Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
16/08/2023, 17:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0b6616bf523209b3db2662213d14f63a_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
0b6616bf523209b3db2662213d14f63a_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
0b6616bf523209b3db2662213d14f63a_mafia_JC.exe
-
Size
487KB
-
MD5
0b6616bf523209b3db2662213d14f63a
-
SHA1
9882a34cbfae00007b2e4d90d40a9c4cd50ce8d3
-
SHA256
95c6ef8952d4a73cc89231ad90974316de69dc368283802acc2427227dd85d29
-
SHA512
143d498bda7a771d8d4ef6d56b2acbe3af3a40938e373bc8639394914ec931e276503f4816e831afb32aa20712d81a9df38e29a8b267bc8207a9ff08c2b48732
-
SSDEEP
6144:qorf3lPvovsgZnqG2C7mOTeiL9DUaGtHT62TBq1gFurW0NAEbRpNY/fNE9H7AHUX:HU5rCOTeiJlGtH22UguTNAaqDNdSNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3400 DB7.tmp 4204 F1E.tmp 2640 FF9.tmp 3644 10E3.tmp 208 11AE.tmp 2380 12B8.tmp 2192 1383.tmp 2620 142F.tmp 2888 1539.tmp 2792 1642.tmp 2172 1E70.tmp 2812 2074.tmp 1636 21BC.tmp 4976 22B6.tmp 4860 244C.tmp 4800 2584.tmp 888 2630.tmp 4624 271B.tmp 2724 2853.tmp 4112 296C.tmp 828 2A18.tmp 1176 2AB5.tmp 2032 2B60.tmp 4324 2C4B.tmp 4088 2CE7.tmp 2580 2DC2.tmp 2716 2E8D.tmp 944 2F0A.tmp 4692 3004.tmp 3668 30A0.tmp 4972 312D.tmp 3368 31F8.tmp 4412 32D3.tmp 1588 335F.tmp 2596 33DC.tmp 4812 3469.tmp 4312 3505.tmp 4172 35C1.tmp 2808 368C.tmp 4940 3738.tmp 4348 37E4.tmp 3264 3880.tmp 4316 390C.tmp 4640 39B8.tmp 4600 3AC2.tmp 532 3C1A.tmp 2160 3D52.tmp 4060 3DFE.tmp 4828 3F46.tmp 5064 3FC3.tmp 5060 407F.tmp 2000 40EC.tmp 3856 41A8.tmp 2572 4244.tmp 3700 432E.tmp 4700 43BB.tmp 3824 4467.tmp 4712 4561.tmp 2008 45DE.tmp 2088 466A.tmp 1648 4716.tmp 4260 49E5.tmp 5040 4ADF.tmp 4124 4BD9.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3424 wrote to memory of 3400 3424 0b6616bf523209b3db2662213d14f63a_mafia_JC.exe 81 PID 3424 wrote to memory of 3400 3424 0b6616bf523209b3db2662213d14f63a_mafia_JC.exe 81 PID 3424 wrote to memory of 3400 3424 0b6616bf523209b3db2662213d14f63a_mafia_JC.exe 81 PID 3400 wrote to memory of 4204 3400 DB7.tmp 82 PID 3400 wrote to memory of 4204 3400 DB7.tmp 82 PID 3400 wrote to memory of 4204 3400 DB7.tmp 82 PID 4204 wrote to memory of 2640 4204 F1E.tmp 83 PID 4204 wrote to memory of 2640 4204 F1E.tmp 83 PID 4204 wrote to memory of 2640 4204 F1E.tmp 83 PID 2640 wrote to memory of 3644 2640 FF9.tmp 84 PID 2640 wrote to memory of 3644 2640 FF9.tmp 84 PID 2640 wrote to memory of 3644 2640 FF9.tmp 84 PID 3644 wrote to memory of 208 3644 10E3.tmp 85 PID 3644 wrote to memory of 208 3644 10E3.tmp 85 PID 3644 wrote to memory of 208 3644 10E3.tmp 85 PID 208 wrote to memory of 2380 208 11AE.tmp 86 PID 208 wrote to memory of 2380 208 11AE.tmp 86 PID 208 wrote to memory of 2380 208 11AE.tmp 86 PID 2380 wrote to memory of 2192 2380 12B8.tmp 87 PID 2380 wrote to memory of 2192 2380 12B8.tmp 87 PID 2380 wrote to memory of 2192 2380 12B8.tmp 87 PID 2192 wrote to memory of 2620 2192 1383.tmp 88 PID 2192 wrote to memory of 2620 2192 1383.tmp 88 PID 2192 wrote to memory of 2620 2192 1383.tmp 88 PID 2620 wrote to memory of 2888 2620 142F.tmp 89 PID 2620 wrote to memory of 2888 2620 142F.tmp 89 PID 2620 wrote to memory of 2888 2620 142F.tmp 89 PID 2888 wrote to memory of 2792 2888 1539.tmp 90 PID 2888 wrote to memory of 2792 2888 1539.tmp 90 PID 2888 wrote to memory of 2792 2888 1539.tmp 90 PID 2792 wrote to memory of 2172 2792 1642.tmp 91 PID 2792 wrote to memory of 2172 2792 1642.tmp 91 PID 2792 wrote to memory of 2172 2792 1642.tmp 91 PID 2172 wrote to memory of 2812 2172 1E70.tmp 92 PID 2172 wrote to memory of 2812 2172 1E70.tmp 92 PID 2172 wrote to