Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
29-08-2023 15:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cda9f568888d9bbd2ea69ed1878e63b8_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
cda9f568888d9bbd2ea69ed1878e63b8_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
cda9f568888d9bbd2ea69ed1878e63b8_mafia_JC.exe
-
Size
488KB
-
MD5
cda9f568888d9bbd2ea69ed1878e63b8
-
SHA1
f66c5bcd88e001fa154ac2348d9965b466e03e0e
-
SHA256
e4a29d80707cef7c45e3d3c607fb31e4704a1ae323a9c58fb2e27df2b5468c9b
-
SHA512
a104e22b2d5c9a5d199242a55ae07d77219e3cbfc2f02e3e6f04e5327a7fa0d69041dff003e77f1edbe9b0a088e3722c5af7663fa9736ff772f61e316c8b2064
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7tr/XsYjK1ZTwxqZSZTIIh9ZL51jPoFR3AHsz:/U5rCOTeiDZ/XxjKTwxqIZTNL583nNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4408 756E.tmp 2684 7639.tmp 3744 7714.tmp 2280 77FF.tmp 1052 7985.tmp 1088 7A50.tmp 2364 7B1B.tmp 1268 7BD7.tmp 3700 7C83.tmp 4860 7D4E.tmp 4960 7F13.tmp 408 801D.tmp 3804 80A9.tmp 2584 8146.tmp 988 8230.tmp 4156 8359.tmp 900 8434.tmp 3044 84EF.tmp 1056 858B.tmp 4744 8656.tmp 1152 8750.tmp 1580 87FC.tmp 4604 88B8.tmp 4236 8983.tmp 520 8A1F.tmp 2168 8A9C.tmp 2136 8B38.tmp 2608 8BD5.tmp 4880 8C52.tmp 1444 8CFE.tmp 416 8DA9.tmp 656 8E55.tmp 456 9088.tmp 1604 90F5.tmp 1248 9182.tmp 3300 920E.tmp 3812 92BA.tmp 3564 9357.tmp 3188 9412.tmp 2592 94AE.tmp 2564 954B.tmp 4980 95C8.tmp 4832 9645.tmp 2272 96D1.tmp 1352 977D.tmp 1016 980A.tmp 920 9887.tmp 3936 99DE.tmp 3172 9A8A.tmp 4788 9B27.tmp 1732 9BB3.tmp 3168 9C30.tmp 4888 9CAD.tmp 1148 9D3A.tmp 2872 9DA7.tmp 2876 9E43.tmp 3572 9ED0.tmp 3084 9F5D.tmp 2252 9FE9.tmp 3388 A095.tmp 1840 A122.tmp 3944 A1AE.tmp 4068 A21C.tmp 1208 A289.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2164 wrote to memory of 4408 2164 cda9f568888d9bbd2ea69ed1878e63b8_mafia_JC.exe 82 PID 2164 wrote to memory of 4408 2164 cda9f568888d9bbd2ea69ed1878e63b8_mafia_JC.exe 82 PID 2164 wrote to memory of 4408 2164 cda9f568888d9bbd2ea69ed1878e63b8_mafia_JC.exe 82 PID 4408 wrote to memory of 2684 4408 756E.tmp 83 PID 4408 wrote to memory of 2684 4408 756E.tmp 83 PID 4408 wrote to memory of 2684 4408 756E.tmp 83 PID 2684 wrote to memory of 3744 2684 7639.tmp 84 PID 2684 wrote to memory of 3744 2684 7639.tmp 84 PID 2684 wrote to memory of 3744 2684 7639.tmp 84 PID 3744 wrote to memory of 2280 3744 7714.tmp 85 PID 3744 wrote to memory of 2280 3744 7714.tmp 85 PID 3744 wrote to memory of 2280 3744 7714.tmp 85 PID 2280 wrote to memory of 1052 2280 77FF.tmp 86 PID 2280 wrote to memory of 1052 2280 77FF.tmp 86 PID 2280 wrote to memory of 1052 2280 77FF.tmp 86 PID 1052 wrote to memory of 1088 1052 7985.tmp 87 PID 1052 wrote to memory of 1088 1052 7985.tmp 87 PID 1052 wrote to memory of 1088 1052 7985.tmp 87 PID 1088 wrote to memory of 2364 1088 7A50.tmp 88 PID 1088 wrote to memory of 2364 1088 7A50.tmp 88 PID 1088 wrote to memory of 2364 1088 7A50.tmp 88 PID 2364 wrote to memory of 1268 2364 7B1B.tmp 89 PID 2364 wrote to memory of 1268 2364 7B1B.tmp 89 PID 2364 wrote to memory of 1268 2364 7B1B.tmp 89 PID 1268 wrote to memory of 3700 1268 7BD7.tmp 90 PID 1268 wrote to memory of 3700 1268 7BD7.tmp 90 PID 1268 wrote to memory of 3700 1268 7BD7.tmp 90 PID 3700 wrote to memory of 4860 3700 7C83.tmp 91 PID 3700 wrote to memory of 4860 3700 7C83.tmp 91 PID 3700 wrote to memory of 4860 3700 7C83.tmp 91 PID 4860 wrote to memory of 4960 4860 7D4E.tmp 92 PID 4860 wrote to memory of 4960 4860 7D4E.tmp 92 PID 4860 wrote to memory of 4960 4860 7D4E.tmp 92 PID 4960 wrote to memory of 408 4960 7F13.tmp 93 PID 4960 wrote to memory of 408 4960 7F13.tmp 93 PID 4960 wrote to memory of 408 4960 7F13.tmp 93 PID 408 wrote to memory of 3804 408 801D.tmp 94 PID 408 wrote to memory of 3804 408 801D.tmp 94 PID 408 wrote to memory of 3804 408 801D.tmp 94 PID 3804 wrote to memory of 2584 3804 80A9.tmp 95 PID 3804 wrote to memory of 2584 3804 80A9.tmp 95 PID 3804 wrote to memory of 2584 3804 80A9.tmp 95 PID 2584 wrote to memory of 988 2584 8146.tmp 96 PID 2584 wrote to memory of 988 2584 8146.tmp 96 PID 2584 wrote to memory of 988 2584 8146.tmp 96 PID 988 wrote to memory of 4156 988 8230.tmp 97 PID 988 wrote to memory of 4156 988 8230.tmp 97 PID 988 wrote to memory of 4156 988 8230.tmp 97 PID 4156 wrote to memory of 900 4156 8359.tmp 98 PID 4156 wrote to memory of 900 4156 8359.tmp 98 PID 4156 wrote to memory of 900 4156 8359.tmp 98 PID 900 wrote to memory of 3044 900 8434.tmp 101 PID 900 wrote to memory of 3044 900 8434.tmp 101 PID 900 wrote to memory of 3044 900 8434.tmp 101 PID 3044 wrote to memory of 1056 3044 84EF.tmp 102 PID 3044 wrote to memory of 1056 3044 84EF.tmp 102 PID 3044 wrote to memory of 1056 3044 84EF.tmp 102 PID 1056 wrote to memory of 4744 1056 858B.tmp 103 PID 1056 wrote to memory of 4744 1056 858B.tmp 103 PID 1056 wrote to memory of 4744 1056 858B.tmp 103 PID 4744 wrote to memory of 1152 4744 8656.tmp 104 PID 4744 wrote to memory of 1152 4744 8656.tmp 104 PID 4744 wrote to memory of 1152 4744 8656.tmp 104 PID 1152 wrote to memory of 1580 1152 8750.