Analysis
-
max time kernel
152s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20230824-en -
resource tags
arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2023, 15:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cf8cf1fc89bd2e056c565609dec48caf_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
cf8cf1fc89bd2e056c565609dec48caf_mafia_JC.exe
Resource
win10v2004-20230824-en
2 signatures
150 seconds
General
-
Target
cf8cf1fc89bd2e056c565609dec48caf_mafia_JC.exe
-
Size
520KB
-
MD5
cf8cf1fc89bd2e056c565609dec48caf
-
SHA1
c8e7abf607bd2b93a5afabb338164d9aa49d4320
-
SHA256
e63fd6f82934ac412737bacc7f6c272397e2523006cfdb7cc5f51c36d06a8052
-
SHA512
8891148531b11dfca584e93ffaa93543331e132418134f05e92f6dbfabaee119fcfe139537eddd0af96f4259a7b3506a1bf6630809615eefd2aa7a5b5ce9e2c1
-
SSDEEP
12288:gj8fuxR21t5i8fnPWIpgGWVvriRkXUKfpkSAGXrLlNZ:gj8fuK1GYnmrVvriRkzfySA0lN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2264 EB3B.tmp 3380 EC54.tmp 1776 ED00.tmp 4812 EDEA.tmp 444 F433.tmp 3268 F5BA.tmp 2024 F6A4.tmp 804 F81B.tmp 4836 F906.tmp 2212 FA0F.tmp 2100 FA9C.tmp 1260 FB38.tmp 3192 FC23.tmp 3412 FCDE.tmp 2168 FD9A.tmp 2144 FE55.tmp 4076 FF40.tmp 5116 1A.tmp 4008 153.tmp 4720 1EF.tmp 1192 2BA.tmp 4596 395.tmp 1504 431.tmp 696 4ED.tmp 4948 5D7.tmp 4004 673.tmp 4080 76D.tmp 2148 819.tmp 968 904.tmp 1740 9FE.tmp 220 AD8.tmp 4428 B75.tmp 4784 C11.tmp 1952 CFB.tmp 2928 D97.tmp 3652 E24.tmp 2992 EA1.tmp 4260 F2E.tmp 3468 FCA.tmp 1012 1047.tmp 4508 10C4.tmp 1764 1141.tmp 1208 11ED.tmp 4156 126A.tmp 4256 12F6.tmp 2288 13A2.tmp 4748 144E.tmp 2180 14BC.tmp 4560 1548.tmp 1364 15C5.tmp 2096 1633.tmp 4752 16DE.tmp 5084 175B.tmp 1004 17D8.tmp 1780 1865.tmp 1756 1901.tmp 2152 197E.tmp 1944 1A1B.tmp 1940 1AA7.tmp 3552 1B43.tmp 4376 1BC0.tmp 2324 1C8C.tmp 4040 1D18.tmp 4804 1DD4.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1524 wrote to memory of 2264 1524 cf8cf1fc89bd2e056c565609dec48caf_mafia_JC.exe 84 PID 1524 wrote to memory of 2264 1524 cf8cf1fc89bd2e056c565609dec48caf_mafia_JC.exe 84 PID 1524 wrote to memory of 2264 1524 cf8cf1fc89bd2e056c565609dec48caf_mafia_JC.exe 84 PID 2264 wrote to memory of 3380 2264 EB3B.tmp 85 PID 2264 wrote to memory of 3380 2264 EB3B.tmp 85 PID 2264 wrote to memory of 3380 2264 EB3B.tmp 85 PID 3380 wrote to memory of 1776 3380 EC54.tmp 87 PID 3380 wrote to memory of 1776 3380 EC54.tmp 87 PID 3380 wrote to memory of 1776 3380 EC54.tmp 87 PID 1776 wrote to memory of 4812 1776 ED00.tmp 88 PID 1776 wrote to memory of 4812 1776 ED00.tmp 88 PID 1776 wrote to memory of 4812 1776 ED00.tmp 88 PID 4812 wrote to memory of 444 4812 EDEA.tmp 89 PID 4812 wrote to memory of 444 4812 EDEA.tmp 89 PID 4812 wrote to memory of 444 4812 EDEA.tmp 89 PID 444 wrote to memory of 3268 444 F433.tmp 90 PID 444 wrote to memory of 3268 444 F433.tmp 90 PID 444 wrote to memory of 3268 444 F433.tmp 90 PID 3268 wrote to memory of 2024 3268 F5BA.tmp 91 PID 3268 wrote to memory of 2024 3268 F5BA.tmp 91 PID 3268 wrote to memory of 2024 3268 F5BA.tmp 91 PID 2024 wrote to memory of 804 2024 F6A4.tmp 92 PID 2024 wrote to memory of 804 2024 F6A4.tmp 92 PID 2024 wrote to memory of 804 2024 F6A4.tmp 92 PID 804 wrote to memory of 4836 804 F81B.tmp 93 PID 804 wrote to memory of 4836 804 F81B.tmp 93 PID 804 wrote to memory of 4836 804 F81B.tmp 93 PID 4836 wrote to memory of 2212 4836 F906.tmp 94 PID 4836 wrote to memory of 2212 4836 F906.tmp 94 PID 4836 wrote to memory of 2212 4836 F906.tmp 94 PID 2212 wrote to memory of 2100 2212 FA0F.tmp 95 PID 2212 wrote to memory of 2100 2212 FA0F.tmp 95 PID 2212 wrote to memory of 2100 2212 FA0F.tmp 