memory of 2812 2172 1E70.tmp 92 PID 2812 wrote to memory of 1636 2812 2074.tmp 93 PID 2812 wrote to memory of 1636 2812 2074.tmp 93 PID 2812 wrote to memory of 1636 2812 2074.tmp 93 PID 1636 wrote to memory of 4976 1636 21BC.tmp 94 PID 1636 wrote to memory of 4976 1636 21BC.tmp 94 PID 1636 wrote to memory of 4976 1636 21BC.tmp 94 PID 4976 wrote to memory of 4860 4976 22B6.tmp 95 PID 4976 wrote to memory of 4860 4976 22B6.tmp 95 PID 4976 wrote to memory of 4860 4976 22B6.tmp 95 PID 4860 wrote to memory of 4800 4860 244C.tmp 97 PID 4860 wrote to memory of 4800 4860 244C.tmp 97 PID 4860 wrote to memory of 4800 4860 244C.tmp 97 PID 4800 wrote to memory of 888 4800 2584.tmp 98 PID 4800 wrote to memory of 888 4800 2584.tmp 98 PID 4800 wrote to memory of 888 4800 2584.tmp 98 PID 888 wrote to memory of 4624 888 2630.tmp 99 PID 888 wrote to memory of 4624 888 2630.tmp 99 PID 888 wrote to memory of 4624 888 2630.tmp 99 PID 4624 wrote to memory of 2724 4624 271B.tmp 100 PID 4624 wrote to memory of 2724 4624 271B.tmp 100 PID 4624 wrote to memory of 2724 4624 271B.tmp 100 PID 2724 wrote to memory of 4112 2724 2853.tmp 101 PID 2724 wrote to memory of 4112 2724 2853.tmp 101 PID 2724 wrote to memory of 4112 2724 2853.tmp 101 PID 4112 wrote to memory of 828 4112 296C.tmp 102 PID 4112 wrote to memory of 828 4112 296C.tmp 102 PID 4112 wrote to memory of 828 4112 296C.tmp 102 PID 828 wrote to memory of 1176 828 2A18.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b6616bf523209b3db2662213d14f63a_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\0b6616bf523209b3db2662213d14f63a_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\DB7.tmp"C:\Users\Admin\AppData\Local\Temp\DB7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\FF9.tmp"C:\Users\Admin\AppData\Local\Temp\FF9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\10E3.tmp"C:\Users\Admin\AppData\Local\Temp\10E3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\11AE.tmp"C:\Users\Admin\AppData\Local\Temp\11AE.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\12B8.tmp"C:\Users\Admin\AppData\Local\Temp\12B8.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\1383.tmp"C:\Users\Admin\AppData\Local\Temp\1383.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\142F.tmp"C:\Users\Admin\AppData\Local\Temp\142F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\1539.tmp"C:\Users\Admin\AppData\Local\Temp\1539.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\1642.tmp"C:\Users\Admin\AppData\Local\Temp\1642.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\1E70.tmp"C:\Users\Admin\AppData\Local\Temp\1E70.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\2074.tmp"C:\Users\Admin\AppData\Local\Temp\2074.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\21BC.tmp"C:\Users\Admin\AppData\Local\Temp\21BC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\22B6.tmp"C:\Users\Admin\AppData\Local\Temp\22B6.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\244C.tmp"C:\Users\Admin\AppData\Local\Temp\244C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\2584.tmp"C:\Users\Admin\AppData\Local\Temp\2584.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\2630.tmp"C:\Users\Admin\AppData\Local\Temp\2630.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\271B.tmp"C:\Users\Admin\AppData\Local\Temp\271B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\2853.tmp"C:\Users\Admin\AppData\Local\Temp\2853.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\296C.tmp"C:\Users\Admin\AppData\Local\Temp\296C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\2A18.tmp"C:\Users\Admin\AppData\Local\Temp\2A18.