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\cda9f568888d9bbd2ea69ed1878e63b8_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\cda9f568888d9bbd2ea69ed1878e63b8_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\7714.tmp"C:\Users\Admin\AppData\Local\Temp\7714.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\77FF.tmp"C:\Users\Admin\AppData\Local\Temp\77FF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\7A50.tmp"C:\Users\Admin\AppData\Local\Temp\7A50.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\7C83.tmp"C:\Users\Admin\AppData\Local\Temp\7C83.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\7F13.tmp"C:\Users\Admin\AppData\Local\Temp\7F13.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\801D.tmp"C:\Users\Admin\AppData\Local\Temp\801D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\80A9.tmp"C:\Users\Admin\AppData\Local\Temp\80A9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\8146.tmp"C:\Users\Admin\AppData\Local\Temp\8146.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\8230.tmp"C:\Users\Admin\AppData\Local\Temp\8230.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\8359.tmp"C:\Users\Admin\AppData\Local\Temp\8359.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\8434.tmp"C:\Users\Admin\AppData\Local\Temp\8434.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\84EF.tmp"C:\Users\Admin\AppData\Local\Temp\84EF.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\858B.tmp"C:\Users\Admin\AppData\Local\Temp\858B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\8750.tmp"C:\Users\Admin\AppData\Local\Temp\8750.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\87FC.tmp"C:\Users\Admin\AppData\Local\Temp\87FC.tmp"23⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\88B8.tmp"C:\Users\Admin\AppData\Local\Temp\88B8.tmp"24⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\8983.tmp"C:\Users\Admin\AppData\Local\Temp\8983.tmp"25⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"26⤵
- Executes dropped EXE
PID:520 -
C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"27⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\8B38.tmp"C:\Users\Admin\AppData\Local\Temp\8B38.tmp"28⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"29⤵
- Executes dropped EXE
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"30⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"31⤵
- Executes dropped EXE
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"32⤵
- Executes dropped EXE
PID:416 -
C:\Users\Admin\AppData\Local\Temp\8E55.tmp"C:\Users\Admin\AppData\Local\Temp\8E55.tmp"33⤵
- Executes dropped EXE
PID:656 -
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"34⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"35⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\9182.tmp"C:\Users\Admin\AppData\Local\Temp\9182.tmp"36⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"37⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"38⤵
- Executes dropped EXE
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"39⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\9412.tmp"C:\Users\Admin\AppData\Local\Temp\9412.tmp"40⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\94AE.tmp"C:\Users\Admin\AppData\Local\Temp\94AE.tmp"41⤵
- Executes dropped EXE
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\954B.tmp"C:\Users\Admin\AppData\Local\Temp\954B.tmp"42⤵
- Executes dropped EXE
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\95C8.tmp"C:\Users\Admin\AppData\Local\Temp\95C8.tmp"43⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"44⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\96D1.tmp"C:\Users\Admin\AppData\Local\Temp\96D1.tmp"45⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\977D.tmp"C:\Users\Admin\AppData\Local\Temp\977D.tmp"46⤵
- Executes dropped EXE
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"47⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"48⤵
- Executes dropped EXE
PID:920 -
C:\Users\Admin\AppData\Local\Temp\9942.tmp"C:\Users\Admin\AppData\Local\Temp\9942.tmp"49⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"50⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"51⤵
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"52⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"53⤵
- Executes dropped EXE
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"54⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"55⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"56⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"57⤵
- Executes dropped EXE
