Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
27/08/2023, 18:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b9046a5cdb8c1fa1463f58fa71f2ace6_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
b9046a5cdb8c1fa1463f58fa71f2ace6_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
b9046a5cdb8c1fa1463f58fa71f2ace6_mafia_JC.exe
-
Size
488KB
-
MD5
b9046a5cdb8c1fa1463f58fa71f2ace6
-
SHA1
1348a2e3e00b59d33b66fc3bf83e222d21e87692
-
SHA256
5011d6cec1d8ccf1cb4210f9c64fcc63485b74f0ce44aefc4301e85782bb54d5
-
SHA512
70f0a499af7862ba35a6f030d3be506fed47da8d7592d034159ed9d94bafcf785acb6b2f3f43fb39e904564ce73fa4e7824ffd0e0c72b3501d14e045835d8a06
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7LeRddcBWMF1z06ngB70G8Y2GrCCjLA9iW2ia:/U5rCOTeiDLeRdqQ/70pYJzLaqNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1920 7BD7.tmp 5108 7CA2.tmp 628 7D5E.tmp 936 7E19.tmp 2564 7F13.tmp 4788 7FFD.tmp 1404 80C9.tmp 3608 8174.tmp 4904 8211.tmp 4384 82BD.tmp 4464 8388.tmp 2436 8424.tmp 3900 84EF.tmp 3720 859B.tmp 2612 8666.tmp 1056 87ED.tmp 1252 88A8.tmp 764 8954.tmp 1808 89F0.tmp 3600 8ABB.tmp 4672 8B87.tmp 1368 8C52.tmp 3968 8CEE.tmp 4940 8D8A.tmp 2924 8E46.tmp 4724 8EF2.tmp 3952 8FAD.tmp 1428 902A.tmp 2188 90E6.tmp 5116 9172.tmp 3224 922E.tmp 1468 9308.tmp 2840 9395.tmp 4240 94ED.tmp 4732 9579.tmp 216 9616.tmp 1804 9683.tmp 4412 971F.tmp 3388 979C.tmp 3076 9829.tmp 4444 9896.tmp 4452 9942.tmp 4128 99B0.tmp 384 9A1D.tmp 3936 9A9A.tmp 3736 9B17.tmp 3496 9B84.tmp 4228 9C01.tmp 5092 9C9E.tmp 548 9D1B.tmp 396 9D98.tmp 876 9E15.tmp 432 9EA1.tmp 2312 9F0F.tmp 1472 9F9B.tmp 3052 A018.tmp 4788 A0A5.tmp 3652 A122.tmp 1104 A18F.tmp 4076 A21C.tmp 3824 A2A8.tmp 2068 A335.tmp 4156 A393.tmp 4476 A41F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2288 wrote to memory of 1920 2288 b9046a5cdb8c1fa1463f58fa71f2ace6_mafia_JC.exe 80 PID 2288 wrote to memory of 1920 2288 b9046a5cdb8c1fa1463f58fa71f2ace6_mafia_JC.exe 80 PID 2288 wrote to memory of 1920 2288 b9046a5cdb8c1fa1463f58fa71f2ace6_mafia_JC.exe 80 PID 1920 wrote to memory of 5108 1920 7BD7.tmp 81 PID 1920 wrote to memory of 5108 1920 7BD7.tmp 81 PID 1920 wrote to memory of 5108 1920 7BD7.tmp 81 PID 5108 wrote to memory of 628 5108 7CA2.tmp 82 PID 5108 wrote to memory of 628 5108 7CA2.tmp 82 PID 5108 wrote to memory of 628 5108 7CA2.tmp 82 PID 628 wrote to memory of 936 628 7D5E.tmp 83 PID 628 wrote to memory of 936 628 7D5E.tmp 83 PID 628 wrote to memory of 936 628 7D5E.tmp 83 PID 936 wrote to memory of 2564 936 7E19.tmp 84 PID 936 wrote to memory of 2564 936 7E19.tmp 84 PID 936 wrote to memory of 2564 936 7E19.tmp 84 PID 2564 wrote to memory of 4788 2564 7F13.tmp 85 PID 2564 wrote to memory of 4788 2564 7F13.tmp 85 PID 2564 wrote to memory of 4788 2564 7F13.tmp 85 PID 4788 wrote to memory of 1404 4788 7FFD.tmp 86 PID 4788 wrote to memory of 1404 4788 7FFD.tmp 86 PID 4788 wrote to memory of 1404 4788 7FFD.tmp 86 PID 1404 wrote to memory of 3608 1404 80C9.tmp 87 PID 1404 wrote to memory of 3608 1404 80C9.tmp 87 PID 1404 wrote to memory of 3608 1404 80C9.tmp 87 PID 3608 wrote to memory of 4904 3608 8174.tmp 88 PID 3608 wrote to memory of 4904 3608 8174.tmp 88 PID 3608 wrote to memory of 4904 3608 8174.tmp 88 PID 4904 wrote to memory of 4384 4904 8211.tmp 90 PID 4904 wrote to memory of 4384 4904 8211.tmp 90 PID 4904 wrote to memory of 4384 4904 8211.tmp 90 PID 4384 wrote to memory of 4464 4384 82BD.tmp 91 PID 4384 wrote to memory of 4464 4384 82BD.tmp 91 PID 4384 wrote to memory of 4464 4384 82BD.tmp 91 PID 4464 wrote to memory of 2436 4464 8388.tmp 92 PID 4464 wrote to memory of 2436 4464 8388.tmp 92 PID 4464 wrote to memory of 2436 4464 8388.tmp 92 PID 2436 wrote to memory of 3900 2436 8424.tmp 93 PID 2436 wrote to memory of 3900 2436 8424.tmp 93 PID 2436 wrote to memory of 3900 2436 8424.tmp 93 PID 3900 wrote to memory of 3720 3900 84EF.tmp 94 PID 3900 wrote to memory of 3720 3900 84EF.tmp 94 PID 3900 wrote to memory of 3720 3900 84EF.tmp 94 PID 3720 wrote to memory of 2612 3720 859B.tmp 95 PID 3720 wrote to memory of 2612 3720 859B.tmp 95 PID 3720 wrote to memory of 2612 3720 859B.tmp 95 PID 2612 wrote to memory of 1056 2612 8666.tmp 96 PID 2612 wrote to memory of 1056 2612 8666.tmp 96 PID 2612 wrote to memory of 1056 2612 8666.tmp 96 PID 1056 wrote to memory of 1252 1056 87ED.tmp 97 PID 1056 wrote to memory of 1252 1056 87ED.tmp 97 PID 1056 wrote to memory of 1252 1056 87ED.tmp 97 PID 1252 wrote to memory of 764 1252 88A8.tmp 100 PID 1252 wrote to memory of 764 1252 88A8.tmp 100 PID 1252 wrote to memory of 764 1252 88A8.tmp 100 PID 764 wrote to memory of 1808 764 8954.tmp 101 PID 764 wrote to memory of 1808 764 8954.tmp 101 PID 764 wrote to memory of 1808 764 8954.tmp 101 PID 1808 wrote to memory of 3600 1808 89F0.tmp 102 PID 1808 wrote to memory of 3600 1808 89F0.tmp 102 PID 1808 wrote to memory of 3600 1808 89F0.tmp 102 PID 3600 wrote to memory of 4672 3600 8ABB.tmp 103 PID 3600 wrote to memory of 4672 3600 8ABB.tmp 103 PID 3600 wrote to memory of 4672 3600 8ABB.tmp 103 PID 4672 wrote to memory of 1368 4672 8B87.