Analysis
-
max time kernel
150s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
20/08/2023, 09:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4c83ffee96520144afd0a15d97c9aac8_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
4c83ffee96520144afd0a15d97c9aac8_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
4c83ffee96520144afd0a15d97c9aac8_mafia_JC.exe
-
Size
486KB
-
MD5
4c83ffee96520144afd0a15d97c9aac8
-
SHA1
9d80f72c5b90493ef778366438529b176026e22d
-
SHA256
5c79869ae99245d1a7fc01f972df312c106b4149980720cef5178907fd8255c7
-
SHA512
6cc5f92099b777c39413fe6184d129a9c511de00b800af37ff4e2857e335b5056ceaaac32a457b05b762776eec7b8d1346bfc3cc340919deb48c02160e869e24
-
SSDEEP
6144:Forf3lPvovsgZnqG2C7mOTeiLfD7jhXk+aCDkja4d0GhFdlfX5+/o3clXc7FFmxb:UU5rCOTeiDFkjaahFHB+/o3OkFxCNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3796 A299.tmp 2744 A79A.tmp 432 A846.tmp 3440 A940.tmp 2720 A9BD.tmp 2472 AA69.tmp 3496 AB15.tmp 4032 ABD0.tmp 4120 AC7C.tmp 4616 AD28.tmp 4776 ADF3.tmp 4712 AEBE.tmp 3580 AFA9.tmp 1380 B17D.tmp 2652 B229.tmp 5008 B2F4.tmp 4940 B3DF.tmp 1656 B4AA.tmp 840 B575.tmp 1872 B650.tmp 1304 B71B.tmp 1384 B7C7.tmp 1372 B892.tmp 4372 B92E.tmp 2664 B9AB.tmp 1240 BAB5.tmp 3284 BB70.tmp 1712 BC2C.tmp 4208 BCE7.tmp 3808 BDC2.tmp 4528 BE9D.tmp 548 BF49.tmp 4100 C033.tmp 1784 C0C0.tmp 4684 C14C.tmp 4216 C1C9.tmp 3972 C265.tmp 3956 C2F2.tmp 4052 C37F.tmp 1072 C3FC.tmp 4336 C488.tmp 5072 C505.tmp 2960 C592.tmp 1672 C60F.tmp 1564 C6BB.tmp 1188 C757.tmp 2424 C7F3.tmp 940 C870.tmp 1468 C8ED.tmp 2036 C999.tmp 4328 CA26.tmp 3752 CAE1.tmp 4540 CB7E.tmp 512 CBFB.tmp 4600 CCA6.tmp 2172 CD52.tmp 1320 CDCF.tmp 2176 CE6C.tmp 2692 CF08.tmp 1260 CF66.tmp 2392 CFE3.tmp 2144 D040.tmp 2000 D0BD.tmp 4300 D14A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4772 wrote to memory of 3796 4772 4c83ffee96520144afd0a15d97c9aac8_mafia_JC.exe 82 PID 4772 wrote to memory of 3796 4772 4c83ffee96520144afd0a15d97c9aac8_mafia_JC.exe 82 PID 4772 wrote to memory of 3796 4772 4c83ffee96520144afd0a15d97c9aac8_mafia_JC.exe 82 PID 3796 wrote to memory of 2744 3796 A299.tmp 83 PID 3796 wrote to memory of 2744 3796 A299.tmp 83 PID 3796 wrote to memory of 2744 3796 A299.tmp 83 PID 2744 wrote to memory of 432 2744 A79A.tmp 84 PID 2744 wrote to memory of 432 2744 A79A.tmp 84 PID 2744 wrote to memory of 432 2744 A79A.tmp 84 PID 432 wrote to memory of 3440 432 A846.tmp 85 PID 432 wrote to memory of 3440 432 A846.tmp 85 PID 432 wrote to memory of 3440 432 A846.tmp 85 PID 3440 wrote to memory of 2720 3440 A940.tmp 86 PID 3440 wrote to memory of 2720 3440 A940.tmp 86 PID 3440 wrote to memory of 2720 3440 A940.tmp 86 PID 2720 wrote to memory of 2472 2720 A9BD.tmp 87 PID 2720 wrote to memory of 2472 2720 A9BD.tmp 87 PID 2720 wrote to memory of 2472 2720 A9BD.tmp 87 PID 2472 wrote to memory of 3496 2472 AA69.tmp 88 PID 2472 wrote to memory of 3496 2472 AA69.tmp 88 PID 2472 wrote to memory of 3496 2472 AA69.tmp 88 PID 3496 wrote to memory of 4032 3496 AB15.tmp 90 PID 3496 wrote to memory of 4032 3496 AB15.tmp 90 PID 3496 wrote to memory of 4032 3496 AB15.tmp 90 PID 4032 wrote to memory of 4120 4032 ABD0.tmp 91 PID 4032 wrote to memory of 4120 4032 ABD0.tmp 91 PID 4032 wrote to memory of 4120 4032 ABD0.tmp 91 PID 4120 wrote to memory of 4616 4120 AC7C.tmp 92 PID 4120 wrote to memory of 4616 4120 AC7C.tmp 92 PID 4120 wrote to memory of 4616 4120 AC7C.tmp 92 PID 4616 wrote to memory of 4776 4616 AD28.tmp 93 PID 4616 wrote to memory of 4776 4616 AD28.tmp 93 PID 4616 wrote to memory of 4776 4616 AD28.tmp 93 PID 4776 wrote to memory of 4712 4776 ADF3.tmp 94 PID 4776 wrote to memory of 4712 4776 ADF3.tmp 94 PID 4776 wrote to memory of 4712 4776 ADF3.tmp 94 PID 4712 wrote to memory of 3580 4712 AEBE.tmp 95 PID 4712 wrote to memory of 3580 4712 AEBE.tmp 95 PID 4712 wrote to memory of 3580 4712 AEBE.tmp 95 PID 3580 wrote to memory of 