Analysis
-
max time kernel
160s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2023, 15:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ceb5fa4bf37a5b29ffe4a1ac96b0f4f4_mafia_JC.exe
Resource
win7-20230824-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
ceb5fa4bf37a5b29ffe4a1ac96b0f4f4_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
ceb5fa4bf37a5b29ffe4a1ac96b0f4f4_mafia_JC.exe
-
Size
520KB
-
MD5
ceb5fa4bf37a5b29ffe4a1ac96b0f4f4
-
SHA1
bac05eb475d9be1f04e52c6f8bc3c240fb2fea8b
-
SHA256
729faee6223ec4a12a88a054a6b6c6ec3c3feddf80d3d7a32c023f21395cd9a7
-
SHA512
73e6cabdd77ff54d8ed2eb1ea7007df0390553e5aabbb0686ad1815fb4b853041f3b31ceb3145bd84bd0725300daa6c570179f704a3285273a9aca887297e233
-
SSDEEP
12288:gj8fuxR21t5i8fQ5aycKl10AlCHYCdaNZ:gj8fuK1GYQ5aytXlC4vN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3280 AE22.tmp 2956 AEDD.tmp 4612 AF7A.tmp 3920 B074.tmp 4892 B13F.tmp 1364 B20A.tmp 4924 B2F4.tmp 620 B3BF.tmp 4372 B43C.tmp 2668 B546.tmp 2844 B602.tmp 2080 B6CD.tmp 3956 B779.tmp 3824 B834.tmp 4884 B90F.tmp 3876 B98C.tmp 1392 BA67.tmp 4576 BB03.tmp 4504 BC1C.tmp 4992 BD16.tmp 3380 BDD2.tmp 1256 BE7D.tmp 1400 BF58.tmp 2148 BFE5.tmp 4456 C081.tmp 5072 C18B.tmp 1068 C246.tmp 532 C2F2.tmp 1416 C3CD.tmp 4812 C469.tmp 2864 C525.tmp 2636 C5E0.tmp 1840 C68C.tmp 3152 C709.tmp 924 C776.tmp 1488 C7F3.tmp 1976 C880.tmp 388 C8FD.tmp 760 C98A.tmp 3816 CA16.tmp 3996 CA93.tmp 2776 CB10.tmp 4932 CBCC.tmp 3732 CC49.tmp 232 CCD5.tmp 3852 CD72.tmp 4684 CE1D.tmp 3316 CEBA.tmp 3304 CF37.tmp 4144 CFE3.tmp 4428 D060.tmp 876 D0DD.tmp 8 D14A.tmp 2212 D1E6.tmp 1996 D263.tmp 1872 D2F0.tmp 4760 D38C.tmp 4584 D419.tmp 264 D496.tmp 4348 D532.tmp 1052 D59F.tmp 4608 D5FD.tmp 2056 D6A9.tmp 3376 D745.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1216 wrote to memory of 3280 1216 ceb5fa4bf37a5b29ffe4a1ac96b0f4f4_mafia_JC.exe 82 PID 1216 wrote to memory of 3280 1216 ceb5fa4bf37a5b29ffe4a1ac96b0f4f4_mafia_JC.exe 82 PID 1216 wrote to memory of 3280 1216 ceb5fa4bf37a5b29ffe4a1ac96b0f4f4_mafia_JC.exe 82 PID 3280 wrote to memory of 2956 3280 AE22.tmp 83 PID 3280 wrote to memory of 2956 3280 AE22.tmp 83 PID 3280 wrote to memory of 2956 3280 AE22.tmp 83 PID 2956 wrote to memory of 4612 2956 AEDD.tmp 84 PID 2956 wrote to memory of 4612 2956 AEDD.tmp 84 PID 2956 wrote to memory of 4612 2956 AEDD.tmp 84 PID 4612 wrote to memory of 3920 4612 AF7A.tmp 85 PID 4612 wrote to memory of 3920 4612 AF7A.tmp 85 PID 4612 wrote to memory of 3920 4612 AF7A.tmp 85 PID 3920 wrote to memory of 4892 3920 B074.tmp 86 PID 3920 wrote to memory of 4892 3920 B074.tmp 86 PID 3920 wrote to memory of 4892 3920 B074.tmp 86 PID 4892 wrote to memory of 1364 4892 B13F.tmp 87 PID 4892 wrote to memory of 1364 4892 B13F.tmp 87 PID 4892 wrote to memory of 1364 4892 B13F.tmp 87 PID 1364 wrote to memory of 4924 1364 B20A.tmp 88 PID 1364 wrote to memory of 4924 1364 B20A.tmp 88 PID 1364 wrote to memory of 4924 1364 B20A.tmp 88 PID 4924 wrote to memory of 620 4924 B2F4.tmp 89 PID 4924 wrote to memory of 620 4924 B2F4.tmp 89 PID 4924 wrote to memory of 620 4924 B2F4.tmp 89 PID 620 wrote to memory of 4372 620 B3BF.tmp 90 PID 620 wrote to memory of 4372 620 B3BF.tmp 90 PID 620 wrote to memory of 4372 620 B3BF.tmp 90 PID 4372 wrote to memory of 2668 4372 B43C.tmp 91 PID 4372 wrote to memory of 2668 4372 B43C.tmp 91 PID 4372 wrote to memory of 2668 4372 B43C.tmp 91 PID 2668 wrote to memory of 2844 2668 B546.tmp 92 PID 2668 wrote to memory of 2844 2668 B546.tmp 92 PID 2668 wrote to memory of 2844 2668 B546.tmp 92 PID 2844 wrote to memory of 2080 2844 B602.tmp 93 PID 2844 wrote to memory of 2080 2844 B602.tmp 93 PID 2844 wrote to memory of 2080 2844 B602.tmp 93 PID 2080 wrote to memory of 3956 2080 B6CD.tmp 94 PID 2080 wrote to memory of 3956 2080 B6CD.tmp 94 PID 2080 wrote to memory of 3956 2080 B6CD.tmp 94 PID 3956 wrote to memory of 3824 3956 B779.tmp 95 PID 3956 wrote to memory of 3824 3956 B779.tmp 95 PID 3956 wrote to memory of 3824 3956 B779.tmp 95 PID 3824 wrote to memory of 4884 3824 B834.tmp 96 PID 3824 wrote to memory of 4884 3824 B834.tmp 96 PID 3824 wrote to memory of 4884 3824 B834.tmp 96 PID 