Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
20-08-2023 16:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
59bdbfe2406ad2bd2ea3f6df9e2f4c33_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
59bdbfe2406ad2bd2ea3f6df9e2f4c33_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
59bdbfe2406ad2bd2ea3f6df9e2f4c33_mafia_JC.exe
-
Size
488KB
-
MD5
59bdbfe2406ad2bd2ea3f6df9e2f4c33
-
SHA1
be7287a35531524116afd59da93de2c8bc04ae4d
-
SHA256
8a1eb6fac72161983d6fe394bf94b4945addd9b643e519bf8497d45ea2686d8c
-
SHA512
97f3f8ddb79a42f6fc5ff115b8405b52a2ce3c7d262e60e4fc59425d38c9fd2d7bcb241382e9225772b491f51614b4a268c2abf866168cfe4698d918f14c5da6
-
SSDEEP
12288:/U5rCOTeiDZA79YCOBMpcCScVKqAVonbNZ:/UQOJDSOBEcCS8KobN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2348 4532.tmp 544 463B.tmp 1628 4707.tmp 3904 47E1.tmp 4608 48BC.tmp 5048 49A6.tmp 4436 4A72.tmp 2224 4BAA.tmp 3244 4C66.tmp 1448 4D8E.tmp 2496 4E79.tmp 3336 4F34.tmp 3420 4FD1.tmp 2080 509C.tmp 808 5148.tmp 2232 5213.tmp 4828 52CE.tmp 3908 53F7.tmp 1924 54B3.tmp 2476 55CC.tmp 1280 5687.tmp 4928 5752.tmp 4156 57EF.tmp 4148 58AA.tmp 2152 5946.tmp 796 5A02.tmp 4340 5ACD.tmp 4492 5B69.tmp 4052 5C15.tmp 1256 5D00.tmp 904 5DAB.tmp 2344 5EA5.tmp 3036 5F90.tmp 4680 602C.tmp 4824 60E8.tmp 2736 6184.tmp 2440 6210.tmp 2888 629D.tmp 1100 632A.tmp 2864 63B6.tmp 2904 6443.tmp 4408 64EF.tmp 5060 657B.tmp 180 6627.tmp 2288 66A4.tmp 836 6741.tmp 4840 682B.tmp 5088 68C7.tmp 3712 6935.tmp 4360 69E0.tmp 3944 6A9C.tmp 3004 6B38.tmp 4260 6BB5.tmp 2216 6C61.tmp 4984 6CEE.tmp 2376 6DA9.tmp 3372 6E45.tmp 3852 6EB3.tmp 2040 6F3F.tmp 1628 6FCC.tmp 3752 7068.tmp 3732 70D6.tmp 3748 7162.tmp 5048 720E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4016 wrote to memory of 2348 4016 59bdbfe2406ad2bd2ea3f6df9e2f4c33_mafia_JC.exe 81 PID 4016 wrote to memory of 2348 4016 59bdbfe2406ad2bd2ea3f6df9e2f4c33_mafia_JC.exe 81 PID 4016 wrote to memory of 2348 4016 59bdbfe2406ad2bd2ea3f6df9e2f4c33_mafia_JC.exe 81 PID 2348 wrote to memory of 544 2348 4532.tmp 82 PID 2348 wrote to memory of 544 2348 4532.tmp 82 PID 2348 wrote to memory of 544 2348 4532.tmp 82 PID 544 wrote to memory of 1628 544 463B.tmp 83 PID 544 wrote to memory of 1628 544 463B.tmp 83 PID 544 wrote to memory of 1628 544 463B.tmp 83 PID 1628 wrote to memory of 3904 1628 4707.tmp 84 PID 1628 wrote to memory of 3904 1628 4707.tmp 84 PID 1628 wrote to memory of 3904 1628 4707.tmp 84 PID 3904 wrote to memory of 4608 3904 47E1.tmp 85 PID 3904 wrote to memory of 4608 3904 47E1.tmp 85 PID 3904 wrote to memory of 4608 3904 47E1.tmp 85 PID 4608 wrote to memory of 5048 4608 48BC.tmp 86 PID 4608 wrote to memory of 5048 4608 48BC.tmp 86 PID 4608 wrote to memory of 5048 4608 48BC.tmp 86 PID 5048 wrote to memory of 4436 5048 49A6.tmp 87 PID 5048 wrote to memory of 4436 5048 49A6.tmp 87 PID 5048 wrote to memory of 4436 5048 49A6.tmp 87 PID 4436 wrote to memory of 2224 4436 4A72.tmp 88 PID 4436 wrote to memory of 2224 4436 4A72.tmp 88 PID 4436 wrote to memory of 2224 4436 4A72.tmp 88 PID 2224 wrote to memory of 3244 2224 4BAA.tmp 89 PID 2224 wrote to memory of 3244 2224 4BAA.tmp 89 PID 2224 wrote to memory of 3244 2224 4BAA.tmp 89 PID 3244 wrote to memory of 1448 3244 4C66.tmp 90 PID 3244 wrote to memory of 1448 3244 4C66.tmp 90 PID 3244 wrote to memory of 1448 3244 4C66.tmp 90 PID 1448 wrote to memory of 2496 1448 4D8E.tmp 91 PID 1448 wrote to memory of 2496 1448 4D8E.tmp 91 PID 1448 wrote to memory of 2496 1448 4D8E.tmp 91 PID 2496 wrote to memory of 3336 2496 4E79.tmp 92 PID 2496 wrote to memory of 3336 2496 4E79.tmp 92 PID 2496 wrote to memory of 3336 2496 4E79.tmp 92 PID 3336 wrote to memory of 3420 3336 4F34.tmp 93 PID 3336 wrote to memory of 3420 3336 4F34.tmp 