1380 3580 AFA9.tmp 96 PID 3580 wrote to memory of 1380 3580 AFA9.tmp 96 PID 3580 wrote to memory of 1380 3580 AFA9.tmp 96 PID 1380 wrote to memory of 2652 1380 B17D.tmp 97 PID 1380 wrote to memory of 2652 1380 B17D.tmp 97 PID 1380 wrote to memory of 2652 1380 B17D.tmp 97 PID 2652 wrote to memory of 5008 2652 B229.tmp 100 PID 2652 wrote to memory of 5008 2652 B229.tmp 100 PID 2652 wrote to memory of 5008 2652 B229.tmp 100 PID 5008 wrote to memory of 4940 5008 B2F4.tmp 101 PID 5008 wrote to memory of 4940 5008 B2F4.tmp 101 PID 5008 wrote to memory of 4940 5008 B2F4.tmp 101 PID 4940 wrote to memory of 1656 4940 B3DF.tmp 102 PID 4940 wrote to memory of 1656 4940 B3DF.tmp 102 PID 4940 wrote to memory of 1656 4940 B3DF.tmp 102 PID 1656 wrote to memory of 840 1656 B4AA.tmp 103 PID 1656 wrote to memory of 840 1656 B4AA.tmp 103 PID 1656 wrote to memory of 840 1656 B4AA.tmp 103 PID 840 wrote to memory of 1872 840 B575.tmp 104 PID 840 wrote to memory of 1872 840 B575.tmp 104 PID 840 wrote to memory of 1872 840 B575.tmp 104 PID 1872 wrote to memory of 1304 1872 B650.tmp 106 PID 1872 wrote to memory of 1304 1872 B650.tmp 106 PID 1872 wrote to memory of 1304 1872 B650.tmp 106 PID 1304 wrote to memory of 1384 1304 B71B.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c83ffee96520144afd0a15d97c9aac8_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\4c83ffee96520144afd0a15d97c9aac8_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\A299.tmp"C:\Users\Admin\AppData\Local\Temp\A299.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\A940.tmp"C:\Users\Admin\AppData\Local\Temp\A940.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\AA69.tmp"C:\Users\Admin\AppData\Local\Temp\AA69.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\AB15.tmp"C:\Users\Admin\AppData\Local\Temp\AB15.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\B17D.tmp"C:\Users\Admin\AppData\Local\Temp\B17D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\B229.tmp"C:\Users\Admin\AppData\Local\Temp\B229.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\B575.tmp"C:\Users\Admin\AppData\Local\Temp\B575.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\B650.tmp"C:\Users\Admin\AppData\Local\Temp\B650.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\B71B.tmp"C:\Users\Admin\AppData\Local\Temp\B71B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"23⤵
- Executes dropped EXE
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\B892.tmp"C:\Users\Admin\AppData\Local\Temp\B892.tmp"24⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"25⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"26⤵
- Executes dropped EXE
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"27⤵
- Executes dropped EXE
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\BB70.tmp"C:\Users\Admin\AppData\Local\Temp\BB70.tmp"28⤵
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"29⤵
- Executes dropped EXE
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"30⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"31⤵
- Executes dropped EXE
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"32⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\BF49.tmp"C:\Users\Admin\AppData\Local\Temp\BF49.tmp"33⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"34⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"35⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"36⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"37⤵
- Executes dropped EXE
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"38⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"39⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\C37F.tmp"C:\Users\Admin\AppData\Local\Temp\C37F.tmp"40⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"41⤵
- Executes dropped EXE
