Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
22/08/2023, 14:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
66f5b8f0acab7fbe27d07ae8bae3ccae_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
66f5b8f0acab7fbe27d07ae8bae3ccae_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
66f5b8f0acab7fbe27d07ae8bae3ccae_mafia_JC.exe
-
Size
520KB
-
MD5
66f5b8f0acab7fbe27d07ae8bae3ccae
-
SHA1
8d8fb7d2b9991c06a98f114acb002a53db579145
-
SHA256
faeef855a6bd9a43825936f8060b28dc26258861e72d56259c1df8aecf6dfac8
-
SHA512
6d613452a92ef7f1d78915f4909bd229e7bbd790a04f1657ad47a236b2244002540f4d73dbfa2faa7cb7b2f30320c2796682c6831f5889521f788b8d8bc19d3a
-
SSDEEP
6144:lLvd/XzCjUIF1UuXLyQjmOH+JjLcP7tY/40OvgbEbuMV/2AjRc1KsWfjZT0XarBx:roRXOQjmOycZIbEXVZjDvbZT6aA4NZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 364 7BE7.tmp 4212 7CA2.tmp 4956 7D4E.tmp 1752 7E48.tmp 1892 7F32.tmp 468 7FCF.tmp 3640 806B.tmp 3744 8146.tmp 2132 8211.tmp 2896 829D.tmp 5060 8359.tmp 436 8472.tmp 2568 851E.tmp 620 8628.tmp 2380 86E3.tmp 3800 878F.tmp 2336 883B.tmp 4432 8954.tmp 4692 8A3E.tmp 472 8B58.tmp 444 8BF4.tmp 4380 8C71.tmp 3228 8CFE.tmp 516 8D9A.tmp 1096 8E17.tmp 3696 8ED2.tmp 1516 8F9D.tmp 3864 9059.tmp 1280 9105.tmp 1208 91D0.tmp 216 925D.tmp 4000 9318.tmp 3952 93E3.tmp 4936 947F.tmp 4848 94FC.tmp 4260 9599.tmp 5092 9616.tmp 2572 96B2.tmp 3436 975E.tmp 4932 97FA.tmp 3288 9887.tmp 372 98F4.tmp 2692 9990.tmp 4100 9A1D.tmp 4696 9AD8.tmp 3764 9B55.tmp 928 9BC3.tmp 1164 9C5F.tmp 3836 9CEC.tmp 4552 9D69.tmp 4384 9E15.tmp 3792 9EA1.tmp 3804 9F0F.tmp 4748 9F9B.tmp 2408 A009.tmp 552 A0A5.tmp 764 A122.tmp 1988 A19F.tmp 1404 A1FD.tmp 3768 A299.tmp 4140 A325.tmp 4700 A393.tmp 2568 A45E.tmp 1656 A4DB.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2284 wrote to memory of 364 2284 66f5b8f0acab7fbe27d07ae8bae3ccae_mafia_JC.exe 81 PID 2284 wrote to memory of 364 2284 66f5b8f0acab7fbe27d07ae8bae3ccae_mafia_JC.exe 81 PID 2284 wrote to memory of 364 2284 66f5b8f0acab7fbe27d07ae8bae3ccae_mafia_JC.exe 81 PID 364 wrote to memory of 4212 364 7BE7.tmp 82 PID 364 wrote to memory of 4212 364 7BE7.tmp 82 PID 364 wrote to memory of 4212 364 7BE7.tmp 82 PID 4212 wrote to memory of 4956 4212 7CA2.tmp 83 PID 4212 wrote to memory of 4956 4212 7CA2.tmp 83 PID 4212 wrote to memory of 4956 4212 7CA2.tmp 83 PID 4956 wrote to memory of 1752 4956 7D4E.tmp 84 PID 4956 wrote to memory of 1752 4956 7D4E.tmp 84 PID 4956 wrote to memory of 1752 4956 7D4E.tmp 84 PID 1752 wrote to memory of 1892 1752 7E48.tmp 85 PID 1752 wrote to memory of 1892 1752 7E48.tmp 85 PID 1752 wrote to memory of 1892 1752 7E48.tmp 85 PID 1892 wrote to memory of 468 1892 7F32.tmp 86 PID 1892 wrote to memory of 468 1892 7F32.tmp 86 PID 1892 wrote to memory of 468 1892 7F32.tmp 86 PID 468 wrote to memory of 3640 468 7FCF.tmp 87 PID 468 wrote to memory of 3640 468 7FCF.tmp 87 PID 468 wrote to memory of 3640 468 7FCF.tmp 87 PID 3640 wrote to memory of 3744 3640 806B.tmp 88 PID 3640 wrote to memory of 3744 3640 806B.tmp 88 PID 3640 wrote to memory of 3744 3640 806B.tmp 88 PID 3744 wrote to memory of 2132 3744 8146.tmp 90 PID 3744 wrote to memory of 2132 3744 8146.tmp 90 PID 3744 wrote to memory of 2132 3744 8146.tmp 90 PID 2132 wrote to memory of 2896 2132 8211.tmp 91 PID 2132 wrote to memory of 2896 2132 8211.tmp 91 PID 2132 wrote to memory of 2896 2132 8211.tmp 91 PID 2896 wrote to memory of 5060 2896 829D.tmp 92 PID 2896 wrote to memory of 5060 2896 829D.tmp 92 PID 2896 wrote to memory of 5060 2896 829D.tmp 92 PID 5060 wrote to memory of 436 5060 8359.tmp 93 PID 5060 wrote to memory of 436 5060 8359.tmp 93 PID 5060 wrote to memory of 436 5060 8359.tmp 93 PID 436 wrote to memory of 2568 436 8472.tmp 94 PID 436 wrote to memory of 2568 436 8472.tmp 94 PID 436 wrote to memory of 2568 436 8472.tmp 94 PID 2568 wrote to memory of 620 2568 851E.tmp 95 PID 2568 wrote to memory of 620 2568 851E.tmp 95 PID 2568 wrote to memory of 620 2568 851E.tmp 95 PID 620 wrote to memory of 2380 620 8628.tmp 96 PID 620 wrote to memory of 2380 620 8628.tmp 96 PID 620 wrote to memory of 2380 620 8628.tmp 96 PID 2380 wrote to memory of 3800 2380 86E3.tmp 97 PID 2380 wrote to memory of 3800 2380 86E3.tmp 97 PID 2380 wrote to memory of 3800 2380 86E3.tmp 97 PID 3800 wrote to memory of 2336 3800 878F.tmp 100 PID 3800 wrote to memory of 2336 3800 878F.tmp 100 PID 3800 wrote to memory of 2336 3800 878F.tmp 100 PID 2336 wrote to memory of 4432 2336 883B.tmp 101 PID 2336 wrote to memory of 4432 2336 883B.tmp 101 PID 2336 wrote to memory of 4432 2336 883B.tmp 101 PID 4432 wrote to memory of 4692 4432 8954.tmp 102 PID 4432 wrote to memory of 4692 4432 8954.tmp 102 PID 4432 wrote to memory of 4692 4432 8954.tmp 102 PID 4692 wrote to memory of 472 4692 8A3E.tmp 103 PID 4692 wrote to memory of 472 4692 8A3E.tmp 103 PID 4692 wrote to memory of 472 4692 8A3E.tmp 103 PID 472 wrote to memory of 444 472 8B58.tmp 104 PID 472 wrote to memory of 444 472 8B58.tmp 104 PID 472 wrote to memory of 444 472 8B58.tmp 104 PID 444 wrote to memory of 4380 444 8BF4.