Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2023, 18:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1ed3c08cb744b8e01a18db2fa9197e3a_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
1ed3c08cb744b8e01a18db2fa9197e3a_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
1ed3c08cb744b8e01a18db2fa9197e3a_mafia_JC.exe
-
Size
488KB
-
MD5
1ed3c08cb744b8e01a18db2fa9197e3a
-
SHA1
919f0b1c2f2e7ad1f536ba0c4d2564dcf260552c
-
SHA256
407121e80f12f044edd528b9aa23fcf29b47d26d878259493cd1a589964858ea
-
SHA512
c42100e731ab7c99b25655dd0c2f7101bb57f878b18d8c70c301a93fddb019fc6fb0f2c44c28931c6ee9a35a2819fb2540cc1de69a566478ef88fcd9c072c682
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7HF2jXgGkiT2mDVlAGYCEu4TKxby7lKvz/RdN:/U5rCOTeiDk92CVlAEN5xbyUT5nNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4664 7F13.tmp 1868 7FBF.tmp 8 809A.tmp 2936 8174.tmp 3864 8220.tmp 4440 82CC.tmp 3000 8368.tmp 3348 8424.tmp 2988 84DF.tmp 4176 858B.tmp 648 8637.tmp 1792 86C4.tmp 4632 87BE.tmp 3988 88B8.tmp 4808 8973.tmp 420 8A2F.tmp 264 8ADB.tmp 2688 8B96.tmp 4032 8C32.tmp 4276 8D4C.tmp 228 8E17.tmp 3596 8EC3.tmp 4636 8FCC.tmp 4432 9097.tmp 924 9153.tmp 1736 91EF.tmp 4892 929B.tmp 1220 9385.tmp 1068 9422.tmp 4092 94BE.tmp 3668 9589.tmp 3876 9645.tmp 4532 971F.tmp 5104 97BC.tmp 4684 9839.tmp 2720 98C5.tmp 672 9952.tmp 3264 99BF.tmp 1408 9A5B.tmp 4768 9AF8.tmp 2796 9B94.tmp 4196 9C40.tmp 2224 9CBD.tmp 5036 9D59.tmp 4868 9DE6.tmp 3408 9E92.tmp 492 9F4D.tmp 2196 9FE9.tmp 4404 A0B4.tmp 3332 A151.tmp 4004 A1CE.tmp 4232 A24B.tmp 3292 A2E7.tmp 2188 A383.tmp 572 A41F.tmp 1484 A4AC.tmp 5024 A558.tmp 3900 A5D5.tmp 892 A652.tmp 3000 A6DF.tmp 2920 A77B.tmp 4752 A827.tmp 3816 A8D3.tmp 932 A950.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4804 wrote to memory of 4664 4804 1ed3c08cb744b8e01a18db2fa9197e3a_mafia_JC.exe 82 PID 4804 wrote to memory of 4664 4804 1ed3c08cb744b8e01a18db2fa9197e3a_mafia_JC.exe 82 PID 4804 wrote to memory of 4664 4804 1ed3c08cb744b8e01a18db2fa9197e3a_mafia_JC.exe 82 PID 4664 wrote to memory of 1868 4664 7F13.tmp 83 PID 4664 wrote to memory of 1868 4664 7F13.tmp 83 PID 4664 wrote to memory of 1868 4664 7F13.tmp 83 PID 1868 wrote to memory of 8 1868 7FBF.tmp 84 PID 1868 wrote to memory of 8 1868 7FBF.tmp 84 PID 1868 wrote to memory of 8 1868 7FBF.tmp 84 PID 8 wrote to memory of 2936 8 809A.tmp 85 PID 8 wrote to memory of 2936 8 809A.tmp 85 PID 8 wrote to memory of 2936 8 809A.tmp 85 PID 2936 wrote to memory of 3864 2936 8174.tmp 86 PID 2936 wrote to memory of 3864 2936 8174.tmp 86 PID 2936 wrote to memory of 3864 2936 8174.tmp 86 PID 3864 wrote to memory of 4440 3864 8220.tmp 87 PID 3864 wrote to memory of 4440 3864 8220.tmp 87 PID 3864 wrote to memory of 4440 3864 8220.tmp 87 PID 4440 wrote to memory of 3000 4440 82CC.tmp 88 PID 4440 wrote to memory of 3000 4440 82CC.tmp 88 PID 4440 wrote to memory of 3000 4440 82CC.tmp 88 PID 3000 wrote to memory of 3348 3000 8368.tmp 90 PID 3000 wrote to memory of 3348 3000 8368.tmp 90 PID 3000 wrote to memory of 3348 3000 8368.tmp 90 PID 3348 wrote to memory of 2988 3348 8424.tmp 91 PID 3348 wrote to memory of 2988 3348 8424.tmp 91 PID 3348 wrote to memory of 2988 3348 8424.tmp 91 PID 2988 wrote to memory of 4176 2988 84DF.tmp 92 PID 2988 wrote to memory of 4176 2988 84DF.tmp 92 PID 2988 wrote to memory of 4176 2988 84DF.tmp 92 PID 4176 wrote to memory of 648 4176 858B.tmp 93 PID 4176 wrote to memory of 648 4176 858B.tmp 93 PID 4176 wrote to memory of 648 4176 858B.tmp 93 PID 648 wrote to memory of 1792 648 8637.tmp 94 PID 648 wrote to memory of 1792 648 8637.tmp 94 PID 648 wrote to memory of 1792 648 8637.tmp 94 PID 1792 wrote to memory of 4632 1792 86C4.tmp 95 PID 1792 wrote to memory of 4632 1792 86C4.tmp 95 PID 1792 wrote to memory of 4632 1792 86C4.tmp 95 PID 4632 wrote to memory of 3988 4632 87BE.tmp 96 PID 4632 wrote to memory of 3988 4632 87BE.tmp 96 PID 4632 wrote to memory of 3988 4632 87BE.tmp 96 PID 3988 wrote to memory of 4808 3988 88B8.tmp 97 PID 3988 wrote to memory of 4808 3988 88B8.tmp 97 PID 3988 wrote to memory of 4808 3988 88B8.tmp 97 PID 4808 wrote to memory of 420 4808 8973.tmp 98 PID 4808 wrote to memory of 420 4808 8973.tmp 98 PID 4808 wrote to memory of 420 4808 8973.tmp 98 PID 420 wrote to memory of 264 420 8A2F.tmp 99 PID 420 wrote to memory of 264 420 8A2F.tmp 99 PID 420 wrote to memory of 264 420 8A2F.tmp 99 PID 264 wrote to memory of 2688 264 8ADB.tmp 100 PID 264 wrote to memory of 2688 264 8ADB.tmp 100 PID 264 wrote to memory of 2688 264 8ADB.tmp 100 PID 2688 wrote to memory of 4032 2688 8B96.tmp 103 PID 2688 wrote to memory of 4032 2688 8B96.tmp 103 PID 2688 wrote to memory of 4032 2688 8B96.tmp 103 PID 4032 wrote to memory of 4276 4032 8C32.tmp 104 PID 4032 wrote to memory of 4276 4032 8C32.tmp 104 PID 4032 wrote to memory of 4276 4032 8C32.tmp 104 PID 4276 wrote to memory of 228 4276 8D4C.tmp 105 PID 4276 wrote to memory of 228 4276 8D4C.tmp 105 PID 4276 wrote to memory of 228 4276 8D4C.tmp 105 PID 228 wrote to memory of 3596 228 8E17.