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\C488.tmp"C:\Users\Admin\AppData\Local\Temp\C488.tmp"42⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\C505.tmp"C:\Users\Admin\AppData\Local\Temp\C505.tmp"43⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\C592.tmp"C:\Users\Admin\AppData\Local\Temp\C592.tmp"44⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\C60F.tmp"C:\Users\Admin\AppData\Local\Temp\C60F.tmp"45⤵
- Executes dropped EXE
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"46⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\C757.tmp"C:\Users\Admin\AppData\Local\Temp\C757.tmp"47⤵
- Executes dropped EXE
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"48⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\C870.tmp"C:\Users\Admin\AppData\Local\Temp\C870.tmp"49⤵
- Executes dropped EXE
PID:940 -
C:\Users\Admin\AppData\Local\Temp\C8ED.tmp"C:\Users\Admin\AppData\Local\Temp\C8ED.tmp"50⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\C999.tmp"C:\Users\Admin\AppData\Local\Temp\C999.tmp"51⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\CA26.tmp"C:\Users\Admin\AppData\Local\Temp\CA26.tmp"52⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"53⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"54⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"55⤵
- Executes dropped EXE
PID:512 -
C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"56⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\CD52.tmp"C:\Users\Admin\AppData\Local\Temp\CD52.tmp"57⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"58⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"59⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\CF08.tmp"C:\Users\Admin\AppData\Local\Temp\CF08.tmp"60⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\CF66.tmp"C:\Users\Admin\AppData\Local\Temp\CF66.tmp"61⤵
- Executes dropped EXE
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\CFE3.tmp"C:\Users\Admin\AppData\Local\Temp\CFE3.tmp"62⤵
- Executes dropped EXE
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\D040.tmp"C:\Users\Admin\AppData\Local\Temp\D040.tmp"63⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"64⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\D14A.tmp"C:\Users\Admin\AppData\Local\Temp\D14A.tmp"65⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\D1D7.tmp"C:\Users\Admin\AppData\Local\Temp\D1D7.tmp"66⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\D254.tmp"C:\Users\Admin\AppData\Local\Temp\D254.tmp"67⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"68⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\D34E.tmp"C:\Users\Admin\AppData\Local\Temp\D34E.tmp"69⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\D3DA.tmp"C:\Users\Admin\AppData\Local\Temp\D3DA.tmp"70⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\D448.tmp"C:\Users\Admin\AppData\Local\Temp\D448.tmp"71⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\D4B5.tmp"C:\Users\Admin\AppData\Local\Temp\D4B5.tmp"72⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\D513.tmp"C:\Users\Admin\AppData\Local\Temp\D513.tmp"73⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\D580.tmp"C:\Users\Admin\AppData\Local\Temp\D580.tmp"74⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\D61C.tmp"C:\Users\Admin\AppData\Local\Temp\D61C.tmp"75⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\D6A9.tmp"C:\Users\Admin\AppData\Local\Temp\D6A9.tmp"76⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\D726.tmp"C:\Users\Admin\AppData\Local\Temp\D726.tmp"77⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"78⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\D84F.tmp"C:\Users\Admin\AppData\Local\Temp\D84F.tmp"79⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"80⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\D949.tmp"C:\Users\Admin\AppData\Local\Temp\D949.tmp"81⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"82⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