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\66f5b8f0acab7fbe27d07ae8bae3ccae_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\66f5b8f0acab7fbe27d07ae8bae3ccae_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\7E48.tmp"C:\Users\Admin\AppData\Local\Temp\7E48.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\7F32.tmp"C:\Users\Admin\AppData\Local\Temp\7F32.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\8146.tmp"C:\Users\Admin\AppData\Local\Temp\8146.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\829D.tmp"C:\Users\Admin\AppData\Local\Temp\829D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\8359.tmp"C:\Users\Admin\AppData\Local\Temp\8359.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\8472.tmp"C:\Users\Admin\AppData\Local\Temp\8472.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\851E.tmp"C:\Users\Admin\AppData\Local\Temp\851E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\8628.tmp"C:\Users\Admin\AppData\Local\Temp\8628.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Users\Admin\AppData\Local\Temp\86E3.tmp"C:\Users\Admin\AppData\Local\Temp\86E3.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\878F.tmp"C:\Users\Admin\AppData\Local\Temp\878F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\883B.tmp"C:\Users\Admin\AppData\Local\Temp\883B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\8954.tmp"C:\Users\Admin\AppData\Local\Temp\8954.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\8B58.tmp"C:\Users\Admin\AppData\Local\Temp\8B58.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
C:\Users\Admin\AppData\Local\Temp\8C71.tmp"C:\Users\Admin\AppData\Local\Temp\8C71.tmp"23⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"24⤵
- Executes dropped EXE
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"25⤵
- Executes dropped EXE
PID:516 -
C:\Users\Admin\AppData\Local\Temp\8E17.tmp"C:\Users\Admin\AppData\Local\Temp\8E17.tmp"26⤵
- Executes dropped EXE
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"27⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"28⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"29⤵
- Executes dropped EXE
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"30⤵
- Executes dropped EXE
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\91D0.tmp"C:\Users\Admin\AppData\Local\Temp\91D0.tmp"31⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"32⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"33⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"34⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\947F.tmp"C:\Users\Admin\AppData\Local\Temp\947F.tmp"35⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\94FC.tmp"C:\Users\Admin\AppData\Local\Temp\94FC.tmp"36⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\9599.tmp"C:\Users\Admin\AppData\Local\Temp\9599.tmp"37⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"38⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\96B2.tmp"C:\Users\Admin\AppData\Local\Temp\96B2.tmp"39⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"40⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\97FA.tmp"C:\Users\Admin\AppData\Local\Temp\97FA.tmp"41⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"42⤵
- Executes dropped EXE
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\98F4.tmp"C:\Users\Admin\AppData\Local\Temp\98F4.tmp"43⤵
- Executes dropped EXE
PID:372 -
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"44⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"45⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"46⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"47⤵
- Executes dropped EXE
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"48⤵
- Executes dropped EXE
PID:928 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"49⤵
- Executes dropped EXE
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"50⤵
- Executes dropped EXE
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\9D69.tmp"C:\Users\Admin\AppData\Local\Temp\9D69.tmp"51⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\9E15.tmp"C:\Users\Admin\AppData\Local\Temp\9E15.tmp"52⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"53⤵
- Executes dropped EXE
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"54⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"55⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"56⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"57⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"58⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\A19F.tmp"C:\Users\Admin\AppData\Local\Temp\A19F.tmp"59⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"60⤵
- Executes dropped EXE
