Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
04-09-2023 16:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2023-08-23_64087ed8d0fed17db25481398a60589d_mafia_JC.exe
Resource
win7-20230831-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2023-08-23_64087ed8d0fed17db25481398a60589d_mafia_JC.exe
Resource
win10v2004-20230831-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2023-08-23_64087ed8d0fed17db25481398a60589d_mafia_JC.exe
-
Size
486KB
-
MD5
64087ed8d0fed17db25481398a60589d
-
SHA1
2976f9514238184587aae87ec97742a0146ba6cc
-
SHA256
b113971b6d58ea931db446ea3797bd14bbc1e08ddd2716bd7f4dd156d3b049bb
-
SHA512
f88b1773f605945b8972fec6ffe6794049c2d6d92d3590ef82708b4acb1a98cde785d9e82a5b7ae2b827d826080e805c70ac0a3df57b2cf892cd56c773fdb1e6
-
SSDEEP
12288:UU5rCOTeiDczSKqtp2dzq/dCPNLSQvNZ:UUQOJDczSYdzqlCPUQvN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 112 5E7B.tmp 3480 5F18.tmp 2592 5FB4.tmp 4408 607F.tmp 4784 610C.tmp 4176 61E6.tmp 4236 6283.tmp 2300 630F.tmp 3288 63CB.tmp 3996 6496.tmp 3504 6532.tmp 4300 65AF.tmp 824 663C.tmp 4168 6707.tmp 4144 67C2.tmp 2692 68CC.tmp 4968 6968.tmp 5100 6A14.tmp 1336 6A91.tmp 2780 6B7B.tmp 4972 6C66.tmp 1936 6D8F.tmp 5116 6E5A.tmp 3664 6F25.tmp 3744 6FB2.tmp 4440 706D.tmp 2028 7138.tmp 3024 7242.tmp 1648 72FD.tmp 3056 7407.tmp 908 74D2.tmp 904 757E.tmp 1844 7639.tmp 1352 76B6.tmp 2928 7743.tmp 3876 77D0.tmp 5112 783D.tmp 1692 78CA.tmp 3960 7947.tmp 2824 79F3.tmp 4828 7A7F.tmp 2724 7B0C.tmp 4548 7B98.tmp 2152 7C35.tmp 4152 7CC1.tmp 4824 7D5E.tmp 2208 7DEA.tmp 4128 7E67.tmp 2616 7F13.tmp 3048 7FA0.tmp 4580 801D.tmp 776 80C9.tmp 2612 8146.tmp 1400 81B3.tmp 3708 824F.tmp 4248 82EB.tmp 3352 8368.tmp 4272 83D6.tmp 4220 8472.tmp 3608 84FF.tmp 1004 858B.tmp 1156 8618.tmp 3644 86A5.tmp 3288 8741.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 792 wrote to memory of 112 792 2023-08-23_64087ed8d0fed17db25481398a60589d_mafia_JC.exe 87 PID 792 wrote to memory of 112 792 2023-08-23_64087ed8d0fed17db25481398a60589d_mafia_JC.exe 87 PID 792 wrote to memory of 112 792 2023-08-23_64087ed8d0fed17db25481398a60589d_mafia_JC.exe 87 PID 112 wrote to memory of 3480 112 5E7B.tmp 88 PID 112 wrote to memory of 3480 112 5E7B.tmp 88 PID 112 wrote to memory of 3480 112 5E7B.tmp 88 PID 3480 wrote to memory of 2592 3480 5F18.tmp 89 PID 3480 wrote to memory of 2592 3480 5F18.tmp 89 PID 3480 wrote to memory of 2592 3480 5F18.tmp 89 PID 2592 wrote to memory of 4408 2592 5FB4.tmp 90 PID 2592 wrote to memory of 4408 2592 5FB4.tmp 90 PID 2592 wrote to memory of 4408 2592 5FB4.tmp 90 PID 4408 wrote to memory of 4784 4408 607F.tmp 91 PID 4408 wrote to memory of 4784 4408 607F.tmp 91 PID 4408 wrote to memory of 4784 4408 607F.tmp 91 PID 4784 wrote to memory of 4176 4784 610C.tmp 92 PID 4784 wrote to memory of 4176 4784 610C.tmp 92 PID 4784 wrote to memory of 4176 4784 610C.tmp 92 PID 4176 wrote to memory of 4236 4176 61E6.tmp 93 PID 4176 wrote to memory of 4236 4176 61E6.tmp 93 PID 4176 wrote to memory of 4236 4176 61E6.tmp 93 PID 4236 wrote to memory of 2300 4236 6283.tmp 94 PID 4236 wrote to memory of 2300 4236 6283.tmp 94 PID 4236 wrote to memory of 2300 4236 6283.tmp 94 PID 2300 wrote to memory of 3288 2300 630F.tmp 95 PID 2300 wrote to memory of 3288 2300 630F.tmp 95 PID 2300 wrote to memory of 3288 2300 630F.tmp 95 PID 3288 wrote to memory of 3996 3288 63CB.tmp 96 PID 3288 wrote to memory of 3996 3288 63CB.tmp 96 PID 3288 wrote to memory of 3996 3288 63CB.tmp 96 PID 3996 wrote to memory of 3504 3996 6496.tmp 97 PID 3996 wrote to memory of 3504 3996 6496.tmp 97 PID 3996 wrote to memory of 3504 3996 6496.tmp 97 PID 3504 wrote to memory of 4300 3504 6532.tmp 98 PID 3504 wrote to memory of 4300 3504 6532.tmp 98 PID 3504 wrote to memory of 4300 3504 6532.tmp 98 PID 4300 wrote to memory of 824 4300 65AF.tmp 99 PID 4300 wrote to memory of 824 4300 65AF.tmp 99 PID 4300 wrote to memory of 824 4300 65AF.tmp 99 PID 824 wrote to memory of 4168 824 663C.tmp 100 PID 824 wrote to memory of 4168 824 663C.tmp 100 PID 824 wrote to memory of 4168 824 663C.tmp 100 PID 4168 wrote to memory of 4144 4168 6707.tmp 102 PID 4168 wrote to memory of 4144 4168 6707.tmp 102 PID 4168 wrote to memory of 4144 4168 6707.tmp 102 PID 4144 wrote to memory of 2692 4144 67C2.tmp 103 PID 4144 wrote to memory of 2692 4144 67C2.tmp 103 PID 4144 wrote to memory of 2692 4144 67C2.tmp 103 PID 2692 wrote to memory of 4968 2692 68CC.tmp 104 PID 2692 wrote to memory of 4968 2692 68CC.tmp 104 PID 2692 wrote to memory of 4968 2692 68CC.tmp 104 PID 4968 wrote to memory of 5100 4968 6968.tmp 106 PID 4968 wrote to memory of 5100 4968 6968.tmp 106 PID 4968 wrote to memory of 5100 4968 6968.tmp 106 PID 5100 wrote to memory of 1336 5100 6A14.tmp 107 PID 5100 wrote to memory of 1336 5100 6A14.tmp 107 PID 5100 wrote to memory of 1336 5100 6A14.tmp 107 PID 1336 wrote to memory of 2780 1336 6A91.tmp 108 PID 1336 wrote to memory of 2780 1336 6A91.tmp 108 PID 1336 wrote to memory of 2780 1336 6A91.tmp 108 PID 2780 wrote to memory of 4972 2780 6B7B.tmp 109 PID 2780 wrote to memory of 4972 2780 6B7B.tmp 109 PID 2780 wrote to memory of 4972 2780 6B7B.tmp 109 PID 4972 wrote to memory of 1936 4972 6C66.