Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2023, 15:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5c4c6004d34e283424642be288421427_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
5c4c6004d34e283424642be288421427_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
5c4c6004d34e283424642be288421427_mafia_JC.exe
-
Size
520KB
-
MD5
5c4c6004d34e283424642be288421427
-
SHA1
2807b7443a4472b260a6c21f2709e32971313daa
-
SHA256
3b3d64c8d3eeab7d0f42fe9d2535047ed552069f23c1c4466f2183f82969abcc
-
SHA512
c726c2f1355b7856db888e8a5cb344730ef277609909dcd9c1b80727a96642b804f42b83f68f23b073425e65efbdfc019f03727652e43a0b35dfce5b546041d2
-
SSDEEP
6144:lLvd/XzCjUIF1UuXLyQjmOH+JjLviFSsWGhPnUKnptJFaUGFVGsH3dZ:roRXOQjmOyfcBpFrGFVNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3372 F02C.tmp 4992 F1D2.tmp 1904 F2CC.tmp 640 F397.tmp 4252 F443.tmp 3440 F50E.tmp 4976 F5BA.tmp 1716 F6A4.tmp 4776 F7AE.tmp 1136 F84A.tmp 1164 F983.tmp 1892 FB19.tmp 1200 FBD5.tmp 928 FCDE.tmp 3152 FE65.tmp 1508 FF20.tmp 2132 FFFB.tmp 2904 C6.tmp 2368 172.tmp 3408 22E.tmp 1408 2F9.tmp 3068 3A5.tmp 2704 450.tmp 2040 50C.tmp 2708 599.tmp 4228 635.tmp 4828 700.tmp 464 7DB.tmp 4444 8D5.tmp 4780 981.tmp 1380 A1D.tmp 1412 AA9.tmp 4208 B36.tmp 448 BC3.tmp 1044 C30.tmp 4172 C9D.tmp 3340 D1A.tmp 4160 D88.tmp 2156 E14.tmp 776 120C.tmp 4052 1289.tmp 2208 1306.tmp 4440 13A2.tmp 3444 141F.tmp 4396 149C.tmp 3936 1519.tmp 2212 1587.tmp 208 1613.tmp 4688 1681.tmp 400 16EE.tmp 4528 175B.tmp 5088 17E8.tmp 4768 18F2.tmp 5048 197E.tmp 3692 1A1B.tmp 1888 1A98.tmp 4272 1B43.tmp 3852 1BB1.tmp 3332 1C3D.tmp 1884 1CDA.tmp 1368 1D76.tmp 3200 1DF3.tmp 224 1EBE.tmp 4736 1F4B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3004 wrote to memory of 3372 3004 5c4c6004d34e283424642be288421427_mafia_JC.exe 80 PID 3004 wrote to memory of 3372 3004 5c4c6004d34e283424642be288421427_mafia_JC.exe 80 PID 3004 wrote to memory of 3372 3004 5c4c6004d34e283424642be288421427_mafia_JC.exe 80 PID 3372 wrote to memory of 4992 3372 F02C.tmp 81 PID 3372 wrote to memory of 4992 3372 F02C.tmp 81 PID 3372 wrote to memory of 4992 3372 F02C.tmp 81 PID 4992 wrote to memory of 1904 4992 F1D2.tmp 82 PID 4992 wrote to memory of 1904 4992 F1D2.tmp 82 PID 4992 wrote to memory of 1904 4992 F1D2.tmp 82 PID 1904 wrote to memory of 640 1904 F2CC.tmp 83 PID 1904 wrote to memory of 640 1904 F2CC.tmp 83 PID 1904 wrote to memory of 640 1904 F2CC.tmp 83 PID 640 wrote to memory of 4252 640 F397.tmp 84 PID 640 wrote to memory of 4252 640 F397.tmp 84 PID 640 wrote to memory of 4252 640 F397.tmp 84 PID 4252 wrote to memory of 3440 4252 F443.tmp 85 PID 4252 wrote to memory of 3440 4252 F443.tmp 85 PID 4252 wrote to memory of 3440 4252 F443.tmp 85 PID 3440 wrote to memory of 4976 3440 F50E.tmp 86 PID 3440 wrote to memory of 4976 3440 F50E.tmp 86 PID 3440 wrote to memory of 4976 3440 F50E.tmp 86 PID 4976 wrote to memory of 1716 4976 F5BA.tmp 87 PID 4976 wrote to memory of 1716 4976 F5BA.tmp 87 PID 4976 wrote to memory of 1716 4976 F5BA.tmp 87 PID 1716 wrote to memory of 4776 1716 F6A4.tmp 88 PID 1716 wrote to memory of 4776 1716 F6A4.tmp 88 PID 1716 wrote to memory of 4776 1716 F6A4.tmp 88 PID 4776 wrote to memory of 1136 4776 F7AE.tmp 89 PID 4776 wrote to memory of 1136 4776 F7AE.tmp 89 PID 4776 wrote to memory of 1136 4776 F7AE.tmp 89 PID 1136 wrote to memory of 1164 1136 F84A.tmp 90 PID 1136 wrote to memory of 1164 1136 F84A.tmp 90 PID 1136 wrote to memory of 1164 1136 F84A.tmp 90 PID 1164 wrote to memory of 1892 1164 F983.tmp 91 PID 1164 wrote to memory of 1892 1164 F983.tmp 91 PID 1164 wrote to memory of 1892 1164 F983.tmp 91 PID 1892 wrote to memory of 1200 1892 FB19.tmp 92 PID 1892 wrote to memory of 1200 1892 FB19.tmp 92 PID 1892 wrote to memory of 1200 1892 FB19.tmp 92 PID 1200 wrote to memory of 928 1200 FBD5.tmp 93 PID 1200 wrote to memory of 928 1200 FBD5.tmp 93 PID 1200 wrote to memory of 928 1200 FBD5.tmp 93 PID 928 wrote to memory of 3152 928 FCDE.tmp 94 PID 928 wrote to memory of 3152 928 FCDE.tmp 94 PID 928 wrote to memory of 3152 928 FCDE.tmp 94 PID 3152 wrote to memory of 1508 3152 FE65.tmp 95 PID 3152 wrote to memory of 1508 3152 FE65.tmp 95 PID 3152 wrote to memory of 1508 3152 FE65.tmp 95 PID 1508 wrote to memory of 2132 1508 FF20.tmp 96 PID 1508 wrote to memory of 2132 1508 FF20.tmp 96 PID 1508 wrote to memory of 2132 1508 FF20.tmp 96 PID 2132 wrote to memory of 2904 2132 FFFB.tmp 97 PID 2132 wrote to memory of 2904 2132 FFFB.tmp 97 PID 2132 wrote to