Analysis
-
max time kernel
151s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
06/08/2023, 11:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8669f27bb6d9fa0170886d98ed9c632d_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
8669f27bb6d9fa0170886d98ed9c632d_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
8669f27bb6d9fa0170886d98ed9c632d_mafia_JC.exe
-
Size
486KB
-
MD5
8669f27bb6d9fa0170886d98ed9c632d
-
SHA1
1a8a2db640a7a33a1461edab5c0906e5ac555100
-
SHA256
9552bebbedc02a3e7a785563bb860b12b4c3a6873a5fb3d49bec6afda02ce1fe
-
SHA512
107a81c914f314c32eb69efa8ae0a4ec3d502fc244fa99427ca7cdcefb7f9165c765e01de5f66f0984e93fd9c6afd143ed96ab7fa79d1267099ddd7f2020e753
-
SSDEEP
12288:UU5rCOTeiD7F/ZjqFL64DOgqXMjj7LzNZ:UUQOJD7FxqF2fgXjjjN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5024 E81E.tmp 3968 E975.tmp 1192 EA41.tmp 1656 EB2B.tmp 3984 EC25.tmp 3672 ECE0.tmp 5092 ED9C.tmp 2484 F731.tmp 3052 F8E7.tmp 3684 F973.tmp 3128 FA8C.tmp 4828 FB77.tmp 4932 FC23.tmp 4024 FCFD.tmp 552 FDA9.tmp 4304 FE74.tmp 460 FF6E.tmp 1936 49.tmp 4704 105.tmp 5100 1EF.tmp 3556 2F9.tmp 3628 395.tmp 756 460.tmp 3928 4ED.tmp 644 599.tmp 3564 683.tmp 1528 73E.tmp 3076 7CB.tmp 1096 8A6.tmp 1744 961.tmp 2868 9EE.tmp 4472 AA9.tmp 4164 B84.tmp 2172 C01.tmp 2388 C7E.tmp 4816 CFB.tmp 4804 D97.tmp 4992 E24.tmp 3660 EE0.tmp 5004 FCA.tmp 3904 1095.tmp 4404 1160.tmp 2808 11DD.tmp 4152 12A8.tmp 3516 1335.tmp 2572 147D.tmp 2132 1539.tmp 3688 15D5.tmp 2320 16A0.tmp 1052 175B.tmp 404 17D8.tmp 380 1894.tmp 1656 1921.tmp 2284 19AD.tmp 2424 1A1B.tmp 1424 1A98.tmp 2684 1B34.tmp 4820 1BA1.tmp 2344 1C2E.tmp 3620 1CBA.tmp 5076 1D66.tmp 4448 1DD4.tmp 4664 1E41.tmp 4012 1ECE.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1824 wrote to memory of 5024 1824 8669f27bb6d9fa0170886d98ed9c632d_mafia_JC.exe 84 PID 1824 wrote to memory of 5024 1824 8669f27bb6d9fa0170886d98ed9c632d_mafia_JC.exe 84 PID 1824 wrote to memory of 5024 1824 8669f27bb6d9fa0170886d98ed9c632d_mafia_JC.exe 84 PID 5024 wrote to memory of 3968 5024 E81E.tmp 85 PID 5024 wrote to memory of 3968 5024 E81E.tmp 85 PID 5024 wrote to memory of 3968 5024 E81E.tmp 85 PID 3968 wrote to memory of 1192 3968 E975.tmp 86 PID 3968 wrote to memory of 1192 3968 E975.tmp 86 PID 3968 wrote to memory of 1192 3968 E975.tmp 86 PID 1192 wrote to memory of 1656 1192 EA41.tmp 87 PID 1192 wrote to memory of 1656 1192 EA41.tmp 87 PID 1192 wrote to memory of 1656 1192 EA41.tmp 87 PID 1656 wrote to memory of 3984 1656 EB2B.tmp 88 PID 1656 wrote to memory of 3984 1656 EB2B.tmp 88 PID 1656 wrote to memory of 3984 1656 EB2B.tmp 88 PID 3984 wrote to memory of 3672 3984 EC25.tmp 89 PID 3984 wrote to memory of 3672 3984 EC25.tmp 89 PID 3984 wrote to memory of 3672 3984 EC25.tmp 89 PID 3672 wrote to memory of 5092 3672 ECE0.tmp 90 PID 3672 wrote to memory of 5092 3672 ECE0.tmp 90 PID 3672 wrote to memory of 5092 3672 ECE0.tmp 90 PID 5092 wrote to memory of 2484 5092 ED9C.tmp 91 PID 5092 wrote to memory of 2484 5092 ED9C.tmp 91 PID 5092 wrote to memory of 2484 5092 ED9C.tmp 91 PID 2484 wrote to memory of 3052 2484 F731.tmp 92 PID 2484 wrote to memory of 3052 2484 F731.tmp 92 PID 2484 wrote to memory of 3052 2484 F731.tmp 92 PID 3052 wrote to memory of 3684 3052 F8E7.tmp 93 PID 3052 wrote to memory of 3684 3052 F8E7.tmp 93 PID 3052 wrote to memory of 3684 3052 F8E7.tmp 93 PID 3684 wrote to memory of 3128 3684 F973.tmp 94 PID 3684 wrote to memory of 3128 3684 F973.tmp 94 PID 3684 wrote to memory of 3128 3684 F973.tmp 94 PID 3128 wrote to memory of 4828 3128 FA8C.tmp 95 PID 3128 wrote to