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"58⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"59⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"60⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"61⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\A095.tmp"C:\Users\Admin\AppData\Local\Temp\A095.tmp"62⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"63⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"64⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\A21C.tmp"C:\Users\Admin\AppData\Local\Temp\A21C.tmp"65⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"66⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"67⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"68⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"69⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"70⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\A50A.tmp"C:\Users\Admin\AppData\Local\Temp\A50A.tmp"71⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"72⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\A613.tmp"C:\Users\Admin\AppData\Local\Temp\A613.tmp"73⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"74⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"75⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\A74C.tmp"C:\Users\Admin\AppData\Local\Temp\A74C.tmp"76⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"77⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"78⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"79⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"80⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"81⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"82⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"83⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\AD66.tmp"C:\Users\Admin\AppData\Local\Temp\AD66.tmp"84⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"85⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"86⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"87⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"88⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"89⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\B064.tmp"C:\Users\Admin\AppData\Local\Temp\B064.tmp"90⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"91⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\B18D.tmp"C:\Users\Admin\AppData\Local\Temp\B18D.tmp"92⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"93⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\B287.tmp"C:\Users\Admin\AppData\Local\Temp\B287.tmp"94⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"95⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"96⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"97⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"98⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\B594.tmp"C:\Users\Admin\AppData\Local\Temp\B594.tmp"99⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"100⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"101⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\B759.tmp"C:\Users\Admin\AppData\Local\Temp\B759.tmp"102⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"103⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\B873.tmp"C:\Users\Admin\AppData\Local\Temp\B873.tmp"104⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\B96D.tmp"C:\Users\Admin\AppData\Local\Temp\B96D.tmp"105⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\BA09.tmp"C:\Users\Admin\AppData\Local\Temp\BA09.tmp"106⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\BA95.tmp"C:\Users\Admin\AppData\Local\Temp\BA95.tmp"107⤵PID:424
-
C:\Users\Admin\AppData\Local\Temp\BB32.tmp"C:\Users\Admin\AppData\Local\Temp\BB32.tmp"108⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"109⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"110⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"111⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\BD93.tmp"C:\Users\Admin\AppData\Local\Temp\BD93.tmp"112⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\BE20.tmp"C:\Users\Admin\AppData\Local\Temp\BE20.tmp"113⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"114⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"115⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"116⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\C023.tmp"C:\Users\Admin\AppData\Local\Temp\C023.tmp"117⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"118⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\C18B.tmp"C:\Users\Admin\AppData\Local\Temp\C18B.tmp"119⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\C217.tmp"C:\Users\Admin\AppData\Local\Temp\C217.tmp"120⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\C285.tmp"C:\Users\Admin\AppData\Local\Temp\C285.tmp"121⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\C311.tmp"C:\Users\Admin\AppData\Local\Temp\C311.tmp"122⤵PID:3572
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-