Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18-08-2023 14:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
29dbf2e4c144cd27aef721f620801efc_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
29dbf2e4c144cd27aef721f620801efc_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
29dbf2e4c144cd27aef721f620801efc_mafia_JC.exe
-
Size
527KB
-
MD5
29dbf2e4c144cd27aef721f620801efc
-
SHA1
df5513032bee20f4c805b079bc029aef6d2ed1fc
-
SHA256
86d7f5bf3e22d278f5f6a895133fb5fb23a87cd5865807bfe6efef3fb997db9f
-
SHA512
eaddb9ca80f92b4a3b93dc0be6819b37a668da262d8644db7ee7e2cef293bc4ff599e42263ae55475af87c32f798be9b94ae5bf2f7b40e405fd19c472f78b345
-
SSDEEP
6144:yorf3lPvovsgZnqG2C7mOTeiLRDYhYzRgCpdvdYl7Mg+3fIRi/fuZ0txIG3NVhe7:fU5rCOTeidhVhvdMMWU/y0thcX4DZu
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1144 ED00.tmp 4476 EE77.tmp 1468 EF23.tmp 3736 EFEE.tmp 1016 F0D8.tmp 2196 F1C2.tmp 4084 F2AD.tmp 2840 F388.tmp 1512 F453.tmp 4888 F51E.tmp 3384 F637.tmp 4980 F712.tmp 1460 F80C.tmp 1600 F8A8.tmp 4752 F992.tmp 2056 FA3E.tmp 2272 FB09.tmp 4628 FBD5.tmp 5008 FC52.tmp 5036 FD0D.tmp 3824 FDC9.tmp 5104 FE74.tmp 3428 FEF1.tmp 2192 FFDC.tmp 2908 78.tmp 2564 143.tmp 4432 1EF.tmp 3912 2BA.tmp 1404 366.tmp 3836 422.tmp 3944 49F.tmp 4276 599.tmp 3100 664.tmp 1536 71F.tmp 908 7AC.tmp 968 838.tmp 912 8C5.tmp 3308 9AF.tmp 5000 A2C.tmp 4132 AC9.tmp 2156 B46.tmp 2880 BF2.tmp 736 C6F.tmp 4672 CFB.tmp 1636 D97.tmp 2856 E43.tmp 4460 EEF.tmp 3552 F8B.tmp 4412 1008.tmp 1052 1076.tmp 2436 1112.tmp 1268 11BE.tmp 552 125A.tmp 2456 1306.tmp 4232 1383.tmp 3020 13F0.tmp 4164 148D.tmp 2784 1529.tmp 4944 15A6.tmp 1344 1642.tmp 2060 16B0.tmp 2972 173C.tmp 1016 17C9.tmp 2584 1836.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1280 wrote to memory of 1144 1280 29dbf2e4c144cd27aef721f620801efc_mafia_JC.exe 80 PID 1280 wrote to memory of 1144 1280 29dbf2e4c144cd27aef721f620801efc_mafia_JC.exe 80 PID 1280 wrote to memory of 1144 1280 29dbf2e4c144cd27aef721f620801efc_mafia_JC.exe 80 PID 1144 wrote to memory of 4476 1144 ED00.tmp 81 PID 1144 wrote to memory of 4476 1144 ED00.tmp 81 PID 1144 wrote to memory of 4476 1144 ED00.tmp 81 PID 4476 wrote to memory of 1468 4476 EE77.tmp 82 PID 4476 wrote to memory of 1468 4476 EE77.tmp 82 PID 4476 wrote to memory of 1468 4476 EE77.tmp 82 PID 1468 wrote to memory of 3736 1468 EF23.tmp 83 PID 1468 wrote to memory of 3736 1468 EF23.tmp 83 PID 1468 wrote to memory of 3736 1468 EF23.tmp 83 PID 3736 wrote to memory of 1016 3736 EFEE.tmp 84 PID 3736 wrote to memory of 1016 3736 EFEE.tmp 84 PID 3736 wrote to memory of 1016 3736 EFEE.tmp 84 PID 1016 wrote to memory of 2196 1016 F0D8.tmp 85 PID 1016 wrote to memory of 2196 1016 F0D8.tmp 85 PID 1016 wrote to memory of 2196 1016 F0D8.tmp 85 PID 2196 wrote to memory of 4084 2196 F1C2.tmp 86 PID 2196 wrote to memory of 4084 2196 F1C2.tmp 86 PID 2196 wrote to memory of 4084 2196 F1C2.tmp 86 PID 4084 wrote to memory of 2840 4084 F2AD.tmp 87 PID 4084 wrote to memory of 2840 4084 F2AD.tmp 87 PID 4084 wrote to memory of 2840 4084 F2AD.tmp 87 PID 2840 wrote to memory of 1512 2840 F388.tmp 88 PID 2840 wrote to memory of 1512 2840 F388.tmp 88 PID 2840 wrote to memory of 1512 2840 F388.tmp 88 PID 1512 wrote to memory of 4888 1512 F453.tmp 89 PID 1512 wrote to memory of 4888 1512 F453.tmp 89 PID 1512 wrote to memory of 4888 1512 F453.tmp 89 PID 4888 wrote to memory of 3384 4888 F51E.tmp 90 PID 4888 wrote to memory of 3384 4888 F51E.tmp 90 PID 4888 wrote to memory of 3384 4888 F51E.tmp 90 PID 3384 wrote to memory of 4980 3384 F637.tmp 91 PID 3384 wrote to memory of 4980 3384 F637.tmp 91 PID 3384 wrote to memory of 4980 3384 F637.tmp 91 PID 4980 wrote to memory of 1460 4980 F712.tmp 92 PID 4980 wrote to memory of 1460 4980 F712.tmp 92 PID 4980 wrote to memory of 1460 4980 F712.tmp 92 PID 1460 wrote to memory of 1600 1460 F80C.tmp 93 PID 1460 wrote to memory of 1600 1460 F80C.tmp 93 PID 1460 wrote to memory of 1600 1460 F80C.tmp 93 PID 1600 wrote to memory of 4752 1600 F8A8.tmp 94 PID 1600 wrote to memory of 4752 1600 F8A8.tmp 94 PID 1600 wrote to memory of 4752 1600 F8A8.tmp 94 PID 4752 wrote to memory of 2056 4752 F992.tmp 96 PID 4752 wrote to memory of 2056 4752 F992.tmp 96 PID 4752 wrote to memory of 2056 4752 F992.tmp 96 PID 2056 wrote to memory of 2272 2056 FA3E.tmp 97 PID 2056 wrote to memory of 2272 2056 FA3E.tmp 