Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17-08-2023 17:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1b0e636affe817dfe2bf9fc1ddf90f6c_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
1b0e636affe817dfe2bf9fc1ddf90f6c_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
1b0e636affe817dfe2bf9fc1ddf90f6c_mafia_JC.exe
-
Size
486KB
-
MD5
1b0e636affe817dfe2bf9fc1ddf90f6c
-
SHA1
3f9e2a255e5c91d63ea49fdc50f9937736b15469
-
SHA256
6addcd11ce140aa2d9ea260b34ea37858bc4e73b83aa2ec8f9a56ceef488c0e3
-
SHA512
17b4297a7bba2ea715e08e37e73910762ea10b47683ea74728cfaa37e0eaf5002a9f2809e593039584b2004c5d48c3480ac9e01784ae133201bb45ea8fe5d2e9
-
SSDEEP
12288:oU5rCOTeiDTp9zHjInwCb2T4yY509XNZ:oUQOJDT3HsnMWi9XN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4856 808A.tmp 2284 81A3.tmp 4220 826E.tmp 3480 8397.tmp 1760 8424.tmp 3352 84D0.tmp 2236 856C.tmp 1876 8666.tmp 1076 8702.tmp 1636 879F.tmp 1928 884A.tmp 2576 88F6.tmp 2108 89A2.tmp 4720 8B67.tmp 4156 8C13.tmp 1148 8CEE.tmp 312 8D7B.tmp 228 8E36.tmp 2224 8EF2.tmp 3240 8F8E.tmp 2004 9059.tmp 4084 9114.tmp 4964 91D0.tmp 1368 924D.tmp 1428 92E9.tmp 1384 9385.tmp 4592 9441.tmp 3816 94AE.tmp 2296 953B.tmp 2836 95E7.tmp 4936 96C2.tmp 4768 980A.tmp 3588 9887.tmp 4868 9913.tmp 4304 9971.tmp 764 9A0D.tmp 828 9A9A.tmp 4620 9B07.tmp 1640 9BA4.tmp 4452 9C21.tmp 4120 9C8E.tmp 2620 9D2A.tmp 3092 9DA7.tmp 1372 9E24.tmp 4832 9EA1.tmp 404 9F2E.tmp 784 9F9B.tmp 2212 A018.tmp 2660 A0C4.tmp 4180 A151.tmp 1300 A1DD.tmp 636 A25A.tmp 3452 A2C8.tmp 3416 A345.tmp 2588 A3C2.tmp 1360 A46E.tmp 4796 A4FA.tmp 3232 A568.tmp 732 A5F4.tmp 2608 A690.tmp 4344 A70D.tmp 4600 A78A.tmp 336 A807.tmp 3664 A8A4.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3164 wrote to memory of 4856 3164 1b0e636affe817dfe2bf9fc1ddf90f6c_mafia_JC.exe 81 PID 3164 wrote to memory of 4856 3164 1b0e636affe817dfe2bf9fc1ddf90f6c_mafia_JC.exe 81 PID 3164 wrote to memory of 4856 3164 1b0e636affe817dfe2bf9fc1ddf90f6c_mafia_JC.exe 81 PID 4856 wrote to memory of 2284 4856 808A.tmp 82 PID 4856 wrote to memory of 2284 4856 808A.tmp 82 PID 4856 wrote to memory of 2284 4856 808A.tmp 82 PID 2284 wrote to memory of 4220 2284 81A3.tmp 83 PID 2284 wrote to memory of 4220 2284 81A3.tmp 83 PID 2284 wrote to memory of 4220 2284 81A3.tmp 83 PID 4220 wrote to memory of 3480 4220 826E.tmp 84 PID 4220 wrote to memory of 3480 4220 826E.tmp 84 PID 4220 wrote to memory of 3480 4220 826E.tmp 84 PID 3480 wrote to memory of 1760 3480 8397.tmp 85 PID 3480 wrote to memory of 1760 3480 8397.tmp 85 PID 3480 wrote to memory of 1760 3480 8397.tmp 85 PID 1760 wrote to memory of 3352 1760 8424.tmp 86 PID 1760 wrote to memory of 3352 1760 8424.tmp 86 PID 1760 wrote to memory of 3352 1760 8424.tmp 86 PID 3352 wrote to memory of 2236 3352 84D0.tmp 87 PID 3352 wrote to memory of 2236 3352 84D0.tmp 87 PID 3352 wrote to memory of 2236 3352 84D0.tmp 87 PID 2236 wrote to memory of 1876 2236 856C.tmp 88 PID 2236 wrote to memory of 1876 2236 856C.tmp 88 PID 2236 wrote to memory of 1876 2236 856C.tmp 88 PID 1876 wrote to memory of 1076 1876 8666.tmp 90 PID 1876 wrote to memory of 1076 1876 8666.tmp 90 PID 1876 wrote to memory of 1076 1876 8666.tmp 90 PID 1076 wrote to memory of 1636 1076 8702.tmp 91 PID 1076 wrote to memory of 1636 1076 8702.tmp 91 PID 1076 wrote to memory of 1636 1076 8702.tmp 91 PID 1636 wrote to memory of 1928 1636 879F.tmp 92 PID 1636 wrote to memory of 1928 1636 879F.tmp 92 PID 1636 wrote to memory of 1928 1636 879F.tmp 92 PID 1928 wrote to memory of 2576 1928 884A.tmp 93 PID 1928 wrote to memory of 2576 1928 884A.tmp 93 PID 1928 wrote to memory of 2576 1928 884A.tmp 93 PID 2576 wrote to memory of 2108 2576 88F6.tmp 94 PID 2576 wrote to memory of 2108 2576 88F6.tmp 94 PID 2576 wrote to memory of 2108 2576 88F6.tmp 94 PID 2108 wrote to memory of 4720 2108 89A2.tmp 95 PID 2108 wrote to memory of 4720 2108 89A2.tmp 95 PID 2108 wrote to memory of 4720 2108 89A2.tmp 95 PID 4720 wrote to memory of 4156 4720 8B67.tmp 96 PID 4720 wrote to memory of 4156 4720 8B67.tmp 96 PID 4720 wrote to memory of 4156 4720 8B67.tmp 96 PID 4156 wrote to memory of 1148 4156 8C13.tmp 97 PID 4156 wrote to memory of 1148 4156 8C13.tmp 97 PID 4156 wrote to memory of 1148 4156 8C13.tmp 97 PID 1148 wrote to memory of 312 1148 8CEE.tmp 98 PID 1148 wrote to memory of 312 1148 8CEE.tmp 98 PID 1148 wrote to memory of 312 1148 8CEE.tmp 98 PID 312 wrote to memory of 228 312 8D7B.tmp 99 PID 312 wrote to memory of 228 312 8D7B.tmp 99 PID 312 wrote to memory of 228 312 8D7B.tmp 99 PID 228 wrote to memory of 2224 228 8E36.tmp 102 PID 228 wrote to memory of 2224 228 8E36.tmp 102 PID 228 wrote to memory of 2224 228 8E36.tmp 102 PID 2224 wrote to memory of 3240 2224 8EF2.tmp 103 PID 2224 wrote to memory of 3240 2224 8EF2.tmp 103 PID 2224 wrote to memory of 3240 2224 8EF2.tmp 103 PID 3240 wrote to memory of 2004 3240 8F8E.tmp 104 PID 3240 wrote to memory of 2004 3240 8F8E.tmp 104 PID 3240 wrote to memory of 2004 3240 8F8E.tmp 104 PID 2004 wrote to memory of 4084 2004 9059.