4884 wrote to memory of 3876 4884 B90F.tmp 97 PID 4884 wrote to memory of 3876 4884 B90F.tmp 97 PID 4884 wrote to memory of 3876 4884 B90F.tmp 97 PID 3876 wrote to memory of 1392 3876 B98C.tmp 98 PID 3876 wrote to memory of 1392 3876 B98C.tmp 98 PID 3876 wrote to memory of 1392 3876 B98C.tmp 98 PID 1392 wrote to memory of 4576 1392 BA67.tmp 99 PID 1392 wrote to memory of 4576 1392 BA67.tmp 99 PID 1392 wrote to memory of 4576 1392 BA67.tmp 99 PID 4576 wrote to memory of 4504 4576 BB03.tmp 100 PID 4576 wrote to memory of 4504 4576 BB03.tmp 100 PID 4576 wrote to memory of 4504 4576 BB03.tmp 100 PID 4504 wrote to memory of 4992 4504 BC1C.tmp 101 PID 4504 wrote to memory of 4992 4504 BC1C.tmp 101 PID 4504 wrote to memory of 4992 4504 BC1C.tmp 101 PID 4992 wrote to memory of 3380 4992 BD16.tmp 102 PID 4992 wrote to memory of 3380 4992 BD16.tmp 102 PID 4992 wrote to memory of 3380 4992 BD16.tmp 102 PID 3380 wrote to memory of 1256 3380 BDD2.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\ceb5fa4bf37a5b29ffe4a1ac96b0f4f4_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\ceb5fa4bf37a5b29ffe4a1ac96b0f4f4_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\B074.tmp"C:\Users\Admin\AppData\Local\Temp\B074.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\B20A.tmp"C:\Users\Admin\AppData\Local\Temp\B20A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Users\Admin\AppData\Local\Temp\B43C.tmp"C:\Users\Admin\AppData\Local\Temp\B43C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\B546.tmp"C:\Users\Admin\AppData\Local\Temp\B546.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\B602.tmp"C:\Users\Admin\AppData\Local\Temp\B602.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\B779.tmp"C:\Users\Admin\AppData\Local\Temp\B779.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\B834.tmp"C:\Users\Admin\AppData\Local\Temp\B834.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\B90F.tmp"C:\Users\Admin\AppData\Local\Temp\B90F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\B98C.tmp"C:\Users\Admin\AppData\Local\Temp\B98C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\BA67.tmp"C:\Users\Admin\AppData\Local\Temp\BA67.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\BB03.tmp"C:\Users\Admin\AppData\Local\Temp\BB03.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\BD16.tmp"C:\Users\Admin\AppData\Local\Temp\BD16.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"23⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\BF58.tmp"C:\Users\Admin\AppData\Local\Temp\BF58.tmp"24⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"25⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"26⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\C18B.tmp"C:\Users\Admin\AppData\Local\Temp\C18B.tmp"27⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\C246.tmp"C:\Users\Admin\AppData\Local\Temp\C246.tmp"28⤵
- Executes dropped EXE
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"29⤵
- Executes dropped EXE
PID:532 -
C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"30⤵
- Executes dropped EXE
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\C469.tmp"C:\Users\Admin\AppData\Local\Temp\C469.tmp"31⤵
- Executes dropped EXE
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\C525.tmp"C:\Users\Admin\AppData\Local\Temp\C525.tmp"32⤵
- Executes dropped EXE
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"33⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\C68C.tmp"C:\Users\Admin\AppData\Local\Temp\C68C.tmp"34⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\C709.tmp"C:\Users\Admin\AppData\Local\Temp\C709.tmp"35⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\C776.tmp"C:\Users\Admin\AppData\Local\Temp\C776.tmp"36⤵
- Executes dropped EXE
PID:924 -
C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"37⤵
- Executes dropped EXE
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\C880.tmp"C:\Users\Admin\AppData\Local\Temp\C880.tmp"38⤵
- Executes dropped EXE
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"39⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\C98A.tmp"C:\Users\Admin\AppData\Local\Temp\C98A.tmp"40⤵
