Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
27/08/2023, 17:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b5d081147a0195acdb1e8165ee2809e6_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
b5d081147a0195acdb1e8165ee2809e6_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
b5d081147a0195acdb1e8165ee2809e6_mafia_JC.exe
-
Size
520KB
-
MD5
b5d081147a0195acdb1e8165ee2809e6
-
SHA1
4ec6cf1de605dc0dca9304a50897044ee2e9e85b
-
SHA256
e4a6b0cfcddcd4eab9a8d67e0d7aa8f53681cf0a0c7d0ab465169275655701a3
-
SHA512
692d8370b662a2f7e6bda0c2fb067922c2017ff836a6448904c8de6ab49f86eaa952f74ba26bb6400ace490aa49f77ab5d7074eefc9326d01d220f036a7e5b46
-
SSDEEP
12288:roRXOQjmOy1BkiA4q/tgIYeVkyxKJ+WNZ:rogQ9ym/KIYeVkyxKlN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4632 7DEA.tmp 4132 7EE4.tmp 4140 7FAF.tmp 1848 80B9.tmp 3908 8194.tmp 4124 827E.tmp 1036 8349.tmp 3892 8443.tmp 2340 854D.tmp 3972 8608.tmp 2512 8731.tmp 4012 87ED.tmp 1824 88A8.tmp 3020 8964.tmp 4200 89F0.tmp 3096 8AEA.tmp 5052 8BD5.tmp 1448 8C90.tmp 5068 8D7B.tmp 2252 8E75.tmp 1472 8F4F.tmp 3580 8FFB.tmp 4548 90C6.tmp 1120 9182.tmp 4180 925D.tmp 2284 9328.tmp 4988 93D4.tmp 4116 9451.tmp 1664 953B.tmp 3980 9635.tmp 3432 96D1.tmp 3448 9829.tmp 2172 98C5.tmp 3456 9961.tmp 5020 99EE.tmp 3428 9A8A.tmp 460 9B36.tmp 4072 9BC3.tmp 4784 9C6F.tmp 1228 9CFB.tmp 3360 9D98.tmp 4832 9E34.tmp 2808 9ED0.tmp 3772 9F7C.tmp 496 A028.tmp 3756 A0C4.tmp 1568 A141.tmp 2880 A1ED.tmp 4496 A27A.tmp 4796 A316.tmp 1624 A3A2.tmp 1740 A410.tmp 4472 A49C.tmp 3928 A539.tmp 2916 A5D5.tmp 3944 A681.tmp 4268 A72D.tmp 3348 A7B9.tmp 3892 A846.tmp 708 A8B3.tmp 2512 A930.tmp 3236 A99E.tmp 4836 AA1B.tmp 2116 AA78.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2776 wrote to memory of 4632 2776 b5d081147a0195acdb1e8165ee2809e6_mafia_JC.exe 82 PID 2776 wrote to memory of 4632 2776 b5d081147a0195acdb1e8165ee2809e6_mafia_JC.exe 82 PID 2776 wrote to memory of 4632 2776 b5d081147a0195acdb1e8165ee2809e6_mafia_JC.exe 82 PID 4632 wrote to memory of 4132 4632 7DEA.tmp 83 PID 4632 wrote to memory of 4132 4632 7DEA.tmp 83 PID 4632 wrote to memory of 4132 4632 7DEA.tmp 83 PID 4132 wrote to memory of 4140 4132 7EE4.tmp 84 PID 4132 wrote to memory of 4140 4132 7EE4.tmp 84 PID 4132 wrote to memory of 4140 4132 7EE4.tmp 84 PID 4140 wrote to memory of 1848 4140 7FAF.tmp 85 PID 4140 wrote to memory of 1848 4140 7FAF.tmp 85 PID 4140 wrote to memory of 1848 4140 7FAF.tmp 85 PID 1848 wrote to memory of 3908 1848 80B9.tmp 86 PID 1848 wrote to memory of 3908 1848 80B9.tmp 86 PID 1848 wrote to memory of 3908 1848 80B9.tmp 86 PID 3908 wrote to memory of 4124 3908 8194.tmp 87 PID 3908 wrote to memory of 4124 3908 8194.tmp 87 PID 3908 wrote to memory of 4124 3908 8194.tmp 87 PID 4124 wrote to memory of 1036 4124 827E.tmp 88 PID 4124 wrote to memory of 1036 4124 827E.tmp 88 PID 4124 wrote to memory of 1036 4124 827E.tmp 88 PID 1036 wrote to memory of 3892 1036 8349.tmp 89 PID 1036 wrote to memory of 3892 1036 8349.tmp 89 PID 1036 wrote to memory of 3892 1036 8349.tmp 89 PID 3892 wrote to memory of 2340 3892 8443.tmp 90 PID 3892 wrote to memory of 2340 3892 8443.tmp 90 PID 3892 wrote to memory of 2340 3892 8443.tmp 90 PID 2340 wrote to memory of 3972 2340 854D.tmp 91 PID 2340 wrote to memory of 3972 2340 854D.tmp 91 PID 2340 wrote to memory of 3972 2340 854D.tmp 91 PID 3972 wrote to memory of 2512 3972 8608.tmp 92 PID 3972 wrote to memory of 2512 3972 8608.tmp 92 PID 3972 wrote to memory of 2512 3972 8608.tmp 92 PID 2512 wrote to memory of 4012 2512 8731.tmp 93 PID 2512 wrote to memory of 4012 2512 8731.tmp 93 PID 2512 wrote to memory of 4012 2512 8731.tmp 93 PID 4012 wrote to memory of 1824 4012 87ED.tmp 94 PID 4012 wrote to memory of 1824 4012 87ED.tmp 94 PID 4012 wrote to memory of 1824 4012 87ED.tmp 94 PID 1824 wrote to memory of 3020 1824 88A8.tmp 95 PID 1824 wrote to memory of 3020 1824 88A8.tmp 95 PID 1824 wrote to memory of 3020 1824 88A8.tmp 95 PID 3020 wrote to memory of 4200 3020 8964.tmp 96 PID 3020 wrote to memory of 4200 3020 8964.tmp 96 PID 3020 wrote to memory of 4200 3020 8964.tmp 96 PID 4200 wrote to memory of 3096 4200 89F0.tmp 97 PID 4200 wrote to memory of 3096 4200 89F0.tmp 97 PID 4200 wrote to memory of 3096 4200 89F0.tmp 97 PID 3096 wrote to memory of 5052 3096 8AEA.tmp 100 PID 3096 wrote to memory of 5052 3096 8AEA.tmp 100 PID 3096 wrote to memory of 5052 3096 8AEA.tmp 100 PID 5052 wrote to memory of 1448 5052 8BD5.tmp 101 PID 5052 wrote to memory of 1448 5052 8BD5.tmp 101 PID 5052 wrote to memory of 1448 5052 8BD5.tmp 101 PID 1448 wrote to memory of 5068 1448 8C90.tmp 102 PID 1448 wrote to memory of 5068 1448 8C90.tmp 102 PID 1448 wrote to memory of 5068 1448 8C90.tmp 102 PID 5068 wrote to memory of 2252 5068 8D7B.tmp 103 PID 5068 wrote to memory of 2252 5068 8D7B.tmp 103 PID 5068 wrote to memory of 2252 5068 8D7B.tmp 103 PID 2252 wrote to memory of 1472 2252 8E75.tmp 104 PID 2252 wrote to memory of 1472 2252 8E75.tmp 104 PID 2252 wrote to memory of 1472 2252 8E75.tmp 104 PID 1472 wrote to memory of 3580 1472 8F4F.