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-23_64087ed8d0fed17db25481398a60589d_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-23_64087ed8d0fed17db25481398a60589d_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"23⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"24⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"25⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"26⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"27⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"28⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"29⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"30⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"31⤵
- Executes dropped EXE
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"32⤵
- Executes dropped EXE
PID:908 -
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"33⤵
- Executes dropped EXE
PID:904 -
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"34⤵
- Executes dropped EXE
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"35⤵
- Executes dropped EXE
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\7743.tmp"C:\Users\Admin\AppData\Local\Temp\7743.tmp"36⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"37⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\783D.tmp"C:\Users\Admin\AppData\Local\Temp\783D.tmp"38⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"39⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"40⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"41⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"42⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"43⤵
- Executes dropped EXE
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\7B98.tmp"C:\Users\Admin\AppData\Local\Temp\7B98.tmp"44⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\7C35.tmp"C:\Users\Admin\AppData\Local\Temp\7C35.tmp"45⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"46⤵
- Executes dropped EXE
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"47⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"48⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\7E67.tmp"C:\Users\Admin\AppData\Local\Temp\7E67.tmp"49⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\7F13.tmp"C:\Users\Admin\AppData\Local\Temp\7F13.tmp"50⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"51⤵
- Executes dropped EXE
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\801D.tmp"C:\Users\Admin\AppData\Local\Temp\801D.tmp"52⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\80C9.tmp"C:\Users\Admin\AppData\Local\Temp\80C9.tmp"53⤵
- Executes dropped EXE
PID:776 -
C:\Users\Admin\AppData\Local\Temp\8146.tmp"C:\Users\Admin\AppData\Local\Temp\8146.tmp"54⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\81B3.tmp"C:\Users\Admin\AppData\Local\Temp\81B3.tmp"55⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\824F.tmp"C:\Users\Admin\AppData\Local\Temp\824F.tmp"56⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\82EB.tmp"C:\Users\Admin\AppData\Local\Temp\82EB.tmp"57⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\8368.tmp"C:\Users\Admin\AppData\Local\Temp\8368.tmp"58⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\83D6.tmp"C:\Users\Admin\AppData\Local\Temp\83D6.tmp"59⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\8472.tmp"C:\Users\Admin\AppData\Local\Temp\8472.tmp"60⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\84FF.tmp"C:\Users\Admin\AppData\Local\Temp\84FF.tmp"61⤵
- Executes dropped EXE
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\858B.tmp"C:\Users\Admin\AppData\Local\Temp\858B.tmp"62⤵
- Executes dropped EXE
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\8618.tmp"C:\Users\Admin\AppData\Local\Temp\8618.tmp"63⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\86A5.tmp"C:\Users\Admin\AppData\Local\Temp\86A5.tmp"64⤵
- Executes dropped EXE
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\8741.tmp"C:\Users\Admin\AppData\Local\Temp\8741.tmp"65⤵
- Executes dropped EXE
