\AppData\Local\Temp\981.tmp"84⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\9EE.tmp"C:\Users\Admin\AppData\Local\Temp\9EE.tmp"85⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\A7B.tmp"C:\Users\Admin\AppData\Local\Temp\A7B.tmp"86⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\AF8.tmp"C:\Users\Admin\AppData\Local\Temp\AF8.tmp"87⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\B65.tmp"C:\Users\Admin\AppData\Local\Temp\B65.tmp"88⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\BC3.tmp"C:\Users\Admin\AppData\Local\Temp\BC3.tmp"89⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\C40.tmp"C:\Users\Admin\AppData\Local\Temp\C40.tmp"90⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\CBD.tmp"C:\Users\Admin\AppData\Local\Temp\CBD.tmp"91⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\D3A.tmp"C:\Users\Admin\AppData\Local\Temp\D3A.tmp"92⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"93⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\E63.tmp"C:\Users\Admin\AppData\Local\Temp\E63.tmp"94⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\EEF.tmp"C:\Users\Admin\AppData\Local\Temp\EEF.tmp"95⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"96⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\FDA.tmp"C:\Users\Admin\AppData\Local\Temp\FDA.tmp"97⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\1076.tmp"C:\Users\Admin\AppData\Local\Temp\1076.tmp"98⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\10F3.tmp"C:\Users\Admin\AppData\Local\Temp\10F3.tmp"99⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\1170.tmp"C:\Users\Admin\AppData\Local\Temp\1170.tmp"100⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\11FC.tmp"C:\Users\Admin\AppData\Local\Temp\11FC.tmp"101⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\12A8.tmp"C:\Users\Admin\AppData\Local\Temp\12A8.tmp"102⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\1316.tmp"C:\Users\Admin\AppData\Local\Temp\1316.tmp"103⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\13A2.tmp"C:\Users\Admin\AppData\Local\Temp\13A2.tmp"104⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\1400.tmp"C:\Users\Admin\AppData\Local\Temp\1400.tmp"105⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\14AC.tmp"C:\Users\Admin\AppData\Local\Temp\14AC.tmp"106⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\1539.tmp"C:\Users\Admin\AppData\Local\Temp\1539.tmp"107⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\15C5.tmp"C:\Users\Admin\AppData\Local\Temp\15C5.tmp"108⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\1642.tmp"C:\Users\Admin\AppData\Local\Temp\1642.tmp"109⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\16BF.tmp"C:\Users\Admin\AppData\Local\Temp\16BF.tmp"110⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\174C.tmp"C:\Users\Admin\AppData\Local\Temp\174C.tmp"111⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\17C9.tmp"C:\Users\Admin\AppData\Local\Temp\17C9.tmp"112⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\1875.tmp"C:\Users\Admin\AppData\Local\Temp\1875.tmp"113⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\1911.tmp"C:\Users\Admin\AppData\Local\Temp\1911.tmp"114⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\198E.tmp"C:\Users\Admin\AppData\Local\Temp\198E.tmp"115⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\19FB.tmp"C:\Users\Admin\AppData\Local\Temp\19FB.tmp"116⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\1A78.tmp"C:\Users\Admin\AppData\Local\Temp\1A78.tmp"117⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\1B05.tmp"C:\Users\Admin\AppData\Local\Temp\1B05.tmp"118⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\1B92.tmp"C:\Users\Admin\AppData\Local\Temp\1B92.tmp"119⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"120⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\1C8C.tmp"C:\Users\Admin\AppData\Local\Temp\1C8C.tmp"121⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\1D18.tmp"C:\Users\Admin\AppData\Local\Temp\1D18.tmp"122⤵PID:224
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-