93 PID 3336 wrote to memory of 3420 3336 4F34.tmp 93 PID 3420 wrote to memory of 2080 3420 4FD1.tmp 94 PID 3420 wrote to memory of 2080 3420 4FD1.tmp 94 PID 3420 wrote to memory of 2080 3420 4FD1.tmp 94 PID 2080 wrote to memory of 808 2080 509C.tmp 95 PID 2080 wrote to memory of 808 2080 509C.tmp 95 PID 2080 wrote to memory of 808 2080 509C.tmp 95 PID 808 wrote to memory of 2232 808 5148.tmp 97 PID 808 wrote to memory of 2232 808 5148.tmp 97 PID 808 wrote to memory of 2232 808 5148.tmp 97 PID 2232 wrote to memory of 4828 2232 5213.tmp 98 PID 2232 wrote to memory of 4828 2232 5213.tmp 98 PID 2232 wrote to memory of 4828 2232 5213.tmp 98 PID 4828 wrote to memory of 3908 4828 52CE.tmp 99 PID 4828 wrote to memory of 3908 4828 52CE.tmp 99 PID 4828 wrote to memory of 3908 4828 52CE.tmp 99 PID 3908 wrote to memory of 1924 3908 53F7.tmp 100 PID 3908 wrote to memory of 1924 3908 53F7.tmp 100 PID 3908 wrote to memory of 1924 3908 53F7.tmp 100 PID 1924 wrote to memory of 2476 1924 54B3.tmp 101 PID 1924 wrote to memory of 2476 1924 54B3.tmp 101 PID 1924 wrote to memory of 2476 1924 54B3.tmp 101 PID 2476 wrote to memory of 1280 2476 55CC.tmp 102 PID 2476 wrote to memory of 1280 2476 55CC.tmp 102 PID 2476 wrote to memory of 1280 2476 55CC.tmp 102 PID 1280 wrote to memory of 4928 1280 5687.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\59bdbfe2406ad2bd2ea3f6df9e2f4c33_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\59bdbfe2406ad2bd2ea3f6df9e2f4c33_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\4532.tmp"C:\Users\Admin\AppData\Local\Temp\4532.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\463B.tmp"C:\Users\Admin\AppData\Local\Temp\463B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Users\Admin\AppData\Local\Temp\4707.tmp"C:\Users\Admin\AppData\Local\Temp\4707.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\47E1.tmp"C:\Users\Admin\AppData\Local\Temp\47E1.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\48BC.tmp"C:\Users\Admin\AppData\Local\Temp\48BC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\49A6.tmp"C:\Users\Admin\AppData\Local\Temp\49A6.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\4A72.tmp"C:\Users\Admin\AppData\Local\Temp\4A72.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\4BAA.tmp"C:\Users\Admin\AppData\Local\Temp\4BAA.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\4C66.tmp"C:\Users\Admin\AppData\Local\Temp\4C66.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\4D8E.tmp"C:\Users\Admin\AppData\Local\Temp\4D8E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\4E79.tmp"C:\Users\Admin\AppData\Local\Temp\4E79.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\4F34.tmp"C:\Users\Admin\AppData\Local\Temp\4F34.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\4FD1.tmp"C:\Users\Admin\AppData\Local\Temp\4FD1.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\509C.tmp"C:\Users\Admin\AppData\Local\Temp\509C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\5148.tmp"C:\Users\Admin\AppData\Local\Temp\5148.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\5213.tmp"C:\Users\Admin\AppData\Local\Temp\5213.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\52CE.tmp"C:\Users\Admin\AppData\Local\Temp\52CE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\53F7.tmp"C:\Users\Admin\AppData\Local\Temp\53F7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\54B3.tmp"C:\Users\Admin\AppData\Local\Temp\54B3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\55CC.tmp"C:\Users\Admin\AppData\Local\Temp\55CC.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\5687.tmp"C:\Users\Admin\AppData\Local\Temp\5687.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\5752.tmp"C:\Users\Admin\AppData\Local\Temp\5752.tmp"23⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\57EF.tmp"C:\Users\Admin\AppData\Local\Temp\57EF.tmp"24⤵