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9046a5cdb8c1fa1463f58fa71f2ace6_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\b9046a5cdb8c1fa1463f58fa71f2ace6_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\7F13.tmp"C:\Users\Admin\AppData\Local\Temp\7F13.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\80C9.tmp"C:\Users\Admin\AppData\Local\Temp\80C9.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\8174.tmp"C:\Users\Admin\AppData\Local\Temp\8174.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\82BD.tmp"C:\Users\Admin\AppData\Local\Temp\82BD.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\8388.tmp"C:\Users\Admin\AppData\Local\Temp\8388.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\8424.tmp"C:\Users\Admin\AppData\Local\Temp\8424.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\84EF.tmp"C:\Users\Admin\AppData\Local\Temp\84EF.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\859B.tmp"C:\Users\Admin\AppData\Local\Temp\859B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\8666.tmp"C:\Users\Admin\AppData\Local\Temp\8666.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\88A8.tmp"C:\Users\Admin\AppData\Local\Temp\88A8.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\8954.tmp"C:\Users\Admin\AppData\Local\Temp\8954.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\89F0.tmp"C:\Users\Admin\AppData\Local\Temp\89F0.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\8B87.tmp"C:\Users\Admin\AppData\Local\Temp\8B87.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"23⤵
- Executes dropped EXE
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"24⤵
- Executes dropped EXE
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"25⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\8E46.tmp"C:\Users\Admin\AppData\Local\Temp\8E46.tmp"26⤵
- Executes dropped EXE
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"27⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"28⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\902A.tmp"C:\Users\Admin\AppData\Local\Temp\902A.tmp"29⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\90E6.tmp"C:\Users\Admin\AppData\Local\Temp\90E6.tmp"30⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp"31⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\922E.tmp"C:\Users\Admin\AppData\Local\Temp\922E.tmp"32⤵
- Executes dropped EXE
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\9308.tmp"C:\Users\Admin\AppData\Local\Temp\9308.tmp"33⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\9395.tmp"C:\Users\Admin\AppData\Local\Temp\9395.tmp"34⤵
- Executes dropped EXE
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\94ED.tmp"C:\Users\Admin\AppData\Local\Temp\94ED.tmp"35⤵
- Executes dropped EXE
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\9579.tmp"C:\Users\Admin\AppData\Local\Temp\9579.tmp"36⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"37⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"38⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"39⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"40⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"41⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\9896.tmp"C:\Users\Admin\AppData\Local\Temp\9896.tmp"42⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\9942.tmp"C:\Users\Admin\AppData\Local\Temp\9942.tmp"43⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"44⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"45⤵
- Executes dropped EXE
PID:384 -
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"46⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"47⤵
- Executes dropped EXE
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"48⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"49⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"50⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"51⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"52⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\9E15.tmp"C:\Users\Admin\AppData\Local\Temp\9E15.tmp"53⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"54⤵
- Executes dropped EXE
PID:432 -
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"55⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"56⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"57⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"58⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"59⤵
- Executes dropped EXE
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\A18F.tmp"C:\Users\Admin\AppData\Local\Temp\A18F.tmp"60⤵
- Executes dropped EXE
