Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
03-09-2023 10:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2023-08-22_90e534176d118fde8a12a14053e91e66_mafia_JC.exe
Resource
win7-20230831-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2023-08-22_90e534176d118fde8a12a14053e91e66_mafia_JC.exe
Resource
win10v2004-20230831-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2023-08-22_90e534176d118fde8a12a14053e91e66_mafia_JC.exe
-
Size
486KB
-
MD5
90e534176d118fde8a12a14053e91e66
-
SHA1
e4861d9d71cd7a1d7ed508cf9952acc709e14103
-
SHA256
ec1f8f88880f02ac858916b40b70f2854753640542d00377971d098d9959ae7e
-
SHA512
ba87bde7e59e4af2f8ce9f9cf69855579106b88d5621d281a1bc69ad65117481ed0ffdc8c317344011fc44c57d354a2adf9f80ee06cbc3fed52cb31720a2c42a
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7uom+0v2U5JF/rC3VibluQXJ3jcbauiX9sH3j:/U5rCOTeiDU+TUBrlu4J3QLhNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4536 8F5F.tmp 2172 900B.tmp 2204 90C6.tmp 2108 9172.tmp 3136 91FF.tmp 4928 92CA.tmp 3940 93B4.tmp 1720 9451.tmp 2720 94DD.tmp 2580 9579.tmp 2168 9616.tmp 3316 9700.tmp 3228 978D.tmp 1496 980A.tmp 1124 9896.tmp 1776 9933.tmp 920 99FE.tmp 1084 9A8A.tmp 60 9B65.tmp 2512 9BE2.tmp 788 9CAD.tmp 704 9D59.tmp 5116 9E53.tmp 4780 9F0F.tmp 1996 9FDA.tmp 3768 A095.tmp 1952 A170.tmp 4592 A20C.tmp 2136 A27A.tmp 5012 A364.tmp 1160 A43F.tmp 3424 A529.tmp 3808 A633.tmp 3460 A690.tmp 1900 A70D.tmp 1808 A7AA.tmp 3492 A836.tmp 5000 A8C3.tmp 3192 A950.tmp 4364 A9DC.tmp 2780 AA78.tmp 1740 AB24.tmp 3500 AC4D.tmp 1120 ACCA.tmp 2268 AD66.tmp 396 ADF3.tmp 1444 AE70.tmp 1348 AEFD.tmp 4692 AF6A.tmp 2204 AFE7.tmp 1560 B083.tmp 2108 B100.tmp 2756 B17D.tmp 3320 B1EB.tmp 4696 B277.tmp 4112 B314.tmp 468 B3B0.tmp 3696 B43C.tmp 5024 B4B9.tmp 748 B546.tmp 2816 B5B3.tmp 4972 B630.tmp 1940 B6AD.tmp 2580 B72A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3692 wrote to memory of 4536 3692 2023-08-22_90e534176d118fde8a12a14053e91e66_mafia_JC.exe 85 PID 3692 wrote to memory of 4536 3692 2023-08-22_90e534176d118fde8a12a14053e91e66_mafia_JC.exe 85 PID 3692 wrote to memory of 4536 3692 2023-08-22_90e534176d118fde8a12a14053e91e66_mafia_JC.exe 85 PID 4536 wrote to memory of 2172 4536 8F5F.tmp 86 PID 4536 wrote to memory of 2172 4536 8F5F.tmp 86 PID 4536 wrote to memory of 2172 4536 8F5F.tmp 86 PID 2172 wrote to memory of 2204 2172 900B.tmp 87 PID 2172 wrote to memory of 2204 2172 900B.tmp 87 PID 2172 wrote to memory of 2204 2172 900B.tmp 87 PID 2204 wrote to memory of 2108 2204 90C6.tmp 88 PID 2204 wrote to memory of 2108 2204 90C6.tmp 88 PID 2204 wrote to memory of 2108 2204 90C6.tmp 88 PID 2108 wrote to memory of 3136 2108 9172.tmp 89 PID 2108 wrote to memory of 3136 2108 9172.tmp 89 PID 2108 wrote to memory of 3136 2108 9172.tmp 89 PID 3136 wrote to memory of 4928 3136 91FF.tmp 90 PID 3136 wrote to memory of 4928 3136 91FF.tmp 90 PID 3136 wrote to memory of 4928 3136 91FF.tmp 90 PID 4928 wrote to memory of 3940 4928 92CA.tmp 91 PID 4928 wrote to memory of 3940 4928 92CA.tmp 91 PID 4928 wrote to memory of 3940 4928 92CA.tmp 91 PID 3940 wrote to memory of 1720 3940 93B4.tmp 92 PID 3940 wrote to memory of 1720 3940 93B4.tmp 92 PID 3940 wrote to memory of 1720 3940 93B4.tmp 92 PID 1720 wrote to memory of 2720 1720 9451.tmp 93 PID 1720 wrote to memory of 2720 1720 9451.tmp 93 PID 1720 wrote to memory of 2720 1720 9451.tmp 93 PID 2720 wrote to memory of 2580 2720 94DD.tmp 94 PID 2720 wrote to memory of 2580 2720 94DD.tmp 94 PID 2720 wrote to memory of 2580 2720 94DD.tmp 94 PID 2580 wrote to memory of 2168 2580 9579.tmp 95 PID 2580 wrote to memory of 2168 2580 9579.tmp 95 PID 2580 wrote to memory of 2168 2580 9579.tmp 95 PID 2168 wrote to memory of 3316 2168 9616.tmp 96 PID 2168 wrote to memory of 3316 2168 9616.tmp 96 PID 2168 wrote to memory of 3316 2168 9616.tmp 96 PID 3316 wrote to memory of 3228 3316 9700.tmp 98 PID 3316 wrote to memory of 3228 3316 9700.tmp 98 PID 3316 wrote to memory of 3228 3316 9700.tmp 98 PID 3228 wrote to memory of 1496 3228 978D.tmp 99 PID 3228 wrote to memory of 1496 3228 978D.tmp 99 PID 3228 wrote to memory of 1496 3228 978D.tmp 99 PID 1496 wrote to memory of 1124 1496 980A.tmp 100 PID 1496 wrote to memory of 1124 1496 980A.tmp 100 PID 1496 wrote to memory of 1124 1496 980A.tmp 100 PID 1124 wrote to memory of 1776 1124 9896.tmp 101 PID 1124 wrote to memory of 1776 1124 9896.tmp 101 PID 1124 wrote to memory of 1776 1124 9896.tmp 101 PID 1776 wrote to memory of 920 1776 9933.tmp 102 PID 1776 wrote to memory of 920 1776 9933.tmp 102 PID 1776 wrote to memory of 920 1776 9933.tmp 102 PID 920 wrote to memory of 1084 920 99FE.tmp 104 PID 920 wrote to memory of 1084 920 99FE.tmp 104 PID 920 wrote to memory of 1084 920 99FE.tmp 104 PID 1084 wrote to memory of 60 1084 9A8A.tmp 105 PID 1084 wrote to memory of 60 1084 9A8A.tmp 105 PID 1084 wrote to memory of 60 1084 9A8A.tmp 105 PID 60 wrote to memory of 2512 60 9B65.tmp 106 PID 60 wrote to memory of 2512 60 9B65.tmp 106 PID 60 wrote to memory of 2512 60 9B65.tmp 106 PID 2512 wrote to memory of 788 2512 9BE2.tmp 107 PID 2512 wrote to memory of 788 2512 9BE2.tmp 107 PID 2512 wrote to memory of 788 2512 9BE2.tmp 107 PID 788 wrote to memory of 704 788 9CAD.