Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2023, 16:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d26dee7e37704c3aeb011ce16479985d_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
d26dee7e37704c3aeb011ce16479985d_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
d26dee7e37704c3aeb011ce16479985d_mafia_JC.exe
-
Size
488KB
-
MD5
d26dee7e37704c3aeb011ce16479985d
-
SHA1
0b7a46f6e265113772107295648c734271772ed2
-
SHA256
03342af558dfe8521314e6381bf4f001eec2f00325209646c2a154c4389683f8
-
SHA512
15e206f80f70541c2cc3d0d3fa6e679b75e16ffe4913a07614f1cf69e53f891b1761e422d9287604e4b3baa2a55a57fde1cfdbda23978aef5b7bc9e7b4233de0
-
SSDEEP
12288:/U5rCOTeiD/xuU8Gy/UC1yvm1a7SEuOcKNZ:/UQOJD/xuU8WC6fSEuNKN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4232 6438.tmp 4848 64B5.tmp 4620 6551.tmp 4300 662C.tmp 812 6707.tmp 3820 68CC.tmp 4304 6968.tmp 1988 6A14.tmp 4168 6E3B.tmp 4716 6ED7.tmp 4388 6FC1.tmp 4472 705D.tmp 2244 70EA.tmp 3304 7196.tmp 4268 7223.tmp 4288 72DE.tmp 1336 735B.tmp 4696 73C8.tmp 1808 7484.tmp 4148 7520.tmp 4104 75CC.tmp 4832 7688.tmp 3656 7724.tmp 5116 780E.tmp 3912 789B.tmp 4060 7947.tmp 3740 7A02.tmp 1164 7A9E.tmp 652 7B1B.tmp 664 7BE7.tmp 848 7CB2.tmp 2860 7D4E.tmp 4256 7E09.tmp 3860 7EC5.tmp 2768 8107.tmp 4076 8194.tmp 2040 8211.tmp 4728 82AD.tmp 2812 833A.tmp 4668 83A7.tmp 3048 8424.tmp 3644 84D0.tmp 408 853D.tmp 4460 85D9.tmp 1852 8666.tmp 3044 86D3.tmp 3884 8770.tmp 3788 87FC.tmp 1788 8889.tmp 4320 8935.tmp 2676 8B29.tmp 2108 8BB5.tmp 1300 8C52.tmp 2380 8CEE.tmp 1908 8D6B.tmp 4020 8E07.tmp 5000 8E94.tmp 1236 8F4F.tmp 4736 8FDC.tmp 2744 9069.tmp 2664 9105.tmp 3844 9172.tmp 1632 91D0.tmp 4168 923D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4644 wrote to memory of 4232 4644 d26dee7e37704c3aeb011ce16479985d_mafia_JC.exe 83 PID 4644 wrote to memory of 4232 4644 d26dee7e37704c3aeb011ce16479985d_mafia_JC.exe 83 PID 4644 wrote to memory of 4232 4644 d26dee7e37704c3aeb011ce16479985d_mafia_JC.exe 83 PID 4232 wrote to memory of 4848 4232 6438.tmp 84 PID 4232 wrote to memory of 4848 4232 6438.tmp 84 PID 4232 wrote to memory of 4848 4232 6438.tmp 84 PID 4848 wrote to memory of 4620 4848 64B5.tmp 85 PID 4848 wrote to memory of 4620 4848 64B5.tmp 85 PID 4848 wrote to memory of 4620 4848 64B5.tmp 85 PID 4620 wrote to memory of 4300 4620 6551.tmp 86 PID 4620 wrote to memory of 4300 4620 6551.tmp 86 PID 4620 wrote to memory of 4300 4620 6551.tmp 86 PID 4300 wrote to memory of 812 4300 662C.tmp 87 PID 4300 wrote to memory of 812 4300 662C.tmp 87 PID 4300 wrote to memory of 812 4300 662C.tmp 87 PID 812 wrote to memory of 3820 812 6707.tmp 88 PID 812 wrote to memory of 3820 812 6707.tmp 88 PID 812 wrote to memory of 3820 812 6707.tmp 88 PID 3820 wrote to memory of 4304 3820 68CC.tmp 89 PID 3820 wrote to memory of 4304 3820 68CC.tmp 89 PID 3820 wrote to memory of 4304 3820 68CC.tmp 89 PID 4304 wrote to memory of 1988 4304 6968.tmp 90 PID 4304 wrote to memory of 1988 4304 6968.tmp 90 PID 4304 wrote to memory of 1988 4304 6968.tmp 90 PID 1988 wrote to memory of 4168 1988 6A14.tmp 91 PID 1988 wrote to memory of 4168 1988 6A14.tmp 91 PID 1988 wrote to memory of 4168 1988 6A14.tmp 91 PID 4168 wrote to memory of 4716 4168 6E3B.tmp 92 PID 4168 wrote to memory of 4716 4168 6E3B.tmp 92 PID 4168 wrote to memory of 4716 4168 6E3B.tmp 92 PID 4716 wrote to memory of 4388 4716 6ED7.tmp 93 PID 4716 wrote to memory of 4388 4716 6ED7.tmp 93 PID 4716 wrote to memory of 4388 4716 6ED7.tmp 93 PID 4388 wrote to memory of 4472 4388 6FC1.tmp 94 PID 4388 wrote to memory of 4472 4388 6FC1.tmp 94 PID 4388 wrote to memory of 4472 4388 6FC1.tmp 94 PID 4472 wrote to memory of 2244 4472 705D.tmp 95 PID 4472 wrote to memory of 2244 4472 705D.tmp 95 PID 4472 wrote to memory of 2244 4472 705D.tmp 95 PID 2244 wrote to memory of 3304 2244 70EA.tmp 96 PID 2244 wrote to memory of 3304 2244 70EA.tmp 96 PID 2244 wrote to memory of 3304 2244 70EA.tmp 96 PID 3304 wrote to memory of 4268 3304 7196.tmp 97 PID 3304 wrote to memory of 4268 3304 7196.tmp 97 PID 3304 wrote to memory of 4268 3304 7196.tmp 97 PID 4268 wrote to memory of 4288 4268 7223.tmp 98 PID 4268 wrote to memory of 4288 4268 7223.tmp 98 PID 4268 wrote to memory of 4288 4268 7223.tmp 98 PID 4288 wrote to memory of 1336 4288 72DE.tmp 99 PID 4288 wrote to memory of 1336 4288 72DE.tmp 99 PID 4288 wrote to memory of 1336 4288 72DE.tmp 99 PID 1336 wrote to memory of 4696 1336 735B.tmp 100 PID 1336 wrote to memory of 4696 1336 735B.tmp 100 PID 1336 wrote to memory of 4696 1336 735B.tmp 100 PID 4696 wrote to memory of 1808 4696 73C8.tmp 101 PID 4696 wrote to memory of 1808 4696 73C8.tmp 101 PID 4696 wrote to memory of 1808 4696 73C8.tmp 101 PID 1808 wrote to memory of 4148 1808 7484.tmp 104 PID 1808 wrote to memory of 4148 1808 7484.tmp 104 PID 1808 wrote to memory of 4148 1808 7484.tmp 104 PID 4148 wrote to memory of 4104 4148 7520.tmp 105 PID 4148 wrote to memory of 4104 4148 7520.tmp 105 PID 4148 wrote to memory of 4104 4148 7520.tmp 105 PID 4104 wrote to memory of 4832 4104 75CC.