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\2AB5.tmp"C:\Users\Admin\AppData\Local\Temp\2AB5.tmp"23⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\2B60.tmp"C:\Users\Admin\AppData\Local\Temp\2B60.tmp"24⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"25⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"26⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"27⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\2E8D.tmp"C:\Users\Admin\AppData\Local\Temp\2E8D.tmp"28⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\2F0A.tmp"C:\Users\Admin\AppData\Local\Temp\2F0A.tmp"29⤵
- Executes dropped EXE
PID:944 -
C:\Users\Admin\AppData\Local\Temp\3004.tmp"C:\Users\Admin\AppData\Local\Temp\3004.tmp"30⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\30A0.tmp"C:\Users\Admin\AppData\Local\Temp\30A0.tmp"31⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\312D.tmp"C:\Users\Admin\AppData\Local\Temp\312D.tmp"32⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\31F8.tmp"C:\Users\Admin\AppData\Local\Temp\31F8.tmp"33⤵
- Executes dropped EXE
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\32D3.tmp"C:\Users\Admin\AppData\Local\Temp\32D3.tmp"34⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\335F.tmp"C:\Users\Admin\AppData\Local\Temp\335F.tmp"35⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"36⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"37⤵
- Executes dropped EXE
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"38⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\35C1.tmp"C:\Users\Admin\AppData\Local\Temp\35C1.tmp"39⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\368C.tmp"C:\Users\Admin\AppData\Local\Temp\368C.tmp"40⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\3738.tmp"C:\Users\Admin\AppData\Local\Temp\3738.tmp"41⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\37E4.tmp"C:\Users\Admin\AppData\Local\Temp\37E4.tmp"42⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\3880.tmp"C:\Users\Admin\AppData\Local\Temp\3880.tmp"43⤵
- Executes dropped EXE
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\390C.tmp"C:\Users\Admin\AppData\Local\Temp\390C.tmp"44⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\39B8.tmp"C:\Users\Admin\AppData\Local\Temp\39B8.tmp"45⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\3AC2.tmp"C:\Users\Admin\AppData\Local\Temp\3AC2.tmp"46⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\3C1A.tmp"C:\Users\Admin\AppData\Local\Temp\3C1A.tmp"47⤵
- Executes dropped EXE
PID:532 -
C:\Users\Admin\AppData\Local\Temp\3D52.tmp"C:\Users\Admin\AppData\Local\Temp\3D52.tmp"48⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\3DFE.tmp"C:\Users\Admin\AppData\Local\Temp\3DFE.tmp"49⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\3F46.tmp"C:\Users\Admin\AppData\Local\Temp\3F46.tmp"50⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\3FC3.tmp"C:\Users\Admin\AppData\Local\Temp\3FC3.tmp"51⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\407F.tmp"C:\Users\Admin\AppData\Local\Temp\407F.tmp"52⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\40EC.tmp"C:\Users\Admin\AppData\Local\Temp\40EC.tmp"53⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\41A8.tmp"C:\Users\Admin\AppData\Local\Temp\41A8.tmp"54⤵
- Executes dropped EXE
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\4244.tmp"C:\Users\Admin\AppData\Local\Temp\4244.tmp"55⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\432E.tmp"C:\Users\Admin\AppData\Local\Temp\432E.tmp"56⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\43BB.tmp"C:\Users\Admin\AppData\Local\Temp\43BB.tmp"57⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\4467.tmp"C:\Users\Admin\AppData\Local\Temp\4467.tmp"58⤵