memory of 2904 2132 FFFB.tmp 97 PID 2904 wrote to memory of 2368 2904 C6.tmp 98 PID 2904 wrote to memory of 2368 2904 C6.tmp 98 PID 2904 wrote to memory of 2368 2904 C6.tmp 98 PID 2368 wrote to memory of 3408 2368 172.tmp 99 PID 2368 wrote to memory of 3408 2368 172.tmp 99 PID 2368 wrote to memory of 3408 2368 172.tmp 99 PID 3408 wrote to memory of 1408 3408 22E.tmp 100 PID 3408 wrote to memory of 1408 3408 22E.tmp 100 PID 3408 wrote to memory of 1408 3408 22E.tmp 100 PID 1408 wrote to memory of 3068 1408 2F9.tmp 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c4c6004d34e283424642be288421427_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\5c4c6004d34e283424642be288421427_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\F02C.tmp"C:\Users\Admin\AppData\Local\Temp\F02C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\F1D2.tmp"C:\Users\Admin\AppData\Local\Temp\F1D2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\F2CC.tmp"C:\Users\Admin\AppData\Local\Temp\F2CC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\F397.tmp"C:\Users\Admin\AppData\Local\Temp\F397.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\F443.tmp"C:\Users\Admin\AppData\Local\Temp\F443.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\F50E.tmp"C:\Users\Admin\AppData\Local\Temp\F50E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\F5BA.tmp"C:\Users\Admin\AppData\Local\Temp\F5BA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\F7AE.tmp"C:\Users\Admin\AppData\Local\Temp\F7AE.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\F84A.tmp"C:\Users\Admin\AppData\Local\Temp\F84A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\F983.tmp"C:\Users\Admin\AppData\Local\Temp\F983.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\FB19.tmp"C:\Users\Admin\AppData\Local\Temp\FB19.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\FCDE.tmp"C:\Users\Admin\AppData\Local\Temp\FCDE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Users\Admin\AppData\Local\Temp\FE65.tmp"C:\Users\Admin\AppData\Local\Temp\FE65.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\FF20.tmp"C:\Users\Admin\AppData\Local\Temp\FF20.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\FFFB.tmp"C:\Users\Admin\AppData\Local\Temp\FFFB.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\C6.tmp"C:\Users\Admin\AppData\Local\Temp\C6.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\172.tmp"C:\Users\Admin\AppData\Local\Temp\172.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\22E.tmp"C:\Users\Admin\AppData\Local\Temp\22E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\2F9.tmp"C:\Users\Admin\AppData\Local\Temp\2F9.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\3A5.tmp"C:\Users\Admin\AppData\Local\Temp\3A5.tmp"23⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\450.tmp"C:\Users\Admin\AppData\Local\Temp\450.tmp"24⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\50C.tmp"C:\Users\Admin\AppData\Local\Temp\50C.tmp"25⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\599.tmp"C:\Users\Admin\AppData\Local\Temp\599.tmp"26⤵
- Executes dropped EXE
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\635.tmp"C:\Users\Admin\AppData\Local\Temp\635.tmp"27⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\700.tmp"C:\Users\Admin\AppData\Local\Temp\700.tmp"28⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\7DB.tmp"C:\Users\Admin\AppData\Local\Temp\7DB.tmp"29⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\8D5.tmp"C:\Users\Admin\AppData\Local\Temp\8D5.tmp"30⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\981.tmp"C:\Users\Admin\AppData\Local\Temp\981.tmp"31⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\A1D.tmp"C:\Users\Admin\AppData\Local\Temp\A1D.tmp"32⤵
- Executes dropped EXE
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\AA9.tmp"C:\Users\Admin\AppData\Local\Temp\AA9.tmp"33⤵
- Executes dropped EXE
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\B36.tmp"C:\Users\Admin\AppData\Local\Temp\B36.tmp"34⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\BC3.tmp"C:\Users\Admin\AppData\Local\Temp\BC3.tmp"35⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\C30.tmp"C:\Users\Admin\AppData\Local\Temp\C30.tmp"36⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\C9D.tmp"C:\Users\Admin\AppData\Local\Temp\C9D.tmp"37⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\D1A.tmp"C:\Users\Admin\AppData\Local\Temp\D1A.tmp"38⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\D88.tmp"C:\Users\Admin\AppData\Local\Temp\D88.tmp"39⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\E14.tmp"C:\Users\Admin\AppData\Local\Temp\E14.tmp"40⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\120C.tmp"C:\Users\Admin\AppData\Local\Temp\120C.tmp"41⤵