97 PID 2056 wrote to memory of 2272 2056 FA3E.tmp 97 PID 2272 wrote to memory of 4628 2272 FB09.tmp 98 PID 2272 wrote to memory of 4628 2272 FB09.tmp 98 PID 2272 wrote to memory of 4628 2272 FB09.tmp 98 PID 4628 wrote to memory of 5008 4628 FBD5.tmp 99 PID 4628 wrote to memory of 5008 4628 FBD5.tmp 99 PID 4628 wrote to memory of 5008 4628 FBD5.tmp 99 PID 5008 wrote to memory of 5036 5008 FC52.tmp 100 PID 5008 wrote to memory of 5036 5008 FC52.tmp 100 PID 5008 wrote to memory of 5036 5008 FC52.tmp 100 PID 5036 wrote to memory of 3824 5036 FD0D.tmp 101 PID 5036 wrote to memory of 3824 5036 FD0D.tmp 101 PID 5036 wrote to memory of 3824 5036 FD0D.tmp 101 PID 3824 wrote to memory of 5104 3824 FDC9.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\29dbf2e4c144cd27aef721f620801efc_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\29dbf2e4c144cd27aef721f620801efc_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\ED00.tmp"C:\Users\Admin\AppData\Local\Temp\ED00.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\EE77.tmp"C:\Users\Admin\AppData\Local\Temp\EE77.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\EF23.tmp"C:\Users\Admin\AppData\Local\Temp\EF23.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\EFEE.tmp"C:\Users\Admin\AppData\Local\Temp\EFEE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\F2AD.tmp"C:\Users\Admin\AppData\Local\Temp\F2AD.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\F388.tmp"C:\Users\Admin\AppData\Local\Temp\F388.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\F453.tmp"C:\Users\Admin\AppData\Local\Temp\F453.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\F51E.tmp"C:\Users\Admin\AppData\Local\Temp\F51E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\F637.tmp"C:\Users\Admin\AppData\Local\Temp\F637.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\F712.tmp"C:\Users\Admin\AppData\Local\Temp\F712.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\F80C.tmp"C:\Users\Admin\AppData\Local\Temp\F80C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\F992.tmp"C:\Users\Admin\AppData\Local\Temp\F992.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\FA3E.tmp"C:\Users\Admin\AppData\Local\Temp\FA3E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\FB09.tmp"C:\Users\Admin\AppData\Local\Temp\FB09.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\FC52.tmp"C:\Users\Admin\AppData\Local\Temp\FC52.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\FE74.tmp"C:\Users\Admin\AppData\Local\Temp\FE74.tmp"23⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"24⤵
- Executes dropped EXE
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"25⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\78.tmp"C:\Users\Admin\AppData\Local\Temp\78.tmp"26⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\143.tmp"C:\Users\Admin\AppData\Local\Temp\143.tmp"27⤵
- Executes dropped EXE
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\1EF.tmp"C:\Users\Admin\AppData\Local\Temp\1EF.tmp"28⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\2BA.tmp"C:\Users\Admin\AppData\Local\Temp\2BA.tmp"29⤵
- Executes dropped EXE
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\366.tmp"C:\Users\Admin\AppData\Local\Temp\366.tmp"30⤵
- Executes dropped EXE
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\422.tmp"C:\Users\Admin\AppData\Local\Temp\422.tmp"31⤵
- Executes dropped EXE
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\49F.tmp"C:\Users\Admin\AppData\Local\Temp\49F.tmp"32⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\599.tmp"C:\Users\Admin\AppData\Local\Temp\599.tmp"33⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\664.tmp"C:\Users\Admin\AppData\Local\Temp\664.tmp"34⤵
- Executes dropped EXE
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\71F.tmp"C:\Users\Admin\AppData\Local\Temp\71F.tmp"35⤵
- Executes dropped EXE
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\7AC.tmp"C:\Users\Admin\AppData\Local\Temp\7AC.tmp"36⤵
- Executes dropped EXE
PID:908 -
C:\Users\Admin\AppData\Local\Temp\838.tmp"C:\Users\Admin\AppData\Local\Temp\838.tmp"37⤵
- Executes dropped EXE
PID:968 -
C:\Users\Admin\AppData\Local\Temp\8C5.tmp"C:\Users\Admin\AppData\Local\Temp\8C5.tmp"38⤵
- Executes dropped EXE
PID:912 -