- Executes dropped EXE
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\4561.tmp"C:\Users\Admin\AppData\Local\Temp\4561.tmp"59⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\45DE.tmp"C:\Users\Admin\AppData\Local\Temp\45DE.tmp"60⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\466A.tmp"C:\Users\Admin\AppData\Local\Temp\466A.tmp"61⤵
- Executes dropped EXE
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\4716.tmp"C:\Users\Admin\AppData\Local\Temp\4716.tmp"62⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\49E5.tmp"C:\Users\Admin\AppData\Local\Temp\49E5.tmp"63⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\4ADF.tmp"C:\Users\Admin\AppData\Local\Temp\4ADF.tmp"64⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\4BD9.tmp"C:\Users\Admin\AppData\Local\Temp\4BD9.tmp"65⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\4C94.tmp"C:\Users\Admin\AppData\Local\Temp\4C94.tmp"66⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\4D21.tmp"C:\Users\Admin\AppData\Local\Temp\4D21.tmp"67⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\4DDD.tmp"C:\Users\Admin\AppData\Local\Temp\4DDD.tmp"68⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\4E88.tmp"C:\Users\Admin\AppData\Local\Temp\4E88.tmp"69⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\4F44.tmp"C:\Users\Admin\AppData\Local\Temp\4F44.tmp"70⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\4FE0.tmp"C:\Users\Admin\AppData\Local\Temp\4FE0.tmp"71⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\508C.tmp"C:\Users\Admin\AppData\Local\Temp\508C.tmp"72⤵PID:260
-
C:\Users\Admin\AppData\Local\Temp\5157.tmp"C:\Users\Admin\AppData\Local\Temp\5157.tmp"73⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\5203.tmp"C:\Users\Admin\AppData\Local\Temp\5203.tmp"74⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\5290.tmp"C:\Users\Admin\AppData\Local\Temp\5290.tmp"75⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\531C.tmp"C:\Users\Admin\AppData\Local\Temp\531C.tmp"76⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\54B3.tmp"C:\Users\Admin\AppData\Local\Temp\54B3.tmp"77⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\556E.tmp"C:\Users\Admin\AppData\Local\Temp\556E.tmp"78⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\55FB.tmp"C:\Users\Admin\AppData\Local\Temp\55FB.tmp"79⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\5714.tmp"C:\Users\Admin\AppData\Local\Temp\5714.tmp"80⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\57B0.tmp"C:\Users\Admin\AppData\Local\Temp\57B0.tmp"81⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\587B.tmp"C:\Users\Admin\AppData\Local\Temp\587B.tmp"82⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\58F8.tmp"C:\Users\Admin\AppData\Local\Temp\58F8.tmp"83⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\5995.tmp"C:\Users\Admin\AppData\Local\Temp\5995.tmp"84⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\5A12.tmp"C:\Users\Admin\AppData\Local\Temp\5A12.tmp"85⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\5A7F.tmp"C:\Users\Admin\AppData\Local\Temp\5A7F.tmp"86⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\5AEC.tmp"C:\Users\Admin\AppData\Local\Temp\5AEC.tmp"87⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\5BA8.tmp"C:\Users\Admin\AppData\Local\Temp\5BA8.tmp"88⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\5C34.tmp"C:\Users\Admin\AppData\Local\Temp\5C34.tmp"89⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\5CA2.tmp"C:\Users\Admin\AppData\Local\Temp\5CA2.tmp"90⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\5D1F.tmp"C:\Users\Admin\AppData\Local\Temp\5D1F.tmp"91⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\5DBB.tmp"C:\Users\Admin\AppData\Local\Temp\5DBB.tmp"92⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\5E38.tmp"C:\Users\Admin\AppData\Local\Temp\5E38.tmp"93⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\5EB5.tmp"C:\Users\Admin\AppData\Local\Temp\5EB5.tmp"94⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\5F32.tmp"C:\Users\Admin\AppData\Local\Temp\5F32.tmp"95⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\602C.tmp"C:\Users\Admin\AppData\Local\Temp\602C.tmp"96⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\60C8.tmp"C:\Users\Admin\AppData\Local\Temp\60C8.tmp"97⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\61C2.tmp"C:\Users\Admin\AppData\Local\Temp\61C2.tmp"98⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\625F.tmp"C:\Users\Admin\AppData\Local\Temp\625F.tmp"99⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\62FB.tmp"C:\Users\Admin\AppData\Local\Temp\62FB.tmp"100⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\6368.tmp"C:\Users\Admin\AppData\Local\Temp\6368.tmp"101⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\63F5.tmp"C:\Users\Admin\AppData\Local\Temp\63F5.tmp"102⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\6472.tmp"C:\Users\Admin\AppData\Local\Temp\6472.tmp"103⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\650E.tmp"C:\Users\Admin\AppData\Local\Temp\650E.tmp"104⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\658B.tmp"C:\Users\Admin\AppData\Local\Temp\658B.tmp"105⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\6618.tmp"C:\Users\Admin\AppData\Local\Temp\6618.tmp"106⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\6695.tmp"C:\Users\Admin\AppData\Local\Temp\6695.tmp"107⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\6721.tmp"C:\Users\Admin\AppData\Local\Temp\6721.tmp"108⤵PID:32
-
C:\Users\Admin\AppData\Local\Temp\67AE.tmp"C:\Users\Admin\AppData\Local\Temp\67AE.tmp"109⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\685A.tmp"C:\Users\Admin\AppData\Local\Temp\685A.tmp"110⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\68C7.tmp"C:\Users\Admin\AppData\Local\Temp\68C7.tmp"111⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\6944.tmp"C:\Users\Admin\AppData\Local\Temp\6944.tmp"112⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\69E0.tmp"C:\Users\Admin\AppData\Local\Temp\69E0.tmp"113⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\6A5D.tmp"C:\Users\Admin\AppData\Local\Temp\6A5D.tmp"114⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\6ADA.tmp"C:\Users\Admin\AppData\Local\Temp\6ADA.tmp"115⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\6B77.tmp"C:\Users\Admin\AppData\Local\Temp\6B77.tmp"116⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\6BE4.tmp"C:\Users\Admin\AppData\Local\Temp\6BE4.tmp"117⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\6C71.tmp"C:\Users\Admin\AppData\Local\Temp\6C71.tmp"118⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\6CEE.tmp"C:\Users\Admin\AppData\Local\Temp\6CEE.tmp"119⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\6D5B.tmp"C:\Users\Admin\AppData\Local\Temp\6D5B.tmp"120⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\6DD8.tmp"C:\Users\Admin\AppData\Local\Temp\6DD8.tmp"121⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\6E45.tmp"C:\Users\Admin\AppData\Local\Temp\6E45.tmp"122⤵PID:2308
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-