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5d081147a0195acdb1e8165ee2809e6_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\b5d081147a0195acdb1e8165ee2809e6_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\80B9.tmp"C:\Users\Admin\AppData\Local\Temp\80B9.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\8194.tmp"C:\Users\Admin\AppData\Local\Temp\8194.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\827E.tmp"C:\Users\Admin\AppData\Local\Temp\827E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\8349.tmp"C:\Users\Admin\AppData\Local\Temp\8349.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\854D.tmp"C:\Users\Admin\AppData\Local\Temp\854D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\8608.tmp"C:\Users\Admin\AppData\Local\Temp\8608.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\8731.tmp"C:\Users\Admin\AppData\Local\Temp\8731.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\88A8.tmp"C:\Users\Admin\AppData\Local\Temp\88A8.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\8964.tmp"C:\Users\Admin\AppData\Local\Temp\8964.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\89F0.tmp"C:\Users\Admin\AppData\Local\Temp\89F0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\8E75.tmp"C:\Users\Admin\AppData\Local\Temp\8E75.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"23⤵
- Executes dropped EXE
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"24⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\9182.tmp"C:\Users\Admin\AppData\Local\Temp\9182.tmp"25⤵
- Executes dropped EXE
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"26⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\9328.tmp"C:\Users\Admin\AppData\Local\Temp\9328.tmp"27⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"28⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\9451.tmp"C:\Users\Admin\AppData\Local\Temp\9451.tmp"29⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"30⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"31⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\96D1.tmp"C:\Users\Admin\AppData\Local\Temp\96D1.tmp"32⤵
- Executes dropped EXE
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"33⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\98C5.tmp"C:\Users\Admin\AppData\Local\Temp\98C5.tmp"34⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"35⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\99EE.tmp"C:\Users\Admin\AppData\Local\Temp\99EE.tmp"36⤵
- Executes dropped EXE
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"37⤵
- Executes dropped EXE
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"38⤵
- Executes dropped EXE
PID:460 -
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"39⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"40⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"41⤵
- Executes dropped EXE
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"42⤵
- Executes dropped EXE
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"43⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"44⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"45⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\A028.tmp"C:\Users\Admin\AppData\Local\Temp\A028.tmp"46⤵
- Executes dropped EXE
PID:496 -
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"47⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\A141.tmp"C:\Users\Admin\AppData\Local\Temp\A141.tmp"48⤵
- Executes dropped EXE
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"49⤵
- Executes dropped EXE
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"50⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"51⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"52⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\A410.tmp"C:\Users\Admin\AppData\Local\Temp\A410.tmp"53⤵
- Executes dropped EXE
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"54⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\A539.tmp"C:\Users\Admin\AppData\Local\Temp\A539.tmp"55⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"56⤵
- Executes dropped EXE
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"57⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"58⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"59⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"60⤵
- Executes dropped EXE
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"61⤵
- Executes dropped EXE
PID:708 -
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"62⤵
- Executes dropped EXE
