Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2023, 18:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
66abcd05bc1d36eba0a4748d7eb2e6eb_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
66abcd05bc1d36eba0a4748d7eb2e6eb_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
66abcd05bc1d36eba0a4748d7eb2e6eb_mafia_JC.exe
-
Size
488KB
-
MD5
66abcd05bc1d36eba0a4748d7eb2e6eb
-
SHA1
945294df9d770653cb04362a7ea2be713519596c
-
SHA256
032e9d67b9f64c292752c1347a96621bd431dddcdf0a290db190ab55a59c0b77
-
SHA512
c74219f9c38edd86a937740f3bb3c3e13e52e2663091005e4141b795899ad0380afbec6edfafa73be59dc51b1316c04241d6caa47e832a64a1bcfe08cc85f830
-
SSDEEP
12288:/U5rCOTeiDA7D0/BLNaoSHdudXuriOhNZ:/UQOJDA/0/BLsVdu9ueOhN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4488 78F9.tmp 4180 7A02.tmp 1376 7AED.tmp 3700 7BE7.tmp 3940 7D2F.tmp 2304 7E19.tmp 1224 7EC5.tmp 1444 7FBF.tmp 3932 807A.tmp 2732 8184.tmp 3012 82EB.tmp 3908 8405.tmp 832 8491.tmp 4988 852E.tmp 3828 85BA.tmp 3836 8656.tmp 220 86F3.tmp 4648 87ED.tmp 4668 8944.tmp 4956 8A00.tmp 1212 8A8D.tmp 3536 8B38.tmp 3640 8BD5.tmp 2024 8C71.tmp 2580 8CFE.tmp 4840 8DD8.tmp 3068 8E75.tmp 3852 8F30.tmp 5100 8FBD.tmp 1936 9097.tmp 4320 9163.tmp 3352 922E.tmp 2496 92F9.tmp 2972 9376.tmp 2940 93F3.tmp 2840 949F.tmp 4204 951C.tmp 2632 95A8.tmp 1544 9645.tmp 2544 96C2.tmp 2220 975E.tmp 5116 980A.tmp 4000 98B6.tmp 1620 9933.tmp 4484 99CF.tmp 2868 9A6B.tmp 4328 9AF8.tmp 836 9B75.tmp 4192 9C11.tmp 3820 9C7E.tmp 4488 9D0B.tmp 4200 9DB7.tmp 4796 9E24.tmp 4180 9EB1.tmp 4848 9F3D.tmp 1740 9FDA.tmp 4528 A076.tmp 2388 A0E3.tmp 1404 A180.tmp 3780 A1ED.tmp 2652 A289.tmp 2732 A306.tmp 4168 A374.tmp 4352 A3E1.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1380 wrote to memory of 4488 1380 66abcd05bc1d36eba0a4748d7eb2e6eb_mafia_JC.exe 81 PID 1380 wrote to memory of 4488 1380 66abcd05bc1d36eba0a4748d7eb2e6eb_mafia_JC.exe 81 PID 1380 wrote to memory of 4488 1380 66abcd05bc1d36eba0a4748d7eb2e6eb_mafia_JC.exe 81 PID 4488 wrote to memory of 4180 4488 78F9.tmp 82 PID 4488 wrote to memory of 4180 4488 78F9.tmp 82 PID 4488 wrote to memory of 4180 4488 78F9.tmp 82 PID 4180 wrote to memory of 1376 4180 7A02.tmp 83 PID 4180 wrote to memory of 1376 4180 7A02.tmp 83 PID 4180 wrote to memory of 1376 4180 7A02.tmp 83 PID 1376 wrote to memory of 3700 1376 7AED.tmp 84 PID 1376 wrote to memory of 3700 1376 7AED.tmp 84 PID 1376 wrote to memory of 3700 1376 7AED.tmp 84 PID 3700 wrote to memory of 3940 3700 7BE7.tmp 85 PID 3700 wrote to memory of 3940 3700 7BE7.tmp 85 PID 3700 wrote to memory of 3940 3700 7BE7.tmp 85 PID 3940 wrote to memory of 2304 3940 7D2F.tmp 86 PID 3940 wrote to memory of 2304 3940 7D2F.tmp 86 PID 3940 wrote to memory of 2304 3940 7D2F.tmp 86 PID 2304 wrote to memory of 1224 2304 7E19.tmp 87 PID 2304 wrote to memory of 1224 2304 7E19.tmp 87 PID 2304 wrote to memory of 1224 2304 7E19.tmp 87 PID 1224 wrote to memory of 1444 1224 7EC5.tmp 88 PID 1224 wrote to memory of 1444 1224 7EC5.tmp 88 PID 1224 wrote to memory of 1444 1224 7EC5.tmp 88 PID 1444 wrote to memory of 3932 1444 7FBF.tmp 89 PID 1444 wrote to memory of 3932 1444 7FBF.tmp 89 PID 1444 wrote to memory of 3932 1444 7FBF.tmp 89 PID 3932 wrote to memory of 2732 3932 807A.tmp 90 PID 3932 wrote to memory of 2732 3932 807A.tmp 90 PID 3932 wrote to memory of 2732 3932 807A.tmp 90 PID 2732 wrote to memory of 3012 2732 8184.tmp 91 PID 2732 wrote to memory of 3012 2732 8184.tmp 91 PID 2732 wrote to memory of 3012 2732 8184.tmp 91 PID 3012 wrote to memory of 3908 3012 82EB.tmp 92 PID 3012 wrote to memory of 3908 3012 82EB.tmp 92 PID 3012 wrote to memory of 3908 3012 82EB.tmp 92 PID 3908 wrote to memory of 832 3908 8405.tmp 93 PID 3908 wrote to memory of 832 3908 8405.tmp 93 PID 3908 wrote to memory of 832 3908 8405.tmp 93 PID 832 wrote to memory of 4988 832 8491.tmp 94 PID 832 wrote to memory of 4988 832 8491.tmp 94 PID 832 wrote to memory of 4988 832 8491.tmp 94 PID 4988 wrote to memory of 3828 4988 852E.tmp 97 PID 4988 wrote to memory of 3828 4988 852E.tmp 97 PID 4988 wrote to memory of 3828 4988 852E.tmp 97 PID 3828 wrote to memory of 3836 3828 85BA.tmp 98 PID 3828 wrote to memory of 3836 3828 85BA.tmp 98 PID 3828 wrote to memory of 3836 3828 85BA.tmp 98 PID 3836 wrote to memory of 220 3836 8656.tmp 99 PID 3836 wrote to memory of 220 3836 8656.tmp 99 PID 3836 wrote to memory of 220 3836 8656.tmp 99 PID 220 wrote to memory of 4648 220 86F3.tmp 100 PID 220 wrote to memory of 4648 220 86F3.tmp 100 PID 220 wrote to memory of 4648 220 86F3.tmp 100 PID 4648 wrote to memory of 4668 4648 87ED.tmp 101 PID 4648 wrote to memory of 4668 4648 87ED.tmp 101 PID 4648 wrote to memory of 4668 4648 87ED.tmp 101 PID 4668 wrote to memory of 4956 4668 8944.tmp 102 PID 4668 wrote to memory of 4956 4668 8944.tmp 102 PID 4668 wrote to memory of 4956 4668 8944.tmp 102 PID 4956 wrote to memory of 1212 4956 8A00.tmp 104 PID 4956 wrote to memory of 1212 4956 8A00.tmp 104 PID 4956 wrote to memory of 1212 4956 8A00.tmp 104 PID 1212 wrote to memory of 3536 1212 8A8D.