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\d26dee7e37704c3aeb011ce16479985d_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\d26dee7e37704c3aeb011ce16479985d_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"23⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\7724.tmp"C:\Users\Admin\AppData\Local\Temp\7724.tmp"24⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\780E.tmp"C:\Users\Admin\AppData\Local\Temp\780E.tmp"25⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\789B.tmp"C:\Users\Admin\AppData\Local\Temp\789B.tmp"26⤵
- Executes dropped EXE
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"27⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\7A02.tmp"C:\Users\Admin\AppData\Local\Temp\7A02.tmp"28⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"29⤵
- Executes dropped EXE
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"30⤵
- Executes dropped EXE
PID:652 -
C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"31⤵
- Executes dropped EXE
PID:664 -
C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"32⤵
- Executes dropped EXE
PID:848 -
C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"33⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\7E09.tmp"C:\Users\Admin\AppData\Local\Temp\7E09.tmp"34⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"35⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\8107.tmp"C:\Users\Admin\AppData\Local\Temp\8107.tmp"36⤵
- Executes dropped EXE
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\8194.tmp"C:\Users\Admin\AppData\Local\Temp\8194.tmp"37⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"38⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\82AD.tmp"C:\Users\Admin\AppData\Local\Temp\82AD.tmp"39⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\833A.tmp"C:\Users\Admin\AppData\Local\Temp\833A.tmp"40⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\83A7.tmp"C:\Users\Admin\AppData\Local\Temp\83A7.tmp"41⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\8424.tmp"C:\Users\Admin\AppData\Local\Temp\8424.tmp"42⤵
- Executes dropped EXE
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\84D0.tmp"C:\Users\Admin\AppData\Local\Temp\84D0.tmp"43⤵
- Executes dropped EXE
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\853D.tmp"C:\Users\Admin\AppData\Local\Temp\853D.tmp"44⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\85D9.tmp"C:\Users\Admin\AppData\Local\Temp\85D9.tmp"45⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\8666.tmp"C:\Users\Admin\AppData\Local\Temp\8666.tmp"46⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\86D3.tmp"C:\Users\Admin\AppData\Local\Temp\86D3.tmp"47⤵
- Executes dropped EXE
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\8770.tmp"C:\Users\Admin\AppData\Local\Temp\8770.tmp"48⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\87FC.tmp"C:\Users\Admin\AppData\Local\Temp\87FC.tmp"49⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\8889.tmp"C:\Users\Admin\AppData\Local\Temp\8889.tmp"50⤵
- Executes dropped EXE
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\8935.tmp"C:\Users\Admin\AppData\Local\Temp\8935.tmp"51⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\8B29.tmp"C:\Users\Admin\AppData\Local\Temp\8B29.tmp"52⤵
- Executes dropped EXE
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"53⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"54⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"55⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"56⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\8E07.tmp"C:\Users\Admin\AppData\Local\Temp\8E07.tmp"57⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\8E94.tmp"C:\Users\Admin\AppData\Local\Temp\8E94.tmp"58⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"59⤵
- Executes dropped EXE
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"60⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"61⤵
- Executes dropped EXE
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"62⤵
- Executes dropped EXE
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp"63⤵
- Executes dropped EXE
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\91D0.tmp"C:\Users\Admin\AppData\Local\Temp\91D0.tmp"64⤵
