Analysis
-
max time kernel
151s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
31/08/2023, 18:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fa31d93457530111337e02beeba348b0_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
fa31d93457530111337e02beeba348b0_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
fa31d93457530111337e02beeba348b0_mafia_JC.exe
-
Size
487KB
-
MD5
fa31d93457530111337e02beeba348b0
-
SHA1
67409bec2230f19605a787fe576a02ed5fb24f64
-
SHA256
344afa9c82cfa8601898467197aacb1d0f922b728f210af6afb9de9b026e81f2
-
SHA512
4b5317520f3be40f3a65e9f09485f99d545869419bb73c8c686588735056fdc12430f257d730724c4e48f68f43182cf98e359623559b53c64095ca3e1675befb
-
SSDEEP
12288:yU5rCOTeiN4ukJkdilT7oEghcvCAC8nfSryCsm7V9bZ:yUQOJN4u5d2T7bghcvCAxn+tsyvb
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4184 6B4D.tmp 3432 6C18.tmp 3708 6C95.tmp 2728 6D21.tmp 4756 6DDD.tmp 4384 6E89.tmp 4828 6F06.tmp 944 6FC1.tmp 2576 705D.tmp 4336 7129.tmp 4212 71E4.tmp 4692 7290.tmp 1892 734B.tmp 4644 7511.tmp 208 75CC.tmp 960 76A7.tmp 2976 7733.tmp 4064 780E.tmp 1972 7918.tmp 4416 7A12.tmp 1600 7AFC.tmp 5072 7BF6.tmp 4172 7C92.tmp 1844 7D2F.tmp 1924 7DEA.tmp 3444 7EC5.tmp 3296 7FBF.tmp 1756 804C.tmp 3736 80E8.tmp 2948 8174.tmp 1272 81F1.tmp 3204 82AD.tmp 2208 8388.tmp 3972 8443.tmp 3840 84A1.tmp 2456 851E.tmp 1712 85AB.tmp 4128 8637.tmp 4116 86C4.tmp 4712 8750.tmp 2056 87CD.tmp 1280 885A.tmp 1596 88D7.tmp 1404 8964.tmp 4260 89E1.tmp 3300 8A5E.tmp 4900 8AFA.tmp 2512 8B77.tmp 2564 8C81.tmp 2072 8D3C.tmp 4408 8DC9.tmp 2548 8E75.tmp 3624 8F01.tmp 5056 8F6F.tmp 4672 8FDC.tmp 4676 9059.tmp 3684 90F5.tmp 4908 9191.tmp 1192 921E.tmp 2100 92AB.tmp 2940 9318.tmp 4496 9385.tmp 4368 9431.tmp 2688 94AE.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3328 wrote to memory of 4184 3328 fa31d93457530111337e02beeba348b0_mafia_JC.exe 83 PID 3328 wrote to memory of 4184 3328 fa31d93457530111337e02beeba348b0_mafia_JC.exe 83 PID 3328 wrote to memory of 4184 3328 fa31d93457530111337e02beeba348b0_mafia_JC.exe 83 PID 4184 wrote to memory of 3432 4184 6B4D.tmp 84 PID 4184 wrote to memory of 3432 4184 6B4D.tmp 84 PID 4184 wrote to memory of 3432 4184 6B4D.tmp 84 PID 3432 wrote to memory of 3708 3432 6C18.tmp 85 PID 3432 wrote to memory of 3708 3432 6C18.tmp 85 PID 3432 wrote to memory of 3708 3432 6C18.tmp 85 PID 3708 wrote to memory of 2728 3708 6C95.tmp 86 PID 3708 wrote to memory of 2728 3708 6C95.tmp 86 PID 3708 wrote to memory of 2728 3708 6C95.tmp 86 PID 2728 wrote to memory of 4756 2728 6D21.tmp 87 PID 2728 wrote to memory of 4756 2728 6D21.tmp 87 PID 2728 wrote to memory of 4756 2728 6D21.tmp 87 PID 4756 wrote to memory of 4384 4756 6DDD.tmp 88 PID 4756 wrote to memory of 4384 4756 6DDD.tmp 88 PID 4756 wrote to memory of 4384 4756 6DDD.tmp 88 PID 4384 wrote to memory of 4828 4384 6E89.tmp 89 PID 4384 wrote to memory of 4828 4384 6E89.tmp 89 PID 4384 wrote to memory of 4828 4384 6E89.tmp 89 PID 4828 wrote to memory of 944 4828 6F06.tmp 90 PID 4828 wrote to memory of 944 4828 6F06.tmp 90 PID 4828 wrote to memory of 944 4828 6F06.tmp 90 PID 944 wrote to memory of 2576 944 6FC1.tmp 91 PID 944 wrote to memory of 2576 944 6FC1.tmp 91 PID 944 wrote to memory of 2576 944 6FC1.tmp 91 PID 2576 wrote to memory of 4336 2576 705D.tmp 92 PID 2576 wrote to memory of 4336 2576 705D.tmp 92 PID 2576 wrote to memory of 4336 2576 705D.tmp 92 PID 4336 wrote to memory of 4212 4336 7129.tmp 93 PID 4336 wrote to memory of 4212 4336 7129.tmp 93 PID 4336 wrote to memory of 4212 4336 7129.tmp 93 PID 4212 wrote to memory of 4692 4212 71E4.tmp 94 PID 4212 wrote to memory of 4692 4212 71E4.tmp 94 PID 4212 wrote to memory of 4692 4212 71E4.tmp 94 PID 4692 wrote to memory of 1892 4692 7290.tmp 95 PID 4692 wrote to memory of 1892 4692 7290.tmp 95 PID 4692 wrote to memory of 1892 4692 7290.tmp 95 PID 1892 wrote to memory of 4644 1892 734B.tmp 96 PID 1892 wrote to memory of 4644 1892 734B.tmp 96 PID 1892 wrote to memory of 4644 1892 734B.tmp 96 PID 4644 wrote to memory of 208 4644 7511.tmp 97 PID 4644 wrote to memory of 208 4644 7511.tmp 97 PID 4644 wrote to memory of 208 4644 7511.tmp 97 PID 208 wrote to memory of 960 208 75CC.tmp 98 PID 208 wrote to memory of 960 208 75CC.tmp 98 PID 208 wrote to memory of 960 208 75CC.tmp 98 PID 960 wrote to memory of 2976 960 76A7.tmp 99 PID 960 wrote to memory of 2976 960 76A7.tmp 99 PID 960 wrote to memory of 2976 960 76A7.tmp 99 PID 2976 wrote to memory of 4064 2976 7733.tmp 102 PID 2976 wrote to memory of 4064 2976 7733.tmp 102 PID 2976 wrote to memory of 4064 2976 7733.tmp 102 PID 4064 wrote to memory of 1972 4064 780E.tmp 103 PID 4064 wrote to memory of 1972 4064 780E.tmp 103 PID 4064 wrote to memory of 1972 4064 780E.tmp 103 PID 1972 wrote to memory of 4416 1972 7918.tmp 104 PID 1972 wrote to memory of 4416 1972 7918.tmp 104 PID 1972 wrote to memory of 4416 1972 7918.tmp 104 PID 4416 wrote to memory of 1600 4416 7A12.tmp 105 PID 4416 wrote to memory of 1600 4416 7A12.tmp 105 PID 4416 wrote to memory of 1600 4416 7A12.tmp 105 PID 1600 wrote to memory of 5072 1600 7AFC.