Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
26/08/2023, 15:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a2cc99614a7394021c8f7773f90d9348_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
a2cc99614a7394021c8f7773f90d9348_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
a2cc99614a7394021c8f7773f90d9348_mafia_JC.exe
-
Size
486KB
-
MD5
a2cc99614a7394021c8f7773f90d9348
-
SHA1
9ffae1aa8a19c9145ee10817939ad5f9176c68dc
-
SHA256
1e2ead20582ec66b8e990b5d578889ae42751e41c4f2aa90b20afcdefaee658f
-
SHA512
8420d8d917b5298ee26b77b4ead006e2d14a9ecca632bb01c63f5af0ddbd30c5272e62c18eb30f32f6e5d4b4b6f7927be07ef0940e63d1953cc909943ef5250b
-
SSDEEP
12288:UU5rCOTeiDVWC6ovFwmhmLk2Wih55YhHBNZ:UUQOJDAoSFhjh55YnN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2960 8E46.tmp 3392 8F6F.tmp 1064 901A.tmp 4664 9114.tmp 872 91D0.tmp 4348 927C.tmp 1612 9347.tmp 4724 93E3.tmp 232 948F.tmp 1884 954B.tmp 3452 96C2.tmp 4404 976D.tmp 4768 97FA.tmp 3448 9896.tmp 1988 9933.tmp 4876 99CF.tmp 3228 9A7B.tmp 4380 9B55.tmp 1500 9C4F.tmp 2656 9CFB.tmp 3040 9DD6.tmp 780 9E63.tmp 4300 9F2E.tmp 2508 9FCA.tmp 4792 A0A5.tmp 3600 A18F.tmp 2932 A27A.tmp 2756 A316.tmp 4160 A3E1.tmp 3468 A49C.tmp 3988 A568.tmp 2664 A5F4.tmp 3252 A6A0.tmp 3336 A71D.tmp 3424 A7F8.tmp 2116 A8A4.tmp 2304 A98E.tmp 5072 A9EC.tmp 376 AB34.tmp 4644 ABB1.tmp 3660 AC2E.tmp 4416 AC9B.tmp 1548 AD18.tmp 836 AD95.tmp 2712 AE22.tmp 1392 AE9F.tmp 3248 AF4B.tmp 4984 B006.tmp 3772 B083.tmp 3592 B110.tmp 4800 B1AC.tmp 4248 B229.tmp 3232 B2C5.tmp 3004 B342.tmp 4492 B3DF.tmp 3944 B45C.tmp 2448 B4E8.tmp 1752 B602.tmp 3736 B68E.tmp 4108 B72A.tmp 1932 B7B7.tmp 432 B853.tmp 1504 B8D0.tmp 4376 B94D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4680 wrote to memory of 2960 4680 a2cc99614a7394021c8f7773f90d9348_mafia_JC.exe 82 PID 4680 wrote to memory of 2960 4680 a2cc99614a7394021c8f7773f90d9348_mafia_JC.exe 82 PID 4680 wrote to memory of 2960 4680 a2cc99614a7394021c8f7773f90d9348_mafia_JC.exe 82 PID 2960 wrote to memory of 3392 2960 8E46.tmp 83 PID 2960 wrote to memory of 3392 2960 8E46.tmp 83 PID 2960 wrote to memory of 3392 2960 8E46.tmp 83 PID 3392 wrote to memory of 1064 3392 8F6F.tmp 84 PID 3392 wrote to memory of 1064 3392 8F6F.tmp 84 PID 3392 wrote to memory of 1064 3392 8F6F.tmp 84 PID 1064 wrote to memory of 4664 1064 901A.tmp 85 PID 1064 wrote to memory of 4664 1064 901A.tmp 85 PID 1064 wrote to memory of 4664 1064 901A.tmp 85 PID 4664 wrote to memory of 872 4664 9114.tmp 86 PID 4664 wrote to memory of 872 4664 9114.tmp 86 PID 4664 wrote to memory of 872 4664 9114.tmp 86 PID 872 wrote to memory of 4348 872 91D0.tmp 87 PID 872 wrote to memory of 4348 872 91D0.tmp 87 PID 872 wrote to memory of 4348 872 91D0.tmp 87 PID 4348 wrote to memory of 1612 4348 927C.tmp 88 PID 4348 wrote to memory of 1612 4348 927C.tmp 88 PID 4348 wrote to memory of 1612 4348 927C.tmp 88 PID 1612 wrote to memory of 4724 1612 9347.tmp 89 PID 1612 wrote to memory of 4724 1612 9347.tmp 89 PID 1612 wrote to memory of 4724 1612 9347.tmp 89 PID 4724 wrote to memory of 232 4724 93E3.tmp 90 PID 4724 wrote to memory of 232 4724 93E3.tmp 90 PID 4724 wrote to memory of 232 4724 93E3.tmp 90 PID 232 wrote to memory of 1884 232 948F.tmp 91 PID 232 wrote to memory of 1884 232 948F.tmp 91 PID 232 wrote to memory of 1884 232 948F.tmp 91 PID 1884 wrote to memory of 3452 1884 954B.tmp 92 PID 1884 wrote to memory of 3452 1884 954B.tmp 92 PID 1884 wrote to memory of 3452 1884 954B.tmp 92 PID 3452 wrote to memory of 4404 3452 96C2.tmp 94 PID 3452 wrote to memory of 4404 3452 96C2.tmp 94 PID 3452 wrote to memory of 4404 3452 96C2.tmp 94 PID 4404 wrote to memory of 4768 4404 976D.tmp 95 PID 4404 wrote to memory of 4768 4404 976D.tmp 95 PID 4404 wrote to memory of 4768 4404 976D.tmp 95 PID 4768 wrote to memory of 3448 4768 97FA.tmp 96 PID 4768 wrote to memory of 3448 4768 97FA.tmp 96 PID 4768 wrote to memory of 3448 4768 97FA.tmp 96 PID 3448 wrote to memory of 1988 3448 9896.tmp 97 PID 3448 wrote to memory of 1988 3448 9896.tmp 97 PID 3448 wrote to memory of 1988 3448 9896.tmp 97 PID 1988 wrote to memory of 4876 1988 9933.tmp 98 PID 1988 wrote to memory of 4876 1988 9933.tmp 98 PID 1988 wrote to memory of 4876 1988 9933.tmp 98 PID 4876 wrote to memory of 3228 4876 99CF.tmp 99 PID 4876 wrote to memory of 3228 4876 99CF.tmp 99 PID 4876 wrote to memory of 3228 4876 99CF.tmp 99 PID 3228 wrote to memory of 4380 3228 9A7B.tmp 100 PID 3228 wrote to memory of 4380 3228 9A7B.tmp 100 PID 3228 wrote to memory of 4380 3228 9A7B.tmp 100 PID 4380 wrote to memory of 1500 4380 9B55.tmp 101 PID 4380 wrote to memory of 1500 4380 9B55.tmp 101 PID 4380 wrote to memory of 1500 4380 9B55.tmp 101 PID 1500 wrote to memory of 2656 1500 9C4F.tmp 102 PID 1500 wrote to memory of 2656 1500 9C4F.tmp 102 PID 1500 wrote to memory of 2656 1500 9C4F.tmp 102 PID 2656 wrote to memory of 3040 2656 9CFB.tmp 103 PID 2656 wrote to memory of 3040 2656 9CFB.tmp 103 PID 2656 wrote to memory of 3040 2656 9CFB.tmp 103 PID 3040 wrote to memory of 780 3040 9DD6.