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ed3c08cb744b8e01a18db2fa9197e3a_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\1ed3c08cb744b8e01a18db2fa9197e3a_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\7F13.tmp"C:\Users\Admin\AppData\Local\Temp\7F13.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\809A.tmp"C:\Users\Admin\AppData\Local\Temp\809A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\8174.tmp"C:\Users\Admin\AppData\Local\Temp\8174.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\8220.tmp"C:\Users\Admin\AppData\Local\Temp\8220.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\8368.tmp"C:\Users\Admin\AppData\Local\Temp\8368.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\8424.tmp"C:\Users\Admin\AppData\Local\Temp\8424.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\84DF.tmp"C:\Users\Admin\AppData\Local\Temp\84DF.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\858B.tmp"C:\Users\Admin\AppData\Local\Temp\858B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\8637.tmp"C:\Users\Admin\AppData\Local\Temp\8637.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Users\Admin\AppData\Local\Temp\86C4.tmp"C:\Users\Admin\AppData\Local\Temp\86C4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\87BE.tmp"C:\Users\Admin\AppData\Local\Temp\87BE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\88B8.tmp"C:\Users\Admin\AppData\Local\Temp\88B8.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\8973.tmp"C:\Users\Admin\AppData\Local\Temp\8973.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Users\Admin\AppData\Local\Temp\8B96.tmp"C:\Users\Admin\AppData\Local\Temp\8B96.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\8C32.tmp"C:\Users\Admin\AppData\Local\Temp\8C32.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\8E17.tmp"C:\Users\Admin\AppData\Local\Temp\8E17.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"23⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"24⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\9097.tmp"C:\Users\Admin\AppData\Local\Temp\9097.tmp"25⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\9153.tmp"C:\Users\Admin\AppData\Local\Temp\9153.tmp"26⤵
- Executes dropped EXE
PID:924 -
C:\Users\Admin\AppData\Local\Temp\91EF.tmp"C:\Users\Admin\AppData\Local\Temp\91EF.tmp"27⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\929B.tmp"C:\Users\Admin\AppData\Local\Temp\929B.tmp"28⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\9385.tmp"C:\Users\Admin\AppData\Local\Temp\9385.tmp"29⤵
- Executes dropped EXE
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\9422.tmp"C:\Users\Admin\AppData\Local\Temp\9422.tmp"30⤵
- Executes dropped EXE
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\94BE.tmp"C:\Users\Admin\AppData\Local\Temp\94BE.tmp"31⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"32⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"33⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"34⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\97BC.tmp"C:\Users\Admin\AppData\Local\Temp\97BC.tmp"35⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\9839.tmp"C:\Users\Admin\AppData\Local\Temp\9839.tmp"36⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\98C5.tmp"C:\Users\Admin\AppData\Local\Temp\98C5.tmp"37⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\9952.tmp"C:\Users\Admin\AppData\Local\Temp\9952.tmp"38⤵
- Executes dropped EXE
PID:672 -
C:\Users\Admin\AppData\Local\Temp\99BF.tmp"C:\Users\Admin\AppData\Local\Temp\99BF.tmp"39⤵
- Executes dropped EXE
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"40⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"41⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"42⤵
- Executes dropped EXE
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"43⤵
- Executes dropped EXE
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"44⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\9D59.tmp"C:\Users\Admin\AppData\Local\Temp\9D59.tmp"45⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"46⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"47⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"48⤵
- Executes dropped EXE
PID:492 -
C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"49⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"50⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"51⤵
- Executes dropped EXE
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"52⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\A24B.tmp"C:\Users\Admin\AppData\Local\Temp\A24B.tmp"53⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"54⤵
- Executes dropped EXE
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\A383.tmp"C:\Users\Admin\AppData\Local\Temp\A383.tmp"55⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\A41F.tmp"C:\Users\Admin\AppData\Local\Temp\A41F.tmp"56⤵
- Executes dropped EXE
PID:572 -
C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"57⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"58⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"59⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"60⤵
- Executes dropped EXE
PID:892 -