- Executes dropped EXE
PID:776 -
C:\Users\Admin\AppData\Local\Temp\1289.tmp"C:\Users\Admin\AppData\Local\Temp\1289.tmp"42⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\1306.tmp"C:\Users\Admin\AppData\Local\Temp\1306.tmp"43⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\13A2.tmp"C:\Users\Admin\AppData\Local\Temp\13A2.tmp"44⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\141F.tmp"C:\Users\Admin\AppData\Local\Temp\141F.tmp"45⤵
- Executes dropped EXE
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\149C.tmp"C:\Users\Admin\AppData\Local\Temp\149C.tmp"46⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\1519.tmp"C:\Users\Admin\AppData\Local\Temp\1519.tmp"47⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\1587.tmp"C:\Users\Admin\AppData\Local\Temp\1587.tmp"48⤵
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\1613.tmp"C:\Users\Admin\AppData\Local\Temp\1613.tmp"49⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\1681.tmp"C:\Users\Admin\AppData\Local\Temp\1681.tmp"50⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\16EE.tmp"C:\Users\Admin\AppData\Local\Temp\16EE.tmp"51⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\175B.tmp"C:\Users\Admin\AppData\Local\Temp\175B.tmp"52⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\17E8.tmp"C:\Users\Admin\AppData\Local\Temp\17E8.tmp"53⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\18F2.tmp"C:\Users\Admin\AppData\Local\Temp\18F2.tmp"54⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\197E.tmp"C:\Users\Admin\AppData\Local\Temp\197E.tmp"55⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"56⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\1A98.tmp"C:\Users\Admin\AppData\Local\Temp\1A98.tmp"57⤵
- Executes dropped EXE
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\1B43.tmp"C:\Users\Admin\AppData\Local\Temp\1B43.tmp"58⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"59⤵
- Executes dropped EXE
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\1C3D.tmp"C:\Users\Admin\AppData\Local\Temp\1C3D.tmp"60⤵
- Executes dropped EXE
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"61⤵
- Executes dropped EXE
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\1D76.tmp"C:\Users\Admin\AppData\Local\Temp\1D76.tmp"62⤵
- Executes dropped EXE
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\1DF3.tmp"C:\Users\Admin\AppData\Local\Temp\1DF3.tmp"63⤵
- Executes dropped EXE
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\1EBE.tmp"C:\Users\Admin\AppData\Local\Temp\1EBE.tmp"64⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"65⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\1FC8.tmp"C:\Users\Admin\AppData\Local\Temp\1FC8.tmp"66⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\2045.tmp"C:\Users\Admin\AppData\Local\Temp\2045.tmp"67⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\2100.tmp"C:\Users\Admin\AppData\Local\Temp\2100.tmp"68⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\216E.tmp"C:\Users\Admin\AppData\Local\Temp\216E.tmp"69⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\220A.tmp"C:\Users\Admin\AppData\Local\Temp\220A.tmp"70⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\2287.tmp"C:\Users\Admin\AppData\Local\Temp\2287.tmp"71⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\2342.tmp"C:\Users\Admin\AppData\Local\Temp\2342.tmp"72⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\23CF.tmp"C:\Users\Admin\AppData\Local\Temp\23CF.tmp"73⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\248A.tmp"C:\Users\Admin\AppData\Local\Temp\248A.tmp"74⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\2536.tmp"C:\Users\Admin\AppData\Local\Temp\2536.tmp"75⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\2611.tmp"C:\Users\Admin\AppData\Local\Temp\2611.tmp"76⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\267E.tmp"C:\Users\Admin\AppData\Local\Temp\267E.tmp"77⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\270B.tmp"C:\Users\Admin\AppData\Local\Temp\270B.tmp"78⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\2798.tmp"C:\Users\Admin\AppData\Local\Temp\2798.tmp"79⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