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\66abcd05bc1d36eba0a4748d7eb2e6eb_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\66abcd05bc1d36eba0a4748d7eb2e6eb_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\78F9.tmp"C:\Users\Admin\AppData\Local\Temp\78F9.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\7A02.tmp"C:\Users\Admin\AppData\Local\Temp\7A02.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\7AED.tmp"C:\Users\Admin\AppData\Local\Temp\7AED.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\807A.tmp"C:\Users\Admin\AppData\Local\Temp\807A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\8184.tmp"C:\Users\Admin\AppData\Local\Temp\8184.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\82EB.tmp"C:\Users\Admin\AppData\Local\Temp\82EB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\8405.tmp"C:\Users\Admin\AppData\Local\Temp\8405.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\8491.tmp"C:\Users\Admin\AppData\Local\Temp\8491.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\852E.tmp"C:\Users\Admin\AppData\Local\Temp\852E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\85BA.tmp"C:\Users\Admin\AppData\Local\Temp\85BA.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\86F3.tmp"C:\Users\Admin\AppData\Local\Temp\86F3.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\8A00.tmp"C:\Users\Admin\AppData\Local\Temp\8A00.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\8B38.tmp"C:\Users\Admin\AppData\Local\Temp\8B38.tmp"23⤵
- Executes dropped EXE
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"24⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\8C71.tmp"C:\Users\Admin\AppData\Local\Temp\8C71.tmp"25⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"26⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"27⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\8E75.tmp"C:\Users\Admin\AppData\Local\Temp\8E75.tmp"28⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\8F30.tmp"C:\Users\Admin\AppData\Local\Temp\8F30.tmp"29⤵
- Executes dropped EXE
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"30⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\9097.tmp"C:\Users\Admin\AppData\Local\Temp\9097.tmp"31⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\9163.tmp"C:\Users\Admin\AppData\Local\Temp\9163.tmp"32⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\922E.tmp"C:\Users\Admin\AppData\Local\Temp\922E.tmp"33⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\92F9.tmp"C:\Users\Admin\AppData\Local\Temp\92F9.tmp"34⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\9376.tmp"C:\Users\Admin\AppData\Local\Temp\9376.tmp"35⤵
- Executes dropped EXE
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\93F3.tmp"C:\Users\Admin\AppData\Local\Temp\93F3.tmp"36⤵
- Executes dropped EXE
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"37⤵
- Executes dropped EXE
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\951C.tmp"C:\Users\Admin\AppData\Local\Temp\951C.tmp"38⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"39⤵
- Executes dropped EXE
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"40⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\96C2.tmp"C:\Users\Admin\AppData\Local\Temp\96C2.tmp"41⤵
- Executes dropped EXE
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"42⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"43⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\98B6.tmp"C:\Users\Admin\AppData\Local\Temp\98B6.tmp"44⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"45⤵
- Executes dropped EXE
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"46⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"47⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"48⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"49⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"50⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"51⤵
- Executes dropped EXE
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"52⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"53⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"54⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"55⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"56⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"57⤵
- Executes dropped EXE
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\A076.tmp"C:\Users\Admin\AppData\Local\Temp\A076.tmp"58⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"59⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\A180.tmp"C:\Users\Admin\AppData\Local\Temp\A180.tmp"60⤵
- Executes dropped EXE
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"61⤵
- Executes dropped EXE