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"61⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"62⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\A827.tmp"C:\Users\Admin\AppData\Local\Temp\A827.tmp"63⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"64⤵
- Executes dropped EXE
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\A950.tmp"C:\Users\Admin\AppData\Local\Temp\A950.tmp"65⤵
- Executes dropped EXE
PID:932 -
C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"66⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"67⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"68⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"69⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\AB92.tmp"C:\Users\Admin\AppData\Local\Temp\AB92.tmp"70⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"71⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"72⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"73⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"74⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"75⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"76⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"77⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\B074.tmp"C:\Users\Admin\AppData\Local\Temp\B074.tmp"78⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\B110.tmp"C:\Users\Admin\AppData\Local\Temp\B110.tmp"79⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"80⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\B239.tmp"C:\Users\Admin\AppData\Local\Temp\B239.tmp"81⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"82⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\B371.tmp"C:\Users\Admin\AppData\Local\Temp\B371.tmp"83⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"84⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\B46B.tmp"C:\Users\Admin\AppData\Local\Temp\B46B.tmp"85⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\B517.tmp"C:\Users\Admin\AppData\Local\Temp\B517.tmp"86⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\B585.tmp"C:\Users\Admin\AppData\Local\Temp\B585.tmp"87⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"88⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\B67F.tmp"C:\Users\Admin\AppData\Local\Temp\B67F.tmp"89⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\B72A.tmp"C:\Users\Admin\AppData\Local\Temp\B72A.tmp"90⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"91⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\B844.tmp"C:\Users\Admin\AppData\Local\Temp\B844.tmp"92⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"93⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\B96D.tmp"C:\Users\Admin\AppData\Local\Temp\B96D.tmp"94⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\BA18.tmp"C:\Users\Admin\AppData\Local\Temp\BA18.tmp"95⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"96⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\BB41.tmp"C:\Users\Admin\AppData\Local\Temp\BB41.tmp"97⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"98⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"99⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"100⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\BD45.tmp"C:\Users\Admin\AppData\Local\Temp\BD45.tmp"101⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"102⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"103⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\BEEB.tmp"C:\Users\Admin\AppData\Local\Temp\BEEB.tmp"104⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\BF77.tmp"C:\Users\Admin\AppData\Local\Temp\BF77.tmp"105⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\C014.tmp"C:\Users\Admin\AppData\Local\Temp\C014.tmp"106⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"107⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\C16B.tmp"C:\Users\Admin\AppData\Local\Temp\C16B.tmp"108⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\C237.tmp"C:\Users\Admin\AppData\Local\Temp\C237.tmp"109⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"110⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\C35F.tmp"C:\Users\Admin\AppData\Local\Temp\C35F.tmp"111⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"112⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"113⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\C525.tmp"C:\Users\Admin\AppData\Local\Temp\C525.tmp"114⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\C592.tmp"C:\Users\Admin\AppData\Local\Temp\C592.tmp"115⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\C5F0.tmp"C:\Users\Admin\AppData\Local\Temp\C5F0.tmp"116⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\C64D.tmp"C:\Users\Admin\AppData\Local\Temp\C64D.tmp"117⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"118⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\C757.tmp"C:\Users\Admin\AppData\Local\Temp\C757.tmp"119⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"120⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\C832.tmp"C:\Users\Admin\AppData\Local\Temp\C832.tmp"121⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"122⤵PID:4696
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-