95 PID 2100 wrote to memory of 1260 2100 FA9C.tmp 96 PID 2100 wrote to memory of 1260 2100 FA9C.tmp 96 PID 2100 wrote to memory of 1260 2100 FA9C.tmp 96 PID 1260 wrote to memory of 3192 1260 FB38.tmp 97 PID 1260 wrote to memory of 3192 1260 FB38.tmp 97 PID 1260 wrote to memory of 3192 1260 FB38.tmp 97 PID 3192 wrote to memory of 3412 3192 FC23.tmp 98 PID 3192 wrote to memory of 3412 3192 FC23.tmp 98 PID 3192 wrote to memory of 3412 3192 FC23.tmp 98 PID 3412 wrote to memory of 2168 3412 FCDE.tmp 99 PID 3412 wrote to memory of 2168 3412 FCDE.tmp 99 PID 3412 wrote to memory of 2168 3412 FCDE.tmp 99 PID 2168 wrote to memory of 2144 2168 FD9A.tmp 100 PID 2168 wrote to memory of 2144 2168 FD9A.tmp 100 PID 2168 wrote to memory of 2144 2168 FD9A.tmp 100 PID 2144 wrote to memory of 4076 2144 FE55.tmp 101 PID 2144 wrote to memory of 4076 2144 FE55.tmp 101 PID 2144 wrote to memory of 4076 2144 FE55.tmp 101 PID 4076 wrote to memory of 5116 4076 FF40.tmp 102 PID 4076 wrote to memory of 5116 4076 FF40.tmp 102 PID 4076 wrote to memory of 5116 4076 FF40.tmp 102 PID 5116 wrote to memory of 4008 5116 1A.tmp 103 PID 5116 wrote to memory of 4008 5116 1A.tmp 103 PID 5116 wrote to memory of 4008 5116 1A.tmp 103 PID 4008 wrote to memory of 4720 4008 153.tmp 104 PID 4008 wrote to memory of 4720 4008 153.tmp 104 PID 4008 wrote to memory of 4720 4008 153.tmp 104 PID 4720 wrote to memory of 1192 4720 1EF.tmp 105 PID 4720 wrote to memory of 1192 4720 1EF.tmp 105 PID 4720 wrote to memory of 1192 4720 1EF.tmp 105 PID 1192 wrote to memory of 4596 1192 2BA.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf8cf1fc89bd2e056c565609dec48caf_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\cf8cf1fc89bd2e056c565609dec48caf_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\EB3B.tmp"C:\Users\Admin\AppData\Local\Temp\EB3B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\EC54.tmp"C:\Users\Admin\AppData\Local\Temp\EC54.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\ED00.tmp"C:\Users\Admin\AppData\Local\Temp\ED00.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\EDEA.tmp"C:\Users\Admin\AppData\Local\Temp\EDEA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\F433.tmp"C:\Users\Admin\AppData\Local\Temp\F433.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
C:\Users\Admin\AppData\Local\Temp\F5BA.tmp"C:\Users\Admin\AppData\Local\Temp\F5BA.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\F81B.tmp"C:\Users\Admin\AppData\Local\Temp\F81B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\F906.tmp"C:\Users\Admin\AppData\Local\Temp\F906.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\FA0F.tmp"C:\Users\Admin\AppData\Local\Temp\FA0F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\FB38.tmp"C:\Users\Admin\AppData\Local\Temp\FB38.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\FC23.tmp"C:\Users\Admin\AppData\Local\Temp\FC23.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\FCDE.tmp"C:\Users\Admin\AppData\Local\Temp\FCDE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\FD9A.tmp"C:\Users\Admin\AppData\Local\Temp\FD9A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\FE55.tmp"C:\Users\Admin\AppData\Local\Temp\FE55.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\FF40.tmp"C:\Users\Admin\AppData\Local\Temp\FF40.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\1A.tmp"C:\Users\Admin\AppData\Local\Temp\1A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\153.tmp"C:\Users\Admin\AppData\Local\Temp\153.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\1EF.tmp"C:\Users\Admin\AppData\Local\Temp\1EF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\2BA.tmp"C:\Users\Admin\AppData\Local\Temp\2BA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\395.tmp"C:\Users\Admin\AppData\Local\Temp\395.tmp"23⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\431.tmp"C:\Users\Admin\AppData\Local\Temp\431.tmp"24⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\4ED.tmp"C:\Users\Admin\AppData\Local\Temp\4ED.tmp"25⤵