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\A99E.tmp"C:\Users\Admin\AppData\Local\Temp\A99E.tmp"63⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"64⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"65⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"66⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\AB53.tmp"C:\Users\Admin\AppData\Local\Temp\AB53.tmp"67⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"68⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"69⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"70⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\AD95.tmp"C:\Users\Admin\AppData\Local\Temp\AD95.tmp"71⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"72⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"73⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"74⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"75⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\B045.tmp"C:\Users\Admin\AppData\Local\Temp\B045.tmp"76⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"77⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\B110.tmp"C:\Users\Admin\AppData\Local\Temp\B110.tmp"78⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"79⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\B229.tmp"C:\Users\Admin\AppData\Local\Temp\B229.tmp"80⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"81⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\B352.tmp"C:\Users\Admin\AppData\Local\Temp\B352.tmp"82⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"83⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\B48B.tmp"C:\Users\Admin\AppData\Local\Temp\B48B.tmp"84⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\B508.tmp"C:\Users\Admin\AppData\Local\Temp\B508.tmp"85⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\B575.tmp"C:\Users\Admin\AppData\Local\Temp\B575.tmp"86⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"87⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\B640.tmp"C:\Users\Admin\AppData\Local\Temp\B640.tmp"88⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\B69E.tmp"C:\Users\Admin\AppData\Local\Temp\B69E.tmp"89⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\B71B.tmp"C:\Users\Admin\AppData\Local\Temp\B71B.tmp"90⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"91⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\B824.tmp"C:\Users\Admin\AppData\Local\Temp\B824.tmp"92⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"93⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\B91E.tmp"C:\Users\Admin\AppData\Local\Temp\B91E.tmp"94⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"95⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\BA47.tmp"C:\Users\Admin\AppData\Local\Temp\BA47.tmp"96⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"97⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\BB70.tmp"C:\Users\Admin\AppData\Local\Temp\BB70.tmp"98⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\BBED.tmp"C:\Users\Admin\AppData\Local\Temp\BBED.tmp"99⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\BC99.tmp"C:\Users\Admin\AppData\Local\Temp\BC99.tmp"100⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\BD16.tmp"C:\Users\Admin\AppData\Local\Temp\BD16.tmp"101⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"102⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"103⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"104⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\BF58.tmp"C:\Users\Admin\AppData\Local\Temp\BF58.tmp"105⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"106⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\C062.tmp"C:\Users\Admin\AppData\Local\Temp\C062.tmp"107⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\C10E.tmp"C:\Users\Admin\AppData\Local\Temp\C10E.tmp"108⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\C256.tmp"C:\Users\Admin\AppData\Local\Temp\C256.tmp"109⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"110⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\C39E.tmp"C:\Users\Admin\AppData\Local\Temp\C39E.tmp"111⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\C41B.tmp"C:\Users\Admin\AppData\Local\Temp\C41B.tmp"112⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"113⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\C553.tmp"C:\Users\Admin\AppData\Local\Temp\C553.tmp"114⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\C5F0.tmp"C:\Users\Admin\AppData\Local\Temp\C5F0.tmp"115⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\C68C.tmp"C:\Users\Admin\AppData\Local\Temp\C68C.tmp"116⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\C709.tmp"C:\Users\Admin\AppData\Local\Temp\C709.tmp"117⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\C776.tmp"C:\Users\Admin\AppData\Local\Temp\C776.tmp"118⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"119⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\C89F.tmp"C:\Users\Admin\AppData\Local\Temp\C89F.tmp"120⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\C93B.tmp"C:\Users\Admin\AppData\Local\Temp\C93B.tmp"121⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\C9D8.tmp"C:\Users\Admin\AppData\Local\Temp\C9D8.tmp"122⤵PID:5100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-