Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2023, 16:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bf8bf53b659b83b674cff2ad5de528d7_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
bf8bf53b659b83b674cff2ad5de528d7_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
bf8bf53b659b83b674cff2ad5de528d7_mafia_JC.exe
-
Size
527KB
-
MD5
bf8bf53b659b83b674cff2ad5de528d7
-
SHA1
39d8d4de5b7d27a55100894fc99bfbcbe6909751
-
SHA256
6d59e736646cc5a4c93c7d93145a758b60c4328850a2549a3757cde15cd57baa
-
SHA512
ed17b4be3d02e515127f712afa9afbbe0d14cfd90fb6d38b363d82d3f8e40126a29ac5263a5b516a5b4d444537fcffc51e0050589f6d1718da30ca17040c6b81
-
SSDEEP
12288:fU5rCOTeidNO9/la3mbsvR+uU+HMGJlIY8yTvDZu:fUQOJdNdsWMBYfDo
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 688 67E2.tmp 1460 68BC.tmp 4388 6997.tmp 2688 6A72.tmp 2532 6B2D.tmp 2944 6BD9.tmp 568 6C95.tmp 4056 6D41.tmp 2456 6E1B.tmp 2088 6E98.tmp 4252 6F63.tmp 4820 701F.tmp 4764 70BB.tmp 3964 7167.tmp 2024 71F4.tmp 3864 731D.tmp 856 73E8.tmp 4516 74B3.tmp 5004 75BC.tmp 3908 7697.tmp 3300 7753.tmp 3452 77D0.tmp 4740 785C.tmp 2824 78E9.tmp 3700 79F3.tmp 820 7A7F.tmp 1440 7B0C.tmp 1332 7B79.tmp 2136 7C35.tmp 1792 7D0F.tmp 2192 7E19.tmp 1448 7E86.tmp 2936 7F61.tmp 4332 7FEE.tmp 4228 809A.tmp 3056 8107.tmp 1480 8194.tmp 4852 8230.tmp 4732 82AD.tmp 2544 832A.tmp 3880 83D6.tmp 4072 8453.tmp 664 84DF.tmp 2408 856C.tmp 2912 8608.tmp 4368 86A5.tmp 1096 8731.tmp 4644 87AE.tmp 2552 883B.tmp 4192 88C7.tmp 3992 8954.tmp 3076 8A00.tmp 2172 8A6D.tmp 1576 8ADB.tmp 1664 8B87.tmp 228 8C13.tmp 4848 8CA0.tmp 1488 8D3C.tmp 3944 8DC9.tmp 2720 8E36.tmp 4840 8EC3.tmp 3360 8F4F.tmp 1912 8FEC.tmp 472 9069.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2980 wrote to memory of 688 2980 bf8bf53b659b83b674cff2ad5de528d7_mafia_JC.exe 81 PID 2980 wrote to memory of 688 2980 bf8bf53b659b83b674cff2ad5de528d7_mafia_JC.exe 81 PID 2980 wrote to memory of 688 2980 bf8bf53b659b83b674cff2ad5de528d7_mafia_JC.exe 81 PID 688 wrote to memory of 1460 688 67E2.tmp 82 PID 688 wrote to memory of 1460 688 67E2.tmp 82 PID 688 wrote to memory of 1460 688 67E2.tmp 82 PID 1460 wrote to memory of 4388 1460 68BC.tmp 83 PID 1460 wrote to memory of 4388 1460 68BC.tmp 83 PID 1460 wrote to memory of 4388 1460 68BC.tmp 83 PID 4388 wrote to memory of 2688 4388 6997.tmp 84 PID 4388 wrote to memory of 2688 4388 6997.tmp 84 PID 4388 wrote to memory of 2688 4388 6997.tmp 84 PID 2688 wrote to memory of 2532 2688 6A72.tmp 85 PID 2688 wrote to memory of 2532 2688 6A72.tmp 85 PID 2688 wrote to memory of 2532 2688 6A72.tmp 85 PID 2532 wrote to memory of 2944 2532 6B2D.tmp 86 PID 2532 wrote to memory of 2944 2532 6B2D.tmp 86 PID 2532 wrote to memory of 2944 2532 6B2D.tmp 86 PID 2944 wrote to memory of 568 2944 6BD9.tmp 87 PID 2944 wrote to memory of 568 2944 6BD9.tmp 87 PID 2944 wrote to memory of 568 2944 6BD9.tmp 87 PID 568 wrote to memory of 4056 568 6C95.tmp 88 PID 568 wrote to memory of 4056 568 6C95.tmp 88 PID 568 wrote to memory of 4056 568 6C95.tmp 88 PID 4056 wrote to memory of 2456 4056 6D41.tmp 89 PID 4056 wrote to memory of 2456 4056 6D41.tmp 89 PID 4056 wrote to memory of 2456 4056 6D41.tmp 89 PID 2456 wrote to memory of 2088 2456 6E1B.tmp 90 PID 2456 wrote to memory of 2088 2456 6E1B.tmp 90 PID 2456 wrote to memory of 2088 2456 6E1B.tmp 90 PID 2088 wrote to memory of 4252 2088 6E98.tmp 91 PID 2088 wrote to memory of 4252 2088 6E98.tmp 91 PID 2088 wrote to memory of 4252 2088 6E98.tmp 91 PID 4252 wrote to memory of 4820 4252 6F63.tmp 92 PID 4252 wrote to memory of 4820 4252 6F63.tmp 92 PID 4252 wrote to memory of 4820 4252 6F63.tmp 92 PID 4820 wrote to memory of 4764 4820 701F.tmp 93 PID 4820 wrote to memory of 4764 4820 701F.tmp 93 PID 4820 wrote to memory of 4764 4820 701F.tmp 93 PID 4764 wrote to memory of 3964 4764 70BB.tmp 94 PID 4764 wrote to memory of 3964 4764 70BB.tmp 94 PID 4764 wrote to memory of 3964 4764 70BB.tmp 94 PID 3964 wrote to memory of 2024 3964 7167.tmp 95 PID 3964 wrote to memory of 2024 3964 7167.tmp 95 PID 3964 wrote to memory of 2024 3964 7167.tmp 95 PID 2024 wrote to memory of 3864 2024 71F4.tmp 98 PID 2024 wrote to memory of 3864 2024 71F4.tmp 98 PID 2024 wrote to memory of 3864 2024 71F4.tmp 98 PID 3864 wrote to memory of 856 3864 731D.tmp 99 PID 3864 wrote to memory of 856 3864 731D.tmp 99 PID 3864 wrote to memory of 856 3864 731D.tmp 99 PID 856 wrote to memory of 4516 856 73E8.tmp 100 PID 856 wrote to memory of 4516 856 73E8.tmp 100 PID 856 wrote to memory of 4516 856 73E8.tmp 100 PID 4516 wrote to memory of 5004 4516 74B3.tmp 101 PID 4516 wrote to memory of 5004 4516 74B3.tmp 101 PID 4516 wrote to memory of 5004 4516 74B3.tmp 101 PID 5004 wrote to memory of 3908 5004 75BC.tmp 102 PID 5004 wrote to memory of 3908 5004 75BC.tmp 102 PID 5004 wrote to memory of 3908 5004 75BC.tmp 102 PID 3908 wrote to memory of 3300 3908 7697.tmp 103 PID 3908 wrote to memory of 3300 3908 7697.tmp 103 PID 3908 wrote to memory of 3300 3908 7697.tmp 103 PID 3300 wrote to memory of 3452 3300 7753.