memory of 4828 3128 FA8C.tmp 95 PID 3128 wrote to memory of 4828 3128 FA8C.tmp 95 PID 4828 wrote to memory of 4932 4828 FB77.tmp 96 PID 4828 wrote to memory of 4932 4828 FB77.tmp 96 PID 4828 wrote to memory of 4932 4828 FB77.tmp 96 PID 4932 wrote to memory of 4024 4932 FC23.tmp 97 PID 4932 wrote to memory of 4024 4932 FC23.tmp 97 PID 4932 wrote to memory of 4024 4932 FC23.tmp 97 PID 4024 wrote to memory of 552 4024 FCFD.tmp 98 PID 4024 wrote to memory of 552 4024 FCFD.tmp 98 PID 4024 wrote to memory of 552 4024 FCFD.tmp 98 PID 552 wrote to memory of 4304 552 FDA9.tmp 99 PID 552 wrote to memory of 4304 552 FDA9.tmp 99 PID 552 wrote to memory of 4304 552 FDA9.tmp 99 PID 4304 wrote to memory of 460 4304 FE74.tmp 100 PID 4304 wrote to memory of 460 4304 FE74.tmp 100 PID 4304 wrote to memory of 460 4304 FE74.tmp 100 PID 460 wrote to memory of 1936 460 FF6E.tmp 101 PID 460 wrote to memory of 1936 460 FF6E.tmp 101 PID 460 wrote to memory of 1936 460 FF6E.tmp 101 PID 1936 wrote to memory of 4704 1936 49.tmp 102 PID 1936 wrote to memory of 4704 1936 49.tmp 102 PID 1936 wrote to memory of 4704 1936 49.tmp 102 PID 4704 wrote to memory of 5100 4704 105.tmp 103 PID 4704 wrote to memory of 5100 4704 105.tmp 103 PID 4704 wrote to memory of 5100 4704 105.tmp 103 PID 5100 wrote to memory of 3556 5100 1EF.tmp 104 PID 5100 wrote to memory of 3556 5100 1EF.tmp 104 PID 5100 wrote to memory of 3556 5100 1EF.tmp 104 PID 3556 wrote to memory of 3628 3556 2F9.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\8669f27bb6d9fa0170886d98ed9c632d_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\8669f27bb6d9fa0170886d98ed9c632d_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\E81E.tmp"C:\Users\Admin\AppData\Local\Temp\E81E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\E975.tmp"C:\Users\Admin\AppData\Local\Temp\E975.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\EA41.tmp"C:\Users\Admin\AppData\Local\Temp\EA41.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\EB2B.tmp"C:\Users\Admin\AppData\Local\Temp\EB2B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\EC25.tmp"C:\Users\Admin\AppData\Local\Temp\EC25.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\ECE0.tmp"C:\Users\Admin\AppData\Local\Temp\ECE0.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\ED9C.tmp"C:\Users\Admin\AppData\Local\Temp\ED9C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\F731.tmp"C:\Users\Admin\AppData\Local\Temp\F731.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\F973.tmp"C:\Users\Admin\AppData\Local\Temp\F973.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\FB77.tmp"C:\Users\Admin\AppData\Local\Temp\FB77.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\FC23.tmp"C:\Users\Admin\AppData\Local\Temp\FC23.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\FCFD.tmp"C:\Users\Admin\AppData\Local\Temp\FCFD.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\FE74.tmp"C:\Users\Admin\AppData\Local\Temp\FE74.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Users\Admin\AppData\Local\Temp\49.tmp"C:\Users\Admin\AppData\Local\Temp\49.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\105.tmp"C:\Users\Admin\AppData\Local\Temp\105.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\1EF.tmp"C:\Users\Admin\AppData\Local\Temp\1EF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\2F9.tmp"C:\Users\Admin\AppData\Local\Temp\2F9.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\395.tmp"C:\Users\Admin\AppData\Local\Temp\395.tmp"23⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\460.tmp"C:\Users\Admin\AppData\Local\Temp\460.tmp"24⤵