- Executes dropped EXE
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\923D.tmp"C:\Users\Admin\AppData\Local\Temp\923D.tmp"65⤵
- Executes dropped EXE
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\92AB.tmp"C:\Users\Admin\AppData\Local\Temp\92AB.tmp"66⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"67⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\93A5.tmp"C:\Users\Admin\AppData\Local\Temp\93A5.tmp"68⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\9422.tmp"C:\Users\Admin\AppData\Local\Temp\9422.tmp"69⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\947F.tmp"C:\Users\Admin\AppData\Local\Temp\947F.tmp"70⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"71⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"72⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"73⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\96C2.tmp"C:\Users\Admin\AppData\Local\Temp\96C2.tmp"74⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"75⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\977D.tmp"C:\Users\Admin\AppData\Local\Temp\977D.tmp"76⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\97DB.tmp"C:\Users\Admin\AppData\Local\Temp\97DB.tmp"77⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"78⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\98F4.tmp"C:\Users\Admin\AppData\Local\Temp\98F4.tmp"79⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\99A0.tmp"C:\Users\Admin\AppData\Local\Temp\99A0.tmp"80⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"81⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"82⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"83⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"84⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"85⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"86⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"87⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"88⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\9E15.tmp"C:\Users\Admin\AppData\Local\Temp\9E15.tmp"89⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"90⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"91⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"92⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"93⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\A103.tmp"C:\Users\Admin\AppData\Local\Temp\A103.tmp"94⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\A18F.tmp"C:\Users\Admin\AppData\Local\Temp\A18F.tmp"95⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"96⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"97⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\A364.tmp"C:\Users\Admin\AppData\Local\Temp\A364.tmp"98⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"99⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\A47D.tmp"C:\Users\Admin\AppData\Local\Temp\A47D.tmp"100⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\A50A.tmp"C:\Users\Admin\AppData\Local\Temp\A50A.tmp"101⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"102⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"103⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"104⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\A76B.tmp"C:\Users\Admin\AppData\Local\Temp\A76B.tmp"105⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"106⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"107⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"108⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"109⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"110⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"111⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\AB53.tmp"C:\Users\Admin\AppData\Local\Temp\AB53.tmp"112⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"113⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"114⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\AD09.tmp"C:\Users\Admin\AppData\Local\Temp\AD09.tmp"115⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"116⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\AE12.tmp"C:\Users\Admin\AppData\Local\Temp\AE12.tmp"117⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"118⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"119⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"120⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\B064.tmp"C:\Users\Admin\AppData\Local\Temp\B064.tmp"121⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"122⤵PID:3764
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-