Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
27/08/2023, 17:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b4626314cdc823c5c0ea8053b5e65f90_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
b4626314cdc823c5c0ea8053b5e65f90_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
b4626314cdc823c5c0ea8053b5e65f90_mafia_JC.exe
-
Size
520KB
-
MD5
b4626314cdc823c5c0ea8053b5e65f90
-
SHA1
cadeeea4260a28290fb31c48daf66a7df239a88e
-
SHA256
20c904fe89085e99750028edbcbe3a6d93590ceee329aa6e77374b610f745ef0
-
SHA512
1b1d1cb2965706016f446894f69d403744c0ba35b9617472a5d6d5ba2ebc6dc6efbbcfc7acd1365bae8350abcf96a5a9cbe13e65f0d84228f4d6e11faa3d8346
-
SSDEEP
12288:roRXOQjmOy2htGngNu+29Cq8KCBSKTCwFNZ:rogQ9y2u+29Cq9CBSzkN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2120 71F4.tmp 2072 72CE.tmp 3156 738A.tmp 1740 7474.tmp 1260 753F.tmp 4528 7639.tmp 216 7714.tmp 2648 77C0.tmp 992 78CA.tmp 4204 79A4.tmp 5084 7ABE.tmp 240 7B89.tmp 3836 7C92.tmp 4944 7D5E.tmp 644 7E58.tmp 4824 7F23.tmp 4144 80D8.tmp 3664 81C3.tmp 3548 82CC.tmp 4664 83C6.tmp 4820 84C0.tmp 4232 858B.tmp 3368 8637.tmp 2740 8731.tmp 4380 87FC.tmp 4476 88F6.tmp 1608 8993.tmp 948 8A3E.tmp 5036 8B19.tmp 3004 8BB5.tmp 3460 8C90.tmp 4296 8D4C.tmp 4404 8E36.tmp 812 8EA3.tmp 3808 8F40.tmp 3896 8FDC.tmp 1388 9069.tmp 1644 90E6.tmp 1764 9191.tmp 2640 920E.tmp 4332 929B.tmp 4344 9337.tmp 3028 9422.tmp 784 94CE.tmp 2352 956A.tmp 4116 9606.tmp 472 96A2.tmp 1932 971F.tmp 4728 97AC.tmp 3328 9858.tmp 5024 98E4.tmp 3508 9961.tmp 2276 99EE.tmp 4220 9A7B.tmp 4608 9B07.tmp 4776 9B94.tmp 1212 9C21.tmp 3084 9CAD.tmp 5088 9D3A.tmp 3464 9DA7.tmp 1840 9E43.tmp 1304 9EC0.tmp 4132 9F6C.tmp 1128 A009.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3116 wrote to memory of 2120 3116 b4626314cdc823c5c0ea8053b5e65f90_mafia_JC.exe 81 PID 3116 wrote to memory of 2120 3116 b4626314cdc823c5c0ea8053b5e65f90_mafia_JC.exe 81 PID 3116 wrote to memory of 2120 3116 b4626314cdc823c5c0ea8053b5e65f90_mafia_JC.exe 81 PID 2120 wrote to memory of 2072 2120 71F4.tmp 82 PID 2120 wrote to memory of 2072 2120 71F4.tmp 82 PID 2120 wrote to memory of 2072 2120 71F4.tmp 82 PID 2072 wrote to memory of 3156 2072 72CE.tmp 83 PID 2072 wrote to memory of 3156 2072 72CE.tmp 83 PID 2072 wrote to memory of 3156 2072 72CE.tmp 83 PID 3156 wrote to memory of 1740 3156 738A.tmp 84 PID 3156 wrote to memory of 1740 3156 738A.tmp 84 PID 3156 wrote to memory of 1740 3156 738A.tmp 84 PID 1740 wrote to memory of 1260 1740 7474.tmp 85 PID 1740 wrote to memory of 1260 1740 7474.tmp 85 PID 1740 wrote to memory of 1260 1740 7474.tmp 85 PID 1260 wrote to memory of 4528 1260 753F.tmp 86 PID 1260 wrote to memory of 4528 1260 753F.tmp 86 PID 1260 wrote to memory of 4528 1260 753F.tmp 86 PID 4528 wrote to memory of 216 4528 7639.tmp 87 PID 4528 wrote to memory of 216 4528 7639.tmp 87 PID 4528 wrote to memory of 216 4528 7639.tmp 87 PID 216 wrote to memory of 2648 216 7714.tmp 88 PID 216 wrote to memory of 2648 216 7714.tmp 88 PID 216 wrote to memory of 2648 216 7714.tmp 88 PID 2648 wrote to memory of 992 2648 77C0.tmp 89 PID 2648 wrote to memory of 992 2648 77C0.tmp 89 PID 2648 wrote to memory of 992 2648 77C0.tmp 89 PID 992 wrote to memory of 4204 992 78CA.tmp 90 PID 992 wrote to memory of 4204 992 78CA.tmp 90 PID 992 wrote to memory of 4204 992 78CA.tmp 90 PID 4204 wrote to memory of 5084 4204 79A4.tmp 91 PID 4204 wrote to memory of 5084 4204 79A4.tmp 91 PID 4204 wrote to memory of 5084 4204 79A4.tmp 91 PID 5084 wrote to memory of 240 5084 7ABE.tmp 92 PID 5084 wrote to memory of 240 5084 7ABE.tmp 92 PID 5084 wrote to memory of 240 5084 7ABE.tmp 92 PID 240 wrote to memory of 3836 240 7B89.tmp 93 PID 240 wrote to memory of 3836 240 7B89.tmp 93 PID 240 wrote to memory of 3836 240 7B89.tmp 93 PID 3836 wrote to memory of 4944 3836 7C92.tmp 94 PID 3836 wrote to memory of 4944 3836 7C92.tmp 94 PID 3836 wrote to memory of 4944 3836 7C92.tmp 94 PID 4944 wrote to memory of 644 4944 7D5E.tmp 95 PID 4944 wrote to memory of 644 4944 7D5E.tmp 95 PID 4944 wrote to memory of 644 4944 7D5E.tmp 95 PID 644 wrote to memory of 4824 644 7E58.tmp 96 PID 644 wrote to memory of 4824 644 7E58.tmp 96 PID 644 wrote to memory of 4824 644 7E58.tmp 96 PID 4824 wrote to memory of 4144 4824 7F23.tmp 97 PID 4824 wrote to memory of 4144 4824 7F23.tmp 97 PID 4824 wrote to memory of 4144 4824 7F23.tmp 97 PID 4144 wrote to memory of 3664 4144 80D8.tmp 98 PID 4144 wrote to memory of 3664 4144 80D8.tmp 98 PID 4144 wrote to memory of 3664 4144 80D8.tmp 98 PID 3664 wrote to memory of 3548 3664 81C3.tmp 99 PID 3664 wrote to memory of 3548 3664 81C3.tmp 99 PID 3664 wrote to memory of 3548 3664 81C3.tmp 99 PID 3548 wrote to memory of 4664 3548 82CC.tmp 100 PID 3548 wrote to memory of 4664 3548 82CC.tmp 100 PID 3548 wrote to memory of 4664 3548 82CC.tmp 100 PID 4664 wrote to memory of 4820 4664 83C6.tmp 101 PID 4664 wrote to memory of 4820 4664 83C6.tmp 101 PID 4664 wrote to memory of 4820 4664 83C6.tmp 101 PID 4820 wrote to memory of 4232 4820 84C0.