- Executes dropped EXE
PID:756 -
C:\Users\Admin\AppData\Local\Temp\4ED.tmp"C:\Users\Admin\AppData\Local\Temp\4ED.tmp"25⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\599.tmp"C:\Users\Admin\AppData\Local\Temp\599.tmp"26⤵
- Executes dropped EXE
PID:644 -
C:\Users\Admin\AppData\Local\Temp\683.tmp"C:\Users\Admin\AppData\Local\Temp\683.tmp"27⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\73E.tmp"C:\Users\Admin\AppData\Local\Temp\73E.tmp"28⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\7CB.tmp"C:\Users\Admin\AppData\Local\Temp\7CB.tmp"29⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\8A6.tmp"C:\Users\Admin\AppData\Local\Temp\8A6.tmp"30⤵
- Executes dropped EXE
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\961.tmp"C:\Users\Admin\AppData\Local\Temp\961.tmp"31⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\9EE.tmp"C:\Users\Admin\AppData\Local\Temp\9EE.tmp"32⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\AA9.tmp"C:\Users\Admin\AppData\Local\Temp\AA9.tmp"33⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\B84.tmp"C:\Users\Admin\AppData\Local\Temp\B84.tmp"34⤵
- Executes dropped EXE
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\C01.tmp"C:\Users\Admin\AppData\Local\Temp\C01.tmp"35⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\C7E.tmp"C:\Users\Admin\AppData\Local\Temp\C7E.tmp"36⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\CFB.tmp"C:\Users\Admin\AppData\Local\Temp\CFB.tmp"37⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\D97.tmp"C:\Users\Admin\AppData\Local\Temp\D97.tmp"38⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"39⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\EE0.tmp"C:\Users\Admin\AppData\Local\Temp\EE0.tmp"40⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\FCA.tmp"C:\Users\Admin\AppData\Local\Temp\FCA.tmp"41⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\1095.tmp"C:\Users\Admin\AppData\Local\Temp\1095.tmp"42⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\1160.tmp"C:\Users\Admin\AppData\Local\Temp\1160.tmp"43⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\11DD.tmp"C:\Users\Admin\AppData\Local\Temp\11DD.tmp"44⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\12A8.tmp"C:\Users\Admin\AppData\Local\Temp\12A8.tmp"45⤵
- Executes dropped EXE
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\1335.tmp"C:\Users\Admin\AppData\Local\Temp\1335.tmp"46⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\13E1.tmp"C:\Users\Admin\AppData\Local\Temp\13E1.tmp"47⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\147D.tmp"C:\Users\Admin\AppData\Local\Temp\147D.tmp"48⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\1539.tmp"C:\Users\Admin\AppData\Local\Temp\1539.tmp"49⤵
- Executes dropped EXE
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\15D5.tmp"C:\Users\Admin\AppData\Local\Temp\15D5.tmp"50⤵
- Executes dropped EXE
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\16A0.tmp"C:\Users\Admin\AppData\Local\Temp\16A0.tmp"51⤵
- Executes dropped EXE
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\175B.tmp"C:\Users\Admin\AppData\Local\Temp\175B.tmp"52⤵
- Executes dropped EXE
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\17D8.tmp"C:\Users\Admin\AppData\Local\Temp\17D8.tmp"53⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\1894.tmp"C:\Users\Admin\AppData\Local\Temp\1894.tmp"54⤵
- Executes dropped EXE
PID:380 -