- Executes dropped EXE
PID:696 -
C:\Users\Admin\AppData\Local\Temp\5D7.tmp"C:\Users\Admin\AppData\Local\Temp\5D7.tmp"26⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\673.tmp"C:\Users\Admin\AppData\Local\Temp\673.tmp"27⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\76D.tmp"C:\Users\Admin\AppData\Local\Temp\76D.tmp"28⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\819.tmp"C:\Users\Admin\AppData\Local\Temp\819.tmp"29⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\904.tmp"C:\Users\Admin\AppData\Local\Temp\904.tmp"30⤵
- Executes dropped EXE
PID:968 -
C:\Users\Admin\AppData\Local\Temp\9FE.tmp"C:\Users\Admin\AppData\Local\Temp\9FE.tmp"31⤵
- Executes dropped EXE
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\AD8.tmp"C:\Users\Admin\AppData\Local\Temp\AD8.tmp"32⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\B75.tmp"C:\Users\Admin\AppData\Local\Temp\B75.tmp"33⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\C11.tmp"C:\Users\Admin\AppData\Local\Temp\C11.tmp"34⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\CFB.tmp"C:\Users\Admin\AppData\Local\Temp\CFB.tmp"35⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\D97.tmp"C:\Users\Admin\AppData\Local\Temp\D97.tmp"36⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"37⤵
- Executes dropped EXE
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\EA1.tmp"C:\Users\Admin\AppData\Local\Temp\EA1.tmp"38⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\F2E.tmp"C:\Users\Admin\AppData\Local\Temp\F2E.tmp"39⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\FCA.tmp"C:\Users\Admin\AppData\Local\Temp\FCA.tmp"40⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\1047.tmp"C:\Users\Admin\AppData\Local\Temp\1047.tmp"41⤵
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\10C4.tmp"C:\Users\Admin\AppData\Local\Temp\10C4.tmp"42⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\1141.tmp"C:\Users\Admin\AppData\Local\Temp\1141.tmp"43⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\11ED.tmp"C:\Users\Admin\AppData\Local\Temp\11ED.tmp"44⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\126A.tmp"C:\Users\Admin\AppData\Local\Temp\126A.tmp"45⤵
- Executes dropped EXE
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\12F6.tmp"C:\Users\Admin\AppData\Local\Temp\12F6.tmp"46⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\13A2.tmp"C:\Users\Admin\AppData\Local\Temp\13A2.tmp"47⤵
- Executes dropped EXE
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\144E.tmp"C:\Users\Admin\AppData\Local\Temp\144E.tmp"48⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\14BC.tmp"C:\Users\Admin\AppData\Local\Temp\14BC.tmp"49⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\1548.tmp"C:\Users\Admin\AppData\Local\Temp\1548.tmp"50⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\15C5.tmp"C:\Users\Admin\AppData\Local\Temp\15C5.tmp"51⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\1633.tmp"C:\Users\Admin\AppData\Local\Temp\1633.tmp"52⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\16DE.tmp"C:\Users\Admin\AppData\Local\Temp\16DE.tmp"53⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\175B.tmp"C:\Users\Admin\AppData\Local\Temp\175B.tmp"54⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\17D8.tmp"C:\Users\Admin\AppData\Local\Temp\17D8.tmp"55⤵