C:\Users\Admin\AppData\Local\Temp\9AF.tmp"C:\Users\Admin\AppData\Local\Temp\9AF.tmp"39⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\A2C.tmp"C:\Users\Admin\AppData\Local\Temp\A2C.tmp"40⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\AC9.tmp"C:\Users\Admin\AppData\Local\Temp\AC9.tmp"41⤵
- Executes dropped EXE
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\B46.tmp"C:\Users\Admin\AppData\Local\Temp\B46.tmp"42⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"43⤵
- Executes dropped EXE
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"44⤵
- Executes dropped EXE
PID:736 -
C:\Users\Admin\AppData\Local\Temp\CFB.tmp"C:\Users\Admin\AppData\Local\Temp\CFB.tmp"45⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\D97.tmp"C:\Users\Admin\AppData\Local\Temp\D97.tmp"46⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\E43.tmp"C:\Users\Admin\AppData\Local\Temp\E43.tmp"47⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\EEF.tmp"C:\Users\Admin\AppData\Local\Temp\EEF.tmp"48⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"49⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"50⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\1076.tmp"C:\Users\Admin\AppData\Local\Temp\1076.tmp"51⤵
- Executes dropped EXE
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\1112.tmp"C:\Users\Admin\AppData\Local\Temp\1112.tmp"52⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\11BE.tmp"C:\Users\Admin\AppData\Local\Temp\11BE.tmp"53⤵
- Executes dropped EXE
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\125A.tmp"C:\Users\Admin\AppData\Local\Temp\125A.tmp"54⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\1306.tmp"C:\Users\Admin\AppData\Local\Temp\1306.tmp"55⤵
- Executes dropped EXE
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\1383.tmp"C:\Users\Admin\AppData\Local\Temp\1383.tmp"56⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\13F0.tmp"C:\Users\Admin\AppData\Local\Temp\13F0.tmp"57⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\148D.tmp"C:\Users\Admin\AppData\Local\Temp\148D.tmp"58⤵
- Executes dropped EXE
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\1529.tmp"C:\Users\Admin\AppData\Local\Temp\1529.tmp"59⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\15A6.tmp"C:\Users\Admin\AppData\Local\Temp\15A6.tmp"60⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\1642.tmp"C:\Users\Admin\AppData\Local\Temp\1642.tmp"61⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\16B0.tmp"C:\Users\Admin\AppData\Local\Temp\16B0.tmp"62⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\173C.tmp"C:\Users\Admin\AppData\Local\Temp\173C.tmp"63⤵
- Executes dropped EXE
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\17C9.tmp"C:\Users\Admin\AppData\Local\Temp\17C9.tmp"64⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\1836.tmp"C:\Users\Admin\AppData\Local\Temp\1836.tmp"65⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\1901.tmp"C:\Users\Admin\AppData\Local\Temp\1901.tmp"66⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\199E.tmp"C:\Users\Admin\AppData\Local\Temp\199E.tmp"67⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\1A59.tmp"C:\Users\Admin\AppData\Local\Temp\1A59.tmp"68⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"69⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\1B72.tmp"C:\Users\Admin\AppData\Local\Temp\1B72.tmp"70⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\1C0F.tmp"C:\Users\Admin\AppData\Local\Temp\1C0F.tmp"71⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"72⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\1D28.tmp"C:\Users\Admin\AppData\Local\Temp\1D28.tmp"73⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\1DA5.tmp"C:\Users\Admin\AppData\Local\Temp\1DA5.tmp"74⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\1E60.tmp"C:\Users\Admin\AppData\Local\Temp\1E60.tmp"75⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\1EDD.tmp"C:\Users\Admin\AppData\Local\Temp\1EDD.tmp"76⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\1F99.tmp"C:\Users\Admin\AppData\Local\Temp\1F99.tmp"77⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\2016.tmp"C:\Users\Admin\AppData\Local\Temp\2016.tmp"78⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\20B2.tmp"C:\Users\Admin\AppData\Local\Temp\20B2.tmp"79⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\213F.tmp"C:\Users\Admin\AppData\Local\Temp\213F.tmp"80⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