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4626314cdc823c5c0ea8053b5e65f90_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\b4626314cdc823c5c0ea8053b5e65f90_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\7714.tmp"C:\Users\Admin\AppData\Local\Temp\7714.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\79A4.tmp"C:\Users\Admin\AppData\Local\Temp\79A4.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\7B89.tmp"C:\Users\Admin\AppData\Local\Temp\7B89.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Users\Admin\AppData\Local\Temp\7C92.tmp"C:\Users\Admin\AppData\Local\Temp\7C92.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\7F23.tmp"C:\Users\Admin\AppData\Local\Temp\7F23.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\80D8.tmp"C:\Users\Admin\AppData\Local\Temp\80D8.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\81C3.tmp"C:\Users\Admin\AppData\Local\Temp\81C3.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\83C6.tmp"C:\Users\Admin\AppData\Local\Temp\83C6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\84C0.tmp"C:\Users\Admin\AppData\Local\Temp\84C0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\858B.tmp"C:\Users\Admin\AppData\Local\Temp\858B.tmp"23⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\8637.tmp"C:\Users\Admin\AppData\Local\Temp\8637.tmp"24⤵
- Executes dropped EXE
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\8731.tmp"C:\Users\Admin\AppData\Local\Temp\8731.tmp"25⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\87FC.tmp"C:\Users\Admin\AppData\Local\Temp\87FC.tmp"26⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\88F6.tmp"C:\Users\Admin\AppData\Local\Temp\88F6.tmp"27⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\8993.tmp"C:\Users\Admin\AppData\Local\Temp\8993.tmp"28⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"29⤵
- Executes dropped EXE
PID:948 -
C:\Users\Admin\AppData\Local\Temp\8B19.tmp"C:\Users\Admin\AppData\Local\Temp\8B19.tmp"30⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"31⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"32⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"33⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp"34⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"35⤵
- Executes dropped EXE
PID:812 -
C:\Users\Admin\AppData\Local\Temp\8F40.tmp"C:\Users\Admin\AppData\Local\Temp\8F40.tmp"36⤵
- Executes dropped EXE
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"37⤵
- Executes dropped EXE
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"38⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\90E6.tmp"C:\Users\Admin\AppData\Local\Temp\90E6.tmp"39⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\9191.tmp"C:\Users\Admin\AppData\Local\Temp\9191.tmp"40⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"41⤵
- Executes dropped EXE
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\929B.tmp"C:\Users\Admin\AppData\Local\Temp\929B.tmp"42⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\9337.tmp"C:\Users\Admin\AppData\Local\Temp\9337.tmp"43⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\9422.tmp"C:\Users\Admin\AppData\Local\Temp\9422.tmp"44⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\94CE.tmp"C:\Users\Admin\AppData\Local\Temp\94CE.tmp"45⤵
- Executes dropped EXE
PID:784 -
C:\Users\Admin\AppData\Local\Temp\956A.tmp"C:\Users\Admin\AppData\Local\Temp\956A.tmp"46⤵
- Executes dropped EXE
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\9606.tmp"C:\Users\Admin\AppData\Local\Temp\9606.tmp"47⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"48⤵
- Executes dropped EXE
PID:472 -
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"49⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"50⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"51⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\98E4.tmp"C:\Users\Admin\AppData\Local\Temp\98E4.tmp"52⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"53⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\99EE.tmp"C:\Users\Admin\AppData\Local\Temp\99EE.tmp"54⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"55⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"56⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"57⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\9C21.tmp"C:\Users\Admin\AppData\Local\Temp\9C21.tmp"58⤵
- Executes dropped EXE