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b0e636affe817dfe2bf9fc1ddf90f6c_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\1b0e636affe817dfe2bf9fc1ddf90f6c_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\808A.tmp"C:\Users\Admin\AppData\Local\Temp\808A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\81A3.tmp"C:\Users\Admin\AppData\Local\Temp\81A3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\8424.tmp"C:\Users\Admin\AppData\Local\Temp\8424.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\84D0.tmp"C:\Users\Admin\AppData\Local\Temp\84D0.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\856C.tmp"C:\Users\Admin\AppData\Local\Temp\856C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\8666.tmp"C:\Users\Admin\AppData\Local\Temp\8666.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\8702.tmp"C:\Users\Admin\AppData\Local\Temp\8702.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\879F.tmp"C:\Users\Admin\AppData\Local\Temp\879F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\88F6.tmp"C:\Users\Admin\AppData\Local\Temp\88F6.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\89A2.tmp"C:\Users\Admin\AppData\Local\Temp\89A2.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\8B67.tmp"C:\Users\Admin\AppData\Local\Temp\8B67.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\8C13.tmp"C:\Users\Admin\AppData\Local\Temp\8C13.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312 -
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\9114.tmp"C:\Users\Admin\AppData\Local\Temp\9114.tmp"23⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\91D0.tmp"C:\Users\Admin\AppData\Local\Temp\91D0.tmp"24⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\924D.tmp"C:\Users\Admin\AppData\Local\Temp\924D.tmp"25⤵
- Executes dropped EXE
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"26⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\9385.tmp"C:\Users\Admin\AppData\Local\Temp\9385.tmp"27⤵
- Executes dropped EXE
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\9441.tmp"C:\Users\Admin\AppData\Local\Temp\9441.tmp"28⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\94AE.tmp"C:\Users\Admin\AppData\Local\Temp\94AE.tmp"29⤵
- Executes dropped EXE
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"30⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\95E7.tmp"C:\Users\Admin\AppData\Local\Temp\95E7.tmp"31⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\96C2.tmp"C:\Users\Admin\AppData\Local\Temp\96C2.tmp"32⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"33⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"34⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"35⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"36⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"37⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"38⤵
- Executes dropped EXE
PID:828 -
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"39⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"40⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\9C21.tmp"C:\Users\Admin\AppData\Local\Temp\9C21.tmp"41⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"42⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"43⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"44⤵
- Executes dropped EXE
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"45⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"46⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"47⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"48⤵
- Executes dropped EXE
PID:784 -
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"49⤵
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"50⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"51⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"52⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"53⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"54⤵
- Executes dropped EXE
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"55⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"56⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\A46E.tmp"C:\Users\Admin\AppData\Local\Temp\A46E.tmp"57⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"58⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"59⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"60⤵
- Executes dropped EXE
PID:732 -
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"61⤵
- Executes dropped EXE
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"62⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\A78A.tmp"C:\Users\Admin\AppData\Local\Temp\A78A.tmp"63⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"64⤵