\21CB.tmp"C:\Users\Admin\AppData\Local\Temp\21CB.tmp"81⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\2258.tmp"C:\Users\Admin\AppData\Local\Temp\2258.tmp"82⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\22D5.tmp"C:\Users\Admin\AppData\Local\Temp\22D5.tmp"83⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\2342.tmp"C:\Users\Admin\AppData\Local\Temp\2342.tmp"84⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\23B0.tmp"C:\Users\Admin\AppData\Local\Temp\23B0.tmp"85⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\246B.tmp"C:\Users\Admin\AppData\Local\Temp\246B.tmp"86⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\24E8.tmp"C:\Users\Admin\AppData\Local\Temp\24E8.tmp"87⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\2565.tmp"C:\Users\Admin\AppData\Local\Temp\2565.tmp"88⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\2650.tmp"C:\Users\Admin\AppData\Local\Temp\2650.tmp"89⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\26BD.tmp"C:\Users\Admin\AppData\Local\Temp\26BD.tmp"90⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\274A.tmp"C:\Users\Admin\AppData\Local\Temp\274A.tmp"91⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\27E6.tmp"C:\Users\Admin\AppData\Local\Temp\27E6.tmp"92⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\2853.tmp"C:\Users\Admin\AppData\Local\Temp\2853.tmp"93⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\28FF.tmp"C:\Users\Admin\AppData\Local\Temp\28FF.tmp"94⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\297C.tmp"C:\Users\Admin\AppData\Local\Temp\297C.tmp"95⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\29F9.tmp"C:\Users\Admin\AppData\Local\Temp\29F9.tmp"96⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\2A76.tmp"C:\Users\Admin\AppData\Local\Temp\2A76.tmp"97⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\2B12.tmp"C:\Users\Admin\AppData\Local\Temp\2B12.tmp"98⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"99⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\2C0C.tmp"C:\Users\Admin\AppData\Local\Temp\2C0C.tmp"100⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\2C7A.tmp"C:\Users\Admin\AppData\Local\Temp\2C7A.tmp"101⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"102⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\2D64.tmp"C:\Users\Admin\AppData\Local\Temp\2D64.tmp"103⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\2E00.tmp"C:\Users\Admin\AppData\Local\Temp\2E00.tmp"104⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\2E6E.tmp"C:\Users\Admin\AppData\Local\Temp\2E6E.tmp"105⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\2EEB.tmp"C:\Users\Admin\AppData\Local\Temp\2EEB.tmp"106⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\2F87.tmp"C:\Users\Admin\AppData\Local\Temp\2F87.tmp"107⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\3014.tmp"C:\Users\Admin\AppData\Local\Temp\3014.tmp"108⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\30A0.tmp"C:\Users\Admin\AppData\Local\Temp\30A0.tmp"109⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\311D.tmp"C:\Users\Admin\AppData\Local\Temp\311D.tmp"110⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\319A.tmp"C:\Users\Admin\AppData\Local\Temp\319A.tmp"111⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"112⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\3275.tmp"C:\Users\Admin\AppData\Local\Temp\3275.tmp"113⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\3311.tmp"C:\Users\Admin\AppData\Local\Temp\3311.tmp"114⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"115⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"116⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"117⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\34F6.tmp"C:\Users\Admin\AppData\Local\Temp\34F6.tmp"118⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\3573.tmp"C:\Users\Admin\AppData\Local\Temp\3573.tmp"119⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\362E.tmp"C:\Users\Admin\AppData\Local\Temp\362E.tmp"120⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\36BB.tmp"C:\Users\Admin\AppData\Local\Temp\36BB.tmp"121⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\3738.tmp"C:\Users\Admin\AppData\Local\Temp\3738.tmp"122⤵PID:3080
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-