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2cc99614a7394021c8f7773f90d9348_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\a2cc99614a7394021c8f7773f90d9348_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\8E46.tmp"C:\Users\Admin\AppData\Local\Temp\8E46.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\901A.tmp"C:\Users\Admin\AppData\Local\Temp\901A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\9114.tmp"C:\Users\Admin\AppData\Local\Temp\9114.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\91D0.tmp"C:\Users\Admin\AppData\Local\Temp\91D0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\927C.tmp"C:\Users\Admin\AppData\Local\Temp\927C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\948F.tmp"C:\Users\Admin\AppData\Local\Temp\948F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Users\Admin\AppData\Local\Temp\954B.tmp"C:\Users\Admin\AppData\Local\Temp\954B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\96C2.tmp"C:\Users\Admin\AppData\Local\Temp\96C2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\976D.tmp"C:\Users\Admin\AppData\Local\Temp\976D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\97FA.tmp"C:\Users\Admin\AppData\Local\Temp\97FA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\9896.tmp"C:\Users\Admin\AppData\Local\Temp\9896.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\9E63.tmp"C:\Users\Admin\AppData\Local\Temp\9E63.tmp"23⤵
- Executes dropped EXE
PID:780 -
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"24⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"25⤵
- Executes dropped EXE
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"26⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\A18F.tmp"C:\Users\Admin\AppData\Local\Temp\A18F.tmp"27⤵
- Executes dropped EXE
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"28⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"29⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"30⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"31⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"32⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"33⤵
- Executes dropped EXE
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"34⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"35⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"36⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"37⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"38⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"39⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"40⤵
- Executes dropped EXE
PID:376 -
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"41⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"42⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"43⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\AD18.tmp"C:\Users\Admin\AppData\Local\Temp\AD18.tmp"44⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\AD95.tmp"C:\Users\Admin\AppData\Local\Temp\AD95.tmp"45⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"46⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"47⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"48⤵
- Executes dropped EXE
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\B006.tmp"C:\Users\Admin\AppData\Local\Temp\B006.tmp"49⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\B083.tmp"C:\Users\Admin\AppData\Local\Temp\B083.tmp"50⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\B110.tmp"C:\Users\Admin\AppData\Local\Temp\B110.tmp"51⤵
- Executes dropped EXE
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"52⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\B229.tmp"C:\Users\Admin\AppData\Local\Temp\B229.tmp"53⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"54⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\B342.tmp"C:\Users\Admin\AppData\Local\Temp\B342.tmp"55⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"56⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\B45C.tmp"C:\Users\Admin\AppData\Local\Temp\B45C.tmp"57⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"58⤵
- Executes dropped EXE
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\B602.tmp"C:\Users\Admin\AppData\Local\Temp\B602.tmp"59⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\B68E.tmp"C:\Users\Admin\AppData\Local\Temp\B68E.tmp"60⤵
- Executes dropped EXE
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\B72A.tmp"C:\Users\Admin\AppData\Local\Temp\B72A.tmp"61⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"62⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\B853.tmp"C:\Users\Admin\AppData\Local\Temp\B853.tmp"63⤵
- Executes dropped EXE
PID:432 -