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-22_90e534176d118fde8a12a14053e91e66_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-22_90e534176d118fde8a12a14053e91e66_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\900B.tmp"C:\Users\Admin\AppData\Local\Temp\900B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\92CA.tmp"C:\Users\Admin\AppData\Local\Temp\92CA.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\93B4.tmp"C:\Users\Admin\AppData\Local\Temp\93B4.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\9451.tmp"C:\Users\Admin\AppData\Local\Temp\9451.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\94DD.tmp"C:\Users\Admin\AppData\Local\Temp\94DD.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\9579.tmp"C:\Users\Admin\AppData\Local\Temp\9579.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\9700.tmp"C:\Users\Admin\AppData\Local\Temp\9700.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\978D.tmp"C:\Users\Admin\AppData\Local\Temp\978D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\9896.tmp"C:\Users\Admin\AppData\Local\Temp\9896.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Users\Admin\AppData\Local\Temp\9D59.tmp"C:\Users\Admin\AppData\Local\Temp\9D59.tmp"23⤵
- Executes dropped EXE
PID:704 -
C:\Users\Admin\AppData\Local\Temp\9E53.tmp"C:\Users\Admin\AppData\Local\Temp\9E53.tmp"24⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"25⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"26⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\A095.tmp"C:\Users\Admin\AppData\Local\Temp\A095.tmp"27⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"28⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\A20C.tmp"C:\Users\Admin\AppData\Local\Temp\A20C.tmp"29⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"30⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\A364.tmp"C:\Users\Admin\AppData\Local\Temp\A364.tmp"31⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\A43F.tmp"C:\Users\Admin\AppData\Local\Temp\A43F.tmp"32⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"33⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\A633.tmp"C:\Users\Admin\AppData\Local\Temp\A633.tmp"34⤵
- Executes dropped EXE
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"35⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"36⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"37⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\A836.tmp"C:\Users\Admin\AppData\Local\Temp\A836.tmp"38⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"39⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\A950.tmp"C:\Users\Admin\AppData\Local\Temp\A950.tmp"40⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"41⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"42⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"43⤵
- Executes dropped EXE
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"44⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"45⤵
- Executes dropped EXE
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"46⤵
- Executes dropped EXE
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\AD66.tmp"C:\Users\Admin\AppData\Local\Temp\AD66.tmp"47⤵
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"48⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\AE70.tmp"C:\Users\Admin\AppData\Local\Temp\AE70.tmp"49⤵
- Executes dropped EXE
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"50⤵
- Executes dropped EXE
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"51⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"52⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\B083.tmp"C:\Users\Admin\AppData\Local\Temp\B083.tmp"53⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\B100.tmp"C:\Users\Admin\AppData\Local\Temp\B100.tmp"54⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\B17D.tmp"C:\Users\Admin\AppData\Local\Temp\B17D.tmp"55⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"56⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\B277.tmp"C:\Users\Admin\AppData\Local\Temp\B277.tmp"57⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\B314.tmp"C:\Users\Admin\AppData\Local\Temp\B314.tmp"58⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"59⤵
- Executes dropped EXE
PID:468 -
C:\Users\Admin\AppData\Local\Temp\B43C.tmp"C:\Users\Admin\AppData\Local\Temp\B43C.tmp"60⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"61⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\B546.tmp"C:\Users\Admin\AppData\Local\Temp\B546.tmp"62⤵
- Executes dropped EXE
PID:748 -
C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"63⤵
- Executes dropped EXE
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"64⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"65⤵
- Executes dropped EXE