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\A21C.tmp"C:\Users\Admin\AppData\Local\Temp\A21C.tmp"61⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"62⤵
- Executes dropped EXE
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"63⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"64⤵
- Executes dropped EXE
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\A41F.tmp"C:\Users\Admin\AppData\Local\Temp\A41F.tmp"65⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"66⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"67⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"68⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\A633.tmp"C:\Users\Admin\AppData\Local\Temp\A633.tmp"69⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"70⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"71⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"72⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"73⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"74⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"75⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"76⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"77⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\AA88.tmp"C:\Users\Admin\AppData\Local\Temp\AA88.tmp"78⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"79⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\AB53.tmp"C:\Users\Admin\AppData\Local\Temp\AB53.tmp"80⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"81⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"82⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"83⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"84⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"85⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\AE12.tmp"C:\Users\Admin\AppData\Local\Temp\AE12.tmp"86⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"87⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"88⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\AF99.tmp"C:\Users\Admin\AppData\Local\Temp\AF99.tmp"89⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"90⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\B064.tmp"C:\Users\Admin\AppData\Local\Temp\B064.tmp"91⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"92⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\B15E.tmp"C:\Users\Admin\AppData\Local\Temp\B15E.tmp"93⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"94⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\B258.tmp"C:\Users\Admin\AppData\Local\Temp\B258.tmp"95⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"96⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"97⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"98⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\B45C.tmp"C:\Users\Admin\AppData\Local\Temp\B45C.tmp"99⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"100⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\B565.tmp"C:\Users\Admin\AppData\Local\Temp\B565.tmp"101⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"102⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\B67F.tmp"C:\Users\Admin\AppData\Local\Temp\B67F.tmp"103⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\B71B.tmp"C:\Users\Admin\AppData\Local\Temp\B71B.tmp"104⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\B779.tmp"C:\Users\Admin\AppData\Local\Temp\B779.tmp"105⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\B815.tmp"C:\Users\Admin\AppData\Local\Temp\B815.tmp"106⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\B892.tmp"C:\Users\Admin\AppData\Local\Temp\B892.tmp"107⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"108⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"109⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\BA28.tmp"C:\Users\Admin\AppData\Local\Temp\BA28.tmp"110⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"111⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\BB61.tmp"C:\Users\Admin\AppData\Local\Temp\BB61.tmp"112⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"113⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\BC99.tmp"C:\Users\Admin\AppData\Local\Temp\BC99.tmp"114⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\BD26.tmp"C:\Users\Admin\AppData\Local\Temp\BD26.tmp"115⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"116⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\BE10.tmp"C:\Users\Admin\AppData\Local\Temp\BE10.tmp"117⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"118⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\BF39.tmp"C:\Users\Admin\AppData\Local\Temp\BF39.tmp"119⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"120⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\C043.tmp"C:\Users\Admin\AppData\Local\Temp\C043.tmp"121⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"122⤵PID:3712
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-