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa31d93457530111337e02beeba348b0_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\fa31d93457530111337e02beeba348b0_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\7290.tmp"C:\Users\Admin\AppData\Local\Temp\7290.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\780E.tmp"C:\Users\Admin\AppData\Local\Temp\780E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\7918.tmp"C:\Users\Admin\AppData\Local\Temp\7918.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\7A12.tmp"C:\Users\Admin\AppData\Local\Temp\7A12.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"23⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\7C92.tmp"C:\Users\Admin\AppData\Local\Temp\7C92.tmp"24⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"25⤵
- Executes dropped EXE
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"26⤵
- Executes dropped EXE
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"27⤵
- Executes dropped EXE
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"28⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\804C.tmp"C:\Users\Admin\AppData\Local\Temp\804C.tmp"29⤵
- Executes dropped EXE
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\80E8.tmp"C:\Users\Admin\AppData\Local\Temp\80E8.tmp"30⤵
- Executes dropped EXE
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\8174.tmp"C:\Users\Admin\AppData\Local\Temp\8174.tmp"31⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\81F1.tmp"C:\Users\Admin\AppData\Local\Temp\81F1.tmp"32⤵
- Executes dropped EXE
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\82AD.tmp"C:\Users\Admin\AppData\Local\Temp\82AD.tmp"33⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\8388.tmp"C:\Users\Admin\AppData\Local\Temp\8388.tmp"34⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"35⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\84A1.tmp"C:\Users\Admin\AppData\Local\Temp\84A1.tmp"36⤵
- Executes dropped EXE
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\851E.tmp"C:\Users\Admin\AppData\Local\Temp\851E.tmp"37⤵
- Executes dropped EXE
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\85AB.tmp"C:\Users\Admin\AppData\Local\Temp\85AB.tmp"38⤵
- Executes dropped EXE
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\8637.tmp"C:\Users\Admin\AppData\Local\Temp\8637.tmp"39⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\86C4.tmp"C:\Users\Admin\AppData\Local\Temp\86C4.tmp"40⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\8750.tmp"C:\Users\Admin\AppData\Local\Temp\8750.tmp"41⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\87CD.tmp"C:\Users\Admin\AppData\Local\Temp\87CD.tmp"42⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\885A.tmp"C:\Users\Admin\AppData\Local\Temp\885A.tmp"43⤵
- Executes dropped EXE
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"44⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\8964.tmp"C:\Users\Admin\AppData\Local\Temp\8964.tmp"45⤵
- Executes dropped EXE
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\89E1.tmp"C:\Users\Admin\AppData\Local\Temp\89E1.tmp"46⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"47⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"48⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\8B77.tmp"C:\Users\Admin\AppData\Local\Temp\8B77.tmp"49⤵
- Executes dropped EXE
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"50⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\8C81.tmp"C:\Users\Admin\AppData\Local\Temp\8C81.tmp"51⤵
- Executes dropped EXE
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"52⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"53⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\8E75.tmp"C:\Users\Admin\AppData\Local\Temp\8E75.tmp"54⤵
- Executes dropped EXE
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\8F01.tmp"C:\Users\Admin\AppData\Local\Temp\8F01.tmp"55⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"56⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"57⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"58⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"59⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\9191.tmp"C:\Users\Admin\AppData\Local\Temp\9191.tmp"60⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\921E.tmp"C:\Users\Admin\AppData\Local\Temp\921E.tmp"61⤵