- Executes dropped EXE
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\58AA.tmp"C:\Users\Admin\AppData\Local\Temp\58AA.tmp"25⤵
- Executes dropped EXE
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\5946.tmp"C:\Users\Admin\AppData\Local\Temp\5946.tmp"26⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\5A02.tmp"C:\Users\Admin\AppData\Local\Temp\5A02.tmp"27⤵
- Executes dropped EXE
PID:796 -
C:\Users\Admin\AppData\Local\Temp\5ACD.tmp"C:\Users\Admin\AppData\Local\Temp\5ACD.tmp"28⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\5B69.tmp"C:\Users\Admin\AppData\Local\Temp\5B69.tmp"29⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\5C15.tmp"C:\Users\Admin\AppData\Local\Temp\5C15.tmp"30⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\5D00.tmp"C:\Users\Admin\AppData\Local\Temp\5D00.tmp"31⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\5DAB.tmp"C:\Users\Admin\AppData\Local\Temp\5DAB.tmp"32⤵
- Executes dropped EXE
PID:904 -
C:\Users\Admin\AppData\Local\Temp\5EA5.tmp"C:\Users\Admin\AppData\Local\Temp\5EA5.tmp"33⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\5F90.tmp"C:\Users\Admin\AppData\Local\Temp\5F90.tmp"34⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\602C.tmp"C:\Users\Admin\AppData\Local\Temp\602C.tmp"35⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\60E8.tmp"C:\Users\Admin\AppData\Local\Temp\60E8.tmp"36⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\6184.tmp"C:\Users\Admin\AppData\Local\Temp\6184.tmp"37⤵
- Executes dropped EXE
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\6210.tmp"C:\Users\Admin\AppData\Local\Temp\6210.tmp"38⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\629D.tmp"C:\Users\Admin\AppData\Local\Temp\629D.tmp"39⤵
- Executes dropped EXE
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\632A.tmp"C:\Users\Admin\AppData\Local\Temp\632A.tmp"40⤵
- Executes dropped EXE
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\63B6.tmp"C:\Users\Admin\AppData\Local\Temp\63B6.tmp"41⤵
- Executes dropped EXE
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\6443.tmp"C:\Users\Admin\AppData\Local\Temp\6443.tmp"42⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\64EF.tmp"C:\Users\Admin\AppData\Local\Temp\64EF.tmp"43⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\657B.tmp"C:\Users\Admin\AppData\Local\Temp\657B.tmp"44⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\6627.tmp"C:\Users\Admin\AppData\Local\Temp\6627.tmp"45⤵
- Executes dropped EXE
PID:180 -
C:\Users\Admin\AppData\Local\Temp\66A4.tmp"C:\Users\Admin\AppData\Local\Temp\66A4.tmp"46⤵
- Executes dropped EXE
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\6741.tmp"C:\Users\Admin\AppData\Local\Temp\6741.tmp"47⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\682B.tmp"C:\Users\Admin\AppData\Local\Temp\682B.tmp"48⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\68C7.tmp"C:\Users\Admin\AppData\Local\Temp\68C7.tmp"49⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\6935.tmp"C:\Users\Admin\AppData\Local\Temp\6935.tmp"50⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\69E0.tmp"C:\Users\Admin\AppData\Local\Temp\69E0.tmp"51⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\6A9C.tmp"C:\Users\Admin\AppData\Local\Temp\6A9C.tmp"52⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\6B38.tmp"C:\Users\Admin\AppData\Local\Temp\6B38.tmp"53⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\6BB5.tmp"C:\Users\Admin\AppData\Local\Temp\6BB5.tmp"54⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\6C61.tmp"C:\Users\Admin\AppData\Local\Temp\6C61.tmp"55⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\6CEE.tmp"C:\Users\Admin\AppData\Local\Temp\6CEE.tmp"56⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\6DA9.tmp"C:\Users\Admin\AppData\Local\Temp\6DA9.tmp"57⤵