C:\Users\Admin\AppData\Local\Temp\1921.tmp"C:\Users\Admin\AppData\Local\Temp\1921.tmp"55⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\19AD.tmp"C:\Users\Admin\AppData\Local\Temp\19AD.tmp"56⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"57⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\1A98.tmp"C:\Users\Admin\AppData\Local\Temp\1A98.tmp"58⤵
- Executes dropped EXE
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\1B34.tmp"C:\Users\Admin\AppData\Local\Temp\1B34.tmp"59⤵
- Executes dropped EXE
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"60⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\1C2E.tmp"C:\Users\Admin\AppData\Local\Temp\1C2E.tmp"61⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\1CBA.tmp"C:\Users\Admin\AppData\Local\Temp\1CBA.tmp"62⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\1D66.tmp"C:\Users\Admin\AppData\Local\Temp\1D66.tmp"63⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"64⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\1E41.tmp"C:\Users\Admin\AppData\Local\Temp\1E41.tmp"65⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\1ECE.tmp"C:\Users\Admin\AppData\Local\Temp\1ECE.tmp"66⤵
- Executes dropped EXE
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\1F5A.tmp"C:\Users\Admin\AppData\Local\Temp\1F5A.tmp"67⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"68⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\20C2.tmp"C:\Users\Admin\AppData\Local\Temp\20C2.tmp"69⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\213F.tmp"C:\Users\Admin\AppData\Local\Temp\213F.tmp"70⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\21BC.tmp"C:\Users\Admin\AppData\Local\Temp\21BC.tmp"71⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\2239.tmp"C:\Users\Admin\AppData\Local\Temp\2239.tmp"72⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\22D5.tmp"C:\Users\Admin\AppData\Local\Temp\22D5.tmp"73⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\2371.tmp"C:\Users\Admin\AppData\Local\Temp\2371.tmp"74⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\23DF.tmp"C:\Users\Admin\AppData\Local\Temp\23DF.tmp"75⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\246B.tmp"C:\Users\Admin\AppData\Local\Temp\246B.tmp"76⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\24E8.tmp"C:\Users\Admin\AppData\Local\Temp\24E8.tmp"77⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\25D3.tmp"C:\Users\Admin\AppData\Local\Temp\25D3.tmp"78⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\2650.tmp"C:\Users\Admin\AppData\Local\Temp\2650.tmp"79⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\26DC.tmp"C:\Users\Admin\AppData\Local\Temp\26DC.tmp"80⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\2759.tmp"C:\Users\Admin\AppData\Local\Temp\2759.tmp"81⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\27F5.tmp"C:\Users\Admin\AppData\Local\Temp\27F5.tmp"82⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\2882.tmp"C:\Users\Admin\AppData\Local\Temp\2882.tmp"83⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\290F.tmp"C:\Users\Admin\AppData\Local\Temp\290F.tmp"84⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\298C.tmp"C:\Users\Admin\AppData\Local\Temp\298C.tmp"85⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\2A18.tmp"C:\Users\Admin\AppData\Local\Temp\2A18.tmp"86⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\2A95.tmp"C:\Users\Admin\AppData\Local\Temp\2A95.tmp"87⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\2B22.tmp"C:\Users\Admin\AppData\Local\Temp\2B22.tmp"88⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\2BAF.tmp"C:\Users\Admin\AppData\Local