- Executes dropped EXE
PID:336 -
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"65⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"66⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"67⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"68⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"69⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\AB53.tmp"C:\Users\Admin\AppData\Local\Temp\AB53.tmp"70⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"71⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"72⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"73⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\AD38.tmp"C:\Users\Admin\AppData\Local\Temp\AD38.tmp"74⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"75⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"76⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"77⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"78⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"79⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"80⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\B093.tmp"C:\Users\Admin\AppData\Local\Temp\B093.tmp"81⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\B100.tmp"C:\Users\Admin\AppData\Local\Temp\B100.tmp"82⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\B17D.tmp"C:\Users\Admin\AppData\Local\Temp\B17D.tmp"83⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"84⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"85⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"86⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\B342.tmp"C:\Users\Admin\AppData\Local\Temp\B342.tmp"87⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"88⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\B46B.tmp"C:\Users\Admin\AppData\Local\Temp\B46B.tmp"89⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"90⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\B546.tmp"C:\Users\Admin\AppData\Local\Temp\B546.tmp"91⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"92⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\B621.tmp"C:\Users\Admin\AppData\Local\Temp\B621.tmp"93⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"94⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\B73A.tmp"C:\Users\Admin\AppData\Local\Temp\B73A.tmp"95⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"96⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\B824.tmp"C:\Users\Admin\AppData\Local\Temp\B824.tmp"97⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\B882.tmp"C:\Users\Admin\AppData\Local\Temp\B882.tmp"98⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"99⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\B99B.tmp"C:\Users\Admin\AppData\Local\Temp\B99B.tmp"100⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\BA38.tmp"C:\Users\Admin\AppData\Local\Temp\BA38.tmp"101⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"102⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\BB41.tmp"C:\Users\Admin\AppData\Local\Temp\BB41.tmp"103⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"104⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"105⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"106⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\BD55.tmp"C:\Users\Admin\AppData\Local\Temp\BD55.tmp"107⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"108⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"109⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\BEEB.tmp"C:\Users\Admin\AppData\Local\Temp\BEEB.tmp"110⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\BF97.tmp"C:\Users\Admin\AppData\Local\Temp\BF97.tmp"111⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\C014.tmp"C:\Users\Admin\AppData\Local\Temp\C014.tmp"112⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\C091.tmp"C:\Users\Admin\AppData\Local\Temp\C091.tmp"113⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"114⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"115⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\C256.tmp"C:\Users\Admin\AppData\Local\Temp\C256.tmp"116⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"117⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\C37F.tmp"C:\Users\Admin\AppData\Local\Temp\C37F.tmp"118⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\C41B.tmp"C:\Users\Admin\AppData\Local\Temp\C41B.tmp"119⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\C515.tmp"C:\Users\Admin\AppData\Local\Temp\C515.tmp"120⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"121⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\C64D.tmp"C:\Users\Admin\AppData\Local\Temp\C64D.tmp"122⤵PID:1400
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-