\2834.tmp"C:\Users\Admin\AppData\Local\Temp\2834.tmp"80⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\28C1.tmp"C:\Users\Admin\AppData\Local\Temp\28C1.tmp"81⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\295D.tmp"C:\Users\Admin\AppData\Local\Temp\295D.tmp"82⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\29CA.tmp"C:\Users\Admin\AppData\Local\Temp\29CA.tmp"83⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\2A66.tmp"C:\Users\Admin\AppData\Local\Temp\2A66.tmp"84⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\2AE3.tmp"C:\Users\Admin\AppData\Local\Temp\2AE3.tmp"85⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\2B70.tmp"C:\Users\Admin\AppData\Local\Temp\2B70.tmp"86⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\2BED.tmp"C:\Users\Admin\AppData\Local\Temp\2BED.tmp"87⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\2C5A.tmp"C:\Users\Admin\AppData\Local\Temp\2C5A.tmp"88⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\2CD7.tmp"C:\Users\Admin\AppData\Local\Temp\2CD7.tmp"89⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\2D54.tmp"C:\Users\Admin\AppData\Local\Temp\2D54.tmp"90⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\2E00.tmp"C:\Users\Admin\AppData\Local\Temp\2E00.tmp"91⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\2E8D.tmp"C:\Users\Admin\AppData\Local\Temp\2E8D.tmp"92⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\2F0A.tmp"C:\Users\Admin\AppData\Local\Temp\2F0A.tmp"93⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"94⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\3023.tmp"C:\Users\Admin\AppData\Local\Temp\3023.tmp"95⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\3091.tmp"C:\Users\Admin\AppData\Local\Temp\3091.tmp"96⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\30FE.tmp"C:\Users\Admin\AppData\Local\Temp\30FE.tmp"97⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\319A.tmp"C:\Users\Admin\AppData\Local\Temp\319A.tmp"98⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"99⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\32C3.tmp"C:\Users\Admin\AppData\Local\Temp\32C3.tmp"100⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"101⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"102⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\3479.tmp"C:\Users\Admin\AppData\Local\Temp\3479.tmp"103⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"104⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\3573.tmp"C:\Users\Admin\AppData\Local\Temp\3573.tmp"105⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\35F0.tmp"C:\Users\Admin\AppData\Local\Temp\35F0.tmp"106⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\366D.tmp"C:\Users\Admin\AppData\Local\Temp\366D.tmp"107⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\36DA.tmp"C:\Users\Admin\AppData\Local\Temp\36DA.tmp"108⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\3747.tmp"C:\Users\Admin\AppData\Local\Temp\3747.tmp"109⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\37C4.tmp"C:\Users\Admin\AppData\Local\Temp\37C4.tmp"110⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\3851.tmp"C:\Users\Admin\AppData\Local\Temp\3851.tmp"111⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\38FD.tmp"C:\Users\Admin\AppData\Local\Temp\38FD.tmp"112⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\397A.tmp"C:\Users\Admin\AppData\Local\Temp\397A.tmp"113⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\3A06.tmp"C:\Users\Admin\AppData\Local\Temp\3A06.tmp"114⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\3AA3.tmp"C:\Users\Admin\AppData\Local\Temp\3AA3.tmp"115⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\3B4F.tmp"C:\Users\Admin\AppData\Local\Temp\3B4F.tmp"116⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\3BBC.tmp"C:\Users\Admin\AppData\Local\Temp\3BBC.tmp"117⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\3C29.tmp"C:\Users\Admin\AppData\Local\Temp\3C29.tmp"118⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\3CB6.tmp"C:\Users\Admin\AppData\Local\Temp\3CB6.tmp"119⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\3D43.tmp"C:\Users\Admin\AppData\Local\Temp\3D43.tmp"120⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\3DDF.tmp"C:\Users\Admin\AppData\Local\Temp\3DDF.tmp"121⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\3E6B.tmp"C:\Users\Admin\AppData\Local\Temp\3E6B.tmp"122⤵PID:2276
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-