\DA33.tmp"C:\Users\Admin\AppData\Local\Temp\DA33.tmp"83⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\DAB0.tmp"C:\Users\Admin\AppData\Local\Temp\DAB0.tmp"84⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"85⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"86⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\DC18.tmp"C:\Users\Admin\AppData\Local\Temp\DC18.tmp"87⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\DC85.tmp"C:\Users\Admin\AppData\Local\Temp\DC85.tmp"88⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\DCD3.tmp"C:\Users\Admin\AppData\Local\Temp\DCD3.tmp"89⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\DD60.tmp"C:\Users\Admin\AppData\Local\Temp\DD60.tmp"90⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\DDEC.tmp"C:\Users\Admin\AppData\Local\Temp\DDEC.tmp"91⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\DE4A.tmp"C:\Users\Admin\AppData\Local\Temp\DE4A.tmp"92⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\DED7.tmp"C:\Users\Admin\AppData\Local\Temp\DED7.tmp"93⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\DF44.tmp"C:\Users\Admin\AppData\Local\Temp\DF44.tmp"94⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"95⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\E05D.tmp"C:\Users\Admin\AppData\Local\Temp\E05D.tmp"96⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"97⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\E157.tmp"C:\Users\Admin\AppData\Local\Temp\E157.tmp"98⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\E1D4.tmp"C:\Users\Admin\AppData\Local\Temp\E1D4.tmp"99⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\E261.tmp"C:\Users\Admin\AppData\Local\Temp\E261.tmp"100⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\E2EE.tmp"C:\Users\Admin\AppData\Local\Temp\E2EE.tmp"101⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\E36B.tmp"C:\Users\Admin\AppData\Local\Temp\E36B.tmp"102⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"103⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\E445.tmp"C:\Users\Admin\AppData\Local\Temp\E445.tmp"104⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\E4E2.tmp"C:\Users\Admin\AppData\Local\Temp\E4E2.tmp"105⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\E57E.tmp"C:\Users\Admin\AppData\Local\Temp\E57E.tmp"106⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"107⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\E697.tmp"C:\Users\Admin\AppData\Local\Temp\E697.tmp"108⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\E733.tmp"C:\Users\Admin\AppData\Local\Temp\E733.tmp"109⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"110⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\E84D.tmp"C:\Users\Admin\AppData\Local\Temp\E84D.tmp"111⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"112⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\E937.tmp"C:\Users\Admin\AppData\Local\Temp\E937.tmp"113⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"114⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\EA50.tmp"C:\Users\Admin\AppData\Local\Temp\EA50.tmp"115⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\EACD.tmp"C:\Users\Admin\AppData\Local\Temp\EACD.tmp"116⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\EB3B.tmp"C:\Users\Admin\AppData\Local\Temp\EB3B.tmp"117⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\EBC7.tmp"C:\Users\Admin\AppData\Local\Temp\EBC7.tmp"118⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\EC44.tmp"C:\Users\Admin\AppData\Local\Temp\EC44.tmp"119⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"120⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"121⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\EDDA.tmp"C:\Users\Admin\AppData\Local\Temp\EDDA.tmp"122⤵PID:2888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-