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf8bf53b659b83b674cff2ad5de528d7_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\bf8bf53b659b83b674cff2ad5de528d7_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\6F63.tmp"C:\Users\Admin\AppData\Local\Temp\6F63.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\73E8.tmp"C:\Users\Admin\AppData\Local\Temp\73E8.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\7753.tmp"C:\Users\Admin\AppData\Local\Temp\7753.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"23⤵
- Executes dropped EXE
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\785C.tmp"C:\Users\Admin\AppData\Local\Temp\785C.tmp"24⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"25⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"26⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"27⤵
- Executes dropped EXE
PID:820 -
C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"28⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\7B79.tmp"C:\Users\Admin\AppData\Local\Temp\7B79.tmp"29⤵
- Executes dropped EXE
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\7C35.tmp"C:\Users\Admin\AppData\Local\Temp\7C35.tmp"30⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"31⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"32⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"33⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\7F61.tmp"C:\Users\Admin\AppData\Local\Temp\7F61.tmp"34⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"35⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\809A.tmp"C:\Users\Admin\AppData\Local\Temp\809A.tmp"36⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\8107.tmp"C:\Users\Admin\AppData\Local\Temp\8107.tmp"37⤵
- Executes dropped EXE
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\8194.tmp"C:\Users\Admin\AppData\Local\Temp\8194.tmp"38⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\8230.tmp"C:\Users\Admin\AppData\Local\Temp\8230.tmp"39⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\82AD.tmp"C:\Users\Admin\AppData\Local\Temp\82AD.tmp"40⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"41⤵
- Executes dropped EXE
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\83D6.tmp"C:\Users\Admin\AppData\Local\Temp\83D6.tmp"42⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\8453.tmp"C:\Users\Admin\AppData\Local\Temp\8453.tmp"43⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\84DF.tmp"C:\Users\Admin\AppData\Local\Temp\84DF.tmp"44⤵
- Executes dropped EXE
PID:664 -
C:\Users\Admin\AppData\Local\Temp\856C.tmp"C:\Users\Admin\AppData\Local\Temp\856C.tmp"45⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\8608.tmp"C:\Users\Admin\AppData\Local\Temp\8608.tmp"46⤵
- Executes dropped EXE
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\86A5.tmp"C:\Users\Admin\AppData\Local\Temp\86A5.tmp"47⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\8731.tmp"C:\Users\Admin\AppData\Local\Temp\8731.tmp"48⤵
- Executes dropped EXE
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\87AE.tmp"C:\Users\Admin\AppData\Local\Temp\87AE.tmp"49⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\883B.tmp"C:\Users\Admin\AppData\Local\Temp\883B.tmp"50⤵
- Executes dropped EXE
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\88C7.tmp"C:\Users\Admin\AppData\Local\Temp\88C7.tmp"51⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\8954.tmp"C:\Users\Admin\AppData\Local\Temp\8954.tmp"52⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\8A00.tmp"C:\Users\Admin\AppData\Local\Temp\8A00.tmp"53⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"54⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"55⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\8B87.tmp"C:\Users\Admin\AppData\Local\Temp\8B87.tmp"56⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\8C13.tmp"C:\Users\Admin\AppData\Local\Temp\8C13.tmp"57⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"58⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"59⤵
- Executes dropped EXE