- Executes dropped EXE
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\6E45.tmp"C:\Users\Admin\AppData\Local\Temp\6E45.tmp"58⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\6EB3.tmp"C:\Users\Admin\AppData\Local\Temp\6EB3.tmp"59⤵
- Executes dropped EXE
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\6F3F.tmp"C:\Users\Admin\AppData\Local\Temp\6F3F.tmp"60⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\6FCC.tmp"C:\Users\Admin\AppData\Local\Temp\6FCC.tmp"61⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\7068.tmp"C:\Users\Admin\AppData\Local\Temp\7068.tmp"62⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\70D6.tmp"C:\Users\Admin\AppData\Local\Temp\70D6.tmp"63⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\7162.tmp"C:\Users\Admin\AppData\Local\Temp\7162.tmp"64⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\720E.tmp"C:\Users\Admin\AppData\Local\Temp\720E.tmp"65⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\72BA.tmp"C:\Users\Admin\AppData\Local\Temp\72BA.tmp"66⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\7356.tmp"C:\Users\Admin\AppData\Local\Temp\7356.tmp"67⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\73F3.tmp"C:\Users\Admin\AppData\Local\Temp\73F3.tmp"68⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\747F.tmp"C:\Users\Admin\AppData\Local\Temp\747F.tmp"69⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\74FC.tmp"C:\Users\Admin\AppData\Local\Temp\74FC.tmp"70⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\75A8.tmp"C:\Users\Admin\AppData\Local\Temp\75A8.tmp"71⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\7654.tmp"C:\Users\Admin\AppData\Local\Temp\7654.tmp"72⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\76E1.tmp"C:\Users\Admin\AppData\Local\Temp\76E1.tmp"73⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\775E.tmp"C:\Users\Admin\AppData\Local\Temp\775E.tmp"74⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\7809.tmp"C:\Users\Admin\AppData\Local\Temp\7809.tmp"75⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\78B5.tmp"C:\Users\Admin\AppData\Local\Temp\78B5.tmp"76⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\7952.tmp"C:\Users\Admin\AppData\Local\Temp\7952.tmp"77⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\7A1D.tmp"C:\Users\Admin\AppData\Local\Temp\7A1D.tmp"78⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\7AA9.tmp"C:\Users\Admin\AppData\Local\Temp\7AA9.tmp"79⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\7B36.tmp"C:\Users\Admin\AppData\Local\Temp\7B36.tmp"80⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\7BB3.tmp"C:\Users\Admin\AppData\Local\Temp\7BB3.tmp"81⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\7C20.tmp"C:\Users\Admin\AppData\Local\Temp\7C20.tmp"82⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\7CCC.tmp"C:\Users\Admin\AppData\Local\Temp\7CCC.tmp"83⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\7D59.tmp"C:\Users\Admin\AppData\Local\Temp\7D59.tmp"84⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\7DF5.tmp"C:\Users\Admin\AppData\Local\Temp\7DF5.tmp"85⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\7E72.tmp"C:\Users\Admin\AppData\Local\Temp\7E72.tmp"86⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"87⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\7F7C.tmp"C:\Users\Admin\AppData\Local\Temp\7F7C.tmp"88⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\8008.tmp"C:\Users\Admin\AppData