\Temp\2BAF.tmp"89⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\2C1C.tmp"C:\Users\Admin\AppData\Local\Temp\2C1C.tmp"90⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\2C99.tmp"C:\Users\Admin\AppData\Local\Temp\2C99.tmp"91⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\2D06.tmp"C:\Users\Admin\AppData\Local\Temp\2D06.tmp"92⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\2D83.tmp"C:\Users\Admin\AppData\Local\Temp\2D83.tmp"93⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\2E00.tmp"C:\Users\Admin\AppData\Local\Temp\2E00.tmp"94⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\2E6E.tmp"C:\Users\Admin\AppData\Local\Temp\2E6E.tmp"95⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\2EFA.tmp"C:\Users\Admin\AppData\Local\Temp\2EFA.tmp"96⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\2F87.tmp"C:\Users\Admin\AppData\Local\Temp\2F87.tmp"97⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\3014.tmp"C:\Users\Admin\AppData\Local\Temp\3014.tmp"98⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\30B0.tmp"C:\Users\Admin\AppData\Local\Temp\30B0.tmp"99⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\312D.tmp"C:\Users\Admin\AppData\Local\Temp\312D.tmp"100⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\31AA.tmp"C:\Users\Admin\AppData\Local\Temp\31AA.tmp"101⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\3227.tmp"C:\Users\Admin\AppData\Local\Temp\3227.tmp"102⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\3294.tmp"C:\Users\Admin\AppData\Local\Temp\3294.tmp"103⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"104⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"105⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"106⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\3498.tmp"C:\Users\Admin\AppData\Local\Temp\3498.tmp"107⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\3524.tmp"C:\Users\Admin\AppData\Local\Temp\3524.tmp"108⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\35A1.tmp"C:\Users\Admin\AppData\Local\Temp\35A1.tmp"109⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\364D.tmp"C:\Users\Admin\AppData\Local\Temp\364D.tmp"110⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\36EA.tmp"C:\Users\Admin\AppData\Local\Temp\36EA.tmp"111⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\3767.tmp"C:\Users\Admin\AppData\Local\Temp\3767.tmp"112⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\37F3.tmp"C:\Users\Admin\AppData\Local\Temp\37F3.tmp"113⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\388F.tmp"C:\Users\Admin\AppData\Local\Temp\388F.tmp"114⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\390C.tmp"C:\Users\Admin\AppData\Local\Temp\390C.tmp"115⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\3989.tmp"C:\Users\Admin\AppData\Local\Temp\3989.tmp"116⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\3A16.tmp"C:\Users\Admin\AppData\Local\Temp\3A16.tmp"117⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\3A93.tmp"C:\Users\Admin\AppData\Local\Temp\3A93.tmp"118⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\3B20.tmp"C:\Users\Admin\AppData\Local\Temp\3B20.tmp"119⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\3B9D.tmp"C:\Users\Admin\AppData\Local\Temp\3B9D.tmp"120⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\3C1A.tmp"C:\Users\Admin\AppData\Local\Temp\3C1A.tmp"121⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\3C87.tmp"C:\Users\Admin\AppData\Local\Temp\3C87.tmp"122⤵PID:3296
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-