- Executes dropped EXE
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\1865.tmp"C:\Users\Admin\AppData\Local\Temp\1865.tmp"56⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\1901.tmp"C:\Users\Admin\AppData\Local\Temp\1901.tmp"57⤵
- Executes dropped EXE
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\197E.tmp"C:\Users\Admin\AppData\Local\Temp\197E.tmp"58⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"59⤵
- Executes dropped EXE
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\1AA7.tmp"C:\Users\Admin\AppData\Local\Temp\1AA7.tmp"60⤵
- Executes dropped EXE
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\1B43.tmp"C:\Users\Admin\AppData\Local\Temp\1B43.tmp"61⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\1BC0.tmp"C:\Users\Admin\AppData\Local\Temp\1BC0.tmp"62⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\1C8C.tmp"C:\Users\Admin\AppData\Local\Temp\1C8C.tmp"63⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\1D18.tmp"C:\Users\Admin\AppData\Local\Temp\1D18.tmp"64⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"65⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\1E51.tmp"C:\Users\Admin\AppData\Local\Temp\1E51.tmp"66⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\1ECE.tmp"C:\Users\Admin\AppData\Local\Temp\1ECE.tmp"67⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\1F7A.tmp"C:\Users\Admin\AppData\Local\Temp\1F7A.tmp"68⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"69⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\2083.tmp"C:\Users\Admin\AppData\Local\Temp\2083.tmp"70⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\2100.tmp"C:\Users\Admin\AppData\Local\Temp\2100.tmp"71⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\218D.tmp"C:\Users\Admin\AppData\Local\Temp\218D.tmp"72⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\2239.tmp"C:\Users\Admin\AppData\Local\Temp\2239.tmp"73⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\22C5.tmp"C:\Users\Admin\AppData\Local\Temp\22C5.tmp"74⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\2333.tmp"C:\Users\Admin\AppData\Local\Temp\2333.tmp"75⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\23CF.tmp"C:\Users\Admin\AppData\Local\Temp\23CF.tmp"76⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\246B.tmp"C:\Users\Admin\AppData\Local\Temp\246B.tmp"77⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\2507.tmp"C:\Users\Admin\AppData\Local\Temp\2507.tmp"78⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\2575.tmp"C:\Users\Admin\AppData\Local\Temp\2575.tmp"79⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\25F2.tmp"C:\Users\Admin\AppData\Local\Temp\25F2.tmp"80⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\266F.tmp"C:\Users\Admin\AppData\Local\Temp\266F.tmp"81⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\26FB.tmp"C:\Users\Admin\AppData\Local\Temp\26FB.tmp"82⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\2769.tmp"C:\Users\Admin\AppData\Local\Temp\2769.tmp"83⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\27E6.tmp"C:\Users\Admin\AppData\Local\Temp\27E6.tmp"84⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\2872.tmp"C:\Users\Admin\AppData\Local\Temp\2872.tmp"85⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\293E.tmp"C:\Users\Admin\AppData\Local\Temp\293E.tmp"86⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\29BB.tmp"C:\Users\Admin\AppData\Local\Temp\29BB.tmp"87⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