\Local\Temp\8008.tmp"89⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\8076.tmp"C:\Users\Admin\AppData\Local\Temp\8076.tmp"90⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\80E3.tmp"C:\Users\Admin\AppData\Local\Temp\80E3.tmp"91⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\81AE.tmp"C:\Users\Admin\AppData\Local\Temp\81AE.tmp"92⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\821C.tmp"C:\Users\Admin\AppData\Local\Temp\821C.tmp"93⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\8289.tmp"C:\Users\Admin\AppData\Local\Temp\8289.tmp"94⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\8373.tmp"C:\Users\Admin\AppData\Local\Temp\8373.tmp"95⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\8400.tmp"C:\Users\Admin\AppData\Local\Temp\8400.tmp"96⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\84CB.tmp"C:\Users\Admin\AppData\Local\Temp\84CB.tmp"97⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\8567.tmp"C:\Users\Admin\AppData\Local\Temp\8567.tmp"98⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\85E4.tmp"C:\Users\Admin\AppData\Local\Temp\85E4.tmp"99⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\8661.tmp"C:\Users\Admin\AppData\Local\Temp\8661.tmp"100⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\86FE.tmp"C:\Users\Admin\AppData\Local\Temp\86FE.tmp"101⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\879A.tmp"C:\Users\Admin\AppData\Local\Temp\879A.tmp"102⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\8826.tmp"C:\Users\Admin\AppData\Local\Temp\8826.tmp"103⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\88C3.tmp"C:\Users\Admin\AppData\Local\Temp\88C3.tmp"104⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\8940.tmp"C:\Users\Admin\AppData\Local\Temp\8940.tmp"105⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\89AD.tmp"C:\Users\Admin\AppData\Local\Temp\89AD.tmp"106⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\8A78.tmp"C:\Users\Admin\AppData\Local\Temp\8A78.tmp"107⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\8AE6.tmp"C:\Users\Admin\AppData\Local\Temp\8AE6.tmp"108⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\8B72.tmp"C:\Users\Admin\AppData\Local\Temp\8B72.tmp"109⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\8BEF.tmp"C:\Users\Admin\AppData\Local\Temp\8BEF.tmp"110⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\8C8B.tmp"C:\Users\Admin\AppData\Local\Temp\8C8B.tmp"111⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\8D18.tmp"C:\Users\Admin\AppData\Local\Temp\8D18.tmp"112⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\8DA5.tmp"C:\Users\Admin\AppData\Local\Temp\8DA5.tmp"113⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\8E41.tmp"C:\Users\Admin\AppData\Local\Temp\8E41.tmp"114⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\8EDD.tmp"C:\Users\Admin\AppData\Local\Temp\8EDD.tmp"115⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\8F5A.tmp"C:\Users\Admin\AppData\Local\Temp\8F5A.tmp"116⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\8FC8.tmp"C:\Users\Admin\AppData\Local\Temp\8FC8.tmp"117⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\9054.tmp"C:\Users\Admin\AppData\Local\Temp\9054.tmp"118⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\90E1.tmp"C:\Users\Admin\AppData\Local\Temp\90E1.tmp"119⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\917D.tmp"C:\Users\Admin\AppData\Local\Temp\917D.tmp"120⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\920A.tmp"C:\Users\Admin\AppData\Local\Temp\920A.tmp"121⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\9277.tmp"C:\Users\Admin\AppData\Local\Temp\9277.tmp"122⤵PID:1628
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-