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"62⤵
- Executes dropped EXE
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\A306.tmp"C:\Users\Admin\AppData\Local\Temp\A306.tmp"63⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\A374.tmp"C:\Users\Admin\AppData\Local\Temp\A374.tmp"64⤵
- Executes dropped EXE
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"65⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"66⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"67⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"68⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"69⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\A671.tmp"C:\Users\Admin\AppData\Local\Temp\A671.tmp"70⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"71⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"72⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"73⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\A894.tmp"C:\Users\Admin\AppData\Local\Temp\A894.tmp"74⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\A911.tmp"C:\Users\Admin\AppData\Local\Temp\A911.tmp"75⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"76⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"77⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"78⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"79⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"80⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"81⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\AD38.tmp"C:\Users\Admin\AppData\Local\Temp\AD38.tmp"82⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"83⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"84⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"85⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"86⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\AF99.tmp"C:\Users\Admin\AppData\Local\Temp\AF99.tmp"87⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"88⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"89⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\B110.tmp"C:\Users\Admin\AppData\Local\Temp\B110.tmp"90⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"91⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\B239.tmp"C:\Users\Admin\AppData\Local\Temp\B239.tmp"92⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"93⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\B381.tmp"C:\Users\Admin\AppData\Local\Temp\B381.tmp"94⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"95⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\B45C.tmp"C:\Users\Admin\AppData\Local\Temp\B45C.tmp"96⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"97⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\B594.tmp"C:\Users\Admin\AppData\Local\Temp\B594.tmp"98⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\B611.tmp"C:\Users\Admin\AppData\Local\Temp\B611.tmp"99⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"100⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\B73A.tmp"C:\Users\Admin\AppData\Local\Temp\B73A.tmp"101⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"102⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\B873.tmp"C:\Users\Admin\AppData\Local\Temp\B873.tmp"103⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"104⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\B97C.tmp"C:\Users\Admin\AppData\Local\Temp\B97C.tmp"105⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"106⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\BA95.tmp"C:\Users\Admin\AppData\Local\Temp\BA95.tmp"107⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\BB41.tmp"C:\Users\Admin\AppData\Local\Temp\BB41.tmp"108⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"109⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"110⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"111⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"112⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"113⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\BEEB.tmp"C:\Users\Admin\AppData\Local\Temp\BEEB.tmp"114⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\BF87.tmp"C:\Users\Admin\AppData\Local\Temp\BF87.tmp"115⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\C014.tmp"C:\Users\Admin\AppData\Local\Temp\C014.tmp"116⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"117⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\C11D.tmp"C:\Users\Admin\AppData\Local\Temp\C11D.tmp"118⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"119⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\C246.tmp"C:\Users\Admin\AppData\Local\Temp\C246.tmp"120⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"121⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\C340.tmp"C:\Users\Admin\AppData\Local\Temp\C340.tmp"122⤵PID:3504
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-