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\A299.tmp"C:\Users\Admin\AppData\Local\Temp\A299.tmp"61⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\A325.tmp"C:\Users\Admin\AppData\Local\Temp\A325.tmp"62⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"63⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"64⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"65⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"66⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"67⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\A633.tmp"C:\Users\Admin\AppData\Local\Temp\A633.tmp"68⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"69⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"70⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"71⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\A827.tmp"C:\Users\Admin\AppData\Local\Temp\A827.tmp"72⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"73⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"74⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"75⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"76⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\AA59.tmp"C:\Users\Admin\AppData\Local\Temp\AA59.tmp"77⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"78⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"79⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"80⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"81⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"82⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"83⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"84⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\AE60.tmp"C:\Users\Admin\AppData\Local\Temp\AE60.tmp"85⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"86⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"87⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"88⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\B054.tmp"C:\Users\Admin\AppData\Local\Temp\B054.tmp"89⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"90⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"91⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\B19D.tmp"C:\Users\Admin\AppData\Local\Temp\B19D.tmp"92⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\B21A.tmp"C:\Users\Admin\AppData\Local\Temp\B21A.tmp"93⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\B277.tmp"C:\Users\Admin\AppData\Local\Temp\B277.tmp"94⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"95⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\B362.tmp"C:\Users\Admin\AppData\Local\Temp\B362.tmp"96⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"97⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\B46B.tmp"C:\Users\Admin\AppData\Local\Temp\B46B.tmp"98⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"99⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\B546.tmp"C:\Users\Admin\AppData\Local\Temp\B546.tmp"100⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"101⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\B621.tmp"C:\Users\Admin\AppData\Local\Temp\B621.tmp"102⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\B69E.tmp"C:\Users\Admin\AppData\Local\Temp\B69E.tmp"103⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\B70B.tmp"C:\Users\Admin\AppData\Local\Temp\B70B.tmp"104⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\B798.tmp"C:\Users\Admin\AppData\Local\Temp\B798.tmp"105⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\B805.tmp"C:\Users\Admin\AppData\Local\Temp\B805.tmp"106⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\B873.tmp"C:\Users\Admin\AppData\Local\Temp\B873.tmp"107⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"108⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\B94D.tmp"C:\Users\Admin\AppData\Local\Temp\B94D.tmp"109⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"110⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\BA95.tmp"C:\Users\Admin\AppData\Local\Temp\BA95.tmp"111⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\BB12.tmp"C:\Users\Admin\AppData\Local\Temp\BB12.tmp"112⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"113⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"114⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"115⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"116⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\BD64.tmp"C:\Users\Admin\AppData\Local\Temp\BD64.tmp"117⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\BE00.tmp"C:\Users\Admin\AppData\Local\Temp\BE00.tmp"118⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"119⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"120⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\BF77.tmp"C:\Users\Admin\AppData\Local\Temp\BF77.tmp"121⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"122⤵PID:1980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-