\2A38.tmp"C:\Users\Admin\AppData\Local\Temp\2A38.tmp"88⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\2AB5.tmp"C:\Users\Admin\AppData\Local\Temp\2AB5.tmp"89⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\2B22.tmp"C:\Users\Admin\AppData\Local\Temp\2B22.tmp"90⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\2B9F.tmp"C:\Users\Admin\AppData\Local\Temp\2B9F.tmp"91⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"92⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\2CA9.tmp"C:\Users\Admin\AppData\Local\Temp\2CA9.tmp"93⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\2D26.tmp"C:\Users\Admin\AppData\Local\Temp\2D26.tmp"94⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\2DB2.tmp"C:\Users\Admin\AppData\Local\Temp\2DB2.tmp"95⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\2E2F.tmp"C:\Users\Admin\AppData\Local\Temp\2E2F.tmp"96⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"97⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\2F48.tmp"C:\Users\Admin\AppData\Local\Temp\2F48.tmp"98⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\2FC5.tmp"C:\Users\Admin\AppData\Local\Temp\2FC5.tmp"99⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\3042.tmp"C:\Users\Admin\AppData\Local\Temp\3042.tmp"100⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\30DF.tmp"C:\Users\Admin\AppData\Local\Temp\30DF.tmp"101⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\314C.tmp"C:\Users\Admin\AppData\Local\Temp\314C.tmp"102⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\31C9.tmp"C:\Users\Admin\AppData\Local\Temp\31C9.tmp"103⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\3265.tmp"C:\Users\Admin\AppData\Local\Temp\3265.tmp"104⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"105⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"106⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"107⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\3479.tmp"C:\Users\Admin\AppData\Local\Temp\3479.tmp"108⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"109⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\3563.tmp"C:\Users\Admin\AppData\Local\Temp\3563.tmp"110⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\35D0.tmp"C:\Users\Admin\AppData\Local\Temp\35D0.tmp"111⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\364D.tmp"C:\Users\Admin\AppData\Local\Temp\364D.tmp"112⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\36BB.tmp"C:\Users\Admin\AppData\Local\Temp\36BB.tmp"113⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\3747.tmp"C:\Users\Admin\AppData\Local\Temp\3747.tmp"114⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\37B5.tmp"C:\Users\Admin\AppData\Local\Temp\37B5.tmp"115⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\3822.tmp"C:\Users\Admin\AppData\Local\Temp\3822.tmp"116⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\389F.tmp"C:\Users\Admin\AppData\Local\Temp\389F.tmp"117⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\392C.tmp"C:\Users\Admin\AppData\Local\Temp\392C.tmp"118⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\39B8.tmp"C:\Users\Admin\AppData\Local\Temp\39B8.tmp"119⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\3A26.tmp"C:\Users\Admin\AppData\Local\Temp\3A26.tmp"120⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\3AA3.tmp"C:\Users\Admin\AppData\Local\Temp\3AA3.tmp"121⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\3B2F.tmp"C:\Users\Admin\AppData\Local\Temp\3B2F.tmp"122⤵PID:4376
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-