C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"64⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\B94D.tmp"C:\Users\Admin\AppData\Local\Temp\B94D.tmp"65⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"66⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\BA47.tmp"C:\Users\Admin\AppData\Local\Temp\BA47.tmp"67⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"68⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\BB61.tmp"C:\Users\Admin\AppData\Local\Temp\BB61.tmp"69⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\BBED.tmp"C:\Users\Admin\AppData\Local\Temp\BBED.tmp"70⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"71⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"72⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\BD35.tmp"C:\Users\Admin\AppData\Local\Temp\BD35.tmp"73⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"74⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\BE20.tmp"C:\Users\Admin\AppData\Local\Temp\BE20.tmp"75⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"76⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"77⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\BF97.tmp"C:\Users\Admin\AppData\Local\Temp\BF97.tmp"78⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\C023.tmp"C:\Users\Admin\AppData\Local\Temp\C023.tmp"79⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"80⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\C11D.tmp"C:\Users\Admin\AppData\Local\Temp\C11D.tmp"81⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\C18B.tmp"C:\Users\Admin\AppData\Local\Temp\C18B.tmp"82⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"83⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"84⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\C38E.tmp"C:\Users\Admin\AppData\Local\Temp\C38E.tmp"85⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"86⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\C534.tmp"C:\Users\Admin\AppData\Local\Temp\C534.tmp"87⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"88⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\C69C.tmp"C:\Users\Admin\AppData\Local\Temp\C69C.tmp"89⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\C728.tmp"C:\Users\Admin\AppData\Local\Temp\C728.tmp"90⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\C796.tmp"C:\Users\Admin\AppData\Local\Temp\C796.tmp"91⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"92⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\C851.tmp"C:\Users\Admin\AppData\Local\Temp\C851.tmp"93⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"94⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\C95B.tmp"C:\Users\Admin\AppData\Local\Temp\C95B.tmp"95⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"96⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\CA74.tmp"C:\Users\Admin\AppData\Local\Temp\CA74.tmp"97⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\CB10.tmp"C:\Users\Admin\AppData\Local\Temp\CB10.tmp"98⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"99⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\CC29.tmp"C:\Users\Admin\AppData\Local\Temp\CC29.tmp"100⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"101⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\CD33.tmp"C:\Users\Admin\AppData\Local\Temp\CD33.tmp"102⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"103⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"104⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"105⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\CF56.tmp"C:\Users\Admin\AppData\Local\Temp\CF56.tmp"106⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\CFE3.tmp"C:\Users\Admin\AppData\Local\Temp\CFE3.tmp"107⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\D07F.tmp"C:\Users\Admin\AppData\Local\Temp\D07F.tmp"108⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"109⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\D188.tmp"C:\Users\Admin\AppData\Local\Temp\D188.tmp"110⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\D234.tmp"C:\Users\Admin\AppData\Local\Temp\D234.tmp"111⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\D2C1.tmp"C:\Users\Admin\AppData\Local\Temp\D2C1.tmp"112⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\D33E.tmp"C:\Users\Admin\AppData\Local\Temp\D33E.tmp"113⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"114⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\D457.tmp"C:\Users\Admin\AppData\Local\Temp\D457.tmp"115⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\D4D4.tmp"C:\Users\Admin\AppData\Local\Temp\D4D4.tmp"116⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\D551.tmp"C:\Users\Admin\AppData\Local\Temp\D551.tmp"117⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\D5CE.tmp"C:\Users\Admin\AppData\Local\Temp\D5CE.tmp"118⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\D66A.tmp"C:\Users\Admin\AppData\Local\Temp\D66A.tmp"119⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\D6E7.tmp"C:\Users\Admin\AppData\Local\Temp\D6E7.tmp"120⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\D755.tmp"C:\Users\Admin\AppData\Local\Temp\D755.tmp"121⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\D7F1.tmp"C:\Users\Admin\AppData\Local\Temp\D7F1.tmp"122⤵PID:4348
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-