- Executes dropped EXE
PID:760 -
C:\Users\Admin\AppData\Local\Temp\CA16.tmp"C:\Users\Admin\AppData\Local\Temp\CA16.tmp"41⤵
- Executes dropped EXE
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\CA93.tmp"C:\Users\Admin\AppData\Local\Temp\CA93.tmp"42⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\CB10.tmp"C:\Users\Admin\AppData\Local\Temp\CB10.tmp"43⤵
- Executes dropped EXE
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"44⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\CC49.tmp"C:\Users\Admin\AppData\Local\Temp\CC49.tmp"45⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\CCD5.tmp"C:\Users\Admin\AppData\Local\Temp\CCD5.tmp"46⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\CD72.tmp"C:\Users\Admin\AppData\Local\Temp\CD72.tmp"47⤵
- Executes dropped EXE
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"48⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"49⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\CF37.tmp"C:\Users\Admin\AppData\Local\Temp\CF37.tmp"50⤵
- Executes dropped EXE
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\CFE3.tmp"C:\Users\Admin\AppData\Local\Temp\CFE3.tmp"51⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\D060.tmp"C:\Users\Admin\AppData\Local\Temp\D060.tmp"52⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\D0DD.tmp"C:\Users\Admin\AppData\Local\Temp\D0DD.tmp"53⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\D14A.tmp"C:\Users\Admin\AppData\Local\Temp\D14A.tmp"54⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"55⤵
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\D263.tmp"C:\Users\Admin\AppData\Local\Temp\D263.tmp"56⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"57⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\D38C.tmp"C:\Users\Admin\AppData\Local\Temp\D38C.tmp"58⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\D419.tmp"C:\Users\Admin\AppData\Local\Temp\D419.tmp"59⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\D496.tmp"C:\Users\Admin\AppData\Local\Temp\D496.tmp"60⤵
- Executes dropped EXE
PID:264 -
C:\Users\Admin\AppData\Local\Temp\D532.tmp"C:\Users\Admin\AppData\Local\Temp\D532.tmp"61⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\D59F.tmp"C:\Users\Admin\AppData\Local\Temp\D59F.tmp"62⤵
- Executes dropped EXE
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\D5FD.tmp"C:\Users\Admin\AppData\Local\Temp\D5FD.tmp"63⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\D6A9.tmp"C:\Users\Admin\AppData\Local\Temp\D6A9.tmp"64⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\D745.tmp"C:\Users\Admin\AppData\Local\Temp\D745.tmp"65⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\D7C2.tmp"C:\Users\Admin\AppData\Local\Temp\D7C2.tmp"66⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\D83F.tmp"C:\Users\Admin\AppData\Local\Temp\D83F.tmp"67⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"68⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\D939.tmp"C:\Users\Admin\AppData\Local\Temp\D939.tmp"69⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"70⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\DA24.tmp"C:\Users\Admin\AppData\Local\Temp\DA24.tmp"71⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\DAB0.tmp"C:\Users\Admin\AppData\Local\Temp\DAB0.tmp"72⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"73⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\DBD9.tmp"C:\Users\Admin\AppData\Local\Temp\DBD9.tmp"74⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\DC56.tmp"C:\Users\Admin\AppData\Local\Temp\DC56.tmp"75⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\DD02.tmp"C:\Users\Admin\AppData\Local\Temp\DD02.tmp"76⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\DD7F.tmp"C:\Users\Admin\AppData\Local\Temp\DD7F.tmp"77⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\DE0C.tmp"C:\Users\Admin\AppData\Local\Temp\DE0C.tmp"78⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"79⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\DF54.tmp"C:\Users\Admin\AppData\Local\Temp\DF54.tmp"80⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"81⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