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"59⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"60⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"61⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"62⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"63⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"64⤵
- Executes dropped EXE
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"65⤵
- Executes dropped EXE
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\A095.tmp"C:\Users\Admin\AppData\Local\Temp\A095.tmp"66⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"67⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\A180.tmp"C:\Users\Admin\AppData\Local\Temp\A180.tmp"68⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"69⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\A26A.tmp"C:\Users\Admin\AppData\Local\Temp\A26A.tmp"70⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"71⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"72⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"73⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"74⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"75⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"76⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\A613.tmp"C:\Users\Admin\AppData\Local\Temp\A613.tmp"77⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"78⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"79⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"80⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"81⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"82⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"83⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"84⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"85⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"86⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"87⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\AB92.tmp"C:\Users\Admin\AppData\Local\Temp\AB92.tmp"88⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"89⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"90⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"91⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"92⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"93⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"94⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"95⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\AF99.tmp"C:\Users\Admin\AppData\Local\Temp\AF99.tmp"96⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\B006.tmp"C:\Users\Admin\AppData\Local\Temp\B006.tmp"97⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\B093.tmp"C:\Users\Admin\AppData\Local\Temp\B093.tmp"98⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\B100.tmp"C:\Users\Admin\AppData\Local\Temp\B100.tmp"99⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"100⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"101⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"102⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"103⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\B371.tmp"C:\Users\Admin\AppData\Local\Temp\B371.tmp"104⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"105⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\B47B.tmp"C:\Users\Admin\AppData\Local\Temp\B47B.tmp"106⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"107⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\B594.tmp"C:\Users\Admin\AppData\Local\Temp\B594.tmp"108⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\B602.tmp"C:\Users\Admin\AppData\Local\Temp\B602.tmp"109⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\B68E.tmp"C:\Users\Admin\AppData\Local\Temp\B68E.tmp"110⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\B72A.tmp"C:\Users\Admin\AppData\Local\Temp\B72A.tmp"111⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"112⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\B844.tmp"C:\Users\Admin\AppData\Local\Temp\B844.tmp"113⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"114⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\B94D.tmp"C:\Users\Admin\AppData\Local\Temp\B94D.tmp"115⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"116⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\BA38.tmp"C:\Users\Admin\AppData\Local\Temp\BA38.tmp"117⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"118⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\BB41.tmp"C:\Users\Admin\AppData\Local\Temp\BB41.tmp"119⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"120⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"121⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\BD06.tmp"C:\Users\Admin\AppData\Local\Temp\BD06.tmp"122⤵PID:3328
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-