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\B72A.tmp"C:\Users\Admin\AppData\Local\Temp\B72A.tmp"66⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"67⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\B853.tmp"C:\Users\Admin\AppData\Local\Temp\B853.tmp"68⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"69⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\B97C.tmp"C:\Users\Admin\AppData\Local\Temp\B97C.tmp"70⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\BA09.tmp"C:\Users\Admin\AppData\Local\Temp\BA09.tmp"71⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\BA95.tmp"C:\Users\Admin\AppData\Local\Temp\BA95.tmp"72⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\BB03.tmp"C:\Users\Admin\AppData\Local\Temp\BB03.tmp"73⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\BB80.tmp"C:\Users\Admin\AppData\Local\Temp\BB80.tmp"74⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"75⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\BC99.tmp"C:\Users\Admin\AppData\Local\Temp\BC99.tmp"76⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\BD26.tmp"C:\Users\Admin\AppData\Local\Temp\BD26.tmp"77⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"78⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\BE10.tmp"C:\Users\Admin\AppData\Local\Temp\BE10.tmp"79⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"80⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\BF29.tmp"C:\Users\Admin\AppData\Local\Temp\BF29.tmp"81⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"82⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\C023.tmp"C:\Users\Admin\AppData\Local\Temp\C023.tmp"83⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"84⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"85⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"86⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"87⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\C311.tmp"C:\Users\Admin\AppData\Local\Temp\C311.tmp"88⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\C39E.tmp"C:\Users\Admin\AppData\Local\Temp\C39E.tmp"89⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\C43A.tmp"C:\Users\Admin\AppData\Local\Temp\C43A.tmp"90⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"91⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\C563.tmp"C:\Users\Admin\AppData\Local\Temp\C563.tmp"92⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\C61F.tmp"C:\Users\Admin\AppData\Local\Temp\C61F.tmp"93⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"94⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\C728.tmp"C:\Users\Admin\AppData\Local\Temp\C728.tmp"95⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"96⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\C880.tmp"C:\Users\Admin\AppData\Local\Temp\C880.tmp"97⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\C8ED.tmp"C:\Users\Admin\AppData\Local\Temp\C8ED.tmp"98⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\C97A.tmp"C:\Users\Admin\AppData\Local\Temp\C97A.tmp"99⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\CA07.tmp"C:\Users\Admin\AppData\Local\Temp\CA07.tmp"100⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\CA93.tmp"C:\Users\Admin\AppData\Local\Temp\CA93.tmp"101⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\CB10.tmp"C:\Users\Admin\AppData\Local\Temp\CB10.tmp"102⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"103⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\CC29.tmp"C:\Users\Admin\AppData\Local\Temp\CC29.tmp"104⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\CCC6.tmp"C:\Users\Admin\AppData\Local\Temp\CCC6.tmp"105⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\CD62.tmp"C:\Users\Admin\AppData\Local\Temp\CD62.tmp"106⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"107⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"108⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\CF08.tmp"C:\Users\Admin\AppData\Local\Temp\CF08.tmp"109⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\CF94.tmp"C:\Users\Admin\AppData\Local\Temp\CF94.tmp"110⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\D031.tmp"C:\Users\Admin\AppData\Local\Temp\D031.tmp"111⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"112⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\D169.tmp"C:\Users\Admin\AppData\Local\Temp\D169.tmp"113⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\D215.tmp"C:\Users\Admin\AppData\Local\Temp\D215.tmp"114⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\D2A2.tmp"C:\Users\Admin\AppData\Local\Temp\D2A2.tmp"115⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\D486.tmp"C:\Users\Admin\AppData\Local\Temp\D486.tmp"116⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\D522.tmp"C:\Users\Admin\AppData\Local\Temp\D522.tmp"117⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"118⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\D65B.tmp"C:\Users\Admin\AppData\Local\Temp\D65B.tmp"119⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\D6E7.tmp"C:\Users\Admin\AppData\Local\Temp\D6E7.tmp"120⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\D793.tmp"C:\Users\Admin\AppData\Local\Temp\D793.tmp"121⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\D810.tmp"C:\Users\Admin\AppData\Local\Temp\D810.tmp"122⤵PID:1736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-