\E04E.tmp"C:\Users\Admin\AppData\Local\Temp\E04E.tmp"82⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"83⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\E186.tmp"C:\Users\Admin\AppData\Local\Temp\E186.tmp"84⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\E203.tmp"C:\Users\Admin\AppData\Local\Temp\E203.tmp"85⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"86⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\E35B.tmp"C:\Users\Admin\AppData\Local\Temp\E35B.tmp"87⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\E3E8.tmp"C:\Users\Admin\AppData\Local\Temp\E3E8.tmp"88⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\E465.tmp"C:\Users\Admin\AppData\Local\Temp\E465.tmp"89⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\E4D2.tmp"C:\Users\Admin\AppData\Local\Temp\E4D2.tmp"90⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\E55F.tmp"C:\Users\Admin\AppData\Local\Temp\E55F.tmp"91⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"92⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\E649.tmp"C:\Users\Admin\AppData\Local\Temp\E649.tmp"93⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"94⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\E714.tmp"C:\Users\Admin\AppData\Local\Temp\E714.tmp"95⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\E791.tmp"C:\Users\Admin\AppData\Local\Temp\E791.tmp"96⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\E82D.tmp"C:\Users\Admin\AppData\Local\Temp\E82D.tmp"97⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\E88B.tmp"C:\Users\Admin\AppData\Local\Temp\E88B.tmp"98⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\E918.tmp"C:\Users\Admin\AppData\Local\Temp\E918.tmp"99⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"100⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\EA21.tmp"C:\Users\Admin\AppData\Local\Temp\EA21.tmp"101⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\EAAE.tmp"C:\Users\Admin\AppData\Local\Temp\EAAE.tmp"102⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"103⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\EB98.tmp"C:\Users\Admin\AppData\Local\Temp\EB98.tmp"104⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\EC25.tmp"C:\Users\Admin\AppData\Local\Temp\EC25.tmp"105⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\ECA2.tmp"C:\Users\Admin\AppData\Local\Temp\ECA2.tmp"106⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"107⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"108⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\EE19.tmp"C:\Users\Admin\AppData\Local\Temp\EE19.tmp"109⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\EE96.tmp"C:\Users\Admin\AppData\Local\Temp\EE96.tmp"110⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\EF23.tmp"C:\Users\Admin\AppData\Local\Temp\EF23.tmp"111⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\EF90.tmp"C:\Users\Admin\AppData\Local\Temp\EF90.tmp"112⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\F00D.tmp"C:\Users\Admin\AppData\Local\Temp\F00D.tmp"113⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\F08A.tmp"C:\Users\Admin\AppData\Local\Temp\F08A.tmp"114⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\F117.tmp"C:\Users\Admin\AppData\Local\Temp\F117.tmp"115⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\F194.tmp"C:\Users\Admin\AppData\Local\Temp\F194.tmp"116⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\F201.tmp"C:\Users\Admin\AppData\Local\Temp\F201.tmp"117⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\F28E.tmp"C:\Users\Admin\AppData\Local\Temp\F28E.tmp"118⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\F339.tmp"C:\Users\Admin\AppData\Local\Temp\F339.tmp"119⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\F3C6.tmp"C:\Users\Admin\AppData\Local\Temp\F3C6.tmp"120⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\F433.tmp"C:\Users\Admin\AppData\Local\Temp\F433.tmp"121⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\F4C0.tmp"C:\Users\Admin\AppData\Local\Temp\F4C0.tmp"122⤵PID:5016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-