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\87DD.tmp"C:\Users\Admin\AppData\Local\Temp\87DD.tmp"66⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\886A.tmp"C:\Users\Admin\AppData\Local\Temp\886A.tmp"67⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\88F6.tmp"C:\Users\Admin\AppData\Local\Temp\88F6.tmp"68⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\8973.tmp"C:\Users\Admin\AppData\Local\Temp\8973.tmp"69⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\89F0.tmp"C:\Users\Admin\AppData\Local\Temp\89F0.tmp"70⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"71⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\8B29.tmp"C:\Users\Admin\AppData\Local\Temp\8B29.tmp"72⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"73⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\8C13.tmp"C:\Users\Admin\AppData\Local\Temp\8C13.tmp"74⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"75⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"76⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"77⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\8E55.tmp"C:\Users\Admin\AppData\Local\Temp\8E55.tmp"78⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"79⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"80⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\901A.tmp"C:\Users\Admin\AppData\Local\Temp\901A.tmp"81⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\90B7.tmp"C:\Users\Admin\AppData\Local\Temp\90B7.tmp"82⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\9134.tmp"C:\Users\Admin\AppData\Local\Temp\9134.tmp"83⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\91E0.tmp"C:\Users\Admin\AppData\Local\Temp\91E0.tmp"84⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\924D.tmp"C:\Users\Admin\AppData\Local\Temp\924D.tmp"85⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"86⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"87⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"88⤵PID:328
-
C:\Users\Admin\AppData\Local\Temp\9470.tmp"C:\Users\Admin\AppData\Local\Temp\9470.tmp"89⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\94FC.tmp"C:\Users\Admin\AppData\Local\Temp\94FC.tmp"90⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\9599.tmp"C:\Users\Admin\AppData\Local\Temp\9599.tmp"91⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"92⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"93⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\972F.tmp"C:\Users\Admin\AppData\Local\Temp\972F.tmp"94⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\97BC.tmp"C:\Users\Admin\AppData\Local\Temp\97BC.tmp"95⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\9867.tmp"C:\Users\Admin\AppData\Local\Temp\9867.tmp"96⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\98F4.tmp"C:\Users\Admin\AppData\Local\Temp\98F4.tmp"97⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"98⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"99⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"100⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"101⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"102⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\9C21.tmp"C:\Users\Admin\AppData\Local\Temp\9C21.tmp"103⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"104⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"105⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"106⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"107⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"108⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"109⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"110⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\A047.tmp"C:\Users\Admin\AppData\Local\Temp\A047.tmp"111⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"112⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"113⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\A19F.tmp"C:\Users\Admin\AppData\Local\Temp\A19F.tmp"114⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\A21C.tmp"C:\Users\Admin\AppData\Local\Temp\A21C.tmp"115⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"116⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"117⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"118⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"119⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\A50A.tmp"C:\Users\Admin\AppData\Local\Temp\A50A.tmp"120⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"121⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\A613.tmp"C:\Users\Admin\AppData\Local\Temp\A613.tmp"122⤵PID:1580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-