- Executes dropped EXE
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\92AB.tmp"C:\Users\Admin\AppData\Local\Temp\92AB.tmp"62⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"63⤵
- Executes dropped EXE
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\9385.tmp"C:\Users\Admin\AppData\Local\Temp\9385.tmp"64⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"65⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\94AE.tmp"C:\Users\Admin\AppData\Local\Temp\94AE.tmp"66⤵
- Executes dropped EXE
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\951C.tmp"C:\Users\Admin\AppData\Local\Temp\951C.tmp"67⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\9579.tmp"C:\Users\Admin\AppData\Local\Temp\9579.tmp"68⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\95F6.tmp"C:\Users\Admin\AppData\Local\Temp\95F6.tmp"69⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\9654.tmp"C:\Users\Admin\AppData\Local\Temp\9654.tmp"70⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\96E1.tmp"C:\Users\Admin\AppData\Local\Temp\96E1.tmp"71⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"72⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\97EA.tmp"C:\Users\Admin\AppData\Local\Temp\97EA.tmp"73⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"74⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\98D5.tmp"C:\Users\Admin\AppData\Local\Temp\98D5.tmp"75⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"76⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"77⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"78⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"79⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"80⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"81⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"82⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"83⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"84⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"85⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"86⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"87⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"88⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"89⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"90⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\A047.tmp"C:\Users\Admin\AppData\Local\Temp\A047.tmp"91⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"92⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"93⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\A18F.tmp"C:\Users\Admin\AppData\Local\Temp\A18F.tmp"94⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\A20C.tmp"C:\Users\Admin\AppData\Local\Temp\A20C.tmp"95⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\A26A.tmp"C:\Users\Admin\AppData\Local\Temp\A26A.tmp"96⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"97⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\A364.tmp"C:\Users\Admin\AppData\Local\Temp\A364.tmp"98⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"99⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"100⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"101⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"102⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"103⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"104⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"105⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"106⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"107⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\A894.tmp"C:\Users\Admin\AppData\Local\Temp\A894.tmp"108⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"109⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"110⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"111⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"112⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\AB44.tmp"C:\Users\Admin\AppData\Local\Temp\AB44.tmp"113⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"114⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"115⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"116⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\AD66.tmp"C:\Users\Admin\AppData\Local\Temp\AD66.tmp"117⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"118⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\AE51.tmp"C:\Users\Admin\AppData\Local\Temp\AE51.tmp"119⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\AECE.tmp"C:\Users\Admin\AppData\Local\Temp\AECE.tmp"120⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"121⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"122⤵PID:3512
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-