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"60⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp"61⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"62⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"63⤵
- Executes dropped EXE
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"64⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"65⤵
- Executes dropped EXE
PID:472 -
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"66⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\9163.tmp"C:\Users\Admin\AppData\Local\Temp\9163.tmp"67⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\91D0.tmp"C:\Users\Admin\AppData\Local\Temp\91D0.tmp"68⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"69⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"70⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\9376.tmp"C:\Users\Admin\AppData\Local\Temp\9376.tmp"71⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\9402.tmp"C:\Users\Admin\AppData\Local\Temp\9402.tmp"72⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"73⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\94FC.tmp"C:\Users\Admin\AppData\Local\Temp\94FC.tmp"74⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"75⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\95B8.tmp"C:\Users\Admin\AppData\Local\Temp\95B8.tmp"76⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"77⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\96B2.tmp"C:\Users\Admin\AppData\Local\Temp\96B2.tmp"78⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"79⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\97CB.tmp"C:\Users\Admin\AppData\Local\Temp\97CB.tmp"80⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"81⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\98E4.tmp"C:\Users\Admin\AppData\Local\Temp\98E4.tmp"82⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\9952.tmp"C:\Users\Admin\AppData\Local\Temp\9952.tmp"83⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\99EE.tmp"C:\Users\Admin\AppData\Local\Temp\99EE.tmp"84⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"85⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"86⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"87⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"88⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"89⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"90⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"91⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"92⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"93⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"94⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"95⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"96⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"97⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"98⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"99⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"100⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"101⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"102⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\A325.tmp"C:\Users\Admin\AppData\Local\Temp\A325.tmp"103⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"104⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\A41F.tmp"C:\Users\Admin\AppData\Local\Temp\A41F.tmp"105⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"106⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\A50A.tmp"C:\Users\Admin\AppData\Local\Temp\A50A.tmp"107⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"108⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"109⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"110⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\A74C.tmp"C:\Users\Admin\AppData\Local\Temp\A74C.tmp"111⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"112⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"113⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"114⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"115⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"116⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\AA88.tmp"C:\Users\Admin\AppData\Local\Temp\AA88.tmp"117⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\AB05.tmp"C:\Users\Admin\AppData\Local\Temp\AB05.tmp"118⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\AB82.tmp"C:\Users\Admin\AppData\Local\Temp\AB82.tmp"119⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"120⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"121⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"122⤵PID:4840
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-